[cas-user] CAS High Availability

13 views
Skip to first unread message

Baba Ndiaye

unread,
Dec 10, 2021, 6:57:34 AM12/10/21
to CAS Community
I want to set up a high availability solution for my CAS servers and i want some solutions for that i want to use DNS round Robin
*DNS round robin
If you already implement it i need your help please.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/45e6a2a5-ef55-4e1b-b1d3-9860fd29eb46n%40apereo.org.

Ray Bon

unread,
Dec 10, 2021, 11:42:33 AM12/10/21
to cas-...@apereo.org
Baba,

We use round robin with 4 cas servers and use hazelcast for ticket storage. Round robin is managed by the load balancer in prod.
Whatever you use for ticket storage has to be fast enough so that the second server knows about the tickets before they are validated by the services.
On my local I use apache config for clustering (this config will work with only one of the cas servers started).

<VirtualHost *:443>
<Proxy balancer://cascluster>
# BalancerMember http://localhost:8087
BalancerMember ajp://localhost:8010
BalancerMember ajp://localhost:8011
</Proxy>
DocumentRoot "/var/www/html"
    

SSLEngine on
SSLCertificateFile      /etc/ssl/certs/local.uvic.ca.chain.pem
SSLCertificateKeyFile /etc/ssl/private/local.uvic.ca.key.pem

SSLProxyEngine on
        #Bypassing certicate checking on self-signed client cert
        SSLProxyVerify none
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerName off
        SSLProxyCheckPeerExpire off

ProxyPreserveHost On
ProxyPass /cas balancer://cascluster/cas 
ProxyPassReverse /cas balancer://cascluster/cas
#ProxyPass /cas ajp://localhost:8010/cas
#ProxyPassReverse /cas ajp://localhost:8010/cas
ProxyPass /cas-management ajp://localhost:8017/cas-management
ProxyPassReverse /cas-management ajp://localhost:8017/cas-management
ProxyPass /sp ajp://localhost:8016/sp
ProxyPassReverse /sp ajp://localhost:8016/sp
ProxyPassReverse /app0 http://localhost:12080/app0
ProxyPassReverse /app1 http://localhost:12080/app1
ProxyPass /Shibboleth.sso http://localhost:12080/Shibboleth.sso
ProxyPassReverse /Shibboleth.sso http://localhost:12080/Shibboleth.sso
ProxyPass /nodejs https://localhost:8443
ProxyPassReverse /nodejs https://localhost:8443
ServerName local.uvic.ca

        <IfModule mod_headers>
                RequestHeader set X-HTTPS 1
                Header set Referrer-Policy "no-referrer-when-downgrade"
        </IfModule>

</VirtualHost>

Ray

On Fri, 2021-12-10 at 03:57 -0800, Baba Ndiaye wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

I want to set up a high availability solution for my CAS servers and i want some solutions for that i want to use DNS round Robin
*DNS round robin
If you already implement it i need your help please.

-- 
Ray Bon
Programmer Analyst
Development Services, University Systems

I acknowledge and respect the lək̓ʷəŋən peoples on whose traditional territory the university stands, and the Songhees, Esquimalt and WSÁNEĆ peoples whose historical relationships with the land continue to this day.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/5d9d0256b4b73788ab1fee8a3bcda3476618eedd.camel%40uvic.ca.

Jason B. Rappaport

unread,
Dec 13, 2021, 8:51:12 AM12/13/21
to cas-...@apereo.org

Ray – good morning.  Are your 4 CAS servers within the same data center?

 

The reason I ask is that we have 4 CAS servers in 4 different data centers (two on prem and two off prem) and what we have seen is that they tend to get into contention with each other resulting in two CAS servers having pegged CPUs.  I talked to the Hazelcast folks and they told me that Hazelcast only works within one data center, and trying to run it across the 4 that we are doing is not recommended with their community edition; their paid edition will handle it as it uses MQs.  Just curious if you have experienced this or not. 

 

Thanks, Jay

 

________________________________

Jason Rappaport (he/him)

Identity and Access Management Analyst

Office of Information Technology

Email:  jaso...@princeton.edu

Office:  609-258-8464

 

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/BL0PR04MB5156F8724919C4C8080F3F2BCC749%40BL0PR04MB5156.namprd04.prod.outlook.com.

Ray Bon

unread,
Dec 13, 2021, 12:09:58 PM12/13/21
to cas-...@apereo.org
Jason,

We run in two data centres. We manage both ourselves, so perhaps our infrastructure is more closely aligned than what you are operating under.

One option may be to set up an independent hazelcast cluster (cas would still start its own but not use it).

I do not know enough about hazelcast to know why it would not work across data centres nor why MQs would be needed.

Ray

On Mon, 2021-12-13 at 13:51 +0000, Jason B. Rappaport wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

-- 
Ray Bon
Programmer Analyst
Development Services, University Systems

I acknowledge and respect the lək̓ʷəŋən peoples on whose traditional territory the university stands, and the Songhees, Esquimalt and WSÁNEĆ peoples whose historical relationships with the land continue to this day.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/00345375cd2cfe1f26b184220bacdc391b9dc244.camel%40uvic.ca.

Baba Ndiaye

unread,
Jan 14, 2022, 11:58:31 AM1/14/22
to CAS Community, Ray Bon

Thank you Ray for your answer I would also like to know if hazelcast must be installed on each node and also for the instanceName which name should we choose? a name of a node where it must be different and we add it to the DNS if this is the case on the name (InstanceName) is down my nodes will no longer be accessible ????
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/765711d9-e2fc-4c9f-9994-86b0e011de5an%40apereo.org.

Ray Bon

unread,
Jan 28, 2022, 1:03:18 PM1/28/22
to cas-...@apereo.org, mrbaba...@gmail.com
Baba,

Each cas server will start its own hazelcast node (no need to install). Hazelcast has some capability to maintain itself if a node goes down (and comes up). I have not tested that since it is a minor inconvenience for a user to log in again if a session is lost

Ray
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/22116d9f1856475fd4365be7544a94fc71e2fb93.camel%40uvic.ca.

Baba Ndiaye

unread,
Feb 5, 2022, 11:54:38 AM2/5/22
to Ray Bon, cas-...@apereo.org
Ok, thanks for the clarification. So something i have this error /cas/login?exception.message=Error+decoding+flow+execution HTTP/1.1"
i have this architecture currently
image.png
The haproxy has the same domain name devcas.mydomain.com but each server has her own IP address. But if my haproxy1 is down (FAI is down Ip public is down) we have a answer of the second but something i have this error on page login page devcas.mydomain.com/cas/login?exception.message=Error+decoding+flow+execution HTTP/1.1"
How can I solve it????
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAFu1ZRsC1M8WP4etkoauNzkj%2Bjo2SMgFbF%3DptDfPQPGXBuE9ig%40mail.gmail.com.

Jason B. Rappaport

unread,
Feb 7, 2022, 8:58:52 AM2/7/22
to cas-...@apereo.org

Good morning.  We have a similar architecture, but slightly different.  We run an internal/ external view of DNS that routes one to either an on-prem load balancer if they are on-prem or an off-prem load balancer if they are off-prem.  Behind each LB we run two CAS servers.  All four CAS servers replicate tickets via Hazelcast and have a local copy of services (SAML, CAS, OIDC) that is shipped to them via Azure DevOps release pipeline.  That being said, we have experienced Hazelcast issues that manifest themselves as pegged CPU typically on two CAS servers (one on and one off prem); when this happens we also see Hazelcast heartbeat error messages.  I have talked to the Hazelcast folks and they do not recommend using Hazelcast in this manner.  Instead, they only recommend using Hazelcast if your CAS servers are in the same datacenter.  We are considering moving to an all off-prem authentication infrastructure as a result. 

 

Thanks, Jay

 

________________________________

Jason Rappaport (he/him)

Identity and Access Management Analyst

Office of Information Technology

Email:  jaso...@princeton.edu

Office:  609-258-8464

 

 

From: cas-...@apereo.org <cas-...@apereo.org> On Behalf Of Baba Ndiaye
Sent: Saturday, February 5, 2022 10:37 AM
To: Ray Bon <rb...@uvic.ca>
Cc: cas-...@apereo.org
Subject: Re: [cas-user] CAS High Availability

 

Ok, thanks for the clarification. So something i have this error /cas/login?exception.message=Error+decoding+flow+execution HTTP/1.1"

i have this architecture currently

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/BL0PR04MB51568BB5A5C973F184295C6FCC2C9%40BL0PR04MB5156.namprd04.prod.outlook.com.
image001.png
Reply all
Reply to author
Forward
0 new messages