Hi everybody!
We’re using the same configuration (one Apache as load balancer and three Tomcat linked using mod_jk on windows2k3 Srv).
We’ve started the configuration for authentication in winAD, follwing the “Configuring Kerberos manual authentication and/or SSO in distributed environments” manual found on SAP web site.
Everything is working fine execpt SSO via the load balancer.
We found, by sniffing, that we received the authentication token from the KDC but we get a “Bad gateway” error on the logon page.
We’re thinking that the problem is between the Apache and the Tomcat.
Here’re our config files:
Apache httpd.conf
#
# ACC
#
ServerRoot "C:/apache2.2"
Listen 80
#
# Modules
#
LoadModule actions_module modules/mod_actions.so
LoadModule alias_module modules/mod_alias.so
LoadModule asis_module modules/mod_asis.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule authn_alias_module modules/mod_authn_alias.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule cgi_module modules/mod_cgi.so
LoadModule dir_module modules/mod_dir.so
LoadModule env_module modules/mod_env.so
LoadModule include_module modules/mod_include.so
LoadModule isapi_module modules/mod_isapi.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule mime_module modules/mod_mime.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule setenvif_module modules/mod_setenvif.so
#=============================================
#== Added for Load balancing on May 20th 2011
#=============================================
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule status_module modules/mod_status.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule jk_module modules/mod_jk.so
LoadModule rewrite_module modules/mod_rewrite.so
#=============================================
<IfModule !mpm_netware_module>
<IfModule !mpm_winnt_module>
User daemon
Group daemon
</IfModule>
</IfModule>
#
# ServerAdmin:
#
ServerAdmin email@address.com
#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#
ServerName LBSrvName:80
#
# DocumentRoot:
#
DocumentRoot "C:/apache2.2/htdocs"
#
# Default directory.
#
<Directory />
Options FollowSymLinks
#AllowOverride None
AllowOverride All
Order deny,allow
Deny from all
</Directory>
#
# DocumentRoot
#
<Directory "C:/apache2.2/htdocs">
Options Indexes FollowSymLinks
#AllowOverride None
AllowOverride All
Order allow,deny
Allow from all
</Directory>
<IfModule dir_module>
DirectoryIndex index.html
</IfModule>
<FilesMatch "^\.ht">
Order allow,deny
Deny from all
Satisfy All
</FilesMatch>
#
# ErrorLog:
#
ErrorLog "logs/error.log"
#
# LogLevel:
#
LogLevel warn
<IfModule log_config_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
<IfModule logio_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
</IfModule>
CustomLog "logs/access.log" common
</IfModule>
<IfModule alias_module>
ScriptAlias /cgi-bin/ "C:/apache2.2/cgi-bin/"
</IfModule>
<IfModule cgid_module>
</IfModule>
<Directory "C:/apache2.2/cgi-bin">
#AllowOverride None
AllowOverride All
Options None
Order allow,deny
Allow from all
</Directory>
#
# DefaultType
#
DefaultType text/plain
<IfModule mime_module>
TypesConfig conf/mime.types
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
</IfModule>
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
#=============================================
#== Added for Reverse Proxy on Sep 05th 2011
#== Used by FedPol
#=============================================
#<VirtualHost 10.0.25.41:*>
# ProxyPreserveHost On
# ProxyPass / http://accreports.idcn.mil.intra/
# ProxyPassReverse / http://accreports.idcn.mil.intra/
#</VirtualHost>
#=============================================
#== Added for URL Rewriting on Aug 09th 2011
#=============================================
RewriteEngine on
# rewrite to a FQDN host
# If not something like 'abc123.DOMAIN'
# If not something begining with digits like '123'
# Then rewrite 'abc123/anything' like 'abc123.DOMAIN/anything'
RewriteCond %{HTTP_HOST} !^([a-z0-9-]+).DOMAIN [NC]
RewriteCond %{HTTP_HOST} !^([0-9]+) [NC]
RewriteRule ^/(.*) http://%{HTTP_HOST}.DOMAIN/$1 [R]
# rewrite rule to adapt OpenDoc links R2 to links R3
RewriteRule /opendoc/(.*) /OpenDocument/opendoc/$1 [PT]
#=============================================
#== Added for Load balancing on May 20th 2011
#=============================================
# MOD_JK SETTINGS
# ===============
JkWorkersFile "conf/workers.properties"
JkLogFile logs/mod_jk.log
JkLogLevel info
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "
jkRequestLogFormat "%w %B %s %U %R"
ExtendedStatus On
ProxyIOBufferSize 65536
LimitRequestFieldSize 65536
# ALIASES
# =======
Alias /maintenance "c:/Apache2.2/htdocs/errors"
# ERRORS REDIRECTION
# ==================
ErrorDocument 500 /maintenance/noTomcat.html
ErrorDocument 503 /maintenance/noTomcat.html
ErrorDocument 403 /maintenance/forbidden.html
# Request redirection
# ===================
# Everything like http://%{host}/ is redirected to loadbalancer
JkMount / loadbalancer
JkMount /* loadbalancer
# Everything like http://%{host}/ is redirected to liveofficeLB
JkMount /dswsbobje/* liveofficeLB
# Everything like http://%{host}/manage is redirected to jkManage(Read/Write)
JkMount /manage jkManage
