Configure Find behind a Reverse Proxy

There are several configurations in which you can set up Find behind a reverse proxy.

Find listening for AJP connections, with authentication delegated to the proxy. The reverse proxy translates incoming HTTP(S) connections from your clients into AJP connections to Find. Find reads the user name from incoming requests, so you must set up remote authentication. The AJP protocol does not support encryption so the connection between the proxy and Find is not encrypted. You configure Find by setting the server.reverseProxy and server.ajp.port system properties. For more information about using Java system properties, see Using Java System Properties.
Find listening on HTTP(S) without performing authentication. Any user who accesses Find is logged in using a single user name that you specify. The reverse proxy can perform authentication but from the point of view of Find there is a single pre-authenticated user. This architecture therefore does not support mapped security because all users have access to the same documents. You configure Find by setting the server.reverseProxy and find.reverse-proxy.pre-authenticated-username system properties. For more information about using Java system properties, see Using Java System Properties.
Find listening on HTTP(S) and performing authentication. Find supports this architecture with no configuration required beyond the configuration of the reverse proxy itself. Users authenticate by using the Find login page presented to them by the proxy. Do not set the server.reverseProxy system property when starting Find. You can encrypt the connection from the user to the proxy, and from the proxy to Find, by using SSL.

In all of these architectures, the reverse proxy must rewrite the request path, response Location headers, and cookie paths.

The following procedure describes how to configure Find, when you want to listen for AJP connections or use HTTP(S) with a pre-authenticated user.

To configure Find

Set the following Java system properties.
- Set server.reverseProxy to true.
- (Optional) Set server.ajp.port to the port number to listen on for AJP connections. By default, Find uses port 8009.
To specify the roles to assign to your users, set the Java system property find.reverse-proxy.pre-authenticated-roles.
- To use hard-coded roles, set this property to a comma-separated list of role names (see User Roles).
- To use roles from the Community component, set the property but leave the value blank. For example:
```
java -Didol.find.home=[home directory] -Dserver.port=[port] -Dserver.reverseProxy=true -Dfind.reverse-proxy.pre-authenticated-roles= -jar find.war
```
  If you are configuring a single pre-authenticated user, a user must exist in the Community component with a name matching the pre-authenticated user name.
  
  To use this option, you must ensure that your Community component configuration file has CheckEntitlement set to False (the default value).
The default value for this property is FindUser.

NOTE: This setting does not assign any roles in the Community component. It gives all users that use the reverse proxy the same permissions to access Find.
Use one of the following options, to use a reverse proxy in AJP or HTTP mode:
- AJP mode. Configure your reverse proxy to handle authentication by setting the remote_user attribute in the AJP request.
- HTTP mode. Set the find.reverse-proxy.pre-authenticated-username system property to a specific user name. This option bypasses authentication so that any user that accesses Find is logged in automatically as that user name. See Configure Find to Use a Single Pre-Authenticated User.
Restart Find.