Configure Data Admin to Use the Reverse Proxy

You configure Data Admin to use a reverse proxy by setting the server.reverseProxy system property. For more information about using Java system properties, see Using Java System Properties.

When you set server.reverseProxy to true, the Data Admin application listens for AJP connections on a port that you can define by using the server.ajp.port system property.

In AJP mode, the reverse proxy must translate incoming HTTP(S) connections from your clients into AJP connections to Data Admin. The application reads the user name from incoming requests, so you must set up remote authentication. You cannot encrypt the connection from the reverse proxy to the application.

You can also use a HTTP reverse proxy. You cannot use remote authentication in this mode. Users authenticate by using the proxied login page. However, you can encrypt the connection with SSL.

In both these methods, the reverse proxy must rewrite the request path, response Location headers, and cookie paths.

By default, server.reverseProxy is false. In this case, the Data Admin application is available only over HTTP or HTTPS, without a reverse proxy.

NOTE: Data Admin uses the WebSocket protocol to communicate between the user Web browsers and the Java process. Your reverse proxy must tunnel this communication from the client to the application, in addition to forwarding HTTP/AJP requests.

To configure Data Admin to use a reverse proxy

Set the following Java system properties.
- server.reverseProxy to true.
- (Optional) Set server.ajp.port to the port number to listen on for AJP connections. By default, Data Admin uses port 8009.
To specify the roles to assign to your users, set the Java system property ida.reverse-proxy.pre-authenticated-roles.
- To use hard-coded roles, set this property to a comma-separated list of role names (see User Roles).
- To use roles from the Community component, set the property but leave the value blank. For example:
```
java -Dserver.reverseProxy=true -Dida.reverse-proxy.pre-authenticated-roles= -Didol.dataadmin.home=[home directory] -Dserver.port=[port] -jar dataadmin.jar
```
  To use this option, you must ensure that your Community component configuration file has CheckEntitlement set to False (the default value).
The default value for this property is IDAUser.

NOTE: This setting does not assign any roles in the Community component. It gives all users that use the reverse proxy the same permissions to access Data Admin.