Installation and User Guide

Transcription

1 Connectivity AutoClient For Alliance Lite 2.0 Installation and User Guide This guide describes how to install, configure, and run AutoClient. It also explains how to send and receive messages and files with AutoClient. This guide is for those who install and configure AutoClient, and those who send and receive files with AutoClient. 19 November 2010

2 AutoClient for Alliance Lite 2.0 Table of Contents 1 Introduction Installation System Requirements Security Recommendations for AutoClient Install AutoClient Uninstalling AutoClient Configuring AutoClient Configuring Local Authentication Modifying Configuration Parameters List of Configuration Parameters How AutoClient Works Emission Directory Reception Directory Archive Directory Error Directory FileAct Delivery Notification Running AutoClient Starting AutoClient Monitoring the Status of AutoClient Stopping AutoClient Sending Files FIN Message Files FileAct Files CSV Files Local Authentication Files Local Test Mode Process Approval of Autoclient Messages and Files Receiving Files Process for Receiving FIN Messages Process for Receiving FileAct Files Process for Receiving CSV Files Monitoring File Transfers List of Errors Errors When Uploading Files to the Alliance Lite Server Pseudo NAK Errors CSV NAK s Installation and User Guide

3 Table of Contents 10 File Examples FIN Message File (RJE Format) FileAct Companion Parameter File FileAct Report Files CSV File Appendix A s and Field Tag Information...67 A.1 Built in s A.2 Field Tag Information Legal Notices November

4 AutoClient for Alliance Lite Introduction What is AutoClient AutoClient is an optionally installed part of Alliance Lite, that allows to integrate other software applications with Alliance Lite. Through AutoClient, your back-office applications can send and receive messages and files over SWIFTNet, in a fully automated way and with strong security. This application provides file-based communication to and from FIN and FileAct services. You can send and receive files containing Standards MT and MX messages, and FileAct files. Customer SWIFT Alliance Lite Web interface AutoClient Back-office application Internet Alliance Lite server SWIFTNet D AutoClient is designed for simplicity and ease of use: Easy automation: AutoClient automatically checks a specific folder, on the PC where it runs, at regular intervals (the frequency is configurable). If AutoClient finds a file in that folder, in one of the supported file formats, it automatically uploads it to the Alliance Lite server. These files are then converted into standard SWIFT messages, or sent as entire files, over SWIFTNet. Vice versa, AutoClient regularly checks on the server for messages or files received from SWIFTNet, and automatically downloads them to a specific reception folder on the PC where it runs. Simple file-based integration: Back-office applications simply need to produce files and put them in a designated AutoClient emission folder to send them on to SWIFTNet. And vice versa, they can read received files from a designated AutoClient reception folder. The files can be in one of 3 formats (for examples see chapter 10"File Examples" on page 55) : FIN files: These are text files, containing messages in standard SWIFT FIN format (MT format). All MT message types are supported, from MT 101 to MT 999. A FIN file can contain several messages, to one or more correspondents. The messages in the file are sent as individual messages on SWIFTNet to your correspondents. The syntax of each message is verified by SWIFT against the SWIFT standard, providing a guarantee to both sender and receiver that the message complies to the SWIFTStandards MT format (see the SWIFT User Handbook, SWIFTStandards MT volumes). CSV files: These are text files, where each line contains a series of comma-separated values. Each line is converted by Alliance Lite into a standard SWIFT message (MT or MX), and that message is sent over SWIFTNet. Only a subset of MT and MX messages are supported. The CSV file formats are described in the Alliance Lite CSV Upload File Format Guide. As these file formats are all simple, they can be produced with a text editor 4 Installation and User Guide

5 Introduction or a spreadsheet application like Microsoft Excel. Many applications exist on the market that can produce or process this formats. FileAct files: These are files in any proprietary format, for example a domestic file format, or an agreed format. The file is transferred in its entirety 'as such', and no validation of the format is performed by SWIFT. Simple start/stop: To start AutoClient, you need an AutoClient token inserted in a USB port of the PC where AutoClient is installed, and you need to provide the password of that token. AutoClient can not run without this token inserted. You do not need to provide the token's password for every message or file that you send. Strong security: The AutoClient USB token is a tamper-proof hardware security module, that digitally signs and authenticates every communication with the Alliance Lite server, using a strong 2048-bit PKI certificate that resides on the token. By default, messages and files uploaded through AutoClient require manual approval by one or more authorised persons that hold their own personal security tokens, as designated by the customer's Alliance Lite Administrators. Finally, the AutoClient can be configured for 'local authentication' i.e. to secure files in transit between the back-office application and the AutoClient, with an additional digital signature that accompanies each file. See "Security Recommendations for AutoClient" on page 7 section 2.2 for more information on security. AutoClient offers two types of services: Live service: This service is used to send and receive real live business messages and files. This service is also called Production service. Test service: This service allows users send and receive messages and files for test and training purposes. Messages and files sent using this Test service will be automatically marked as "test" or "pilot" towards your correspondents, and thus this Test service provides a "safe" environment. Only one security token can be assigned to the AutoClient. Your Alliance Lite Administrators can configure this token to allow use of the Live service, Test service, or both Live and Test services. When AutoClient is used on Test service: only FIN messages sent to FIN Test and Training are accepted and CSV files containing data for Funds MX messages are processed for the pilot Funds service. only files sent to FileAct Test and Training services and Funds MX messages are accepted(service names ending with!p). 19 November

