HTTP Connectors and Load Balancing Guide

Procedure 2.1. Configure Apache HTTP Server to Load mod_jk

1. Open JWS_HOME/httpd/conf/httpd.conf and add the following lines at the end of the file:

   # Include mod_jk's specific configuration file  
   Include conf.d/mod_jk.conf

   Copy to Clipboard Toggle word wrap
2. Create a new file: JWS_HOME/httpd/conf.d/mod_jk.conf
3. Add the following configuration to the mod_jk.conf file.

   # Load mod_jk module
   # Specify the filename of the mod_jk lib
   LoadModule jk_module modules/mod_jk.so
    
   # Where to find workers.properties
   JkWorkersFile conf.d/workers.properties
   
   # Where to put jk logs
   JkLogFile logs/mod_jk.log
    
   # Set the jk log level [debug/error/info]
   JkLogLevel info 
    
   # Select the log format
   JkLogStampFormat  "[%a %b %d %H:%M:%S %Y]"
    
   # JkOptions indicates to send SSK KEY SIZE
   JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
    
   # JkRequestLogFormat
   JkRequestLogFormat "%w %V %T"
                  
   # Mount your applications
   JkMount /application/* loadbalancer
    
   # Add shared memory.
   # This directive is present with 1.2.10 and
   # later versions of mod_jk, and is needed for
   # for load balancing to work properly
   JkShmFile logs/jk.shm 
                 
   # Add jkstatus for managing runtime data
   <Location /jkstatus/>
       JkMount status
       Require ip 127.0.0.1
   </Location>

   Copy to Clipboard Toggle word wrap

   Important

   The LoadModule directive must reference the mod_jk library directory location for the native binary you installed.

   Note

   The JkMount directive specifies which URLs Apache HTTP Server will forward to the mod_jk module. Based on the directive's configuration, mod_jk forwards the received URL onto the correct Servlet containers.

   To enable Apache HTTP Server to serve static content (or PHP content) directly, and only use the load balancer for Java applications, the suggested configuration above specifies that all requests with the URL /application/* are sent to the mod_jk load-balancer.

   Alternatively, you can forward all URLs to mod_jk by specifying /* in the directive.

4. Optional: JKMountFile Directive

   In addition to the JkMount directive, you can use the JkMountFile directive to specify a mount point's configuration file. The configuration file contains multiple Tomcat forwarding URL mappings.
   1. Navigate to JWS_HOME/httpd/conf.d/.
   2. Create a file named uriworkermap.properties.
   3. Using the following syntax example as a guide, specify the URL to forward and the worker name.
      The syntax required takes the form: /URL=WORKER_NAME
      The example block below configures mod_jk to forward requests to /jmx-console and /web-console to Apache HTTP Server.

      # Simple worker configuration file
      
      # Mount the Servlet context to the ajp13 worker
      /jmx-console=loadbalancer
      /jmx-console/*=loadbalancer
      /web-console=loadbalancer
      /web-console/*=loadbalancer

      Copy to Clipboard Toggle word wrap
   4. In JWS_HOME/httpd/conf.d/mod_jk.conf, append the following directive:

      # Use external file for mount points.
      # It will be checked for updates each 60 seconds.
      # The format of the file is: /url=worker
      # /examples/*=loadbalancer
      JkMountFile conf.d/uriworkermap.properties

      Copy to Clipboard Toggle word wrap

5. Optional: Configure Apache HTTP Server Logging

   You can configure the Apache HTTP Server that is doing the load balancing to log which worker node handled a request. This may be useful when troubleshooting your load balancer.
   To enable this for mod_jk, you can either:
   • include %w in your JkRequestLogFormat; or
   • log the name of the mod_jk worker used by including %{JK_WORKER_NAME}n in your Apache HTTP Server LogFormat(s).
   For more information on JkRequestLogFormat, see http://tomcat.apache.org/connectors-doc/webserver_howto/apache.html. For more information on Apache HTTP Server logging (including log rotation), see http://httpd.apache.org/docs/2.4/logs.html.

