HTTP Connectors and Load Balancing Guide

Procedure 2.1. Configure Apache HTTP Server to Load mod_jk

1. Open JWS_HOME/httpd/conf/httpd.conf and add the following lines at the end of the file:

   # Include mod_jk's specific configuration file  
   Include conf.d/mod_jk.conf

2. Create a new file: JWS_HOME/httpd/conf.d/mod_jk.conf
3. Add the following configuration to the mod_jk.conf file.

   # Load mod_jk module
   # Specify the filename of the mod_jk lib
   LoadModule jk_module modules/mod_jk.so
    
   # Where to find workers.properties
   JkWorkersFile conf.d/workers.properties
   
   # Where to put jk logs
   JkLogFile logs/mod_jk.log
    
   # Set the jk log level [debug/error/info]
   JkLogLevel info 
    
   # Select the log format
   JkLogStampFormat  "[%a %b %d %H:%M:%S %Y]"
    
   # JkOptions indicates to send SSK KEY SIZE
   JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
    
   # JkRequestLogFormat
   JkRequestLogFormat "%w %V %T"
                  
   # Mount your applications
   JkMount /application/* loadbalancer
    
   # Add shared memory.
   # This directive is present with 1.2.10 and
   # later versions of mod_jk, and is needed for
   # for load balancing to work properly
   JkShmFile logs/jk.shm 
                 
   # Add jkstatus for managing runtime data
   <Location /jkstatus/>
       JkMount status
       Require ip 127.0.0.1
   </Location>

   Important

   The LoadModule directive must reference the mod_jk library directory location for the native binary you installed.

   Note

   The JkMount directive specifies which URLs Apache HTTP Server will forward to the mod_jk module. Based on the directive's configuration, mod_jk forwards the received URL onto the correct Servlet containers.

   To enable Apache HTTP Server to serve static content (or PHP content) directly, and only use the load balancer for Java applications, the suggested configuration above specifies that all requests with the URL /application/* are sent to the mod_jk load-balancer.

   Alternatively, you can forward all URLs to mod_jk by specifying /* in the directive.

4. Optional: JKMountFile Directive

   In addition to the JkMount directive, you can use the JkMountFile directive to specify a mount point's configuration file. The configuration file contains multiple Tomcat forwarding URL mappings.
   1. Navigate to JWS_HOME/httpd/conf.d/.
   2. Create a file named uriworkermap.properties.
   3. Using the following syntax example as a guide, specify the URL to forward and the worker name.
      The syntax required takes the form: /URL=WORKER_NAME
      The example block below configures mod_jk to forward requests to /jmx-console and /web-console to Apache HTTP Server.

      # Simple worker configuration file
      
      # Mount the Servlet context to the ajp13 worker
      /jmx-console=loadbalancer
      /jmx-console/*=loadbalancer
      /web-console=loadbalancer
      /web-console/*=loadbalancer

   4. In JWS_HOME/httpd/conf.d/mod_jk.conf, append the following directive:

      # Use external file for mount points.
      # It will be checked for updates each 60 seconds.
      # The format of the file is: /url=worker
      # /examples/*=loadbalancer
      JkMountFile conf.d/uriworkermap.properties

5. Optional: Configure Apache HTTP Server Logging

   You can configure the Apache HTTP Server that is doing the load balancing to log which worker node handled a request. This may be useful when troubleshooting your load balancer.
   To enable this for mod_jk, you can either:
   • include %w in your JkRequestLogFormat; or
   • log the name of the mod_jk worker used by including %{JK_WORKER_NAME}n in your Apache HTTP Server LogFormat(s).
   For more information on JkRequestLogFormat, see http://tomcat.apache.org/connectors-doc/webserver_howto/apache.html. For more information on Apache HTTP Server logging (including log rotation), see http://httpd.apache.org/docs/2.4/logs.html.

