IBM Verify

 View Only

 Reverse Proxy Forwarding Traffic When Runtime is Down

Nilrandha Fernando's profile image
Nilrandha Fernando posted 10/28/24 01:44 AM

Hi Team,

We have currently designed an architecture where there's reverse proxy 1 connected to primary master node (runtime) and reverse proxy 2 connected to secondary master node (runtime). The two runtimes are clustered and replicated. We tried to test out the high availability by taking down the primary master node and accessing the reverse proxy 1, it loaded without any issues and only throws the "Authentication mechanism is not available" error after we entered user credentials and tried to authenticate. Shouldn't this ideally take down the reverse proxy page as well so that the load balancer can identify the negative health status on the "reverse proxy 1 -> primary master node" path and route all traffic through "reverse proxy 2 -> secondary master node"? Your valuable inputs are highly appreciated.

Thanks in advance.

JACK YARBOROUGH's profile image
JACK YARBOROUGH posted 10/28/24 03:34 PM

The Policy Server (Runtime Component) does not automatically fail over.

You have to explicitly promote the secondary master (in your scenario) in the cluster to be primary master for High Availability to be achieved:

https://www.ibm.com/docs/en/sva/10.0.8?topic=support-high-availability-policy-server

If you promote the secondary appliance to primary master you should see the authentication mechanism become available again.

The Reverse Proxy instance itself is able to run without the Policy Server being up and running, it has a local copy of the security policy and authenticates directly to the configured LDAP server. The issue is that if you have a local runtime component and use a local user registry as well that user registry is then tied to the runtime component. It's replicated through a cluster that replicates the runtime component but the other nodes have a read only copy, so when you authenticate it requires that you be able to contact those nodes.

Again, promoting the secondary master to cluster primary master would resolve this condition.

Related Content