topic Re: External hostname and multitenancy in Administration and Deployment

External hostname and multitenancy

m0rbid — Sat, 09 Oct 2021 00:39:43 GMT

So, i have set up a multitenancy sas viya environment, onboarded 4 tenants and everything is green. I can login in to the individual tenants with local hostnames and all services are onbared and my workers are connected to the controller.

However, the problem starts when exposing this to the internet trough a load balancer.

I have set up dns, followed this guide for setting external hostname How to Configure a Reverse Proxy in Front of SAS V... - SAS Support Communities

I find the request coming in in the ssl request log with correct header like so

10.245.96.228 - - [30/Sep/2021:21:15:10 +0200] develop0.****.****.****.no "GET /SASLogon/login HTTP/1.1" 200 2957 "-" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0"
10.245.96.228 - - [30/Sep/2021:21:15:10 +0200] develop0.****.****.****.no "GET /SASLogon/resources/images/transparent.png HTTP/1.1" 304 - https://develop0.****.****.****.no/SASLogon/login "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0"
10.245.96.228 - - [30/Sep/2021:21:15:10 +0200] develop0.****.****.****.no "GET /SASLogon/resources/images/saslogo.svg HTTP/1.1" 304 - https://develop0.****.****.****.no/SASLogon/login "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0"
10.245.96.229 - - [30/Sep/2021:21:15:11 +0200] - "GET /" 302 229 "-" "-"

(i have "blurred" the actual hostname, but they are the external one

service url for viya and http are correct.

But all external tenant urls leads to the provider tenant and not the individual tenant the request stated above.

Any thoughts?

Re: External hostname and multitenancy

Sajid01 — Sat, 09 Oct 2021 02:50:18 GMT

While a proper answer would depend on your configuration details, here are some factors to be considered.
1.In a multi tenant deployment not all services are tenant specific. Services such as Apache Web Server are a part of shared services. What the individual tenants are sure to receive is a specific instance of CAS .

2.If you have configured your SAS Viya behind a reverse proxy and/or load balancer, then the external browser will only point to the reverse proxy. Any service behind the Viya Apache server will not be aware of the reverse proxy and vice versa. Thus any internal Viya service will only point to the Apache Service which may be operating from the provider tenant.
Perhaps a ticket to SAS Tech Support may be provide you with the an answer appropriate and relevant to your environment.

Re: External hostname and multitenancy

m0rbid — Sat, 09 Oct 2021 12:22:52 GMT

I'm not sure how to configure viya to live behind a reverse proxy. If i point my browser to tenant1.internal.hostname i can login with the tenant username and pass. If i point my browser to tenant1.external.hostname i get to the login page but cannot login to tenant1, only the provider tenant even tho my tenantid gets through to apache according to the request log above

Re: External hostname and multitenancy

Sajid01 — Sat, 09 Oct 2021 12:45:13 GMT

I think the best way is to approach SAS Tech Support.

Re: External hostname and multitenancy

gwootton — Mon, 11 Oct 2021 12:59:40 GMT

In a multi-tenancy configuration, SAS gets the tenant ID from the request. Given we can see the tenant ID in the request to apache I suspect Viya is not aware of the external hostname so is considering the entire hostname the base url instead of identifying the subdomain for the tenant separately.

Did you set the config/viya/sas.httpproxy.external.hostname and sas.httpproxy.external.port values using sas-bootstrap-config?

Re: External hostname and multitenancy

m0rbid — Mon, 11 Oct 2021 13:02:03 GMT

thanks for the reply, yes i did, and i have confirmed it with a config read

Re: External hostname and multitenancy

gwootton — Mon, 11 Oct 2021 13:23:35 GMT

Was this provided in vars.yaml when onboarding the tenant?

https://go.documentation.sas.com/doc/en/calcdc/3.5/caltenants/n1dulp7rsnyxhzn1a4xx2a1cpzco.htm#n0t1f81it6fewin13fd293ag57rw

You may also need to include the load balancer in the zones.internal.hostnames value:

https://go.documentation.sas.com/doc/en/sasadmincdc/v_015/calconfigref/n08086sasconfiguration0admin.htm

Re: External hostname and multitenancy

JessLund — Tue, 11 Jan 2022 08:39:39 GMT

Hi did you manage to find a solution to this problem?