JkMount /manage/* jkManage
# Everything like http://%{host}/status is redirected to jkWatch(Read-Only allow from all)
JkMount /status jkWatch
JkMount /status/* jkWatch
# Everything like http://%{host}/maintenance is NOT redirected
JkUnMount /maintenance loadbalancer
JkUnMount /maintenance/* loadbalancer
# Locations
# =========
<Location "/jkmanager">
Order Deny,Allow
Deny from all
Allow from someWorkStationName
</Location>
<Location "/m*">
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from someWorkStationName
</Location>
<Location "/M*">
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from someWorkStationName
</Location>
<Location "/maintenance">
Allow from all
</Location>
#=============================================
APACHE Workers.properties
#=====================================================
# Load-Balancer, Maintenance & status Configuration
#=====================================================
#Worker list for LB and status
worker.list=loadbalancer,Member1,Member2,Member3,jkWatch,jkManage,liveofficeLB
# Define a 'jkWatch' worker using status
worker.jkWatch.type=status
worker.jkWatch.read_only=True
#'maintenance' is here an alias defined in httpd.conf refering to htdocs/errors/
worker.jkWatch.css=/maintenance/Customization/default.css
# Define a 'jkManage' worker using status
worker.jkManage.type=status
worker.jkManage.read_only=False
#'maintenance' is here an alias defined in httpd.conf refering to htdocs/errors/
worker.jkManage.css=/maintenance/Customization/default.css
#Member1
worker.Member1.port=8109
#worker.Member1.host=10.0.25.164
worker.Member1.host=Member1Name.DOMAIN
worker.Member1.type=ajp13
worker.Member1.cachesize=30
worker.Member1.lbfactor=3
worker.Member1.max_packet_size=65536
#Member2
worker.Member2.port=8009
#worker.Member2.host=10.0.25.161
worker.Member2.host=Member2Name.DOMAIN
worker.Member2.type=ajp13
worker.Member2.cachesize=30
worker.Member2.lbfactor=5
worker.Member2.max_packet_size=65536
#Member3
worker.Member3.port=8009
#worker.Member3.host=10.0.25.165
worker.Member3.host=Member3Name.DOMAIN
worker.Member3.type=ajp13
worker.Member3.cachesize=30
worker.Member3.lbfactor=5
worker.Member3.max_packet_size=65536
#------------------------------
# Load-balancing behaviour
#------------------------------
worker.loadbalancer.type=lb
worker.loadbalancer.method=R
worker.loadbalancer.balance_workers=Member1,Member2,Member3
worker.loadbalancer.sticky_session=true
worker.liveofficeLB.type=lb
worker.liveofficeLB.method=R
worker.liveofficeLB.sticky_session=true
worker.liveofficeLB.balance_workers=Member1
TOMCAT Server.xml
<?xml version="1.0" encoding="UTF-8"?>
<Server port="8005" shutdown="SHUTDOWN">
<!-- Comment these entries out to disable JMX MBeans support used for the administration web application -->
<Listener className="org.apache.catalina.core.AprLifecycleListener"/>
<Listener className="org.apache.catalina.mbeans.ServerLifecycleListener"/>
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
<Listener className="org.apache.catalina.storeconfig.StoreConfigLifecycleListener"/>
<!-- Global JNDI resources -->
<GlobalNamingResources>
<!-- Test entry for demonstration purposes -->
<Environment name="simpleValue" type="java.lang.Integer" value="30"/>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users -->
<Resource auth="Container" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" name="UserDatabase" pathname="conf/tomcat-users.xml" type="org.apache.catalina.UserDatabase"/>
</GlobalNamingResources>
<!-- Define the Tomcat Stand-Alone Service -->
<Service name="Catalina">
<!-- Define a non-SSL HTTP/1.1 Connector on port 8080 -->
<!--<Connector URIEncoding="UTF-8" acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" port="8180" redirectPort="8443"/>-->
<Connector URIEncoding="UTF-8" acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="65536" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" port="8180" redirectPort="8443" />
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector enableLookups="false" port="8109" protocol="AJP/1.3" redirectPort="8443"/>
<!-- Define the top level container in our container hierarchy -->
<Engine defaultHost="accreports.DOMAIN" name="Catalina" jvmRoute="Member1Name" >
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
<!-- Define the default virtual host -->
<Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true" xmlNamespaceAware="false" xmlValidation="false">
</Host>
<!-- BO XI R3 ACC INFOVIEWAPP -->
<Host appBase="webapps" name="accreports.DOMAIN" debug="0" unpackWARs="false" autoDeploy="false">
<Alias>accreports</Alias>
<Context path="" docBase="InfoViewApp"/>
<Context path="opendoc" docBase="OpenDocument"/>
<Logger className="org.apache.catalina.logger.FileLogger"/>
</Host>
<!-- BO XI R3 ACC CMCAPP -->
<Host appBase="webapps" name="acccmc.DOMAIN" debug="0" unpackWARs="false" autoDeploy="false">
<Alias>acccmc</Alias>
<Context path="" docBase="CmcApp"/>
<Logger className="org.apache.catalina.logger.FileLogger"/>
</Host>
</Engine>
</Service>
</Server>
Can someone help us? 
Middleware
(BOB member since 2006-07-13)