AdminHttpApplication (admin.json)

The AdminHttpApplication serves requests on the administrative route, such as the creation of routes and the collection of monitoring information. The administrative route and its subroutes are reserved for administration endpoints.

The configuration is loaded from a JSON-encoded configuration file, expected by default at $HOME/.openig/config/admin.json.

Default Objects

IG creates the following objects by default in admin.json:

AuditService

Records no audit events. The default AuditService is NoOpAuditService. For more information, see "NoOpAuditService".

CaptureDecorator

Captures requests and response messages. The default CaptureDecorator is named capture. For more information, see "CaptureDecorator".

ClientHandler

Communicates with third-party services. For more information, see "ClientHandler".

ForgeRockClientHandler

Sends ForgeRock Common Audit transaction IDs when communicating with protected applications. The default ForgeRockClientHandler is a Chain, composed of a TransactionIdOutboundFilter and a ClientHandler.

ReverseProxyHandler

Communicates with third-party services. For more information, see "ReverseProxyHandler".

ScheduledExecutorService

Specifies the number of threads in a pool.

SecretsService

Manages a store of secrets from files, system properties, and environment variables, by using ForgeRock Commons Secrets Service. The default SecretsService is a SystemAndEnvSecretStore with the default configuration. For more information, see Secret Stores.

TemporaryStorage

Manages temporary buffers. To change the default values, add a TemporaryStorage object named TemporaryStorage, and use non-default values. For more information, see "TemporaryStorage".

TimerDecorator

Records time spent within filters and handlers. The default TimerDecorator is named timer. For more information, see "TimerDecorator".

TransactionIdOutboundFilter

Inserts the ID of a transaction into the header of a request.

Provided Objects

IG creates the following objects when a filter with the name of the object is declared in admin.json:

"ApiProtectionFilter"

The default filter used to protect administrative APIs on reserved routes. To override this filter, declare a different filter with the same name in admin.json.

By default, only the loopback address can access reserved routes.

For information about reserved routes, see "Reserved Routes".

"MetricsProtectionFilter"

A filter used to protect the monitoring endpoints.

By default, the Prometheus Scrape Endpoint and Common REST Monitoring Endpoint are open and accessible. No special credentials or privileges are required to access the monitoring endpoints.

To protect the monitoring endpoints, declare a different filter with the same name in admin.json.

For an example of how to manage access, see "Protecting the Monitoring Endpoints".

"StudioProtectionFilter"

A filter to protect the Studio endpoint when IG is running in development mode.

When IG is running in development mode, by default the Studio endpoint is open and accessible. Use this filter to restrict access to Studio in development mode.

For information about accessing Studio, see the Studio User Guide.

For information about restricting access to Studio in development mode, see Restricting Access to Studio.

Usage

{
   "heap": [ configuration object, ... ],
   "connectors": configuration object,
   "vertx": object,
   "gatewayUnits": configuration expression<number>,
   "mode": enumeration,
   "prefix": configuration expression<string>,
   "properties": JSON object,
   "secrets": configuration object,
   "temporaryDirectory": configuration expression<string>,
   "temporaryStorage": TemporaryStorage reference,
   "preserveOriginalQueryString": configuration expression<boolean>,
   "session": configuration object
}

Properties

"connectors": array of configuration objects, required

Note

This property is used only when IG is running in standalone mode.

Server port configuration, when IG is server-side.

When an application sends requests to IG, or requests services from IG, IG is acting as a server of the application (server-side), and the application is acting as a client. 

{
  "connectors" : [
    {
      "port": configuration expression<number>, ...
      "tls": ServerTlsOptions reference,
      "vertx": object
    },
    {
      ...
    },
  ]
}
port: configuration expressions<number>, required

Port on which IG is connected. When more than one port is defined, IG is connected to each port.

tls: ServerTlsOptions reference, optional

Configure options for connections to TLS-protected endpoints, based on "ServerTlsOptions". Define the object inline or in the heap.

Default: Connections to TLS-protected endpoints are not configured.

vertx: object, optional

Vert.x-specific configuration for this connector, where IG does not provide its own first-class configuration. Vert.x options are described in HttpServerOptions.

