Apache2 NTLM not working with reverse proxy load balancer

Question

We're working on setting up load balancing between two Apache servers on two different Windows Server 2012 machines (let's call them VmA and VmB), at the present we use the mod_authnz_sspi to authenticate users using Windows Authentication. VmA hosts the load balancer, and a secondary HTTP server to serve requests, VmB just hosts a HTTP server.

The issue we're having is that it does not automatically pass credentials through to the secondary server and it will always ask to enter credentials (important to note, if you do enter credentials it will work, however this isn't an option for our environment). Also, if we disable VmB in the server balancing and only have VmA in the balancer, it works without a hitch. It only asks for credentials when working as a proxy between VMs.

Here is my httpd.conf file for reference.

<Proxy "balancer://mycluster">
        BalancerMember "http://VmAhostname:8080"
        BalancerMember "http://VmBhostname:80"
</Proxy>

KeepAlive On

SetEnv proxy-initial-not-pooled
SetEnv proxy-chain-auth On

ProxyRequests On
ProxyVia On
ProxyPreserveHost On
ProxyPass               "/" "balancer://mycluster/"
ProxyPassReverse        "/" "balancer://mycluster/"

Any assistance would be appreciated

Answer 1

Hey guys so we worked it out eventually. Essentially the best course is to remove NTLM auth from the request servers and only enable auth on the balance loading server. Then, have the reverse proxy server add a request header with the auth details.

If you do this you will need to secure the request servers to only allow traffic from the reverse proxy server, or else anybody could header inject a username.

After removing auth from the request servers just add this to the reverse proxy server:

RequestHeader set X-Remote-User expr=%{REMOTE_USER}

And that should do it!