Skip to content
Lynxwork

Polarion 2512 Configuration for Lynxwork OSLC Connectors

This guide explains how to configure Polarion 2512 to work with Lynxwork OSLC Connectors.

Some prerequisites overlap with Polarion’s Linked Data configuration, but additional Apache and CORS configurations are required.

Variables

Variables used in this guide:

Variable Meaning
{connector_base_url} Base URL of the Lynxwork OSLC server hosting the connector. For Azure DevOps, this is the URL from Azure DevOps Server.
{application_site_url} The URL of the external ALM application from which users access Polarion.
{extension_host_url} The URL where the Lynxwork extension is hosted and from which users access Polarion.

{application_site_url} examples

{extension_host_url} examples

  • Jira Cloud: https://*.cdn.prod.attlassian.net
  • Azure DevOps Cloud: https://makelynxworkab.gallerycdn.vsassets.io
  • Azure DevOps Server: same as {application_site_url}

Configuration

Step 1 — Update Apache Content Security Policy

  1. Edit the Apache configuration at /etc/apache2/conf-available/polarion.conf.

  2. Update the Content Security Policy (CSP) response header to add URLs to the CSP directives, as follows:

    Header set Content-Security-Policy "default-src ...; frame-ancestors ... {application_site_url} {extension_host_url}; frame-src ... {connector_base_url}"

Explanation

  • frame-ancestors allows Polarion to be embedded inside the external application.
  • frame-src allows Polarion to load content from the Lynxwork Connector.

Step 2 — Configure Apache CORS headers

  1. Edit the Apache configuration at /etc/apache2/conf-available/polarion.conf.
  2. Add the following Apache directives.

Note: Escape dots when entering the {extension_host_url}.

  • Jira Cloud: "^https://.*\.cdn\.prod\.atlassian\.net$"
  • Azure DevOps Cloud: "^https://makelynxworkab\.gallerycdn\.vsassets\.io$"
SetEnvIf Origin "^{extension_host_url}$" ORIGIN_ALLOWED=$0
Header set Access-Control-Allow-Origin "%{ORIGIN_ALLOWED}e" env=ORIGIN_ALLOWED
Header set Access-Control-Allow-Credentials "true"
Header set Access-Control-Allow-Methods "GET, PUT, POST, OPTIONS"
Header always set Access-Control-Allow-Headers "authorization, content-type, oslc-core-version"

Explanation: These directives complement the Polarion Tomcat CORS settings (Step 3) to enable credentialed cross-origin requests. Header Access-Control-Allow-Credentials cannot currently be configured via polarion.properties.

Step 3 — Update Polarion Tomcat CORS settings

  1. Edit the Polarion properties file at /opt/polarion/etc/polarion.properties.

  2. Add the following (See Polarion System Configuration Properties Reference):

    com.siemens.polarion.tomcat.cors.allowedHeaders=authorization, content-type, oslc-core-version
    com.siemens.polarion.tomcat.cors.allowedOrigins={extension_host_url}
    # FOR JIRA CLOUD, use * instead of {extension_host_url}
    #com.siemens.polarion.tomcat.cors.allowedOrigins=*

Explanation

  • These settings allow Polarion to accept JavaScript requests to Polarion APIs from the user’s browser.
  • Why change cors.allowedHeaders? The defaults do not include the necessary oslc-core-version header.
  • Why set cors.allowedOrigins to * for Jira Cloud? Polarion does not support wildcards for its cors.allowedOrigins property. Since Jira extensions are served from dynamically changing subdomains of atlassian.net, you need to instead allow all origins (*).