Authentication behind a load balancer not succedding due to protocols

[JonEasy]

Hi,

I am continue my journey with mod_auth_openidc since I strongly believe in its capabilities. However my new current setup is a bit complex and I do not manage to make it work.

I have a load balancer that terminates all 443 traffic and redirects everythin to port 80 on my EC2 instance. That instance has an httpd service that acts as a reverse proxy that directs all the requests from my client to backend. See my part of my config below:

RewriteEngine on
ProxyPreserveHost On
ProxyRequests On
RewriteRule ^/myapi/(.*)$ http://localhost:8001/myapi/$1 [P]
ProxyPass /myapi http://localhost:8001/myapi
ProxyPassReverse /myapi http://localhost:8001/myapi

The problem I am encountering is that my apache is claiming the following :

oidc_authenticate_user: the URL scheme (https) of the configured OIDCRedirectURI does not match the URL scheme of the URL being accessed (http): the "state" and "session" cookies will not be shared between the two!, oidc_authenticate_user: the URL scheme (https) of the configured OIDCRedirectURI does not match the URL scheme of the URL being accessed (http): the "state" and "session" cookies will not be shared between the two!,

My configuration is the following:

OIDCProviderMetadataURL https://welll-known/openid-configuration
OIDCRedirectURI https://mydomain/callback
OIDCScope "openid profile"
OIDCClientID CLIENT_ID
OIDCClientSecret secret
OIDCCryptoPassphrase "tA!2bC&4dEfGhI6jKlMnOpQrStUvXwZy"
OIDCProviderTokenEndpointAuth client_secret_post
OIDCSessionType client-cookie
OIDCCookiePath /
OIDCStateTimeout 300

I assume that since the apache is listening only on port 80 ( remind that load balancer only redirects all traffic to port 80) the redirect can not be implemented.
Is there a way I could change the redirectUri to make this scenario work ?

[zandbelt]

https://github.com/OpenIDC/mod_auth_openidc/wiki#8-how-do-i-run-mod_auth_openidc-behind-a-reverse-proxy

[JonEasy]

OIDCXForwardedHeaders X-Forwarded-Host
And still the problem

[zandbelt]

please read the error message more carefully ("scheme") and the documentation ("X-Forwarded-Proto")

[JonEasy]

It all work perfectly. Congratulation on the work done on this module. !!