HCL Domino Ideas Portal
Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.
For more information and upcoming events around #dominoforever, please visit our Destination Domino Page
@Thomas Hampel: No. - The field "XForwardedFor" is limited to the http protocol. This field does not exist on any other protocols (such as imap, smtp, ldap, etc.).
The problems with the current status quo are:
When Password Lockout is configured to use "Also enforce lockout on based on IP address" and "Count user name failures also as IP address failures", this will only work properly with the http protocol.
For other protocols (ldap, imap, smpt, etc), it may cause the load balancer's IP to become locked out, essentially locking out all users for all protocols.
As a result, Administrators may be forced to disable these useful Security Features in order to guarantee operational safety.
Supporting the Proxy Protocol fixes all this mess.
[ Toni Feric, Belsoft Collaboration ]
Isnt this already provided with this => https://domino-ideas.hcltechsw.com/ideas/DOMINO-I-185
Yes this makes a lot of sense.
There are many customers using appliances in front of Domino.
And also as mentioned before K8s and other cloud native platforms need it today.
IMHO we need both XCLIENT support and proxy protocol support.
[ Daniel Nashed / https://blog.nashcom.de ]
As soon as domino server tasks (smtp / imap / pop) are placed behind a protocol proxy (eg an nginx front-end server or other antispam architecture) we lose the possibility to receive the real original IP address.
For this sceneario the HAProxy "proxy protocol" (also implemented by nginx) comes to the rescue for TCP based protocols.
If domino server taks (ideally even the NRCP listened) would support proxy protocol it could be possible to have a DMZ responder (using haproxy or nginx) that acts as first point of contact and communicates with domino in a more secure lan segment.
Having a proxy in the middle means the domino task can only see the proxy as the source IP. Having proxy protocol supported would allow to get the real source IP and behave accordingly.
This is even more important as we begin to run domino inside k8s / containerized systems whe the K8S cluster network is in general nat-ted and proxies (like haproxy and nginx) manage the tranposrt.