6 AutoClient for Alliance Lite Installation 2.1 System Requirements Overview This section outlines the system requirements for AutoClient. The default installation folder is <drive>\program Files\SWIFT\Alliance Lite\ which is referred to throughout this document as <installation directories>\. Only the base directory (by default, C:\Program Files\SWIFT\Alliance Lite\files ) must be made accessible to the (remote) application for placing and retrieving files. The entire AutoClient installation directory that includes logs, configs, and so forth (by default, C:\Program Files \SWIFT\Alliance Lite) must never be made accessible remotely, because it contains the autoclient.properties file and other sensitive files. Category Operating system Requirement AutoClient runs on the following operating systems: Windows XP with Service Pack 2 (SP2) or Service Pack 3 (SP3) Windows Server 2003 with Service Pack 2 (SP2) Windows Vista with Service Pack 1 (SP1) or Service Pack 2 (SP2) Note SWIFT only supports 32-bit versions for these operating systems. Note Non-English versions of Windows are supported. Disk space Minimum 120 MB for the software installation Minimum 30 MB for the base directory Minimum 60 MB for the log directory Connectivity Standard broadband Internet access, such as ADSL, WiFi, cable, and other forms. Dial-up connectivity will be insufficient. AutoClient can connect to the Internet through a firewall or HTTP proxy, see "Security Considerations" on page 7 AutoClient connects to the Alliance Lite server over SSL/TLS, TCP port 443. AutoClient does not listen on this port, or any other port. Unlike the Alliance Lite web interface, AutoClient does not need Internet Explorer or a Java plug-in, and can be run on a PC where Internet Explorer is not used to browse. However, when installing AutoClient, a system check is performed and this check requires Internet Explorer 6, 7 or 8. The software can be installed on the system running under VMWare Workstation. Running Alliance Lite under other virtualisation technology is not supported. Do not use Microsoft Remote Desktop or VMware server for the installation, de-installation, or monitoring. 6 Installation and User Guide

7 Installation 2.2 Security Recommendations for AutoClient Overview This section provides recommendations for securing the Alliance Lite AutoClient and additional information about the security requirement for normal browsing to Alliance Lite Security Considerations Important It is recommended not to use Alliance Lite from a PC which is used for other applications that use USB based security devices. Access to AutoClient To run AutoClient, the user must plug in a USB token created by the customer's Alliance Lite administrators, see the Alliance Lite Administration Guide. This USB token contains a certificate which, together with an associated password, authenticates the files sent from AutoClient to the Alliance Lite server. The user obtains the USB token from an Alliance Lite administrator. Firewall between AutoClient and the Internet It is strongly advised to use a firewall between the workstations used for Alliance Lite (both the Alliance Lite Web Interface (browser), as well as the AutoClient) and the Internet. For Alliance Lite to function, the firewall must allow outgoing TCP connections from the Alliance Lite workstation(s) towards (for Live service) and to test.swiftalliancelite.com (for Test service) on the standard port for SSL/HTTPS (tcp/443). No incoming connections are required, and we recommend to block all incoming connections from the Internet. Note that if you are using a local (host based) firewall on the computer running AutoClient, it must be configured to accept a local connection between two AutoClient processes on this computer (localhost port 8000). This TCP connection flow is required for AutoClient to function normally. Note You can use an HTTP proxy between AutoClient and the Internet. The HTTP proxy must not attempt to inspect (break) the SSL session. Proxy authentication using login and password is supported by Alliance Lite. See "Configuring AutoClient" on page 18 for more details. Security mechanisms between AutoClient and the Alliance Lite server Use of PKI: X.509 certificates, issued by SWIFT and stored on the USB token identities are issued at BIC level Authentication and encryption: SSL 3.0/ TLS 1.0 using 2-way authentication encryption algorithm: AES November

8 AutoClient for Alliance Lite 2.0 Electronic signature: Hash: SHA-256 The RSA 2048 bit Private Key (used for signing) remains on the USB token. The USB token is password-protected. The key pair generation (USB token) is performed locally at the customer's site. The RSA signature operation is performed internally on the USB token. digital signature of the message exchanges (X.509 V 3.0. PKCS #7 standard) Security between AutoClient and the back-office application It is the user's responsibility to implement the necessary security and access mechanisms between the AutoClient directories and the back-office application. Permissions on directories The Windows user that starts AutoClient with a token, see "Starting AutoClient" on page 29, does not require read or write permissions on the AutoClient file directories. This allows a segregation of duties, for example, the person that can put a file in the AutoClient's emission directory, can be different from the person that can instruct AutoClient to start sending. The AutoClient file directories (emission, reception, archive, and error), located by default under the base directory <installation directories>\files, must have read and write permission for "SWIFT AutoClient Service". This is a Windows service that typically always runs in the background on the PC where AutoClient is installed, whether or not AutoClient has been started with a token, or not. This Windows service is by default started when the PC that hosts AutoClient is started, with no user logged on yet. Therefore by default the user that started this service is the "Local System account", and thus it is this user that must have read and write permission on the AutoClient file directories. These permissions are set automatically by the AutoClient installation. If you require other users or applications to read or write files in those folders, you (a user with Windows Administrator privileges) might need to set these folders' permissions accordingly. Do not give access to these folders to large groups of users, such as Users or Everyone. The logging directory by default is <installation directories>\logs and must have read and write permission for the "Local System account". For more information about permissions and protection, see "Protection of the System" on page 9. Local Authentication The AutoClient can be configured to require local authentication between the back-office application and the AutoClient, to protect files in transit between the application and AutoClient. This is strongly recommended. When local authentication is enabled, the back-office application digitally signs each file that it submits to AutoClient, and AutoClient verifies this signature. If the file has been altered between the back-office application and the AutoClient, then the signature verification will fail and the AutoClient will refuse to send the file. Correspondingly, when local authentication is enabled, the AutoClient will digitally sign every received file when putting it in its reception folder. This allows the back-office application to verify this signature. The signature is calculated with HMAC-SHA-256, a well-known secure hash algorithm with strong key length. This algorithm requires a secret key to be shared between the back-office application and the AutoClient. See "Configuring AutoClient" on page 18 for an explanation on how to configure AutoClient for local authentication. 8 Installation and User Guide

