[GH-ISSUE #2803] Reverse proxy header authentication does not work #954

New issue

Closed

opened 2026-03-07 20:57:15 +03:00 by kerem · 0 comments

kerem commented

2026-03-07 20:57:15 +03:00

Owner

Originally created by @v1tam1nb2 on GitHub (Jul 25, 2024).
Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/2803

I am trying reverse proxy authentication in a Docker environment using Openresty and Cloudbeaver 24.1.3 but it is not working with errors.

Version 23.3.5 worked. Has anything changed?

Docker compose

version: '3'
services:
  openresty:
    container_name: openresty
    hostname: openresty
    image: bitnami/openresty:latest
    restart: always
    ports:
      - 8888:80
    volumes:
     - ./openresty/nginx.conf:/opt/bitnami/openresty/nginx/conf/nginx.conf

  cloudbeaver:
    container_name: cloudbeaver
    hostname: cloudbeaver
    image: dbeaver/cloudbeaver:24.1.3
    restart: always
    ports:
      - 8978:8978
    volumes:
      - ./cloudbeaver/cloudbeaver.conf:/opt/cloudbeaver/conf/cloudbeaver.conf
      - ./data/cloudbeaver/workspace:/opt/cloudbeaver/workspace

Cloudbeaver conf

cloudbeaver.conf

{
    server: {
        serverPort: 8978,
        serverName: "CloudBeaver Sample Server",
        workspaceLocation: "workspace",
        contentRoot: "web",
        driversLocation: "drivers",

        sslConfigurationPath:"${CLOUDBEAVER_SSL_CONF_PATH:workspace/.data/ssl-config.xml}",

        rootURI: "/",
        serviceURI: "/api/",

        productSettings: {
            # Global properties
            core.theming.theme: 'light',
            core.localization.localization: 'en',
            #core.authentication.baseAuthProvider: 'reverseProxy',
            #core.authentication.primaryAuthProvider: 'reverseProxy',
            # core.localization.defaultLanguage: 'jp',
            plugin.sql-editor.autoSave: true,
            plugin.sql-editor.disabled: false,
            # max size of the file that can be uploaded to the editor (in kilobytes)
            plugin.sql-editor.maxFileSize: 10240,
            plugin.log-viewer.disabled: false,
            plugin.log-viewer.logBatchSize: 1000,
            plugin.log-viewer.maxFailedRequests: 3,
            plugin.log-viewer.maxLogRecords: 2000,
            plugin.log-viewer.refreshTimeout: 3000,
            sql.proposals.insert.table.alias: PLAIN
        },

        expireSessionAfterPeriod: 1800000,

        develMode: false,

        enableSecurityManager: false,

        sm: {
            enableBruteForceProtection: "${CLOUDBEAVER_BRUTE_FORCE_PROTECTION_ENABLED:true}",
            maxFailedLogin: "${CLOUDBEAVER_MAX_FAILED_LOGINS:10}",
            minimumLoginTimeout: "${CLOUDBEAVER_MINIMUM_LOGIN_TIMEOUT:1}",
            blockLoginPeriod: "${CLOUDBEAVER_BLOCK_PERIOD:300}",
            passwordPolicy: {
                minLength: "${CLOUDBEAVER_POLICY_MIN_LENGTH:8}",
                requireMixedCase: "${CLOUDBEAVER_POLICY_REQUIRE_MIXED_CASE:true}",
                minNumberCount: "${CLOUDBEAVER_POLICY_MIN_NUMBER_COUNT:1}",
                minSymbolCount: "${CLOUDBEAVER_POLICY_MIN_SYMBOL_COUNT:0}"
            }
        },

        database: {
            driver: "${CLOUDBEAVER_DB_DRIVER:h2_embedded_v2}",
            url: "${CLOUDBEAVER_DB_URL:jdbc:h2:${workspace}/.data/cb.h2v2.dat}",
            schema: "${CLOUDBEAVER_DB_SCHEMA:''}",
            user: "${CLOUDBEAVER_DB_USER:''}",
            password: "${CLOUDBEAVER_DB_PASSWORD:''}",
            initialDataConfiguration: "${CLOUDBEAVER_DB_INITIAL_DATA:conf/initial-data.conf}",
            pool: {
                minIdleConnections: "${CLOUDBEAVER_DB_MIN_IDLE_CONNECTIONS:4}",
                maxIdleConnections: "${CLOUDBEAVER_DB_MAX_IDLE_CONNECTIONS:10}",
                maxConnections: "${CLOUDBEAVER_DB_MAX_CONNECTIONS:100}",
                validationQuery: "${CLOUDBEAVER_DB_VALIDATION_QUERY:SELECT 1}"
            },
            backupEnabled: "${CLOUDBEAVER_DB_BACKUP_ENABLED:true}"
        }

