HAProxy – How to Add Basic HTTP Access Authentication

haproxyhttp-authentication

I've successfully setup HAProxy in front of an HTTP server which I have no control over.

Is it possible to configure HAProxy to add Simple HTTP Authentication to all sites, bearing in mind I can't configure this on the backend?

Thanks,

Lars

Best Answer

I had to do this today myself (because IIS 7.5 bizarrely doesn't actually support authenticating against anything but Windows user accounts or AD!)...

Here's all the code

userlist UsersFor_AcmeCorp
  user joebloggs insecure-password letmein

backend HttpServers
  .. normal backend stuff goes here as usual ..
  acl AuthOkay_AcmeCorp http_auth(UsersFor_AcmeCorp)
  http-request auth realm AcmeCorp if !AuthOkay_AcmeCorp

I documented it a bit better here: http://nbevans.wordpress.com/2011/03/03/cultural-learnings-of-ha-proxy-for-make-benefit/

Related Solutions

HAProxy – How to Use Custom 503 Error Document

You can use the errorfile directive and then a custom .http text file. So for example:

errorfile 503 /etc/haproxy/errors/503-mycustom.http

Content of the file would then be something like:

HTTP/1.0 503 Service Unavailable
Cache-Control: no-cache
Connection: close
Content-Type: text/html

<html> 
  <head>
    <title>RARRR!!!!!</title>
  </head> 
  <body style="font-family:Arial,Helvetica,sans-serif;">
    <div style="margin: 0 auto; width: 960px;"> 
          <h2 >RAWR RAWR RAWR</h2>
    </div>
  </body> 
</html>

The errorfile directive can be specific to a backend as well.

The "errorfile" setting cannot be used to change a response sent by HAProxy if nodes are online. This setting only affects HAProxy when all nodes are offline.

It is important to understand that this keyword is not meant to rewrite errors returned by the server, but errors detected and returned by HAProxy. This is why the list of supported errors is limited to a small set.

HAproxy: digest authentication

If I understood you well, you can try using a different balancing algorithm balance source instead of roundrobin. Using this algorithm, all the requests from the same IP will go the same backend server (unless that server is down). This can distribute the load between your backend servers evenly depending on your clients IP addresses.

Best Answer

Related Solutions

HAProxy – How to Use Custom 503 Error Document

HAproxy: digest authentication

Related Topic