For properties where IG provides its own first-class configuration, Vert.x configuration options are disallowed, and the IG configuration option takes precedence over Vert.x options configured in vertx. The following Vert.x configuration options are disallowed server-side:

  • port

  • useAlpn

  • ssl

  • enabledCipherSuites

  • enabledSecureTransportProtocols

  • jdkSslEngineOptions

  • keyStoreOptions

  • openSslEngineOptions

  • pemKeyCertOptions

  • pemTrustOptions

  • pfxKeyCertOptions

  • pfxTrustOptions

  • trustStoreOptions

  • clientAuth

The following example configures Vert.x-specific options for the connection on 8080, and TLS options for the connection on 8443: 

{
  "connectors": [{
    "port": 8080,
    "vertx": {
      "maxWebSocketFrameSize": 128000,
      "maxWebSocketMessageSize": 256000,
      "compressionLevel": 4
    }
  },
  {
    "port": 8443,
    "tls": "ServerTlsOptions-1"
  }]
}
vertx: object, optional

Note

This property is used only when IG is running in standalone mode.

Vert.x-specific configuration used to more finely-tune Vert.x instances. Vert.x options are described in VertxOptions.

"gatewayUnits": configuration expression<number>, optional

Note

This property is used only when IG is running in standalone mode.

The number of parallel instances of IG to bind to an event loop. All instances listen on the same ports.

Default: The number of cores available to the JVM.

mode: operating mode, optional

Set the IG mode to development or production. The value is not case-sensitive.

  • Development mode (mutable mode)

    In development mode, by default all endpoints are open and accessible.

    You can create, edit, and deploy routes through IG Studio, and manage routes through Common REST, without authentication or authorization.

    Use development mode to evaluate or demo IG, or to develop configurations on a single instance. This mode is not suitable for production.

    For information about how to switch to development mode, see "Switching from Production Mode to Development Mode".

    For information about restricting access to Studio in development mode, see Restricting Access to Studio.

  • Production mode (immutable mode)

    In production mode, the /routes endpoint is not exposed or accessible.

    Studio is effectively disabled, and you cannot manage, list, or even read routes through Common REST.

    By default, other endpoints, such as /share and api/info are exposed to the loopback address only. To change the default protection for specific endpoints, configure an ApiProtectionFilter in admin.json and add it to the IG configuration.

    For information about how to switch to production mode, see "Switching From Development Mode to Production Mode".

If mode is not set, the provided configuration token ig.run.mode can be resolved at startup to define the run mode.

Default: production

"heap": array of configuration objects, optional

The heap object configuration, described in "Heap Objects".

You can omit an empty array.

"prefix": configuration expression<string>, optional

The base of the route for administration requests. This route and its subroutes are reserved for administration endpoints.

Default: openig

"properties": JSON object, optional

Configuration parameters declared as property variables for use in the configuration. See also Properties.

Default: none

"secrets": configuration object, optional

An object that configures an inline array of one or more secret stores, as defined in "Default Secrets Object".

"temporaryDirectory": configuration expression<string>, optional

Directory containing temporary storage files.

Set this property to store temporary files in a different directory, for example: 

{
   "temporaryDirectory": "/path/to/my-temporary-directory"
}

Default: $HOME/.openig/tmp (on Windows, %appdata%\OpenIG\tmp)

"temporaryStorage": TemporaryStorage reference, optional

Cache content during processing based on this TemporaryStorage configuration.

Provide either the name of a TemporaryStorage object defined in the heap, or an inline TemporaryStorage configuration object.

Incoming requests use the temporary storage buffer as follows:

  • In standalone mode, the request is loaded into the IG temporary storage buffer, before it enters the chain. If the content length of a request is more than the buffer limit, IG returns an HTTP 413 Payload Too Large immediately.

  • In web container mode, the request is loaded into the web container buffer, which is managed externally. IG does not access the web container buffer until a filter, handler, or other object tries to access the request body. At that point, IG transfers the content of the web container buffer to its own temporary storage. If the web container buffer is bigger than the IG temporary storage, a buffer exception occurs.

Default: Use the heap object named TemporaryStorage. Otherwise use an internally-created TemporaryStorage object that is named TemporaryStorage, and that uses default settings for a TemporaryStorage object.

See also "TemporaryStorage".

"preserveOriginalQueryString": configuration expression<boolean>, optional

Process query strings in URLs, by applying or not applying a decode/encode process to the whole query string.

