Using Sticky route for session affinity in nginx proxing requests to Jira, does not work.

Question

Background : We have nginx setup to loadbalance requests to Jira and we had a successful implementation using Sticky learn. However considering the sticky route method as mentioned in Atlassian documentation we were unable to achieve success. Problem : When Sticky route is being used we are being redirected to the login page every time we try to login. Details : Nginx conf : map $cookie_jsessionid $route_cookie { ~.+\.(?P\w+)$ $route;} map $request_uri $route_uri { ~jsessionid=.+\.(?P\w+)$ $route;} upstream jiracluster { zone jiracluster 64k; server hostname1:port route=node1; server hostname2:port route=node2; #sticky learn create=$upstream_cookie_JSESSIONID # lookup=$cookie_JSESSIONID # zone=client_sessions1:1m # timeout=1h; sticky route $route_cookie $route_uri; Please note: the commented Sticky learn method works perfectly! We are trying to study the behavior of Sticky route. Does atlassian recommend only Sticky Route ? or is Sticky learn also fine to use as it supports session affinity. Please let me know if any further information will be helpful to better understanding the issue.

Ivan Tapia · Answer

@Dilip Kumar Mavireddi , I have try the suggested configuration from Atlassian described in https://confluence.atlassian.com/jirakb/how-to-set-up-nginx-plus-as-the-load-balancer-for-a-jira-data-center-cluster-640516559.html having the same result than you, after read multiple times NGiNX documentation https://docs.nginx.com/nginx/deployment-guides/load-balance-third-party/apache-tomcat/ I found that I was missing add jvmRoute as part of the Engine section along with the appropriate connector configuration on server.xml file. I hope this also work for you if you still interested in try route method. --- Next sections has been taken from NGiNX documentation as an example ---- 2. Add the following lines to the configuration files for your backend Tomcat servers to append an identifier based on the jvmRoute attribute (here, set to either a or b) to the end of the JSESSIONID cookie value: # On host 10.100.100.11 # On host 10.100.100.12

Dilip Kumar Mavireddi · Answer

Hi Andrew, Sorry for the delay. This is what is working for us at the moment. When we tried to replace sticky learn with sticky route.. we get simply re-directed back to login page again. So to switch between Sticky route and Sticky learn we simply replace it with the contents between the related lines. Please advise if I am missing something on the Sticky Route as shown below that is kicking me out. =========STICKY ROUTE================ map $cookie_jsessionid $route_cookie { ~.+\.(?P\w+)$ $route;} map $request_uri $route_uri { ~jsessionid=.+\.(?P\w+)$ $route;} upstream jiracluster { zone jiracluster 64k; server hostname1:port route=node1; server hostname2:port route=node2; #sticky learn create=$upstream_cookie_JSESSIONID # lookup=$cookie_JSESSIONID # zone=client_sessions1:1m # timeout=1h; sticky route $route_cookie $route_uri; ===========STICKY ROUTE================ Full Config : --------------------------------------------------------------------- user nginx; worker_processes auto; error_log /../error.log notice; pid /../nginx.pid; events { worker_connections 1024; } ##### http { include /../mime.types; default_type application/octet-stream; proxy_read_timeout 3600s; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; log_format timings '"$time_local" client=$remote_addr ' 'method=$request_method request="$request" ' 'request_length=$request_length ' 'status=$status bytes_sent=$bytes_sent ' 'body_bytes_sent=$body_bytes_sent ' 'referer=$http_referer ' 'user_agent="$http_user_agent" ' 'upstream_addr=$upstream_addr ' 'upstream_status=$upstream_status ' 'request_time=$request_time ' 'upstream_response_time=$upstream_response_time ' 'upstream_connect_time=$upstream_connect_time ' 'upstream_header_time=$upstream_header_time' 'pipelined=$pipe'; access_log /../access.log timings; sendfile on; tcp_nopush on; #keepalive_timeout 65; gzip on; include /../*.conf; =============STICKY LEARN================ upstream jirac { zone jirac 64k; server node1:p22 route=jira-01; server node2:p22 route=jira-02; sticky learn create=$upstream_cookie_JSESSIONID lookup=$cookie_JSESSIONID zone=client_sessions:1m timeout=1h; } ==========STICKY LEARN==================== server { listen p33 ssl; root /usr/share/nginx/html; server_name jira...com; client_max_body_size 250M; ssl on; ssl_certificate /...crt; ssl_certificate_key /..key; ssl_ciphers 'ECD......; ssl_prefer_server_ciphers on; location / { health_check mandatory ; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_pass https://jirac; } } } -----------------------------------------------------------------------

Andy Heinzer · Answer

In regards to using Jira data center, you need to use a load balancer that supports sticky sessions.  If you don't then the browser requests to that load balancer could be randomly routed to different nodes for each request, which in turn could cause all sorts of unexpected behavior with Jira.

To avoid this potentially negative experience for the end user, the Data center documentation does explicitly state that your load balancer needs to support sticky sessions.  That way when a user logs in, they are typically bound to the node they are first routed to until either they log out, timeout their login, or that node actually goes down.

I am interested to see your complete nginx config.  It looks like you might have only posted a portion of this.   I would expect your config to look more like the example posted in  How to set up NGINX Plus as the load balancer for a JIRA Data Center cluster