# Configure the Reverse Proxy

The following sections provide configuration examples for using different reverse proxy servers.

## Apache 2

Apache 2 is a free open source Web server that you can configure as a reverse proxy by using the `mod_proxy` module.

The following configuration example exposes the IDOL Data Admin running on `ida.example.com` at `https://localhost:443/dataadmin`, using AJP to enable remote authentication. The application AJP port is 8009, and the HTTPS port is 8443.

For this configuration, you must enable the `mod_proxy`, `mod_proxy_ajp`, `mod_proxy_wstunnel`, and `mod_ssl` modules.

    SSLEngine on
    SSLProxyEngine on

    SSLCertificateFile /path/to/my-certificate.crt
    SSLCertificateKeyFile /path/to/my-key.key

    <Location /dataadmin/>
       AuthType YOUR_AUTH_MODULE
       require valid-user

       ProxyPass "ajp://ida.example.com:8009/"
       ProxyPassReverse /

       # Ensure WebSocket protocol is forwarded correctly
       RewriteEngine on
       RewriteCond %{HTTP:UPGRADE} ^Websocket$ [NC]
       RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
       RewriteRule /api/user/socket/(.*) wss://ida.example.com:8443/api/user/socket/$1 [P]
    </Location>

The following configuration example exposes the IDOL Data Admin running on `ida.example.com` at `https://localhost:443/dataadmin`, using HTTPS to communicate with the application.

For this configuration, you must enable the `mod_proxy`, `mod_proxy_http`, `mod_proxy_wstunnel`, and `mod_ssl` modules.

    SSLEngine on
    SSLProxyEngine on

    SSLCertificateFile /path/to/my-certificate.crt
    SSLCertificateKeyFile /path/to/my-key.key

    <Location /dataadmin/>
       AuthType YOUR_AUTH_MODULE
       require valid-user

       ProxyPass "https://ida.example.com:8443/"
       ProxyPassReverse /

       # Ensure WebSocket protocol is forwarded correctly
       RewriteEngine on
       RewriteCond %{HTTP:UPGRADE} ^Websocket$ [NC]
       RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
       RewriteRule /api/user/socket/(.*) wss://ida.example.com:8443/api/user/socket/$1 [P]
    </Location>

### SAML

You can configure Apache 2 to act as a SAML service provider, which ensures that users are authenticated before passing them through to the application, and sends them to an identity provider if they are not.

For this configuration, you must install and enable the `mod_auth_mellon` module.

    SSLEngine on
    SSLProxyEngine on

    SSLCertificateFile /path/to/my-certificate.crt
    SSLCertificateKeyFile /path/to/my-key.key

    <Location /dataadmin/>
       AuthType "Mellon"
       AuthName YOUR_AUTH_NAME
       Require valid-user

       MellonEnable "auth"
       MellonSecureCookie On
       MellonVariable "session_cookie"
       MellonUser "NAME_ID"
       MellonEndpointPath "/mellon"
       MellonDefaultLoginPath "/"

       # Session TTL seconds
       MellonSessionLength 86400

       MellonSPMetadataFile /path/to/service/provider/metadata
       MellonSPPrivateKeyFile /path/to/service/provider/key/file
       MellonSPCertFile /path/to/service/provier/cert/file
       MellonIdPMetadataFile /path/to/idp/metadata/file

       ProxyPass "https://ida.example.com:8443/"
       ProxyPassReverse /

       # Ensure WebSocket protocol is forwarded correctly
       RewriteEngine on
       RewriteCond %{HTTP:UPGRADE} ^Websocket$ [NC]
       RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
       RewriteRule /api/user/socket/(.*) wss://ida.example.com:8443/api/user/socket/$1 [P]
    </Location>

## NGINX

Nginx is a free open source Web server and reverse proxy. It does not support the AJP protocol, so remote authentication is not possible.

The following example configuration exposes the IDOL Data Admin instance running on `https://ida.example.com:8443/ida` at `https://localhost:443/dataadmin`.

    server {
       listen 443 ssl default_server;

       ssl_certificate /path/to/my-certificate.crt;
       ssl_certificate_key /path/to/my-key.key

       location /dataadmin/ {
          proxy_pass https://ida.example.com:8443/ida;
          proxy_cookie_path /ida /dataadmin;

          # Ensure WebSocket protocol is forwarded correctly
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
       }
    }

## Internet Information Services (IIS)

IIS is a Web server created by Microsoft that is built into many versions of Windows. You can configure it as a reverse proxy in HTTP mode, by using the URL Rewrite and Application Request Routing (ARR) modules. In later versions of IIS, the Web server can automatically proxy WebSockets connections.

You can enable the AJP protocol by using the Apache Tomcat ISAPI redirector module.

To reverse proxy in HTTP mode, you must configure a URL Rewrite rule that redirects incoming requests to the application, and another rule that rewrites Location headers in the response.

_FT_HTML5_bannerTitle.htm