Short Description
Saviynt provides support to execute and invoke extensions or custom jars from various application modules. Below are a few Do's and Don'ts that should be followed while building one
Application version
All Versions
Detailed best practice
Do’s:
- Leverage APIs for interacting with the Saviynt application. Please refer to the Saviynt REST API documentation on the documentation portal .
- Package name should be like com.custom.xxxx (Please do not use com.saviynt structure)
- Saviynt API connection credentials to flow from config - Please no not hardcode the credentials inside the code.
- If properties file is used to store sensitive information, then make sure the data is encrypted. And then use decryption within the jar.
- Specifically close resources - don’t rely on garbage collection. (e.g. connection objects, file handles, etc.). Note- if not handled correctly this can lead to memory leaks.
- If you are using any third-party jars, please check the license, security vulnerabilities associated with them carefully.
- All user inputs must be sanitized. Do NOT accept data and directly use it in queries, scripts, etc. that can lead to any form of injection attacks. Check if the data is as per expectation and reject inputs in case of a validation failure.
- Properly free allocated memory when error conditions occur.
- Ensure that appropriate timeouts (for recovery or retries) are added in the code with proper messages.
Don’ts:
- Do not build jar if similar feature is available OOTB.
- Instead of building all the logic in jar try to reuse features available in the application, for example if as part of the custom logic you have to send email then instead of creating a function with smtp information from scratch use Saviynt's sendemail API.
- Do not directly connect to the Saviynt Database .
- No logs / trace should be printed in loop
- Avoid unnecessary initialization of objects
- Don’t print any confidential data in the logs
- Do not use intermediate shells to execute programs.
- Do not disclose sensitive information in error responses, including system details, session identifiers or account information
General best practices to follow are :
- Use Java standard coding practices for writing the efficient code.
- Create and maintain a document including detailed design and test cases
- Use appropriate exception handling techniques to gracefully handle exceptional situations
- Optimize performance - Use efficient data structures and algorithms and minimize unnecessary operations
- Have adequate logs added for debugging purposes.
- Use proper naming conventions.
- Have a proper try catch for error handling.
- Have proper comments / Javadoc added.
- Avoid excessive synchronization.
- Keep Synchronized Sections Small.
Key Benefits
Optimized performance and ease of maintenance
