Ops Manager Layer-7 client-IP forwarding and remote-IP header
Parent: Ops Manager Application · Published reference · snapshot 2026-10-31
↓ Facts as markdownall context files
Source-anchored research for Ops Manager Layer-7 client-IP forwarding and remote-IP header. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- MongoDB’s HA procedure requires Layer-7 support and warns that Layer-4 balancing might affect SAML/OIDC authentication, IP-based API restrictions, auditing and logging. It identifies client IP as input to API access lists and auditing; it does not say every Layer-4 deployment necessarily fails authentication. (low confidence) (verified as of 2026-10-14) [source]
How it works
- When the remote-IP header setting is enabled, block clients from connecting directly to Ops Manager application hosts. The Guardian template explicitly warns that direct access permits injected headers to spoof the client IP, consistent with MongoDB’s direct-access restriction. (medium confidence) (verified as of 2026-10-14) [source]
Comparisons and alternatives
- The Ops Manager UI remote-IP header setting maps to mms.remoteIp.header, whose value is an HTTP header name. This differs from mms.centralUrl, which identifies the public Ops Manager URL; the two configuration values are not interchangeable. (medium confidence) (verified as of 2026-10-14) [source]
Facts and statements
- Setting Load Balancer Remote IP Header also enables X-Forwarded-Host for the original requested host, X-Forwarded-Proto for the original protocol, X-Forwarded-Server for the proxy hostname and X-Proxied-Https for HTTPS status. (medium confidence) (verified as of 2026-10-14) [source]
- For interpreting the additional headers that Ops Manager enables, Eclipse Jetty independently documents X-Forwarded-Proto as protocol metadata and X-Proxied-Https as an HTTPS-status indicator. These headers convey different request metadata from the client address carried by X-Forwarded-For; Jetty documentation alone does not establish Ops Manager’s bundled version or header precedence. (medium confidence) (verified as of 2026-10-14) [source]
Children
- No children recorded.