AWS m2 documentation change
Summary
Added new configuration properties for JMS MQ connections, database metadata schema inclusion, API access logging, session management, and security headers. Updated RabbitMQ properties with types and default values. Introduced client application configuration options including in-memory caching and library list management.
Security assessment
The changes add documentation for security features including session timeout/tracking modes (preventing session hijacking), custom allowed headers for OAuth, and API access logging (auditing capabilities). However, there's no evidence of these changes addressing a specific vulnerability or security incident. The security documentation additions are proactive enhancements rather than reactive fixes.
Diff
diff --git a/m2/latest/userguide/ba-runtime-key-value.md b/m2/latest/userguide/ba-runtime-key-value.md index ee6543019..2f84626d7 100644 --- a//m2/latest/userguide/ba-runtime-key-value.md +++ b//m2/latest/userguide/ba-runtime-key-value.md @@ -5 +5 @@ -YML notationQuick start / Use casesAvailable properties for the main applicationAvailable properties for optional web applicationsAvailable properties for the client application +YML notationQuick start / Use casesAvailable properties for the main applicationAvailable properties for optional web applicationsAvailable properties for the client applicationAvailable properties for the client applicationConfigure API access logging @@ -22,0 +23,4 @@ In Spring Boot applications `application-main.yml` is the configuration file in + * Available properties for the client application + + * Configure API access logging + @@ -138 +141,0 @@ The following use cases show examples of the applicable keys and values. - remote : false @@ -233,0 +237,14 @@ The following use cases show examples of the applicable keys and values. + ######################################################### + ##### Configuration properties for JMS MQ connection #### + ######################################################### + mq.queues.jms.connectionfactory.borrow-connection-timeout: 31 # Timeout, in seconds, for borrowing connections from the pool. + mq.queues.jms.connectionfactory.ignore-session-transacted-flag: true # Whether or not to ignore the transacted flag when creating a session. + mq.queues.jms.connectionfactory.local-transaction-mode: false # Whether or not to include local transactions. + mq.queues.jms.connectionfactory.maintenance-interval: 62 # The time, in seconds, between runs of the pool's maintenance thread. + mq.queues.jms.connectionfactory.max-idle-time: 63 # The time, in seconds, after which connections are cleaned up from the pool. + mq.queues.jms.connectionfactory.max-lifetime: 0 # The time, in seconds, that a connection can be pooled for before being destroyed. 0 denotes no limit. + mq.queues.jms.connectionfactory.max-pool-size: 1 # The maximum size of the pool. This property will be overwritten by mq.queues.jmsMQQueueManagers[N].jmsMQMaxPoolSize property (if provided). + mq.queues.jms.connectionfactory.min-pool-size: 1 # The minimum size of the pool. + mq.queues.jms.connectionfactory.reap-timeout: 0 # The reap timeout, in seconds, for borrowed connections. 0 denotes no limit. + + @@ -305,0 +323,22 @@ The following use cases show examples of the applicable keys and values. + ############################################################# + ##### Database metadata schema inclusion configuration #### + ############################################################# + gapwalk: + database: + metadata: + schema-inclusion: + enabled: false + schemas: + global: + - "SCHEMA1" + - "SCHEMA2" + + ############################## + ##### URL configuration #### + ############################## + gapwalk.post.script.mediatype.json: false + + ######################################## + ##### CBLQDA parameters #### + ######################################## + gapwalk.cobol.cblqda.enabled: false @@ -354,0 +394,3 @@ Key | Type | Default value | Description | Release version +`jildb.datasource` \+ -`driver-class-name` \+ -`url` \+ -`username` \+ -`password` | Standard spring datasource with subkeys | | Contains the connection information for the Jics database. | +`jildb.backend` | string | | Specifies the database type used in the Jildb backend, for example, Oracle. | +`jildb.record-hold-timeout` | int | 10000 | Specifies the wait timeout period, in milliseconds, for the record holding mechanism in Jildb. | @@ -355,0 +398,4 @@ Key | Type | Default value | Description | Release version +`blu4iv.userspace.pageSize` | int | 4096 | Specifies the page size which is used to allocate storage for user spaces. The size of the user space at any given time is always a multiple of this number specified. | 4.10.0 +`blu4iv.userspace.store-type` | string | memory | Specifies the store type that is used for user space registry. Supported values are memory and redis. If no store type is provided, memory is used by default. | 4.10.0 +`blu4iv.userspace.redis.