Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Section


Column
width800px

frevvo configuration properties are configured in the frevvo-config.properties file in the <frevvo-home>\tomcat\conf directory. The frevvo-config.properties is a standard java properties file. Any valid context parameter can be configured as a property in this file. This file contains properties that define global customizations that apply to the <frevvo home>\tomcat\webapps\frevvo directory and the frevvo connector warfiles (Database Connector, Filesystem, SharePoint). For example, you can provide the client secret information for the Google Connector with a property in this file. 

The properties that can be added to the frevvo-config.properties file are discussed below. The configuration properties in the frevvo-config.properties file will override the properties configured in <frevvo-home>\tomcat\conf\server.xml file. Parameters, previously configured in the web.xml file included in the frevvo.war must be added to the frevvo-config.properties file as well.

Info

frevvo only supports/certifies frevvo running in the tomcat container. Refer to our Supported Platforms for the list of Application Servers supported/certified by frevvo.

Converting Context Parameters to Properties  

The configuration properties follow a simple property name=value syntax. Let's say you had context parameters to default the tenant login and customize the placeholder on the login screen in the frevvo.xml file of your previous installation.

 The context parameters in frevvo.xml would look like this:

Code Block
titlefrevvo.xml from your previous installation
<Parameter name="frevvo.default.login.tenant.id" value="your_tenant_id" override="false"/>
<Parameter name="frevvo.login.username.placeholder" value="user@<your_tenant_name>" override="false"/>

The configuration properties follow a simple property name=value syntax. Follow these steps to convert configuration parameters from previous releases to properties in the frevvo-config.properties file.

  1. Navigate to <frevvo-home>/tomcat/conf directory.
  2. Edit the frevvo-config.properties file.

  3. The Parameter name becomes the property name.
  4. Add an equal sign
  5. Add the value after the equal sign
  6. Repeat this for all custom parameters
  7. Save the file
Code Block
titlefrevvo-config.properties file in the v7.4.x installation
#Custom Tenant Id and Placeholder
frevvo.default.login.tenant.id=<your_tenant_id>
frevvo.login.username.placeholder=<@<your tenant name>

Here is an example of a frevvo-config.properties file that provides the URL for the Filesystem connector, a property to turn on/off the Insight Server and a property to turn on DEBUG level logging for the frevvo.log and any frevvo connector logfiles.

Code Block
frevvo.filesystem.connector.url=http(s)://<your server>:port/filesystem 
insight.enabled=true insight.service.url=http(s)://<your server>:port/insight 
frevvo.sharepoint.connector.url=http(s)://<your server>:port/sharepoint 
logging.level.root=DEBUG

Updating the frevvo-config.properties requires server restart. You do not have to restart the Insight server.

frevvo tomcat bundle

In the frevvo tomcat bundle, the frevvo-config.properties file is located in the <frevvo-home>\tomcat\conf directory. The path to the frevvo-config.properties file is specified in the <frevvo-home>\tomcat\bin\sentenv.bat.sh files

Code Block
set CATALINA_OPTS=%CATALINA_OPTS% -Dspring.config.location="file:///%CATALINA_HOME%/conf/,file:///%CATALINA_HOME%/conf/frevvo-config.properties"



Column
width400px

On this page:

Table of Contents
maxLevel1


...

frevvo is a multi-tenant application. See the administration section on Manage Tenants. However, it is possible that all you need is a single tenant. If this is your case, it simplifies the frevvo server login if you default the @<tenantname> so the user only needs to enter their username to login. Customers who default the tenant login normally would also 1069267438Customizing the placeholder on the login screen. Please read that topic for details.

  1. Stop frevvo if it is running.
  2. Navigate to the <frevvo-home>\tomcat\conf directory
  3. Open the frevvo-config.properties file with a text editor.
  4. Add the frevvo.default.login.tenant.id property to the <frevvo-home>\tomcat\conf\frevvo-config.properties file and set the param-value to the name of your one tenant.

    Code Block
    titlefrevvo-config.properties
    frevvo.default.login.tenant.id=<your_tenant_id> 
    


  5. Save the file
  6. Restart frevvo.

...

You may want to customize the user@tenant placeholder on the login screen to reflect the name of your frevvo tenant to minimize confusion for your users or to remove the @tenant from the placeholder if you have defaulted the tenant login. 


On Premise customers can change the default placeholder on the login screen by modifying the values for the frevvo.login.username.placeholder property.

...

  • Unable to contact license server
  • Unable to renew license. Your license will expire in <n> day(s)

External URLs

The External URL should always be set up when frevvo tomcat is running behind a proxy. Setting the correct external URL is necessary when frevvo either redirects to an external system that is sensitive to the originating address e.g. SAML Identity Provider, OAuth server, etc. or generates a URL for external use e.g. a share URL

Tomcat is already configured to accept the standard x-forwarded headers. If the proxy is providing these in the request then nothing needs to be done. If the headers are custom, then frevvo can be configured to do the translation. If these headers are not being provided, then you need to configure the tomcat connector proxy attributes.

