EZproxy and Omeka and PDF Embed

I needed to lockdown an instance of Omeka via htaccess and make it accessible via EZproxy.

On a few phones I noticed that the item, but the PDF does not appear on the phone (only when using the proxy), so I switched from Object to JS (Choose the method to use to embed PDF documents. "Object" uses the browser's native PDF viewer or plugins like Adobe Reader. "PDF.js" uses a cross-browser JavaScript-based PDF viewer.) and it errors out with the Proxy.

Here is the browser error when using PDF.JS
PDF.js v1.0.473 (build: 1694cd8)
Message: Unexpected server response (0) while retrieving PDF "http://library.gc.cuny.edu/legacy/files/original/f2251a58d310d591fece5a22630e0eec.pdf".

I checked the server logs and there were no errors in either access or error logs.

Is there a best way to restrict access via htaccess?
I am currently using:
order deny,allow
deny from all

Note: because we are using a load balancer for our server and http client requests only see the virtual IP of the load balancer and not the actual IP of the server, I needed to add the entire class B to the .htacces ALLOW statement to include the proxy and load balancer server:
Allow from 146.96.0.0/16
I do not know if this piece of information is relevant.

Is there a best way to proxy Omeka?
The database stanza that I am using is:
Title Legacy ETDs
URL http://myfakesite.edu/legacy/
URL http://myfakesite.edu/legacy/files/
URL http://myfakesite.edu/legacy/items/
URL http://myfakesite.edu/legacy/items/show/
URL http://myfakesite.edu/legacy/files/original/
URL http://myfakesite.edu/legacy/files/fullsize/
URL http://myfakesite.edu/legacy/files/square_thumbnails/
URL http://myfakesite.edu/legacy/files/theme_uploads/
DJ myfakesite.edu
HJ myfakesite.edu

Note 2: This is completely independent of my previous question regarding the proxifying of URLs:
http://omeka.org/forums/topic/proxify-urls#post-114262

Thank you!

I am restricting access to an Omeka install via htaccess and discovered that PDFs are only viewable if:
• IP is included in the .htacces file that I use to restrict the world from the Omeka
• The clients hosts file is edited: 146.96.128.35 library.gc.cuny.edu

I think that the issue is either:
• There is an incompatibility between the JavaScript that is used in the PDF embed plugin and EZproxy. Hence if those two conditions exist the proxy is not being used. I have seen incompatibilities similar to this in the past. For example, SciFinder’s ‘drawing tools’ did not work for almost 6 months because of a similar incompatibility.

• The fact that we have our server behind a the load balancer and a virtual IP, which might be confusing the client requests.

I am not seeing many error messages, so it is difficult to diagnosis.

The plugin has two settings:
"Object" uses the browser's native PDF viewer or plugins like Adobe Reader. "PDF.js" uses a cross-browser JavaScript-based PDF viewer.

I see this error when I use the Object setting of the plugin:
[Wed Feb 03 09:52:44 2016] [error] [client 146.96.128.15] client denied by server configuration: /var/www/html/legacy/files/original/77864757253e251fef8e19b04ef547e6.pdf, referer: http://library.gc.cuny.edu.ezproxy.gc.cuny.edu/legacy/items/show/12130

I see this error in the browser when I use the JS setting of the plugin:
PDF.js v1.0.473 (build: 1694cd8)
Message: Unexpected server response (0) while retrieving PDF "http://library.gc.cuny.edu/legacy/files/original/f2251a58d310d591fece5a22630e0eec.pdf".

The plugin is trying to return:
http://library.gc.cuny.edu/legacy/files/original/f2251a58d310d591fece5a22630e0eec.pdf
rather than:
http://library.gc.cuny.edu.ezproxy.gc.cuny.edu/legacy/files/original/f2251a58d310d591fece5a22630e0eec.pdf

and unable to return:
http://library.gc.cuny.edu/legacy/files/original/f2251a58d310d591fece5a22630e0eec.pdf
because .htaccess prevents

Suggest how to append the URL?

You can tell Omeka that locally-stored files need to be exposed with a different base URL than the one it would normally use.

The config.ini setting is storage.adapterOptions.webDir and in your case it looks like you'd use the value http://library.gc.cuny.edu.ezproxy.gc.cuny.edu/legacy/files

I see two:

/var/www/html/legacy/application/config/config.ini
/var/www/html/legacy/themes/berlin/config.ini

I assume the one in the application?

I searched both versions of the file and do not see the setting. Do I just add it?

Thank you,
Stephen

Yes, it is the one at application/config/config.ini.

You'd just add the line

storage.adapterOptions.webDir = "http://library.gc.cuny.edu.ezproxy.gc.cuny.edu/legacy/files"

Great! Thank you for the superb support.

Because the baseURL (library.gc.cuny.edu.ezproxy.gc.cuny.edu) is hard-coded (only way that PDFs are always protected, yet accessible via EZproxy):
Accessing the site this way:
http://library.gc.cuny.edu/legacy/items/show/12122

does not work! PDF is not viewable and returns this error:
PDF.js v1.0.473 (build: 1694cd8)
Message: Unexpected server response (0) while retrieving PDF "http://library.gc.cuny.edu.ezproxy.gc.cuny.edu/legacy/files/original/8540fce3f163db8a68474287ffb90392.pdf".

Is there a different setting that I could use that would allow the 'base url' to be more dynamic? I mean, if folks come in via http://library.gc.cuny.edu/legacy/ (on campus) rather than http://library.gc.cuny.edu.ezproxy.gc.cuny.edu/legacy/ the plugin will not error out?

Not a showstopper. Just curious. Thanks.

I don't think there's anything built in that you can do to do this more dynamically.

You could probably make a plugin that looked for the presence of some HTTP header to indicate what the host name should be and configure the storage that way. I don't know what EZproxy specifically does, but there might be, for example, an X-Forwarded-Host header to tell you if the site's being accessed through the proxy, and you could look for that.

Thank you. Appreciate knowing.