*` | Supported Redis properties | | Specifies configuration properties for the user spaces redis store, see [Available Redis cache properties in AWS Blu Age Runtime](./ba-runtime-redis-configuration.html). | 4.10.0 +`blu4iv.dataaccess.useOldDaoDesign` | boolean | false | A global flag that determines if the application is to use the old DAO architecture or the new. This is dependent on whether the DAO's were generated using old or new design. | @@ -364,0 +411 @@ Key | Type | Default value | Description | Release version +`clcommand.rtvmbrd.hasHeader` | string | true | Specify if the files contain headers that should not be included when counting the rows. | @@ -388,0 +436,2 @@ Key | Type | Default value | Description | Release version +`server.servlet.session.tracking-modes` | string | cookie | Specifies the session tracking modes to use. Possible values are `url`, `cookie`, `ssl`. Multiple values can be specified separated by commas. Note: When deploying on Tomcat, you need to set `cookies=false` in context.xml because Tomcat takes precedence for tracking mode configuration. | +`server.servlet.session.timeout` | string | 30m | Specifies the session timeout duration. Examples: `60s` (60 seconds), `4m` (4 minutes), `4h` (4 hours). | @@ -394,0 +444 @@ Key | Type | Default value | Description | Release version +`dataSimplifier.doubleFloatingType` | string | IEEE_754 | The double floating type is the format used to encode and decode a floating-point number. Allowed values are `IEEE_754` / `HFP`(for Hexadecimal Floating Point format). Default value is `IEEE_754`. | 4.7.0 @@ -411,0 +462 @@ Key | Type | Default value | Description | Release version +`returnHttp5xxResponseForFailedSyncJob` | boolean | false | Specifies whether to return HTTP response code of 500 series for unsuccessful synchronized job execution. | 4.10.0 @@ -463 +513,0 @@ Key | Type | Default value | Description | Release version -`sort.function` | string | | The sort function name for the blu4iv database. | @@ -484,0 +535,2 @@ Key | Type | Default value | Description | Release version +`gapwalk-application.security.customAllowedHeaders` | string[] | null | The list of custom headers to allow. This option requires `gapwalk-application.identity` to be set to `oauth`. | 4.8.0 +`listOfMDCUrlParams` | string | `null` | The list of URL parameters to add to the MDC when executing Groovy batch script. | @@ -487 +538,0 @@ Key | Type | Default value | Description | Release version -`gapwalk-application.security.localhostWhitelistingEnabled` | boolean | true | Specifies whether to enable authentication from any `localhost` requests. | @@ -498,0 +550 @@ Key | Type | Default value | Description | Release version +`job.default.encoding` | string | CP1047 | Specifies the default encoding which is used to initialize the job level storage. For example, switches in BLU4IV application uses this encoding to initialize to zeroes. | 4.9.0 @@ -518,6 +570,5 @@ Key | Type | Default value | Description | Release version -| | | When `mq.queues` is `rabbitmq`, The IBMMQ hostname. | -`mq.queues.rabbitMQHost` | | | The Rabbit MQ hostname. | -`mq.queues.rabbitMQVirtualHost` | | | The Rabbit MQ virtual hostname. | -`mq.queues.rabbitMQPort` | | | The Rabbit MQ port. | -`mq.queues.rabbitMQUsername` | | | The Rabbit MQ user. | -`mq.queues.rabbitMQPassword` | | | The Rabbit MQ password. | +`mq.queues.rabbitMQHost` | string | null | The Rabbit MQ hostname. | +`mq.queues.rabbitMQVirtualHost` | string | null | The Rabbit MQ virtual hostname. | +`mq.queues.rabbitMQPort` | number | null | The Rabbit MQ port. | +`mq.queues.rabbitMQUsername` | string | null | The Rabbit MQ user. | +`mq.queues.rabbitMQPassword` | string | null | The Rabbit MQ password. | @@ -526,0 +578,8 @@ Key | Type | Default value | Description | Release version +`xmlGeneratorPrettyFormat` | boolean | true | Determines the formatting style of the generated XML output within the XmlGenerator class. When set to `true`, the XML output is formatted in a human-readable, indented structure (pretty-printed). When set to `false`, the output is in a compact, single-line format without additional whitespace. | 4.8.0 +`gapwalk.database.metadata.schema-inclusion.enabled` | boolean | false | Enables a memory optimization feature that control which database schemas are cached by a application. This configuration helps reduce memory footprint while maintaining system stability by intelligently managing schema metadata. It automatically includes some common database system schemas which maybe required for proper operation. | 4.9.0 +`gapwalk.database.metadata.schema-inclusion.schemas.global` | list<String> | null | Defines a list of schemas that should be cached. | 4.9.0 +`sqlConnectionAutoCommitEnabled` | boolean | true | Enables automatic commit of current connection during connection reset operations. When enabled, automatically commits the current connection before switching to a new datasource connection in non-XA environments to prevent connection instability. When disabled, logs a warning message about potential connection issues during reset operations. | 4.10.0 +`gapwalk.post.script.mediatype.json` | boolean | false | Specifies whether the `Content-Type` header of the response from endpoint `/post/script/{scriptId:.+}` is set to `application/json`, depending on the value of a boolean variable. If set to false, the default is `text/plain; charset=utf-8`. | +`startDefaultJob` | string | `false` | Specify whether to initialize default job at first transaction. | +`gapwalk.cobol.cblqda.enabled` | boolean | false | Enables a CBLQDA feature that controls QSAM files' dynamic allocation during an OPEN statement. This configuration helps to dynamically allocate temporary files declared in the program, even if the files are not defined in the JCL script. | +`mq.queues.jms.connectionfactory.*` | Supported Atomikos connection factory properties | | Specifies configuration properties for the JMS MQ connection pool. | @@ -606,0 +666,13 @@ Key | Type | Default value | Description +`jhdb.keepParent` | boolean | false | Whether to keep _parent and _logicalparent during IMS insertion. When set to true the IMS ISRT call will insert _parent and _logicalparent into database columns. +`jhdb.query.timeout` | int | -1 | Specifies a timeout for any jhdb transaction execution in seconds. After this time, the system will try to interrupt the program. No timeout is set if the value is -1 (default). +`jhdb.backend` | string | | Jhdb backend type. Expected value is `rdbms` +`jhdb.transaction.scope.programs` | string | | list of programs to be declared as a whole transaction. Separate each program with a comma (`,`). For example:`PCP008,PCT008` +`metadata.datasource` \+ -`driver-class-name` \+ -`url` \+ -`username` \+ -`password` \+ -`type` | string | Standard spring datasource with subkeys | Contains the metadata information for the jhdb database, including psbs, dbds, connections. Alternately, use of AWS secrets is strongly encouraged. + +## Available properties for the client application + +Your modernized application may require specific property configurations for the client Spring application. These properties initialize beans from classes packaged in runtime JAR files. The `application-profile.yaml` file, where the profile value is set during application generation, allows you to configure these properties. The following table lists the key/value parameters available for configuring the client web application that uses beans from classes packaged in the Gapwalk runtime + +Key | Type | Default value | Description | Release version +---|---|---|---|--- +`blu4iv.dtaara.library.disable` | boolean | false | Controls the usage of library in the context of data area operations. If set to true, library usage is disabled for data area operations, but this does not affect the usage of QTemp. If set to false, library is considered when performing CRUD operations for data area. | 4.5.0 @@ -614,0 +687,82 @@ Key | Type | Default value | Description | Release version +`blu4iv.dao.data.max` | number | 10 | The size of the internal cache for input DAO operations. This cache exists at the program level (single instance). | 4.9.0 +`blu4iv.dao.sort.function` | string | | The sort function name for the