The OFTP Connector sends and receives files via the OFTP protocol.
OFTP connections are configured in two places: the OFTP Profile section of the Profile page, and individual OFTP connectors in the Flows page. In the OFTP Profile section, the local OFTP entity should be identified via an Odette Identifier, and settings for the local OFTP server should be configured. Each OFTP connector should be configured to make outbound connections to a single trading partner, i.e a single OFTP entity.
For information on routing an OFTP message through a separate OFTP entity (e.g. a clearinghouse), please see the Message Routing section.
The OFTP Profile must be configured before connections can be established with individual OFTP connectors.
OFTP Profile Tab
Settings for identifying the local profile.
- Odette Identifier (SSID Code) Your Odette identifier. This value will be included in outgoing transmissions to identify the sender, and incoming messages must be addressed to this identifier. Odette identifiers are provided by the Odette organization.
- Password (SSID Password) The password associated with the Odette Identifier. This can be a value of your choosing, as long as your trading partners have the same value configured on their systems.
Settings related to the private decryption and signature certificate.
- Data Decryption Certificate The certificate that will be used to decrypt incoming messages and sign outgoing messages. This certificate should never be shared with any external parties. Click the Create Certificate button to generate a new self-signed certificate that is ready to use in an OFTP transaction; a corresponding public key certificate will also be generated with the same filename and a ‘.cer’ extension.
- Certificate Password The password required to access the Data Decryption Certificate.
Settings related to the OFTP server implementation.
- Port The port on which the server will listen for incoming connections.
- Use SSL/TLS Whether SSL/TLS must be negotiated to connect to the server.
- SSL Private Certificate If SSL is enabled, an SSL certificate is required to verify the server’s identify.
- Certificate Password The password required to access the SSL certificate.
Settings related to server logging.
- Enable Server Log Whether to maintain server-side logs for incoming OFTP connections.
- Log Debug Info Whether to log additional information about OFTP connections and transmissions that are useful for debugging.
- Rotate Log Files The number of days that the server should maintain a logfile before a new file is started.
- Delete Log Files The number of days that the server should maintain logs before the logfile is deleted.
After configuring the OFTP Profile, OFTP Connectors can be created in the Flows page and configured for a specific trading partner.
Settings related to the remote OFTP entity to connect to.
- Identifier The Odette Identifier for the remote OFTP entity (the trading partner’s identifier).
- Password The password associated with the partner’s identifier.
- Version The version of the OFTP protocol to use when exchanging files.
- Remote Host The hostname or IP address of the remote OFTP server.
- Port The port on which to connect to the remote OFTP server.
- Use SSL Whether negotiate SSL/TLS when connecting to the remote OFTP server.
- Secure Odette Authentication Whether to perform application-layer encryption and decryption. Both a signing and encryption certificate must be specified to perform this authentication.
Settings related to the OFTP connection parameters.
- Virtual File Format The OFTP file format to be used when transmitting files.
- Virtual File Security Whether to sign and/or encrypt outgoing messages.
- Compression Whether to compress outgoing messages.
- Request Signed Receipts Whether outgoing messages should cause a signed receipt to be returned.
- Overwrite local files When a file is received that already exists locally, whether that file should be overwritten or the incoming message should be ignored.
Trading Partner Certificates
Settings related to the public key certificates provided by the trading partner.
- Encryption Certificate The public key certificate used for encryption when sending messages. This certificate must be paired with the trading partner’s private decryption certificate, and the trading partner should provide this public key certificate when sharing OFTP configuration details.
- SSL Server Certificate The public key certificate used to verify the identity of an SSL/TLS server. Only necessary if the partner’s OFTP system requires SSL/TLS. If the trading partner does not provide an SSL server certificate, this setting can be set to ‘Any Certificate’ to unconditionally trust the target server’s identity.
Settings related to routing an OFTP message through a separate OFTP entity.
- Routing Partner If outgoing OFTP messages should be routed through an OFTP entity that is separate from the target OFTP entity, then this field should be set to the OFTP connector that is configured to connect to the intermediary OFTP server. For example, if the connector needs to send files to serverA and route the file through serverB, then the connector should be configured to connect to serverA and this field should be set to an OFTP connector configured to connect to serverB.
Settings related to the automatic processing of files by the connector.
