Page Comparison

Category: URL configurations for various common page routing 

LOGIN_PAGE_URL

Mandatory

URL

This key is used to identify the Log in page URL. The URL must not include the context root. For example: If the context root is "dummy" and the log in page is within a folder called "jsp" in the WAR file, then the value would be "/jsp/login.jsp".

LOGIN_PAGE_URL_ROUTING_MODE

Mandatory

Routing Mode

This key is used to identify the log in page URL routing mode.LOGOUT

LOGOUT_PAGE_URL

Mandatory

URL

This key is used to identify the log out page URL. The URL must not include the context root.
For example:
if If the context root is "dummy" and the log in out page is within a folder called "jsp" in the WAR file, then the value is would be "/jsp/simulationlaunchlogout.jsp". Simulation Mode launch is always done as a new page launch. So, no routing mode is needed. This key is required only Simulation mode of Canvas is used by the application. Else this key can be ignored.

SIMULATION_MODE_PAGE_USER_TOKEN_NAME

Optional

String

LOGOUT_PAGE_URL_ROUTING_MODE

Mandatory

Routing Mode

This key is used to identify the log out page URL routing mode.

INVALID_SESSION_PAGE_URL

Mandatory

URL

This key is used to indicate the key under which the user token is shared as part of the Simulation mode launch page URL. This key is required only Simulation mode of Canvas is used by the application. Else this key can be ignored.

FORCE_CHANGE_PWD_PAGE_URL

Optional

URL

This key is used to identify the Force Change Password identify the Invalid Session page URL. The URL must not include the context root. For example:If the context root is "dummy" and the log in page is within a folder called "jsp" in the WAR file, then the value would is be "/jsp/changepasswordinvalidsession.jsp". This URL configuration is needed only if the internal authentication support of Canvas is used.FORCE_CHANGE_PWD_

INVALID_SESSION_PAGE_URL_ROUTING_MODE

OptionalMandatory

Routing Mode

This key is used to identify the Force Change Password Invalid session page URL routing mode. This URL configuration is needed only if the internal authentication support of Canvas is used.

Category: CSRF Configuration

CSRF_VALIDATION_ENABLED

Mandatory

Boolean

This is a boolean configuration to indicate whether CSRF Validation is enabled or not.

CSRF_TOKEN_FIELD_NAME

Mandatory

String

This is the key under which the CSRF Token is sent by the browser to the server. This is applicable only if the CSRF validation is enabled.

CSRF_IGNORE_URLS

Optional

String[]

This is a comma separated list of URIs. This must not include the context root of the application. This is applicable only if the CSRF validation is enabled.

Category: Session Configuration 

IDLE_SESSION_TIMEOUT_SEC

Mandatory

Number

This indicates the idle session time out interval in seconds that must be monitored at the browser level.

ALLOW_MULTI_LOGIN

Mandatory

Boolean

This is a boolean configuration to indicate whether multiple concurrent sessions for a single log in id of the user must be allowed or not.

AUTH_SERV_PROV_CLASS

Mandatory

Class Name

This is the default authentication provider that is to be used during log in / log out / re-authentication purposes. This must implement the interface – com.intellectdesign.canvas.security.IAuthenticationServiceProvider.

HYBRID_POLICY_PROV_CLASS

Mandatory

Class Name

This configuration does not allow capturing the authentication detail during log in, if 'NONE' is set as key value.

LOGIN_MODE

Optional

LOV

This indicates how the log in to the system must happen if there is a direct access to protected content. Possible values are as follows: AUTO - This mode indicates that user log in must happen automatically when the first time the user accesses the protected content. This mode must be used only if there is some kind of SSO solution and the AuthenticationProvider has the necessary capability to log in the user using the SSO. FORM - This mode indicates that the user must be routed to the log in page if the user tries to access protected content directly without log in. BLOCK - This mode indicates that the user must be shown an Access denied page if the user tries to access protected content directly without log in. The default value is BLOCK.

