...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
| Section | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
...
If you are using tomcat, emails sent are tracked in the <frevvo-home>\tomcat\logs\frevvo.log file when the INFO Debugginglogfilelevels log level is enabled. Look for an entry like "Sending email to <email address> with subject <the subject of your email>. If an error occurs when sending, the message "Could not send email to <email address> with subject <the subject of your email> including the actual exception that caused the problem will be logged.
...
is a multi-tenant application. See the administration section on Manage Tenants. However, it is possible that all you need is a single tenant. If this is your case, it simplifies the server login if you default the @<tenantname> so the user only needs to enter their username to login. Customers who default the tenant login normally would also customize the placeholder on the login screenCustomizingtheplaceholderontheloginscreen. Please read that topic for details.
- Stop frevvo if it is running.
- Navigate to the <frevvo-home>\tomcat\conf directory
- Open the frevvo-config.properties file with a text editor.
Add the frevvo.default.login.tenant.id property to the <frevvo-home>\tomcat\conf\frevvo-config.properties file and set the param-value to the name of your one tenant.
Code Block title frevvo-config.properties frevvo.default.login.tenant.id=<your_tenant_id>
- Save the file
- Restart .
...
You may want to customize the user@tenant placeholder on the login screen to reflect the name of your tenant to minimize confusion for your users or to remove the @tenant from the placeholder if you have defaulted the tenant loginDefaulttheTenantLogin.
In-house customers can change the default placeholder on the login screen by modifying the values for the frevvo.login.username.placeholder property.
...
- Unable to contact license server
- Unable to renew license. Your license will expire in <n> day(s)
External URLs
The External URL should always be set up when frevvo tomcat is running behind a proxy. Setting the correct external URL is necessary when frevvo either redirects to an external system that is sensitive to the originating address e.g. SAML Identity Provider, OAuth server, etc. or generates a URL for external use e.g. a share URL.
Tomcat is already configured to accept the standard x-forwarded headers. If the proxy is providing these in the request then nothing needs to be done. If the headers are custom, then frevvo can be configured to do the translation. If these headers are not being provided, then you need to configure the tomcat connector proxy attributes.
...
This is the most flexible setup. You do not need to make any changes in frevvo to use this as tomcat is already configured to handle the standard x-forwarded headers which are as follows:
- X-Forwarded-Proto: the protocol of the incoming request (http or https).
- X-Forwarded-Host: the host name of the incoming request
- X-Forwarded-Port: the port of the incoming request
...
| Expand | |||||
|---|---|---|---|---|---|
| |||||
For example, if you prefer to use a parameter called X-Fwd-Scheme instead of X-Forwarded-Proto, simply add the appropriate context parameter and make sure that your proxy is setting a header with the new name. The defaults are shown below. Replace the values on the right side of the '=' with your corresponding custom header name.
|
Configure a Tomcat Proxy
Proxy attributes are set up on the tomcat connector that the proxy is forwarding requests to, which could be the HTTPS or the HTTP connector of the <frevvo-home>\tomcat\conf\server.xml file. For example, if SSL is being terminated in the proxy then it forwards to the HTTP connector (as shown below). Add the properties proxyName, proxyPort, scheme and secure.
...
Default Internal Port
uses a connector on port 8081 for internal requests. As indicated in the server.xml, changing the frevvo internal connector 8081 settings in the server.xml file can cause unexpected changes, and is not advised.
The connector with port 8081 is configured in the server.xml file. Please ensure this port is available for to use.
...
If you need to change the internal port, follow these instructions. The only case where frevvo.internal.port may need to be changed is if port 8081 is already in use by another application.
In the server.xml, replace port 8081 in all locations with the port number of your choice. Make sure the new port is open and available for 's use.
Code Block <Connector address="127.0.0.1" port="<port>" protocol="org.apache.coyote.http11.Http11NioProtocol" connectionTimeout="40000" maxHttpHeaderSize="32768" useBodyEncodingForURI="true" />
In the frevvo-config.properties file, add the frevvo.internal.port property and set it to the same port number used in step 1.
Code Block frevvo.internal.port=<port>
Default External Port
uses a connector on port 8082 for external requests. By default the tomcat bundle is configured to bind to port 8082. Please ensure this port is available for to use. You can change the port by:
...
The HTTPS connector on port 8443 is enabled by default . If you want to disable it, edit in the <frevvo-home>/tomcat/conf/server.xml and comment out the HTTPS connector:.
| Code Block | ||
|---|---|---|
| ||
<!-- HTTPS Connector --> <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="${catalina.home}/conf/keystore" keystorePass="password" connectionTimeout="20000" maxHttpHeaderSize="32768" useBodyEncodingForURI="true" /> --> |
recommends reviewing your Certificate Authority's documentation for detailed steps to configure your certificate in Apache Tomcat. Additional info on how to use SSL on tomcat can be found on the Apache/Tomcat website.
There are multiple ways of configuring certificates depending on their format. For example, a PKCS#12 (pfx or p12) certificate doesn't have to be imported into the keystore. It can be configured directly as:
| Code Block |
|---|
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1+TLSv1.1+TLSv1.2"
keystoreFile=C:\CERTDIRECTORY\CERT.pfx" keystorePass="YourPassword" keystoreType="PKCS12"
connectionTimeout="40000" maxHttpHeaderSize="32768" useBodyEncodingForURI="true"/> |
However, PKCS#7 or P7B formats require importing the certificate chain into the keystore. The Certificate Authority needs to provide all the intermediate certificates to be imported.
