ActivityBase Web Server Installation Guide

Transcription

1 ActivityBase Web Server Installation Guide

2 Information in this document is subject to change without notice. The software described in this document is furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in accordance with the terms of those agreements. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or any means electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of IDBS. The names of actual companies and products mentioned in this document may be trademarks of their respective owners. IDBS accepts no responsibility or liability for any errors or inaccuracies that may appear in this documentation. Copyright 2013 IDBS Date of issue: 15 th July 2013

3 Contents Contents... 3 Introduction... 5 Server Roles Installation... 6 Overview... 6 Step 1: Run Add Roles Wizard... 6 Step 2: Select Role Service Features to install... 7 Step 3: Confirm Installation Server Features Installation Overview Step 1: Select the Features node in the tree in Server Manager and click on Add Features Step 2: Select Features to install Step 3: Confirm Installation IDBS ActivityBase Web Upgrade Overview Step 1: Stop the ActivityBase Web Site Step 2: Uninstall the current version of ActivityBase Web Step 3: Install the new version of ActivityBase Web Step 4: Restart the ActivityBase Web Site IDBS ActivityBase Web Installation Overview Run the ActivityBase Web Setup Wizard IDBS ActivityBase Web Configuration Overview Step 1: Set Root Directory Step 2: ActivityBase Membership Provider Connection Settings Step 3: Oracle Connection Settings for Proxy User Step 4: Server Certificate Settings Step 5: Windows Impersonation Account Settings Step 6: Commit changes to Configuration Files How To: Setup a Certificate for Secure Sockets Layer (SSL) Overview Step 1: Install ActivityBase Web Step 2: Choose the type of Certificate to use Step 3a: Request a new Certificate from an Internal Certification Authority Step 3b: Create a new Self-Signed Certificate Step 4: Enable HTTPS Binding for the Site in IIS Step 5: Establish Certificate Trust on the Client Page 3 of 47

4 Step 6: Install Root Certification Authority (CA) on the Client Step 7: Grant Access Permissions to the Certificate s Private Key How To: Add the ActivityBase Web application to Internet Information Services (IIS) Overview Step 1: Configure the Application Pool Step 2: Add the ActivityBase Web application Step 3: Test the Web Services using HTTPS protocol (SSL) How To: Create multiple Websites from the same installation Overview Step 1: Clone the directory structure Step 2: Add the ActivityBase Web application to Internet Information Services (IIS) How To: Enable external Windows authentication Overview Step 1: Disable the ActivityBase Oracle Membership Provider Step 2: Enable the Active Directory Membership Provider Step 3: Set the Default Membership Provider Step 4: Set the Application Pool Identity Troubleshooting HTTP Error Not Found HTTP Error Not Found HTTP Error Service Unavailable HTTP Error Internal Server Error w3wp process spiking to 100% CPU usage Unable to create or modify an XE Template from the Web client Duplicate MIME type for.jnlp File Extension Web Server Log File is not created Found Multiple X.509 Certificates An operations error occurred Keyset does not exist Page 4 of 47

5 Introduction This document contains information on how to install and configure an ActivityBase Web Server. It is specific to ActivityBase and Windows Server 2008 R2. The document deals with: Installing the Server Roles & Features required to support ActivityBase Installing ActivityBase Web. Adding the ActivityBase Web application to Internet Information Services (IIS). Configuring IDBS Plate Creator to communicate with the Web Server over a secure connection using Secure Socket Layer (SSL). Configuring the Result Writing Component (RWC) to communicate with the Web Server over a secure connection using Secure Socket Layers (SSL). Configuring the ActivityBase Web client to communicate with the Web Site over a secure connection using Secure Socket Layer (SSL). Creating multiple instances of the ActivityBase Web application in IIS. Enabling external Windows authentication. Troubleshooting Before running the ActivityBase Web server installation an Oracle database client must be installed. The software version must be either 10gR2 or 11gR2 (64-bit version), patched up to the latest patch set available. The installation must include the Oracle Data Provider for.net (ODP.NET) if it is an optional component. The recommended version is The steps involved in running the Oracle Universal Installer are outside the scope of this document. If you have any problems with the install, or have any feedback or comments, please your local support office (support@idbs.com) or refer to the IDBS Customer Support Portal. Page 5 of 47

