[OPENDJ-7291] Provide a debugging tool for connecting a proxy to backend servers Created: 17/Jun/20 Updated: 23/Jun/20
|Component/s:||ease of use, proxy|
Not really sure what to ask for. Here's what it was this time.
When I end up with something like this:
The "failureReason" never seems to be any help at all.
It's especially disappointing when you find that you can proxy with the proxy server's account on backend DSs, no problem:
It's hard enough getting that far.
What next? Try to find the proxy's failed request in the (non-human-readable) logs.
The trouble is, the only indication of the problem is the error on the proxy, and the log message is not helpful. My next guess is access control, but one can spend hours in blind alleys... and that's just to get a demo set up.
|Comment by Mark Craig [ 17/Jun/20 ]|
Debug logging is not a useful answer. I tried setting up debug logging just for the code where the message seems to be, which is in org.opends.server.core.BindOperation. That got me an empty logs/debug file. When I opened it up to org.opendj.server.core, I got 26527 lines.
Looking at the code, which people outside ForgeRock won't be able to do, is cheating anyway. But I am wondering why I seem to be getting a message from a local backend... when addressing what should be a proxy backend. Maybe something happened in the routing (another part of the configuration that I don't understand very well).
|Comment by Mark Craig [ 23/Jun/20 ]|
Back to going in circles around the drawing board this morning. This time I get 49 invalid credentials and no failure reason hint at all:
It does look like the proxy is managing to discover the DS/RSs:
Connecting directly to the a DS/RS and using --proxyAs works fine, but only for 1/2 the servers. So there must be something wrong with my script, or I've screwed up replication or something. So once I manage to figure that out myself and shut those servers down, the proxy fails over and I get the expected result.
This issue is not to say setting up a proxy is technically impossible. But debugging any problems is very frustrating.