Search results matching tag 'Application Request Routing webfarm port http https'

questions about reverse proxy SSL features

guizmo974 — Mon, 27 Jul 2009 17:47:24 GMT

Hi,

I would like to know if with IIS 7 + ARR + URL rewrite i can handle some features i need:

I would like to publish some site from severals hosts (mix apache and IIS) through IIS reverse proxy and SSL:

Publish only the IIS reverse proxy to the public network with NATed port 443.
Web server are on private network, request are forwarded to the right server by some private URLs. (URL rewrite ?)
reverse proxy handle SSL for all the server behind (SSL termination). request between reverse proxy and web server flow through HTTP. one wildcard domain cert will be use and some DNS alias on the same domain.
Some web server may require basic form authentification with apache. We would like to be able as much as possible to run our web server behind reverse proxy with no modification.

It seems right but i have one special application with SSL mutual authentification with client cert. The application use it's own CA with selfsigned cert. Behavior of the application depend on client cert.

It seems that this application can run behind an apache reverse proxy with some modules (mod_ssl among). One problem is certificate access

sample apache config available for the app:

 Virual host config

    SSLEngine on
    SSLCipherSuite SSLv2:-LOW:-EXPORT:RC4+RSA
    SSLCertificateFile      /some/path/file.pem
    SSLCertificateKeyFile   /some/path/file.pem
    SSLCertificateChainFile /some/path/file.pem
    SSLCACertificateFile    /some/path/file.pem
    SSLCARevocationFile     /some/path/file.pem
    SSLVerifyClient optional 
    SSLVerifyDepth  1
    SSLOptions +StdEnvVars

This config is for apache access to the needed cert from the application. How to handle a config like this in IIS ?

Next problem is that i need to pass some custom header to the backend server like this:

Sample apache config available for the app:

    RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
    RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
    RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e

From my reading it seem that IIS reverse proxy can handle the features we need (and we want to use it for a bunch of reason). But is the mutual SSL auth with heterogeneous system possible ?

Thanks in advance for your answers.

Regards

ARR + Forms Authentication

jortizv — Wed, 22 Jul 2009 15:05:27 GMT

Is there an easy way to configure Forms Authentication to be passed to the farm servers, the idea is to have the authentication happen at one server and another server will be access with those credentials, our application uses forms authentication, and when we hit another server directly on the farm by passes the form authentication, can anyone guide me on the most effective way to do this..

Any help would be appreciated.. thank you

Recipe for proxying http requests to different port on same machine

Skwerl — Tue, 03 Mar 2009 04:44:04 GMT

I apologize if this is an elementary situation, but I've been banging my head on it for a couple hours without success. This has been mentioned on the forum before, but I don't see explicit directions on how to accomplish this. We have a mail server with its own web server (for webmail) running on the same machine we use IIS7 on to serve our web sites. I've set the webmail server to use port 81. What I would like is to proxy external requests for mail.domain.com to localhost:81. I had no problem getting redirection to work, but due to firewall limitations, we want everything to go through port 80, so this wasn't suitable.
I've added the following server level (I trashed the "fake" webfarm I set up) rewrite rule:

The result of this is a 404.4 error. I don't know why IIS is complaining about a handler. Is it trying to process the php file that the webamail server is using? If anyone can provide me with some detailed guidance on how to accomplish this, I'd be most appreciative. Perhaps providing a comprehensive list of "recipes" like this as they are encountered and solved in the forum would be helpful in the ARR documentation pages.

Thank you in advance,
Josh Usovsky

Re: SSL handshake problems with Apache

JohnRobertson — Tue, 03 Feb 2009 11:50:55 GMT

Thanks for the suggestion Mike,

I gave it a try against our system test environment but I'm still getting 502 ! Details have changed since my previous posts as it's a differant env-

If I miss out IIS and go directly to AIX on port 8002 from internet explorer I'm OK and can see certificate for site www.osso.ste.rbsgrp.mde.

If I go via IIS it's 502 time again with Apache logging -

[Tue Feb 3 11:41:43 2009] [error] mod_ossl: SSL call to NZ function nzos_Handshake failed with error 29014 (server www.osso.ste.rbsgrp.mde:443, client 11.153.106.55)
[Tue Feb 3 11:41:43 2009] [error] mod_ossl: Unknown error
[Tue Feb 3 11:41:43 2009] [error] mod_ossl: SSL call to NZ function nzos_Handshake failed with error 28864 (server www.osso.ste.rbsgrp.mde:443, client 11.153.106.55)
[Tue Feb 3 11:41:43 2009] [error] mod_ossl: SSL IO error [Hint: the client stop the connection unexpectedly]

While IIS is logging -

#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2009-02-03 11:41:43 W3SVC6 MLAUANZEN01 11.153.106.143 GET / X-ARR-LOG-ID=936c5cb5-d42c-43d8-a27a-6f0352411679 443 - 11.152.62.60 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1) - - www.osso.ste.rbsgrp.mde 502 3 12175 1664 372 109

I'm trying to set this up as a proof of concept that ARR will do a job for us by loadbalancing SSL Apache instances so any suggestions would be greatly appreciated.

Finally, I'm wondering if anybody could suggest a friendly debug tool ? I'm a bit scared of Wireshark !

John,

SSL handshake problems with Apache

JohnRobertson — Mon, 02 Feb 2009 18:13:11 GMT

Please help folks !

I have configured a serverfarm server and added httpport and httpsport details for an Oracle HTTP server (basically Apache rebadged). SSL offloading is disabled and I've added URL rewrite rules to pass on in the clear and when {HTTPS} is on as directed elsewhere.

Connections in the clear work fine but when I try https I'm getting a 502.

In the apache ssl error log I see

SSL call to NZ function nzos_Handshake failed with error 29014

I have IIS server certificates in place to handle client to IIS connections and the OAS has seperate SSL certificates meant to handle the IIS to OAS connection but I suspect I'm missing a step in getting IIS to accept these ?

Thanks,

httpPort and httpsPort in ARR

bb1769 — Tue, 30 Dec 2008 21:47:47 GMT

I need to reverse proxy to a server on non-default http/https ports (8080/8443). I used the appcmd method mentioned in the comments in this post to add the setting in IIS7:
forums.iis.net/t/1153071.aspx

When I list the contents of the webFarms (appcmd list config /section:webFarms), it shows the httpPort and httpsPort attributes:

But when I request a resource through the server farm, it sends the request to the reverse proxy machine on port 80 (verified using Wireshark). Is this the correct attribute, or does something else need to be added/done? Thanks for any help.