# CPE fails to authenticate to GenieACS v1.2 behind NGINX

**URL:** <https://forum.genieacs.com/t/cpe-fails-to-authenticate-to-genieacs-v1-2-behind-nginx/844>\
**Category:** Uncategorized\
**Created:** [June 18, 2020, 1:55pm UTC](https://forum.genieacs.com/t/cpe-fails-to-authenticate-to-genieacs-v1-2-behind-nginx/844 "2020-06-18T13:55:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bboyanov](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bboyanov](https://forum.genieacs.com/u/bboyanov)\
**Post date:** [June 18, 2020, 1:55pm UTC](https://forum.genieacs.com/t/cpe-fails-to-authenticate-to-genieacs-v1-2-behind-nginx/844/1 "2020-06-18T13:55:59Z")

</div>

Hi,  
The CPE fails to authenticate to GenieACS v1.2 behind NGINX (as reverse proxy).  
The ACS returns “Authentication failure”.  
If the ACS direct (not after NGIX) is working perfect.

My setup:

1. NGINX (terminate SSL):

> ```
> > server {
> > listen MY_IP_ADDRESS:7547 ssl;
> > server_name tr1.telenor.bg;`
> > ssl_certificate_key /etc/nginx/cert.key;
> > ssl_certificate /etc/nginx/cert.crt;
> > location / {
> > proxy_ssl_session_reuse off;
> > proxy_http_version 1.1;
> > proxy_buffering off;
> > proxy_pass_header Authorization;
> > proxy_set_header Host $host;
> > proxy_set_header Connection "Keep-Alive";
> > proxy_set_header X-Forwarded-User $remote_user;
> > proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
> > proxy_pass http://127.0.0.1:7546;
> > }
> > }
> 
> ```

1. GenieACS configuration (no SSL):  
`GENIEACS_CWMP_INTERFACE=127.0.0.1`  
`GENIEACS_CWMP_PORT=7546`

---

<div class="post-metadata">

**Author:** ![bboyanov](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bboyanov](https://forum.genieacs.com/u/bboyanov)\
**Post date:** [June 25, 2020, 3:59pm UTC](https://forum.genieacs.com/t/cpe-fails-to-authenticate-to-genieacs-v1-2-behind-nginx/844/2 "2020-06-25T15:59:49Z")

</div>

After looking in the code I found that this check fails ( **if (!s || n.nonce !== s || n.qop && (!n.cnonce || !n.nc))** ) due to “s” is empty:

```
async function authenticate(e, t) {
                const s = getConfigExpression(e.cacheSnapshot, "cwmp.auth");
                if (!s)
                    return !0;
                let n;
                if (e.httpRequest.headers.authorization && (n = parseAuthorizationHeader(e.httpRequest.headers.authorization)),
                n && "Digest" === n.method) {
                    const s = sessionsNonces.get(e.httpRequest.connection);
                    if (!s || n.nonce !== s || n.qop && (!n.cnonce || !n.nc)){
                        return !1;
					}
                    n.body = t
                }

```

Some how **e.httpRequest.connection** is no not exist and is droped from WeakMap ( **sessionsNonces** ).

Any suggestions?

---

<div class="post-metadata">

**Author:** ![zaidka](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.genieacs.com/zaidka/32/9_2.png) [@zaidka](https://forum.genieacs.com/u/zaidka)\
**Post date:** [June 25, 2020, 7:14pm UTC](https://forum.genieacs.com/t/cpe-fails-to-authenticate-to-genieacs-v1-2-behind-nginx/844/3 "2020-06-25T19:14:51Z")

</div>

I can look into it if you can send me a packet capture of the Digest authentication request and response between GenieACS and nginx.

---

<div class="post-metadata">

**Author:** ![bboyanov](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bboyanov](https://forum.genieacs.com/u/bboyanov)\
**Post date:** [June 26, 2020, 7:53am UTC](https://forum.genieacs.com/t/cpe-fails-to-authenticate-to-genieacs-v1-2-behind-nginx/844/4 "2020-06-26T07:53:11Z")

</div>

Hi Zaid,  
I forgot to mention that the “code” post is a bit different: we skip the NGINX and we use load balancer to ofload the SSL. In this case the communication is successful only in case without authentication. If the authentication is used - the behavior is the same as ASC behind NGINX proxy (fails with 401 Unauthorized).

So, I’ll send you **tcpdump** files soon.

Thanks

---

<div class="post-metadata">

**Author:** ![bboyanov](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bboyanov](https://forum.genieacs.com/u/bboyanov)\
**Post date:** [July 3, 2020, 12:43pm UTC](https://forum.genieacs.com/t/cpe-fails-to-authenticate-to-genieacs-v1-2-behind-nginx/844/5 "2020-07-03T12:43:05Z")

</div>

Sorry for the late replay.  
I found the problem that cause the problem. It was configuration in F5 load balancer. After some switch change in F5, now the authentication is working fine.

Now there is a other issue probably it is not related to ACS.

Once again sorry for the late replay.