LOG_REQUESTID_AS_REFERENCE

Mandatory

Boolean

This is a boolean configuration to indicate whether the unique Request ID generated by Canvas for each request must be displayed to the end user in case of any errors faced.

CHECK_CLIENT_IP_FOR_SESSION_VALIDATION

Mandatory

Boolean

This is a boolean configuration to indicate whether for every request the Client IP must be validated with that detected at the time of application launch.

CLIENT_IP_PARAM_NAME

Optional

String

This key is used only if the CHECK_CLIENT_IP_FOR_SESSION_VALIDATION key is enabled. This key is optional and can be used to tell the Canvas platform as to how it can retrieve the Client IP from.

CLIENT_IP_PARAM_SCOPE

Optional

LOV

This key is used only if the CHECK_CLIENT_IP_FOR_SESSION_VALIDATION is enabled. This key is optional and used to indicate the exact location from where the custom Client IP key must be read from. The possible values are:

• HEADER - indicating from Request Header
• PARAM - indicating from Request parameters

XFRAMEOPTION_DEFAULT

Optional

LOV

This is the default value for X-FRAME-OPTIONS that must be set in all responses. The possible valid values for this option are:

• DENY
• SAMEORIGIN
  The default value is assumed to be DENY.

XFRAMEOPTION_IGNOREURLS

Optional

URL[]

This contains the comma separated list of URL patterns for which the X-FRAME-OPTIONS header must not be emitted.

Category: Context Root specific configuration

ALL_CONTEXT_ROOTS

Mandatory

String[]

This provides a comma separated list of all context roots enabled for the application. The context roots are the basis by which the ProtectionDomain and the context root level validations get configured.

[Context Root]_VALIDATE_REFERRER_ACTION_FLAG

Optional

Boolean

This key is used to indicate whether Referrer URL needs to be validation for a particular context root. If this is not configured, by default it is treated as "false". For this key to be detected, the context root must have been included in the ALL_CONTEXT_ROOTS list.

[Context Root]_VALID_REFERERS

Optional

URL[]

This key is used to provide the list of valid referrer URLs applicable for that particular Context root. For this key to be detected, the context root must have been included in the ALL_CONTEXT_ROOTS list.

[Context Root]_SKIP_REFERRER_SOURCE_URLS

Optional

URL[]

This key is used to provide the list of URLs for which the referrer validation need not be done. For this key to be detected, the context root must have been included in the ALL_CONTEXT_ROOTS list.

SIMULATION_MODE_PAGE_URL

Optional

URL

This key is used to identify the Simulation Mode launch page URL. The URL must not include the context root.

For example:
if the context root is "dummy" and the log in page is within a folder called "jsp" in the WAR file, then the value is "/jsp/simulationlaunch.jsp". Simulation Mode launch is always done as a new page launch. So, no routing mode is needed. This key is required only Simulation mode of Canvas is used by the application. Else this key can be ignored.

SIMULATION_MODE_PAGE_USER_TOKEN_NAME

Optional

String

This key is used to indicate the key under which the user token is shared as part of the Simulation mode launch page URL. This key is required only Simulation mode of Canvas is used by the application. Else this key can be ignored.

FORCE_CHANGE_PWD_PAGE_URL

Optional

URL

This key is used to identify the Force Change Password page URL. The URL must not include the context root. For example: If the context root is "dummy" and the log in page is within a folder called "jsp" in the WAR file, then the value would be "/jsp/changepassword.jsp". This URL configuration is needed only if the internal authentication support of Canvas is used.

FORCE_CHANGE_PWD_PAGE_URL_ROUTING_MODE

Optional

Routing Mode

This key is used to identify the Force Change Password page URL routing mode. This URL configuration is needed only if the internal authentication support of Canvas is used.

Category: CSRF Configuration

CSRF_VALIDATION_ENABLED

Mandatory

Boolean

This is a boolean configuration to indicate whether CSRF Validation is enabled or not.

CSRF_TOKEN_FIELD_NAME

Mandatory

String

This is the key under which the CSRF Token is sent by the browser to the server. This is applicable only if the CSRF validation is enabled.

