Application Access does not support websockets #5264
Comments
webvictim
added
bug
feature-request
|
@webvictim I haven't found any documentation on Teleport for that so I am wondering if it is a current limitation. |
Then I could make it worked using a SSH local port forwarding with tsh only (so https + wss). If I try from the web portal selecting my app I have the following error I don't understand what is going wrong there as for other services like Kubernetes the forwarding to an internal cluster using a self signed TLS certificate is working properly. |
|
Hi, I am still encountering this issue after upgrading from 6.0 to 6.2. I tried different constellations but one app will fail with browsers reporting (in the dev console) Would appreciate any help. Thanks a lot! |
|
Hi, I am having the same problem here. Trying to access application which is behind nginx server as ngins id doing some hard rewrite stuff, which teleport is not able to do. However, websockets are working when I am directly accessing the web page from the nginx instance, but when I try to use the teleport app access before the nginx - everything seems to work fine except the websockets. I've tried everything described in this post and with no success. It seems wss:// just does not to pass through teeleport. Using teleport enterprise 7.3.3 |
|
cc @r0mant |
|
@webvictim I started using teleport ent 8.0.3 and now in the logs I can see that teleport is returning this: |
|
My knee jerk reaction looking at this response was that this looks like a beginning of TLS handshake which would've confirmed the issue with proxying secure web sockets but IIRC TLS handshake starts with We'd need to repro this to see what's going on, I'll see when we can schedule this. @lord-kyron Are you able to try and point Teleport directly to the application bypassing nginx just to try and rule it out, or is the application not available directly to your Teleport app agent? |
|
I've actually found what my issue is. It is because nginx was serving the server block with http2 enabled and it seems teleport knows that next hop will use http2 and tries to pass the websockets over the http2 and the nginx is returning the http is malformed as it cannot upgrade the request. However when I turned off the http2 on nginx level it is working flawlessly now. |
|
@lord-kyron I'm trying to proxy vCenter as well but I'm not having much luck. Would you be willing to share your NGINX and teleport configurations? |
|
@lord-kyron can share your nginx configurations? |
|
@vdudejon @itmisx And Teleport Apps configuration should be: |
Is it clear what exactly is missing in teleport and is there a follow up issue/ticket for it as feature request? |
What happened: Trying to establish a websocket connection through AAP does not allow websockets to connect.
What you expected to happen: Websockets should work.
How to reproduce it (as minimally and precisely as possible): Deploy something that requires websockets and proxy it through AAP. It will not work.
For my testing I used Node-Red. Deploy it in Docker using default port 1880. Set up AAP like so:
/etc/teleport.yaml:Connecting to https://nodered.teleport.example.com through a browser will load the UI, but websocket connections will fail. You can see this in Chrome dev tools:
For contrast, here's the websocket traffic working correctly using Caddy:
I can see no relevant logs outputted from Teleport during these attempted websocket connections, even at DEBUG level. Regardless, here is the full log section for the connection from start to finish:
Environment
Teleport version (use
teleport version):Teleport v5.1.0 git:v5.1.0-0-g46679fb34 go1.15.5OS (e.g. from
/etc/os-release):Fedora 32Where are you running Teleport? (e.g. AWS, GCP, Dedicated Hardware): Intel NUC
Browser environment
Google Chrome Version 87.0.4280.88 (Official Build) (arm64)The text was updated successfully, but these errors were encountered: