How to Configure IIS 7.0 proxy in front of Apache with Crowd/JIRA/Confluence?

[Joshua Procious]

Hello. We have Crowd 3.4.4 set up on a server AWS instance and JIRA/Confluence set up on another instance. Application links and user directories are all working correctly. OAUT is fine and the crowd.properties is configured for standard input tested on our dev site and working and seraph-config is configured correctly. Users are able to log in using Crowd Directory on both Jira and Confluence. The only problem is that SSO doesn't work. I've gone through this (https://confluence.atlassian.com/crowd/troubleshooting-sso-with-crowd-131466214.html\) tutorial and verified everything. However I suspect something with reverse proxy is misconfigured. We are NOT running a virtual Apache proxy, we are using IIS 7 and then Apache behind with proxyName, proxyPort, and scheme configured. JIra/Confluence have SSL configured and working before this addition of Crowd. From the Crowd log file in debug mode: 

DEBUG [integration.http.util.CrowdHttpTokenHelperImpl] Checking for a SSO token that will need to be verified by Crowd.

 DEBUG [integration.http.util.CrowdHttpTokenHelperImpl] No request attribute token could be found, now checking the browser submitted cookies.

DEBUG [integration.http.util.CrowdHttpTokenHelperImpl] Unable to find a valid Crowd token.

[Joshua Procious · Accepted solution]

The Reverse Proxy that lives for JIRA/Confluence on the Production EC2 instance needed to have "Reverse rewrite host in response headers" setting unchecked. This is found in IIS>Application Request Routing Cache>Proxy Settings (on right). When checked, this keeps the crowd.key from being passed correctly to Crowd and then back to the site (JIRA or Confluence respectively).