Application and Web Servers

Additional Requirements for TomCat

For Tomcat, add the following for Connector in the server.xml file (found in root/conf):

relaxedQueryChars=""<>[\]^`\{|}" 

JDBC Latency Test

This application measures database server response time.

To test SQL Server, execute this command. Type the entire command on a single line:

java -classpath tcutility.jar;sqljdbc.jar teamconnect.jdbc.JdbcLatencyTest arg0 arg1 arg2 arg3 arg4 arg5 To test Oracle: 

java -classpath tcutility.jar;ojdbc5.jar teamconnect.jdbc.JdbcLatencyTestarg0 arg1 arg2 arg3 arg4 arg5

The argument definitions are:

• 0: JDBC URL (e.g., jdbc:sqlserver://10.0.0.127;databaseName=TEST_DB or jdbc:oracle:thin:@10.0.0.127:1521:test_db)
• 1: class name for database driver (e.g. oracle.jdbc.OracleDriver or com.microsoft.sqlserver.jdbc.SQLServerDriver)
• 2: Database username
• 3: Database password
• 4: Number of iterations in the test
• 5: Text of the SQL query (e.g. select * from Y_USER)

The output from the app states the time, in microseconds, required to execute this simple query. Expected acceptable range for this query is 0.6 to 0.8 seconds. Longer times may indicate a database issue that should be resolved before installation.

UDP Test

This application tests clustered server environments. Both UDP and RMI (described below) must work properly for TeamConnect to run on clustered servers.

Login to Machine1 and run these commands:

set CLASSPATH=tcutility.jar

java -classpath tcutility.jar teamconnect.udp.UDPServer 239.192.16.15 6018 5

The argument values shown are examples only. The argument definitions are:

• arg0: UDP address
• arg1: UDP port
• arg2: Time to live (number of hops)

The application responds with message "waiting..."

Login to Machine2 and run these commands:

set CLASSPATH=tcutility.jar

java -classpath tcutility.jar teamconnect.udp.UDPClient 239.192.16.15 6018 Hello 55

The argument values shown are examples only. The argument definitions are:

• arg0: UDP address
• arg1: UDP port
• arg2: Message string to be sent
• arg3: Message count
• arg4: Time to live (number of hops)

The application will respond with messages showing the test string and the status of the send request. These messages will repeat for as many times as are specified in the arg3 value. The server application on Machine1 should display messages, one for each send request, containing the text of the sent string.

Repeat the process by terminating the server application on Machine1, then changing Machine2 to Server and Machine1 to Client.

RMI Test

This application tests clustered server environments. Both UDP (described above) and RMI must work properly for TeamConnect to run on clustered servers.

Note: The RMI registry should not already be running when you begin this test. It is important that the CLASSPATH value be set before the registry is started.

Login to Machine1 and run these commands:

set CLASSPATH=tcutility.jar rmiregistry <port>

java -classpath tcutility.jar teamconnect.rmi.Server <port>

The application responds with "Server ready". Login to Machine2 and run these commands:

set CLASSPATH=tcutility.jar

java -classpath tcutility.jar teamconnect.rmi.Client <IP addr of RMI server> <port>

The application responds with the message "Hello, World" and with the run time that was required to execute the test. Repeat the process by terminating the server application on Machine1, then changing Machine2 to Server and Machine1 to Client, then rerunning the test.

Session Cookie Attributes

The application server must be configured to enforce the Secure and HttpOnly attributes on the TCSESSIONID cookie. This ensures the session identifier is only transmitted over HTTPS and is protected from client-side scripts.

• Oracle WebLogic: To improve security, configure the Secure and HttpOnly flags for session cookies. This should be done at the Server or Domain level within the Web Application settings of Oracle WebLogic.
  
  Alternative: Application Server-Level Cookie Security Override
  If you cannot enforce these settings domain-wide, you can configure an application server-level override. This involves modifying the deployment descriptor:

1. Locate the weblogic.xml file.
2. Search for the comment: <!-- UNCOMMENT TO ENABLE SESSION COOKIE SECURITY OVER HTTPS -->
3. Follow your organization’s WebLogic configuration standards to enable the secure cookie options by uncommenting the relevant section.
   Note: This override is implemented via server configuration and does not require modifying the TeamConnect WAR file or source code.

• Apache Tomcat: Enforce attributes through the server.xml or context.xml configuration files.

• IBM WebSphere (Open Liberty): Configure session cookie security attributes at the Application Server or Profile level.

For detailed, platform‑specific configuration steps, refer to your application server documentation:

• Apache Tomcat – Tomcat SessionCookieConfig secure and HttpOnly flags docs
• Oracle WebLogic – Oracle WebLogic session cookie configuration documentation
• IBM WebSphere – IBM WebSphere Liberty HSTS configuration docs

HTTP Strict Transport Security (HSTS)

To protect information from being transmitted over unencrypted connections and to prevent Man-in-the-Middle attacks, the application server must implement HTTP Strict Transport Security (HSTS). The server must send the Strict-Transport-Security response header to enforce HTTPS-only communication with the TeamConnect domain. This ensures that browsers automatically convert all HTTP requests to HTTPS and refuse insecure connections for the duration specified by the max-age directive.

The application server configuration must include the following header:

Strict-Transport-Security: max-age=60000; includeSubDomains

• max-age: Indicates the number of seconds that the browser should automatically convert all HTTP requests to HTTPS.

• includeSubDomains: Indicates that all sub-domains of the web application must also use HTTPS.