Listeners

The HTTP, TCP, and SOAP listeners have the same type of basic parameters.

NODE

Defines the logical name of a node block. The settings are:

For HTTP - LST_HTTP.

For TCP - LST_TCP.

For SOAP - LST_SOAP.

PORT

Defines the port number that a listener is listening on. The default value for the HTTP listener is 8117. The default value for the TCP listener is 8116.

HOST

Defines an IP address that a listener is listening on. If blank, the listener will listen on all IP addresses.

The HTTP, TCP, and SOAP listeners have the following security parameter:

RESTRICT_TO_IP

Defines the name of a host or IP address(es) that will be accepted by the listener. The syntax is

hostname, xxx.xxx.xxx.xxx, yyy.yyy.yyy, ...

The address must be in base 256 standard dot notation. For platforms that support IPv6, IPv6 notation can be used if it is enabled (for example, 2001:1b1:719:1b1:203:baff:fe0a:fe23)

The internal default is *.*.*.*, which allows all IP addresses.

Note: You can use a wildcard to mask an entire section of the address, as in the following examples:

172.204.201.*
172.*.*.*
172.204.*.*
2001:1b1:719:1b1:203:baff:*:fe23

Partial masking is not supported, for example:

172.204.201.1*
172.204.201.*23

The HTTP listener has the following additional parameters:

Security

SECURITY

Defines the authentication protocol used by a secured listener. This parameter can only be set if OPSYS is the primary security provider. The valid values are:

• Default. This is the default value, which does not add a SECURITY attribute in the HTTP listener node of odin.cfg.
• Kerberos or NTLM. This setting adds the attribute SECURITY=KERBEROS in the HTTP listener node of odin.cfg.

  Kerberos is only available on Windows, Linux, and IBM i. Kerberos supports passing an authentication ticket between multiple computers (multiple hops). For example, the Kerberos authentication ticket can be passed from a browser computer to a server computer to a DBMS computer. For Kerberos authentication to work, computers must be configured for Kerberos. Contact your administrator for instructions on configuring Kerberos in your environment.

  NTLM is only available on Windows and supports Integrated Windows Authentication (IWA) between two computers (for example, a browser computer to a server computer or a server computer to a DBMS computer).

• NTLM only. This setting adds the attribute SECURITY=IWA (Integrated Windows Authentication) in the HTTP listener node of odin.cfg.

  IWA is only available on Windows and supports authentication between two computers (for example, a browser computer to a server computer or a server computer to a DBMS computer).

To configure the server for Kerberos on Linux and IBM i, you must set the following properties:

1. First, on the Access Control page, enter the SPN (Service Principal Name) in the krb5_srv_principal field. Contact your Domain Administrator for information.
2. Select Kerberos or NTLM for the SECURITY parameter in the HTTP Listener properties.
3. Create local user IDs on Linux or IBM i matching domain users that will connect to the server using Kerberos.

The following table shows the effects of the Security settings on authentication.

SECURITY Setting	SECURITY attribute in odin.cfg	Server Machine Configured for Delegation Browser and Server on Same Machine	Server Machine Configured for Delegation Browser and Server on Different Machines	Server Machine Not Configured for Delegation Browser and Server on Same Machine	Server Machine Not Configured for Delegation Browser and Server on Different Machines
Default	None	Explicit Connection. User prompted for credentials.	Explicit Connection. User prompted for credentials.	Explicit Connection. User prompted for credentials.	Explicit Connection. User prompted for credentials.
Kerberos or NTLM	SECURITY = KERBEROS	IWA	KERBEROS	IWA	Fails to connect and issues Session Lost message. Edaprint contains message that the server was unable to initialize Kerberos and an explicit connection is required.
NTLM only	SECURITY=IWA	IWA	IWA	IWA	IWA

LOGIN_FAILURE

Defines the type of message shown for a login error. The valid values are:

0 - Shows a general error message.

1 - Shows a precise error message.

The default value is 0.

LOGIN_HIDE_PROVIDERS

Defines whether available security providers or domains should be shown in the login screen. The valid values are:

• 0 - shows all available security providers or domains.
• 1 - hides all available security providers or domains.

