How to enable CORS Filter in OpenAM?

[yashpatil1998]

I have tried to refer this documentation to enable CORS configuration in the Ui. But the corresponding option isn't available in OpenAM (the same is available in ForgeRock AM). Is there the corresponding available, if not, any configuration steps to enable CORS filter?

I am using OpenAM 14.7.1 image.

[yashpatil1998]

Current workaround which I have used is to disable CORS in Safari browser.

[maximthomas]

Hi, you need to uncomment the following lines in WEB-INF/web.xml file in your OpenAM deployment and configure CORS filter parameters according to your needs

OpenAM/openam-server-only/src/main/webapp/WEB-INF/web.xml

Lines 86 to 149 in da05a2f

	<!-- To configure CORS Support, please see the documentation and use the following lines as a template.
	<filter>
	<filter-name>CORSFilter</filter-name>
	<filter-class>org.forgerock.openam.cors.CORSFilter</filter-class>
	<init-param>
	<description>
	Accepted Methods (Required):
	A comma separated list of HTTP methods for which to accept CORS requests.
	</description>
	<param-name>methods</param-name>
	<param-value>POST,PUT</param-value>
	</init-param>
	<init-param>
	<description>
	Accepted Origins (Required):
	A comma separated list of origins from which to accept CORS requests.
	</description>
	<param-name>origins</param-name>
	<param-value>http://www.example.net,https://example.org:8433</param-value>
	</init-param>
	<init-param>
	<description>
	Allow Credentials (Optional):
	Whether to include the Vary (Origin) and Access-Control-Allow-Credentials headers in the response.
	Default: false
	</description>
	<param-name>allowCredentials</param-name>
	<param-value>false</param-value>
	</init-param>
	<init-param>
	<description>
	Allowed Headers (Optional):
	A comma separated list of HTTP headers which can be included in the requests.
	</description>
	<param-name>headers</param-name>
	<param-value>headerOne,headerTwo,headerThree</param-value>
	</init-param>
	<init-param>
	<description>
	Expected Hostname (Optional):
	The name of the host expected in the request Host header.
	</description>
	<param-name>expectedHostname</param-name>
	<param-value>openam.example.com:8080</param-value>
	</init-param>
	<init-param>
	<description>
	Exposed Headers (Optional):
	The comma separated list of headers which the user-agent can expose to its CORS client.
	</description>
	<param-name>exposeHeaders</param-name>
	<param-value>exposeHeaderOne,exposeHeaderTwo</param-value>
	</init-param>
	<init-param>
	<description>
	Maximum Cache Age (Optional):
	The maximum time that the CORS client can cache the pre-flight response, in seconds.
	Default: 600
	</description>
	<param-name>maxAge</param-name>
	<param-value>600</param-value>
	</init-param>
	</filter>
	-->

OpenAM/openam-server-only/src/main/webapp/WEB-INF/web.xml

Lines 269 to 274 in da05a2f

	<!--
	<filter-mapping>
	<filter-name>CORSFilter</filter-name>
	<url-pattern>/json/*</url-pattern>
	</filter-mapping>
	-->