MAS9 - using AWS Certificates and OAuth with Microsoft EntraID

Question

Hi all,
we have a self managed Openshift Cluster (no ROSA) running on AWS EC2 Instances.
For authentication when using the Openshift Console we use Microsoft EntraID.
My current requirement is to use AWS TLS Certificates for securing the connection.
The idea was to put an Application Loadbalancer in front of the Network Loadbalancer created by Openshift.
This Application Loadbalancer should use the AWS Certificates anr terminate the client facing SSL connection.
So, I have created a ALB pointing to the NLB forwarding the traffic to the OpenShift Router (HA-Proxy).
Than I hve changed the Route53 Entry for *.apps.mydomain.com to point to the ALB.

When I call the console URL the first requests are responsed properly, but the redirect to oauth-openshift.apps.madomain.com is answered with 503 from the OpenShift Router (HA-Proxy).
The configuration of the NLB and the OpenShift Routes are unchanged.
Any ideas why it doesn't work?

Answer

Hello,
the 503 on oauth-openshift is most likely because the ALB is no longer passing the SNI/Host header correctly to the OpenShift router. If TLS termination is still happening on the router, then the ALB needs to be configured in passthrough (TCP), otherwise the router won’t recognize the hostname and returns 503.
On the other hand, if you terminate TLS at the ALB, then the certificates on the OpenShift side need to match exactly the same domains, otherwise the OAuth authentication will fail.

Maximo