CXS-946

Fixed an issue that affected the ThingWorx Connection Server v.9.1.0 where some file transfers failed when the log level was set to DEBUG or TRACE when running the Connection Server with Java 8.

For those customers still on ThingWorx Connection Server v.9.1.0, one of the following methods can be used to work around the issue:

CXS-556

Upgrade Connection Services Extension (CSE) to support Oracle JDK 11 and Amazon Corretto 11 (OpenJDK).

CXS-644

Added support to Connection Server for Amazon Corretto 11 (OpenJDK 11).

CXS-871

Added support to Connection Server for Oracle JDK 11.

CXS-880

Support Matrix has been updated.

CXS-887

Update documentation for Java 11 support..

TW-82696

The CXSERVER_APP_KEY environment variable must be newly set in the file docker-compose.yml when using Connection Server 9.1.x or later.

CXS-496

To allow better tracking of multi-part messages through it, the Connection Server now logs the multi-part details, including chunk number and the number of chunks, in the "forwarding to edge" and "forwarding to platform" log messages.

CXS-607

Add service discovery support to Connection Server to enable it to operate in a ThingWorx High Availability Clustering environment.

The Connection Server supports dynamic configuration of ThingWorx Platform instances to connect to using service discovery. With this feature, administrators do not have to configure the platform instances manually and restart the Connection Server when the platforms change.

More specifically, the service discovery feature enables the Connection Server to respond to platforms being added to and removed from the cluster. If a target platform is removed from the cluster, the Connection Server responds by:

The service discovery feature detects ThingWorx Platform instances going up and down while keeping the Connection Servers connected correctly in the cluster. The Remote Things connected through HAProxy can still receive property updates from the edge when one platform instance in the cluster goes down.

Properties have been added to the Connection Server configuration for service discovery. If you are running the Connection Server in a ThingWorx High Availability Clustering environment, refer to Service Discovery Configuration.

CXS-617

Use round robin policy for message routing in HA connection server.

When operating in a ThingWorx High Availability Clustering environment, the Connection Server routes, ingress (request) messages to ThingWorx Platform instances using a round robin policy. The round robin policy provides good load distribution and fault tolerance. For more information, refer to Using the Connection Server in a ThingWorx High Availability (HA) Clustering Environment.

CXS-619

The Connection Server now handles multi-part ingress requests for round robin routing policy when operating in a ThingWorx High Availability Clustering environment. The Connection Server routes multi-part ingress (request) messages to the same ThingWorx Platform instance. If the platform disconnects or is not writable, error messages are written to the Connection Server log. For more information, refer to the subsection on multi-part messages in the topic, Using the Connection Server in a ThingWorx High Availability (HA) Clustering Environment.

CXS-688

Add support for '/TWS' AlwaysOn connections.

For remote access sessions through a ThingWorx Platform the ThingWorx Remote Access Client (RAC) uses a ThingWorx Temporary WebSocket (TWS) endpoint. In a ThingWorx High Availability Clustering deployment, two RAC clients will establish an AlwaysOn tunnel through the same Connection Server. In this type of deployment, the Connection Server is used as a proxy for remote access sessions. For more information about the TWS endpoint, refer to the subsection, "WebSocket Endpoint for Remote Access", in the ThingWorx help center topic, What's New in ThingWorx Remote Access Extension and ThingWorx Remote Access Client?

CXS-693

The following metrics have been added for a Connection Server that is running in a High Availability Clustering environment:

In addition, metrics have been added for the High Availability Cluster and service discovery. Refer to Metrics for details.

CXS-734

With this release, support for JKS is deprecated because the algorithms used by the Java Key Store are no longer considered secure. Instead of reading JKS, the Connection Server now reads PKCS keystores by default. If a keystore cannot be read, the Connection Server terminates abnormally. Indications of this situation are that the Connection Server returns a non-0 result code and writes messages to the appropriate logs.

If you configure a JKS, a warning message is logged. That said, JKS trust stores can still be used without issue since they contain only a list of trusted certificates.

When using PKCS, configuration files that specify the file name should not contain the extension. For example, abc_cert instead of abc_cert.pfx.

For information about converting a JKS key store to PKCS, refer to Converting JKS Keystores to PKCS Keystores.

CXS-737

The Connection Server now performs TLS host name validation of certificates by default when connecting to an HTTPS-enabled ThingWorx Platform.

If absolutely necessary, you can disable host name verification by configuration. Best security practice is to leave host name verification enabled.

CXS-744

When a ThingWorx Platform instance is removed from service discovery and the cluster no longer has any WebSocket connections to the platform, all per-platform metrics in the cluster are removed or reset for that platform instance.

CXS-767

In a ThingWorx High Availability Clustering environment, a Connection Server shuts down gracefully if it is disconnected from a ZooKeeper instance for a configurable amount of time. The Connection Server continues to work until the timeout expires, at which time, the Connection Server disconnects clients and shuts down gracefully.

CXS-793

Enable TLS by default in the Connection Server.

In keeping with PTC policy to be secure by default, the configuration of the Connection Server had SSL/TLS enabled by default. To configure the keystore for a standalone environment, refer to Required Configuration for the Connection Server. Optionally,, you can configure trust store. Refer to Minimal Configuration for Connecting to a Single-Server ThingWorx Platform Installation Using SSL/TLS.

