|Manuals

Thinfinity Broker

Thinfinity Brokers are the logical control core of the platform. Unlike gateways, they do not receive direct user traffic. Instead, they handle session orchestration, license validation, and integration with backend services such as Active Directory and the MySQL database. By centralizing these functions, Brokers ensure secure coordination across all Thinfinity® Workspace services.

Session Orchestration

Thinfinity Brokers establish secure communication channels with Thinfinity Gateways via HTTPS on port 443. They serve as the central decision-making component, evaluating policies and user identities to authorize access to designated resources, VDI pools, applications, and web services.

Thinfinity Broker Session Orchestration

Licensing Service

Thinfinity Brokers utilize port 7443 (HTTPS) for network communication to perform the verification process of Thinfinity Workspace license, facilitating a secure and encrypted transmission of requests and responses for validation, ensuring accurate activation and operational integrity of associated services.

Thinfinity Broker Licensing Service

Active Directory Integration

Network communication interfaces need the use of TCP port 389 designated for LDAP and TCP port 636 designated for LDAPS. These ports are necessary for enabling authentication mechanisms, identity management and policy enforcement across network nodes.

Brokers must establish and maintain a connection to the organization domain and its Active Directory infrastructure, ensuring adherence to established security policies and utilizing the existing inherited trust relationships.

AD Cache Component on the Broker

Each Thinfinity Broker maintains an internal AD Cache to minimize latency and reduce dependency on constant real-time queries to Active Directory.

What It Stores

  • User credentials (hashed), group memberships, and policy mappings.
  • Recently validated tokens and session states.
  • User-to-resource authorization rules derived from AD groups.

How It Works

Upon user authentication, the Broker initiates an LDAP query to the AD to retrieve the user’s credential information and group membership attributes. The retrieved data is stored within the Broker’s local AD Cache, facilitating the authorization processes for subsequent requests by eliminating the need for additional LDAP queries to AD.

The local cache uses a scheduled refresh mechanism to synchronize with AD, ensuring that modifications are accurately reflected within Thinfinity Workspace.

In scenarios where AD is temporarily unavailable, the Broker continues to use its cached AD to uphold session integrity and maintain authenticated user sessions without interruption.

Advantages

  • Performance: Decreases latency associated with individual authentication requests and session orchestration processes.
  • Resilience: Ensures uninterrupted service availability during transient AD outages.
  • Scalability: Mitigates the workload on AD servers during authentication peak periods, enhancing overall system capacity.

Database Integration (Profiles & Logs)

  • Port 3306 (MySQL): Brokers connect to the MySQL Database Service to persist session data, user profiles, configuration settings, and activity logs.
  • Profiles Database: Mission-critical component. High Availability (HA) is strongly recommended to ensure consistency of user sessions, fast profile loading, and uninterrupted operations in case of database node failures.
  • Audit Log Database: Not mission-critical. HA and sizing requirements (storage capacity, retention periods, and log rotation policies) can be defined according to each organization’s compliance and auditing standards.
Database Integration Profiles Logs

Summary

In every Thinfinity Workspace deployment, the Workload Layer remains internal-only with no public IP exposure. This architecture implements a Zero Trust security model, reduces the attack surface, and ensures that all user authentication and access requests are precisely routed and mediated through Thinfinity Gateways and Brokers.