How to set up a reverse proxy using Apache 2.0.x and have it rewrite urls.
This is particularly useful if you’re using an Identity server internally and want to be able to access the server externally. You can set up an Apache reverse proxy server in your DMZ and allow it to do so. If you use Identity Server 6.3 or higher, you will not need to do this.
The sole purpose for this article is because we needed a workaround for a customer due to a problem with the older version of Identity server where for the logout button uses an absolute url rather than a relative url and it causes the link to be inaccessible.
Because the customer was doing this on Linux, the instructions here will be for Linux and will differ from what you would do in Solaris. If you wanted to do this in Solaris, you would need either more sources or you could install the binaries from http://www.blastwave.org or http://www.sunfreeware.org.
To start with, you will need Apache 2.0.x installed. You can verify this with:
rpm -qav | grep httpd
or
rpm -qav | grep apache (depending on which Linux distribution you have)
My output shows I have httpd-2.0.52-3.1 installed.
You will want to check to see that your Apache installation also includes the mod_proxy modules. You can check this with:
rpm -qil httpd
My output shows:
/usr/lib/httpd/modules/mod_proxy.so
/usr/lib/httpd/modules/mod_proxy_connect.so
/usr/lib/httpd/modules/mod_proxy_ftp.so
/usr/lib/httpd/modules/mod_proxy_http.so
Redhat Linux and Trustix Secure Linux both have these by default. I obviously can’t speak for all the other Linux distributions out there. If you don’t have these, you don’t want to continue. You will probably want to either find an rpm that has these or go and download the source and compile Apache with them.
Now, here comes the fun stuff. You will need to compile a new module – mod_proxy_html. You can download the module from: http://apache.webthing.com/mod_proxy_html/
You may want to follow this as a guide: http://www.apacheweek.com/features/reverseproxies
There are a few dependencies you will need to compile this module. For instance, you will definitely need a compiler and some libraries. Here’s a small list that I have installed on my box. You may need more.
gcc
httpd-devel-2.0.52-3.1
libxml2-2.6.16-3.i386.rpm
libxml2-devel-2.6.16-3.i386.rpm
zlib-devel-1.2.1.2-1.i386.rpm
To compile the module, run:
apxs -c -I/usr/include/libxml2 -i mod_proxy_html.c
After doing this, you should find the module located where your apache modules are stored like:
ls -l /usr/lib/httpd/modules/mod_proxy_html.so
-rwxr-xr-x 1 root root 59627 Apr 8 18:02 /usr/lib/httpd/modules/mod_proxy_html.so
Congratulations! You now have the module installed. You now have to configure it.
In my case, the apache configuration file is located in /etc/httpd/conf/httpd.conf
Here, I add where the modules are:
———————————————————————————————–
LoadFile /usr/lib/libxml2.so.2
LoadModule proxy_html_module modules/mod_proxy_html.so
———————————————————————————————–
Then, later in the file:
———————————————————————————————–
ProxyHTMLLogVerbose On
LogLevel Debug
ProxyRequests off
ProxyPass /amserver http://sapphire.atac.ebay.sun.com/amserver
ProxyPassReverse /amserver http://sapphire.atac.ebay.sun.com/amserver
ProxyPass /amconsole http://sapphire.atac.ebay.sun.com/amserver
ProxyPassReverse /amconsole http://sapphire.atac.ebay.sun.com/amserver
SetOutputFilter proxy-html
ProxyHTMLURLMap http://sapphire.atac.ebay.sun.com http://megatron.atac.ebay.sun.com i
———————————————————————————————–
What I’m doing here is rewrite the url for any requests that go into amconsole or amserver to go and grab the data from the sapphire machine. Any urls that are within the pages that point to sapphire will be rewritten as megatron.
All you have to do now is restart apache.
/usr/sbin/apachectl restart
That’s it! You now should be able to access http://megatron.atac.ebay.sun.com/amserver or
http://megatron.atac.ebay.sun.com/amconsole and get the same login screen and be able to navigate the entire Identity Server or whatever else you put behind the proxy.
For issues, be sure to look at your Apache access and error logs and you can visit the following links:
http://apache.webthing.com/mod_proxy_html/
http://www.apacheweek.com/features/reverseproxies