HTTP Connectors and Load Balancing Guide 5.6

Procedure

1. Go to the JBCS_HOME/httpd/conf.d directory.

2. Create a new file named mod_jk.conf and enter the following configuration details:

   # Load mod_jk module
   # Specify the filename of the mod_jk lib
   LoadModule jk_module modules/mod_jk.so
   
   # Where to find workers.properties
   JkWorkersFile conf.d/workers.properties
   
   # Where to put jk logs
   JkLogFile logs/mod_jk.log
   
   # Set the jk log level [debug/error/info]
   JkLogLevel info
   
   # Select the log format
   JkLogStampFormat  "[%a %b %d %H:%M:%S %Y]"
   
   # JkOptions indicates to send SSL KEY SIZE
   JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
   
   # JkRequestLogFormat
   JkRequestLogFormat "%w %V %T"
   
   # Mount your applications
   JkMount /application/* loadbalancer
   
   # Add shared memory.
   # This directive is present with 1.2.10 and
   # later versions of mod_jk, and is needed for
   # for load balancing to work properly
   JkShmFile logs/jk.shm
   
   # Add jkstatus for managing runtime data
   <Location /jkstatus/>
       JkMount status
       Require ip 127.0.0.1
   </Location>

   Important

   Ensure that the LoadModule directive references the mod_jk native binary that you have installed.

   Note

   The JkMount directive specifies the URLs that the Apache HTTP Server can forward to the mod_jk module. Based on the configuration for the JkMount directive, mod_jk forwards the received URL to the correct servlet containers.

   To enable the Apache HTTP Server to serve static content (or PHP content) directly, and only use the load balancer for Java applications, the preceding configuration example specifies that the Apache HTTP Server sends only requests with the URL /application/* to the mod_jk load balancer.

   Alternatively, you can configure the Apache HTTP Server to forward all URLs to mod_jk by specifying /* in the JkMount directive.

3. Optional: To use the JkMountFile directive to specify the configuration file for a mount point, perform the following steps:

   1. Go to the JBCS_HOME/httpd/conf.d/ directory.
   2. Create a file named uriworkermap.properties.

   3. Specify the URL that you want to forward and the worker name.

      For example:

      # Simple worker configuration file
      
      # Mount the Servlet context to the ajp13 worker
      /application=loadbalancer
      /application/*=loadbalancer

      Note

      The required syntax is in the format: /URL=WORKER_NAME

      The preceding example configures mod_jk to forward requests for /application to the JBoss Web Server Tomcat back end.

   4. In the JBCS_HOME/httpd/conf.d/mod_jk.conf file, enter the following directive:

      # Use external file for mount points.
      # It will be checked for updates each 60 seconds.
      # The format of the file is: /url=worker
      # /examples/*=loadbalancer
      JkMountFile conf.d/uriworkermap.properties

4. Optional: To enable Apache HTTP Server logging, perform either of the following steps:

   • Include %w in your JkRequestLogFormat directive, as shown in the preceding step about mod_jk.conf settings.
   • Log the name of the mod_jk worker that you want to use, by including %{JK_WORKER_NAME}n in your Apache HTTP Server LogFormat(s).

Procedure

1. Go to the JBCS_HOME/httpd/conf.d/ directory.
2. Create a file named workers.properties.

3. Enter the following configuration details:

   # Define list of workers that will be used
   # for mapping requests
   worker.list=loadbalancer,status
   
   # Define Node1
   # modify the host as your host IP or DNS name.
   worker.node1.port=8009
   worker.node1.host=node1.mydomain.com
   worker.node1.type=ajp13
   worker.node1.ping_mode=A
   worker.node1.lbfactor=1
   
   # Define Node2
   # modify the host as your host IP or DNS name.
   worker.node2.port=8009
   worker.node2.host=node2.mydomain.com
   worker.node2.type=ajp13
   worker.node2.ping_mode=A
   worker.node2.lbfactor=1
   
   # Load-balancing behavior
   worker.loadbalancer.type=lb
   worker.loadbalancer.balance_workers=node1,node2
   worker.loadbalancer.sticky_session=1
   
   # Status worker for managing load balancer
   worker.status.type=status

   Note

   In the preceding example, ensure that you replace host, port, and secret settings with values that are relevant for your environment.