CSRF_TOKEN

Defines whether a secret token should be used in all form submissions. This is used to prevent cross-site request forgery attacks. The valid values are:

• 0 - disable CSRF token.
• 1 - enable CSRF token.

SANITIZE_PARAMETERS

Defines whether the HTTP listener should sanitize all submitted form parameters. Valid values are zero (0) to disable sanitizing of form parameters, or 1 to enable sanitizing of form parameters. The default value is 1.

VERIFY_REFERER

Defines whether to verify the HTTP referer header. Valid values are zero (0) to disable verifying the referer header, or 1 to enable verifying the referer header. The default value is 1.

X_FRAME_OPTIONS

Defines whether a browser should be allowed to render the Web Console in a frame. Valid values are:

• NONE. This is available for the HTTP Listener only. The Web Console can be displayed in a frame.
• DENY. The Web Console cannot be displayed in a frame.
• SAMEORIGIN. The Web Console can only be displayed in a frame on the same origin as the page itself. This is the default value.

Enable HTTPS

Enables HTTPS support, either for OpenSSL or Microsoft Windows SSL.

Both types have the following additional parameters:

SSL_CERTIFICATE

Defines the SSL certificate. The default certificate name for Microsoft SSL is iwaycert.p12.

SSL_PASSPHRASE_E

If the private key of the certificate is encrypted, an encrypted passphrase must be provided to decrypted the private key.

The following additional parameters are specific to OpenSSL:

SSL_PRIVATE_KEY

Defines the file that contains the private key for the listener. It must correspond to the public key embedded in the PEM certificate and must be in PEM format.

SSL_CA_CERTIFICATE

Defines the file containing the trusted CA certificate in PEM format. It is used to verify the client certificate. If the client fails to send the certificate or if verification fails, connections will be rejected. More than one CA certificate may be present in the file.

The following additional parameter is specific to Microsoft SSL:

SSL_FRIENDLY_NAME

Indicates a name used to identify the certificate in the PKCS#12 file, if the file contains more than one certificate.

SSL_AUTH_CLIENT

Defines whether client authentication should be enabled. Valid values are:

• 0 (zero). The Client is not asked for a certificate. There is no client authentication. This is the default value.
• 1. The server requests a certificate from the client. All received certificates are validated. If the client fails to send a certificate or verification fails, connections will be rejected.

Sessions Control

PERSISTENT_GLOBAL

Defines whether global FOCUS variables will be persistent within a browser session. The valid values are:

0 - Global variables are not persistent within a browser session.

1 - Global variables are persistent within a browser session.

The default value is 0.

PASS_EXPIRE_NOTIFICATION

Determines whether users receive a password expiration notification by defining the number of days before expiration at which a notification will occur. The default value is 0, meaning no notification.

MAX_WEBSESSION

Defines the maximum number of active sessions. The HTTP listener will reject connections to the Web Console if this number is reached. The default value is 0, meaning no limit.

TIMEOUT_WARNING

Defines how many minutes before session expiration a warning message will be displayed. The default value is zero (0), which means there is no timeout warning message.

LOG_LAST_REQUESTS

Defines the maximum number of last requests in a session that will be collected as statistics. The default value is 10.

Alias

IBI_HTML

Defines a URL alias for the primary file lookup directory. Lookup is performed first in the directory described by this alias. The default value is $EDAHOME/etc.

HTML_HOME

Defines a comma-delimited list of directories for file lookup. Directories are searched in the order in which they appear in this list.

SESSION_EXPIRATION

This parameter has been deprecated and has been combined with the foccache_maxage parameter, in order to make sure that no foccache files remain when the session has expired. For more information about the foccache_maxage parameter, see Application Settings.

Miscellaneous Settings

DEFAULT_HOST

Defines the preferred hostname or IP address for the listener when a listener has multiple IP addresses or hostnames.

PROXY_SERVER

Runs the HTTP Listener as a proxy server. The valid values are:

0 - Proxy server for the HTTP protocol is off.

1 - Proxy server for the HTTP protocol is on.

The default value is 0.