<p>I'm facing a strange issue in my K8S cluster</p>
<p>Basically I have 2 application:</p>
<ul>
<li>identity manager (WSO2 IS based but the issue is not related to WSO2)</li>
<li>external SAML2 IDP that will manage X509 authentication</li>
</ul>
<p>I configured WSO2 in order to use this external SAML2 IDP</p>
<p>When I try to login by X509, WSO2 shows me the login page, i click on smartcard and a redirect is done to the external SAML IDP.</p>
<p>In this case the nginx ingress gives to me 502 bad gateway. If I copy the URL, close the browser and try again to access directly to the X509 IDP, all works pretty good.</p>
<p>Note that I'm using another external SAML IDP and in this case the redirect is working pretty good</p>
<p>The difference between the 2 external IDP is that I configured the ingress controller of X509 SAML IDP in pass-through because I need that X509 certificare is consumed by my Java application</p>
<p>May, anybody, tell me why I'm having this strange behaviour?</p>
<p>Thank you</p>
<p>Angelo</p>
<p><strong>UPDATE</strong>
Here you can find my <strong><code>nginx.conf</code></strong> <a href="https://raw.githubusercontent.com/angeloimm/nginx_configuration/main/nginx.conf" rel="noreferrer">https://raw.githubusercontent.com/angeloimm/nginx_configuration/main/nginx.conf</a></p>
<p>This is my <strong><code>ingress.yaml</code></strong></p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: eid-tls-ingress
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /eid-tsl/
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
spec:
  tls:
    - hosts:
        - login-cns-test.it
  rules:
  - host: login-cns-test.it
    http:
      paths:
      - path: /
        backend:
          serviceName: eid-tls-service
          servicePort: 443
</code></pre>
<p><strong>UPDATE 2</strong></p>
<p>This is my scenario:
<a href="https://i.stack.imgur.com/GHdks.png" rel="noreferrer"><img src="https://i.stack.imgur.com/GHdks.png" alt="enter image description here" /></a></p>
<p>As you can see all http/s requests from internet are intercepted by my customer balancer (<strong>Balancer cloud vmware nsx</strong>) this balancer routes the requests to the worker nodes.</p>
<p>On worker nodes I have my eid-tls-service; it's a default type service (clusterIP type) so I need the ingress controller in order to handle request.</p>
<p>The only important thing (at least I think) is that I need a <strong>passthrough</strong> configuration. So I confogured my K8S and my nginx controller by using passthrough. No configuration has been done on Balancer cloud vmware nsx</p>
<p>In fact I need that the X509 certficate is not consumed by Ingress Controller but it must arrive directly to my application (to my service).</p>
<p>I have just 1 replica of my service.</p>
<p>This is my service yaml config:</p>
<pre><code>kind: Service
apiVersion: v1
metadata:
  name: eid-tls-service
spec:
  selector:
    app: eid-tls
  ports:
  - protocol: TCP
    name: https-port
    port: 443
    targetPort: 443
</code></pre>
<p>From kubectl this is my eid-tls-service describe:</p>
<pre><code>Name: eid-tls-service
Namespace: eid-tls-idp-ns
Labels: &lt;none&gt;
Annotations: Selector: app=eid-tls
Type: ClusterIP
IP: xx.ss.z.ttt
Port: https-port 443/TCP
TargetPort: 443/TCP
Endpoints: xx.yy.z.www:443
Session Affinity: None
Events: &lt;none&gt;
</code></pre>
<p>This is my ingress controller log error:</p>
<p><code>2021/01/28 11:24:06 [error] 3210#3210: *78115978 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42) while SSL handshaking to upstream, client: 127.0.0.1, server:</code></p>
<p>What I really can't understand is why if I copy the URL, close the browser (by cleaning all cookies and files) and I paste the copied URL all works good (certificate is consumed by my java application)</p>

Angelo Immediata
<p>I guess I found the reason for this behaviour. Basically it's happening the following:</p>
<ul>
<li>a HTTP request is handled by my IAM by using SSL connection</li>
<li>a redirect is made from my IAM to my X509 IAM living inside the saml
K8S cluster.</li>
</ul>
<p>My X509 IAM ingress controller is configured in pass-through.
On step 2 the SSL connection is terminated and handled by my pod, K8S ingress controller tries to use SSL connection during the redirect and so the flow is compromised.</p>
<p>If I copy and paste the URL, I don't start a SSL connection on my IAM but I directly go to the X509 IAM so no redirect is done.</p>
<p>Basically I think I can't follow my approach so what I did is change the <code>ingress.yaml</code> definition in this way:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: eid-tls-ingress
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/configuration-snippet: &quot;proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;&quot;
    nginx.ingress.kubernetes.io/server-snippet: &quot;ssl_verify_client optional_no_ca;&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
spec:
  tls:
    - hosts:
        - login-cns-test.it
  rules:
  - host: login-cns-test.it
    http:
      paths:
      - path: /
        backend:
          serviceName: eid-tls-service
          servicePort: 443
</code></pre>
<p>I configured the ingress controller in way that the cetificate is passed to the backend application in a HTTP request header. Now it seems to be all pretty working.</p>
<p>Thank to all you</p>