Currently you must not disable 's http port. In a future release this will be allowed. Disabling ' http port will cause your form server to malfunction as requires this port. For most cases it is sufficient to share the https version of your form/flow's Url and leave http open. However, if you want to force all form usage to be over https and feel it is not enough to simply share the https form Urls (as a user can switch to http as long as that port is open), we recommend that you deploy behind an Apache or IIS server. Close the http port on Apache or IIS but leave tomcat's http port open so that can POST back to itself when needed over http but no one outside can access it.
...
| Note |
|---|
|
...
no longer supports the web.xml parameters for frevvo.xforwarded.protocol.header, frevvo.xforwarded.host.header, and frevvo.xforwarded.port.headers. The general recommendation is to rely on the Servlet Container for handling dynamic proxies. A better approach is to use tomcat's RemoteIp Valve instead. Please see this documentation on the Apache Tomcat website for information about the RemoteIp valve functionality. This tomcat valve has been incorporated into our tomcat bundle.
| Code Block |
|---|
<Valve className="org.apache.catalina.valves.RemoteIpValve"
internalProxies=".*"
remoteIpHeader="x-forwarded-for"
proxiesHeader ="x-forwarded-by"
protocolHeader="x-forwarded-proto" /> |
...
The frevvo API uses an http connection pool which implies that connections are reused for a given route. In some cases, an API call (such as a rule or doc action) may fail intermittently due to a connection reset or a socket read timeout. Setting the property http.connection.maxidletime in the frevvo-config.properties file may resolve this issue. This property sets the idle time in milliseconds beyond which the connection will be closed by the monitor. By default, it is not set and hence there is no monitor running. Once it is configured with a positive value e.g. 30000, the monitor runs every 1 second looking for expired idle connections and closes them.
...
Skew error when logging into an Azure SAML tenant
Users logging into a Azure SAML tenant may encounter the error "Access Denied. Authorization Required". Examination of the frevvo.log shows the following entry:
| Code Block |
|---|
Response issue time is either too old or with date in the future, skew 60, time 2016-06-01T05:49:25.330Z |
This error is typically caused by a clock synchronization issue between the Service Provider (frevvo) and the Identity Provider (Azure) or a genuine delay in the connection. If you get this error, adding the com.frevvo.security.saml.response.skew property can be used to specify the time in seconds allowed between the request and the response from Azure to a value greater than the default value of 60 seocnds.
Follow these steps:
- Stop frevvo if it is running.
- Navigate to <frevvo-home>\tomcat\conf
- Open the frevvo-config.properties file with a text editor.
Add the parameter shown below with a value greater than the default value of 60 seconds. The example shown increases the timer to 120 seconds.
Code Block com.frevvo.security.saml.response.skew=120
Save the file.
- Restart .
- Retry the login.
...
Changing the Default Task Notification Email Message
If you want to change the default subject and body of the task notification email for your server, add these properties to the frevvo-config.properties file.
| Code Block |
|---|
frevvo.task.notification.email.subject=New task
frevvo.task.notification.email.message=You can access your task list by clicking <a href="{task.perform.url}">this link</a> |
Change the value in this parameter to anything you want. The task.perform.url template {task.perform.url} is a built-in template in and it will always point to the specific task. Refer to the Task Notification Email Link topic for some other options. If you wrap the templates in an HTML <a> tag, it will generate a clickable link in the email.
If you do not want the link in your task notification emails to go there, you can remove it. The default message can include form control templates.
Non-default Database Schema
If you use a custom schema (anything other than 'dbo'), you must add the following property to the <frevvo home>/tomcat/conf/frevvo-config.properties file. This property's default value is 'dbo'.
...
Secure Passwords in Tomcat
Security audits may point out that some secrets are stored in clear text in tomcat configuration files. Here is a list of (known) secrets that are currently stored in clear text by default:
Tomcat JDBC and SMTP configurations in Tomcat’s <frevvo-home>\tomcat\conf\server.xml
Database password in <frevvo-home>\tomcat\conf\dbconnector.properties
Google Connector’s Client Secret in <frevvo-home>\tomcat\conf\frevvo-config.properties
frevvo’s SAML keystore password in <frevvo-home>\tomcat\bin\setenv.bat and the service.bat files for the Windows OS or setenv.sh for UNIX/Linux OS
Tomcat, and thereby , does not support encryption out of the box. There are two main options for securing this information.
Limit access to Tomcat files
The first option is limiting access to the file so that it can only be read by the user that Tomcat process runs as and root (or the administrator on Windows). Here are two relevant articles about Tomcat passwords that provide suggestions for limiting access and masking sensitive information:
- https://cwiki.apache.org/confluence/display/TOMCAT/Password.
- https://wiki.owasp.org/index.php/Securing_tomcat#Cleartext_Passwords_in_CATALINA_HOME.2Fconf.2Fserver.xml
For the Database Connector, you can define the data source at the container (tomcat) level for some added security. Please see this documentation which explains how.
OS Environment Variables
Starting in Tomcat v9.0.34 ( v9.0.15+) Tomcat introduced support for environment variables in server.xml. (See Apache Tomcat 9 (9.0.54) - Changelog for details.) This new capability is disabled by default in Tomcat but can be enabled by adding the following property to conf/catalina.properties.
...