404 error with openhab behind NGINX reverse proxy and authentication

Hello,

i want to access my openhab instance from the internet with authentication with oauth-proxy and keycloak.

This is my nginx configuration:

server {

  # Server config
  listen 443 ssl;
  server_name openhab.domain.de www.openhab.domain.de;

  # SSL Certs
  ssl_certificate /etc/letsencrypt/live/openhab.domain.de/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/openhab.domain.de/privkey.pem;

  #include ssl/ssl.conf;

  location  /oauth2/ {
    proxy_pass       http://auth.domain.de:1080;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    #proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }
  location  /oauth2/auth {
    proxy_pass       http://auth.domain.de:1080;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    #set $args $args&allowed_groups=/ldap/openhab;
  }

  location / {
    proxy_pass https://192.168.10.165:8443/$request_uri;

    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in?rd=https://192.168.10.165:8443;
    #error_page 401 = /oauth2/start;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;
    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}

Thanks for your help in advance,
Alex

no ideas?

404 page not found ?
Did you check the nginx log file for requests that have been logged ?

Thanks for your reply.
The nginx log just says:

x.x.x.x - - [05/May/2024:18:35:40 +0000] "GET /overview HTTP/2.0" 404 1257 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "-"

I have also had this issue since upgrading to 4.2.M2. It seems to be specifically for the /overview page when not logged in. Problem is I often get a “Communication failure” banner on the start page, and when clicking “Reload” on that it redirects to /overview giving the 404.

Edit: And it’s not an error with nginx:

curl 127.0.0.1:8080/overview -v
*   Trying 127.0.0.1:8080...
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> GET /overview HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.74.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< Cache-Control: must-revalidate,no-cache,no-store
< Content-Type: text/html
< Content-Length: 1271
< Server: Jetty(9.4.53.v20231009)

This issue i got, too.
I am on version 4.1.2