iRules

Load balancing MS-Active Directory and Kerberos

Jeff Browning — Fri, 12 Sep 2008 19:44:03 GMT

You know what? You never know what you might find in the DevCentral Forums. Some pretty cool stuff happens in the Solutions Forums - a place to focus on doing interesting things with F5 gear from an application perspective (i.e. Microsoft app, Oracle App, etc.).

Here's an interesting one I found recently: load balancing resources protected by MS-AD-Kerberos. Not always two technologies you expect to see together... However, thanks to user "ravi.rajan", there's the solution. The trick is that you don't add the BIG-IP to the AD (you can't). Instead, you create a Microsoft Service Principal Name (SPN) for "the HTTP services mapping to a particular domain user ids." For more, go here.

For details about SPNs if you're not familiar with them, you can learn more from Microsoft TechNet (a team I worked on many, many years ago, BTW) or at MSDN if that's more your speed.

According to "ravi.rajan", it's not just the IIS folks that get to play:

We have kerberos single sign on working for IIS, weblogic, SAP enterprise portal without any issues.

After talking about this with Colin, he made a good point: once you have this backend wired (and simply doing LB to distinct virtuals/URLs for the various services for IIS, webogic, etc.), why not bring the forms out to the front end and consolidate the process. Theoretically, you could use LTM's form-based auth on the front end. LTM can serve up a standard form and then pass auth through the various services on the backend. Here's a nice little sample (Client Auth Using HTML Forms) in the CodeShare to get you started.

Technorati Tags: active directory, microsoft, kerberos, f5, big-ip, devcentral, weblogic, sap enterprise portal, jeff browning

Share this post :

Support, Social Technology, and Trust

Jeff Browning — Thu, 11 Sep 2008 23:35:19 GMT

As Don mentioned earlier this week, we took the plunge and entered Forrester's Groundswell contest. To me, I believe this is the ultimate testament to what you, the community, are doing on DevCentral everyday (check out this page - it's pretty cool). Back when we started this thing, it was simply to help folks learn how to tap into F5's groundbreaking iControl API. After asking users, we learned that folks needed some assistance getting started. Surprise, surprise - understanding terms like WSDL, SOAP, and related things were a bit new to F5's traditional users! With backgrounds in software, where forums have been around a while, we thought this would be a good tool to enable us to assist and support users as they played with this cool technology.

Honestly? Selling management on un-moderated forums was not a slam-dunk. There were (reasonably) concerns that someone might say something nasty. That said, we made a philosophical choice... to trust our users. We wanted them be as involved and invested in this community as F5 is. So - trust matters. Along the way, something interesting happened: the community even started to protect it's own turf!

The same thing happened when we weighed the pros and cons of moving ALL of our technical documentation to a wiki. (what? let ANYONE edit it? seriously...?). Yes - like the forums, there was plenty of debate. Once again, the notions of trust and enablement - all with the desire of supporting users through more free-flowing, 24x7, worldwide contributions - won out. The result? Well - just one example is the over 100 iRule samples posted in the Codeshare today - the vast majority contributed by real users working on solving real challenges everyday.

When looking at this whole contest thing, I'm sure some of the other categories could have applied. But, the "supporting" category is the most obvious choice. However, it's not exactly why most might think... When I step back and look at what everyone is doing in the community, what strikes me most is how - in significant part because of the social media technologies we've embraced - users are supporting each other. Without a free-flowing community, ideas and solutions created in Auckland may have never been seen by users in Munich. Or, a cool iRule trick from someone in London may have never reached someone in Tokyo.

Further, I'll be the first to admit this: there are some protocols or technologies that we'll NEVER know as well as some of you. You're work, day in and day out, with a specific protocol or application server - and specifically it's subtle quirks that come from working with it daily - help you bring a completely different dimension to other users wrestling with a similar problem. Sure - we can research and understand something academically. However, members' tribal, hands-on knowledge makes all of the difference when providing real, useful solutions.

Candidly, there are times when I ask myself this: how do vendors that DON'T enable this free-flow of ideas survive? With the growth of cloud, SOA, virtualization, etc., the technology hairball and the knowledge required cannot be owned by one all-knowing company, right?

I go back to the beginning; it's this notion of trust, free-flowing ideas and dialog, that makes this community all about support. Not just F5 supporting our technology (as it should). But, helping end users help each other to just get more... value... ideas... inspiration... support. All from others working to solve similar problems.

BTW - some serious props go out to F5 leadership for trusting and embracing the community as partners and co-collaborators on this journey. If not for that trust, I don't think we would see the dynamic interaction that happens each day on DevCentral.

So, if you've read this far, thank you for your participation in and involvement with DevCentral. If you feel like it, maybe make a visit to our entry page and make a comment and vote for DevCentral. Also - we've set up a Forum here on DevCentral as well for you to post your comments, thoughts, likes, etc. about DevCentral.

