oVirt/RHEV 4 should be accessible from reverse proxy server
Marcus, can you confirm if you've tried the reverse proxy directions written by Martin here: http://lists.ovirt.org/pipermail/users/2016-July/040877.html
Please take a look at BZ1325746 and BZ1362196, those are targeted to 4.0.4 and they should solve all currently known issues around accessing engine with multiple different FQDNs and allows using dynamic ports (so engine can run inside container).
Restoring needinfo
ok, ovirt-engine-4.0.4.1-0.1.el7ev.noarch tested via apache httpd 2.x as reverse proxy. (Tested with self-signed certs on httpd host, playing with custom certificates can be an exercise for interested users. Also engine's certs verfication was not done. SPICE console opening was successful as well.) ~~~ == /etc/httpd/conf.d/proxy.conf <VirtualHost _default_:80> ServerAdmin root@localhost ServerName 10-34-61-191.exmaple.com:80 ProxyPreserveHost On ProxyPass / http://jb-rhevm40.exmaple.com/ retry=0 ProxyPassReverse / http://jb-rhevm40.exmaple.com/ ErrorLog logs/proxy_error_log TransferLog logs/proxy_access_log LogLevel warn </VirtualHost> == /etc/httpd/conf.d/ssl.conf Listen 10.34.61.191:443 https SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog SSLSessionCache shmcb:/run/httpd/sslcache(512000) SSLSessionCacheTimeout 300 SSLRandomSeed startup file:/dev/urandom 256 SSLRandomSeed connect builtin SSLCryptoDevice builtin <VirtualHost _default_:443> ServerName 10-34-61-191.exmaple.com:443 ErrorLog logs/ssl_error_log TransferLog logs/ssl_access_log LogLevel warn SSLEngine on SSLProtocol all -SSLv2 SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA SSLCertificateFile /etc/pki/tls/certs/localhost.crt SSLCertificateKeyFile /etc/pki/tls/private/localhost.key #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # let's do not check engine's certificate SSLProxyEngine On SSLProxyVerify None SSLProxyCheckPeerCN Off SSLProxyCheckPeerName Off # proxy to engine ProxyPreserveHost On ProxyPass / https://jb-rhevm40.exmaple.com/ retry=0 ProxyPassReverse / https://jb-rhevm40.exmaple.com/ BrowserMatch "MSIE [2-5]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 CustomLog logs/ssl_request_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" </VirtualHost> ~~~ ~~~ # cat /etc/ovirt-engine/engine.conf.d/99-custom-sso-setup.conf SSO_ALTERNATE_ENGINE_FQDNS="10-34-61-191.example.com jb-rhevm40.example.com" ~~~
I managed to get working kerberos SSO via reverse proxy, here are some details: - add reverse proxy fqdn into IPA ~~~ ipa host-add 10-34-61-191.example.com ipa service-add HTTP/10-34-61-191.example.com ipa-getkeytab -p HTTP/10-34-61-191.example.com -k /tmp/temporary.keytab ~~~ - get already existing http.keytab - merging keytabs (on IPA host) ~~~ ktutil : rkt /tmp/temporay.keytab : rtk http.keytab : list : wkt /tmp/new.keytab ~~~ - copy new keytab to engine host as http.keytab After opening User Portal via reverse proxy URL (10-34-61-191.example.com), I get automatically logged in and klist shows: ~~~ Credentials cache: FILE:/tmp/krb5cc_1000 Principal: vdcadmin.COM Issued Expires Principal Sep 8 16:18:43 2016 Sep 9 02:18:42 2016 krbtgt/BRQ-IPA.EXAMPLE.COM.COM Sep 8 16:30:21 2016 Sep 9 02:18:42 2016 HTTP/jb-rhevm40.example.com.COM Sep 8 16:57:44 2016 Sep 9 02:18:42 2016 HTTP/10-34-61-191.example.com.COM ~~~