Tomcat, Spring Framework, and Spring Security FAQ

What is the current version of Tomcat in OpenEdge?

OpenEdge 12.8 ships with Tomcat 10.1.15. Between releases new updates may be required. For Tomcat updates in service packs, see OpenEdge® 12 Platform Compatibility Guide.

What are the current versions of Spring Framework and Spring Security in OpenEdge?

OpenEdge 12.8 ships with Spring Framework 6.0.14 and Spring Security 6.1.4. Between releases new updates may be required. For the Spring updates in service packs, see OpenEdge® 12 Platform Compatibility Guide.

OpenEdge 12.8.12 ships with Spring Framework 6.2.18 and Spring Security 6.5.11. These updates include new features, support for the latest specifications, and long-term support.

For more information, see Upgrade Spring configuration files.

What steps are required to update applications to 12.8.0?

OpenEdge 12.8 requires the following application updates:

WebSpeed

For more information, see "get cgi" in the OpenEdge Application server: Developing WebSpeed Applications in the OpenEdge 11.7 documentation.

SAML

The samlToken.httpBinding.allowedMethods property in the oeablSecurity.properties file is deleted, and the CSV file referenced in the oeablsecurity.properties file controls URL access.

For more information, see About the URL access control file.

jwtToken.macKey

When you use jwtToken.keystore.type=mac, you must set the jwtToken.macKey value based on the value of the signatureAlg property.

For more information on Spring Security properties and values, see $DLC/servers/pasoe/conf/oeablSecurity.properties.README.

What properties are removed from 12.8.12?

The following legacy properties were removed due to the shift away from X-Frame-Options strategies:

• http.spring.headers.frameOptions
• http.spring.headers.frameOptions.policy
• http.spring.headers.frameOptions.allowFrom.strategy
• http.spring.headers.frameOptions.allowFrom.strategy.value
• http.spring.headers.frameOptions.allowFrom.strategy.fromParameter

These properties relied on outdated mechanisms such as ALLOW-FROM, which modern browsers no longer support and Spring Security has deprecated.

What properties are added in 12.8.12?

Replace the removed properties with the new property:

• http.spring.headers.frameAncestors

This property defines allowed origins for embedding Progress Application Server (PAS) for OpenEdge in an <iframe> using the Content-Security-Policy: frame-ancestors directive.

Examples:

• self—Allows framing only from the same origin.
• none—Disallows all framing (recommended for production).
• https://trusted.example.com—Allows framing from a specific domain.

These changes are reflected in both:

• catalina_base/conf/oeablSecurity.properties
• catalina_base/conf/oeablSecurity.properties.README

What XML files changed in 12.8.12?

If you customized XML files in earlier releases, reapply your changes to the updated XML files.

• enableOAuth2ResourceServer.xml
• enableSamlSecurity.xml
• authFilters.xml
• sharedAuthFilters.xml

The security-context-explicit-save attribute was removed from <http> bean definitions. Spring Security now handles context saving automatically.

• In authFilters.xml and sharedAuthFilters.xml, the OEHeaderWriterFilter bean was updated:
  • Added property: frameAncestors—This property reads its value from the new http.spring.headers.frameAncestors setting in the .properties file.

Is it possible to apply Tomcat security updates to PAS for OpenEdge?

Upgrading the Tomcat version shipped with PAS for OpenEdge is possible and supported as long as it is the same major version. For more information, see Apply Tomcat security updates.