Technorati Tags: forrester, groundswell, devcentral, f5, icontrol, wsdl, social technology, community, protocol, cloud computing, SOA, virtualization, Jeff Browning

81 free iRule samples (and growing)

Jeff Browning — Tue, 01 Apr 2008 19:59:55 GMT

Interested in iRules but reluctant to get started? Concerned that your scripting skills are a little dusty... that maybe it might be more work than you're willing to undertake? Never fear. Your community is here.

Don't forget that - thanks to the experts at-large in the community - there are over 80 iRule samples available to help jumpstart your project.

I would be willing to bet significant sums that there is at least ONE iRule sample that may address a challenge you've had on your "fix it" list for some time. And, while the sample may not fit perfectly, it will probably get you... 50%... 60%... maybe even 80-90% of the way to a very workable solution.

Take a peek - the iRule Codeshare is growing quickly. And, be sure to share your favorites as well. The more everyone shares, the more everyone benefits.

Technorati Tags: f5, irules, code samples, scripts, community, jeff browning

Job-Hacking

Jeff Browning — Mon, 27 Aug 2007 18:01:07 GMT

I recently had a fascinating conversation with Rob Whiteley of Forrester. We were chatting about how life is changing for the network professional. How more and more automation is driving the frontline network ops folks to look for new areas in which to build skills, offer innovative solutions, etc. I was surprised by the lengths at which companies are going to automate otherwise "human" tasks today to reduce cost and risk and increase efficiency.

Since then, I haven't been able to get a term (created by my friend Dave) out of my head: "job-hacking".

(courtesy of www.hardwickrecruiting.com)

I can't help but believe - simply from the real stories I've heard from the community - that rolling up sleeves and learning how iRules and iControl work is the fast track to getting closer to the application teams. Maybe scoring some points with the folks in the security group. Using these "job-hacking" tools, maybe you can write an iRule that saves a developer a few weeks of work. Or, maybe YOU can architect how the automation of the data center takes shape with an iControl app that orchestrates application or patch updates. Last time I checked, zero downtime during patches for the business units and no more 2am Saturday maintenance windows (for you?!) is a good thing.

Each day is a choice. Each day is an opportunity to move forward, to add a new tool to you toolbox, that puts you in control of your destiny. Trust me - I've spoken with countless users out there that say, "iRules are cool but... I'm swamped. I can't afford to make time to learn how to use them with everything else I have to do."

To anyone that thinks that... I would argue you can't afford to delay embracing tools and technology that will help you evolve before trends in the industry catch up with you. Your most valued job-hacking tools could be the iRules... or iControl apps... you keep pushing to the bottom of your task list.

Thoughts? Chime in with your opinions...

Technorati Tags: irules, icontrol, security, automation

The Forgotten Network Tier?

Jeff Browning — Thu, 09 Aug 2007 19:58:48 GMT

An interesting article has been published on www.devx.com by Ty Anderson, a consultant at Cogent Company. Check it out - he does a great job of pointing out how application developers can take advantage of the network (and specifically - iRules and iControl) when writing apps. Here's a snippet...

"The reality is developers can build better, more effective applications by utilizing Application Delivery Controller (ADC). These devices are deployed in your network and track all network traffic. This includes in-coming, out-going, and internal traffic. Once installed and configured, these devices know everything that occurs in your network. This means they also know everything about the information sent and received by your applications."

For more, go here: http://www.devx.com/vstudioextensibility/Article/35158

Technorati Tags: icontrol, irule, visual studio, ADC

Must Read iRule Doc

Jeff Browning — Tue, 17 Jul 2007 21:56:25 GMT

I just ran across one of the most useful docs I've seen posted by the team on DevCentral. If you're new to iRules, possibly looking for ways to expand your knowledge, or just bored and looking for something cool to do, this document in the iRule wiki is a must-read. It breaks down some of the most common ways iRules are used and it provides some really useful building blocks for when you want to combine elements for that "double black diamond"-like challenge you're facing.

For example: how about an iRule that simply illustrates logging (a useful debugging technique in itself)? Or, trying to limit pesky client attempts to throttle your servers with excessive connections? Maybe you're interested in using Data Groups (class files) that allow you to abstract variables in a better, more organized, and efficient manner.

Check this out.

(btw - a special nod to Colin for this - great work!)

Technorati Tags: irule, connection limiting, event logging, data groups, class files

Cache in hand

Jeff Browning — Fri, 08 Jun 2007 23:56:02 GMT

If you haven't visited the iRule CodeShare lately, you should

There are some great new community contributions from "wschultz" and "hoolio".

On the caching front, you need to see the cool ideas under "UsingIRulesToManipulateCache" including an iRule with a couple timers, one for Mac/Safari clients, as well as another for sites using MoveableType and TypeKey. Nice work!

"Hoolio", a long-time contributor, added some cool stuff related to setting a URI to lower case.

