Configure IBM Security Privileged Identity Manager Appliance with a Load Balancer

Transcription

1 Configure IBM Security Privileged Identity Manager Appliance with a Load Balancer Aanchal Sinha aansinha@in.ibm.com Nitesh Mehare nimehare@in.ibm.com Parag Gokhale parag.gokhale@in.ibm.com Santosh Ankushkar sankushk@in.ibm.com Aug 5, 2014, 1.0 Abstract: Installing IBM Security Privileged Identity Manager (ISPIM) virtual appliance takes away the complexity in installing and configuring three separate products. It is recommended to create cluster of ISPIM virtual appliances to provide high availability for business users. This white paper talks about requirements for setting up a cluster and provides step-by-step guide to installing and configuring a popular, open source load balancer for ISPIM cluster.

2 Table of Contents 1Introduction...3 2Deployment Topology Configuration SSL Certificates Install Nginx Configure Nginx...6 3Conclusion...8 4Resources...8 5About the authors...8 Table of Figures Figure 1: Network Deployment Topology...3 Index of Tables Table of Listings

3 1 Introduction IBM Security Privileged Identity Manager secures, automates, and audits the use of privileged Identities in an enterprise. To prevent insider attacks, Privileged Identity Manager manages privileged user passwords without exposing them and by automatic user access provisioning and automatic reset of these passwords after every use. For business continuity, it is necessary to have this service highly available. Deploying a cluster of Privileged Identity Manager virtual appliances provides the required high availability. This article describes a mechanism to configure and tune such a cluster using an external load balancer. IBM business partners, consultants, and IT department personnel, who are responsible for installing and deploying a cluster of IBM Security Privileged Identity Manager virtual appliances, will find this article useful to a successful cluster deployment. 2 Deployment 2.1 Topology Figure 1: Network Deployment Topology Figure 1: Network Deployment Topology shows a cluster deployment of Privileged Identity Manager virtual appliances. The clients can be Self Care portal for manual check-out, check-in of shared credentials and Single sign-on agent on Windows desktop. A load balancer is a hardware or software device capable of spreading user requests amongst cluster member nodes. To avoid being a single point of failure, one should keep a backup for the load balancer ready to be swapped in case of primary load balancer's failure. The Load Balancer must meet the following requirements:

4 Needs to be a Layer-7 Load Balancer. Must be installed with a valid SSL certificate. One can install a certificate signed by a commercial Certificate Authority or a self-signed certificate. In the later case, the Root CA certificate, with which the Load Balancer certificate is signed, must be imported in the Windows truststore to be able to work with Single sign-on access agent. The Access Agent should be configured to use Load Balancer as the IMS Server. The communication between the Access Agent and the IMS Server is over a separate SSL connection. Needs to turn on 'underscores_in_headers' directive. 2.2 Configuration We chose Nginx as load balancer. Nginx (pronounced engine-x) is a highly deployed, open source HTTP server and reverse proxy server. Rest of the article describes preparation, setup, and tuning of Nginx load balancer in creating a cluster of Privileged Identity Manager virtual appliances SSL Certificates Ideally, you have a certificate, signed by one of the commercial Certificate Authorities, to be configured with this load balancer. You may skip this section unless you are creating a self signed certificate. Create self-signed certificate Ensure openssl packages are installed on the machine where you expect to install the load balancer. Create a folder 'sslkeys' and navigate to that directory. 1. Create RSA keys for RootCA openssl genrsa -out rootca.key 2048 Generating RSA private key, 2048 bit long modulus e is (0x10001)

5 2. Create RootCA certificate openssl req -x509 -new -nodes -key rootca.key -days out rootca.pem You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank Country Name (2 letter code) [XX]:US State or Province Name (full name) []:California Locality Name (eg, city) [Default City]:Costa Mesa Organization Name (eg, company) [Default Company Ltd]:IBM Organizational Unit Name (eg, section) []:ISL Common Name (eg, your name or your server's hostname) []:IBMrootCA Address []:root@ibm.com