9 Installation Automatic prompting for file download for Reports The reports function uses the "automatic prompting for file downloads" when requesting files. Therefore in the Windows Security Settings, the "automatic prompting for file downloads" option should be set to "enabled" Protection of the System Overview The customer must protect the systems used for Alliance Lite AutoClient in line with industry security practices, such as: Harden all operating systems involved in the AutoClient flow with industry best practices Protect the Alliance Lite AutoClient system from unauthorised network access. Install and manage firewalls to shield that system from incoming Internet traffic, and from unauthorised access over the customer's internal network The firewall solution must be: a physical one to protect incoming traffic from and outgoing traffic to Internet and internal networks. Ideally, no Internet incoming traffic must be accepted that is not required by the AutoClient a PC-local one to ensure that only authorised programmes communicate with the outside. Restrict outgoing traffic from the system to business-critical sites, and to legitimate sites required for software updates. Ideally, do not browse or access the Internet from the PC where you access Alliance Lite AutoClient and dedicate the system for AutoClient only. Use up-to-date virus scanners and malware scanners to protect the Alliance Lite system from malware such as viruses, worms, keyboard loggers, trojans, and rootkits. Scan for viruses any file sent to or received from the AutoClient. Ensure the system used for hosting the AutoClient is only physically and logically accessible by persons entitled to access this system. Ensure that only authorised and required software products are installed on the system used to access Alliance Lite. Ideally, dedicate the system for AutoClient only. Ensure that all software applications that run on the Alliance Lite system are regularly updated and patched. This includes: Windows patches critical Java runtime patches patches for other applications running on the system like the Internet Explorer browser additional features of the browser, called plug-ins like Shockwave, QuickTime, Realplayer, and any others. Ensure that all critical internal flows to or from the system hosting the AutoClient are protected against disclosure or malicious changes, especially, if the AutoClient emission and receiving files are transferred through the network. 19 November

10 AutoClient for Alliance Lite 2.0 Ideally, use strong authentication controls and cryptography means, like flow encryption and authentication, in line with Customer Policy. Note Local Authentication between a back-office application and AutoClient is recommended by SWIFT. See "Security Considerations" on page 7 for further details Protection of the AutoClient USB Token USB Token Protection Users must take the utmost care to protect the AutoClient token from unauthorised borrowing, loss, and theft. They must also take all necessary measures to prevent any unauthorised disclosure of the AutoClient token's password. Ensure only authorised and identified individuals use the AutoClient token Ensure each active AutoClient token is safe-stored when not used Revoke any unused or lost token. The customer's Alliance Lite administrator can do this, see the Alliance Lite Administration Guide. The users must never: lend the AutoClient token to others leave the token inserted in the PC, unless the PC is in a secured area, protected from physical and logical (network) access by unauthorised persons or applications write down any password or communicate a password to unauthorised people use a password that can be deduced easily allow anybody to watch over its shoulder when the token's password is entered Local Protection of the AutoClient System Local protection The customer must implement the following management principles to mitigate the risks to its system: Establish user management practices to ensure that only authorised users are created and remain on the system Because users change roles or leave the company, ensure that the administrator maintains an accurate and up-to-date list of authorised users aligned with the actual access to the system. Establish entitlement management practices to ensure that users are granted access to Alliance Lite functions only on a need to know or need to have basis. Specially, protect the AutoClient software, files, and hosting directories against unauthorised local and domain access by setting up strict permissions and remove any default access like Users and Everyone permissions. Take into consideration any local and remote access (like RDP and Windows File Sharing/CIFS). Implement Segregation of Duty principles to separate tasks like administration of the system, security administration tasks, and users of the AutoClient. 10 Installation and User Guide

