Skip to content
English
Contact Us
  • There are no suggestions because the search field is empty.

Setup Shinydocs Dashboards Behind Reverse Proxy in IIS

This guide shows how to make Shinydocs Dashboards available through Microsoft IIS, Windows’ built-in web server. Users get one secure web address instead of connecting to Dashboards directly. You install a few IIS add-ons, set up the forwarding, and turn on HTTPS. Then you limit access so only approved Windows users or groups can sign in.

 Table of Contents

Setting up IIS

To set up IIS, you will need to make a site and download some additional features.

  1. In Server Manager, go to Manage > Add Roles and Features.
  2. Select Role-based or feature-based installation, then click Next.
  3. Select the server from the server pool, then click Next.
  4. You should now be in Server Roles. Make sure you have URL Authorization and Windows Authentication checked.

  5. Proceed through the remainder of the wizard.
  6. Download and install:

Make your Site

  1. Open IIS Manager.
  2. Right-click Sites and click Add Website.
  3. Give the site a name. Use the DefaultAppPool application pool.
  4. Give a physical path where the site will be located.
  5. For bindings:
    Setting Value
    Type http (https can be used here, but you will need a certificate)
    IP address All Unassigned
    Port 80 is the default; this can be changed if needed
    Host name Specify a host name
  6. Now you have your site!

Configure the IIS Reverse Proxy

  1. Launch IIS Manager and select the website you'll be configuring as the reverse proxy. Click the URL Rewrite feature in the center panel.
  2. Click Add Rule(s)... in the Actions panel on the right.
  3. In the Add Rule(s) dialog, select Reverse Proxy and click OK.
  4. Click OK again.
  5. In the Add Reverse Proxy Rules dialog:
    • Under Inbound Rules, enter the Kibana URL (localhost:5601) as the location where requests will be forwarded.
    • Under Outbound Rules, enable Rewrite the domain names of the links in HTTP responses, and enter the external URL for the server in the To: field. The external URL is whatever clients on the network will type into their browsers to access Kibana. (The example uses the server name from a lab environment.)
    • Click OK to complete the dialog.

    Screenshot: Add Reverse Proxy Rules dialog with these values:

    Field Value
    Inbound Rules – server name or IP localhost:5601
    Enable SSL Offloading Checked
    Rewrite the domain names of the links in HTTP responses Checked
    From localhost:5601
    To smb-elk1 (example server name)

Configure Server Variables

Inbound configuration

  1. With the website selected, go back to the URL Rewrite module. This time choose View Server Variables... from the Actions panel.
  2. On the Allowed Server Variables screen, choose Add... to add a new server variable called HTTP_ACCEPT_ENCODING, then click OK. Follow the same process to add a second variable called HTTP_X_ORIGINAL_ACCEPT_ENCODING.
  3. Go back to the URL Rewrite rules and select the inbound rule (for example, ReverseProxyInboundRule1). Then click Edit....
  4. On the Edit Inbound Rule screen, expand the Server Variables section and click Add....
    • From the Server variable name drop-down, select HTTP_X_ORIGINAL_ACCEPT_ENCODING.
    • Under Value, type {HTTP_ACCEPT_ENCODING}. Be sure to include the curly braces so the rule knows to use the value of that variable.
    • Leave Replace the existing value checked, then click OK.
  5. Click Add... again to add another server variable.
    • This time select HTTP_ACCEPT_ENCODING from the drop-down.
    • Type any text value into the Value field (for example, 123).

    Note: The goal is to set this variable's value to empty, but the field won't accept a blank value. Enter any placeholder text so the variable can be saved; it is replaced with a blank in step 7.