Procedure 6.1. Configure the Kerberos Client

1. Create the Kerberos Configuration File

   Create the krb5.conf configuration file in the /etc directory and add the following to the file:

   [logging]
     default = FILE:/var/log/krb5libs.log
     kdc = FILE:/var/log/krb5kdc.log
     admin_server = FILE:/var/log/kadmind.log
   
   [libdefaults]
     default_realm = EXAMPLE.COM
     default_tgs_enctypes = des-cbc-md5,des3-cbc-sha1-kd
     default_tkt_enctypes = des-cbc-md5,des3-cbc-sha1-kd
     dns_lookup_realm = false
     dns_lookup_kdc = false
     allow_weak_crypto = yes
     ticket_lifetime = 24h
     renew_lifetime = 7d
     forwardable = yes  
   
   [realms]
     EXAMPLE.COM = {
       kdc = localhost:60088
       admin_server = localhost:60088
     }
   
   [domain_realm]
     .example.com = EXAMPLE.COM
     example.com = EXAMPLE.COM

   Copy to Clipboard Toggle word wrap

2. Create a Key Tab

   Create a key tab in the /etc/httpd folder with the following contents:

   # ktutil
   ktutil: addent -password -p HTTP/localhost@EXAMPLE.COM -k 0 -e des-cbc-md5
   Password for HTTP/localhost@EXAMPLE.COM: secretpwd
   ktutil: list
   slot KVNO Principal
   ---- ---- ---------------------------------------------------------------------
      1    0               HTTP/localhost@EXAMPLE.COM
   ktutil: wkt krb5.keytab
   ktutil: quit

   Copy to Clipboard Toggle word wrap
   As the root user, run the following commands to apply the correct group and permissions to the key tab:

   # chgrp apache /etc/httpd/krb5.keytab
   # chmod 640 /etc/httpd/krb5.keytab

   Copy to Clipboard Toggle word wrap

3. Check the Hosts File

   Ensure that the following host configuration is included in the /etc/hosts file:

   127.0.0.1 localhost

   Copy to Clipboard Toggle word wrap

Procedure 6.2. Configure mod_auth_kerb

• Create the auth_kerb.conf configuration file in the JWS_HOME/httpd/conf.d/ folder and add the following information to the file:

  #
  # The mod_auth_kerb module implements Kerberos authentication over
  # HTTP, following the "Negotiate" protocol.
  # 
  
  LoadModule auth_kerb_module modules/mod_auth_kerb.so
  
  <Location /kerberostest>
    AuthType Kerberos
    AuthName "Kerberos Login"
    KrbMethodNegotiate On
    KrbMethodK5Passwd Off
    KrbAuthRealms EXAMPLE.COM
    KrbServiceName HTTP
    Krb5KeyTab /etc/httpd/krb5.keytab
    require valid-user
  </Location>

  Copy to Clipboard Toggle word wrap

Procedure 6.3. Test the Kerberos Authentication

1. Create a Test Page

   Create a test page named auth_kerb_page.html in JWS_HOME/httpd/www/html/kerberostest/.

2. Add the Contents of the Test Page

   Add the following contents to the test page (auth_kerb_page.html):

   <html>
   <body>
       <h1>mod_auth_kerb successfully authenticated!</h1>
   </body>
   </html>

   Copy to Clipboard Toggle word wrap

3. Optional: Set Log Level

   Optionally, set the log level for debugging in JWS_HOME/httpd/conf/httpd.conf.

4. Start httpd

   The the Installation Guide for details.

5. Test Authentication

   Test the authentication as follows:
   1. Initiate Kerberos authentication for the test user hnelson:

      $ kinit hnelson

      Copy to Clipboard Toggle word wrap
   2. View the details for the test user hnelson:

      $ klist

      Copy to Clipboard Toggle word wrap
      A result similar to the following appears:

      Ticket cache: FILE:/tmp/krb5cc_18602
      Default principal: hnelson@EXAMPLE.COM
      
      Valid starting     Expires            Service principal
      06/03/13 14:21:13  06/04/13 14:21:13  krbtgt/EXAMPLE.COM@EXAMPLE.COM
      renew until 06/10/13 14:21:13

      Copy to Clipboard Toggle word wrap

   3. Testing Apache HTTP Server Kerberos Authentication

      Test Apache HTTP Server Kerberos authentication as follows:

      $ curl --negotiate -u : http://localhost/kerberostest/auth_kerb_page.html

      Copy to Clipboard Toggle word wrap
      If working correctly, the following result appears:

      <html>
      <body>
          <h1>mod_auth_kerb successfully authenticated!</h1>
      </body>
      </html>

      Copy to Clipboard Toggle word wrap