    },
    app: {
        anonymousAccessEnabled: true,
        anonymousUserRole: "user",
        defaultUserTeam: "user",
        grantConnectionsAccessToAnonymousTeam: false,
        supportsCustomConnections: true,
        showReadOnlyConnectionInfo: false,
        systemVariablesResolvingEnabled: "${CLOUDBEAVER_SYSTEM_VARIABLES_RESOLVING_ENABLED:false}",

        forwardProxy: true, 

        publicCredentialsSaveEnabled: true,
        adminCredentialsSaveEnabled: true,

        resourceManagerEnabled: true,

        resourceQuotas: {
            dataExportFileSizeLimit: 10000000,
            resourceManagerFileSizeLimit: 500000,
            sqlMaxRunningQueries: 100,
            sqlResultSetRowsLimit: 100000,
            sqlResultSetMemoryLimit: 2000000,
            sqlTextPreviewMaxLength: 4096,
            sqlBinaryPreviewMaxLength: 261120
        },
        defaultAuthProvider: "reverseProxy",
        enableReverseProxyAuth: true,
        enabledAuthProviders: [
            "reverseProxy"
        ],

        disabledDrivers: [
            "sqlite:sqlite_jdbc",
            "h2:h2_embedded",
            "h2:h2_embedded_v2",
            "clickhouse:yandex_clickhouse"
        ],
        disabledBetaFeatures: [

        ],
        authConfigurations: [
            {
                "id": "reverseProxy",
                "provider": "reverseProxy",
                "displayName": "Reverse Proxy",
                "disabled": false,
                "iconURL": "",
                "description": "",
                "parameters": {
                    "logout-url": "",
                    "user-header": "",
                    "team-header": "",
                    "team-delimiter": "",
                    "first-name-header": "",
                    "last-name-header": ""
                }
            }
        ]

    }

}

Openresty

nginx.conf

# Based on https://www.nginx.com/resources/wiki/start/topics/examples/full/#nginx-conf
# user              www www;  ## Default: nobody

worker_processes  auto;
error_log         "/opt/bitnami/openresty/nginx/logs/error.log";
pid               "/opt/bitnami/openresty/nginx/tmp/nginx.pid";

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    log_format    main '$remote_addr - $remote_user [$time_local] '
                       '"$request" $status  $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';
    access_log    "/opt/bitnami/openresty/nginx/logs/access.log";
    add_header    X-Frame-Options SAMEORIGIN;

    client_body_temp_path  "/opt/bitnami/openresty/nginx/tmp/client_body" 1 2;
    proxy_temp_path        "/opt/bitnami/openresty/nginx/tmp/proxy" 1 2;
    fastcgi_temp_path      "/opt/bitnami/openresty/nginx/tmp/fastcgi" 1 2;
    scgi_temp_path         "/opt/bitnami/openresty/nginx/tmp/scgi" 1 2;
    uwsgi_temp_path        "/opt/bitnami/openresty/nginx/tmp/uwsgi" 1 2;

    sendfile           on;
    tcp_nopush         on;
    tcp_nodelay        off;
    gzip               on;
    gzip_http_version  1.0;
    gzip_comp_level    2;
    gzip_proxied       any;
    gzip_types         text/plain text/css application/javascript text/xml application/xml+rss;
    keepalive_timeout  65;
    ssl_protocols      TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers        HIGH:!aNULL:!MD5;
    client_max_body_size 80M;
    server_tokens off;

    include  "/opt/bitnami/openresty/nginx/conf/server_blocks/*.conf";

    # HTTP Server
    server {
        # Port to listen on, can also be set in IP:PORT format
        listen  80;

        include  "/opt/bitnami/openresty/nginx/conf/bitnami/*.conf";

		location / {
			proxy_pass       http://cloudbeaver:8978;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
			proxy_set_header X-User 'cbadmin';
            proxy_set_header X-Role 'user|admin';
		}

        location /status {
            stub_status on;
            access_log   off;
            allow 127.0.0.1;
            deny all;
        }
    }
}