6 3. Create certificate for load balancer signed by RootCA openssl genrsa -out lb.key 2048 Generating RSA private key, 2048 bit long modulus e is (0x10001) openssl req -new -key lb.key -out lb.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank Country Name (2 letter code) [XX]:IN State or Province Name (full name) []:MH Locality Name (eg, city) [Default City]:Pune Organization Name (eg, company) [Default Company Ltd]:IBM Organizational Unit Name (eg, section) []:ISL Common Name (eg, your name or your server's hostname) []:server1.ibm.com Address []:admin@server1.ibm.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: openssl x509 -req -in lb.csr -CA rootca.pem -CAkey rootca.key -CAcreateserial -out lb.crt -days 500 Signature ok subject=/c=in/st=mh/l=pune/o=ibm/ou=isl/cn=server1.ibm.com/ address=admin@se rver1.ibm.com Getting CA Private Key Install Nginx Nginx can be installed by either downloading the source & building it or by directly installing the binaries for the RHEL setup. Preferrably, download Pre-built stable package from Nginx site and install it Configure Nginx Modify Nginx configuration file nginx/nginx.conf as follows: Enable SSL Add server element to configuration file as follows:

7 server { } listen 443 ssl; ssl on; ssl_certificate./sslkeys/lb.crt; ssl_certificate_key./sslkeys/lb.key; Configure Origin Servers (Vas) Add upstream element and make a reference using proxy_pass under location sub-element as shown below: Directive ip_hash enables session stickiness. Privileged Identity Manager Virtual Appliance cluster requires session affinity. Out of the box Nginx installation provides session affinity at IP address level. Commercial version of Nginx provides session affinity at a much granular level. Alternately, 'nginxsticky-module-ng' is an open source library that provides session affinity for Nginx at a granular level. upstream backend { ip_hash; server server1.ibm.com:443 max_fails=3 fail_timeout=20s; server server2.ibm.com:443 max_fails=3 fail_timeout=20s; } Location Directive server {... location / { } }... proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_next_upstream error timeout invalid_header http_500 http_404; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Ssl on; proxy_redirect off; proxy_pass Servers listed here have same weight and are used per load determined by the load balancer. Multiple directives exist to influence this decision. max_fails and fail_timeout ensures Load Balancer does not direct incoming requests to a server that has been sending failure response or timing out on requests. Special Handling Http {... underscores_in_headers... on; ESSO (IMS) server sends back responses with custom headers. Enable 'underscore_in_headers'

8 property. Tuning fail_timeout' and 'max_fails' directives control the optimal wait period and number of unsuccessful attempts. Based on these directives, nginx decides when to route incoming request to next available server. Value for this parameter needs to be picked carefully otherwise the request may timeout before getting routed to available server. We found setting value of 20 seconds for fail_time and 3 for max_fails helped the cluster perform better but your mileage may vary. 3 Conclusion IBM Security Privileged Identity Manager virtual appliance can be made highly available by creating a load balanced cluster of these appliances. Any Layer-7 load balancer can be used and configured as described in the article. Nginx is a highly successful and most deployed as HTTP server and reverse proxy. It is very easy to configure and use Nginx as a load balancer in front of IBM Privileged Manager virtual appliance cluster. 4 Resources Nginx download site nginx-sticky-module-ng - An open-source module to provide cookie level session affinity for nginx Learn more about ISPIM Virtual Appliance 5 About the authors Aanchal Sinha works in the capacity of a test professional in the IBM Security Identity Manager Virtual Appliance team. She has been with IBM for almost 4 years now. Most of her area of work at ISL has been with Appliance, Cognos Reporting, IBM Security Identity Manager and Role and Policy Modeler testing. Nitesh Mehare works in the capacity of a test professional in the IBM Security Identity Manager Virtual Appliance team. He has been with IBM for almost 7 years now. He has worked on products like ISPIM Virtual Appliance, IBM Tivoli Directory Server, IBM Security Identity Manager etc

9 Parag Gokhale is an appliance architect in the Security group. He is a senior developer, speaks at seminars and customer conferences, and has a paper published in IEEE. Santosh Ankushkar works as a test professional in the IBM Security Identity Manager Virtual Appliance team. He has been with IBM for almost 4 years now. He has worked on products such as ISPIM Virtual Appliance, IBM Role and Policy Modeler, IBM Security Identity Manager.