11 Installation Control and monitor the access and usage of the system administrator and any account having access to any of the AutoClient files and hosting directories, specially the emission, and reception directories. For instance, implement 4-eyes procedures to access privileged accounts in a way that two or more people are required to do administrative tasks. Ideally, monitor as well the activities of these accounts to detect any malicious action. Establish a solution to log the access and all activities of the privileged accounts and protect these logs for forensic purposes as well. Protect the AutoClient backups against malicious modification and disclosure ideally by cryptographic means, like strong signature and encryption of the backups, in line with Customer Policy. Monitor daily traffic, to detect mismatches between authorised and actual traffic, both, sent or received. The user must not delegate all the Alliance Lite administrator roles to a single person that can then use the two different USB tokens to create its own AutoClient token. 2.3 Install AutoClient Overview The following section provides details of how to install the AutoClient Software. Note Do not use Microsoft Remote Desktop or VMware server for the installation, or deinstallation. Running Alliance Lite under other virtualisation technology is not supported. Note You must remove your USB token when installing or upgrading your AutoClient. What you need to install AutoClient the CD labelled "Alliance Lite 2.0.1", which contains the AutoClient software, or the Alliance Lite software downloaded from > Support > Download centre. Only use one of these two sources, do not use software provided by others. you must be logged in as a Windows user with Windows Administrator privileges, to install AutoClient. To start or use AutoClient once it is installed, you do not need Windows Administrator privileges. the user who is installing the AutoClient software needs the All Access permission (read and write) on the installation directories. The installation directory is by default <drive>\program Files\SWIFT\Alliance Lite but the user can change this at the start of the installation. Note The new installation removes the previously installed AutoClient. If you have been using a previous version of Alliance Lite, then SWIFT recommends using the same folders when installing Alliance Lite The software is upgraded, and the content of AutoClient file directories (emission, reception, archive, and error), are preserved. The installation of the driver for the Alliance Lite USB tokens over-writes all existing SafeNet software that was already present on your PC. If you have older SafeNet software and want to preserve it, then install Alliance Lite on a different system. 19 November

12 AutoClient for Alliance Lite 2.0 Note Installing AutoClient through a Remote Desktop can lead to a corrupted SafeNet driver on the local machine. This can be seen by looking at the SafeNet icon that identifies a USB token is present but when the certificate details are checked the pop-up shows the "token removed" text. installation.log The installation.log file records events that occur during installation. This file is created under <installation directories>\logs. If you encounter a problem during installation, then check the contents of this file. To install AutoClient: 1. Insert the CD labelled "Alliance Lite 2.0.1" in the CD drive. 2. Double-click the AllianceLite-install.exe file. The installation application unpacks the files in the installer. This may take 2 to 3 minutes. When the installer files are unpacked, the following window appears: 3. Select Install Alliance Lite AutoClient, and click Next. This also installs the Alliance Lite USB token driver automatically. The End-user Licence window appears. 4. Accept the terms, and click Next. The following window appears. 12 Installation and User Guide

13 Installation 5. Select a directory where to install Alliance Lite, by doing either of the following: To accept the default directory, click Next. To select another directory, click Browse... to locate the directory, or type a local directory of your choice. Then click Next. Note The directory must be a local directory if the default directory was not selected. The following window appears. 6. In this window, define the following parameters: Base Directory: the directory used by AutoClient to store files and exchange files with customer applications, by default this is <drive>\program Files\SWIFT\Alliance Lite \files, that is, a subdirectory of the installation directory. This directory does not have to 19 November

14 AutoClient for Alliance Lite 2.0 be a subdirectory of the installation directory, and can reside on another disk on the same computer. For security reasons, do not put this directory on another computer or on a networked disk. Note If you migrate from a previous version of the AutoClient, then the previous version of the AutoClient is un-installed but the contents of the Base Directory are left untouched. SWIFT recommends that you specify the same directory when installing a newer version of the AutoClient. Emission Timer: the interval (in seconds) with which AutoClient checks for files ready to be sent to counterparties. Reception Timer: the interval (in seconds) with which AutoClient checks for files received from counterparties. Advanced: if you want AutoClient to connect to the Internet through an HTTP proxy server, then click Advanced.... Configuration window In the configuration window that appears, select the Configure AutoClient to connect through a proxy checkbox, and specify the following information: in the Hostname field, type the IP address or hostname of the proxy server through which to connect to the Internet in the Port field, type a valid TCP port for the proxy server Then click OK or optionally if the proxy requires authorisation, then in Username, type the name of the proxy, and in Password, its password. Note To modify these parameters after installation, see "Configuring AutoClient" on page Click Next after specifying the parameters. If the base directory that you have selected does not exist, then click Yes to create it. After you click Next or Yes, the Close Applications window may appear if you have other applications currently running. If not, go to step Do either of the following: Close the applications listed in the window, and click Next (this is the SWIFT recommended method) Select Continue installation without closing the running applications, and click Next 14 Installation and User Guide

15 Installation Note If the previously installed AutoClient is still running, then there might be a slight delay during which the Next is disabled while the installer shuts down the running AutoClient. 9. A window appears to confirm the Alliance Lite installation details that you have entered in the previous steps. Do either of the following: To confirm the installation details, and proceed with the installation, click Install. Note When you click Install, you cannot roll back the installation. To modify the installation details, click Previous and make the necessary changes. Note If there is already SafeNet Drivers installed, you are asked to confirm that you want to overwrite them. After you click Install, the AutoClient software and the Alliance Lite USB token driver are installed. You need to remove the USB token when prompted. 19 November

