This release of OpenIG includes the following new capabilities:

Throttling Filter

The throttling filter has been extended to support different throttling rates (OPENIG-595).

OpenIG can now apply different throttling rates to different groups of requests. Before this release, only one throttling rate could be applied. Requests are categorized into groups by the evaluation of an expression. The throttling rate for each request group can be mapped in memory or configured by a script.

For more information, see Chapter 16, "Throttling the Rate of Requests to a Protected Application" in the Gateway Guide and ThrottlingFilter(5) in the Configuration Reference.

SLF4J Logging in OpenIG

The Simple Logging Facade for Java (SLF4J) is now provided in OpenIG, allowing you to define different logging behavior for routes and third-party dependencies (OPENIG-920).

Before this release, some but not all log messages from SLF4J loggers were included with the default OpenIG log sink entries. To access all messages from SLF4J loggers, in config.json define the default LogSink as type Slf4jLogSink.

{
  "name": "LogSink",
  "type": "Slf4jLogSink",
   "config": {
    "base": "com.example.app"
  }
}
     

For more information, see Chapter 17, "Logging Events in OpenIG" in the Gateway Guide and Slf4jLogSink(5) in the Configuration Reference.

OAuth 2.0 Common Resource Server Filter

OpenIG now uses the OAuth 2.0 Common Resource Server filter (OPENIG-864).

Previously, access tokens for OAuth2ResourceServerFilter were stored in the "target" attribute. This attribute has been removed. Access tokens are now stored in a dedicated context and accessed through ${contexts.oauth2.accessToken}.

For more information, see Chapter 8, "OpenIG As an OAuth 2.0 Resource Server" in the Gateway Guide and OAuth2ResourceServerFilter(5) in the Configuration Reference.

Elasticsearch Audit Event Handler

The audit service now supports an ElasticsearchAuditEventHandler to log audit events in the Elasticsearch search and analytics engine.

For more information, see Chapter 15, "Auditing and Monitoring OpenIG" in the Gateway Guide and ElasticsearchAuditEventHandler(5) in the Configuration Reference.

Condition Enforcement Filter

A condition enforcement filter is now available to verify that a specified condition is met before the chain of execution is continued (OPENIG-880).

For information, see ConditionEnforcementFilter(5) in the Configuration Reference.

Class Import for Groovy Scripts

The following classes are imported automatically for Groovy scripts:

• org.forgerock.http.Client

• org.forgerock.http.Filter

• org.forgerock.http.Handler

• org.forgerock.http.filter.throttling.ThrottlingRate

• org.forgerock.http.util.Uris

• org.forgerock.util.AsyncFunction

• org.forgerock.util.Function

• org.forgerock.util.promise.NeverThrowsException

• org.forgerock.util.promise.Promise

• org.forgerock.services.context.Context

• org.forgerock.http.protocol.*

It is no longer necessary to include import statements for these classes in Groovy scripts (OPENIG-963).

For more information, see ScriptableFilter(5) in the Configuration Reference and ScriptableHandler(5) in the Configuration Reference.

Scheduled Executor Service

OpenIG now provides a scheduled executor service that can be declared and configured in the heap, and shared by downstream components, such as filters and handlers, that use an executor service. Previously, each filter and handler created its own executor service (OPENIG-178).

This executor service simplifies configuration and makes it possible for components to share resources. You can configure the number of threads in the executor service and how the executor service is stopped.

For more information, see ScheduledExecutorService(5) in the Configuration Reference.

This release of OpenIG includes the following enhancements:

Improved Performance of the PolicyEnforcementFilter

Internal refactoring of the OpenIG policy enforcement filter has significantly improved performance (OPENIG-1013).

Before this release, the number of SSO tokens required by the policy enforcement filter was proportional to the number of connected user agents. From this release, a single token is requested the first time the policy enforcement filter is called, and then that same token is used for all policy evaluation requests. The token is automatically refreshed when necessary.

The refactoring has resulted in the following improvements:

• Reduced memory usage on OpenAM and OpenIG - there are fewer SSO sessions.

• Increased speed - OpenIG performs fewer HTTP calls to get SSO tokens, and therefore spends less time waiting for tokens.

For more information, see PolicyEnforcementFilter(5) in the Configuration Reference.

Asynchronous Processing of Filters and Handlers

All of the filters and handlers in OpenIG have been refactored for fully asynchronous HTTP message processing (OPENIG-865).

Configuration Settings Can Be Defined As Expressions

Filters, handlers, and other objects whose configuration settings require strings, integers, or booleans, can now be configured by expressions (OPENIG-397).

This improvement allows you to change configuration settings by changing the value of a system property or environment variable, and then restarting OpenIG or reloading the route. You can change configuration settings without changing the configuration file.

For more information, see Configuration Settings(5) in the Configuration Reference.

Failures in OAuth2ClientFilter Are Diverted to a Failure Handler

All client failures are rerouted to a failure handler. Before this release, a 500 Internal Server Error was returned. The failure object in the target has an additional field called exception, providing the cause of failure (OPENIG-981).

For more information, see OAuth2ClientFilter(5) in the Configuration Reference.

Support for Environment and Subject/Claims in Policy Enforcement

The PolicyEnforcementFilter now provides support to specify a policy environment and to specify a subject by claims (OPENIG-836).

The circumstances under which a policy applies can now be configured. For example, environment conditions can specify that the policy applies only during working hours or only when accessing from a specific IP address. For this improvement, the "environment" attribute has been added to the PolicyEnforcementFilter.

Subjects can now be specified by JWT claims. For this improvement, the "claimsSubject" attribute has been added to the PolicyEnforcementFilter.

For more information, see PolicyEnforcementFilter(5) in the Configuration Reference.

Attributes and Advices Returned With Policy Decisions

The PolicyEnforcementFilter now exposes attributes and advices returned by the policy decision (OPENIG-824).

For this improvement, the "target" attribute has been added to the PolicyEnforcementFilter. For more information, see PolicyEnforcementFilter(5) in the Configuration Reference.

Logs at Error Level on OAuth2ClientFilter

The OAuth2ClientFilter now logs at the error level instead of the warning level (OPENIG-945).

Error Messages Improved for Evaluation of Expressions

More warning and error logs are now available for the evaluation or assignation of expressions (OPENIG-451).

The following information is logged:

• Missing bean properties

• Out-of-bound index in lists

• Movement to an unmodifiable collection

• Exception during evaluation

• Unexpected result type

• Any function failure