Bug #11923
Runtime settings defaults in FWD diverge from the OE counterparts
Start date:
Due date:
% Done:
0%
billable:
No
vendor_id:
GCD
case_num:
version_reported:
version_resolved:
History
#1 Updated by Artur Școlnic 14 days ago
This is a table with all the common settings that have different default values compared to OE:
| # | Area | Setting (OpenEdge / FWD) | OpenEdge default | FWD default | Impact of the divergence |
|---|---|---|---|---|---|
| 1 | AppServer | idleResourceTimeout / idleResourceTimeout |
0 (idle checks off) | 1800000 (idle clean-up every 30 min) | High: FWD disconnects clients idle for more than 30 min (idleSessionTimeout), while an untuned OE instance leaves bound connections alone. Silent: long-lived clients get errors on their next call. |
| 2 | AppServer | agentListenerTimeout / agentListenerTimeout |
10000 | 300000 | Low: only matters when the agent fails to start; FWD then waits 5 min before reporting it. |
| 3 | AppServer | maxAgents / maxAgents |
10 | 1 (setting it higher only logs a warning) | Medium: commonly tuned in production. FWD has no scale-out across agent processes and no isolation between them: one JVM holds every session, so a crash or heap exhaustion hits them all. Capacity comes from maxMsaSessionsPerAgent instead. |
| 4 | AppServer | agentLogFile / agentLogFile |
blank | legacy_client_<datetime>_%uos_%pid_%as.log |
Low: only changes the file name and location; log-shipping or monitoring scripts need adjusting. OE's {yyyy-mm-dd} token does not rotate the log in FWD. |
| 5 | AppServer | agentLogEntryTypes / agentLogEntryTypes |
blank in [AppServer.SessMgr] |
ASPlumbing,DB.Connects (matches the OE instance section) |
Low: FWD logs a bit more by default; OE instances normally set the same value anyway. |
| 6 | AppServer | REST adapterEnabled / rest/enabled |
1 | false | Medium: REST services are unreachable until enabled. Loud and fixed with one setting. |
| 7 | AppServer | SOAP adapterEnabled / soap/enabled |
1 | false | Medium: SOAP services are unreachable until enabled. Loud and fixed with one setting. |
| 8 | AppServer | WEB adapterEnabled / webHandler/enabled |
1 | false | Medium: WebHandler and WebSpeed endpoints are unreachable until enabled. Loud and fixed with one setting. |
| 9 | AppServer | WEB wsRoot / webspeedHandler/basepath |
/static/webspeed |
/ |
Medium for WebSpeed apps that build static-asset URLs from wsRoot (images and scripts return 404); none otherwise. |
| 10 | AppServer | WEB defaultCookieDomain / webspeedHandler/defaultCookieDomain |
the application URL | localhost |
High for WebSpeed apps that set cookies: browsers reject a localhost domain when the app is reached by its real host name, so logins and session state are lost silently. Always set this explicitly. |
| 11 | AppServer | WEB defaultCookiePath / webspeedHandler/defaultCookiePath |
the application URL | / |
Low: cookies are sent to more paths than before; this rarely breaks anything. |
| 12 | AppServer | SOAP wsaUrl / soap/basepath + soap/wsdlPort |
/soap on the instance's HTTP port |
/ws on port 443 |
Medium: the WSDL advertises a different endpoint, so existing SOAP clients and generated stubs must be repointed. Loud. |
| 13 | Web container | Executor maxThreads / JettyThreadPool/maxThreads |
300 | 200 | Low: only reached under heavy concurrent HTTP load, where requests then queue. |
| 14 | Web container | Executor minSpareThreads / JettyThreadPool/minThreads |
10 | 8 | Low: negligible warm-up difference. |
| 15 | Web container | psc.as.https.port / adminPort |
8811 | 9443 | Low: deployment configuration, loud; clients and firewalls need the right port. |
| 16 | Web container | psc.as.http.port / <app>WebApp/port |
8810 | -1 (off); the main FWD server has no HTTP connector | Low-Medium: plain-HTTP clients and internal health probes fail. Loud. |
| 17 | Web container | connectionTimeout / webServerMaxIdleTimeout |
20000 ms | -1, which falls back to Jetty's 30000 ms | Low: idle keep-alive sockets stay open slightly longer. |
| 18 | Web container | web.xml session-timeout / <app>WebApp/sessionTimeout |
