title: HAProxy https on Openshift ends in redirect loop on non-local gears
body: <p>I have a Tomcat 7 (JBoss EWS 2.0) app with HAProxy Web Load Balancer. Https works fine when there is only one server running but as soon as I add another one (by setting minimum number of gears to 2), a problem occurs.</p>
  
  <p>I have checked out the GEAR cookie when connecting and as soon as it is the local gear <code>local-569aaabf0c1e661db1000004</code> the connection is established, but the <code>569aadaa89f5cff3c9000058-petrfox</code> GEAR cookie makes trouble.</p>
  
  <p>The problem is that every attempt to connect, which is redirected (by the load balancer) to the newly started gear, ends in 302 redirect loop (by accessing <a href="https://dftestapp-petrfox.rhcloud.com/" rel="nofollow">https://dftestapp-petrfox.rhcloud.com/</a> I get 302 with header Location:<a href="https://dftestapp-petrfox.rhcloud.com/" rel="nofollow">https://dftestapp-petrfox.rhcloud.com/</a>).</p>
  
  <p>You can try it on the link above - if the page loads, just remove the GEAR cookie and refresh, you will be most probably redirected to the other one gear this time.</p>
  
  <p>Generated HAProxy configuration (haproxy.cfg) is</p>
  
  <pre><code>#---------------------------------------------------------------------
  # Example configuration for a possible web application.  See the
  # full configuration options online.
  #
  #   http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
  #
  #---------------------------------------------------------------------
  
  #---------------------------------------------------------------------
  # Global settings
  #---------------------------------------------------------------------
  global
  # to have these messages end up in /var/log/haproxy.log you will
  # need to:
  #
  # 1) configure syslog to accept network log events.  This is done
  #    by adding the '-r' option to the SYSLOGD_OPTIONS in
  #    /etc/sysconfig/syslog
  #
  # 2) configure local2 events to go to the /var/log/haproxy.log
  #   file. A line like the following can be added to
  #   /etc/sysconfig/syslog
  #
  #    local2.*                       /var/log/haproxy.log
  #
  #log         127.0.0.1 local2
  
  maxconn     256
  
  # turn on stats unix socket
  stats socket /var/lib/openshift/569aaabf0c1e661db1000004/haproxy//run/stats level admin
  
  #---------------------------------------------------------------------
  # common defaults that all the 'listen' and 'backend' sections will
  # use if not designated in their block
  #---------------------------------------------------------------------
  defaults
  mode                    http
  log                     global
  option                  httplog
  option                  dontlognull
  option http-server-close
  #option forwardfor       except 127.0.0.0/8
  option                  redispatch
  retries                 3
  timeout http-request    10s
  timeout queue           1m
  timeout connect         10s
  timeout client          1m
  timeout server          1m
  timeout http-keep-alive 10s
  timeout check           10s
  maxconn                 128
  
  listen stats 127.7.244.3:8080
  mode http
  stats enable
  stats uri /
  
  listen express 127.7.244.2:8080
  
  cookie GEAR insert indirect nocache
  option httpchk GET /
  http-check expect rstatus 2..|3..|401
  
  balance leastconn
  server gear-569aadaa89f5cff3c9000058-petrfox ex-std-node827.prod.rhcloud.com:56761 check fall 2 rise 3 inter 2000 cookie 569aadaa89f5cff3c9000058-petrfox
  server local-gear 127.7.244.1:8080 check fall 2 rise 3 inter 2000 cookie local-569aaabf0c1e661db1000004
  </code></pre>
  
  <p>I tried to turn off forcing https in my app (by removing <code>&lt;intercept-url pattern="/**" requires-channel="https"/&gt;</code> in applicationContext-security.xml), used just http and it worked. Therefore I assume there must be some more https configuration needed. But my question is where and what do I need to configure? I find it strange that it doesn't work with the generated configuration, because load balancing is something why one chooses Openshift and https is in some circumstances a must have. It is also strange to me that everything goes well when you are redirected to the local-gear.</p>
  
  <p>I didn't find any material which would be any of help. Could you please help me with this problem?</p>
  
  <p><strong>UPDATE:</strong> I don't know where the problem is, but it could be in settings of the server. Here is the config file server.xml (which I had never changed)</p>
  
  <pre><code>&lt;?xml version='1.0' encoding='utf-8'?&gt;
  &lt;!--
    Licensed to the Apache Software Foundation (ASF) under one or more
    contributor license agreements.  See the NOTICE file distributed with
    this work for additional information regarding copyright ownership.
    The ASF licenses this file to You under the Apache License, Version 2.0
    (the "License"); you may not use this file except in compliance with
    the License.  You may obtain a copy of the License at
  
        http://www.apache.org/licenses/LICENSE-2.0
  
    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
  --&gt;
  &lt;!-- Note:  A "Server" is not itself a "Container", so you may not
       define subcomponents such as "Valves" at this level.
       Documentation at /docs/config/server.html
   --&gt;
  &lt;Server port="-1" shutdown="SHUTDOWN"&gt;
    &lt;!-- Security listener. Documentation at /docs/config/listeners.html
    &lt;Listener className="org.apache.catalina.security.SecurityListener" /&gt;
    --&gt;
    &lt;!--APR library loader. Documentation at /docs/apr.html --&gt;
    &lt;Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /&gt;
    &lt;!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html --&gt;
    &lt;Listener className="org.apache.catalina.core.JasperListener" /&gt;
    &lt;!-- Prevent memory leaks due to use of particular java/javax APIs--&gt;
    &lt;Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /&gt;
    &lt;Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /&gt;
    &lt;Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /&gt;
  