Special thanks to both "wschultz" and "hoolio" - great stuff, from members, that makes DevCentral an awesome community.

(Psssst... remember: sharing is easy. The more everyone shares, the more everyone benefits. So, if you've been sitting on a cool or even simple by highly useful iRule, post it to CodeShare.)

Technorati Tags: iRules, cache, uri, devcentral

Take a Couple Days Off

Jeff Browning — Wed, 11 Apr 2007 19:52:10 GMT

Seth Godin really hit home today with this post. Chances are, you'll hear from one of your web marketing managers soon asking you to fix your server error pages. Lucky for you, there are some great iRules contributed by the DevCentral community that can sove this problem in a matter of minutes (so that YOU can take a day off too!).

For instance, the most obvious is the "File Not Found Handler". Or, you could "Insert Content Into a Server Response". If problems are ocurring because of someone requesting an HTTP:// URL instead of an HTTPS:// URL, you could use the "HTTP to HTTPS redirect" (and avoid the error page altogether).

A cool solution could also take advantage of Harlan Richard's "Return_Status_404" iRule which enables one iRule to flexibly handle all 404s and other errors across multiple web properties.

Or, to get really elegant, you could start with Kevin Stewart's iRule - "OCSP Authentication error redirect" - and build an iRule that enables you to customize the error response based upon the user request and even provide suggestions on what to do next... Adding "breadcrumbs" like this not only help the user get where they're trying to go. It can even make helpdesk troubleshooting easier when the user calls for help.

Nothing like the flexibility to solve these problems quickly - and easily - thanks to community driven innovation and ideas.

Oh yeah - one nice benefit is that by running this as an iRule, you only have to do it in one place... Since you won't have to update every server in the data center with the same error handling code, I think you probable deserve another day off...

Assembly

Jeff Browning — Tue, 10 Apr 2007 23:12:00 GMT

If you spend much time with kids, you learn that assembling things - trains, toys, etc. - is part of the program. You also learn that kids themselves really like assembling things. Train cars switching places in-line behind the locomotive. Tracks sections in various configurations. Of course all of this is done to get the desired result (which can change daily or even hourly!)

Some of the most interesting kids don't stop with the order of the cars or train track. Some actually take the cars apart, reassemble them in new ways (sometimes missing certain parts), and arrive at completely new and cool variants of the original.

Fast forward a few years and it's easy to see why "pimping a ride" via extensive mods and customization is such a major trend among adults (big kids). Assembling new variations on a theme, for either expression or purpose is a powerful and exciting process with amazing results.

The ability to assemble pieces flexibly is to me what feeds ingenuity and makes it possible to achieve great things. If locked into a fixed environment, it's hard to assemble and let the mind run to it's most creative (and dare I say "productive"?!) result. For example, have you ever seen a wizardized HTML editor or web development tool that can completely wizardize building a website that solves any unique need? It's not only impossible - you would likely chuckle at anyone suggesting it. Even simpler, I can't imagine how MS-Excel would work if it only had a wizard. In fact, other than charting, it's actually the un-wizard (and BTW - statiscally the Microsoft product featuring the highest customer satisfaction rating for years...)

Going back to kids (or cars... or bicyles... or music... or virtually anything engaging or innovative), the toys that stop getting used are the ones with the least flexibility to be used in new and interesting ways. Alternatively, toys (or cars... or bicyles... or music... or virtually anything engaging or innovative) that afford infinite possibilities to assemble new combinations are the most engaging and frankly, most interesting. (heck - some even keep parents engaged for hours...)

Everytime I launch the iRule Editor, I kind of smile (thanks Joe!). To have the ability to quickly build highly useful iRules yet be able to tweak them and tune them to infinite degrees, it's the perfect technology and tool for solving real problems. I can use Codeshare to find building blocks that both accelerate the process and help me learn simultaneously.

My creativity is my only limitation. And, that's pretty cool.

I think that's an important part of why we are seeing so many cool things going on amongst the DevCentral community. You (the members) are finding new ways daily to assemble new combinations or collections of technology to solve things that in some cases have not been able to be solved before.

Community Driven Innovation

Jeff Browning — Wed, 28 Feb 2007 10:01:12 GMT

I've been throwing this phrase around a lot lately. I like it. I think it embodies the spirit of what's happening on DevCentral. Members are sharing ideas in the forums, posting samples and sample tweaks to codeshare, and more. The net result? Innovative solutions that share the unique skills and experience of a wide range of individuals in the community. I dig it. My favorite part about being involved with DevCentral and working with this team (btw - I'm in awe at the lengths Joe, Colin, and Don have gone to in order to make DC4 possible) is the fact that people in this community are really changing the way things work for the better. And, I believe this community is only getting started.

Also - while we may host the site, it's really you, the member's, community. So, get involved. Share ideas. And, let us know what we can do to help you.

BTW - stay tuned... there's more to come in the very near future. So, visit frequently in the coming days.