ISV Solutions

New SAP Solution Forum Unlocks F5 Integration Help

Jeff Browning — Thu, 16 Oct 2008 21:51:50 GMT

If you're running SAP software in your company, there's a good chance you've made a significant investment in making employees more productive. However, I've seen too many companies spend a ton of money on software and then forget that predictably secure application access and reasonable performance are instrumental in users getting value from the solution. It's like spending a bunch of cash on a speedy new PC and then... forgetting that you need power to run it. Or, a car with 600 horsepower and spellbinding looks... with no transmission. At some point, simply getting the app to the users can be a critical factor. (I say "simply" because to most, it is. But, there really are some tricks to doing it well.)

F5's work with SAP is significant because it addresses this need: to enable reliably secure, fast access to powerful applications based on SAP technology. While we invest significant time working closely with partners like SAP to build the most widely applicable solutions, there are bound to be countless other ways people do this. That's where the new Forum comes into play. Rarely are these types of solutions deployed identically. The new forum makes it easy for those of you in the community using SAP to connect with your peers and share best practices and ideas you've implemented.

Take a look, post your questions, answers, or even share what has worked well for you. And, check out what one of F5's experts - Nojan - has to say about it!

Technorati Tags: SAP, F5, Solution, DevCentral, Jeff Browning

Share this post :

Load balancing MS-Active Directory and Kerberos

Jeff Browning — Fri, 12 Sep 2008 19:44:03 GMT

You know what? You never know what you might find in the DevCentral Forums. Some pretty cool stuff happens in the Solutions Forums - a place to focus on doing interesting things with F5 gear from an application perspective (i.e. Microsoft app, Oracle App, etc.).

Here's an interesting one I found recently: load balancing resources protected by MS-AD-Kerberos. Not always two technologies you expect to see together... However, thanks to user "ravi.rajan", there's the solution. The trick is that you don't add the BIG-IP to the AD (you can't). Instead, you create a Microsoft Service Principal Name (SPN) for "the HTTP services mapping to a particular domain user ids." For more, go here.

For details about SPNs if you're not familiar with them, you can learn more from Microsoft TechNet (a team I worked on many, many years ago, BTW) or at MSDN if that's more your speed.

According to "ravi.rajan", it's not just the IIS folks that get to play:

We have kerberos single sign on working for IIS, weblogic, SAP enterprise portal without any issues.

After talking about this with Colin, he made a good point: once you have this backend wired (and simply doing LB to distinct virtuals/URLs for the various services for IIS, webogic, etc.), why not bring the forms out to the front end and consolidate the process. Theoretically, you could use LTM's form-based auth on the front end. LTM can serve up a standard form and then pass auth through the various services on the backend. Here's a nice little sample (Client Auth Using HTML Forms) in the CodeShare to get you started.

Technorati Tags: active directory, microsoft, kerberos, f5, big-ip, devcentral, weblogic, sap enterprise portal, jeff browning

Share this post :

What's the difference between a CLI and API, really?

Jeff Browning — Tue, 29 Apr 2008 21:58:15 GMT

Here at Interop, I had an interesting conversation on the show floor about integration. We were talking about how another company can remotely invoke change against infrastructure "via the CLI". When I asked why, the reasoning was that it's just how the infrastructure can be integrated - kind of because, "that's what's available". Sadly - that's pretty true in the networking world. To date, there is no API like iControl that offers a comprehensive API with broad tool support and functionality.

So - when writing integration via the CLI, what happens when the hardware versions change? Maybe an upgrade patch? Or, what if some smart engineers add some new features that require existing CLI commands to be deprecated?

How does the integration work after that? In many cases - it doesn't. And, that's the difference between a CLI and API. CLIs are hardwired scripts that work well in the short term but don't evolve as gracefully as true integration. Now - they have their place - no question about it. But, for smart, dynamic integration?

APIs provide a more dynamic, fluid integration and binding between software and infrastructure. To do this, the work on the infrastructure side is not trivial. However, it makes a HUGE difference for the end-user trying to write and maintain integration as the underlying infrastructure evolves.

API = nimble and flexible. CLI = brittle and difficult to manage. Big differences.

Technorati Tags: api, cli, iControl, f5, devcentral, Jeff Browning