blu4iv database. | 4.9.0 +`blu4iv.dao.support` | string | JPA | Specifies the data access implementation to use (JPA or JDBC). | 4.9.0 +`blu4iv.dao.cache.enabled` | boolean | false | Enable the In-memory cache. | 4.8.0 +`blu4iv.dao.cache.enabledHits` | boolean | false | Add the tracking of number of requests to the cache. | 4.8.0 +`blu4iv.dao.cache.initMaxResults` | number | 10000 | The size of the cache. | 4.8.0 +`blu4iv.dao.cache.entries.fileIds` | string | | The list of database tables to be cached. | 4.8.0 +`blu4iv.dao.cache.entries.programIds` | string | | The program's identifiers where the cache should be activated for the specified tables. The cache is available for all sub-programs in the execution stacks. | 4.8.0 +`blu4iv.librarylist.enabled` | boolean | false | Enable the use of the library list to resolve a file library. | 4.10.0 +`blu4iv.librarylist.libraries` | string | | The initial list of libraries ordered from left to right. | 4.10.0 + +### Configure the In-Memory cache for AS400 applications + +The in-memory cache feature enables users to cache read-only data within memory, significantly improving performance for data-intensive programs. The cache system optimizes performance in three ways: loading data only on first access, creating data access maps on demand, and storing cached data efficiently near program memory. This design minimizes memory overhead while maximizing speed improvements. + + + ################################################################### + # Cache configuration for read operations called from DAO classes # + ################################################################### + blu4iv: + dao: + cache: + enabled: true + enabledHits: true + initMaxResults: 100000 + entries: + - + fileIds: [${TABLEA}] + programIds: [${PROGRAM1}] + - + fileIds: [${TABLEB},${TABLEC}] + programIds: [${PROGRAM2}] + librarylist: + enabled: true + libraries: ["LIBA","LIBC","LIBE"] + +## Configure API access logging + +The API access logging feature records detailed information about API requests to BAC, JAC, and Gapwalk applications, helping meet security requirements by tracking who accessed what and when. + +Key | Type | Default value | Description | Release version +---|---|---|---|--- +`api.logging.enabled` | boolean | false | Enables API access logging for BAC, JAC, and Gapwalk applications. When enabled, logs all API requests with details. | 5.0.0 + +When enabled, user can provide logback file configuration to log API access logs in chosen place using the logger name `api.access`. The logs can include the following MDC fields: + +MDC Field | Description +---|--- +`api-date` | The date and time when the API request was made +`api-duration` | How long it took to process the API request (milliseconds) +`api-host` | The source address that the API request came from +`api-context` | Where the API is hosted +`api-user` | The username or identifier of the person making the API request +`api-sessionid` | A unique identifier for the user's current login session +`api-scheme` | The transfer protocol used, for example, HTTP or HTTPS. +`api-name` | The endpoint/URI that was accessed +`api-retcode` | The status code returned after the API request completed +`api-secure` | The security method used to protect the API call (e.g., OAuth2, Token, Anonymous) +`api-method` | The type of HTTP request made (e.g., GET, POST, DELETE, ...) + +To configure a dedicated log file for API access logs, add the following to your logback configuration: + + + <!-- File appender --> + <appender name="ApiAccessFile" class="ch.qos.logback.core.FileAppender"> + <file>logs/main/main-api-access.log</file> + <immediateFlush>true</immediateFlush> + <encoder> + <pattern>%date %X{api-scheme} %X{api-host} %X{api-method} %X{api-name} - Return code: %X{api-retcode} - Start date: %X{api-date} - Duration: %X{api-duration} ms - User: %X{api-user} - SessionId: %X{api-sessionid} - SecureMethod: %X{api-secure} %n</pattern> + </encoder> + </appender> + + <logger name="api.access" level="info" additivity="false"> + <appender-ref ref="ApiAccessFile" /> + <appender-ref ref="CONSOLE" /> + </logger> + +Sample log output: + + + 2025-06-13 22:24:36,174 http 127.0.0.1 GET /bac/api/services/rest/bluesamservice/listDataSet - Return code: 200 - Start date: 06-13-2025 22:24:35.863+0200 - Duration: 308 ms - User: velocity_admin - SessionId: + 1X1X1X1X1X1X1X1X1X1X1X1X1X1X1X1X- SecureMethod: Oauth2