6 Server Roles Installation Overview This section describes how to install the Web Server (IIS) role on the Windows Server (2008 R2). This server role provides all the necessary support and infrastructure required to host the ActivityBase Web site and related Web services. Step 1: Run Add Roles Wizard Login to the server with Administrative privileges. Open Server Manager from Administrative Tools. Select the Roles node in the tree and click on Add Roles. Check the Web Server (IIS) role box from the list of roles to install on the server. If the server is going to be used as an ActivityBase file server, then also check the File Services role box. Click on Next twice. Page 6 of 47

7 Step 2: Select Role Service Features to install Select the role services to install based on the recommended set of role service features in the table below. Role Service Feature Required? Description Common HTTP Features Static Content Yes Static Content allows the Web server to publish static content, such as HTML pages and image files. Default Document Yes Default Document lets you configure a default file for the Web server to return when users do not specify a file in a URL. Directory Browsing Optional 1 Directory Browsing lets users see the contents of a directory on your Web server. Use Directory Browsing to enable an automatically generated list of all directories and files available in a directory when users do not specify a file in a URL and default documents are either disabled or not configured. HTTP Errors Yes HTTP Errors lets you customize the error messages returned to users browsers when the Web server detects a fault condition. HTTP Redirection No HTTP Redirection provides support to redirect user requests to a specific destination. WebDAV Publishing No WebDAV Publishing (Web Distributed Authoring and Versioning) enables you to publish files to and from a Web server by using the HTTP protocol. Application Development ASP.NET Yes ASP.NET provides a server side object-oriented programming environment for building Web sites and Web applications based on the.net Framework..NET Extensibility Yes.NET Extensibility lets managed code developers change, add, and extend Web server functionality in the request pipeline, the configuration, and the User Interface. ASP No Active Server Pages (ASP) provides a server side scripting environment for building Web sites and Web applications. ASP offers improved performance over CGI scripts by providing IIS with native support for both VBScript and Jscript. CGI No Common Gateway Interface (CGI) defines how a Web server passes information to an external program. Typical uses might include using a Web form to collect information and then passing that information to a CGI script to be ed somewhere else. Because CGI is a standard, CGI scripts can be written by using a variety of programming languages. The downside to using CGI is the performance overhead. ISAPI Extensions Yes Internet Server Application Programming Interface (ISAPI) Extensions provides support Page 7 of 47

8 for dynamic Web content development using ISAPI extensions. An ISAPI extension runs when requested, just like any other static HTML file or dynamic ASP file. Since ISAPI applications are compiled code, they are processed much faster than ASP files or files that call COM+ components. ISAPI Filters Yes Internet Server Application Programming Interface (ISAPI) Filters provides support for Web applications that use ISAPI filters. ISAPI filters are files that can extend or change the functionality provided by IIS. An ISAPI filter reviews every request made to the Web server, until the filter finds one that it needs to process. Server Side Includes No Server Side Includes (SSI) is a scripting language that is used to generate HTML pages dynamically. The script runs on the server before the page is delivered to the client and typically involves inserting one file into another. For example, you might create an HTML navigation menu and use SSI to dynamically add it to all pages on a Web site. Health & Diagnostics HTTP Logging Yes HTTP Logging provides logging of Web site activity for this server. When a traceable event (usually an HTTP transaction) occurs, IIS calls the selected logging module, which then writes to one of the logs stored in the file system of the Web server. These logs are kept in addition to those provided by the operating system. Logging Tools No Logging Tools provides infrastructure to manage Web server logs and automate common logging tasks. Request Monitor Yes Request Monitor provides infrastructure to monitor Web application health by capturing information about HTTP requests in an IIS worker process. Administrators and developers can use Request Monitor to understand which HTTP requests are executing in a worker process when the worker process has become unresponsive or very slow. Tracing No Tracing provides infrastructure to diagnose and troubleshoot Web applications. By using failed request tracing, you can troubleshoot difficult to capture events like poor performance or authentication-related failures. This feature buffers trace events for a request and only flushes them to disk if the request falls into a user-configured error condition. Custom Logging No Custom Logging provides support for logging Web server activity in a format that differs greatly from how IIS generates log files. Use Custom Logging to create your own logging module. Custom logging modules are added to IIS by registering a new COM component that implements ILogPlugin or ILogPluginEx. ODBC Logging No ODBC Logging provides infrastructure that supports logging Web server activity to an Page 8 of 47

