14. Firewall Considerations (Advanced)

14A. LyciaWeb Ports

Reiterate that 9090 (non-secure) and 9443 (secure) ports are open.

14B. Kerberos / SSO Authentication

• When configuring Single Sign-On with Kerberos, ensure your firewall allows Kerberos requests between the client and application server.
• Configure your browser to perform SSO authentication (e.g., Chrome command-line parameters like --auth-server-whitelist="*.qx.ua").

Reference: For more on SSO/Kerberos setup, see the Single Sign-on (SSO) authentication page.

14C. SSL Certificates

• For development, self-signed SSL certificates or no certificates are acceptable.
• LyciaDesktop can ignore SSL certificate errors using the --ignore-certificate-errors parameter.
  • Command Example: LyciaDesktop.exe --ignore-certificate-errors …
  • For production, trusted CA-signed SSL certificates are mandatory.
• Reference: For more on SSL certificates, see the SSL certificates page.

14D. Content Security Policy (CSP)

• LyciaWeb: CSP directives can be customized in listener.xml.
• Example listener.xml entry:

• LyciaDesktop: CSP is hardcoded and cannot be customized or disabled.

Reference: For more on CSP, see the Content Security Policy documentation.