To configure the keystore in a ThingWorx High Availability Clustering environment, refer to High Availability Configuration Optionally,, to configure the trust store, refer to High Availability Configuration in the same topic.

CXS-540

After a restart, the Connection Server now retries binding to a ThingWorx Platform every 15 seconds (configurable) until it succeeds.

With this change, the Connection Server eventually binds with a ThingWorx Platform after a restart in a ThingWorx High Availability Clustering deployment. In this environment, it may take two to three minutes for the bind to succeed and the last connection time to update.

CXS-456

Log the result message when a BIND request fails.

When ThingWorx Platform sends an unsuccessful BIND/UNBIND response, the result message is now written to the log. The log includes the endpoint ID and request ID. If possible, it may include the bind names.

CXS-626

Updates to support testing against ThingWorx 8.5.

No updates were necessary

CXS-451

Additional metrics are provided for the Connection Server:

CXS-457

Add logs for the monitoring services of the Connection Server

The following changes have been made:

CXS-458

Redundant logs have been removed from the Connection Server.

CXS-463

Add higher QOS for responses flowing through Connection Server.

Responses flowing through a Connection Server are now submitted to netty up to two times the regular netty watermark. This functionality has a configuration property, transport.websockets.connections.enableHigherQualityOfServiceForResponses , to allow it to be enabled (default value of true) or disabled.(false.

CXS-483

Support for using an encrypted configuration file for the AlwaysOn Connection Server has been added for this release. See the topic, Setting Up an Encrypted Configuration File in the ThingWorx Connection Services Help Center or in the ThingWorx Connection Server Installation and Operations Guide, v.8.4, available from the Reference Documents page on the PTC Support site.

CXS-450

Allow Connection Server to consolidate multiple authentication (AUTH) requests when platform authentication is slow.

If the platform is slow to respond to AUTH requests, a client may generate multiple AUTH requests. When finally getting a AUTH response from ThingWorx, the Connection Server will now send the AUTH response back to the edge with the latest AUTH request ID sent in.

CXS-452

Error sending message may not be propagated to original client.

This issue is fixed in this release. Errors encountered in the process of transforming and writing messages to the platform are now propagated back to the initiating client.

CXS-453

Minimize context switching

This issue is resolved in this release. To improve performance when processing a request, context switching has been minimized.

CXS-467

Connection Server should allow configuring a short AUTH timeout for WebSockets

The WebSocket will now be closed if no AUTH request is received within some configurable interval (10000 ms by default). The property is transport.websockets.authentication.timeout-ms.

CXS-475

This issue has been resolved as part of PTC’s continued investment in helping customers reduce risks associated with security threats.

CXS-518 (14708758)

Out of Memory issues.

This issue is fixed in the 8.4.0 release.

CXS-527 (14717556)

The Connection Server failed to start due to the following error:

WORKAROUND: Add -Dvertx.disableFileCPResolving=true to the CONNECTION_SERVER_OPTS environment variable.

This issue is fixed in the 8.4.0 release.

TW-35553

Async Java SDK does not correctly implement the WebSocket close session handshake

The async Java client did not reply to the server (ThingWorx platform) with a CloseWebSocketFrame when the platform tried to terminate a connection.

This issue is fixed in this release.

CXS-448 /PSPT-5684 (14571469)

The Connection Server is reporting OOM errors.

This issue is fixed in this release.

CXS-424 (14219987)

Connection Server does not properly handle "multi-part bind messages".

This issue is fixed in this release.

CXS-422

Edge device can assume session permissions of another session.

An edge device, once authenticated using valid security claims, could assume the permissions from another authenticated session by sending request messages with the session ID of the session that it wanted to assume.

This issue is fixed in this release. If a request is sent with a session ID other than the one returned from the initial authentication, the request is ignored. The request exencutes with the permissions associated with the initial authentication session ID rather than the permissions associated with the session ID sent in the request.

CXS-407 (14078591)

The Connection Server may fail to appear in the Connection Server Monitor UI/Mashup when regaining connectivity to ThingWorx.

CAUSE: A race condition in the AlwaysOn protocol adapter could break the flow of egress messages from the ThingWorx Platform to the Connection Server.

This issue is fixed in this release.

CXS-392

ISSUE: Connection Server affinity required for load-balanced Connection Servers when using a multiplexed client

DETAILS: Multiplexed clients (Java SDK) must establish all WebSockets to the same Connection Server. If using a multiplexed client, you must ensure that the load balancer directs all traffic for a given client to the same Connection Server. If all WebSockets do not go to the same Connection Server, the client will experience egress-related issues. Also, if one of the Connection Servers to which the client is attached fails, all things bound through that Connection Server will show up as not connected in the ThingWorx Platform. However, the clients will think that they are still bound and will not try to re-bind. These remote things will not be able to receive egress and cannot send ingress. Restarting the clients will resolve the issue.

CXS-261 / 13622133

EMS Linux + Connection Server 7.2 + ThingWorx Platform 7.2 does not work.

This issue is resolved in this release. The configuration section in the guide for the Connection Server has been updated.

CXS-268

Command to set environment variable as shown in documentation causes errors on startup.

This issue is resolved in this release.

DC-1373

Chunking for uploads of large files was not working.

This issue is resolved.

DC-1376

In multi-part requests, the entityName was not being found properly, resulting in the messages timing out.

This issue is resolved.