9 ODBC-compliant database. By using a logging database, you can programmatically display and manipulate data from the logging database on an HTML page. You might do this to search logs for specific events that you want to monitor. Security Basic Authentication No Basic Authentication offers strong browser compatibility. Appropriate for small internal networks, this authentication method is rarely used on the public Internet. Its major disadvantage is that it transmits passwords across the network using an easily decrypted algorithm. If intercepted, these passwords are simple to decipher. Use SSL with Basic authentication. Windows Authentication No Windows Authentication is a low cost authentication solution for internal Web sites. This authentication scheme allows administrators in a Windows domain to take advantage of the domain infrastructure for authenticating users. Do not use Windows authentication if users who must be authenticated access your Web site from behind firewalls and proxy servers. Digest Authentication No Digest Authentication works by sending a password hash to a Windows domain controller to authenticate users. When you need improved security over Basic authentication, consider using Digest authentication, especially if users who must be authenticated access your Web site from behind firewalls and proxy servers. Client Certificate Mapping Authentication IIS Client Certificate Mapping Authentication No No Client Certificate Mapping Authentication uses client certificates to authenticate users. A client certificate is a digital ID from a trusted source. IIS offers two types of authentication using client certificate mapping. This type uses Active Directory to offer one-to-one certificate mappings across multiple Web servers. IIS Client Certificate Mapping Authentication uses client certificates to authenticate users. A client certificate is a digital ID from a trusted source. IIS offers two types of authentication using client certificate mapping. This type uses IIS to offer one-to-one or many-to-one certificate mapping, and offers better performance over Client Certificate Mapping authentication. URL Authorization No URL Authorization allows you to create rules that restrict access to Web content. You can bind these rules to users, groups, or HTTP header verbs. By configuring URL authorization rules, you can prevent users who are not members of certain groups from accessing content or interacting with Web pages. Request Filtering Yes Request Filtering screens all incoming requests to the server and filters these requests based on rules set by the administrator. Many malicious attacks share common Page 9 of 47

10 Performance characteristics, such as very long URLs, or requests for an unusual action. By filtering requests, you can try to reduce the impact of these types of attacks. IP and Domain Restrictions No IP and Domain Restrictions allow you to enable or deny content based on the originating IP address or domain name of the request. Instead of using groups, roles, or NTFS file system permissions to control access to content, you can specify IP addresses or domain names. Static Content Compression Dynamic Content Compression Optional 2 No Static Content Compression provides infrastructure to configure HTTP compression of static content. This provides more efficient use of bandwidth. Unlike dynamic responses, compressed static responses can be cached without degrading CPU resources. Dynamic Content Compression provides infrastructure to configure HTTP compression of dynamic content. Enabling dynamic compression always gives you more efficient use of bandwidth, but if your server's processor utilization is already very high, the CPU load imposed by dynamic compression might make your site perform more slowly. Management Tools IIS Management Console Yes IIS Manager provides infrastructure to manage IIS 7.5 by using a graphical user interface. You can use IIS Manager to manage a local or remote Web server that runs IIS 7.5. IIS Management Scripts and Tools No IIS Management Scripts and Tools provide infrastructure to manage an IIS 7.5 Web server programmatically by using commands in a Command Prompt window or by running scripts. You can use these tools when you want to automate commands in batch files or when you do not want to incur the overhead of managing IIS by using the graphical user interface. Management Service No Management Service provides infrastructure to configure the IIS 7.5 user interface, IIS Manager, for remote management in IIS 7.5. IIS 6 Management Compatibility IIS 6 Metabase Compatibility No IIS 6.0 Metabase Compatibility provides infrastructure to query and configure the metabase so that you can run applications and scripts written in earlier versions of IIS that used the Admin Base Object (ABO) or Active Directory Service Interface (ADSI) APIs. IIS 6 WMI Compatibility No IIS 6.0 WMI Compatibility provides Windows Management Instrumentation (WMI) scripting interfaces to programmatically manage and automate tasks for IIS 7.5 by using a set of scripts that you create in the WMI provider. You can manage sites with this service by using the WMI CIM Studio, WMI Event Registration, WMI Event Viewer, and WMI Object Browser tools. IIS 6 Scripting Tools No IIS 6.0 Scripting Tools provides the ability to continue using IIS 6.0 scripting tools that were built to manage IIS 6.0 in IIS 7.5. This is especially useful if your applications and Page 10 of 47