16 AutoClient for Alliance Lite The Test Firewall Configuration screen appears: Click the Test Connections button to run the test to ensure that your firewall does not block communications, or Next to skip the test. If there are any configuration problems with your firewall, the response received will depend on the firewall. but normally you will receive a message asking you if you wish to "allow the connection now and in the future". To configure the firewall accept the request. When the test is complete click OK in the pop-up message that appears. 11. Upon successful installation, the Installation Complete window appears. Select your preferred restart option, and click Finish. You must restart your computer before you start using AutoClient. 2.4 Uninstalling AutoClient To remove AutoClient: 1. Remove the USB token (note that the uninstall may fail if the USB token is still inserted). 2. Do the following: Click the Windows Start > Settings > Control Panel and use the: Add or Remove Programs option on Windows XP Programs and Features option on Windows Vista. The Alliance Lite Uninstallation window appears. 3. Click Next to proceed, or Cancel to terminate the process. A warning prompts you to confirm the uninstallation. 4. Click Yes to remove the software, or No to terminate the process. After you click Yes, the Close Applications window may appear if you have other applications currently running. 16 Installation and User Guide

17 Installation 5. Do either of the following: Close the applications listed in the window, and click Next Select Continue installation without closing the running applications, and click Next. After you click Next, the removal of the software starts. When the process is complete, the Uninstallation Complete window appears to confirm that the software was removed successfully. 6. Click Finish. Note The content of AutoClient file directories (emission, reception, archive, and error), are preserved after installation. It is the responsibility of the user to remove the contents and the directories. 19 November

18 AutoClient for Alliance Lite Configuring AutoClient Introduction This section explains how you can configure Local Authentication and modify the AutoClient configuration parameters that you set during AutoClient installation. 3.1 Configuring Local Authentication Overview The Local Authentication (LAU) option can be turned on or off by the user for each of the three different file types that AutoClient supports. The different file types that AutoClient supports are FIN, FileAct, and CSV files. If LAU signature is required for a file type, then AutoClient generates an LAU signature to accompany a received file of that type. AutoClient also verifies the correctness of LAU signatures that the back-office application generates to accompany the files to be sent of that type. LAU signatures are placed in separate files called LAU files with a ".lau" file extension. These LAU files are always stored alongside the payload file to which they refer to, so that they may be stored in all the four directories: archive, emission, error, and reception. Note Users should note that the autoclient.properties file contains confidential data (the LAU keys), so only the "files" directory should be made accessible remotely for placing and retrieving files. In no case should the whole AutoClient directory (that includes logs, configs, and so forth.) be accessible remotely. To configure LAU in AutoClient: 1. Double-click the setpasswords.cmd file located in the Alliance Lite installation directory. The Set Passwords tool appears. 2. In the Set Passwords tool, select 2 to set the FIN LAU key, select 3 to set the FileAct LAU key, or select 4 to set the CSV LAU key. Press ENTER. 3. Type the 17 to 32 ASCII characters for your key and press ENTER. 4. Type the 17 to 32 ASCII characters again to confirm the key values entered in the previous step and press ENTER. Note Make a note of the key value, since exactly the same key value needs to be configured into the back-office application. 5. If the ASCII characters are accepted, go to step 6. rejected, repeat steps 3 and Select 5 and click ENTER to save the changes and exit the Set Passwords tool. Select 6 and press ENTER to discard the changes and exit. To remove LAU from AutoClient: 1. Load the autoclient.properties file into an editor from the config subdirectory in the Alliance Lite installation directory. 18 Installation and User Guide

19 Configuring AutoClient 2. Locate the line at the end of the file that defines the encrypted key value an delete the line. For the FIN key, the line will start at FinLauKey.enc. For the FileAct key, the line will start FileActLauKey.enc. For the CSV key, the line will start CsvLauKey.enc. 3. Save the file. 3.2 Modifying Configuration Parameters Note When you modify a configuration parameter, you must restart AutoClient before the new setting takes effect. To modify a configuration parameter: 1. Locate the autoclient.properties file under <installation directories>\config, and doubleclick this file. All lines that start with a # (hash character) are comment lines. The content of this file resembles the following: # Parameter Name: BaseDirectory # Public : YES # Possible values: N/A # Default Value: No default value. # Description: Base directory: may not exceed 50 characters. Must be a # valid local directory with read and write permissions. # BaseDirectory=C:\\Program Files\\SWIFT\\Alliance Lite\\files # Parameter Name: AllowRetries # Public : YES # Possible values: TRUE FALSE # Default Value: TRUE # Description: When set to TRUE, will retry a failed upload up to 3 times # and each attempt will be separated by 3600 sec. # When set to FALSE, the AutoClient will not retry a failed upload. The # upload status is immediately set to error. AllowRetries=TRUE # Parameter Name: EmissionTimerInMillis # Public : YES # Possible values: min = 5000 msec, max = msec # Default Value: msec # Description: The local emission directory polling frequence. EmissionTimerInMillis=5000 # Parameter Name: ReceptionTimerInMillis # Public : YES # Possible values: min = msec, max = msec # Default Value: msec # Description: The remote server polling frequence. ReceptionTimerInMillis=60000 # Parameter Name: HttpsProxyEnabled # Public : YES # Possible values: TRUE FALSE # Default Value: FALSE # Description: Specifies whether this autoclient should connect through a # Proxy server. HttpsProxyEnabled=FALSE # Parameter Name: HttpsProxyHost # Public : YES # Possible values: valid host name or IP address of the proxy server. # Default Value: No default value. # Description: Address of the proxy server through which to connect # to the Internet. Only taken into account if 'HttpsProxyEnabled' is set to TRUE. HttpsProxyHost=localhost # Parameter Name: HttpsProxyPort 19 November