  6. With both variables set, click Apply in the Actions panel.
  7. Replace the placeholder text value (123 in this example) with a blank. This is done in the website's web.config file. For the Default Web Site, that file is located in C:\inetpub\wwwroot. Open web.config in a text editor, find the text value you entered, and delete the value between the quotes, leaving just the quotes.Before: 
    <rule name="ReverseProxyInboundRule1" stopProcessing="true">
        <match url="(.*)" />
        <action type="Rewrite" url="http://localhost:5601/{R:1}" />
        <serverVariables>
            <set name="HTTP_X_ORIGINAL_ACCEPT_ENCODING" value="{HTTP_ACCEPT_ENCODING}" />
            <set name="HTTP_ACCEPT_ENCODING" value="123" />
        </serverVariables>
    </rule>

    After:

    <rule name="ReverseProxyInboundRule1" stopProcessing="true">
        <match url="(.*)" />
        <action type="Rewrite" url="http://localhost:5601/{R:1}" />
        <serverVariables>
            <set name="HTTP_X_ORIGINAL_ACCEPT_ENCODING" value="{HTTP_ACCEPT_ENCODING}" />
            <set name="HTTP_ACCEPT_ENCODING" value="" />
        </serverVariables>
    </rule>
  8. In web.config, also add the following after <configuration> and before <system.webServer>: 
    <system.web>
        <httpRuntime requestPathInvalidCharacters="" relaxedUrlToFileSystemMapping="true" />
    </system.web>

    The top of the file should look like this:

    <?xml version="1.0" encoding="UTF-8"?>
    <configuration>
        <system.web>
            <httpRuntime requestPathInvalidCharacters="" relaxedUrlToFileSystemMapping="true" />
        </system.web>
        <system.webServer>
  9. Save the file.

Outbound configuration

That addresses the inbound portion of the configuration. Next, address outbound traffic.

  1. Under URL Rewrite, click Add Rule(s)... again, this time selecting Blank rule under Outbound rules.
  2. Name the new rule RestoreAcceptEncoding, and select <Create New Precondition...> from the drop-down menu. On the Add Precondition screen:
    • Name: NeedsRestoringAcceptEncoding
    • Using: Regular Expressions
    • Logical grouping: Match All
  3. Click Add... to add a new condition:
    • Condition input: {HTTP_X_ORIGINAL_ACCEPT_ENCODING} (include the curly braces)
    • Check if input string: Matches the Pattern
    • Pattern: .+
    • Ignore case: Checked
    Click OK, then click OK again to close the Add Precondition dialog.
  4. Still on the Edit Outbound Rule screen, find the Match section and set:
    • Matching scope: Server Variable
    • Variable name: HTTP_ACCEPT_ENCODING
    • Variable value: Matches the Pattern
    • Using: Regular Expressions
    • Pattern: ^(.*)
    • Ignore case: Checked
  5. Lastly, under the Action section:
    • Ensure Action type is set to Rewrite.
    • For Value, type {HTTP_X_ORIGINAL_ACCEPT_ENCODING} (include the curly braces).
    • Ensure Replace existing server variable value is checked.
    • Leave Stop processing of subsequent rules unchecked.
    • Click Apply.

If everything has gone according to plan, reverse proxying from IIS to Kibana should now be working. If you browse to http://localhost on the Elastic server, you should see Kibana being served via IIS over port 80.

Configure SSL Certificate

  1. Select the server name in the left-hand Connections panel, then choose the Server Certificates option.
  2. Choose Create Self-Signed Certificate... from the Actions pane.
  3. Type the friendly name you want to use for referencing this certificate (the example uses the server name, SMB-ELK1). Leave the certificate store set to Personal. Click OK.
  4. With the certificate created, bind it to the website. To do that, expand the server in IIS and select the website (for example, Default Web Site).
  5. Select Bindings... from the Actions pane.
  6. On the Site Bindings screen, choose Add....
  7. On the Add Site Binding screen:
    • Type: https
    • IP address: All Unassigned
    • Port: 443
    • SSL certificate: select your certificate from the drop-down
  8. Click OK to add the site binding, then click Close to close the Site Bindings screen. The website is now accessible over HTTPS.

Configuring User Authentication

  1. Back on the Dashboards server in IIS, select the website and choose the Authentication option.
  2. Within Authentication, set:
    Name Status
    Anonymous Authentication Disabled
    Windows Authentication Enabled
  3. Return to the main IIS screen for the website and select Authorization Rules.
  4. Delete the Allow → All Users rule that is created by default. Then click Add Allow Rule... in the Actions pane.
  5. In the Add Allow Authorization Rule dialog, select the Specified roles or user groups radio button and type the name of the group you're allowing access to (for example, SMBLAB\Role-G-ElasticAdmins). Then click OK.