In one environment, we have three servers
load balanced that have a single Tomcat instance on each, fronted by two different Apache virtual hosts. Each of those two virtual hosts (served by all three servers) has its own different
load balancer. Internally, the first host (we'll call it barfoo) is served by port 443 (HTTPS) with its cert and the second host (we'll call it foobar) is served by port 1443 (HTTPS). When you hit foobar, it goes
to the
load balancer which is using IP affinity for that host, so you can easily test login/HTTPS on one of the servers serving foobar, but not the others (because you keep getting that server for the lifetime of the LB session, iirc).
In addition, each of the servers are using Shibboleth v2 for authN/SSO, using mod_shib (iirc). So, a normal request
to foobar hits the LB, is directed
to the 3rd server (and will do that from then on for as long as the LB session lasts), then Apache, then
to the Shibboleth SP which looks at the request, makes you login via negotiation with the Shibboleth IdP, then you hit Apache again which in turn hits Tomcat, renders, and returns the response. (I'm leaving out some steps there.)
We'd like
to hit one of the individual servers (foobar-03.acme.org which we'll say has IP 1.2.3.4) via HTTPS (skipping the
load balancer), so we at first try putting this in /etc/hosts:
1.2.3.4 foobar.acme.org
But since foobar.acme.org is a secondary virtual host running on 1443, it attempts
to get barfoo.acme.org rather than foobar.acme.org at port 1443 and see that the cert for barfoo.acme.org is invalid for this case since it doesn't match the request's host, foobar.acme.org.
I thought an ssh tunnel might be easy enough, so I tried:
ssh -L 7777:foobar-03.acme.org:1443
[email protected]
I tried just hitting https://localhost:7777/webappname in a browser, but when the Shibboleth login is over, it again tries
to redirect
to barfoo.acme.org, which is the default host for 443, and we get into an infinite redirect loop.
I then tried setting up an SSH tunnel with privileged port 443 locally going
to 443 of foobar-03.acme.org as the hostname for that virtual host:
sudo ssh -L 443:foobar-03.acme.org:1443
[email protected]
I also edited /etc/hosts
to add:
127.0.0.1 foobar.acme.org
This finally worked and I was able
to get the browser
to hit the individual HTTPS host at https://foobar.acme.org/webappname, bypassing the
load balancer.
This was a bit of a pain and wouldn't work for everyone, due
to the requirement
to use the local 443 port and ssh
to the server.
Is there an easier way
to browse
to and log into an individual host in this case?