Procedure

1. Open the mod_cluster configuration file.

   Note

   The mod_cluster configuration file is typically located in the JBCS_HOME/httpd/conf.d/mod_cluster.conf directory.

2. To create a Listen directive for the proxy server, enter the following line in the mod_cluster.conf file:

   Listen IP_ADDRESS:PORT_NUMBER

   Note

   In the preceding example, replace IP_ADDRESS with the address of the server network interface that the proxy server uses to communicate with the worker nodes, and replace PORT_NUMBER with the port that the proxy server listens on.

   Ensure that the port is open for incoming TCP connections.

3. To create a virtual host, enter the following details in the mod_cluster.conf file:

   <VirtualHost IP_ADDRESS:PORT_NUMBER>
   
      <Directory />
         Require ip IP_ADDRESS
      </Directory>
   
      KeepAliveTimeout 60
      MaxKeepAliveRequests 0
   
      ManagerBalancerName mycluster
      AdvertiseFrequency 5
      EnableMCPMReceive On
   
   </VirtualHost>

   Note

   In the preceding example, replace IP_ADDRESS and PORT_NUMBER with the address of the server network interface and port number that you have specified for the Listen directive.

   This address and port combination is only used for mod_cluster management messages. This address and port combination is not used for general traffic.

Procedure

1. To add a listener to Tomcat, add the following Listener element below the other Listener elements in the JWS_HOME/tomcat<VERSION>/conf/server.xml file:

   <Listener className="org.jboss.modcluster.container.catalina.standalone.ModClusterListener" advertise="true" stickySession="true" stickySessionForce="false" stickySessionRemove="true" />

2. To give the worker node a unique identity, edit the JWS_HOME/tomcat<VERSION>/conf/server.xml file, to add the jvmRoute attribute and value to the Engine element:

   <Engine name="Catalina" defaultHost="localhost" jvmRoute="worker01">

3. To configure STATUS MCMP message frequency, modify the org.jboss.modcluster.container.catalina.status-frequency Java system property.

   For example:

   -Dorg.jboss.modcluster.container.catalina.status-frequency=6

   Note

   Tomcat worker nodes periodically send status messages that contain their current load status to the Apache HTTP Server balancer. The default frequency of these messages is 10 seconds. If you have hundreds of worker nodes, the STATUS MCMP messages can increase traffic congestion on your Apache HTTP Server network.

   You can configure the MCMP message frequency by modifying the org.jboss.modcluster.container.catalina.status-frequency Java system property. By default, the property accepts values that are specified in seconds multiplied by 10. For example, setting the property to 1 means 10 seconds. In the preceding example, the property is set to 6, which means 60 seconds.

4. Optional: To configure the firewall for proxy server advertisements, complete either of the following steps to open port 23364 for UDP connections on the worker node’s firewall:

   • For Red Hat Enterprise Linux 7:

     firewall-cmd --permanent --zone=public --add-port=23364/udp

   • For Microsoft Windows using PowerShell

     Start-Process "$psHome\powershell.exe" -Verb Runas -ArgumentList '-command "NetSh Advfirewall firewall add rule name="UDP Port 23364" dir=in  action=allow protocol=UDP localport=23364"'
     Start-Process "$psHome\powershell.exe" -Verb Runas -ArgumentList '-command "NetSh Advfirewall firewall add rule name="UDP Port 23364" dir=out action=allow protocol=UDP localport=23364"'

     Note

     When a proxy server uses mod_cluster, the proxy server can use UDP multicast to advertise itself. Most operating system firewalls block the server advertisement feature by default. To enable server advertisement and receive these multicast messages, you can open port 23364 for UDP connections on the worker node’s firewall, as shown in the preceding examples.

Procedure

1. Open the JWS_HOME/tomcat<VERSION>/conf/server.xml file.

2. To define a mod_cluster listener and disable dynamic proxy discovery, add or change the Listener element for ModClusterListener.

