Web GUI proxy through WHS IIS

[Comitizer]

Hello All,

It looks like I've made some progress getting the IIS install on WHS to proxy the connection to the sage

webserver. There are still some problems but I thought that if I post my steps someone else might be able

to help my figure out where the issues lie.

For all of you that are wondering why you would want to proxy the web interface through IIS here are a

couple of reasons:

1. You only have to open ports for the WHS web interface in your router (and WHS takes care of this on its

own if it can).

2. It give the appearance of everything running on one port (443).

3. It makes the site SSL secure

4. You can take advantage of the built in security of the WHS webserver (login pages, etc).

5. You can run multiple web interfaces for multiple sage installs and map them to different sub directories

Anyway, here is how I managed to get everything (mostly) working:

First, you need to download the URL rewriter from ManagedFusion. The website is located here:

http://www.managedfusion.com/products/url-rewriter/

Once you have the rewriter, and a new virtual directory under the "Remote" app and point it to the folder

that will host your redirect. Basically, this is the folder that you will go to in your browser when you

want to access the sage web interface.

In my case, I put it under a folder named "sage". So, your path looks like this:

C:\Inetpub\remote\sage\

This is the folder where you will "install" the url rewriter. So, create a "bin" directory and place the

ManagedFusion.Rewriter.dll and .pdb in it. Once that is done, create a web.config and a

ManagedFusion.Rewriter.rules text file in the "sage" folder. The ManagedFusion.Rewriter.rules file should

look like this:

RewriteEngine On
RewriteLogLevel 5
RewriteLog "C:\temp\rewrite.log"
RewriteBase /Remote/sage
RewriteRule ^(.*)$ http://<host>:8080/sage$1 [P]

Obviously, you can point the log file where ever you like, you'll also want <host> to point to the machine

that is running your sage web GUI. Once you have everything working you can also lower the log level to 1

(for increased performance).

The web.config file should look like this:

<?xml version="1.0"?>
<configuration>
	<configSections>
		<sectionGroup name="managedFusion" 

type="ManagedFusion.Rewriter.Configuration.ManagedFusionSectionGroup, ManagedFusion.Rewriter">
			<section name="rewriter" 

type="ManagedFusion.Rewriter.Configuration.RewriterManagerSection, ManagedFusion.Rewriter" />
		</sectionGroup>
	</configSections>
	<managedFusion>
		<rewriter path="ManagedFusion.Rewriter.rules" />
	</managedFusion>
	<system.web>
		<compilation debug="true" />
		<httpModules>
			<add name="RewriterModule" type="ManagedFusion.Rewriter.RewriterModule, 

ManagedFusion.Rewriter"/>
		</httpModules>
	</system.web>
</configuration>

Now, I performed the next step but I'm not sure if it actually does anything. Right click on your sage

virtual directory (in the IIS manager) and select "properties" then click the "configuration" button under

the "virtual directory" tab and add the ManagedFusion dll to the "Wildcard application maps" section.

After you've done the above, restart IIS (at least, I did, not sure if you have to) and make sure it picked

up your changes.

Once IIS is up, login to the WHS website (https://<host>/Remote) and after you've logged in, change your

browser's URL to read:

https://<host>/Remote/sage/

you should get the login response from your sage webserver. Login and you'll probably see a pink "404"

page and your URL will look something like:

/Remote/sage/logon.aspx?ReturnUrl=%2fRemote%2fsage%2fRemote%2fsage

so, edit the URL to be:

/Remote/sage/Home

and you should see your sage web GUI (at least I do).

Now, here are the issues that I am seeing:

1. (and this is a big one) For some reason, this doesn't work in IE. I have no idea why but everything that I use IE I get a 404.

2. I can't remove the security from the sage GUI. When I enabled access for all, nothing would work anymore. I want to remove this so that we can use WHS's built in login page.

3. The first time you go to the site it always redirects to ReturnUrl=%2fRemote%2fsage%2fRemote%2fsage which is wrong. It should be ReturnUrl=%2fRemote%2fsage not sure what's going on there.

So, hopefully, there are others on this forum that would like to see their GUI proxied through IIS. If so, maybe some of us can figure out where the problems are coming from.