Error

5-07-2024 07:57:28.717 [main] DEBUG i.c.service.security.db.CBDatabase -       Management database connection established
25-07-2024 07:57:28.784 [main] DEBUG io.cloudbeaver.server.CBApplication - Starting Jetty server (8978 on all interfaces) 
25-07-2024 07:57:28.785 [DBeaver: CloudBeaver events job] DEBUG i.c.s.events.WSDefaultEventHandler - cb_subject_permissions event handled
25-07-2024 07:57:28.785 [DBeaver: CloudBeaver events job] DEBUG i.c.s.events.WSDefaultEventHandler - cb_subject_permissions event handled
25-07-2024 07:57:29.048 [main] DEBUG i.c.server.graphql.GraphQLEndpoint - Schema extensions loaded: WebServiceBindingCore,WebServiceBindingNavigator,WebServiceBindingSQL,WebServiceBindingAdmin,WebServiceBindingAuth,WebServiceBindingDataTransfer,WebServiceBindingFS,WebServiceBindingMetadata,WebServiceBindingRM
25-07-2024 07:57:29.341 [main] DEBUG i.c.server.jetty.CBJettyServer - Max http session idle time: 1800s
25-07-2024 07:57:29.346 [main] DEBUG i.c.server.jetty.CBJettyServer - Active servlets:
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   static: [/*]
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   images: [/api/images/*]
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   status: [/status]
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   graphql: [/api/gql/*]
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   sqlResultValueViewer: [/api/sql-result-value/*]
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   sqlUploadFile: [/api/resultset/blob/*]
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   adminLogs: [/api/logs/*]
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   dataTransfer: [/api/data/*]
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   dataTransferImport: [/api/data/import/*]
25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer -   fileSystems: [/api/fs-data/*]
25-07-2024 07:57:29.349 [main] INFO  org.eclipse.jetty.server.Server - jetty-11.0.18; built: 2023-10-27T02:14:36.036Z; git: 5a9a771a9fbcb9d36993630850f612581b78c13f; jvm 17.0.11+9
25-07-2024 07:57:29.407 [main] INFO  o.e.j.s.s.DefaultSessionIdManager - Session workerName=
25-07-2024 07:57:29.424 [main] INFO  o.e.j.server.handler.ContextHandler - Started o.e.j.s.ServletContextHandler@2d4a0671{/,file:///opt/cloudbeaver/web/,AVAILABLE}
25-07-2024 07:57:29.432 [main] INFO  o.e.jetty.server.AbstractConnector - Started ServerConnector@13803a94{HTTP/1.1, (http/1.1)}{0.0.0.0:8978}
25-07-2024 07:57:29.434 [main] INFO  org.eclipse.jetty.server.Server - Started JettyServer@b56c222{STARTING}[11.0.18,sto=0] @3428ms
25-07-2024 07:57:52.059 [qtp1493657028-41] DEBUG i.c.model.session.WebUserContext - refresh permissions null 442c7592-c1ad-49d4-8b81-440899570645
25-07-2024 07:57:52.137 [qtp1493657028-41] DEBUG i.c.s.session.WebSessionManager - New web session '13uypzi5cze1j1xzj5n9xi9ilg0'
25-07-2024 07:57:52.791 [qtp1493657028-37] INFO  i.c.s.w.CBJettyWebSocketManager - Websocket created for session: 13uypzi5cze1j1xzj5n9xi9ilg0
25-07-2024 07:57:52.813 [qtp1493657028-37] DEBUG i.c.s.websockets.CBEventsWebSocket - EventWebSocket connected to the 13uypzi5cze1j1xzj5n9xi9ilg0 session
25-07-2024 07:57:52.907 [qtp1493657028-43] DEBUG i.c.server.graphql.GraphQLEndpoint - API > serverConfig
25-07-2024 07:57:53.034 [qtp1493657028-37] DEBUG i.c.server.graphql.GraphQLEndpoint - API > openSession
25-07-2024 07:57:53.042 [qtp1493657028-37] DEBUG i.c.service.auth.RPSessionHandler - Attempting to authenticate user 'cbadmin' with teams [u, s, e, r, |, a, d, m, i, n] through reverse proxy
25-07-2024 07:57:53.048 [qtp1493657028-37] DEBUG i.c.s.s.CBEmbeddedSecurityController - Create user: cbadmin
25-07-2024 07:57:53.054 [qtp1493657028-37] ERROR i.c.service.core.impl.WebServiceCore - Error calling session handler 'RPSessionHandler'
io.cloudbeaver.DBWebException: Error:
Error saving user teams in database
        at io.cloudbeaver.service.auth.RPSessionHandler.reverseProxyAuthentication(RPSessionHandler.java:139)
        at io.cloudbeaver.service.auth.RPSessionHandler.handleSessionOpen(RPSessionHandler.java:63)
        at io.cloudbeaver.service.core.impl.WebServiceCore.openSession(WebServiceCore.java:228)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at io.cloudbeaver.service.WebServiceBindingBase$ServiceInvocationHandler.invoke(WebServiceBindingBase.java:169)
        at jdk.proxy7/jdk.proxy7.$Proxy12.openSession(Unknown Source)
        at io.cloudbeaver.service.core.WebServiceBindingCore.lambda$14(WebServiceBindingCore.java:94)
        at graphql.execution.ExecutionStrategy.invokeDataFetcher(ExecutionStrategy.java:309)
        at graphql.execution.ExecutionStrategy.fetchField(ExecutionStrategy.java:286)
        at graphql.execution.ExecutionStrategy.resolveFieldWithInfo(ExecutionStrategy.java:212)
        at graphql.execution.AsyncExecutionStrategy.execute(AsyncExecutionStrategy.java:55)
        at graphql.execution.Execution.executeOperation(Execution.java:161)
        at graphql.execution.Execution.execute(Execution.java:104)
        at graphql.GraphQL.execute(GraphQL.java:557)
        at graphql.GraphQL.lambda$parseValidateAndExecute$11(GraphQL.java:476)
        at java.base/java.util.concurrent.CompletableFuture.uniComposeStage(CompletableFuture.java:1187)
