raulcnadal/applivery-authentication-sidecar-relay repository overview

⁠Overview

In certain scenarios, customers heavily relying on LDAP may be reluctant to open a direct inbound connection from the internet to their LDAP server due to strict internal security policies.

To address this, Applivery provides a secure, egress-only model to bind to LDAP without requiring a direct inbound firewall rule. This approach consists of two core elements:

⁠1. Applivery Authentication Sidecar - FRP Relay

This container is deployed on the public internet and acts as the secure gateway, allowing the following connections:

• Inbound from Applivery via port 7636 TCP (LDAPS).
• Inbound from the customer's public IP address via port 7000 TCP (Tunnel communication).

⁠2. Applivery Authentication Sidecar - FRP Client

This stack is deployed securely inside the customer's internal network. It initiates a bidirectional Layer 4 TCP connection outbound to the Applivery Authentication Sidecar Relay on the internet to exchange information.

LDAP requests from Applivery travel through this pre-established secure tunnel and are forwarded to GLAuth, which exposes an ACME-provisioned certificate for external LDAP bindings. The authentication request is then delivered to the internal LDAP server. The response is received by GLAuth, routed all the way back up the tunnel to the internet-facing Relay, and finally delivered to Applivery. This completely eliminates the need for any direct inbound connections from the internet.

⁠Network Requirements

Each container within the internal stack requires the following bidirectional network connections to function properly:

FRP Client:

• Outbound to the Applivery Authentication Sidecar Relay IP (the public internet component) via port 7000 TCP.
• Outbound to the internal LDAP server via port 636 TCP.

GLAuth:

• Inbound and Outbound to/from the FRP Client (handled internally within the same Docker network).
• Outbound to the internal LDAP server via port 636 TCP.

⁠Part 1: Deploying the Public Cloud Server (Relay)

This server acts as your public gateway. It must have a static public IP and a domain name (e.g., ldap.yourcompany.com) pointing to it.

Thanks to the Applivery custom Relay image, deployment is extremely streamlined. Configuration is handled entirely via environment variables, and the tunnel enforces strict TLS encryption automatically.

⁠1. Create docker-compose.yml

Create a new directory on your public server, open a docker-compose.yml file, and paste the following configuration:

version: '3.8'

services:
  applivery-relay:
    image: raulcnadal/applivery-authentication-sidecar-relay:latest
    container_name: applivery-sidecar-relay
    restart: unless-stopped
    environment:
      # The internal port the tunnel communicates over
      - BIND_PORT=7000
      # Require a strong token to prevent unauthorized clients from connecting
      - TUNNEL_TOKEN=CHANGE_THIS_TO_A_LONG_SECURE_PASSWORD
    ports:
      - "7000:7000" # FRP Tunnel Communication Port
      - "7636:7636" # Public LDAPS Listener Port

⁠2. Start the Relay

Run the following command in the same directory to start the public listener:

docker-compose up -d

The Relay server is now live, fully encrypted, and waiting for your internal Applivery Sidecar Client to establish the secure tunnel!