Software-Based Clustering [Ubuntu 12.04]

[Jarno Huuskonen]

Hi Manuel,

On Thu, Jul 09, Manuel Haim wrote:
> I guess you refer to this thread (haproxy >= 1.5.8 needed):
> http://comments.gmane.org/gmane.comp.web.haproxy/18796
> 
> Well, that works, but seemed a bit hacky to me, so we stayed with nginx
> + haproxy.
> For completeness, I have added a working haproxy-only configuration
> attatched to this email.

You'll probably also need to ignore client certificate verification errors
on port 8443 (if SP's can use for example self signed certs in
metadata).
(http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.1-verify)

bind *:8443 ssl verify optional crt-ignore-err 18,19,20,21,27 ca-ignore-err 18,19,20,21,27
AFAIK ignoring these verfication errors is same as
optional_no_ca in mod_ssl and ssl_verify_client optional_no_ca; in
nginx (the 18,19... error codes are in openssl x509_vfy.h).

> > Manuel: is unimr.tomcat6.ProxiedSslValve needed to parse nginx/pound
> > SSL_CLIENT_CERT header ? (AFAIK tomcat SSLValve can't parse pound/nginx
> > \n\t in SSL_CLIENT_HEADER).
> 
> You are right, the default org.apache.catalina.valves.SSLValve will work
> well with SSL_CLIENT_CERT header when set by Apache or HAProxy, as the
> header has the same shape. The unimr.tomcat6.ProxiedSslValve as a
> replacement is only needed when the header is set by pound or nginx.
> 
> Reason: When adding the client cert to the http header, the newline
> character will be replaced in different ways:
> 
> Apache mod_header: Whitespace
> Pound: Tab

This depends on configure option: --enable-cert1l
(with this option pound inserts cert in one long line w/out whitespace).

> nginx: Whitespace+Tab

> HAProxy: Whitespace

-Jarno

-- 
Jarno Huuskonen