Redirection and Rewrite (SSO)

Heya,

Here is a suggestion on how this could be achieved but it would still need to be fully tested,

It sounds like you are dealing with a Single Sign-On (SSO) flow that includes a redirection to an internal domain which the client cannot resolve, and you would like to modify that redirect so that it points to a public domain instead.

If the redirect is initiated by the server that is behind the reverse proxy, then Apache’s mod_proxy module alone cannot solve your issue because the redirection is part of the HTTP payload, and mod_proxy does not modify the HTTP payload, it only passes it along.

Instead, you can use Apache’s mod_substitute module in combination with mod_proxy to rewrite the redirection URL in the HTTP payload.

Here is an example of how to do it:

<VirtualHost *:443>
  ServerName example.public.com

  # Enable the substitute module for the response bodies
  SetOutputFilter SUBSTITUTE

  # Replace the internal domain with the public one in the Location header
  Substitute "s|example_server.private.com|example_server.public.com|n"

  ProxyPass        / https://1.2.3.4/
  ProxyPassReverse / https://1.2.3.4/
  ProxyPreserveHost On

  DocumentRoot /var/www/default
  SSLEngine on
  SSLProxyEngine on
  SSLProxyCheckPeerName Off
  SSLProxyCheckPeerCN Off

  ErrorLog "/var/log/apache2/proxy-error-prime-proxy-full.log"
  CustomLog "/var/log/apache2/proxy-access-prime-proxy-full.log" common
</VirtualHost>

his configuration will replace any occurrence of example_server.private.com with example_server.public.com in the HTTP response bodies.

Note: Apache mod_substitute is not the most performant module, especially for large payloads. Use with caution in production environments and always test your configuration thoroughly before applying it.

Remember to enable the module with a2enmod substitute and restart Apache with systemctl restart apache2 or the equivalent command on your system.

If the above solution doesn’t work for you or your use case is more complex, you might need to use a more sophisticated reverse proxy such as Nginx or a full-featured API Gateway that supports response rewriting out of the box.

As always, carefully consider the security implications of any configuration changes you make. Modifying HTTP payloads on-the-fly can potentially expose sensitive information if not done carefully.