<div dir="ltr">My case for HTTP load balancing is little different. Ideally I would like to use a real load balancer (A10 in this case) for balancing HTTP and HTTPS services.<div>Would that be possible? </div><div><br><div>Based on the info in this thread, and Apache configuration for IPA (ipa.conf) the following steps were performed</div></div><div>- Added host for <a href="http://sso.example.com">sso.example.com</a></div><div>- Added service for HTTP/<a href="http://sso.example.com">sso.example.com</a></div><div>- added new entry for HTTP/<a href="http://sso.example.com">sso.example.com</a> to /etc/httpd/conf/ipa.keytab. This keytab is listed in the conf.d/ipa.conf under the Location '/ipa' groups of directives. </div><div> ipa-getkeytab -s `hostname` -p HTTP/<a href="http://sso.example.com">sso.example.com</a> -k /etc/httpd/conf/ipa.keytab</div><div><br></div><div>- modifed the conf.d/ipa-rewrite.conf and ipa-pki-proxy.conf to redirect requests to <a href="http://sso.example.com">sso.example.com</a></div><div><br></div><div>The login page loads but unfortunately authentication is failing with HTTP 401 (unauthorized) response from the server. I wonder what I am doing wrong.</div><div><br></div><div>IPA ver is 3.0 running on CentOS 6.5, 64bit</div><div><br></div><div>Thanks</div><div><br></div><div>Dimitar</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Sep 30, 2014 at 3:01 AM, Petr Spacek <span dir="ltr"><<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 29.9.2014 23:12, Simo Sorce wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Mon, 29 Sep 2014 23:25:08 +0300<br> Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote:<br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Mon, 29 Sep 2014, Mark Heslin wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Folks,<br> <br> I'm looking for the best approach to take for configuring IdM<br> clients to access web services (HTTP)<br> with keytabs when a front-end load-balanced hostname is in place.<br> <br> I have a distributed OpenShift Enterprise configuration with three<br> broker hosts (broker1, broker2, broker3)<br> with all three configured as IdM clients.<br> <br> IdM is configured with one server (<a href="http://idm-srv1.example.com" target="_blank">idm-srv1.example.com</a>), one<br> replica (<a href="http://idm-srv2.example.com" target="_blank">idm-srv2.example.com</a>); an HTTP service<br> has been created for each broker host:<br> <br> # ipa service-add HTTP/<a href="http://broker1.example.com" target="_blank">broker1.example.com</a><br> # ipa service-add HTTP/<a href="http://broker2.example.com" target="_blank">broker2.example.com</a><br> # ipa service-add HTTP/<a href="http://broker3.example.com" target="_blank">broker3.example.com</a><br> <br> A DNS round-robin hostname called '*broker**.<a href="http://example.com" target="_blank">example.com</a>*' has also<br> been configured to distribute broker requests<br> across the three brokers:<br> <br> # ipa dnsrecord-add <a href="http://example.com" target="_blank">example.com</a> broker --a-ip-address=10.0.0.11<br> # ipa dnsrecord-add <a href="http://example.com" target="_blank">example.com</a> broker --a-ip-address=10.0.0.12<br> # ipa dnsrecord-add <a href="http://example.com" target="_blank">example.com</a> broker --a-ip-address=10.0.0.13<br> <br> Effectively, this creates a DNS A record that acts as a pseudo DNS<br> load-balancer.<br> <br> To access the HTTP services, we have been creating keytabs for for<br> the first broker host:<br> <br> # ipa-getkeytab -s <a href="http://idm-srv1.example.com" target="_blank">idm-srv1.example.com</a> -p<br> HTTP/*broker1*.<a href="mailto:example.com@EXAMPLE.COM" target="_blank">example.com@<u></u>EXAMPLE.COM</a><br> -k<br> /var/www/openshift/broker/<u></u>httpd/conf.d/http.keytab<br> <br> and copying the keytab over to the other two OpenShift broker hosts.<br> <br> This all works fine but in the event that *broker1* should go down,<br> the other broker hosts will lose access<br> to the web service. Ideally, we would like to have web services use<br> the more generic, "load balanced"<br> hostname (*<a href="http://broker.example.com" target="_blank">broker.example.com</a>*) and in turn have the keytabs use<br> this name as well.<br> <br> I tried creating an HTTP service using the "load balanced" hostname<br> (*<a href="http://broker.example.com" target="_blank">broker.example.com</a>*) but that appears to fail<br> due to *<a href="http://broker.example.com" target="_blank">broker.example.com</a>* not being a valid host within IdM:<br> <br> # ipa service-add HTTP/<a href="http://broker.example.com" target="_blank">broker.example.com</a><br> ipa: ERROR: The host '<a href="http://broker.example.com" target="_blank">broker.example.com</a>' does not exist to add a<br> service to.<br> <br> In the F18 FreeIPA guide it discusses creating a combined keytab<br> file (Section 6.5.4) using ktutil:<br> <br> <a href="http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/managing-services.html#Using_the_Same_Service_Principal_for_Multiple_Services" target="_blank">http://docs.fedoraproject.org/<u></u>en-US/Fedora/18/html/FreeIPA_<u></u>Guide/managing-services.html#<u></u>Using_the_Same_Service_<u></u>Principal_for_Multiple_<u></u>Services</a><br> <br> but would that still work as intended should a broker host go down?<br> <br> The next section (6.5.5) mentions creating a keytab to create a<br> service principal that can be used across multiple hosts:<br> <br> # ipa-getkeytab -s <a href="http://kdc.example.com" target="_blank">kdc.example.com</a> -p HTTP/<a href="http://server.example.com" target="_blank">server.example.com</a> -k<br> /etc/httpd/conf/krb5.keytab -e des-cbc-crc<br> <br> Which seems more in-line with my thinking and exactly what we've<br> been doing but again, if I try to do that<br> using the "load balanced" hostname (*<a href="http://broker.example.com" target="_blank">broker.example.com</a>*) it fails<br> sicne it's not a valid host within IdM.<br> <br> What is the best method to doing this?<br> </blockquote> Make a host named <a href="http://broker.example.com" target="_blank">broker.example.com</a><br> ipa host-add <a href="http://broker.example.com" target="_blank">broker.example.com</a> --force<br> <br> --force will make sure to create the host object even if there is no<br> such name in the DNS.<br> <br> Then create services for this host.<br> <br> You'll need to set up your balancer hosts to use the proper service<br> principal instead of allowing them to construct the principal<br> themselves based on the hostname.<br> </blockquote> <br> Even better tell them to not assume any name if the server name is NULL<br> GSSAPI will try every key in the keytab. YUou can even force that<br> behavior with a krb5 config hack even if the app insist setting a name<br> by adding "ignore_acceptor_hostname true" in [libdefaults]<br> </blockquote> <br></div></div> I consider this as a 'workaround'.<br> <br> Even better option is to teach your client application to use DNS SRV records instead of plain A records. SRV records allow you to do more fancy things like non-equal load balancing etc.<span class="HOEnZb"><font color="#888888"><br> <br> -- <br> Petr^2 Spacek</font></span><div class="HOEnZb"><div class="h5"><br> <br> -- <br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<u></u>mailman/listinfo/freeipa-users</a><br> Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br> </div></div></blockquote></div><br></div>