        at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:2309)
        at graphql.GraphQL.parseValidateAndExecute(GraphQL.java:471)
        at graphql.GraphQL.executeAsync(GraphQL.java:439)
        at graphql.GraphQL.execute(GraphQL.java:365)
        at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeQuery(GraphQLEndpoint.java:257)
        at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeSingleQuery(GraphQLEndpoint.java:203)
        at io.cloudbeaver.server.graphql.GraphQLEndpoint.doPost(GraphQLEndpoint.java:186)
        at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:520)
        at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:587)
        at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764)
        at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665)
        at org.eclipse.jetty.websocket.servlet.WebSocketUpgradeFilter.doFilter(WebSocketUpgradeFilter.java:170)
        at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)
        at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)
        at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527)
        at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221)
        at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1570)
        at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221)
        at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1381)
        at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176)
        at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484)
        at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1543)
        at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174)
        at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1303)
        at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)
        at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)
        at org.eclipse.jetty.server.Server.handle(Server.java:563)
        at org.eclipse.jetty.server.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1598)
        at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:753)
        at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:501)
        at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:287)
        at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)
        at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
        at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:199)
        at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411)
        at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969)
        at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194)
        at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149)
        at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: org.jkiss.dbeaver.model.exec.DBCException: Error saving user teams in database
        at io.cloudbeaver.service.security.CBEmbeddedSecurityController.setUserTeams(CBEmbeddedSecurityController.java:222)
        at io.cloudbeaver.service.security.CBEmbeddedSecurityController.findOrCreateExternalUserByCredentials(CBEmbeddedSecurityController.java:2454)
        at io.cloudbeaver.service.security.CBEmbeddedSecurityController.finishAuthentication(CBEmbeddedSecurityController.java:2160)
        at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1565)
        at io.cloudbeaver.service.auth.RPSessionHandler.reverseProxyAuthentication(RPSessionHandler.java:126)
        ... 61 common frames omitted
Caused by: org.h2.jdbc.JdbcSQLIntegrityConstraintViolationException: Referential integrity constraint violation: "CONSTRAINT_C9CD: PUBLIC.CB_USER_TEAM FOREIGN KEY(TEAM_ID) REFERENCES PUBLIC.CB_TEAM(TEAM_ID) ('u')"; SQL statement:
INSERT INTO CB_USER_TEAM(USER_ID,TEAM_ID,GRANT_TIME,GRANTED_BY) VALUES(?,?,?,?) [23506-214]
        at org.h2.message.DbException.getJdbcSQLException(DbException.java:508)
        at org.h2.message.DbException.getJdbcSQLException(DbException.java:477)
        at org.h2.message.DbException.get(DbException.java:223)
        at org.h2.message.DbException.get(DbException.java:199)
        at org.h2.constraint.ConstraintReferential.checkRowOwnTable(ConstraintReferential.java:311)
        at org.h2.constraint.ConstraintReferential.checkRow(ConstraintReferential.java:252)
        at org.h2.table.Table.fireConstraints(Table.java:1172)
        at org.h2.table.Table.fireAfterRow(Table.java:1190)
        at org.h2.command.dml.Insert.insertRows(Insert.java:188)
        at org.h2.command.dml.Insert.update(Insert.java:135)
        at org.h2.command.dml.DataChangeStatement.update(DataChangeStatement.java:74)
        at org.h2.command.CommandContainer.update(CommandContainer.java:169)
        at org.h2.command.Command.executeUpdate(Command.java:252)
        at org.h2.jdbc.JdbcPreparedStatement.execute(JdbcPreparedStatement.java:254)
        at org.apache.commons.dbcp2.DelegatingPreparedStatement.execute(DelegatingPreparedStatement.java:95)
        at org.apache.commons.dbcp2.DelegatingPreparedStatement.execute(DelegatingPreparedStatement.java:95)
        at io.cloudbeaver.service.security.CBEmbeddedSecurityController.setUserTeams(CBEmbeddedSecurityController.java:317)
        at io.cloudbeaver.service.security.CBEmbeddedSecurityController.setUserTeams(CBEmbeddedSecurityController.java:218)
        ... 65 common frames omitted