CSRF_IGNORE_URLS

Optional

String[]

This is a comma separated list of URIs. This must not include the context root of the application. This is applicable only if the CSRF validation is enabled.

Category: Session Configuration 

IDLE_SESSION_TIMEOUT_SEC

Mandatory

Number

This indicates the idle session time out interval in seconds that must be monitored at the browser level.

ALLOW_MULTI_LOGIN

Mandatory

Boolean

This is a boolean configuration to indicate whether multiple concurrent sessions for a single log in id of the user must be allowed or not.

AUTH_SERV_PROV_CLASS

Mandatory

Class Name

This is the default authentication provider that is to be used during log in / log out / re-authentication purposes. This must implement the interface – com.intellectdesign.canvas.security.IAuthenticationServiceProvider.

HYBRID_POLICY_PROV_CLASS

Mandatory

Class Name

This configuration does not allow capturing the authentication detail during log in, if 'NONE' is set as key value.

LOGIN_MODE

Optional

LOV

This indicates how the log in to the system must happen if there is a direct access to protected content. Possible values are as follows: AUTO - This mode indicates that user log in must happen automatically when the first time the user accesses the protected content. This mode must be used only if there is some kind of SSO solution and the AuthenticationProvider has the necessary capability to log in the user using the SSO. FORM - This mode indicates that the user must be routed to the log in page if the user tries to access protected content directly without log in. BLOCK - This mode indicates that the user must be shown an Access denied page if the user tries to access protected content directly without log in. The default value is BLOCK.

LOG_REQUESTID_AS_REFERENCE

Mandatory

Boolean

This is a boolean configuration to indicate whether the unique Request ID generated by Canvas for each request must be displayed to the end user in case of any errors faced.

CHECK_CLIENT_IP_FOR_SESSION_VALIDATION

Mandatory

Boolean

This is a boolean configuration to indicate whether for every request the Client IP must be validated with that detected at the time of application launch.

CLIENT_IP_PARAM_NAME

Optional

String

This key is used only if the CHECK_CLIENT_IP_FOR_SESSION_VALIDATION key is enabled. This key is optional and can be used to tell the Canvas platform as to how it can retrieve the Client IP from.

CLIENT_IP_PARAM_SCOPE

Optional

LOV

This key is used only if the CHECK_CLIENT_IP_FOR_SESSION_VALIDATION is enabled. This key is optional and used to indicate the exact location from where the custom Client IP key must be read from. The possible values are:

• HEADER - indicating from Request Header
• PARAM - indicating from Request parameters

XFRAMEOPTION_DEFAULT

Optional

LOV

This is the default value for X-FRAME-OPTIONS that must be set in all responses. The possible valid values for this option are:

• DENY
• SAMEORIGIN
  The default value is assumed to be DENY.

XFRAMEOPTION_IGNOREURLS

Optional

URL[]

This contains the comma separated list of URL patterns for which the X-FRAME-OPTIONS header must not be emitted.

Category: Context Root specific configuration

ALL_CONTEXT_ROOTS

Mandatory

String[]

This key is used to identify the current application context path. This provides a comma separated list of all context roots enabled for the application. The context roots are the basis by which the ProtectionDomain and the context root level validations get configured.

[Context Root]_VALIDATE_REFERRER_ACTION_FLAG

Optional

Boolean

This key is used to indicate whether Referrer URL needs to be validation for a particular context root. If this is not configured, by default it is treated as "false". For this key to be detected, the context root must have been included in the ALL_CONTEXT_ROOTS list.

[Context Root]_VALID_REFERERS

Optional

URL[]

This key is used to provide the list of valid referrer URLs applicable for that particular Context root. For this key to be detected, the context root must have been included in the ALL_CONTEXT_ROOTS list.

[Context Root]_SKIP_REFERRER_SOURCE_URLS

Optional

URL[]

This key is used to provide the list of URLs for which the referrer validation need not be done. For this key to be detected, the context root must have been included in the ALL_CONTEXT_ROOTS list.