[Freeipa-users] URL is changing on the browser

[Peter Fern]

On 14/11/16 20:39, Troels Hansen wrote:
>
>
> ----- On Nov 14, 2016, at 9:38 AM, Peter Fern <freeipa at 0xc0dedbad.com>
> wrote:
>
>
>     I'd be interested to hear from anyone who has a working recipe for
>     HA/load-balancing (with HAProxy preferably).  Cookie rewriting is
>     doable, but I can't see a way to rewrite the referrer for multiple
>     backend hosts.
>
>
> One (quite hack-ish) way of doing it could be:
> 2 apache vhosts, one pointing to one IPA server, set up like
> https://www.adelton.com/freeipa/freeipa-behind-proxy-with-different-name
>
> SSLProxyEngine on
> ProxyPass / https://ipa.int.example.com/
> ProxyPassReverse / https://ipa.int.example.com/
> ProxyPassReverseCookieDomain ipa.int.example.com webipa.example.com
> RequestHeader edit Referer ^https://webipa\.example\.com/ https://ipa.int.example.com/
>
> Then set up a second HA using HAproxy or Apache (with sticky session)
> pointing to the two Apache IPA vhosts.
> Thoug, not quite sure what will happen if you hit a down IPA server,
> but you should be able to configure that in the HA...

Ah, good thought - I hadn't considered hacking the referrer on the
Apache side.

I used only the RequestHeader edit on the Apache server for each IPA
server, since it can co-exist with direct access, and did the cookie
rewriting on the HAProxy side, since that should only happen when
accessed via the balancer.  Appears to be working with some quick
testing.  Below is my HAProxy backend, in case it helps someone:

backend ipa-ssl
        # Rewrite cookie domain
        acl ipa1_int_cookie_dom res.hdr(Set-cookie) -m sub Domain=ipa1.int.example.com
        rspirep ^(Set-Cookie:.*)\ Domain=ipa1.int.example.com(.*) \1\ Domain=ipa.example.com\2 if ipa1_int_cookie_dom
        acl ipa2_int_cookie_dom res.hdr(Set-cookie) -m sub Domain=ipa2.int.example.com
        rspirep ^(Set-Cookie:.*)\ Domain=ipa2.int.example.com(.*) \1\ Domain=ipa.example.com\2 if ipa2_int_cookie_dom

        # Sticky sessions
        cookie ipa_session prefix nocache
        server ipa1 ipa1.int.example.com:443 check cookie ipa1 ssl ca-file /etc/ipa/ca.crt
        server ipa2 ipa2.int.example.com:443 check cookie ipa2 ssl ca-file /etc/ipa/ca.crt

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20161114/b24aeee3/attachment.htm>