Configure Load Balancer for OpenAM 12

Introduction

In this article I will demonstrate how to configure software Load Balancer (LB) for two OpenAMs.

OpenAM is a open source access management software provided by ForgeRock.

Load balancing aims to optimize resource use, maximize throughput, minimize response time, and avoid overload of any single resource. If a one server is down, LB redirect all requests to others servers which are up.

To simplify, I will configure LB, OpenAM 1 and OpenAM 2 on one virtual machine and OpenAMs will be configured with embedded data and config store. To read more about embedded config and data store please check chapters 1.4 and 1.5 here.

Prerequisites:

• configured virtual machine
• 2 x apache tomcat
  • tomcat 1 is listening on port 8080
  • tomcat 2 is listening on port 8081 (conf/server.xml, also it is necessary to change the port for shutdown )
• edit /etc/hosts to include all hostnames (all hostnames will have the same IP, because they are on the same machine)
  • openam1.profiq.com
  • openam2.profiq.com
  • openam.profiq.com

Load Balancer

I used HA proxy software load balancer.

Download HA Proxy

You can download HA Proxy here.

Install HA Proxy from source

1. Unpack HA Proxy:

# tar -xvf haproxy-1.5.14.tar.gz

2. Navigate into HA Proxy directory:

# cd ./haproxy-1.5.14

3. Compile HA Proxy. Compile for Linux kernel 2.6.32 or later and optimize the binaries for the install CPU architecture.

Note: you can check your linux version:

# make TARGET=linux2632 ARCH=native

# uname -a
Linux centos6-64 2.6.32-504.8.1.el6.x86_64 #1 SMP Wed Jan 28 21:11:36 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

4. Install the compiled binary:

# make install

5. Copy the HA Proxy to yours directory

# mkdir /opt/HA-Proxy-1.5.14
# cp /usr/local/sbin/haproxy /opt/HA-Proxy-1.5.14

Configure HA Proxy

1. Create the configuration file

# vim /opt/HA-Proxy-1.5.14/haproxy.conf

2. Add content into HA Proxy configuration file:

global
   maxconn 4096
   daemon

defaults
   mode http
   option tcpka
   retries 3
   option redispatch
   maxconn 1024
   timeout client 1h
   timeout connect 5000ms
   timeout server 1h

frontend fe
   bind openam.profiq.com:80
   default_backend be

backend be
   mode http
   balance roundrobin
   cookie SERVERID insert indirect nocache
   server openam1 openam1.profiq.com:8080 check cookie 1
   server openam2 openam2.profiq.com:8081 check cookie 2
   option http-server-close
   option redispatch
   appsession amlbcookie len 2 timeout 1h request-learn

Backend is configured for 2 OpenAMs (openam1 and openam2) and LB is listening on openam.profiq.com:80.

It is recommended to use stickiness (“appsession amlbcookie len 2 timeout 1h request-learn”) for the backend, it means, if you log in via openam1 a cookie is sent by the backend with backend-specific value, HA Proxy will then look for that cookie, and will store its value in a table associating it with the server’s identifier, for more info see.

You can find description for properties in to HA Proxy documentation here.

OpenAM 1

Download latest stable OpenAM

Download latest openam (currently it is OpenAM 12.0.1) from forgerock backtsage here.

Install OpenAM 1

1. Deploy downloaded openam.war into tomcat

# cp /opt/OpenAM-12.0.1.war /opt/apache-tomcat-7.0.50/webapps/openam.war

2. Start tomcat 1
3. Hit the openam1 page: http://openam1.profiq.com:8080/openam and you will see OpenAM Configuration Page

4. Choose “Create New Configuration” and accept the license
5. Step 1: Set amAdmin password and click next
6. Step 2: Server config: Server URL = http://openam1.profiq.com:8080 Cookie Domain = .profiq.com Platform Locale = en_US Configuration Directory =/root/openam1
7. Step 3: Configuration Data Store Settings

8. Step 4: User Data Store Settings Set “OpenAM User Data Store”
9. Step 5: Site Configuration

10. Step 6: Default Policy Agent User set password
11. Summary

12. Create Configuration

Note: For more info see OpenAM install guide

OpenAM 2

Install OpenAM 2

1. Deploy downloaded openam.war into tomcat

# cp /opt/OpenAM-12.0.1.war /opt/apache-tomcat-6.0.39/webapps/openam.war

2. Start tomcat 1
3. Hit the openam2 page: http://openam2.profiq.com:8081/openam and you will see OpenAM Configuration Page
4. Choose “Create New Configuration” and accept the license
5. Step 1: Set amAdmin password and click next
6. Step 2: Server config: Server URL = http://openam2.profiq.com:8081 Cookie Domain = .profiq.com Platform Locale = en_US Configuration Directory = /root/openam2
7. Step 3: Configuration Data Store Settings Set “Add to Existing Deployment” Server URL: http://openam1.profiq.com:8080/openam

8. Step 5 Site Configuration Site Name = profiq site Load Balancer URL = http://openam.profiq.com:80/openam Enable Session HA Persistence and Failover = true

9. Summary
10. Create Configuration

Test Configuration

• Start load balancer:

# /opt/HA-Proxy-1.5.14/haproxy -f /opt/HA-Proxy-1.5.14/haproxy.conf

• Hit the load balancer: http://openam.profiq.com/openam
• Login as amadmin
• if you check cookies there will be cookie amlbcookie = 01 (01 is ID of server, in my case means you are logged via OpenAM1)
• delete all cookies and shut-down openam1, login again, and observe the cookie amlbcookie. You can observe that second OpenAM server will be used and one can see it by looking at amlbcookie = 02. This simulates purpose of load balancer, where if you have multiple users, load balancer will balance load in a way where it send user 1 to OpenAM 1, user 2 to OpenAM 2, user 3 to OpenAM 1 again etc. This is called round-robin algorithm (“balance roundrobin” = property from HA proxy config file).