0

How can I add SPNEGO authentication to a WildFly 10.1 load balancer?

Background:

  • All nodes are running on Windows.
  • The nodes themselves are running on WildFly 8.2.1 (because the application is tight to it) in a Wildfly 8.2.1 domain
  • The load balancer is running WildFly 10.1
  • The nodes are registering with mod_cluster
T-Heron
  • 5,385
  • 7
  • 26
  • 52
Maddin
  • 957
  • 1
  • 11
  • 21

2 Answers2

2

You need to get the SPNEGO support into your application.

WildFly 8 and 9 don't have the Undertow SPNEGO integration ready (WFLY-2553) . You should either switch to WildFly 10.x, or try to use a custom SPNEGO authentication method on your worker nodes. Try to use either servlet filter approach or this custom authenticator.

My strong recommendation is to upgrade to WildFly 10+.

kwart
  • 3,154
  • 1
  • 21
  • 22
1

There isn't much to go by in your post as to what is and is not working. This forum is more about what custom code you have created that isn't working, and we can help you there. It seems in this instance you are looking more for an approach on how to setup Kerberos authentication into your WildFly nodes through a load-balancer. As info, it doesn't matter that there is a load-balancer involved, except that you specify a VIP name for the nodes in DNS and have the VIP name be the fully-qualified DNS host part of the name in the SPN which you will need to setup in order for clients to do Kerberos SSO against the WildFly nodes. I don't know anything about WildFly specifically, but I found this link for you which may help get you started: WildFly 9 - Kerberos Authentication for Domain Management Over HTTP

T-Heron
  • 5,385
  • 7
  • 26
  • 52
  • I am still a bit confused. By VIP I assume you mean Virtual IP. As I understood it. The load balancer receives a request and forwards it to the web server node. To my understanding the Kerberos negotiation is between the client and the load balancer, not between the client and the node. Setting up a DNS round-robin or a VIP would only help if I wanted to distribute the load between several load balancers. Otherwise the load balancing would be done by the network setup, not the wildfly load balancer. – Maddin Feb 06 '17 at 22:32