Proxy Protocol Support at LDAP Connection Handler

[muralicbe1983]

Currently we have done the setup of OpenDJ version 5.0.1 with 2 directory servers(user store) and 1 replication server. Now need to setup the Load Balancer(LB) before the 2 directory servers. In our environment we are using NGNIX as LB & our requirement is to have the Client IP at the OpenDJ server end to validate the incoming clients.

We have the same setup in our Forgerock Directory Services 7.3.6 which support the proxy protocol LDAP connection handler & LB enabled with NGNIX to get the client IPs.

As we migrate from Forgerock to OpenDJ, in order to have the same LB setup need to know whether this proxy protocol is supported in LDAP connection handler. If not, any plan to accomodate this feature in next release?

[vharseko]

LDAP Proxy Backend

[muralicbe1983]

@vharseko - Thanks for the reply. In our environment the standard LB is NGNIX, we can't move away from this. Is this Proxy Protocol enhancement feature can be accommodated in upcoming OpenDJ release?

[vharseko]

Attach an example of your nginx configuration for LDAP balancing with IP transfer

[muralicbe1983]

@vharseko below is one sample which we did for Forgerock

NGNIX configuration
################
upstream ds1_1636 {
server us1.hk.com:1636 max_fails=3 fail_timeout=30s;
server us2.hk.com:1636 max_fails=3 fail_timeout=30s;
}
server {
listen 1636;
proxy_pass ds1_1636;
proxy_protocol v2;
proxy_timeout 10m;
proxy_connect_timeout 1m;
}

At Forgerock directory services - new LDAP connection Handler added for NGNIX

/dsconfig set-connection-handler-prop
--handler-name LDAPS_1636_proxycontrol
--add proxy-protocol-allowed-client:
--set proxy-protocol-enabled:true
--hostname localhost
--port 5444
--bindDn
--bindPassword
--no-prompt

[vharseko]

Planned in 5.2+ Vote to raise the priority 🖐️