20 AutoClient for Alliance Lite 2.0 # Public : YES # Possible values: Valid TCP port for the proxy server. # Default Value: No default value. # Description: Valid TCP port for the proxy server. Only taken # into account if 'HttpsProxyEnabled' is set to TRUE. HttpsProxyPort=8080 # Parameter Name: HttpsProxyUser # Public : YES # Possible values: Valid user name for accessing the Internet through the # proxy server configured by 'HttpsProxyHost' and 'HttpsProxyPort'. # Default Value: No default value. # Description: Valid user name as configured within the proxy server. Only # taken into account if 'HttpsProxyEnabled' is set to TRUE and none of # the 'HttpsProxyUser' and 'HttpsProxyUser' is left empty. HttpsProxyUser= # Parameter Name: HttpsProxyPassword[.enc] # Public : YES # Possible values: Valid password for proxy user defined in 'HttpsProxyUser'. # Default Value: No default value. # Description: Valid password as configured within the proxy server for the # 'HttpsProxyUser'. Only taken into account if 'HttpsProxyEnabled' is set to # TRUE and none of the 'HttpsProxyUser' and 'HttpsProxyUser' is left empty. HttpsProxyPassword.enc= # Parameter Name: LocalTestMode # Public : YES # Possible values: TRUE FALSE # Default Value: FALSE # Description: When set to TRUE, causes AutoClient to process messages for # emission up to an including LAU validation but will not send any files. # This can be used to test interoperability between back-office applications and AutoClient. LocalTestMode=FALSE 2. Edit the parameters manually, as appropriate. To do this, change the value specified in the last line of the details of a parameter. In the example shown, to modify the current value (120000) for the ReceptionTimer parameter, the value in the following line must be changed: ReceptionTimerInMillis= Note For HttpsProxyPassword, FinLauKey, FileActLauKey, and CsvLauKey parameters, the value must be changed using the setpasswords tool in the installation directory. 3. Save and close the file once you have made the required modifications. 4. Stop and start AutoClient for your changes to take effect. 3.3 List of Configuration Parameters You can modify the following configuration parameters: Parameter BaseDirectory Description The directory used by AutoClient to store and retrieve files. It must not exceed 50 characters. It must be either a valid local directory or a valid remote UNC directory with read and write permissions for the Windows account that started the "SWIFT AutoClient Service" Windows service (by default, this is the "Local System account"). 20 Installation and User Guide

21 Configuring AutoClient Parameter AllowRetries Description Default value: TRUE When set to TRUE, AutoClient retries a failed upload 3 times, and each retry is separated by 3600 sec When set to FALSE, AutoClient does not retry a failed upload. The upload status is immediately set to error. EmissionTimerInMillis ReceptionTimerInMillis HttpsProxyEnabled HttpsProxyHost HttpsProxyPort HttpsProxyUser HttpsProxyPassword.enc FinLauKey.enc FileActLauKey.enc CsvLauKey.enc LocalTestMode The interval (in seconds) with which AutoClient checks for files ready to be sent to counterparties. Default value: 120 seconds The value of this parameter must be between 60 and 5000 seconds. The interval (in seconds) with which AutoClient checks for files received from counterparties. Default value: 120 seconds The value of this parameter must be between 60 and 5000 seconds. Specifies whether AutoClient must connect through a proxy server. Default value: FALSE The IP address (or hostname) of the proxy server through which to connect to the Internet. Only taken into account if "HttpsProxyEnabled" is set to TRUE. Used if the connections to the Internet are made through a proxy, such as an Apache. In some cases, an administrator wants to authenticate the users connecting to the proxy. In that case the uname / pwd is used on top of regular proxy settings. A valid TCP port for the proxy server. Only taken into account if "HttpsProxyEnabled" is set to TRUE. The username to authenticate the AutoClient towards its Proxy The password of the ProxyUser. Note that the value of this parameter must be changed using the setpasswords tool in the installation directory. LAU key for FIN file transfers. Note that the value of this parameter must be changed using the setpasswords tool in the installation directory.. LAU key for FileAct file transfers. Note that the value of this parameter must be changed using the setpasswords tool in the installation directory. LAU key for CSV file transfers. Note that the value of this parameter must be changed using the setpasswords tool in the installation directory. Used to test the flow between the Back-Office and the AutoClient without actually sending the files to Alliance Lite. The AutoClient checks the LAU but does not submit or lock the files. Example with proxy Parameter HttpsProxyEnabled Value TRUE HttpsProxyHost HttpsProxyPort 8080 HttpsProxyUser username 19 November

