Enabling the Verba Web Application in 3rd Party Frame
Because of the default security settings of the Verba Web Application, displaying the webapp in a 3rd party frame is not allowed. The following steps describe how to turn off this security feature.
Step 1 - Log in to the Verba Media Repository (or Single) server.
Step 2 - Go to the [APPLICATION_FOLDER]\tomcat\conf folder.
Step 3 - Open the web.xml file for editing.
Step 4 - Remove or comment out the following lines:
<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
<async-supported>true</async-supported>
<init-param>
<param-name>antiClickJackingOption</param-name>
<param-value>SAMEORIGIN</param-value>
</init-param>
</filter>Step 5 - Remove or comment out the following lines too:
<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
Step 6 - Save the changes.
Step 7 - Restart the Verba Web Application service in the Services console.
Comments
OUTDATED
For Microsoft Teams application seamless SSO solution the following extra configuraiton modiciations are required:
Step 1 - Go to the [APPLICATION_FODLER]\tomcat\conf folder.
Step 2 - Open the web.xml file for editing.
Step 3 - Add the following cookie-config tag to the existing session-config tag. (It is needed because the security flag for the set-cookie was handled by the httpHeaderSecurity filter and without it this should be turn on again.)
<session-config>
<session-timeout>30</session-timeout>
<cookie-config>
<http-only>true</http-only>
<secure>true</secure>
</cookie-config>
</session-config>
Step 4 - Go to the [APPLICATION_FODLER]\tomcat\webapps\verba\META-INF folder.
Step 5 - Open the context.xml file for editing.
Step 6 - Change the CookieProcessor tag sameSiteCookies attribute value to "none"
<CookieProcessor sameSiteCookies="none" />The original article turns out too many security features, so the whole artcle should be reviewed.
This instructions should be updated with an extra step since 9.6.18.7315 and 9.7.0.7317. In that releases the default CSP header configurations were hardened. The MRs that are neede to embedded into 3rd party iframe must overwrite the default CSP configuration. To overwrite that settings the following Registry key should be changed:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Verba\Web\HeaderSecurityCSP(create it if it doesn't exists yet, type: REG_SZ). The current default value is:default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; frame-src 'self' mailto: tel:; frame-ancestors 'self';From this value the following parts must be removed:
frame-ancestors 'self';