# Multiple OOD servers behind a load balancer

**URL:** <https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510>\
**Category:** Get Help\
**Created:** [September 9, 2025, 12:20pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510 "2025-09-09T12:20:58Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![mnakao](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mnakao/32/1001_2.png) [@mnakao](https://discourse.openondemand.org/u/mnakao)\
**Post date:** [September 9, 2025, 12:20pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510/1 "2025-09-09T12:20:58Z")

</div>

Hello all,

I’m planning to place multiple OOD servers behind a load balancer (BIG-IP) and would like your advice on the configuration. My environment is following:

- OOD version: 4.0.6
- OS: Red Hat Enterprise Linux 8.10
- Load balancer FQDN (with sticky sessions): _[parent.net](http://parent.net)_
- OOD server FQDN: _[child1.net](http://child1.net)_ (single node for now)

Current configuration is as following:

- On _[child1.net](http://child1.net)_:
  - /etc/ood/config/ood\_portal.yml: `servername: ‘parent.net’`
  - /etc/httpd/conf.d/auth\_openidc.conf: `OIDCRedirectURI https://parent.net/oidc`

With this setup, when I access _[parent.net](http://parent.net)_ from a web browser, I can reach the OOD service running on _[child1.net](http://child1.net)_, and web browser’s address bar shows _[parent.net](http://parent.net)_, as expected. However, when I access _[child1.net](http://child1.net)_ directly from the browser, I can still reach the OOD service on _[child1.net](http://child1.net)_, but the browser’s address bar shows _[parent.net](http://parent.net)_.

This makes me think that once I add more OOD servers, accessing _[child1.net](http://child1.net)_ directly might sign me into a different backend node. For maintenance purposes, I would like requests to go directly to _[child1.net](http://child1.net)_ when accessing _[child1.net](http://child1.net)_, bypassing the load balancer, and I would like the browser to remain on _[child1.net](http://child1.net)_.

Could you advise how to achieve this configuration?

I also tried another approach based on this thread: [Putting an entire OOD setup behind a web proxy? - #7 by wdpypere](https://discourse.openondemand.org/t/putting-an-entire-ood-setup-behind-a-web-proxy/519/7). On _[child1.net](http://child1.net)_ I set in /etc/ood/config/ood\_portal.yml:

- servername: ‘[child1.net](http://child1.net)’
- proxy\_server: ‘[parent.net](http://parent.net)’
- logout\_redirect: /oidc?logout=https%3A%2F%[2Fparent.net](http://2Fparent.net)

And in /etc/httpd/conf.d/auth\_openidc.conf:

- OIDCRedirectURI [https://parent.net/oidc](https://parent.net/oidc)

The result was the same, and the browser still showed _[parent.net](http://parent.net)_ when accessing _[child1.net](http://child1.net)_  
directly.

If there are best practices or recommended settings in OOD, OpenIDC, or BIG-IP to support both normal access via _[parent.net](http://parent.net)_ and direct maintenance access to _[child1.net](http://child1.net)_, I would greatly appreciate your guidance.

Thank you very much for your help.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 9, 2025, 4:41pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510/2 "2025-09-09T16:41:30Z")

</div>

If I try the same thing on our host by using the internal DNS name instead of the external DNS name I get a `301 Moved Permanently` response from the internal host back to the external host. So that’s why it’s changing the DNS name (you can see the same in your network tab of your browser).

I think it’s coming from this section of the .conf file.

> <https://github.com/OSC/ondemand/blob/ee6188527f2689afdd0848242c215f7eb601132a/ood-portal-generator/templates/ood-portal.conf.erb#L90-L96>

You can try to set `use_rewrites: false` in `ood_portal.yml`, but I’m not entirely sure what the behavior will be given you have a proxy server. That seems to be the only thing you can toggle here.

---

<div class="post-metadata">

**Author:** ![mnakao](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mnakao/32/1001_2.png) [@mnakao](https://discourse.openondemand.org/u/mnakao)\
**Post date:** [September 10, 2025, 1:51pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510/3 "2025-09-10T13:51:42Z")

</div>

@jeff.ohrstrom

Thank you for your reply. I tried a few approaches, but none worked as expected.