    &lt;!-- Global JNDI resources
         Documentation at /docs/jndi-resources-howto.html
    --&gt;
    &lt;GlobalNamingResources&gt;
      &lt;!-- Editable user database that can also be used by
           UserDatabaseRealm to authenticate users
      --&gt;
      &lt;Resource name="UserDatabase" auth="Container"
                type="org.apache.catalina.UserDatabase"
                description="User database that can be updated and saved"
                factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
                pathname="conf/tomcat-users.xml" /&gt;
    &lt;/GlobalNamingResources&gt;
  
    &lt;!-- A "Service" is a collection of one or more "Connectors" that share
         a single "Container" Note:  A "Service" is not itself a "Container",
         so you may not define subcomponents such as "Valves" at this level.
         Documentation at /docs/config/service.html
     --&gt;
    &lt;Service name="Catalina"&gt;
  
      &lt;!--The connectors can use a shared executor, you can define one or more named thread pools--&gt;
      &lt;!--
      &lt;Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
          maxThreads="150" minSpareThreads="4"/&gt;
      --&gt;
  
  
      &lt;!-- A "Connector" represents an endpoint by which requests are received
           and responses are returned. Documentation at :
           Java HTTP Connector: /docs/config/http.html (blocking &amp; non-blocking)
           Java AJP  Connector: /docs/config/ajp.html
           APR (HTTP/AJP) Connector: /docs/apr.html
           Define a non-SSL HTTP/1.1 Connector on port 8080
      --&gt;
      &lt;Connector address="${OPENSHIFT_JBOSSEWS_IP}"
                 port="${OPENSHIFT_JBOSSEWS_HTTP_PORT}"
                 protocol="HTTP/1.1"
                 connectionTimeout="20000"
                 redirectPort="8443"/&gt;
  
      &lt;!-- A "Connector" using the shared thread pool--&gt;
      &lt;!--
      &lt;Connector executor="tomcatThreadPool"
                 port="8080" protocol="HTTP/1.1"
                 connectionTimeout="20000"
                 redirectPort="8443" /&gt;
      --&gt;
      &lt;!-- Define a SSL HTTP/1.1 Connector on port 8443
           This connector uses the JSSE configuration, when using APR, the
           connector should be using the OpenSSL style configuration
           described in the APR documentation --&gt;
      &lt;!--
      &lt;Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
                 maxThreads="150" scheme="https" secure="true"
                 clientAuth="false" sslProtocol="TLS" /&gt;
      --&gt;
  
      &lt;!-- Define an AJP 1.3 Connector on port 8009 --&gt;
      &lt;!--Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /--&gt;
  
  
      &lt;!-- An Engine represents the entry point (within Catalina) that processes
           every request.  The Engine implementation for Tomcat stand alone
           analyzes the HTTP headers included with the request, and passes them
           on to the appropriate Host (virtual host).
           Documentation at /docs/config/engine.html --&gt;
  
      &lt;!-- You should set jvmRoute to support load-balancing via AJP ie :
      &lt;Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1"&gt;
      --&gt;
      &lt;Engine name="Catalina" defaultHost="localhost"&gt;
  
        &lt;!--For clustering, please take a look at documentation at:
            /docs/cluster-howto.html  (simple how to)
            /docs/config/cluster.html (reference documentation) --&gt;
        &lt;!--
        &lt;Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/&gt;
        --&gt;
  
        &lt;!-- Use the LockOutRealm to prevent attempts to guess user passwords
             via a brute-force attack --&gt;
        &lt;Realm className="org.apache.catalina.realm.LockOutRealm"&gt;
          &lt;!-- This Realm uses the UserDatabase configured in the global JNDI
               resources under the key "UserDatabase".  Any edits
               that are performed against this UserDatabase are immediately
               available for use by the Realm.  --&gt;
          &lt;Realm className="org.apache.catalina.realm.UserDatabaseRealm"
                 resourceName="UserDatabase"/&gt;
        &lt;/Realm&gt;
  
        &lt;Host name="localhost"  appBase="webapps"
              unpackWARs="false" autoDeploy="true"&gt;
  
          &lt;!-- SingleSignOn valve, share authentication between web applications
               Documentation at: /docs/config/valve.html --&gt;
          &lt;!--
          &lt;Valve className="org.apache.catalina.authenticator.SingleSignOn" /&gt;
          --&gt;
  
          &lt;!-- RemoteIp valve, pass protocol header from proxy. -
              http://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/valves/RemoteIpValve.html
          --&gt;
  
          &lt;Valve
            className="org.apache.catalina.valves.RemoteIpValve"
            protocolHeader="x-forwarded-proto"
          /&gt;
  
          &lt;!-- Access log processes all example.
               Documentation at: /docs/config/valve.html
               Note: The pattern used is equivalent to using pattern="common" --&gt;
          &lt;!--
          &lt;Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                 prefix="localhost_access_log." suffix=".txt"
                 pattern="%h %l %u %t &amp;quot;%r&amp;quot; %s %b" /&gt;
          --&gt;
        &lt;/Host&gt;
      &lt;/Engine&gt;
    &lt;/Service&gt;
  &lt;/Server&gt;
  </code></pre>