Originally created by @v1tam1nb2 on GitHub (Jul 25, 2024). Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/2803 I am trying reverse proxy authentication in a Docker environment using Openresty and Cloudbeaver 24.1.3 but it is not working with errors. Version 23.3.5 worked. Has anything changed? ## Docker compose ```yaml version: '3' services: openresty: container_name: openresty hostname: openresty image: bitnami/openresty:latest restart: always ports: - 8888:80 volumes: - ./openresty/nginx.conf:/opt/bitnami/openresty/nginx/conf/nginx.conf cloudbeaver: container_name: cloudbeaver hostname: cloudbeaver image: dbeaver/cloudbeaver:24.1.3 restart: always ports: - 8978:8978 volumes: - ./cloudbeaver/cloudbeaver.conf:/opt/cloudbeaver/conf/cloudbeaver.conf - ./data/cloudbeaver/workspace:/opt/cloudbeaver/workspace ``` ## Cloudbeaver conf - cloudbeaver.conf ```conf { server: { serverPort: 8978, serverName: "CloudBeaver Sample Server", workspaceLocation: "workspace", contentRoot: "web", driversLocation: "drivers", sslConfigurationPath:"${CLOUDBEAVER_SSL_CONF_PATH:workspace/.data/ssl-config.xml}", rootURI: "/", serviceURI: "/api/", productSettings: { # Global properties core.theming.theme: 'light', core.localization.localization: 'en', #core.authentication.baseAuthProvider: 'reverseProxy', #core.authentication.primaryAuthProvider: 'reverseProxy', # core.localization.defaultLanguage: 'jp', plugin.sql-editor.autoSave: true, plugin.sql-editor.disabled: false, # max size of the file that can be uploaded to the editor (in kilobytes) plugin.sql-editor.maxFileSize: 10240, plugin.log-viewer.disabled: false, plugin.log-viewer.logBatchSize: 1000, plugin.log-viewer.maxFailedRequests: 3, plugin.log-viewer.maxLogRecords: 2000, plugin.log-viewer.refreshTimeout: 3000, sql.proposals.insert.table.alias: PLAIN }, expireSessionAfterPeriod: 1800000, develMode: false, enableSecurityManager: false, sm: { enableBruteForceProtection: "${CLOUDBEAVER_BRUTE_FORCE_PROTECTION_ENABLED:true}", maxFailedLogin: "${CLOUDBEAVER_MAX_FAILED_LOGINS:10}", minimumLoginTimeout: "${CLOUDBEAVER_MINIMUM_LOGIN_TIMEOUT:1}", blockLoginPeriod: "${CLOUDBEAVER_BLOCK_PERIOD:300}", passwordPolicy: { minLength: "${CLOUDBEAVER_POLICY_MIN_LENGTH:8}", requireMixedCase: "${CLOUDBEAVER_POLICY_REQUIRE_MIXED_CASE:true}", minNumberCount: "${CLOUDBEAVER_POLICY_MIN_NUMBER_COUNT:1}", minSymbolCount: "${CLOUDBEAVER_POLICY_MIN_SYMBOL_COUNT:0}" } }, database: { driver: "${CLOUDBEAVER_DB_DRIVER:h2_embedded_v2}", url: "${CLOUDBEAVER_DB_URL:jdbc:h2:${workspace}/.data/cb.h2v2.dat}", schema: "${CLOUDBEAVER_DB_SCHEMA:''}", user: "${CLOUDBEAVER_DB_USER:''}", password: "${CLOUDBEAVER_DB_PASSWORD:''}", initialDataConfiguration: "${CLOUDBEAVER_DB_INITIAL_DATA:conf/initial-data.conf}", pool: { minIdleConnections: "${CLOUDBEAVER_DB_MIN_IDLE_CONNECTIONS:4}", maxIdleConnections: "${CLOUDBEAVER_DB_MAX_IDLE_CONNECTIONS:10}", maxConnections: "${CLOUDBEAVER_DB_MAX_CONNECTIONS:100}", validationQuery: "${CLOUDBEAVER_DB_VALIDATION_QUERY:SELECT 1}" }, backupEnabled: "${CLOUDBEAVER_DB_BACKUP_ENABLED:true}" } }, app: { anonymousAccessEnabled: true, anonymousUserRole: "user", defaultUserTeam: "user", grantConnectionsAccessToAnonymousTeam: false, supportsCustomConnections: true, showReadOnlyConnectionInfo: false, systemVariablesResolvingEnabled: "${CLOUDBEAVER_SYSTEM_VARIABLES_RESOLVING_ENABLED:false}", forwardProxy: true, publicCredentialsSaveEnabled: true, adminCredentialsSaveEnabled: true, resourceManagerEnabled: true, resourceQuotas: { dataExportFileSizeLimit: 10000000, resourceManagerFileSizeLimit: 500000, sqlMaxRunningQueries: 100, sqlResultSetRowsLimit: 100000, sqlResultSetMemoryLimit: 2000000, sqlTextPreviewMaxLength: 4096, sqlBinaryPreviewMaxLength: 261120 }, defaultAuthProvider: "reverseProxy", enableReverseProxyAuth: true, enabledAuthProviders: [ "reverseProxy" ], disabledDrivers: [ "sqlite:sqlite_jdbc", "h2:h2_embedded", "h2:h2_embedded_v2", "clickhouse:yandex_clickhouse" ], disabledBetaFeatures: [ ], authConfigurations: [ { "id": "reverseProxy", "provider": "reverseProxy", "displayName": "Reverse Proxy", "disabled": false, "iconURL": "", "description": "", "parameters": { "logout-url": "", "user-header": "", "team-header": "", "team-delimiter": "", "first-name-header": "", "last-name-header": "" } } ] } } ``` ## Openresty - nginx.conf ```conf # Based on https://www.nginx.com/resources/wiki/start/topics/examples/full/#nginx-conf # user www www; ## Default: nobody worker_processes auto; error_log "/opt/bitnami/openresty/nginx/logs/error.log"; pid "/opt/bitnami/openresty/nginx/tmp/nginx.pid"; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log "/opt/bitnami/openresty/nginx/logs/access.log"; add_header X-Frame-Options SAMEORIGIN; client_body_temp_path "/opt/bitnami/openresty/nginx/tmp/client_body" 1 2; proxy_temp_path "/opt/bitnami/openresty/nginx/tmp/proxy" 1 2; fastcgi_temp_path "/opt/bitnami/openresty/nginx/tmp/fastcgi" 1 2; scgi_temp_path "/opt/bitnami/openresty/nginx/tmp/scgi" 1 2; uwsgi_temp_path "/opt/bitnami/openresty/nginx/tmp/uwsgi" 1 2; sendfile on; tcp_nopush on; tcp_nodelay off; gzip on; gzip_http_version 1.0; gzip_comp_level 2; gzip_proxied any; gzip_types text/plain text/css application/javascript text/xml application/xml+rss; keepalive_timeout 65; ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; client_max_body_size 80M; server_tokens off; include "/opt/bitnami/openresty/nginx/conf/server_blocks/*.conf"; # HTTP Server server { # Port to listen on, can also be set in IP:PORT format listen 80; include "/opt/bitnami/openresty/nginx/conf/bitnami/*.conf"; location / { proxy_pass http://cloudbeaver:8978; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-User 'cbadmin'; proxy_set_header X-Role 'user|admin'; } location /status { stub_status on; access_log off; allow 127.0.0.1; deny all; } } } ``` ## Error ``` 5-07-2024 07:57:28.717 [main] DEBUG i.c.service.security.db.CBDatabase - Management database connection established 25-07-2024 07:57:28.784 [main] DEBUG io.cloudbeaver.server.CBApplication - Starting Jetty server (8978 on all interfaces) 25-07-2024 07:57:28.785 [DBeaver: CloudBeaver events job] DEBUG i.c.s.events.WSDefaultEventHandler - cb_subject_permissions event handled 25-07-2024 07:57:28.785 [DBeaver: CloudBeaver events job] DEBUG i.c.s.events.WSDefaultEventHandler - cb_subject_permissions event handled 25-07-2024 07:57:29.048 [main] DEBUG i.c.server.graphql.GraphQLEndpoint - Schema extensions loaded: WebServiceBindingCore,WebServiceBindingNavigator,WebServiceBindingSQL,WebServiceBindingAdmin,WebServiceBindingAuth,WebServiceBindingDataTransfer,WebServiceBindingFS,WebServiceBindingMetadata,WebServiceBindingRM 25-07-2024 07:57:29.341 [main] DEBUG i.c.server.jetty.CBJettyServer - Max http session idle time: 1800s 25-07-2024 07:57:29.346 [main] DEBUG i.c.server.jetty.CBJettyServer - Active servlets: 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - static: [/*] 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - images: [/api/images/*] 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - status: [/status] 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - graphql: [/api/gql/*] 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - sqlResultValueViewer: [/api/sql-result-value/*] 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - sqlUploadFile: [/api/resultset/blob/*] 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - adminLogs: [/api/logs/*] 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - dataTransfer: [/api/data/*] 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - dataTransferImport: [/api/data/import/*] 25-07-2024 07:57:29.347 [main] DEBUG i.c.server.jetty.CBJettyServer - fileSystems: [/api/fs-data/*] 25-07-2024 07:57:29.349 [main] INFO org.eclipse.jetty.server.Server - jetty-11.0.18; built: 2023-10-27T02:14:36.036Z; git: 5a9a771a9fbcb9d36993630850f612581b78c13f; jvm 17.0.11+9 25-07-2024 07:57:29.407 [main] INFO o.e.j.s.s.DefaultSessionIdManager - Session workerName= 25-07-2024 07:57:29.424 [main] INFO o.e.j.server.handler.ContextHandler - Started o.e.j.s.ServletContextHandler@2d4a0671{/,file:///opt/cloudbeaver/web/,AVAILABLE} 25-07-2024 07:57:29.432 [main] INFO o.e.jetty.server.AbstractConnector - Started ServerConnector@13803a94{HTTP/1.1, (http/1.1)}{0.0.0.0:8978} 25-07-2024 07:57:29.434 [main] INFO org.eclipse.jetty.server.Server - Started JettyServer@b56c222{STARTING}[11.0.18,sto=0] @3428ms 25-07-2024 07:57:52.059 [qtp1493657028-41] DEBUG i.c.model.session.WebUserContext - refresh permissions null 442c7592-c1ad-49d4-8b81-440899570645 25-07-2024 07:57:52.137 [qtp1493657028-41] DEBUG i.c.s.session.WebSessionManager - New web session '13uypzi5cze1j1xzj5n9xi9ilg0' 25-07-2024 07:57:52.791 [qtp1493657028-37] INFO i.c.s.w.CBJettyWebSocketManager - Websocket created for session: 13uypzi5cze1j1xzj5n9xi9ilg0 25-07-2024 07:57:52.813 [qtp1493657028-37] DEBUG i.c.s.websockets.CBEventsWebSocket - EventWebSocket connected to the 13uypzi5cze1j1xzj5n9xi9ilg0 session 25-07-2024 07:57:52.907 [qtp1493657028-43] DEBUG i.c.server.graphql.GraphQLEndpoint - API > serverConfig 25-07-2024 07:57:53.034 [qtp1493657028-37] DEBUG i.c.server.graphql.GraphQLEndpoint - API > openSession 25-07-2024 07:57:53.042 [qtp1493657028-37] DEBUG i.c.service.auth.RPSessionHandler - Attempting to authenticate user 'cbadmin' with teams [u, s, e, r, |, a, d, m, i, n] through reverse proxy 25-07-2024 07:57:53.048 [qtp1493657028-37] DEBUG i.c.s.s.CBEmbeddedSecurityController - Create user: cbadmin 25-07-2024 07:57:53.054 [qtp1493657028-37] ERROR i.c.service.core.impl.WebServiceCore - Error calling session handler 'RPSessionHandler' io.cloudbeaver.DBWebException: Error: Error saving user teams in database at io.cloudbeaver.service.auth.RPSessionHandler.reverseProxyAuthentication(RPSessionHandler.java:139) at io.cloudbeaver.service.auth.RPSessionHandler.handleSessionOpen(RPSessionHandler.java:63) at io.cloudbeaver.service.core.impl.WebServiceCore.openSession(WebServiceCore.java:228) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at io.cloudbeaver.service.WebServiceBindingBase$ServiceInvocationHandler.invoke(WebServiceBindingBase.java:169) at jdk.proxy7/jdk.proxy7.$Proxy12.openSession(Unknown Source) at io.cloudbeaver.service.core.WebServiceBindingCore.lambda$14(WebServiceBindingCore.java:94) at graphql.execution.ExecutionStrategy.invokeDataFetcher(ExecutionStrategy.java:309) at graphql.execution.ExecutionStrategy.fetchField(ExecutionStrategy.java:286) at graphql.execution.ExecutionStrategy.resolveFieldWithInfo(ExecutionStrategy.java:212) at graphql.execution.AsyncExecutionStrategy.execute(AsyncExecutionStrategy.java:55) at graphql.execution.Execution.executeOperation(Execution.java:161) at graphql.execution.Execution.execute(Execution.java:104) at graphql.GraphQL.execute(GraphQL.java:557) at graphql.GraphQL.lambda$parseValidateAndExecute$11(GraphQL.java:476) at java.base/java.util.concurrent.CompletableFuture.uniComposeStage(CompletableFuture.java:1187) at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:2309) at graphql.GraphQL.parseValidateAndExecute(GraphQL.java:471) at graphql.GraphQL.executeAsync(GraphQL.java:439) at