Unable to set up CORS filter for the OEManager servlet

Jul 21, 2017
Knowledge

Title

URL Name

Unable-to-set-up-CORS-filter-for-the-OEManager-servlet

Article Number

000125023

Environment

Product: OpenEdge Version: 11.5, 11.6, 11.7 OS: All supported platforms

Question/Problem Description

Unable to set up CORS filter for the OEManager servlet

CORS filter can't be successfully configured for OEManager.

The messageHeader and ResponseHeader properties from the OECORSFilter bean configuration are ignored, preventing CORS filtering from being set up for OEManager.

The CORS filter and the bean definition is added to the oemgr<>.xml file. Yet, the OECORSFilter bean configuration is partly ignored by OEManager.

Steps to Reproduce

Clarifying Information

OEManager (oemanager.war) is a Java Web application provides a REST API for remote management and monitoring of ABL applications deployed on a Progress Application Server for OpenEdge (PASOE) instance. It is similar to the administration API supported by the Tomcat Web server’s JMX interface, but it uses JSON input/output payloads.

The following bean config (oemgrSecurity-container.xml) is ignored, for instance:

<b:bean id="OECORSFilter"
class="com.progress.appserv.services.security.OECORSFilter" >


<b:property name="allowAll" value="false" />
<b:property name="allowDomains" value="*" />
<b:property name="allowSubdomains" value="false" />
<b:property name="allowMethods" value="GET,POST,DELETE,OPTIONS" />

<b:property name="messageHeaders" value="Accept,Accept-Language,Accept-Encoding,Authorization,Cache-Control,Connection,Cookie,Host,Upgrade-Insecure-Requests,User-Agent" />
<b:property name="responseHeaders" value="Access-Control-Allow-Origin,Access-Control-Allow-Headers,Access-Control-Allow-Methods,Access-Control-Max-Age,Cache-Control,Content-Type,Date,Expires,Server,Transfer-Encoding,X-CLIENT-CONTEXT-ID,X-OE-CLIENT-CONTEXT-ID,Content-Length,Set-Cookie" />

<b:property name="supportCredentials" value="true" />
<b:property name="maxAge" value="-1" />

</b:bean>

With <b:property name="allowAll" value="true" /> there are no CORS errors, but as a matter of fact, CORS is disabled with that setting.

Error Message

Defect Number

Defect PSC00358769

Enhancement Number

Cause

This is a known issue, caused by the following:

Invalid, static, built-in CORS response headers.
No configurable CORS filter was included in the OEManager's Spring Security configuration files.
The web.xml URL access controls ( for the default container security ) did not correctly allow PUBLIC, non-authenticated, OPTIONS methods for CORS preflight requests.

Resolution

Upgrade to OE 11.7.1.001 or later

The fix for this issue results in customer visible change in behavior, and the requirement to manually update existing OEManager web application deployments.

Updating OEManager web application in existing PASOE installations:

a) Update OEManager in the PASOE server template - if it is deployed (i.e. oemanager exists in the webapps/ directory )

i. Replace the file DLC/servers/pasoe/extras/oemanager.war with the updated oemanager.war file

ii. If the file DLC/servers/pasoe/webapps/oemanager.war exists, replace it with DLC/servers/pasoe/extras/oemanager.war (from step a.i )

iii. From this point forward and newly created PASOE server instances will contain the updated oemanager.war

b) Update the OEManager in PASOE server instances - if it is deployed (i.e. oemanager.war exists in the webapps/ directory)

i. Complete the update of OEManager web application found in a) above

ii. For each PASOE server instance you want to update do this set of steps:

1. cd to /bin

2. undeploy the old oemanager version: tcman.{sh|bat} undeploy oemanager

3. redeploy the updated oemanager version: tcman.{sh|bat} deploy /servers/pasoe/extras/oemanager.war

Configuring the updated OEManager's CORS filter:
The updated OEManager now contains the same CORS filter as is found in all of the oeabl.war web applications.

That CORS filter's default settings are the same as is used in the oeabl.war web applications.

You configure the OEManager's CORS filter using the same Spring properties and properties values as the oeabl.war web application

To modify the OEManager's CORS filter behavior edit the "OECORSFilter" bean properties in the
/webapps/oemanager/WEB-INF/oemgrSecurity-container.xml

You may reference the "OECORSFilter" bean's property descriptions by looking for the "OECORSFilter.xxxxx" descriptions in
the /conf/oeablSecurity.properties.README file.

Workaround

Notes

Keyword Phrase

Last Modified Date

7/21/2017 10:07 AM

Unable to set up CORS filter for the OEManager servlet

Files(0)

Was this article helpful?

Was this article helpful?

Unable to set up CORS filter for the OEManager servlet

Information

Related Articles