<html><body><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000"><div><br></div><div><br></div><div><span id="zwchr" data-marker="__DIVIDER__">----- On Nov 14, 2016, at 9:38 AM, Peter Fern <freeipa@0xc0dedbad.com> wrote:<br></span></div><div data-marker="__QUOTED_TEXT__"><blockquote style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;" data-mce-style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><br class="moz-cite-prefix"><p>I'd be interested to hear from anyone who has a working recipe for HA/load-balancing (with HAProxy preferably). Cookie rewriting is doable, but I can't see a way to rewrite the referrer for multiple backend hosts.</p></blockquote><div><br></div><div>One (quite hack-ish) way of doing it could be:</div><div>2 apache vhosts, one pointing to one IPA server, set up like https://www.adelton.com/freeipa/freeipa-behind-proxy-with-different-name</div><div><br></div><div><pre class="programlisting">SSLProxyEngine on
ProxyPass / https://ipa.int.example.com/
ProxyPassReverse / https://ipa.int.example.com/
ProxyPassReverseCookieDomain ipa.int.example.com webipa.example.com
RequestHeader edit Referer ^https://webipa\.example\.com/ https://ipa.int.example.com/<br><br></pre>Then set up a second HA using HAproxy or Apache (with sticky session) pointing to the two Apache IPA vhosts.<br></div><div>Thoug, not quite sure what will happen if you hit a down IPA server, but you should be able to configure that in the HA...<br data-mce-bogus="1"></div></div></div></body></html>