Software-Based Clustering [Ubuntu 12.04]

[Jarno Huuskonen]

Hi,

On Wed, Jul 08, Manuel Haim wrote:
> haproxy is configured to spread the request over the tomcat backends,
> sticking to the JSESSIONID cookie. We have additionally added the
> ability to check for a "_preselect_" cookie in order to select an idp
> backend for testing purposes.
> 
> You can use a software package kalled "keepalived" for IP failover, so
> if your server running the loadbalancer fails, another server may step in.
> 
> The v2 IDPs run directly within tomcat here (no apache). Therefor we
> have added a org.apache.catalina.valves.RemoteIpValve (to unpack
> X-Forwarded-For and ignore the loadbalancer ip) and an
> unimr.tomcat6.ProxiedSslValve (to unpack the ssl client cert), you will
> find the latter at
> http://www.staff.uni-marburg.de/~haimm/

We use fairly similar setup, but we use haproxy for ssl offloading
and loadbalancing (so no nginx). We don't need backchannel/soap
endpoints (no port 8443 / client certs), but I've tested that haproxy
can optionally verify client certs and insert client cert in header
and tomcat sslvalve can parse the cert.

Manuel: is unimr.tomcat6.ProxiedSslValve needed to parse nginx/pound
SSL_CLIENT_CERT header ? (AFAIK tomcat SSLValve can't parse pound/nginx
\n\t in SSL_CLIENT_HEADER).

-Jarno

-- 
Jarno Huuskonen