Geolocation feature

Configuration in IAM

0. Go to:
   Loginapp >> Basic Settings
1. In the Gateway Settings field, add the Airlock Gateway Settings (Loginapp) plugin. Keep the default values.
2. Activate your configuration.
3. You have specified the Gateway settings for the IAM Loginapp. Proceed with the configuration of Airlock Gateway.

Configuration in Gateway

0. To enable IP-address-forwarding in Gateway, the Send environment cookies option must be enabled in the respective Gateway mapping. Check that this is the case:

1. Open the Gateway Configuration Center.
2. Go to:
   Appication Firewall >> Reverse Proxy
3. In the Mapping column, select the mapping that connects the client host to your application's backend protected by IAM.
4. Open the Mapping detail page. In the Basic tab of the Mapping detail page, go to the Application section. Check that the Send environment cookies property is enabled. If not, enable it.
5. Activate your configuration.
6. IAM can now retrieve the client IP address from the AL_ENV_REMOTE_ADDR cookie sent by Airlock Gateway. The next step is to configure the geolocation provider. See Configure the geolocation provider.

Configuration in IAM

0. Go to:
   Loginapp >> Basic Settings
1. In the Gateway Settings field, add the Airlock Microgateway Settings plugin. This plugin enables the parsing of HTTP headers, forwarded by Microgateway, for information on the incoming request.
2. In the Airlock Microgateway Settings plugin dialog, go to the HTTP Request Client IP Extractor property. Check that the plugin HTTP Request Client IP Extractor - DEFAULT is set (default). If not, add a HTTP Request Client IP Extractor plugin. This plugin extracts the client IP address from the incoming request.
3. In the HTTP Request Client IP Extractor plugin dialog, go to the HTTP Header Name property. This property defines the HTTP header whose value contains the IP address. The header name defined here must be identical to the HTTP header name configured in Microgateway's proxy. Check that X-Forwarded-For is set as header name (this is the default).
4.  

   Notice

   You could in fact enter any header name here as long as it matches the name set in Microgateway. However, we recommend using X-Forwarded-For. This is the de-facto standard header name for identifying the originating IP address of a client connecting to a web server through a proxy server.
5. Activate your configuration.
6. You have specified the Microgateway settings for the IAM Loginapp. Proceed with the configuration of Airlock Microgateway.

Configuration in Microgateway

0. Next, you must define which request headers Microgateway should add before forwarding the request to IAM. You do this in Microgateway's custom resource (CRD) HeaderRewrites. Set the following fields:

1. Configure the HeaderRewrites CRD

   • Field HeaderRewrites.spec.request.add.custom.headers.name: Defines the name of the HTTP header to add. This name must be identical to the HTTP header name previously configured for IAM in the HTTP Header Name property of the HTTP Request Client IP Extractor plugin. The recommended header name is X-Forwarded-For.
2. • Field HeaderRewrites.spec.request.add.custom.headers.value: Defines the value of the header, that is, the request IP address forwarded to IAM. Here, enter the following Envoy command operator:
     “%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%”.
     Microgateway will forward the effective client IP determined after proxy processing.
   • Field HeaderRewrites.spec.request.add.custom.mode: Defines the header addition strategy. Set the value OverwriteOrAdd. This always adds the configured header and value (see above), even if a header with the same name already exists.
3. Save your settings.
4. IAM can now retrieve the client IP address from the specified HTTP header sent by Airlock Microgateway. The next step is to configure the geolocation provider. See Configure the geolocation provider.
   For cloud deployments with an upstream proxy or load balancer, also consider the following notice.
5.  

   Notice

   Microgateway in Cloud setup
   Depending on the cloud setup, Microgateway may not be directly connected to the client and may therefore see only the IP address of an upstream proxy or load balancer. In this case, a trusted upstream system that knows the effective client IP must forward it, for example in the X-Forwarded-For header.

   See the figure below. Here, system B terminates the secure TLS connection between itself and the client. So B should set or extend the X-Forwarded-For header to MGW. Microgateway must be configured to trust B, and to use the address forwarded by B when determining the effective client IP.

Install the GeoLite 2 database

0. Go to the GeoLite download page (https://www.maxmind.com/en/accounts/<my-account-nr>/geoip/downloads).
1. Download the GeoLite City or the GeoLite Country database as GZIP file (.tar.gz archive).
2. Extract the file and store the including .mmdb file in your IAM folder system, e.g., /opt/GeoLite2/GeoLite2-City.mmdb or instances/auth/GeoLite2-Country.mmdb.
3. Note the path to the .mmdb file.

Configure the geolocation provider in IAM

0. In the IAM Config Editor, go to:
   Loginapp >> Basic Settings
1. In the Geolocation Provider field, add a MaxMind Geolocation Provider plugin. This plugin configures the geolocation provider based on the locally stored MaxMind GeoLite 2 City or Country database.
2. In the MaxMind Geolocation Provider plugin dialog, in the Db File Location field, enter the path to the previously downloaded .mmdb MaxMind database file.
3. Activate your configuration.
4. You have now configured a geolocation provider and linked it with your .mmdb MaxMind database file. IAM will automatically detect updates to the file.