Project

General

Profile

Tâche #18126

Scénario #18360: Finaliser la configuration et le packaging d'EoleSSO en mode cluster

Intégration de la configuration dans le dictionnaire d'EoleSSO

Added by Bruno Boiget almost 5 years ago. Updated over 4 years ago.

Status:
Fermé
Priority:
Normal
Assigned To:
Start date:
11/28/2016
Due date:
% Done:

100%

Estimated time:
4.00 h
Spent time:
Remaining (hours):
0.0

Description

paramétrage :

  • du load balancing
  • de la télémétrie (activer / désactiver)

Associated revisions

Revision 8da3f78c (diff)
Added by Bruno Boiget almost 5 years ago

Début de mise en place des fichiers de configuration du mode cluster

ref #18433
ref #18126

History

#1 Updated by Bruno Boiget almost 5 years ago

  • Estimated time changed from 6.00 h to 3.00 h

#2 Updated by Bruno Boiget almost 5 years ago

  • Remaining (hours) changed from 6.0 to 3.0

#3 Updated by Scrum Master almost 5 years ago

  • Status changed from Nouveau to En cours

#4 Updated by Scrum Master almost 5 years ago

  • Assigned To set to Bruno Boiget

#5 Updated by Christophe LEON almost 5 years ago

Exemple de configuration stunnel, coté client


cert = /etc/ssl/certs/stunnel-eole.crt
key = /etc/ssl/certs/stunnel-eole.key
CAFile = /etc/stunnel/stunnel-server.pem
verify = 3
pid = /var/run/stunnel.pid
[redis]
client = yes
SSLversion = TLSv1
accept = 127.0.0.1:6379
connect = sso.ac-reunion.fr:6379

/etc/ssl/certs/stunnel-eole.crt est généré par gen_certif, mais il faut désactiver

#nsCertType              = server

dans certif-eole.conf

#6 Updated by Christophe LEON almost 5 years ago

Configuration stunnel, côté serveur

cert = /etc/stunnel/stunnel-server.pem
key = /etc/stunnel/stunnel-server.key
pid = /var/run/stunnel.pid
CAPath = /etc/stunnel/eole
verify = 3
[redis]
SSLversion=TLSv1
accept = 172.31.186.31:6379
connect = 127.0.0.1:6379

Les ca_locale.crt et stunnel-eole.crt de chacun des clients est a copier dans /etc/stunnel/eole et la commande suivante est à lancer

c_rehash /etc/stunnel/eole

#7 Updated by Bruno Boiget almost 5 years ago

  1. Fait :
  • Activation des statistiques en mode expert dans le dictionnaire 21_sso.xml --> nécéssite l'installation de prometheus_client pour fonctionner
  1. A mettre en place :
  • paquet eole-sso-cluster-client :
    • installe python-redis et stunnel4
    • génère un certificat et met en place la configuration stunnel (avec hote et port de la machine hébergeant Redis). voir commentaires précédents
    • dictionnaire avec l'adresse et port de stunnel côté Redis + variable eolesso_cluster mise à "oui"
  • paquet eole-sso-cluster-server ? (ou installation manuelle) :
    • installe redis-server et stunnel4
    • génère les certificats et la configuration stunnel pour accès à Redis. Port configurable (identique pour Redis/stunnel).
    • + conf ha-proxy ?

#8 Updated by Bruno Boiget almost 5 years ago

  • % Done changed from 0 to 30

#9 Updated by Christophe LEON almost 5 years ago

Exemple de conf haproxy ( juste ce qui a été ajouté par rapport à une conf classique )

global
ssl-server-verify none
frontend https-in
bind 172.31.186.31:443 ssl crt /etc/haproxy/ssl/sso.ac-reunion.fr.pem
option forwardfor
redirect scheme https if !{ ssl_fc }
default_backend backend_servers
backend backend_servers
balance roundrobin
cookie SERVERNAME insert indirect nocache
server sso-master 172.31.186.29:443 ssl cookie s1 check
server sso-slave 172.31.186.30:443 ssl cookie s2 check

#10 Updated by Bruno Boiget almost 5 years ago

  • Estimated time changed from 3.00 h to 4.00 h
  • Parent task changed from #9921 to #18360

#11 Updated by Bruno Boiget almost 5 years ago

  • Status changed from En cours to Nouveau

#12 Updated by Bruno Boiget almost 5 years ago

  • Remaining (hours) changed from 3.0 to 4.0

#13 Updated by Bruno Boiget almost 5 years ago

  • Status changed from Nouveau to En cours

#14 Updated by Bruno Boiget almost 5 years ago

  • Remaining (hours) changed from 4.0 to 2.0

#15 Updated by Bruno Boiget almost 5 years ago

  • Status changed from En cours to Résolu

#16 Updated by Daniel Dehennin over 4 years ago

  • % Done changed from 30 to 100

#17 Updated by Joël Cuissinat over 4 years ago

  • Status changed from Résolu to Fermé
  • Remaining (hours) changed from 2.0 to 0.0

Also available in: Atom PDF