   For example:

   <Listener className="org.jboss.modcluster.container.catalina.standalone.ModClusterListener" advertise="false" stickySession="true" stickySessionForce="false" stickySessionRemove="true"/>

   Note

   Ensure that you set the advertise property to false.

3. To create a static proxy server list, update the proxyList property by adding a comma-separated list of proxies in the following format: IP_ADDRESS:PORT,IP_ADDRESS:PORT

   For example:

   <Listener className="org.jboss.modcluster.container.catalina.standalone.ModClusterListener" advertise="false" stickySession="true" stickySessionForce="false" stickySessionRemove="true" proxyList="10.33.144.3:6666,10.33.144.1:6666"/>

Procedure

1. To install mod_ssl, enter the following command:

   # yum install jbcs-httpd24-mod_ssl

2. To specify SSL configuration settings:

   1. Open the JBCS_HOME/httpd/conf.d/ssl.conf file.

   2. Enter details for the ServerName, SSLCertificateFile, and SSLCertificateKeyFile.

      For example:

      <VirtualHost _default_:443>
      ServerName www.example.com:443
      SSLCertificateFile /opt/rh/jbcs-httpd24/root/etc/pki/tls/certs/localhost.crt
      SSLCertificateKeyFile /opt/rh/jbcs-httpd24/root/etc/pki/tls/private/localhost.key

      Note
      • The ServerName must match the Common Name (CN) that is associated with the SSL certificate. If the ServerName does not match the CN, client browsers display domain name mismatch errors.
      • The SSLCertificateFile specifies the path to the SSL certificate file.
      • The SSLCertificateKeyFile specifies the path to the private key file that is associated with the SSL certificate.
3. Verify that the Listen directive matches the hostname or IP address for the httpd service for your deployment.

4. To restart the Apache HTTP Server, enter the following command:

   # service jbcs-httpd24-httpd restart

Procedure

1. Configure a certificate authority.

   Note

   Ensure that your CA can issue OCSP certificates. The CA must be able to append the following attributes to the certificate:

   [ usr_cert ]
   ...
   authorityInfoAccess=OCSP;URI:http://<HOST>:<PORT>
   ...
   [ v3_OCSP ]
   basicConstraints = CA:FALSE
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = OCSP Signing

   In the preceding example, replace HOST and PORT with the details of the OCSP responder that you will configure.

2. Configure an OCSP responder.

Procedure

1. Open the JBCS_HOME/httpd/conf.d/ssl.conf file.

2. Specify the appropriate OCSP configuration details for your deployment.

   For example:

   # Require valid client certificates (mutual auth)
   SSLVerifyClient require
   SSLVerifyDepth  3
   # Enable OCSP
   SSLOCSPEnable on
   SSLOCSPDefaultResponder http://<HOST>:<PORT>
   SSLOCSPOverrideResponder on

   Note

   The preceding example shows how to enable OCSP validation of client certificates. In the preceding example, replace <HOST> and <PORT> with the IP address and port of the default OCSP Responder.

Procedure

1. Go to the JBCS_HOME/httpd/conf.d/ directory.
2. Create a file named mod_cluster.conf.

3. Enter the following configuration details:

   LoadModule proxy_cluster_module modules/mod_proxy_cluster.so
   LoadModule cluster_slotmem_module modules/mod_cluster_slotmem.so
   LoadModule manager_module modules/mod_manager.so
   LoadModule advertise_module modules/mod_advertise.so
   
   MemManagerFile cache/mod_cluster
   
   <IfModule manager_module>
     Listen 6666
     <VirtualHost *:6666>
       <Directory />
         Require ip 127.0.0.1
       </Directory>
       ServerAdvertise on
       EnableMCPMReceive
       <Location /mod_cluster_manager>
         SetHandler mod_cluster-manager
         Require ip 127.0.0.1
      </Location>
     </VirtualHost>
   </IfModule>

   Note

   The preceding example shows how to set up JBoss Core Services as a proxy server that is listening on localhost.

Procedure

1. Open the JWS_HOME/tomcat<VERSION>/conf/server.xml file.

2. Add the following Listener element:

   <Listener className="org.jboss.modcluster.container.catalina.standalone.ModClusterListener" advertise="true"/>

1. Specify configuration settings in the krb5.conf file.
2. Create a key tab in the JBCS_HOME/httpd/conf file.
3. Assign permissions to the key tab.
4. Ensure that localhost is included in the /etc/hosts file.

