Software-Based Clustering [Ubuntu 12.04]

[Manuel Haim]

Hi Jarno,

> but I've tested that haproxy can optionally verify client certs and
> insert client cert in header and tomcat sslvalve can parse the cert.

I guess you refer to this thread (haproxy >= 1.5.8 needed):
http://comments.gmane.org/gmane.comp.web.haproxy/18796

Well, that works, but seemed a bit hacky to me, so we stayed with nginx
+ haproxy.
For completeness, I have added a working haproxy-only configuration
attatched to this email.


> Manuel: is unimr.tomcat6.ProxiedSslValve needed to parse nginx/pound
> SSL_CLIENT_CERT header ? (AFAIK tomcat SSLValve can't parse pound/nginx
> \n\t in SSL_CLIENT_HEADER).

You are right, the default org.apache.catalina.valves.SSLValve will work
well with SSL_CLIENT_CERT header when set by Apache or HAProxy, as the
header has the same shape. The unimr.tomcat6.ProxiedSslValve as a
replacement is only needed when the header is set by pound or nginx.

Reason: When adding the client cert to the http header, the newline
character will be replaced in different ways:

Apache mod_header: Whitespace
Pound: Tab
nginx: Whitespace+Tab
HAProxy: Whitespace


Kind regards,
Manuel
-------------- next part --------------
# HAProxy configuration
# M. Haim, 30-Oct-2014
global
	daemon
	maxconn 256
	tune.ssl.default-dh-param 2048
	# set default parameters to the Intermediate configuration
	# see https://wiki.mozilla.org/Security/Server_Side_TLS
	ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

defaults
	mode http
	timeout connect 5000ms
	timeout client 50000ms
	timeout server 50000ms
	option forwardfor

### Frontends ###################################################

### HTTP:80 ###
frontend http
	bind *:80
	redirect scheme https code 301 if !{ ssl_fc }

### HTTPS:443 ###
frontend https
	bind *:443 ssl no-sslv3 crt /path/to/sslchain.pem
	# Enable this if your want HSTS (recommended)
	rspadd  Strict-Transport-Security:\ max-age=15768000
	reqadd X-Forwarded-Proto:\ https
	# check url:
	acl url_idp path_beg /idp
	# check cookie:
	acl cookie_idp01 cook(_preselect_) idp01
	acl cookie_idp02 cook(_preselect_) idp02
	use_backend tomcat-8080-idp01 if url_idp cookie_idp01
	use_backend tomcat-8080-idp02 if url_idp cookie_idp02
	use_backend tomcat-8080 if url_idp
	default_backend apache-443

### HTTPS:8443 ###
frontend https-soap
	bind *:8443 ssl no-sslv3 verify optional crt /path/to/sslchain.pem ca-file /path/to/sslchain.pem
	# Enable this if your want HSTS (recommended)
	rspadd  Strict-Transport-Security:\ max-age=15768000
	http-request set-header X-SSL			%[ssl_fc]
	http-request set-header X-SSL-Client-Verify	%[ssl_c_verify]
	http-request set-header X-SSL-Client-SHA1	%{+Q}[ssl_c_sha1]
	http-request set-header X-SSL-Client-DN		%{+Q}[ssl_c_s_dn]
	http-request set-header X-SSL-Client-CN		%{+Q}[ssl_c_s_dn(cn)]
	http-request set-header X-SSL-Issuer		%{+Q}[ssl_c_i_dn]
	http-request set-header X-SSL-Client-Not-Before	%{+Q}[ssl_c_notbefore]
	http-request set-header X-SSL-Client-Not-After	%{+Q}[ssl_c_notafter]
        # Since HAproxy 1.5.8: Client Cert forwarding
        # See http://comments.gmane.org/gmane.comp.web.haproxy/18796
        http-request add-header X-SSL-Client-Cert -----BEGIN\ CERTIFICATE-----\ %[ssl_c_der,base64]\ -----END\ CERTIFICATE-----\ # don't forget last space
	reqadd X-Forwarded-Proto:\ https
	acl url_idp path_beg /idp
	use_backend tomcat-8443 if url_idp
	default_backend apache-443

	
### Backends ###################################################

### Apache (www endpoint) ###
backend apache-443
	balance roundrobin
	server idp01 idp01.example.org:443 check
	server idp02 idp02.example.org:443 check

backend apache-443-idp01
	server idp01 idp01.example.org:443 check

backend apache-443-idp02
	server idp02 idp02.example.org:443 check

### Shibboleth IdP (www endpoint) ###
backend tomcat-8080
	balance roundrobin
	# Stick to Java session cookie:
	appsession JSESSIONID len 52 timeout 1h
	server idp01 idp01.example.org:8080 check
	server idp02 idp02.example.org:8080 check

backend tomcat-8080-idp01
	server idp01 idp01.example.org:8080 check

backend tomcat-8080-idp02
	server idp02 idp02.example.org:8080 check

### Shibboleth IdP (SOAP endpoint) ###
backend tomcat-8443
	balance roundrobin
	# Stick to Java session cookie:
	appsession JSESSIONID len 52 timeout 1h
	server idp01 idp01.example.org:8443 check
	server idp02 idp02.example.org:8443 check