...

This is the most flexible setup. You do not need to make any changes in frevvo to use this as tomcat is already configured to handle the standard x-forwarded headers which are as follows:

  • X-Forwarded-Proto: the protocol of the incoming request (http or https).
  • X-Forwarded-Host: the host name of the incoming request
  • X-Forwarded-Port: the port of the incoming request

...

Expand
titleClick here to see an example...

For example, if you prefer to use a parameter called X-Fwd-Scheme instead of X-Forwarded-Proto, simply add the appropriate context parameter and make sure that your proxy is setting a header with the new name.

The defaults are shown below. Replace the values on the right side of the '=' with your corresponding custom header name.

Code Block
titlefrevvo-config.properties
//Defaults - replace values with your custom headers
server.tomcat.host-header=X-Forwarded-Host
server.tomcat.port-header=X-Forwarded-Port
server.tomcat.remote-ip-header=X-Forwarded-For
server.tomcat.protocol-header=X-Forwarded-Proto

//Example of a non-standard header name
server.tomcat.protocol-header=X-Fwd-Scheme


Configure a Tomcat Proxy

Proxy attributes are set up on the tomcat connector that the proxy is forwarding requests to, which could be the HTTPS or the HTTP connector of the <frevvo-home>\tomcat\conf\server.xml file. For example, if SSL is being terminated in the proxy then it forwards to the HTTP connector (as shown below). Add the properties proxyName, proxyPort, scheme and secure

...

frevvo uses a connector on port 8081 for internal requests. As indicated in the server.xml, changing the frevvo internal connector 8081 settings in the server.xml file can cause unexpected changes, and is not advised. 

The connector with port 8081 is configured in the server.xml file. Please ensure this port is available for frevvo to use. 

...

If you need to change the internal port, follow these instructions. The only case where frevvo.internal.port may need to be changed is if port 8081 is already in use by another application.

  1. In the server.xml, replace port 8081 in all locations with the port number of your choice. Make sure the new port is open and available for frevvo's use.

    Code Block
    <Connector address="127.0.0.1" port="<port>" protocol="org.apache.coyote.http11.Http11NioProtocol"
                   connectionTimeout="40000"
                   maxHttpHeaderSize="32768"
                   useBodyEncodingForURI="true" />


  2. In the frevvo-config.properties file, add the frevvo.internal.port property and set it to the same port number used in step 1.

    Code Block
    frevvo.internal.port=<port>


...

frevvo uses a connector on port 8082 for external requests. By default the frevvo tomcat bundle is configured to bind to port 8082. Please ensure this port is available for frevvo to use. You can change the port by:

...

Code Block
languagehtml/xml
<!-- HTTPS Connector
-->
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
        maxThreads="150" scheme="https" secure="true" clientAuth="false"
        sslProtocol="TLS" keystoreFile="${catalina.home}/conf/keystore" keystorePass="password"
        connectionTimeout="20000" maxHttpHeaderSize="32768"
        useBodyEncodingForURI="true" />


frevvo recommends reviewing your Certificate Authority's documentation for detailed steps to configure your certificate in Apache Tomcat. Additional info on how to use SSL on tomcat can be found on the Apache/Tomcat website

There are multiple ways of configuring certificates depending on their format. For example, a PKCS#12 (pfx or p12) certificate doesn't have to be imported into the keystore. It can be configured directly as:

Code Block
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
       scheme="https" secure="true"
       clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1+TLSv1.1+TLSv1.2"
       keystoreFile=C:\CERTDIRECTORY\CERT.pfx" keystorePass="YourPassword" keystoreType="PKCS12" 
       connectionTimeout="40000" maxHttpHeaderSize="32768" useBodyEncodingForURI="true"/>

However, PKCS#7 or P7B formats require importing the certificate chain into the keystore. The Certificate Authority needs to provide all the intermediate certificates to be imported. 

Currently, you must not disable frevvo's HTTP port. In a future release this will be allowed. Disabling frevvo's HTTP port will cause your form server to malfunction as frevvo requires this port. For most cases, it is sufficient to share the HTTPS version of your form/workflow's URL and leave HTTP open. However, if you want to force all form usage to be over HTTPS and feel it is not enough to simply share the HTTPS form URLs (as a user can switch to HTTP as long as that port is open), we recommend that you deploy frevvo behind an Apache or IIS server. Close the HTTP port on Apache or IIS but leave tomcat's HTTP port open so that frevvo can POST back to itself when needed over HTTP but no one outside can access it.

...

