LI80749: PORTAL CAN BLOCK USER LOGIN WHEN NGINX CONTROLLER DIRECTS TO DIFFERENT WORKER NODE

IBM_API_Connect_ICP_Enterprise_2018.4.1.5
IBM_API_Connect_ICP_Professional_2018.4.1.5

APAR status

• Closed as program error.

Error description

• In a multi-node portal cluster, if a login request received by
  the nginx controller on one worker node is directed to a www
  pod running on a different worker node, then the user can be
  blocked if too many login attempts are detected.
  

Local fix

• Execute in to the admin container on each www pod and edit this
  file:  /var/aegir/config/includes/global.inc, adding the IP
  addresses of all worker nodes to this array:
  $settings['reverse_proxy_addresses'] = ['9.20.152.180'];
  eg:
  $settings['reverse_proxy_addresses'] =
  ['10.x.x.1','10.x.x.2','10.x.x.3'];
  Then restart nginx on that pod by exec'ing in to it's web
  container and running:  killall /usr/sbin/nginx
  NOTE : This workaround will not survive a POD restart.
  

Problem summary

• The IP addresses of other cluster nodes can get blocked due to
  not being whitelisted.
  

Problem conclusion

• Fix targeted for release in v2018.4.1.5
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  API CONNECT ENT

• Fixed component ID

  5725Z2201

Applicable component levels

• R18X PSY

     UP