15107: Merge branch 'master' into 15107-rails-bad-redirect

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tclegg@veritasgenetics.com>

diff --git a/lib/controller/railsproxy/railsproxy.go b/lib/controller/railsproxy/railsproxy.go
index 54257cffc57d9a84eb946b73f3704607c1b9c45e..ba1c323ba67a377e7eabc40be6eb5fa4762ef381 100644 (file)
--- a/lib/controller/railsproxy/railsproxy.go
+++ b/lib/controller/railsproxy/railsproxy.go
@@ -8,7 +8,6 @@ package railsproxy
 
 import (
        "fmt"
-       "net/http"
        "net/url"
        "strings"
 
@@ -38,10 +37,5 @@ func NewConn(cluster *arvados.Cluster) *rpc.Conn {
        if err != nil {
                panic(err)
        }
-       conn := rpc.NewConn(cluster.ClusterID, url, insecure, rpc.PassthroughTokenProvider)
-       // If Rails is running with force_ssl=true, this
-       // "X-Forwarded-Proto: https" header prevents it from
-       // redirecting our internal request to an invalid https URL.
-       conn.SendHeader = http.Header{"X-Forwarded-Proto": []string{"https"}}
-       return conn
+       return rpc.NewConn(cluster.ClusterID, url, insecure, rpc.PassthroughTokenProvider)
 }

diff --git a/lib/controller/rpc/conn_test.go b/lib/controller/rpc/conn_test.go
index 80e90a043f23e66c85d2c49f49280de84a061ee8..7a5403e930edb3ec197191d6319487a7ae2f5eda 100644 (file)
--- a/lib/controller/rpc/conn_test.go
+++ b/lib/controller/rpc/conn_test.go
@@ -36,10 +36,21 @@ func (s *RPCSuite) SetUpTest(c *check.C) {
        ctx := ctxlog.Context(context.Background(), ctxlog.TestLogger(c))
        s.ctx = context.WithValue(ctx, contextKeyTestTokens, []string{arvadostest.ActiveToken})
        s.conn = NewConn("zzzzz", &url.URL{Scheme: "https", Host: os.Getenv("ARVADOS_TEST_API_HOST")}, true, func(ctx context.Context) ([]string, error) {
-               return ctx.Value(contextKeyTestTokens).([]string), nil
+               tokens, _ := ctx.Value(contextKeyTestTokens).([]string)
+               return tokens, nil
        })
 }
 
+func (s *RPCSuite) TestLogin(c *check.C) {
+       s.ctx = context.Background()
+       opts := arvados.LoginOptions{
+               ReturnTo: "https://foo.example.com/bar",
+       }
+       resp, err := s.conn.Login(s.ctx, opts)
+       c.Check(err, check.IsNil)
+       c.Check(resp.RedirectLocation, check.Equals, "/auth/joshid?return_to="+url.QueryEscape(","+opts.ReturnTo))
+}
+
 func (s *RPCSuite) TestCollectionCreate(c *check.C) {
        coll, err := s.conn.CollectionCreate(s.ctx, arvados.CreateOptions{Attrs: map[string]interface{}{
                "owner_uuid":         arvadostest.ActiveUserUUID,

diff --git a/services/api/config/application.rb b/services/api/config/application.rb
index 9a4270ad9df4384d88c97cf100ae83790a1a35ba..f211ec9e0cde5c67160bda1bde97e20cdb7861a8 100644 (file)
--- a/services/api/config/application.rb
+++ b/services/api/config/application.rb
@@ -76,6 +76,11 @@ module Server
 
     config.action_dispatch.perform_deep_munge = false
 
+    # force_ssl's redirect-to-https feature doesn't work when the
+    # client supplies a port number, and prevents arvados-controller
+    # from connecting to Rails internally via plain http.
+    config.ssl_options = {redirect: false}
+
     I18n.enforce_available_locales = false
 
     # Before using the filesystem backend for Rails.cache, check