Documenting my solution for posterity.
Please excuse the format of IPs, they are not real.
Our HAProxy setup is this
- frontend
- 389ds-frontend (7.7.7.7 / 7:7:7::7)
- haproxy nodes
- 389ds-hap-1 (1.2.3.4 / 1:2:3::4)
- 389ds-hap-2 (2.3.4.5 / 2:3:4::5)
The backend servers
- 389ds-node1
- 389ds-node2
Adding only the 389ds-hap-1 and 389ds-hap-2 IPs to the
nsslapd-haproxy-trusted-ip attribute was not enough.
I also had to add the LB frontend IP along with the HAProxy servers IPs.
This is what works for us:
[root@389ds-node1 ~]# dsconf my-389ds-instance config get
nsslapd-haproxy-trusted-ip
nsslapd-haproxy-trusted-ip: 7.7.7.7
nsslapd-haproxy-trusted-ip: 7:7:7::7
nsslapd-haproxy-trusted-ip: 1.2.3.4
nsslapd-haproxy-trusted-ip: 2.3.4.5
nsslapd-haproxy-trusted-ip: 1:2:3::4
nsslapd-haproxy-trusted-ip: 2:3:4::5
Best regards,
Mitja
On 1. 8. 25 14:26, Mitja Mihelič via 389-users wrote:
I tried again on version 389-ds-base-3.1.2-3.el9, but I ran into the
same error
Disconnect - Protocol error - Unknown Proxy - P4
An I missing an obvious setting I should be configuring or might this
be a long standing unresolved bug?
Best regards,
Mitja
On 28. 7. 25 09:01, Mitja Mihelič via 389-users wrote:
Hi!
I am trying to set up HAProxy with two 389DS nodes in multi-supplier
setup. I have followed the instructions on
https://www.port389.org/docs/389ds/howto/howto-test-haproxy-ldaps.html and
https://docs.redhat.com/en/documentation/red_hat_directory_server/12/html/configuration_and_schema_reference/assembly_core-server-configuration-attributes_config-schema-reference-title#nsslapd-haproxy-trusted-ip_assembly_cn-config.
I am using 389-ds-base-2.6.1-10.el9_6 on AlmaLinux 9.6.
Please excuse the IPs and hostnames, they have been changed.
I have set "nsslapd-haproxy-trusted-ip" to the following
[root@389ds-node1 ~]# dsconf my-389ds-instance config add
nsslapd-haproxy-trusted-ip=1.2.3.4
nsslapd-haproxy-trusted-ip=1:2:3::4
nsslapd-haproxy-trusted-ip=2.3.4.5 nsslapd-haproxy-trusted-ip=2:3:4::5
[root@389ds-node1 ~]# dsconf my-389ds-instance config get
nsslapd-haproxy-trusted-ip
nsslapd-haproxy-trusted-ip: 1.2.3.4
nsslapd-haproxy-trusted-ip: 2.3.4.5
nsslapd-haproxy-trusted-ip: 1:2:3::4
nsslapd-haproxy-trusted-ip: 2:3:4::5
When trying to connect through HAProxy, the client reports the
following error
[root@389ds-node1 ~]# ldapwhoami -vvv -H
ldaps://ldap-test.example.com -D
"uid=usern...@example.com,dc=example,dc=com" -x -W
ldap_initialize( ldaps://ldap-test.example.com:636/??base )
ldap_result: Can't contact LDAP server (-1)
Access log on 389ds-node1 reports this
[25/Jul/2025:08:32:41.207106191 +0200] conn=216 fd=74 slot=74 SSL
connection from 1.2.3.4 to 11.22.33.44
[25/Jul/2025:08:32:41.207237108 +0200] conn=216 op=-1 fd=74
Disconnect - Protocol error - Unknown Proxy - P4
It looks like the values in "nsslapd-haproxy-trusted-ip" are being
ignored.
How can I get this to work?
Best regards,
Mitja
--
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-le...@lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