11 scripts use ActiveX Data Objects (ADO) or Active Directory Service Interface (ADSI) APIs. IIS 6.0 Scripting Tools requires the WAS Configuration API. IIS 6 Management Console No IIS 6.0 Manager provides infrastructure for administration of remote IIS 6.0 servers from this computer. FTP Server FTP Service No FTP Server enables the transfer of files between a client and server by using the FTP protocol. Users can establish an FTP connection and transfer files by using an FTP client or FTP-enabled Web browser. FTP Extensibility No Enables support for FTP extensibility features such as custom providers, ASP.NET users or IIS Manager users. IIS Hostable Web Core IIS Hostable Web Core No Core IIS Web engine components can be consumed or hosted by other applications. This lets IIS 7 components service HTTP requests directly in an application. This is useful for enabling basic Web server capabilities for custom applications or for debugging applications. 1 By default, directory browsing is enabled in IIS so that users can see the contents of directories. To enhance security, you should set directory browsing to disabled unless you have a specific reason to enable it. If you enable directory browsing, make sure that you only enable it on the particular directory or directories that you want to share. 2 If other Web sites also hosted in IIS use large amounts of bandwidth or if you want to use bandwidth more effectively, consider enabling HTTP Static Content Compression. This provides faster transmission times between IIS and compression-enabled browsers. If your network bandwidth is restricted, HTTP compression can be beneficial unless your processor usage is already very high. Compressed static responses can also be cached without degrading CPU resources. Page 11 of 47

12 Step 3: Confirm Installation Click Next to confirm then click on Install. Once finished click on Close. Please note that the server may require a reboot once the installation completes. Page 12 of 47

13 Server Features Installation Overview This section describes how to install the Windows Server features necessary to support ActivityBase Web. This includes the Microsoft.NET Framework which provides the runtime environment used by the application. Step 1: Select the Features node in the tree in Server Manager and click on Add Features. Step 2: Select Features to install The server features in the table below are mandatory and must be installed for the ActivityBase to function correctly. Feature Sub-Feature.NET Frameworks Features.NET Framework WCF Activation Windows Process Activation Process Model Service.NET Environment Configuration APIs Page 13 of 47

14 All other features in the server features list are optional. It is recommended that the Web Service (IIS) Remote Server Administration Tool is installed. This includes the Internet Information Services (IIS) 6.0 Manager and IIS Manager snap-ins and related command-line tools which allow IIS features to be managed remotely. Step 3: Confirm Installation Click Next to confirm then click on Install. Once finished click on Close and then close the Server Manager. Please note that the server may require a reboot once the installation completes. Page 14 of 47

15 IDBS ActivityBase Web Upgrade Overview This section describes how to upgrade a previous 8.0.x version of the ActivityBase Web application to Important: If you have used an SSL certificate to secure the current version of ActivityBase Web then this certificate can be reused (provided that the certificate s subject name contains the fully qualified DNS hostname of the Web server). Otherwise, please refer to the instructions for setting up an SSL certificate in the section titled How To: Setup a Certificate for Secure Sockets Layer (SSL). Important: If you have made any customizations to either the grid or form layouts then these should be backed up prior to the upgrade. The folders to backup are:- {Program Files}\IDBS\ActivityBase Web\Web Site\Forms {Program Files}\IDBS\ActivityBase Web\Web Site\Grids Step 1: Stop the ActivityBase Web Site Open a Command Prompt. Execute the following command to stop the ActivityBase Web site:- %systemroot%\system32\inetsrv\appcmd.exe stop site /site.name: Default Web Site Replace Default Web Site with the name of the Web Site which the ActivityBase Web application is installed under in IIS. Step 2: Uninstall the current version of ActivityBase Web Select Start Control Panel Uninstall a program. Select IDBS ActivityBase Web from the list of installed programs and click on Uninstall. Page 15 of 47

16 Click Yes to confirm that you wish to uninstall IDBS ActivityBase Web. Follow the steps to uninstall the program. Note: If the uninstaller program fails to remove any files from {Program Files}\IDBS\ActivityBase Web these can be manually deleted. Step 3: Install the new version of ActivityBase Web Follow the steps in the section titled IDBS ActivityBase Web Installation to install the new version of ActivityBase Web. Details of how to configure the new installation can be found in the section titled IDBS ActivityBase Web Configuration. Note: If you have made backups of customizations to either the grid or form layouts then these should be restored at this point. Step 4: Restart the ActivityBase Web Site Open a Command Prompt. Execute the following command to restart the ActivityBase Web site:- %systemroot%\system32\inetsrv\appcmd.exe start site /site.name: Default Web Site Replace Default Web Site with the name of the Web Site which the ActivityBase Web application is installed under in IIS. Page 16 of 47