- Send Whether files arriving at the connector will automatically be sent as OFTP messages.
- Retry Interval The amount of time before a failed send is retried. A retry is triggered when the server does not respond to a send attempt, or responds negatively to communicate that the file was not received.
- Retry Maximum Attempts The maximum number of times a failed send will be retried before an error is thrown by the connector.
- Resend Interval The amount of time before unacknowledged messages are resent. A resend is triggered when the server receives the file, but a receipt is not provided within the expected timeframe.
- Resend Maximum Attempts The maximum number of times a file will be resent before an error is thrown by the connector.
Optional Certificates (PEM/CER Format)
Settings related to additional certificates to use for enhanced security.
- Auth Challenge Certificate The public key certificate to present when challenged by the server to verify authenticity.
- Verification Certificate The public key certificate to use when verifying digital signatures on incoming messages.
- Receipt Verification Certificate The public key certificate to use when verifying digital signatures on incoming receipts.
- Rollover Certificate An additional certificate to use for authentication. Useful when an overlap period between certificate change is needed.
- Rollover Verification Certificate An additional certificate to use for signature verification. Useful when an overlap period between certificate change is needed.
Alternate Local Profile
Settings that override the OFTP configuration in the Profile page for this specific OFTP connector. Setting an alternate local profile allows the use of different local certificates and identifiers for certain trading partners.
- SSID Your Odette identifier. Overrides Odette Identifier in the Profile section. The OFTP Server will use the Alternate SSID and Password from this partner. When sending, this ID will be used as both the file sender and for session authentication, unless overridden by the relaying partner. If SSID and SFID are both set, the SFID will be used when sending the file.
- Password The local identifier password.
- SFID When accepting incoming OFTP files, ArcESB will process messages in this connector as though they were relayed from the local OFTP profile. Incoming network connections will still be greeted with the SSID and password from the OFTP profile (unless overridden in this section). If SSID and SFID are both set, the SFID will be used when sending the file.
- Private Certificate The certificate that will be used to decrypt incoming messages and sign outgoing messages. Overrides Data Decryption Certificate in the Profile section.
- Certificate Password The password required to access the local private certificate.
SSL Client Authentication
Settings related to client authentication when two-way SSL authentication is required.
- Private Certificate The private certificate presented during SSL client authentication.
- Certificate Password The password required to access the SSL client certificate.
Settings that determine the folder on disk that files will be sent/uploaded from, and the folder that they will be received/downloaded to.
- Input Folder (Send) The connector can send/upload files placed in this folder. If Send Automation is enabled, the connector will automatically poll this location for files to process.
- Output Folder (Receive) The connector will place received/downloaded files in this folder. If the connector is connected to another connector in the flow, files will not remain here and will instead be passed along to the Input/Send folder for the connected connector.
- Processed Folder (Sent) After processing a file, the connector will place a copy of sent/uploaded files in this folder if Save to Sent Folder is enabled.
An arbitrary set of commands to execute on the remote server at various times during connector execution: directly after connecting, after downloading each file, after uploading each file, before downloading each file, and before uploading each file.
Settings related to the allocation of resources to the connector.
- Max Workers The maximum number of worker threads that will be consumed from the threadpool to process files on this connector. If set, overrides the default setting from the Profile tab.
- Max Files The maximum number of files that will be processed by the connector each time worker threads are assigned to the connector. If set, overrides the default setting from the Profile tab.
Settings not included in the previous categories.
- Connect to Receive Whether to connect to the remote party to receive files, even if no files are ready to be sent.
- Connect to Receive Interval The interval between connection attempts to receive files when no files are ready to be sent.
- Encryption Algorithm The algorithm to use when encrypting outgoing messages.
- Enforce Protocol Version Whether to accept protocol versions not configured for this partner.
- Send Filter A glob pattern filter to determine which files in the Send folder will be uploaded by the connector (e.g. *.txt). Negative patterns may be used to indicate files that should not be uploaded (e.g. -*.tmp). Multiple patterns may be separated by commas, with later filters taking priority except when an exact match is found.
- File Description Map The map to set file description text for sending files. A semi-colon-delimited list of glob patterns for matching filenames. For example, ‘INVOICE*=This is an invoice;*ORDER.*=This is an order’
- Log Debug Info Whether enhanced logging is enabled for the connector. When requesting support, it is recommended to generate a debug log and provide this along with the support request.