graphql.GraphQL.execute(GraphQL.java:365) at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeQuery(GraphQLEndpoint.java:257) at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeSingleQuery(GraphQLEndpoint.java:203) at io.cloudbeaver.server.graphql.GraphQLEndpoint.doPost(GraphQLEndpoint.java:186) at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:520) at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:587) at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764) at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665) at org.eclipse.jetty.websocket.servlet.WebSocketUpgradeFilter.doFilter(WebSocketUpgradeFilter.java:170) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1570) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1381) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1543) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1303) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at org.eclipse.jetty.server.Server.handle(Server.java:563) at org.eclipse.jetty.server.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1598) at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:753) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:501) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:287) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100) at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:199) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149) at java.base/java.lang.Thread.run(Thread.java:840) Caused by: org.jkiss.dbeaver.model.exec.DBCException: Error saving user teams in database at io.cloudbeaver.service.security.CBEmbeddedSecurityController.setUserTeams(CBEmbeddedSecurityController.java:222) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.findOrCreateExternalUserByCredentials(CBEmbeddedSecurityController.java:2454) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.finishAuthentication(CBEmbeddedSecurityController.java:2160) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1565) at io.cloudbeaver.service.auth.RPSessionHandler.reverseProxyAuthentication(RPSessionHandler.java:126) ... 61 common frames omitted Caused by: org.h2.jdbc.JdbcSQLIntegrityConstraintViolationException: Referential integrity constraint violation: "CONSTRAINT_C9CD: PUBLIC.CB_USER_TEAM FOREIGN KEY(TEAM_ID) REFERENCES PUBLIC.CB_TEAM(TEAM_ID) ('u')"; SQL statement: INSERT INTO CB_USER_TEAM(USER_ID,TEAM_ID,GRANT_TIME,GRANTED_BY) VALUES(?,?,?,?) [23506-214] at org.h2.message.DbException.getJdbcSQLException(DbException.java:508) at org.h2.message.DbException.getJdbcSQLException(DbException.java:477) at org.h2.message.DbException.get(DbException.java:223) at org.h2.message.DbException.get(DbException.java:199) at org.h2.constraint.ConstraintReferential.checkRowOwnTable(ConstraintReferential.java:311) at org.h2.constraint.ConstraintReferential.checkRow(ConstraintReferential.java:252) at org.h2.table.Table.fireConstraints(Table.java:1172) at org.h2.table.Table.fireAfterRow(Table.java:1190) at org.h2.command.dml.Insert.insertRows(Insert.java:188) at org.h2.command.dml.Insert.update(Insert.java:135) at org.h2.command.dml.DataChangeStatement.update(DataChangeStatement.java:74) at org.h2.command.CommandContainer.update(CommandContainer.java:169) at org.h2.command.Command.executeUpdate(Command.java:252) at org.h2.jdbc.JdbcPreparedStatement.execute(JdbcPreparedStatement.java:254) at org.apache.commons.dbcp2.DelegatingPreparedStatement.execute(DelegatingPreparedStatement.java:95) at org.apache.commons.dbcp2.DelegatingPreparedStatement.execute(DelegatingPreparedStatement.java:95) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.setUserTeams(CBEmbeddedSecurityController.java:317) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.setUserTeams(CBEmbeddedSecurityController.java:218) ... 65 common frames omitted ```