<Parameter name="frevvo.default.login.tenant.id" value="your_tenant_id" override="false"/>
<Parameter name="frevvo.login.username.placeholder" value="user@<your_tenant_name>" override="false"/>

#Custom Tenant Id and Placeholder
frevvo.default.login.tenant.id=<your_tenant_id>
frevvo.login.username.placeholder=<@<your tenant name>

frevvo.box.connector.client.id=bttkldgy9r5td0kdu57v0h6h2gotjf03
frevvo.box.connector.client.secret=EM08T1IjiMFuyCP5OJWm5QPyTz0qcL4A 
frevvo.filesystem.connector.url=http(s)://<your server>:port/filesystem 
insight.enabled=true insight.service.url=http(s)://<your server>:port/insight 
frevvo.sharepoint.connector.url=http(s)://<your server>:port/sharepoint 
logging.level.root=DEBUG

set CATALINA_OPTS=%CATALINA_OPTS% -Dspring.config.location="file:///%CATALINA_HOME%/conf/,file:///%CATALINA_HOME%/conf/frevvo-config.properties"

...

 is a multi-tenant application. See the administration section on Manage Tenants. However, it is possible that all you need is a single tenant. If this is your case, it simplifies the  server login if you default the @<tenantname> so the user only needs to enter their username to login. Customers who default the tenant login normally would also customize the placeholder on the login screen. Please read that topic for details.

1. Stop frevvo if it is running.
2. Navigate to the <frevvo-home>\tomcat\conf directory
3. Open the frevvo-config.properties file with a text editor.

4. Add the frevvo.default.login.tenant.id property to the <frevvo-home>\tomcat\conf\frevvo-config.properties file and set the param-value to the name of your one tenant.

   Code Block
   title frevvo-config.properties
   frevvo.default.login.tenant.id=<your_tenant_id>

5. Save the file
6. Restart .
   

...

<!-- HTTPS Connector
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
        maxThreads="150" scheme="https" secure="true" clientAuth="false"
        sslProtocol="TLS" keystoreFile="${catalina.home}/conf/keystore" keystorePass="password"
        connectionTimeout="20000" maxHttpHeaderSize="32768"
        useBodyEncodingForURI="true" />
-->

recommends  recommends reviewing your Certificate Authority's documentation for detailed steps to configure your certificate in Apache Tomcat. Additional info on how to use SSL on tomcat can be found on the Apache/Tomcat website. 

There are multiple ways of configuring certificates depending on their format. For example, a PKCS#12 (pfx or p12) certificate doesn't have to be imported into the keystore. It can be configured directly as:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
       scheme="https" secure="true"
       clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1+TLSv1.1+TLSv1.2"
       keystoreFile=C:\CERTDIRECTORY\CERT.pfx" keystorePass="YourPassword" keystoreType="PKCS12" 
       connectionTimeout="40000" maxHttpHeaderSize="32768" useBodyEncodingForURI="true"/>

However, PKCS#7 or P7B formats require importing the certificate chain into the keystore. The Certificate Authority needs to provide all the intermediate certificates to be imported. 

Currently you must not disable 's http port. In a future release this will be allowed. Disabling ' http port will cause your form server to malfunction as  requires this port. For most cases it is sufficient to share the https version of your form/flow's Url and leave http open. However, if you want to force all form usage to be over https and feel it is not enough to simply share the https form Urls (as a user can switch to http as long as that port is open), we recommend that you deploy  behind an Apache or IIS server. Close the http port on Apache or IIS but leave tomcat's http port open so that  can POST back to itself when needed over http but no one outside can access it.

...

...

no longer supports the web.xml parameters for frevvo.xforwarded.protocol.header, frevvo.xforwarded.host.header, and frevvo.xforwarded.port.headers. The general recommendation is to rely on the Servlet Container for handling dynamic proxies. A better approach is to use tomcat's RemoteIp Valve instead.  Please see this documentation on the Apache Tomcat website for information about the RemoteIp valve functionality. This tomcat valve has been incorporated into our tomcat bundle.

