Bug 1353093

Marcus, can you confirm if you've tried the reverse proxy directions written by Martin here:  http://lists.ovirt.org/pipermail/users/2016-July/040877.html

Please take a look at BZ1325746 and BZ1362196, those are targeted to 4.0.4 and they should solve all currently known issues around accessing engine with multiple different FQDNs and allows using dynamic ports (so engine can run inside container).

Restoring needinfo

ok, ovirt-engine-4.0.4.1-0.1.el7ev.noarch

tested via apache httpd 2.x as reverse proxy. (Tested with self-signed certs on httpd host, playing with custom certificates can be an exercise for interested users. Also engine's certs verfication was not done. SPICE console opening was successful as well.)

~~~

== /etc/httpd/conf.d/proxy.conf
<VirtualHost _default_:80>

  ServerAdmin root@localhost
  ServerName 10-34-61-191.exmaple.com:80

  ProxyPreserveHost On
  ProxyPass / http://jb-rhevm40.exmaple.com/ retry=0
  ProxyPassReverse / http://jb-rhevm40.exmaple.com/

  ErrorLog logs/proxy_error_log
  TransferLog logs/proxy_access_log
  LogLevel warn

</VirtualHost>


== /etc/httpd/conf.d/ssl.conf
Listen 10.34.61.191:443 https

SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog

SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin

SSLCryptoDevice builtin

<VirtualHost _default_:443>

  ServerName 10-34-61-191.exmaple.com:443

  ErrorLog logs/ssl_error_log
  TransferLog logs/ssl_access_log
  LogLevel warn

  SSLEngine on
  SSLProtocol all -SSLv2
  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA

  SSLCertificateFile /etc/pki/tls/certs/localhost.crt
  SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
  #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
  #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

  # let's do not check engine's certificate
  SSLProxyEngine On
  SSLProxyVerify None
  SSLProxyCheckPeerCN Off
  SSLProxyCheckPeerName Off

  # proxy to engine
  ProxyPreserveHost On
  ProxyPass / https://jb-rhevm40.exmaple.com/ retry=0
  ProxyPassReverse / https://jb-rhevm40.exmaple.com/

  BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

  CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost> 
~~~

~~~
# cat /etc/ovirt-engine/engine.conf.d/99-custom-sso-setup.conf
SSO_ALTERNATE_ENGINE_FQDNS="10-34-61-191.example.com jb-rhevm40.example.com"
~~~

I managed to get working kerberos SSO via reverse proxy, here are some details:

- add reverse proxy fqdn into IPA
~~~
ipa host-add 10-34-61-191.example.com
ipa service-add HTTP/10-34-61-191.example.com
ipa-getkeytab -p HTTP/10-34-61-191.example.com -k /tmp/temporary.keytab
~~~
- get already existing http.keytab
- merging keytabs (on IPA host)
~~~
ktutil
: rkt /tmp/temporay.keytab
: rtk http.keytab
: list
: wkt /tmp/new.keytab
~~~
- copy new keytab to engine host as http.keytab

After opening User Portal via reverse proxy URL (10-34-61-191.example.com), I get automatically logged in and klist shows:

~~~
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal: vdcadmin.COM

  Issued                Expires               Principal
Sep  8 16:18:43 2016  Sep  9 02:18:42 2016  krbtgt/BRQ-IPA.EXAMPLE.COM.COM
Sep  8 16:30:21 2016  Sep  9 02:18:42 2016  HTTP/jb-rhevm40.example.com.COM
Sep  8 16:57:44 2016  Sep  9 02:18:42 2016  HTTP/10-34-61-191.example.com.COM
~~~