How to configure a proxy server on VCF Identity Broker (vIDB) 9.1

Products

VCF Operations

Issue/Introduction

This article provides instructions for configuring a customer-managed proxy server for the VCF Identity Broker (vIDB) appliance in VCF Operations 9.1. This configuration is necessary when the appliance requires a proxy for outbound internet access to perform tasks such as Identity Provider (IdP) federation with Microsoft Entra ID.

Environment

VCF Operations 9.1

VIDB 9.1

Resolution

To configure the proxy server on the Control Plane node, you must prepare the proxy's Root CA certificate (if SSL inspection is enabled on the Proxy server) and apply the settings via the PATCH API. Refer to Configure a Proxy Server for VCF Management Services Components and VCF Automation documentation and complete up to Step 5. After that, follow the steps below to include the certificate and additional attributes in the payload in the correct format:

Prepare the Proxy Root CA: If your proxy performs SSL inspection, obtain the Root CA certificate file (.cer or .pem) used by the proxy.
Encode the Certificate: Convert the certificate into a single-line Base64 encoded string (no line breaks) using the following command:
```
echo -n '-----BEGIN CERTIFICATE-----
<contents_of_certificate_file>
-----END CERTIFICATE-----' | base64 -w 0
```
This generates the single-line Base64 string required for the encodedCertificate field in the API payload.

Apply Proxy Configuration via API: Use the VCF Operations API to update the proxy settings. The payload must include the correctly formatted encodedCertificate (if SSL inspection is active on the Proxy server), the exclusion lists formatted as comma-separated strings, and the correct tlsEnabled boolean value.Example API payload structure:

export TASK_ID=$(curl -k -s -X PATCH -H "Authorization: Bearer ${TOKEN}" \
"${FLEET_HOST}/fleet-lcm/v1/components/${VSP_COMP_ID}/config" \
  -H "Content-Type: application/json" \
  -d '{
  "type": "VspClusterConfigSpec",
    "peerProxy": {
      "tlsEnabled": true | false,
      "credentialsEnabled": true | false,
      "encodedCertificate": "<base64_encoded_string_from_step_2>",
      "excludeDomains": "<internal_domain_1>,<internal_domain_2>",
      "excludeIpAddresses": "<internal_ip_1>,<internal_ip_2>",
      "host": "##.##.##.##",
      "port": ###
    }
  }' | jq -r '.id')

echo "Started Task ID: $TASK_ID"

Do not use asterisks in the excludeDomains and excludeIpAddresses properties.

Verify Connectivity: Log in to the Control Plane node via SSH and verify the outbound path through the proxy:
```
curl -kv https://example.com
```
Finalize Configuration: Once connectivity is confirmed, proceed with the desired service integration (e.g., SSO setup) in the VCF Operations UI.

Additional Information

If you encounter the error: Saving configuration settings failed with the following error: Failed to retrieve OIDC endpoints from configuration url , when configuring the Entra ID in VCF Operations, verify the tlsEnabled parameter in your API payload. If your proxy server does not accept TLS connections, ensure "tlsEnabled" is set to false. Setting this to true when the proxy does not support it will cause the configuration to fail.