介绍
使用软件层面做ADFS 反向代理以及负载均衡
需求准备
- 2 Ubuntu 20.04 Servers
- 3 available IP Addresses (Here we are using the 10.0.0.0/24 subnet)
- 10.0.0.100 for keepalived
- 10.0.0.101 for the MASTER server
- 10.0.0.102 for the BACKUP server
- An ADFS Cluster
Keepalived 配置
MASTER: /etc/keepalived/keepalived.conf
global_defs {
router_id haproxy
enable_script_security
}
vrrp_script chk_haproxy {
script "/usr/bin/pgrep haproxy"
interval 2
weight 2
}
vrrp_instance haproxy {
interface ens160
state MASTER
# MASTER requires a higher priority number than the SLAVE
priority 101
virtual_router_id 51
authentication {
auth_type AH
auth_pass 12345678
}
virtual_ipaddress {
10.0.0.100
}
track_script {
chk_haproxy
}
}
BACKUP: /etc/keepalived/keepalived.conf
global_defs {
router_id haproxy
enable_script_security
}
vrrp_script chk_haproxy {
script "/usr/bin/pgrep haproxy"
interval 2
weight 2
}
vrrp_instance haproxy {
interface ens160
state BACKUP
# BACKUP requires a lower priority number than the MASTER
priority 100
virtual_router_id 51
authentication {
auth_type AH
auth_pass 12345678
}
virtual_ipaddress {
10.0.0.100
}
track_script {
chk_haproxy
}
}
HAProxy 配置
需要将必要的证书放置于 /etc/ssl/domain.com/certificate.pem
根据需要修改以下配置文件内容:
/etc/haproxy/haproxy.cfg
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
user haproxy
group haproxy
maxconn 40000
ulimit-n 81000
daemon
ssl-default-bind-ciphers EECDH+AESGCM:EDH+AESGCM
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-server-ciphers EECDH+AESGCM:EDH+AESGCM
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
tune.ssl.default-dh-param 2048
defaults
log global
mode tcp
option httplog
option dontlognull
option forwardfor
option http-use-htx
timeout client 30s
timeout server 30s
timeout connect 5s
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
# Page to view statistics with username User and password Password
listen stats
bind :9000
mode http
stats enable
stats hide-version
stats realm Haproxy\ Statistics
stats uri /haproxy_stats
stats auth Username:Password
# Frontend for HTTP to HTTPS redirect
frontend fe_http
bind *:80
mode http
option httplog
log global
redirect scheme https code 301
# Frontend for SNI Passthrough
frontend fe_spt
bind *:443
option forwardfor header X-Forwarded-For
tcp-request inspect-delay 5s
tcp-request content accept if { req_ssl_hello_type 1 }
# An entry is required per FQDN
use_backend spt_sts if { req_ssl_sni -i sts.domain.com }
# This will be the webpage that is displayed if no matching FQDN is detected
default_backend spt_sts
# Each SNI Passthrough backend requires a port to use for the normal frontend
backend spt_sts
option forwardfor header X-Forwarded-For
server localhost 127.0.0.1:20000 check
# Normal frontend
frontend fe_sts
bind *:20000 ssl crt /etc/ssl/domain.com/certificate.pem
mode http
http-request set-header X-MS-Forwarded-Client-IP %[src]
use_backend be_sts
# Normal backend
backend be_sts
mode http
log global
balance roundrobin
option httpchk GET /adfs/ls/IdpInitiatedSignon.aspx HTTP/1.1\r\nHost:\ sts.domain.com
option forwardfor header X-Client
http-check expect status 200
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server adfs01 10.0.0.98:443 ssl verify none check check-sni sts.domain.com sni ssl_fc_sni inter 3s rise 2 fall 3
server adfs02 10.0.0.99:443 ssl verify none check check-sni sts.domain.com sni ssl_fc_sni inter 3s rise 2 fall 3