UAA Network Communications

This topic describes User Account and Authentication (UAA) internal network communication paths with other Pivotal Application Service (PAS) components.

Inbound Communications

The following table lists network communication paths that are inbound to UAA.

Source VM Destination VM Port Transport Layer Protocol App Layer Protocol Security and Authentication
cloud_controller uaa 8443 TCP HTTPS OAuth 2.0 or none*
diego_brain (SSH Proxy) uaa 443 TCP HTTPS OAuth 2.0
loggregator_trafficcontroller uaa 8443 TCP HTTPS TLS
router uaa 8443 TCP HTTPS OAuth 2.0

*The authentication method depends on the type of request.

Outbound Communications: Internal to PCF

The following table lists network communication paths that are outbound from UAA.

Source VM Destination VM Port Transport Layer Protocol App Layer Protocol Security and Authentication
uaa mysql_proxy* 3306 TCP MySQL MySQL authentication**
uaa (Route Registrar) nats 4222 TCP NATS Basic authentication

*Applies only to deployments where internal MySQL is selected as the database.

** MySQL authentication uses the MySQL native password method.

Outbound Communications: External to PCF

The following table lists network communication paths from UAA that are outbound to external systems.

Source VM Destination VM Port Transport Layer Protocol App Layer Protocol Authentication
uaa LDAP LDAP server communication port TCP LDAP/LDAPS Basic authentication (LDAP bind)
uaa SAML/OIDC 80 or 443 (HTTP port) TCP HTTP/HTTPS Key

BOSH DNS Communications

By default, PAS components and app containers look up services using the BOSH DNS service discovery mechanism. To support this lookup, BOSH Director colocates a BOSH DNS server on every deployed VM. For more information, see BOSH DNS Network Communications.

Create a pull request or raise an issue on the source for this page in GitHub