17 IDBS ActivityBase Web Installation Overview This section describes how to install the ActivityBase Web application on the server. Run the ActivityBase Web Setup Wizard Run the IDBS ActivityBaseWeb.msi installation file. Click Next. Check the box to accept the terms in the License Agreement and click Next. Page 17 of 47

18 Select the most appropriate setup type to suite your needs. (Both Typical and Complete install all program features. Custom allows the default target installation folder to be changed). Click Next. Click Install. When the installation completes tick the Launch Configuration Tool checkbox and click Finish. The ActivityBase Web Configuration Tool will be launched. The configuration settings are described in the next section. Page 18 of 47

19 IDBS ActivityBase Web Configuration Overview This section describes how to configure the ActivityBase Web application. The ActivityBase Web application requires a number of settings to be modified post install and a configuration tool is provided to support this. Step 1: Set Root Directory Open the ActivityBase Web Site Configuration Tool (Start menu -> IDBS Software -> Utilities) Click on the Set Root Directory tab. Select the root ActivityBase Web directory, as chosen during the installation process, in the folder browser dialog that opens. The default for this will be {Program Files}\IDBS\ActivityBase Web\Web Site Once selected, a number of sections will become available for configuration. Step 2: ActivityBase Membership Provider Connection Settings This section configures the custom Membership provider used for authenticating users with the ActivityBase Oracle database. Click the ActivityBase Membership Provider Connection Settings option on the left hand side. Enter the Oracle database connection details that the web site will use when authenticating users. This can be either a SQL*Net alias name for the database or an Oracle EZConnect string. It is recommended that an Oracle EZConnect string is specified, as this eliminates the need for service name lookups in tnsnames.ora files when connecting to an Oracle database across a TCP/IP network. The syntax is: [//]host[:port][/service_name] where: // Optional. Specify // for a URL Page 19 of 47

20 host Required. Specify the host name or IP address of the database server. This should be fully domain-qualified if the local operating system configuration specifies a domain. port Optional. Specify the listening port. The default is service_name Optional. Specify the service name of the database. The default is the host of the database server computer. e.g. //DEVELOPMENT1:1521/ORCL Note: An Oracle TNS identifier may be specified for the data source (SQL*Net Alias). If this alternative is used, it is important that the named identifier set on the client machines matches the name set in the Web Server. Otherwise, the user will be able to launch an XE template maintenance session, but will be unable to create or update templates. Step 3: Oracle Connection Settings for Proxy User This section sets up the connection string for the proxy user used by the Web site and Web services to connect to the database. Click the Oracle Connection Settings for Proxy User option on the left hand side. Enter the proxy username, proxy password, ActivityBase database schema and SQL*Net alias or EZConnect string. Note that the ProxyUserName is the ABASEPOOL user defined when the ActivityBase schema was installed/upgraded and the schema is name of the ActivityBase schema e.g. ABASE. Page 20 of 47

21 Step 4: Server Certificate Settings This section sets up the server certificate used for WCF authentication. This certificate is used to encrypt the client credentials and secure the messages transmitted between client and server. Enter the subject name of the certificate to use for authentication. Note: The subject name of this certificate must contain the fully qualified DNS hostname of the Web Server. This is because during the authentication negotiation the client checks the subject name of the certificate sent from the server against the hostname of the machine making the HTTP request. This is to prevent man-in-the-middle style attacks. Note: This certificate can be the same as the certificate setup in Internet Information Services (IIS) for Secure Sockets Layer (SSL). Refer to the section titled How To: Configure the ActivityBase Web application to use a Secure Sockets Layer (SSL). Page 21 of 47

22 Step 5: Windows Impersonation Account Settings This section sets up the Windows user account used to access the ActivityBase file server. By default, the Web site runs as the user account of the application pool which it is installed under in IIS. Typically, this account will have the least privileged set of access permissions possible. Therefore, to allow the Web site to access the ActivityBase file server a special proxy account must be nominated, or created. Note that the account requires read / write access to the ActivityBase file server in order to read and write ActivityBase files (templates, plate formats, import definitions and associated documents). Enter the domain, username and password. Note: To learn how to create a Windows domain user account please refer to the following Microsoft Guidance document Step 6: Commit changes to Configuration Files Click on the Update Files tab. Confirm the message that the configuration files have been updated successfully by clicking OK. Select File -> Exit to close the configuration tool. Note: Please refer to the configuration related known issue w3wp process spiking to 100% CPU usage in the Troubleshooting section of this document. Page 22 of 47