- Max Record Size When the virtual file format is Fixed or Variable, this field determines the maximum size of each record. The default record size is 128.
- Parent Connector The connector from which settings should be inherited, unless explicitly overwritten within the existing connector configuration. Must be set to a connector of the same type as the current connector.
- Received Filename Format Incoming files will be written to the Receive Folder using this filename convention. The following macros may be used to ensure that unique filenames are generated:
- Virtual Filename Map The map from local filenames to outgoing virtual filenames when sending files. A semi-colon-delimited list of glob patterns for matching filenames. For example, ‘INVOICE*=filename1;*ORDER.*=filename2’
- Log Messages Whether the log entry for a processed file will include a copy of the file itself.
Save to Sent Folder Whether files processed by the connector should be copied to the Sent folder for the connector.
- SSL Enabled Protocols The list of SSL/TLS protocols supported when establishing outgoing connections. It is strongly recommended to only use TLS protocols. Some obsolete operating systems do not support TLS 1.2.
Establishing a Connection
The following settings are required to establish an outgoing OFTP connection:
- Identifier (the trading partner’s identifier)
- Password (associated with the trading partner’s identifier)
- Remote Host
After establishing a connection, the appropriate trading partner certificates must be configured before files can be securely transferred.
Send and Receive Files
After the OFTP profile and partner-specific OFTP Connectors have been configured, files can be securely sent and received.
Within an OFTP Connector, the Input tab displays the files that should be sent to the target trading partner. If Send Automation is enabled, files that reach the Input/Send Folder of the connector will automatically be packaged and sent. Successful transmissions are indicated by a green ‘Sent’ status, while warning and error statuses are represented in yellow and red. The log files for failing or successful transmissions can be accessed by expanding the row associated with the transmitted file.
The Create Test Files button can be used to generate a simple series of test files to send to the trading partner.
Resend and Retry
An OFTP Resend is triggered when the trading partner is expected to return an asynchronous receipt, but fails to do so within the Resend Interval duration (by default this is 60 minutes). The application then attempts to resend the transmission. The application will continue re-sending the message until a receipt is received or the Resend Maximum Attempts is exhausted.
A Retry is triggered when the protocol response from the trading partner’s system indicates that the server has not received the transmission. This can indicate a networking or connectivity issue, which are often transient. The application will retry the transmission every Retry Interval minutes until the transmission is received or the Retry Maximum Attempts is exhausted.
Within an OFTP Connector, the Output tab displays the files that have been received by the application and routed to the connector. Files are routed to a specific OFTP Connector based on the Odette Identifier present in the incoming OFTP message. Each file row can be expanded to display a list of available logs for the transmission.
These files are available in the Output/Receive Folder of the connector. If the connector is connected to other connectors in the flow, files will automatically be moved from the Output/Receive Folder of the OFTP Connector to the Send directory of the next connector in the flow.
Each OFTP connector is configured to connect to a single OFTP entity. Sometimes OFTP involves a routing scenario, where a file originating at one OFTP entity (call it serverA) needs to pass through another OFTP entity (call it serverB) to reach the destination OFTP entity (call it serverC).
In this scenario, the Odette Identifier of serverB is the SSID value during the transfer, and the Odette Identifier of serverC is the SFID. In other words, the SSID identifies the ‘middleman’ server that the originator connects to, and the SFID identifies the target entity that this ‘middleman’ should forward/route the OFTP message to.
OFTP Routing in Arc
To accomplish this routing scenario in Arc, configure one OFTP Connector to connect to serverB (i.e. the ‘middleman’ server) and another OFTP Connector to connect to serverC (i.e. the destination server).
The OFTP Connector configured to connect to serverC must also have the Routing Partner field set to the OFTP Connector that is configured to connect to serverB.
Files to send out to the destination server should be processed by the OFTP Connector configured to connect to serverC. The other OFTP Connector (targeting serverB) is used behind-the-scenes to route the message, but does not directly process files within the Flow.
SSID vs SFID
If a partner provides a single identifier that they call an SFID, configure a single OFTP connector to connect with this entity, and use the SFID as the SSID. If the partner provides an SFID value and an SSID value, the SFID corresponds to serverC in the above scenario, and the SSID corresponds to serverB.