Hi everyone,I'm having connection issues to our on-premise Ceph RGW storage with AWSSimpleStorage.Due to our firewalls being restrictive, I tried to go through the private gateway path.Works good for APIs but I had to set a Host header to make it work just as the documentation mentioned. (https://success.outsystems.com/documentation/outsystems_developer_cloud/managing_outsystems_platform_and_apps/configure_a_private_gateway_to_your_network/)Then I tried to connect to the Ceph server but I have no control on the headers sent and as a result, the connection is always dropped.Anyone has experience with this issue?Is there an official way to contact the author of AWSSimpleStorage to eventually have the possibility to add that header as an optional parameters ?Thank you very much for your answers,Axel
Hi, you did contact the author 😃 Im currently at ONE conference. I will Take a Look once i returned. best. Stefan
Hi. I checked the ceph documentation and according to it, no special headers using the AWS SDK are needed. I'm not using ceph but maybe you just need to set the ForcePathStyle config property to True.
On Forge you will also find a demo application AWS Simple Storage Service Demo that you can use to try and inspect. I can confirm that the demo runs with MinIO and Garage S3 self-hosted.
Can you let me know which Header you are looking for?
Stefan
Hi Stefan,
Thank you for your quick response and for pointing out the ForcePathStyle property. I can confirm that I am already using ForcePathStyle = True in my configuration.
You are completely right that under normal circumstances, a standard S3/Ceph integration using the AWS SDK doesn't require any special headers. However, our issue isn't caused by Ceph itself, but rather by the OutSystems ODC Private Gateway network architecture.
Because our Ceph storage is self-hosted on-premise behind a restrictive firewall, we cannot target it directly from ODC. We have to route the traffic through the ODC Private Gateway.
Here is exactly what happens:
The Endpoint Mismatch: To route the SDK traffic through the secure tunnel, we have to configure the AWS client endpoint to point to our ODC Private Gateway URL (e.g., https://<secure-gateway>) instead of our actual internal Ceph URL (https://s3.storage.company.be).
The Proxy/Reverse-Proxy Issue: When the AWS SDK sends the request, it automatically generates a standard HTTP Host header based on that endpoint URL.
The Drop: When that request hits our internal corporate proxy/reverse-proxy on the other side of the gateway, the proxy sees a Host header matching the OutSystems gateway domain instead of the expected internal Ceph domain. Because security policies strictly validate the Host header to prevent unauthorized routing, our reverse-proxy immediately drops the connection.
To make this architecture work, the OutSystems documentation explicitly states that we must manually override the Host header to match our internal target server domain.
My Working Solution
To unblock our project, I took a look at your library's source code. I'm not a .NET expert, so I used some AI assistance to help me tap into the AWS SDK's pipeline, but I managed to get a working fix locally using the BeforeRequestEvent hook.
It works flawlessly with our Private Gateway setup now. Here is the diff of my implementation if you'd like to use it as a reference:
Since you know the codebase inside out, you might have a cleaner or more idiomatic .NET way of handling this, but the logic effectively solves the gateway block.
Would you be open to introducing a HostHeader parameter like this in an upcoming official release? It would safely enable support for enterprise environments utilizing secure proxies without affecting standard cloud setups.
A similar problem seems to happen with pre-signed URL but I have to take a closer look to it.
Thank you again for your time and for maintaining this great component!
Best regards,Axel
I see. I really wonder why this is working in your environment. The service endpoint is part of the SIGv4 and an S3 store following S3 compatibility should deny a request due to signature mismatch. But as said I never had a chance to work with ceph before.
What you are doing in your custom code is already the way to change the Host header. If this works for you I suggest you use your own custom code for the time being. I have to do some extensive testing before adding this to the codebase and it will take some time......
I would nevertheless suggest that your reverse-proxy allows secure-gateway as an allowed host. This is IMHO a much cleaner approach.
Hi Stefan,I'll a have a chat with my colleagues about the proxy following your advice.
Here's the code that was adapted to make pre-signed url work if hostheader is provided :
Hope it may help some people in the same case as us.Have a great day,Axel