power bi report server web application access shows internal server error 500

[masbirooo]

Hi,

iam proxying my power bi report server web UI through teleport,
the UI is has a NLB and NFW on front,
iam accessing through the original url normally but through teleport it prompts the report server's basic auth page
and after i log in it shows a black screen with internal server error

Teleport/teleport agent Version:
14.3.14

Report server logs:

received a request with an unmatched or no authentication scheme. 401

teleport agent logs:
{"caller":"reverseproxy/reverse_proxy.go:216","component":"app:service","level":"error","message":"Error forwarding to https://is-report.example.com/reports/browse, err: stream error: stream ID 3; HTTP_1_1_REQUIRED; received from peer","timestamp":"2024-04-18T08:57:54Z"}

teleport agent config:

- name: is-report
    uri: "https://is-report.example.com/reports/browse"
    public_addr: is-report.teleport.exmple.com/reports/browse
  labels:
     xx: xx

iam not sure if this is related to teleport not supporting basic auth
or redirection issue or could be certificate issue!

any ideas ?

[masbirooo]

i can now login by switch the uri to http:10.x.x.x/reports/browse instead of https, but now i get 400 bad request

[webvictim]

On the face of it, this looks like the web server is expecting an HTTP/1.1 connection but Teleport is actually using HTTP/2 to connect to it. This shouldn't happen.

With that said, your app config also looks a bit off. Correct indentation and spacing are very important in YAML. Try this and restart:

apps:
- name: is-report
  uri: https://is-report.example.com/reports/browse
  public_addr: is-report.teleport.exmple.com
  labels:
    xx: xx

[uedvt359]

i've gotten the same error on a host requiring ntlm authentication (iis). i don't have a solution for proxying these right now.

~ % curl -v https://iis.example.com/login/
* ALPN: server accepted h2
* using HTTP/2
* h2 [:method: GET]
* h2 [:scheme: https]
* h2 [:authority: iis.example.com]
* h2 [:path: /login/]
* h2 [user-agent: curl/8.2.1]
* h2 [accept: */*]
* Using Stream ID: 1
> GET /pwserver/ HTTP/2
> Host: iis.example.com
> User-Agent: curl/8.2.1
> Accept: */*
> 
< HTTP/2 401 
< content-type: text/html
< server: Microsoft-IIS/10.0
< www-authenticate: Negotiate
< www-authenticate: NTLM
< x-powered-by: ASP.NET

INFO [APP:SERVI] Round trip: GET https://iis.example.com/login/, code: 401, duration: 11.580597ms tls:version: 304, tls:resume:true, tls:csuite:1301, tls:server:74656c65706f72742e696e7472612e7469726f6c2e67762e6174.teleport.cluster.local reverseproxy/reverse_proxy.go:223
INFO [APP:WEB]   Round trip: GET /login/, code: 401, duration: 15.911181ms tls:version: 304, tls:resume:true, tls:csuite:1301, tls:server:iis.teleport.local reverseproxy/reverse_proxy.go:223
ERRO [APP:SERVI] Error forwarding to https://iis.example.com/login/, err: stream error: stream ID 3; HTTP_1_1_REQUIRED; received from peer reverseproxy/reverse_proxy.go:218
INFO [APP:WEB]   Round trip: GET /login/, code: 500, duration: 1.717454ms tls:version: 304, tls:resume:true, tls:csuite:1301, tls:server:iis.teleport.local reverseproxy/reverse_proxy.go:223

[AnNHSVT]

Same issue!

Does anyone have solution to workaround/resolve this problem?

Thanks and Regards!

[tunguyen9889]

I am facing the same issue when configuring Teleport to proxy through the Power BI Report (SSRS) https endpoint, got the HTTP_1_1_REQUIRED error. Using the http endpoint works, but it's not stable.
Teleport version 17.4.5