30 min | 3600 s | Low: web sessions live twice as long (more memory, longer exposure); only affects third-party webapps. |
| 19 | Security | OECORSFilter.allowAll / web-response-headers |
all origins allowed | none: no origin allowed, preflights get 403 | High for browser front-ends calling REST from another origin: every cross-origin call is blocked until the headers are configured. Loud in the browser console, but blocks everything. |
| 20 | Security | LockOutRealm failureCount / auth-mode/retries |
lockout after 5 failures for 300 s | 0 (only limits retries within one login attempt, never locks the account) | Medium: security posture; FWD offers no brute-force lockout. Silent: nothing fails, the protection is just absent. |
| 21 | Security | http.formlogin.loginurl / <type>/authentication/login_path |
/static/auth/j_spring_security_check |
none, so every call authenticates | Medium if clients use form login: FWD services only do basic authentication, so those clients must change. None for basic-authentication or anonymous clients. |
| 22 | Security | http.logout.url / <type>/authentication/logout_path |
/static/auth/j_spring_security_logout |
/fwdlogout |
Low: only matters when login tokens are used; clients must call the new path. |
| 23 | Security | OESSOTokenManager.ssoTokenRefresh / tokenHeartbeatIntervalSec |
on, every 3600 s | 0 (off) | Low: only with single sign-on; tokens expire instead of being refreshed. |
| 24 | Logging | psc.as.logging.oeabl.level / logging/loggers/root |
WARN (Tomcat's own logger: INFO) | INFO | Low: more verbose logs. Watch out: FWD silently ignores OE level names (WARN, ERROR, DEBUG, TRACE). |
| 25 | Logging | rolling policy / logging/file/rotationLimit |
daily | every 500000 bytes | Low: log-archiving scripts that expect one file per day need changing. |
| 26 | Logging | psc.as.logging.maxhistory / logging/file/rotationCount |
6 | 120 | Low: FWD keeps about 60 MB in total (120 files of 500000 bytes); busy servers can lose history sooner than with 6 daily files. |
| 27 | Logging | console appender / logging/console |
on (INFO) | off | Low: matters only when logs are collected from stdout (containers). |
| 28 | Health | psc.as.health.interval / persistence/health-check/interval |
60 s | 300 s, the lowest it allows | Low: off by default in both; FWD only checks database connectivity. |
#3 Updated by Artur Școlnic 14 days ago
- Assignee set to Artur Școlnic
- Status changed from New to WIP
#4 Updated by Artur Școlnic 13 days ago
- Status changed from WIP to Review
- reviewer Constantin Asofiei added
Defaults changed to match OpenEdge
| # | Setting (FWD key) | OpenEdge default | FWD before | FWD now | File |
|---|---|---|---|---|---|
| 10 | WebSpeed webspeedHandler/defaultCookieDomain |
empty (host-only cookie) | localhost |
empty | util/WebContextOps.java |
| 13 | Jetty JettyThreadPool/maxThreads |
300 | 200 | 300 | web/GenericWebServer.java |
| 14 | Jetty JettyThreadPool/minThreads |
10 | 8 | 10 | web/GenericWebServer.java |
| 18 | Third-party web app <app>WebApp/sessionTimeout |
30 min | 3600 s | 1800 s | web/GenericWebServer.java |
| - | Server response header (not configurable) |
not sent | sent, with the Jetty version | not sent | web/GenericWebServer.java |
| - | Max form POST size for WebSpeed and WebHandler (not configurable) | 2 MB | 200000 bytes | 2 MB | main/LegacyServiceHandler.java, main/WebServiceHandler.java, webspeed/WebspeedHandler.java |
| - | JWT expiry clock skew (not configurable) | 60 s | 0 s | 60 s | security/OidcSsoAuthenticator.java |
Diverging defaults left unchanged
- Changed, then reverted after the code review: 11, 17, and the max form POST size for REST and SOAP
- No FWD mechanism to match: 3, 16, 20, 21, 25, plus URI encoding, directory listings for third-party WARs,
srvrAppMode/srvrDebug, and the JWT audience check - Would expose services or weaken security: 6, 7, 8, 19
- The OpenEdge value does not work in FWD: 2, 9, 28
- Already matches in effect: 1, 5
- Would change existing FWD deployments or make logging worse: 4, 12, 15, 22, 23, 24, 26, 27
Committed to 11923a.