Thoughts?

Comitizer

[babgvant]

1 & 3) I think you need other rules (placed above the current one) to catch the incorrect urls and remap them to the proper location.

[Comitizer]

Thanks for the reply!

That makes sense but I still don't understand why IE would give me a 404 and FF would work as expected. I mean, they are seeing the same data from the webserver right? Maybe tonight I'll take a peek at the log files.

[babgvant]

I got it working on w2k8, thx for the heads up on this. I was going to write my own reverse proxy. Easy rocks!



my virtual directory is Sage (for the regex below)

RewriteEngine On
RewriteLogLevel 1
RewriteLog "C:\temp\rewrite.log"
RewriteRule ^/[S|s]age/?$ http://server:8080/sage/home [P]
RewriteRule ^/[S|s]age/login.aspx http://server:8080/sage/home [P]
RewriteRule ^/[S|s]age/(.*)$ http://server:8080/sage/$1 [P]

[Comitizer]

Great, I managed to get it to work a lot better with the following:

RewriteEngine On
RewriteLogLevel 1
RewriteLog "C:\temp\rewrite.log"
RewriteBase /remote/sage
RewriteRule ^(.*) http://caprica:8080/sage$1 [P]

but none of the searches work. I'll try your rules to see how it goes.

Did you find any differences in the steps that I listed? I'll be honest, I wrote them up from memory and they might be incorrect. When I tired to set up a 2nd directory I kept getting an error about directory browsing being disabled (and managed fusion never fired off).

[Comitizer]

Hmm, for some reason it's not adding the port to my mapping. My sage is running on caprica:8080 (and that's what's in my rules) but in the logs I see this:

Rewrite: Input: https://caprica/remote/sage/Home
Rule 0: Input: /remote/sage/Home
Rule 1: Input: /remote/sage/Home
Rewrite: Output: https://caprica/remote/sage/Home


Which makes sense but loses my port information.

By the way, I found it's best to disable the authentication on the sage webserver by editing the realm.properties and commenting out the line that looks like:

SageTV Web Interface=/sage

once you do that, you can use the WHS authentication piece by taking the <machineKey> and <authentication> tags from the <system.web> section of the web.config file in your /remote folder and pasting it into the web.config in the sage folder.

In order to do the above, you'll also have to point at the login page by editing the loginUrl="logon.aspx" to read loginUrl="../logon.aspx"

This works really well and requires you to use your WHS credentials to login before it will pass you to the sage interface.

[bcjenkins]

Don't you also need to map sagepublic?

B

[Comitizer]

I'm sorry, what is that?

[bcjenkins]

sagepublic is the path which is returned for RSS feeds, links to media files, etc.

[Peter_h]

Did you get this all working?

This is on my next to do list. I would like to proxy the Web interface, SJQ, SRE all through ISS. I'm just very hesitant because this is new territory for me. The last time I touched the inet/pub folder I had to do a reinstall.

This seems pretty straightforward.

[Comitizer]

Yeah, it works really well and doesn't really make any changes to the rest of IIS which I like. Just make sure you follow the ManagedFusion install steps and you should be ok.

Good luck, if you post here I'll try to help but my experience is limited.

[Peter_h]

Thanks for the follow up.

So would I follow the same steps for Sage Job Que and Sage Recording Extender? Both have a web interface built on the Jetty Web Server.

Also, do you have the SSL version of the Web Server running?

Lastly, did you make links to these in your WHS website? If so, where do they appear?

[Comitizer]

You should be able to make a virtual directory for each site that you want to map to. Just follow the steps and point each instance to a different web server.

No, I don't have the SSL version of the sage web server running but it gets passed through the IIS server and comes out SSL in the end. Does that make sense? So the connection from IIS to the sage web server is standard HTTP but the browser connects to IIS via SSL.

The links appear in the /remote/default.aspx page under the "web sites" section (which I think only shows up if you have actually added a link there). You can download the Whiist add on if you need a GUI to build the link or you can edit the Websites.xml (C:\Inetpub\remote\WebSites.xml). There is an example in the file itself if you need to know the syntax.