Additional servlet filters

You can register generic servlet filters in the embedded Jetty server to perform additional filtering tasks on requests to or responses from IDM. For example, you might want to use a servlet filter to protect access to IDM with an access management product. Servlet filters are configured in files named openidm/conf/servletfilter-name.json. These servlet filter configuration files define the filter class, required libraries, and other settings.

A sample servlet filter configuration is provided in the servletfilter-cors.json file in the /path/to/openidm/conf directory.

The sample servlet filter configuration file is shown below:

{
    "classPathURLs" : [ ],
    "systemProperties" : { },
    "requestAttributes" : { },
    "scriptExtensions" : { }.
    "initParams" : {
       "allowedOrigins" : "https://localhost:&{openidm.port.https}",
       "allowedMethods" : "GET,POST,PUT,DELETE,PATCH",
       "allowedHeaders" : "accept,x-openidm-password,x-openidm-nosession,
                           x-openidm-username,content-type,origin,
                           x-requested-with",
       "allowCredentials" : true,
       "chainPreflight" : false
    },
    "urlPatterns" : [
       "/*"
    ],
    "filterClass" : "org.eclipse.jetty.servlets.CrossOriginFilter"
}

The sample configuration includes the following properties:

classPathURLs: The URLs to any required classes or libraries that should be added to the classpath used by the servlet filter class.
systemProperties: Any additional Java system properties required by the filter.
requestAttributes: The HTTP Servlet request attributes that will be set when the filter is invoked. IDM expects certain request attributes to be set by any module that protects access to it, so this helps in setting these expected settings.
scriptExtensions: Optional script extensions to IDM. Currently only augmentSecurityContext is supported. A script that is defined in augmentSecurityContext is executed after a successful authentication request. The script helps to populate the expected security context. For example, the login module (servlet filter) might select to supply only the authenticated user name, while the associated roles and user ID can be augmented by the script.

Supported script types include "text/javascript" and "groovy". The script can be provided inline ("source":script source) or in a file ("file":filename). The sample filter extends the filter interface with the functionality in the script script/security/populateContext.js.
filterClass: The servlet filter that is being registered.

The following additional properties can be configured for the filter:

httpContextId: The HTTP context under which the filter should be registered. The default is "openidm".
servletNames: A list of servlet names to which the filter should apply. The default is "OpenIDM REST".
urlPatterns: A list of URL patterns to which the filter applies. The default is ["/*"].
initParams: Filter configuration initialization parameters that are passed to the servlet filter init method. For more information, refer to http://docs.oracle.com/javaee/5/api/javax/servlet/FilterConfig.html.

PingIDM 7.5.0

Additional servlet filters