Procedure

1. To specify configuration settings in the krb5.conf file:

   1. Go to the /etc directory.
   2. Create a file named krb5.conf.

   3. Enter the following configuration details:

      [logging]
        default = FILE:/var/log/krb5libs.log
        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmind.log
      
      [libdefaults]
        default_realm = EXAMPLE.COM
        default_tgs_enctypes = des-cbc-md5,des3-cbc-sha1-kd
        default_tkt_enctypes = des-cbc-md5,des3-cbc-sha1-kd
        dns_lookup_realm = false
        dns_lookup_kdc = false
        allow_weak_crypto = yes
        ticket_lifetime = 24h
        renew_lifetime = 7d
        forwardable = yes
      
      [realms]
        EXAMPLE.COM = {
          kdc = localhost:60088
          admin_server = localhost:60088
        }
      
      [domain_realm]
        .example.com = EXAMPLE.COM
        example.com = EXAMPLE.COM

2. To create a key tab:

   1. Open the JBCS_HOME/httpd/conf file.

   2. Enter the following details:

      # ktutil
      ktutil: addent -password -p HTTP/localhost@EXAMPLE.COM -k 0 -e des-cbc-md5
      Password for HTTP/localhost@EXAMPLE.COM: secretpwd
      ktutil: list
      slot KVNO Principal
      ---- ---- ---------------------------------------------------------------------
         1    0               HTTP/localhost@EXAMPLE.COM
      ktutil: wkt JBCS_HOME/httpd/conf/krb5.keytab
      ktutil: quit

      Important

      Environment variables are not expanded within the ktutil prompt. You must substitute the full path for the JBCS_HOME variable.

3. To apply the correct group and permissions to the key tab, enter the following commands as the root user:

   # chgrp apache JBCS_HOME/httpd/conf/krb5.keytab
   # chmod 640 JBCS_HOME/httpd/conf/krb5.keytab

4. Ensure that the following host configuration is included in the /etc/hosts file:

   127.0.0.1 localhost

Procedure

1. Go to the JBCS_HOME/httpd/conf.d/ directory.
2. Create a file named auth_kerb.conf.

3. Enter the following configuration details:

   #
   # The mod_auth_kerb module implements Kerberos authentication over HTTP, following the "Negotiate" protocol.
   #
   
   # The LoadModule statement is done in conf.d/10-auth_kerb.conf
   # LoadModule auth_kerb_module modules/mod_auth_kerb.so
   
   <Location /kerberostest>
     AuthType Kerberos
     AuthName "Kerberos Login"
     KrbMethodNegotiate On
     KrbMethodK5Passwd Off
     KrbAuthRealms EXAMPLE.COM
     KrbServiceName HTTP
     Krb5KeyTab $JBCS_HOME/httpd/krb5.keytab
     require valid-user
   </Location>

Procedure

1. To create a test page, perform the following steps:

   1. Go to the JBCS_HOME/httpd/www/html/kerberostest directory.
   2. Create a test page named auth_kerb_page.html.

   3. Enter the following details:

      <html>
      <body>
          <h1>mod_auth_kerb successfully authenticated!</h1>
      </body>
      </html>

2. Optional: In the JBCS_HOME/httpd/conf/httpd.conf file, set the log level to debugging.
3. Start the Apache HTTP Server. For more information, see the Red Hat JBoss Core Services Apache HTTP Server Installation Guide.

4. To initiate Kerberos authentication for the test user, hnelson, enter the following command:

   $ kinit hnelson

5. To view the details for the test user, hnelson, enter the following command:

   $ klist

   The klist command produces the following type of output:

   Ticket cache: FILE:/tmp/krb5cc_18602
   Default principal: hnelson@EXAMPLE.COM
   
   Valid starting     Expires            Service principal
   06/03/13 14:21:13  06/04/13 14:21:13  krbtgt/EXAMPLE.COM@EXAMPLE.COM
   renew until 06/10/13 14:21:13