Procedure 6.1. Configure the Kerberos Client

1. Create the Kerberos Configuration File

   Create the krb5.conf configuration file in the /etc directory and add the following to the file:

   [logging]
     default = FILE:/var/log/krb5libs.log
     kdc = FILE:/var/log/krb5kdc.log
     admin_server = FILE:/var/log/kadmind.log
   
   [libdefaults]
     default_realm = EXAMPLE.COM
     default_tgs_enctypes = des-cbc-md5,des3-cbc-sha1-kd
     default_tkt_enctypes = des-cbc-md5,des3-cbc-sha1-kd
     dns_lookup_realm = false
     dns_lookup_kdc = false
     allow_weak_crypto = yes
     ticket_lifetime = 24h
     renew_lifetime = 7d
     forwardable = yes  
   
   [realms]
     EXAMPLE.COM = {
       kdc = localhost:60088
       admin_server = localhost:60088
     }
   
   [domain_realm]
     .example.com = EXAMPLE.COM
     example.com = EXAMPLE.COM

2. Create a Key Tab

   Create a key tab in the /etc/httpd folder with the following contents:

   # ktutil
   ktutil: addent -password -p HTTP/localhost@EXAMPLE.COM -k 0 -e des-cbc-md5
   Password for HTTP/localhost@EXAMPLE.COM: secretpwd
   ktutil: list
   slot KVNO Principal
   ---- ---- ---------------------------------------------------------------------
      1    0               HTTP/localhost@EXAMPLE.COM
   ktutil: wkt krb5.keytab
   ktutil: quit

   As the root user, run the following commands to apply the correct group and permissions to the key tab:

   # chgrp apache /etc/httpd/krb5.keytab
   # chmod 640 /etc/httpd/krb5.keytab

3. Check the Hosts File

   Ensure that the following host configuration is included in the /etc/hosts file:

   127.0.0.1 localhost

Procedure 6.2. Configure mod_auth_kerb

• Create the auth_kerb.conf configuration file in the JWS_HOME/httpd/conf.d/ folder and add the following information to the file:

  #
  # The mod_auth_kerb module implements Kerberos authentication over
  # HTTP, following the "Negotiate" protocol.
  # 
  
  LoadModule auth_kerb_module modules/mod_auth_kerb.so
  
  <Location /kerberostest>
    AuthType Kerberos
    AuthName "Kerberos Login"
    KrbMethodNegotiate On
    KrbMethodK5Passwd Off
    KrbAuthRealms EXAMPLE.COM
    KrbServiceName HTTP
    Krb5KeyTab /etc/httpd/krb5.keytab
    require valid-user
  </Location>

Procedure 6.3. Test the Kerberos Authentication

1. Create a Test Page

   Create a test page named auth_kerb_page.html in JWS_HOME/httpd/www/html/kerberostest/.

2. Add the Contents of the Test Page

   Add the following contents to the test page (auth_kerb_page.html):

   <html>
   <body>
       <h1>mod_auth_kerb successfully authenticated!</h1>
   </body>
   </html>

3. Optional: Set Log Level

   Optionally, set the log level for debugging in JWS_HOME/httpd/conf/httpd.conf.

4. Start httpd

   The the Installation Guide for details.

5. Test Authentication

   Test the authentication as follows:
   1. Initiate Kerberos authentication for the test user hnelson:

      $ kinit hnelson

   2. View the details for the test user hnelson:

      $ klist

      A result similar to the following appears:

      Ticket cache: FILE:/tmp/krb5cc_18602
      Default principal: hnelson@EXAMPLE.COM
      
      Valid starting     Expires            Service principal
      06/03/13 14:21:13  06/04/13 14:21:13  krbtgt/EXAMPLE.COM@EXAMPLE.COM
      renew until 06/10/13 14:21:13

   3. Testing Apache HTTP Server Kerberos Authentication

      Test Apache HTTP Server Kerberos authentication as follows:

      $ curl --negotiate -u : http://localhost/kerberostest/auth_kerb_page.html

      If working correctly, the following result appears:

      <html>
      <body>
          <h1>mod_auth_kerb successfully authenticated!</h1>
      </body>
      </html>