Step 2-Configure the UMP-365 VM
You need to ensure that only the WAF is able to access the IIS and to prevent repeated redirect requests behind the NAT.
| ➢ | To configure the UMP-365 VM: |
| 1. | Configure IIS bindings: |
| ● | Keep the *:80 binding on Default Website. The WAF connects to it. |
| ● | The installer also adds a *:443 binding with a self-signed certificate called UMP-SSL. If nobody uses HTTPS on the VM directly, remove this binding. If you keep it, replace the certificate with one from your internal CA. Scanners report a self-signed certificate as a finding. |
| 2. | Configure Forwarded headers: The UMP-365 Web application (/tenantui) reads X-Forwarded-Proto therefore no change is required. The Customer portal (/authenticate) does not read it by default, and it redirects every HTTP request to HTTPS behind the WAF which creates an endless redirect loop. To fix it, add the following environment variable to C:\acs\SysAdmin.CustomerAuthentication\web.config, inside the <aspNetCore> element: |
Copy
<environmentVariables>
<!-- keep the variables that are already there -->
<environmentVariable name="ASPNETCORE_FORWARDEDHEADERS_ENABLED" value="true" />
</environmentVariables>
| 3. | Recycle the application pool AuthAppPool. An upgrade of UMP-365 replaces this web.config, so check this setting after every upgrade. |