22 AutoClient for Alliance Lite 2.0 Parameter HttpsProxyPassword Value <xxxxxxxxxx> Example without proxy Parameter HttpsProxyEnabled HttpsProxyHost Value FALSE localhost HttpsProxyPort 8080 HttpsProxyUser HttpsProxyPassword 22 Installation and User Guide

23 How AutoClient Works 4 How AutoClient Works Overview AutoClient uses a directory structure on the local host to interface with your back-office application. This section describes the AutoClient directory structure, what are the functions of each directory, and the types of file contained in each directory. It is the user's responsibility to determine the way the back-office application communicates with AutoClient. The AutoClient directory structure When you install AutoClient, you must specify a location for the installation directory (by default, C:\Program Files\SWIFT\Alliance Lite ) and a location for the base directory (by default, C: \Program Files\SWIFT\Alliance Lite\files ) on the AutoClient host. The base directory contains four subdirectories: emission, reception, archive, and error. Other technical directories also exist and are located in the installation directory, such as: logs: contains the AutoClient log files and installation log files config: contains the AutoClient configuration file called autoclient.properties The previous diagram shows the default directory structure under Program Files. The 'files' directory is the base directory, and can be placed elsewhere at installation time. 4.1 Emission Directory Emission The back-office application uses the emission directory to request upload of files by AutoClient to SWIFTNet. AutoClient regularly scans the emission directory for new files to be uploaded. The EmissionTimerInMillis polling timer determines how often the emission directory is scanned, see "List of Configuration Parameters" on page 20. The back-office application can submit FIN (RJE) files, FileAct files, and CSV files, with or without LAU files with the following conventions: 19 November

24 AutoClient for Alliance Lite 2.0 For FIN: <filename>.fin (data file) <filename>.fin.lau ( LAU file) For FileAct,: <filename>[.pde] (data file) <filename>[.pde].par (a companion parameter file). The file transfer only starts if the.par file is present. [.pde]: the back-office application may add a.pde (Possible Duplicate Emission) extension to the file name. This.pde extension is then carried up to the destination. The.pde extension can be added to the file name to indicate that this file may have been sent already. This extension forces the file transfer to be marked as possible duplicate on the reception side (<filename>.<transferref>s[_pdr]). The.pde extension is not applicable to FIN files. <filename>[.pde].par.lau (LAU file) for CSV, <filename>.csv (data file) <filename>.csv.lau ( LAU file) The emission directory does not require any maintenance because the AutoClient automatically moves a file from its emission directory to its archive directory (see "Archive Directory" on page 27), when the file has been uploaded to the Alliance Lite server. Note However, the back-office application must monitor the emission directory. Should a file stay in the emission directory for more than 30 minutes, the back office application must raise an alarm. The AutoClient Operator must investigate the issue. 4.2 Reception Directory Reception The reception directory contains the files that your organisation receives from counterparties. It also contains the status of the messages that your organisation sent previously through AutoClient. AutoClient regularly polls the Alliance Lite server for new files ready for download. Files appear in the server when they are completely downloaded and ready for the back-office application to process. The ReceptionTimerInMillis timer determines how often AutoClient checks the reception directory for files received from counterparties, see "List of Configuration Parameters" on page 20. The reception directory can contain the following types of file: FIN (Standards MT) files: identified by extension.fin and if LAU is enabled, LAU files are identified by extension fin.lau containing the business MTs addressed to your organisation. 24 Installation and User Guide

25 How AutoClient Works with the status of messages that you have sent through AutoClient (ACK, NAK, MT 010, MT 011, MT 012, MT 019, or pseudo NAK). Conforming to the following conventions: <filename>.fin (data file) <filename>.fin.lau ( LAU file) For more information, see "Process for Receiving FIN Messages" on page 45. FileAct files (any format): files received transfer status of files sent previously LAU file in reception directory (if LAU is enabled) Conforming to the following conventions <filename>.<transferref>s[_pdr] <filename>.<transferref>s[_pdr].par <filename>.<transferref>s[_pdr].ok <filename>.<transferref>s[_pdr].err If LAU is enabled: <filename>.<transferref>s[_pdr].par[.lau] <filename>.<transferref>s[_pdr].ok[.lau] <filename>.<transferref>s[_pdr].err[.lau] For the transfer status of files sent previously <filename>.<transferref>c.ok <filename>.<transferref>c.dlv <filename>.<transferref>c.err <filename>.<timestamp>.err If LAU is enabled: <filename>.<transferref>c.ok.lau <filename>.<transferref>c.dlv.lau <filename>.<transferref>c.err.lau <filename>.<timestamp>.err.lau For more information, see "Process for Receiving FileAct Files" on page 46. <TransferRef>: SWIFT generates a unique string of characters called TransferRef. The TransferRef contains a timestamp assigned by SWIFTNet, and is the same at the sender and at the receiver side, except for the last character. 19 November