Note
  • There will be three additional logfiles when running Tomcat as a Windows service:
    • frevvoforms - stderr.YYYYMMDD and frevvoforms - stdout.YYYYMMDD for standard error messages and standard output stream, respectively. This is the default Tomcat behavior.
    • commons-daemon.YYYY-MM-DD.log for Windows Service errors
  • The Insight server no longer creates a log since the insight.war is integrated into frevvo.war. The messages formerly in the insight logs are now found in the in the <frevvo-home>/tomcat/frevvo_YYYY-MM-DD.log

...

frevvo no longer supports the web.xml parameters for frevvo.xforwarded.protocol.header, frevvo.xforwarded.host.header, and frevvo.xforwarded.port.headers. The general recommendation is to rely on the Servlet Container for handling dynamic proxies. A better approach is to use tomcat's RemoteIp Valve instead.  Please see this documentation on the Apache Tomcat website for information about the RemoteIp valve functionality. This tomcat valve has been incorporated into our frevvo tomcat bundle.

Code Block
 <Valve className="org.apache.catalina.valves.RemoteIpValve"
            internalProxies=".*" 
            remoteIpHeader="x-forwarded-for" 
            proxiesHeader ="x-forwarded-by" 
            protocolHeader="x-forwarded-proto" />

...

The frevvo API uses an http connection pool which implies that connections are reused for a given route. In some cases, an API call (such as a rule or doc action) may fail intermittently due to a connection reset or a socket read timeout. Setting the property http.connection.maxidletime in the frevvo-config.properties file may resolve this issue. This property sets the idle time in milliseconds beyond which the connection will be closed by the monitor. By default, it is not set and hence there is no monitor running. Once it is configured with a positive value e.g. 30000, the monitor runs every 1 second looking for expired idle connections and closes them.

...

Skew error when logging into an Azure SAML tenant

Users logging into a frevvo Azure SAML tenant may encounter the error "Access Denied.  Authorization Required". Examination of the frevvo.log shows the following entry:

Code Block
Response issue time is either too old or with date in the future, skew 60, time 2016-06-01T05:49:25.330Z

This error is typically caused by a clock synchronization issue between the Service Provider (frevvo) and the Identity Provider (Azure) or a genuine delay in the connection. If you get this error, adding the com.frevvo.security.saml.response.skew property can be used to specify the time in seconds allowed between the frevvo request and the response from Azure to a value greater than the default value of 60 seocnds.

Follow these steps:

  1. Stop frevvo if it is running.
  2. Navigate to <frevvo-home>\tomcat\conf
  3. Open the frevvo-config.properties file with a text editor.
  4. Add the parameter shown below with a value greater than the default value of 60 seconds. The example shown increases the timer to 120 seconds.

    Code Block
    com.frevvo.security.saml.response.skew=120


  5. Save the file.

  6. Restart frevvo.
  7. Retry the login.

...

Changing the Default Task Notification Email Message

If you want to change the default subject and body of the task notification email for your frevvo server, add these properties to the frevvo-config.properties file.

Code Block
frevvo.task.notification.email.subject=New task
frevvo.task.notification.email.message=You can access your task list by clicking <a href="{task.perform.url}">this link</a>

Change the value in this parameter to anything you want. The task.perform.url template {task.perform.url} is a built-in template in frevvo and it will always point to the specific task. Refer to the Task Notification Email Link topic for some other options. If you wrap the templates in an HTML <a> tag, it will generate a clickable link in the email.

If you do not want the link in your task notification emails to go there, you can remove it. The default message can include form control templates. 

Non-default Database Schema

If you use a custom schema (anything other than 'dbo'), you must add the following property to the <frevvo home>/tomcat/conf/frevvo-config.properties file. This property's default value is 'dbo'.

...

Secure Passwords in Tomcat

Security audits may point out that some secrets are stored in clear text in tomcat configuration files. Here is a list of (known) secrets that are currently stored in clear text by default:

  • Tomcat JDBC and SMTP configurations in Tomcat’s <frevvo-home>\tomcat\conf\server.xml

  • Database password in <frevvo-home>\tomcat\conf\dbconnector.properties

  • Google Connector’s Client Secret in <frevvo-home>\tomcat\conf\frevvo-config.properties

  • frevvo’s SAML keystore password in <frevvo-home>\tomcat\bin\setenv.bat and the service.bat files for the Windows OS or setenv.sh for UNIX/Linux OS

Tomcat, and thereby frevvo, does not support encryption out of the box. There are two main options for securing this information.

Limit access to Tomcat files

The first option is limiting access to the file so that it can only be read by the user that Tomcat process runs as and root (or the administrator on Windows). Here are two relevant articles about Tomcat passwords that provide suggestions for limiting access and masking sensitive information:

For the Database Connector, you can define the data source at the container (tomcat) level for some added security. Please see this documentation which explains how.

OS Environment Variables

Starting in Tomcat v9.0.34 (frevvo v9.0.15+) Tomcat introduced support for environment variables in server.xml. (See Apache Tomcat 9 (9.0.54) - Changelog for details.) This new capability is disabled by default in Tomcat but can be enabled by adding the following property to conf/catalina.properties.

...