 <Valve className="org.apache.catalina.valves.RemoteIpValve"
            internalProxies=".*" 
            remoteIpHeader="x-forwarded-for" 
            proxiesHeader ="x-forwarded-by" 
            protocolHeader="x-forwarded-proto" />

...

The  API uses an http connection pool which implies that connections are reused for a given route. In some cases, an API call (such as a rule or doc action) may fail intermittently due to a connection reset or a socket read timeout. Setting the property http.connection.maxidletime in the frevvo-config.properties file may resolve this issue. This property sets the idle time in milliseconds beyond which the connection will be closed by the monitor. By default, it is not set and hence there is no monitor running. Once it is configured with a positive value e.g. 30000, the monitor runs every 1 second looking for expired idle connections and closes them.

...

Skew error when logging into a SAML or Azure SAML tenant

Users logging into a  SAML or Azure SAML tenant may encounter the error "Access Denied.  Authorization Required". Examination of the frevvo.log shows the following entry:

Response issue time is either too old or with date in the future, skew 60, time 2016-06-01T05:49:25.330Z

This error is typically caused by a clock synchronization issue between the Service Provider (frevvo) and the Identity Provider (i.e. Azure) or a genuine delay in the connection. If you get this error, adding the com.frevvo.security.saml.response.skew property can be used to specify the time in seconds allowed between the request and the response from the Identity Provider to a value greater than the default value of 60 seconds.

Follow these steps:

1. Stop frevvo if it is running.
2. Navigate to <frevvo-home>\tomcat\conf
3. Open the frevvo-config.properties file with a text editor.

4. Add the parameter shown below with a value greater than the default value of 60 seconds. The example shown increases the timer to 120 seconds.
   

   Code Block
   com.frevvo.security.saml.response.skew=120

   
   

5. Save the file.

6. Restart .
7. Retry the login.
   

...

Changing the Default Task Notification Email Message

If you want to change the default subject and body of the task notification email for your  server, add these properties to the frevvo-config.properties file.

frevvo.task.notification.email.subject=New task
frevvo.task.notification.email.message=You can access your task list by clicking <a href="{task.perform.url}">this link</a>

Change the value in this parameter to anything you want. The task.perform.url template {task.perform.url} is a built-in template in  and it will always point to the specific task. Refer to the Task Notification Email Link topic for some other options. If you wrap the templates in an HTML <a> tag, it will generate a clickable link in the email.

If you do not want the link in your task notification emails to go there, you can remove it. The default message can include form control templates. 

Security Vulnerabilities

The following security vulnerablities have been addressed as follows:

...

Secure Passwords in Tomcat

Security audits may point out that some secrets are stored in clear text in tomcat configuration files. Here is a list of (known) secrets that are currently stored in clear text by default:

• Tomcat JDBC and SMTP configurations in Tomcat’s <frevvo-home>\tomcat\conf\server.xml

• Database password in <frevvo-home>\tomcat\conf\dbconnector.properties

• Google Connector’s Client Secret in <frevvo-home>\tomcat\conf\frevvo-config.properties

• frevvo’s SAML keystore password in <frevvo-home>\tomcat\bin\setenv.bat and the service.bat files for the Windows OS or setenv.sh for UNIX/Linux OS

Tomcat, and thereby , does not support encryption out of the box. There are two main options for securing this information.

Limit access to Tomcat files

The first option is limiting access to the file so that it can only be read by the user that Tomcat process runs as and root (or the administrator on Windows). Here are two relevant articles about Tomcat passwords that provide suggestions for limiting access and masking sensitive information:

• https://cwiki.apache.org/confluence/display/TOMCAT/Password. 
• https://wiki.owasp.org/index.php/Securing_tomcat#Cleartext_Passwords_in_CATALINA_HOME.2Fconf.2Fserver.xml

For the Database Connector, you can define the data source at the container (tomcat) level for some added security. Please see this documentation which explains how.

OS Environment Variables

Starting in Tomcat v9.0.34 ( v9.0.15+) Tomcat introduced support for environment variables in server.xml. (See Apache Tomcat 9 (9.0.54) - Changelog for details.) This new capability is disabled by default in Tomcat but can be enabled by adding the following property to conf/catalina.properties.

...