Software-Based Clustering [Ubuntu 12.04]
Manuel Haim
haim at hrz.uni-marburg.de
Wed Jul 8 03:36:38 EDT 2015
Hi Ricardo,
just some hints to get you started with a software solution:
We are still running an IdP v2 cluster, initially used "pound" for load
balancing, but then switched to a stack of "nginx" 1.6.2 and "haproxy"
1.5.8 (as pound did not allow to switch off the insecure SSLv3).
nginx is used here to do SSL offloading, i.e. it serves the https page
and forwards the request as plain http to haproxy. The remote ip is put
insiede the X-Forwarded-For http header. Additionally, nginx is
configured to ask for the SSL client certificate if the request comes in
at the SOAP backchannel (port 8443) and puts it inside a http header
(for later retrieval by the idp).
haproxy is configured to spread the request over the tomcat backends,
sticking to the JSESSIONID cookie. We have additionally added the
ability to check for a "_preselect_" cookie in order to select an idp
backend for testing purposes.
You can use a software package kalled "keepalived" for IP failover, so
if your server running the loadbalancer fails, another server may step in.
The v2 IDPs run directly within tomcat here (no apache). Therefor we
have added a org.apache.catalina.valves.RemoteIpValve (to unpack
X-Forwarded-For and ignore the loadbalancer ip) and an
unimr.tomcat6.ProxiedSslValve (to unpack the ssl client cert), you will
find the latter at
http://www.staff.uni-marburg.de/~haimm/
Please find some configuration examples attached to this email.
Kind regards,
Manuel
Am 07.07.2015 um 17:13 schrieb Ricardo T. Macedo:
> I’m configuring a cluster with IdP v3 using ubuntu 12.04. The
> documentation recommends the hardware or software-based clustering
> (https://wiki.shibboleth.net/confluence/display/IDP30/Clustering#Clustering-Hardware-orSoftware-BasedClusteringAn).
> My idea is use a free software-based approach (less expensive). Anyone
> has tried this before? What software is normally used in IdP clustering
> to intercept and route traffic to various nodes in a cluster?
>
>
> Best regards,
>
> Ricardo.
>
>
>
-------------- next part --------------
# HAProxy configuration
# M. Haim, 30-Oct-2014
global
# logging
#log /dev/log local0
#log /dev/log local1 notice
#chroot /var/lib/haproxy
#stats socket /run/haproxy/admin.sock mode 660 level admin
#stats timeout 30s
#user haproxy
#group haproxy
#
daemon
maxconn 256
defaults
# logging
#log global
#option httplog
#option dontlognull
#
mode http
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
### Frontends ###################################################
### HTTPS:443 from nginx -> HTTP:444 HAProxy ###
frontend https
bind localhost:444
# check url:
acl url_idp path_beg /idp
# check cookie:
acl cookie_idp01 cook(_preselect_) idp01
acl cookie_idp02 cook(_preselect_) idp02
use_backend tomcat-8080-idp01 if url_idp cookie_idp01
use_backend tomcat-8080-idp02 if url_idp cookie_idp02
use_backend tomcat-8080 if url_idp
default_backend apache-443
# HTTPS:8443 from nginx -> HTTP:8444 HAProxy
frontend https-soap
bind localhost:8444
acl url_idp path_beg /idp
use_backend tomcat-8443 if url_idp
default_backend apache-443
### Backends ###################################################
### Apache (www endpoint) ###
backend apache-443
balance roundrobin
server idp01 idp01.example.org:443 check
server idp02 idp02.example.org:443 check
backend apache-443-idp01
server idp01 idp01.example.org:443 check
backend apache-443-idp02
server idp02 idp02.example.org:443 check
### Shibboleth IdP (www endpoint) ###
backend tomcat-8080
balance roundrobin
# Stick to Java session cookie:
appsession JSESSIONID len 52 timeout 1h
server idp01 idp01.example.org:8080 check
server idp02 idp02.example.org:8080 check
backend tomcat-8080-idp01
server idp01 idp01.example.org:8080 check
backend tomcat-8080-idp02
server idp02 idp02.example.org:8080 check
### Shibboleth IdP (SOAP endpoint) ###
backend tomcat-8443
balance roundrobin
# Stick to Java session cookie:
appsession JSESSIONID len 52 timeout 1h
server idp01 idp01.example.org:8443 check
server idp02 idp02.example.org:8443 check
-------------- next part --------------
# nginx include
# M. Haim, 24-Oct-2014
# Intermediate HTTPS configuration
# see https://wiki.mozilla.org/Security/Server_Side_TLS
server_name idp.example.org;
# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
ssl_certificate /path/to/sslchain.pem;
ssl_certificate_key /path/to/sslchain.pem;
ssl_session_timeout 5m;
ssl_session_cache shared:SSL:50m;
# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
# current parameter generated by: `openssl dhparam -out dhparam.pem 2048`
ssl_dhparam /etc/nginx/dhparam.pem;
# Intermediate configuration. tweak to your needs.
# Using Mozilla intermediate recommendation here,
# see https://wiki.mozilla.org/Security/Server_Side_TLS
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
# Enable this if your want HSTS (recommended)
add_header Strict-Transport-Security max-age=15768000;
# OCSP Stapling ---
# fetch OCSP records from URL in ssl_certificate and cache them
ssl_stapling on;
ssl_stapling_verify on;
## verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /path/to/sslchain.pem;
# resolver <IP DNS resolver>;
location / {
proxy_pass $myproxy;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# Forward ssl cert (for ProxiedSSLValve)
# see http://nginx.org/en/docs/http/ngx_http_ssl_module.html
proxy_set_header X-SSL-certificate $ssl_client_cert;
proxy_set_header X-SSL-cipher $ssl_cipher;
# Forward ssl cert (for SSLValve)
# see http://tomcat.apache.org/tomcat-7.0-doc/config/valve.html#SSL_Valve
proxy_set_header ssl_client_cert $ssl_client_cert;
proxy_set_header ssl_cipher $ssl_cipher;
proxy_set_header ssl_session_id "(null)";
proxy_set_header ssl_cipher_usekeysize "(null)";
# The following headers are not needed:
#proxy_set_header X-SSL-Subject $ssl_client_s_dn;
#proxy_set_header X-SSL-Issuer $ssl_client_i_dn;
#proxy_set_header X-SSL-notBefore ; # not available in nginx
#proxy_set_header X-SSL-notAfter ; # not available in nginx
#proxy_set_header X-SSL-serial $ssl_client_serial;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto https;
### By default we don't want to redirect it ####
proxy_redirect off;
}
-------------- next part --------------
# nginx configuration
# M. Haim, 24-Oct-2014
# HTTP endpoint - rewrite url to to HTTPS
server {
listen 80;
rewrite ^ https://$host$uri permanent;
}
# HTTPS endpoint
server {
listen 443;
ssl on;
set $myproxy http://backends;
include /etc/nginx/nginx-myproxy.conf;
}
# HTTPS-SOAP endpoint (with SSL client cert)
server {
listen 8443;
ssl on;
set $myproxy http://backends8443;
ssl_verify_client optional_no_ca;
include /etc/nginx/nginx-myproxy.conf;
}
# hand over to HAProxy
upstream backends {
server localhost:444;
}
# hand over to HAProxy
upstream backends8443 {
server localhost:8444;
}
-------------- next part --------------
A non-text attachment was scrubbed...
Name: tomcat_server.xml
Type: text/xml
Size: 1712 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150708/b7d7b6f3/attachment-0001.xml>
More information about the users
mailing list