Reverse Proxy – Setting Up FreeIPA Web Interface Behind HAProxy

freeipahaproxyreverse-proxy

I am trying to configure the FreeIPA web interface to work behind my HAProxy instance. I found an old GitHub Gist for the configuration (https://gist.github.com/m4ce/d081ab39654c3e13bbe8b150986526a3) as well as a medium article (https://medium.com/@michalmedvecky/running-freeipa-behind-haproxy-77620736698e) but in both cases they make use of the rspirep command, something which is no longer supported in HAProxy. So far I have got this:

        balance roundrobin
        # Set cookie to ensure same server is used
        cookie SERVERID insert indirect nocache httponly secure

        # Modify headers
        http-request set-header Referer https://1.ipa.example.com/ipa

        # Set cookies domain
        acl hdr_set_cookie_dom_1 res.hdr(Set-cookie) -m sub Domain= 1.ipa.example.com
        http-response replace-header  Set-Cookie ^Domain=1\.ipa\.example\.com(.*)$  Domain=authenticate\.example\.com\1 if hdr_set_cookie_dom_1

        server 1.ipa 1.ipa.example.com:443 check ssl verify none cookie 1

But this just results in the client being redirected from authenticate.example.com to 1.ipa.example.com.

Does anyone have a more up to date guide on how to configure this or any ideas on what might be causing the issues?

Best Answer

FreeIPA does not support running behind HA proxy, whatever product you'd use for that. I'd suggest you to read https://ssimo.org/blog/id_019.html for basic technical details to understand why is it not supported.

Related Topic