Skip to main content
The IP allowlist compares the caller’s network address with the list. Behind a load balancer or an ingress, the address the service sees is the proxy’s, not the caller’s. This page tells a BYOC operator what to configure so the platform learns the real address.
This page applies to BYOC deployments only. On Lerian Cloud, Lerian operates this configuration for you. You only manage the list itself.
For the architecture view, read Tenant IP allowlist.

​
Trusted proxies

Set TRUSTED_PROXIES on these Lerian services, not only on the Access Manager:
  • The Access Manager Auth and Identity services.
  • The products Midaz, Reporter, Lender, and Streaming Hub.
  • The rails Pix via JD, Pix via BTG, Pix Lerian, and Bank Transfer.
Each of these services resolves the caller’s address on its own and forwards it to the Access Manager Auth service. A service without the variable forwards no address. Auth uses a forwarded address only from a caller in the TRUSTED_PROXIES or PLATFORM_INTERNAL_CIDRS of Auth. On the Access Manager itself, the variable decides whether the allowlist enforces at all, as the table below shows. The value is a comma-separated list of CIDR ranges. List only the proxies and networks that connect directly to that service. On Auth, include the networks that the products and rails call Auth from.
Rules the platform applies to the value:
  • CIDR ranges only. A bare address without a prefix is rejected.
  • Very broad ranges are rejected: broader than /8 for IPv4 or /48 for IPv6. 0.0.0.0/0 never works.
  • On the Access Manager, a malformed value stops the service at startup.
What happens when the value is absent: For a product request (POST /v1/authorize) from a caller outside the TRUSTED_PROXIES and PLATFORM_INTERNAL_CIDRS of Auth, Auth checks the caller’s own address when that address is public. When it is not public, such as a private or CGNAT address, Auth allows the request without a check. A metric and a log line that names the address signal it. At sign-in and token issuance, Auth checks the caller’s own address, public or not.

​
Validate the deployment

Run this check once after you set the variables, from a workspace whose list you control.
1

Activate a list with your own address

Send the list through the Identity API with "scopes": ["console", "api"]. Include the address you connect from and the address your test client calls from.
2

Sign in from a listed address

Sign in from that address. The sign-in must succeed.
3

Sign in from an unlisted address

Sign in from another network, such as a mobile connection. Expect a refusal.
4

Call a Midaz endpoint from both addresses

Call any protected Midaz endpoint from the listed address, then from the unlisted one. Expect 200 and then 403 with code AUT-0021.
If the platform accepts a request from the unlisted address, it does not learn the real address. Check TRUSTED_PROXIES on the service that answered and on Auth, and PLATFORM_INTERNAL_CIDRS on Auth and Identity.

Tenant IP allowlist architecture

How Auth, Identity, and each product share the check.

Manage the list in the Console

The administrator’s guide to the Security page.