I configured `ood_portal.yml` and `auth_openidc.conf` as follows:

```auto
servername: ‘child1.net’
proxy_server: ‘parent.net’
logout_redirect: /oidc?logout=https%3A%2F%2Fparent.net
use_rewrites: false

```

```auto
OIDCRedirectURI https://parent.net/oidc

```

With this setup, I can access the OOD dashboard at [https://parent.net/](https://parent.net/) , but accessing [https://child1.net](https://child1.net) returns _Internal Server Error_. The error log (`/var/log/httpd/child1.net_error_ssl.log`) shows:

```auto
oidc_authenticate_user: the URL hostname (parent.net) of the configured 
OIDCRedirectURI does not match the URL hostname of the URL being accessed 
(child1.net): the "state" and "session" cookies will not be shared between the two!

```

To address this, I updated `ood_portal.yml` with a `server_aliases` entry:

```auto
server_aliases:
  - ‘parent.net’

```

However, the same error occurs.

Next, I tried changing the `OIDCRedirectURI` to use `child1.net` in `auth_openidc.conf` :

```auto
OIDCRedirectURI https://child1.net/oidc

```

This resulted in the reverse error:

```auto
oidc_authenticate_user: the URL hostname (child1.net) of the configured 
OIDCRedirectURI does not match the URL hostname of the URL being accessed 
(parent.net): the "state" and "session" cookies will not be shared between the two!

```

Do I need to edit `/opt/ood/ood-portal-generator/templates/ood-portal.conf.erb` directly?

Bests,

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 10, 2025, 2:19pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510/4 "2025-09-10T14:19:46Z")

</div>

> [@mnakao](#):
>
> This makes me think that once I add more OOD servers, accessing _[child1.net](http://child1.net)_ directly might sign me into a different backend node. For maintenance purposes, I would like requests to go directly to _[child1.net](http://child1.net)_ when accessing _[child1.net](http://child1.net)_, bypassing the load balancer, and I would like the browser to remain on _[child1.net](http://child1.net)_.

I’m not 100% sure how to do this. Maybe @tdockendorf knows? @mnakao wants to access the servers behind the proxy directly (to test, verify and so on) while still being able to use the proxy itself.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [September 11, 2025, 12:32pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510/5 "2025-09-11T12:32:03Z")

</div>

I wish I knew, but I have very limited experience with using load balancers.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 11, 2025, 1:12pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510/6 "2025-09-11T13:12:27Z")

</div>

If the error is around the RedirectURI, maybe if `OIDCRedirectURI https://child1.net/oidc` were `OIDCRedirectURI /oidc` (the relative URI) would work? You can try to edit the .conf file manually.

Your timing may be good because we just now have a pull request to be able to configure this to the relative URI.

---

<div class="post-metadata">

**Author:** ![mnakao](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mnakao/32/1001_2.png) [@mnakao](https://discourse.openondemand.org/u/mnakao)\
**Post date:** [September 11, 2025, 1:23pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510/7 "2025-09-11T13:23:52Z")

</div>

Thank you very much!  
I was just trying it with a relative path, and it worked with the following settings:

I set `/etc/ood/config/ood_portal.yml` and `/etc/httpd/conf.d/auth_openidc.conf` as follows:

```auto
servername: 'parent.net'
server_aliases:
- 'child.net'

```

```auto
OIDCRedirectURI /oidc

```

As a result:

- Accessing **[parent.net](http://parent.net)** in a web browser now works via the load balancer.
- Accessing **[child.net](http://child.net)** in a web browser allows access to OOD directly, without going through the load balancer.

Best regards,

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 11, 2025, 1:28pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510/8 "2025-09-11T13:28:23Z")

</div>

OK, this will be patched in 4.1. There’s a pull request moving through now (below).

Instead of editing the .conf file which will cause issues when/if you try to do other updates, I’d instead advise that you edit the ruby files that generate the .conf file. In this way it’ll continue to work generating .conf files while still being able to provide the relative URL.

Here’s the change below that’s fairly simple:

> <https://github.com/OSC/ondemand/pull/4582/files>
>
> Introduce a variable to configure \`oidc\_redirect\_uri \`. If nothing is set, \`#{pr…otocol}#{servername}#{@oidc\_uri}\` will be used as \`oidc\_redirect\_uri\`, as it is currently.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [March 10, 2026, 1:29pm UTC](https://discourse.openondemand.org/t/multiple-ood-servers-behind-a-load-balancer/4510/9 "2026-03-10T13:29:10Z")

</div>

Closed on March 10, 2026, 1:29pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.