介绍

使用软件层面做ADFS 反向代理以及负载均衡

需求准备

  • 2 Ubuntu 20.04 Servers
  • 3 available IP Addresses (Here we are using the 10.0.0.0/24 subnet)
    • 10.0.0.100 for keepalived
    • 10.0.0.101 for the MASTER server
    • 10.0.0.102 for the BACKUP server
  • An ADFS Cluster

Keepalived 配置

MASTER: /etc/keepalived/keepalived.conf

  1. global_defs {
  2.     router_id haproxy
  3.     enable_script_security
  4. }
  6. vrrp_script chk_haproxy {
  7.     script "/usr/bin/pgrep haproxy"
  8.     interval 2
  9.     weight 2
  10. }
  12. vrrp_instance haproxy {
  13.     interface ens160
  14.     state MASTER
  15.     # MASTER requires a higher priority number than the SLAVE
  16.     priority 101
  17.     virtual_router_id 51
  18.     authentication {
  19.         auth_type AH
  20.         auth_pass 12345678
  21.     }
  22.     virtual_ipaddress {
  23.         10.0.0.100
  24.     }
  25.     track_script {
  26.         chk_haproxy
  27.     }
  28. }

BACKUP: /etc/keepalived/keepalived.conf

  1. global_defs {
  2.     router_id haproxy
  3.     enable_script_security
  4. }
  6. vrrp_script chk_haproxy {
  7.     script "/usr/bin/pgrep haproxy"
  8.     interval 2
  9.     weight 2
  10. }
  12. vrrp_instance haproxy {
  13.     interface ens160
  14.     state BACKUP
  15.     # BACKUP requires a lower priority number than the MASTER
  16.     priority 100
  17.     virtual_router_id 51
  18.     authentication {
  19.         auth_type AH
  20.         auth_pass 12345678
  21.     }
  22.     virtual_ipaddress {
  23.         10.0.0.100
  24.     }
  25.     track_script {
  26.         chk_haproxy
  27.     }
  28. }

HAProxy 配置

需要将必要的证书放置于 /etc/ssl/domain.com/certificate.pem

根据需要修改以下配置文件内容：
/etc/haproxy/haproxy.cfg

  1. global
  2.     log /dev/log local0
  3.     log /dev/log local1 notice
  4.     chroot /var/lib/haproxy
  5.     stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
  6.     user haproxy
  7.     group haproxy
  8.     maxconn 40000
  9.     ulimit-n 81000
  10.     daemon
  11.     ssl-default-bind-ciphers EECDH+AESGCM:EDH+AESGCM
  12.     ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
  13.     ssl-default-server-ciphers EECDH+AESGCM:EDH+AESGCM
  14.     ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
  15.     tune.ssl.default-dh-param 2048
  17. defaults
  18.     log global
  19.     mode tcp
  20.     option httplog
  21.     option dontlognull
  22.     option forwardfor
  23.     option http-use-htx
  24.     timeout client 30s
  25.     timeout server 30s
  26.     timeout connect 5s
  27.     errorfile 400 /etc/haproxy/errors/400.http
  28.     errorfile 403 /etc/haproxy/errors/403.http
  29.     errorfile 408 /etc/haproxy/errors/408.http
  30.     errorfile 500 /etc/haproxy/errors/500.http
  31.     errorfile 502 /etc/haproxy/errors/502.http
  32.     errorfile 503 /etc/haproxy/errors/503.http
  33.     errorfile 504 /etc/haproxy/errors/504.http
  35. # Page to view statistics with username User and password Password
  36. listen stats
  37.     bind :9000
  38.     mode http
  39.     stats enable
  40.     stats hide-version
  41.     stats realm Haproxy\ Statistics
  42.     stats uri /haproxy_stats
  43.     stats auth Username:Password
  45. # Frontend for HTTP to HTTPS redirect
  46. frontend fe_http
  47.     bind *:80
  48.     mode http
  49.     option httplog
  50.     log global
  51.     redirect scheme https code 301
  53. # Frontend for SNI Passthrough
  54. frontend fe_spt
  55.     bind *:443
  56.     option forwardfor header X-Forwarded-For
  57.     tcp-request inspect-delay 5s
  58.     tcp-request content accept if { req_ssl_hello_type 1 }
  60.     # An entry is required per FQDN
  61.     use_backend spt_sts if { req_ssl_sni -i sts.domain.com }
  63.     # This will be the webpage that is displayed if no matching FQDN is detected
  64.     default_backend spt_sts
  66. # Each SNI Passthrough backend requires a port to use for the normal frontend
  67. backend spt_sts
  68.     option forwardfor header X-Forwarded-For
  69.     server localhost 127.0.0.1:20000 check
  71. # Normal frontend
  72. frontend fe_sts
  73.     bind *:20000 ssl crt /etc/ssl/domain.com/certificate.pem
  74.     mode http
  75.     http-request set-header X-MS-Forwarded-Client-IP %[src]
  76.     use_backend be_sts
  78. # Normal backend
  79. backend be_sts
  80.     mode http
  81.     log global
  82.     balance roundrobin
  83.     option httpchk GET /adfs/ls/IdpInitiatedSignon.aspx HTTP/1.1\r\nHost:\ sts.domain.com
  84.     option forwardfor header X-Client
  85.     http-check expect status 200
  86.     http-request add-header X-Forwarded-Proto https if { ssl_fc }
  87.     server adfs01 10.0.0.98:443 ssl verify none check check-sni sts.domain.com sni ssl_fc_sni inter 3s rise 2 fall 3
  88.     server adfs02 10.0.0.99:443 ssl verify none check check-sni sts.domain.com sni ssl_fc_sni inter 3s rise 2 fall 3