LDAP Proxy Backend

[vharseko]

LDAP Proxy Backend

Overview

An LDAP Proxy Backend is a specialized intermediary service that acts as a gateway between LDAP clients (users, applications, devices) and one or more backend LDAP directory servers (e.g., Microsoft Active Directory, OpenLDAP, FreeIPA). It processes, filters, and routes LDAP requests without being the authoritative source of the directory data itself, enhancing security, performance, and manageability.

---

Key Features & Functions

1. Request Routing & Load Balancing

• Distributes incoming LDAP queries across multiple backend servers to prevent overload.
• Performs health checks to ensure traffic is only routed to available and healthy servers, providing high availability.

2. Security & Access Control

• Authentication Forwarding: Proxies bind requests to the correct backend server, hiding the internal directory structure.
• Network Filtering: Acts as a single enforcement point for security policies, filtering malicious queries and unauthorized operations.
• SSL/TLS Termination: Offloads encryption/decryption from backend servers, centralizing certificate management.

3. Protocol Translation & Normalization

• Translates between different LDAP versions (e.g., v2 to v3) for backward compatibility.
• Normalizes Distinguished Names (DNs) and attributes to present a unified view of disparate directories.

4. Caching

• Improves read performance and reduces backend load by storing frequent query results (e.g., authentication states, group memberships).

5. Abstraction & Federation (Virtual Directory)

• Presents a single, unified LDAP namespace to clients, even when data is distributed across different directory types (e.g., merging AD and OpenLDAP).

6. Centralized Logging & Auditing

• Provides a single point for monitoring and logging all LDAP traffic, which is crucial for security analysis and compliance.

---

Common Use Cases

• Securing Critical Directories: Deploying a proxy in a DMZ to broker LDAP communications from external apps to an internal Active Directory.
• High Availability: Providing a resilient endpoint for applications, allowing backend servers to be maintained without downtime.
• Directory Migration: Seamlessly redirecting traffic from an old directory to a new one during migration projects.
• Simplifying Application Config: Applications only need to be configured to connect to the proxy, not to every individual backend server.

---

Technical Summary

In architectural terms, the LDAP Proxy Backend functions as a facade. It implements the LDAP protocol to appear as a standard server to clients, while its core logic involves processing requests (bind, search, compare) and intelligently communicating with the authoritative directories behind it.

In summary: It is a strategic middleware component that adds a layer of intelligence, security, and resilience to directory services.

Vote to raise the priority 🖐️

[bilias]

Hi, is this planned for any next release?

[vharseko]

Hi @bilias, thanks for the interest.

It is planned, but there is no committed release date yet: most likely it will land within the next 2-3 major releases. It is still at the proposal stage.

To help us prioritise and scope it, could you describe your use case? For example:

• load balancing / failover across several backend directories,
• a gateway in a DMZ in front of Active Directory or another directory,
• pass-through authentication only (bind forwarded to another server),
• merging several directories into one namespace (virtual directory),
• a migration from another directory.

Depending on the answer, part of it may already be covered by existing features, or it may narrow down what a first version needs to do.

You can also vote to raise the priority here: https://opencollective.com/openidentityplatform/projects/opendj/contribute/vote-to-raise-the-priority-of-an-issue-92500

[bilias]

Hi @vharseko and thanks for the reply.

Our use case is for HA LDAP Services.

• Dual (active/backup) load balancer (IP) providing IP LB for the LDAP Proxy servers
• Dual LDAP Proxy servers <- this
• Multiple LDAP Directories behind the LDAP Proxy.

LDAP Proxies:
Monitoring of LDAP backends (ldap monitoring backend/SNMP).
Route priorities per operation (BIND, SEARCH, ADD etc), with load balancing.

Merging (combine different bases under a master one - unify), DN rewriting (if it's needed), virtual attributes, attribute rewritting, attribute filtering, transformations.
Binds are always forwarded to LDAP backends (I don't believe we use pass-through). Service account or the user's account to bind to backend depending on the destination.

LDAP backends are different kind of directories:

• OpenLDAP
• 389
• Active Directory

Virtual LDIF backend but mostly for failover
Primary is down, Secondary is down -> use ldif in order to at least show base dn and not return failure to the application.

In the past merging attributes from Database inside the virtual directory was needed, but no more.

OUD provides most of the features we need, but it's not open source.
Apart from OUD I don't know any similar software for this. Maybe ForgeRock's but haven't' tested that.
OpenLDAP proxy services are basic.

Thanks