The following characters are disallowed in query string URL components: ", {, }, <, >, (space), and |. For more information about which query strings characters require encoding, see Uniform Resource Identifier (URI): Generic Syntax.

  • true: Preserve query strings as they are presented.

    Select this option if the query string must not change during processing, for example, in signature verification.

    If a query string contains a disallowed character, the request produces a 400 Bad Request.

  • false: Tolerate disallowed characters in query string URL components, by applying a decode/encode process to the whole query string.

    Select this option when a user agent or client produces query searches with disallowed characters. IG transparently encodes the disallowed characters before forwarding requests to the protected application.

    Characters in query strings are transformed as follows:

    • Allowed characters are not changed.

      For example, sep=a is not changed.

    • Percent-encoded values are re-encoded when the decoded value is an allowed character.

      For example, sep=%27 is changed to sep=', because ' is an allowed character.

    • Percent-encoded values are not changed when the decoded value is a disallowed character.

      For example, sep=%22 is not changed, because " is a disallowed character.

    • Disallowed characters are encoded.

      For example, sep=", is changed to sep=%22, because " is a disallowed character.

Default: false

"session": configuration object, optional

Important

Supported only for IG in standalone mode.

Configures stateful sessions for IG in standalone mode. For information about IG sessions, see "Sessions". 

{
  "session": {
    "cookie": {
      "name": configuration expression<string>,
      "httpOnly": configuration expression<boolean>,
      "secure": configuration expression<boolean>,
      "path": configuration expression<string>
    },
    "timeout": configuration expression<duration>
  }
}
"cookie": object, optional

The configuration of the cookie used to store the stateful session.

Default: The cookie is treated as a host-based cookie.

"name": configuration expression<string>, optional

The session cookie name.

Default: IG_SESSIONID

"httpOnly": configuration expression<boolean>, optional

Flag to mitigate the risk of client-side scripts accessing protected cookies.

Default: true

"secure": configuration expression<boolean>, optional

Flag to limit the scope of the cookie to secure channels.

Set this flag only if the user-agent is able to re-emit cookies over HTTPS on its next hop. For example, to re-emit a cookie with the `secure` flag, the user-agent must be connected to its next hop by HTTPS.

Default: false

"path": configuration expression<boolean>, optional

Flag to limit the scope of the cookie to secure channels.

Set this flag only if the user-agent is able to re-emit cookies over HTTPS on its next hop. For example, to re-emit a cookie with the `secure` flag, the user-agent must be connected to its next hop by HTTPS.

Default: /

"timeout": configuration expression<duration>, optional

The duration after which idle sessions are automatically timed out.

The value must be above zero, and no greater than 3650 days (approximately 10 years). {projectName} truncates the duration of longer values to 3650 days.

Default: 30 minutes

Example Configuration Files

Default Configuration

When your configuration does not include an admin.json file, the following admin.json is provided by default: 

{
  "prefix" : "openig"
}

{
  "prefix": "openig",
  "connectors": [
    { "port" : 8080 }
  ]
}

Overriding the Default ApiProtectionFilter

The following example shows an admin.json file configured to override the default ApiProtectionFilter that protects the reserved administrative route. This example is used in "Setting Up the UMA Example". 

{
  "prefix": "openig",
  "connectors": [
    { "port" : 8080 }
  ],
  "heap": [
    {
      "name": "ClientHandler",
      "type": "ClientHandler"
    },
    {
      "name": "ApiProtectionFilter",
      "type": "CorsFilter",
      "config": {
        "policies": [
          {
            "origins": [ "http://app.example.com:8081" ],
            "acceptedMethods": [ "GET", "POST", "DELETE" ],
            "acceptedHeaders": [ "Content-Type" ]
          }
        ]
      }
    }
  ]
}
{
  "prefix": "openig",
  "heap": [
    {
      "name": "ClientHandler",
      "type": "ClientHandler"
    },
    {
      "name": "ApiProtectionFilter",
      "type": "CorsFilter",
      "config": {
        "policies": [
          {
            "origins": [ "http://app.example.com:8081" ],
            "acceptedMethods": [ "GET", "POST", "DELETE" ],
            "acceptedHeaders": [ "Content-Type" ]
          }
        ]
      }
    }
  ]
}

Read a different version of :