23 How To: Setup a Certificate for Secure Sockets Layer (SSL) Overview The section details how to configure the ActivityBase Web server and client computer(s) with a certificate to use for Secure Sockets Layer (SSL). Secure Sockets Layer is the industry standard security technology for establishing an encrypted channel between a Web server and a Web browser. All data passed through this channel between the Web server and Web browsers will remain private and integral. Typically, an SSL Certificate will contain your domain name, your company name, your address, your city, your state and your country. It will also contain the expiration date of the Certificate and details of the Certification Authority responsible for the issuance of the Certificate. When a Web browser connects to a secure Web site it will retrieve the site's SSL Certificate and check that it has not expired, it has been issued by a Certification Authority the Web browser trusts, and that it is being used by the website for which it has been issued. If it fails on any one of these checks the Web browser will display a warning to the end user letting them know that the site security cannot be trusted. Based on the type of failure, the user may be allowed to ignore the warning and proceed at their own risk. A certificate may be provided from a certificate issuing authority. This could be obtained from a Window Server 2003 or 2008 Certificate Server with your organization, or purchased from a third-party Certification Authority such as VeriSign Authentication Services, now part of Symantec Corporation. Alternatively, you can create a "self-signed certificate" which is a test certificate that should only be used during the development and testing of the Web site. A self-signed certificate is less secure because it is not issued from a trusted Certification Authority (CA) source and is therefore not recommended for use in a production environment. Step 1: Install ActivityBase Web Perform a full install of ActivityBase Web on your server machine. Step 2: Choose the type of Certificate to use If you wish to use an existing certificate purchased from a Certification Authority such as VeriSign TM then proceed to step 4. Note that this certificate must be registered to your domain and the subject name must contain the hostname of your Web server. If you wish to request a certificate from a Certification Authority within your organization please follow step 3a. Alternatively, if you wish to create a "self-signed certificate" please follow step 3b. Step 3a: Request a new Certificate from an Internal Certification Authority Open Internet Information Services (IIS) Manager on the server machine. Select the root Web-Server node in the left-hand tree-view, and then double click on the "Server Certificates" button in the Features View. Page 23 of 47

24 Click on the Create Domain Certificate... link in the actions pane on the right-hand-side of the screen. Complete the Distinguished Name Properties page to provide information about your organization to an internal certification authority. Enter the information described in the table below into the relevant fields. Page 24 of 47

25 Field Name Common Name Organization Organizational unit City/locality State/province Country/region Description Type a subject name for the certificate. Note: this should be the same as the fully qualified DNS hostname of the Web server. For example: SERVER.DOMAIN.COM Type the name of the organization for which the certificate will be used. Type the name of the department or division in the organization in which the certificate will be used. Type the unabbreviated name of the city or locality where your organization or organizational unit is located. Type the unabbreviated name of the state or province where your organization or organizational unit is located. Type the name of the country or region where your organization or organizational unit is located. Click Next to continue. Complete the Online Certification Authority page to specify details of the Certificate Server to request the certificate from. Enter the information described in the table below into the relevant fields. Field Name Specify Online Certification Authority Friendly Name Description Type the certificate authority name and certificate server name using the following notation: CertificateAuthorityName\Servername Note: your network administrator should be able to advise you on this setting. Type a friendly name to identify the self-signed certificate. Page 25 of 47

26 Click on Finish. If the request was successful the new server certificate will be displayed in the Server Certificates list. Proceed to step 4. Step 3b: Create a new Self-Signed Certificate Open Internet Information Services (IIS) Manager on the server machine. Select the root Web-Server node in the left-hand tree-view, and then double click on the "Server Certificates" button in the Features View on right-hand side of the screen. Page 26 of 47

27 Click on the Create Self-Signed Certificate... link in the actions pane on the right-hand-side of the screen. Complete the Specify Friendly Name page to provide a friendly name to identify the certificate. Type a friendly name for the certificate. Note: The friendly name should match the DNS hostname of the server hosting the Web site. For example, ABASEWEB. Page 27 of 47

