0

Does anyone here have a successful Sharepoint------> HAProxy setup ? In addition the HAProxy is also doing SSL offloading.

I have been able to get it to work and I can access the site collection but when I started clicking around other areas of the site is when I noticed some renderings do not occur. I opened up the Console debugger and I see some interesting errors.

"Access to XMLHttpRequest at 'http://example.domain.com' from origin 'https://example.domain.com' has been blocked by CORS policy. I also see some 401 Unauthorized errors. 'Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.'

So has anyone setup a 100% working Sharepoint to HAProxy SSL offloading ?

Let me know if you need any more information

5
  • 1
    Is there a reason you're using SSL Offloading? It's insecure and doesn't bring much benefit beyond certificate management. I use HAProxy in TCP mode which works great.
    – user6024
    Sep 16, 2019 at 1:24
  • Certificate Management. I have several services in the back-end and having one location as a proxy helps with this. Question: How is SSL offloading insecure ? Sep 16, 2019 at 11:18
  • OAuth tokens, used for SharePoint Addins, WFM, OOS, and others relies on transport security. By transitioning the connection from HTTPS to HTTP, you remove the transport security. The OAuth tokens can be intercepted and replayed. I wrote about this here: thesharepointfarm.com/2014/09/dangers-allowhttp-sharepoint
    – user6024
    Sep 16, 2019 at 14:16
  • Hello, That is understandable. What I have done is what you suggested and put HAProxy in TCP mode and now I am just doing SSL passthrough. And now everything is working. My question now is: How can I handle certificate management ? Since now a certificate will have to be installed on various servers Sep 16, 2019 at 16:52
  • Windows doesn't have anything built-in. There are various services which provide cert management, from PoSh to agent-based solutions, to DevOps solutions like Ansible (docs.ansible.com/ansible/latest/modules/…).
    – user6024
    Sep 16, 2019 at 16:54

1 Answer 1

0

As suggested by @Trevor Seward By putting HAProxy into TCP Mode and letting the back-end server handle the Encryption/decryption. This resovled my issue

Although the original question still stands as Im sure someone will want to know how to make it work with HAProxy doing SSL offloading.

Thank You

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.