26 AutoClient for Alliance Lite 2.0 The last character is: C for files sent by AutoClient S for files received by AutoClient [_pdr]: in some cases (for example, after retries during the FileAct transfer), the FileAct protocol adds a _pdr extension (Possible Duplicate Reception) to the received data file, companion parameter, or report file names. This additional extension is carried unaltered to the reception directory..lau for the LAU of files sent previously CSV Application Files identified by an extension.csv, or.csv.lau if LAU is activated contain the statuses of messages previously sent within a CSV file. Received CSV files do not contain business messages. Conforming to the following conventions <filename>.csv (data file) <filename>.csv.lau ( LAU file) The <filename> structure consists of : <Instruction>_<Status>_<timestamp>.csv[.lau] where the structure elements can contain the following: Instructions: Subscription, Redemption, SwitchSLeg, SwitchRLeg, ConfSubscription, ConfRedemption, ConfSwitchSLeg, ConfSwitchRLeg, Status, StatusSwitch. Status: can be ACK, DLV, NAK, ABD, DELNAK and OVRDUE Note The instruction type is the message business name as defined in the CSV layout definition document. It is the keyword used in the incoming CSV to identify the message type. Example: Subscription_ACK_ csv The following is the format of a CSV file: <status> <error code> <error text> <status time stamp> <original filename><position in original file> <copy of first line from original message in CSV> [,,,,,<copy of line 2 from original message in CSV>] will be present for switch orders, may be present for semt* [,,,,,<copy of line 3 from original message in CSV>] may be present for semt* [,,,,,<copy of line 4 from original message in CSV>] may be present for semt* It is the user's responsibility to maintain the reception directory - AutoClient does not automatically move files from the reception directory. SWIFT recommends that you perform regular archives of the files contained in this directory. 26 Installation and User Guide

27 How AutoClient Works 4.3 Archive Directory Archive FIN and FileAct files that have been successfully uploaded to the Alliance Lite server are moved from the emission directory to the archive directory. Note The presence of a file in the archive directory does not mean that the file has been sent on SWIFTNet, or delivered to the receiver - that is indicated through other means, see "Sending Files" on page 33. The archive directory can contain the following types of file: for a FIN file: <filename>.<timestamp>.fin (original) <filename>.<timestamp>.fin.lau (original) if LAU enabled for a FileAct file, two files are present: <filename>[.pde].<timestamp> (original) <filename>[.pde].<timestamp>.par <filename>[.pde].<timestamp>.par.lau (copy of original) if LAU enabled for a CSV file: <filename>.<timestamp>.csv (original) <filename>.<timestamp>.csv.lau (copy of original) if LAU enabled It is the user's responsibility to maintain the archive directory. SWIFT recommends that you perform regular archives of the files contained in this directory. 4.4 Error Directory Error The error directory contains copies of the files that resulted in an error before or during upload, together with an error file (with extension.err) containing a description of the error. The error directory can contain the following types of file: for a FIN file, two files are present: <filename>.<timestamp>.fin (original) <filename>.<timestamp>.fin.err <filename>.<timestamp>.fin.lau if LAU enabled <filename>.<timestamp>.fin.err.lau if LAU enabled for a FileAct file, three files are present: <filename>[.pde].<timestamp> <filename>[.pde].<timestamp>.par 19 November

28 AutoClient for Alliance Lite 2.0 <filename>.<timestamp>.err <filename>[.pde].<timestamp>.par.lau if LAU enabled <filename>[.pde].<timestamp>.err.lau ) if LAU enabled for a CSV file, two files are present: <filename>.<timestamp>.csv <filename>.<timestamp>.csv.err <filename>[.pde].<timestamp>.csv.lau if LAU enabled <filename>[.pde].<timestamp>.csv.err.lau if LAU enabled It is the user's responsibility to maintain the error directory. SWIFT recommends that you perform regular archives of the files contained in this directory. 4.5 FileAct Delivery Notification Sending a notification Should a FileAct transfer require a Delivery Notification, Alliance Lite creates this Delivery Notification Automatically for the receiver. Alliance Lite creates the Delivery Notification once the Receiver's AutoClient has successfully downloaded the file. The FileAct delivery notification is stored in the reception directory. Receiving a notification When you send a FileAct Transfer, you receive the Delivery Notification in the Reception directory of your AutoClient as a.dlv file. 28 Installation and User Guide

29 Running AutoClient 5 Running AutoClient Overview This section explains how to start and stop AutoClient, and how to monitor the status of AutoClient. To run AutoClient, you must have a USB token created by an Alliance Lite Administrator specifically for AutoClient. You also need the password associated with this USB token. For more information, see the Alliance Lite Administration Guide. 5.1 Starting AutoClient To start AutoClient: The "SWIFT AutoClient Service" runs automatically as a Windows Service under a system account: 1. Insert the AutoClient USB token in a USB port. 2. Do one of the following: Click the Windows Start button, and select Programs > Alliance Lite > Start AutoClient. Or, right-click the AutoClient icon in the Windows Tray and click Start AutoClient from the shortcut menu In the Alliance Lite installation path use one of the command line utility: autoclient - start. Note You can start AutoClient by connecting either to the Live service or to the Test service. 3. Type the password of the AutoClient USB token and select Live if you want to connect Autoclient to the Live service. Select Test&Training if you want to connect the AutoClient to the Test service. Do one of the following: If AutoClient starts successfully, then the AutoClient Monitor icon (in the Windows Tray) turns green. AutoClient polls the Alliance Lite server for files ready for download, and the emission directory for files ready to be sent. If AutoClient fails to start, then the AutoClient Monitor icon turns yellow or red, and an error message appears. For more information, see "Monitoring the Status of AutoClient" on page November