28 Click OK. The new server certificate will be displayed in the Server Certificates list. Step 4: Enable HTTPS Binding for the Site in IIS Important: ActivityBase Web requires both HTTP and HTTPS protocols to be enabled. Where SSL is not used, communications between client and Web Server are secured with an X.509 certificate at the message-level rather than transport-level. Do not remove the HTTP binding, or enable the Require SSL setting for the ActivityBase Web Site in IIS. Open Internet Information Services (IIS) Manager on the server machine. To SSL enable the ActivityBase Web services select the Default Web-Site node in the left-hand tree-view, and then click the "Bindings" link in its "actions" pane on the right-hand side of the screen. Page 28 of 47

29 This will then bring up a dialog that lists all of the binding rules that direct traffic to this site (meaning the host-header/ip address/port combinations for the site): To enable SSL for the site, you will need to click the "Add..." button. This will bring up an "Add Site Binding" dialog that you can use to add HTTPS protocol support. You can select the self-signed certificate you created earlier from the SSL certificate dropdown list in the dialog, and in doing so indicate that you want to use that certificate when encrypting content over SSL. Page 29 of 47

30 Click OK. Close the Site Bindings window. Step 5: Establish Certificate Trust on the Client For a certificate to work properly, certain requirements must be met on both the server and the client. Each side has a list of root Certification Authorities (CAs) that they trust. When the server prompts for a certificate, the request includes a list of the certification authorities that the server trusts. The client then compares this list to the list of certification authorities that the client trusts and creates a list of the ones that match. Then, the client compares that list to the client certificates it has and determines which, if any, certificates have been issued by Certification Authorities that both the client and the server trust. Only if there is a mutual Certification Authority that both sides trust will communication between the client and the server be allowed to continue. If you have elected to use an existing certificate purchased from a Certification Authority such as VeriSign then, normally, no additional configuration will be required on the client machine(s). This is because the root Certification Authorities for well-known trusted sources, like VeriSign, are trusted by Microsoft and distributed in the Microsoft Windows Operating System. In this case, omit Step 6. If you have chosen to use a certificate requested from an internal Certification Authority within your organization then it is likely that the root Certification Authority will already be trusted on your client machine(s). Your network administrator should be able to confirm this. If confirmed, omit Step 6. Alternatively, if you have decided to use a Self-Signed Certificate which is self-issued then you will need to install this on every client machine from which you wish to run the ActivityBase Web Client or ActivityBase Thick client using the Result Writing Component (RWC) or IDBS Plate Creator. Step 6: Install Root Certification Authority (CA) on the Client Open Microsoft Management Console on the client machine. (From a Command Prompt run mmc.exe). Select File Add/Remove Snap-in... from the menu. Select the Certificates snap-in from the list of available snap-ins. Click on Add>. Page 30 of 47

31 In the Certificates snap-in window select the Computer account radio button. Click on Next> to continue. In the Select Computer window select the Local computer radio button. Note: this is this client computer that the console is running on. Click on Finish. Repeat the previous steps to add another Certificates snap-in for the remote computer. Page 31 of 47

32 In the Select Computer window select the Another computer radio button. Type the name of the Web Server which the ActivityBase Web application is running on. Note: this is this client computer that the console is running on. Click on Finish. Page 32 of 47

33 Verify that the Add or Remove Snap-ins window displays two selected snap-ins; one for the Local Computer (client) and one for the remote computer (Web server). Click on OK. The console window will display a tree view containing the certificate stores from the Local Computer (client) and the remote computer (Web server). Page 33 of 47

34 Expand the Trusted Root Certification Authorities node on the remote computer (Web server). Locate the root Certification Authority certificate. Note: This will be the Self-Signed certificate which is self-issued that was created in Step 3b. Expand the Trusted Root Certification Authorities store on the local computer (client). Copy the root Certification Authority certificate from the Trusted Root Certification Authorities store on the remote computer to the Trusted Root Certification Authorities store on the client computer. Note: To copy the certificate, hold down the CTRL key and drag the certificate from the source node to the destination node in the tree. A warning prompt will appear to inform you the private key will not be copied with the certificate. Click Yes to complete the copy. Page 34 of 47

35 Step 7: Grant Access Permissions to the Certificate s Private Key Note: The above process only generates and stores the certificate in the certificate store, but it does not assign any permission on that certificate. In order for ActivityBase Web to use the certificate, you may need to grant permissions to the user account which the ActivityBase application pool runs under. For instance, the user account DefaultAppPool is the default account which Web services hosted in IIS 7.5 will be run under. Expand the Personal Certificates node on the remote computer (Web server). Right-click on the SSL certificate and select All Tasks Manage Private Keys... A dialog will be displayed showing the current permissions for the certificate s private key. Page 35 of 47

36 Check that the user account which the ActivityBase application pool runs under (e.g. DefaultAppPool) is assigned Full Control permissions. If not, click on Add and grant this permission. Click on OK. Finally, select File Exit to close the Microsoft Management Console. Note: Internet Information Services (IIS) may need to be restarted after granting privileges on the server certificate for the changes to take effect. From a Command Prompt run: iisreset. Page 36 of 47

37 How To: Add the ActivityBase Web application to Internet Information Services (IIS) Overview The section details how to add the ActivityBase Web application to Internet Information Services (IIS). In IIS terms, an application is a grouping of files that delivers content or provides services over protocols, such as HTTP. In addition to belonging to a site, an application belongs to an application pool, which isolates the application from applications in other application pools on the server. When an application is created in IIS, the application's path becomes part of the site's URL. A directory is designated as the application root, or starting point, for the application. Then specific properties are applied to that particular application, such as the protocol scheme and application pool that the application will run in. Step 1: Configure the Application Pool This step is optional but highly recommended. In IIS, an application pool is a group of one or more URLs that are served by a worker process (a windows service that runs Web applications) or a set of worker processes. The main benefit of using application pools is that they set boundaries for the applications they contain, which means that if an application in one application pool fails, applications in other application pools will not be affected. Another advantage is that by assigning resource-intensive applications to their own application pool the performance of other applications is less likely to decrease. Isolating applications also improves security because it reduces the chance that one application is able to access the protected resources of another application. Open Internet Information Services (IIS) Manager from Administrative Tools on the server machine. Expand the connection that will contain the website and select the Application Pools node in the left-hand tree-view, and then right-click and select "Add Application Pool..." from the context menu. Page 37 of 47

38 In the Add Application Pool dialog, enter a name to uniquely identify the application pool e.g. ActivityBase. Select the version of the.net Framework to be loaded by the application pool. Select the Integrated managed pipeline mode which supports requests for managed content by integrating IIS and ASP.NET in the request processing pipeline. Check the checkbox to enable the application pool to automatically start whenever the Windows Process Activation Service (WAS) is started. Note that if automatic startup is disabled, the application pool must be manually started otherwise requests made to applications in the application pool will return an HTTP 503-Service Unavailable error. Click on OK. The new Application Pool will now appear in the main page when Application Pools is selected. Step 2: Add the ActivityBase Web application Open Internet Information Services (IIS) Manager from Administrative Tools on the server machine. Select the Default Web Site node in the left-hand tree-view, and then right-click and select "Add Application..." from the context menu. Page 38 of 47

39 In the Add Application dialog, enter an alias that clients can use to access the application s content from a Web browser. For example, if the site base address is and the application for this site is given the alias /ActivityBase, users can access the application from their Web browser by typing Add the physical path for the application content. For a Typical installation type this is: {Program Files}\ IDBS\ActivityBase Web\Web Site. If a unique application pool for the application to run in was created in Step 1 then select this, otherwise leave the DefaultAppPool as default. Click on OK. Page 39 of 47

40 Step 3: Test the Web Services using HTTPS protocol (SSL) Open Internet Explorer (or another supported Web Browser) on the client machine. Enter the following address in the address bar (replacing localhost with the Web server fully qualified hostname as appropriate): If you are using Internet Explorer and a self-signed certificate, you may encounter the anti-phishing security alert regarding the origin of the certificate. Do not be concerned if this happens - it is just IE being helpful by suggesting that a self-signed certificate on your local machine looks suspicious. Click the "Continue to this website" link to bypass this security warning and proceed to the site. If the root authority certificate is added to the Trusted Root Certification Authorities certificate store on the client machine then the above warning message will not be shown. The Plate Mapping Service web page should be displayed. Page 40 of 47

41 How To: Create multiple Websites from the same installation Overview The IDBS ActivityBase Web Installer does not support installing multiple instances of the Web application in IIS. If there is a specific requirement for this, for example to allow separate test and production systems to be hosted simultaneously, then this can be achieved by manually cloning the Web application s directory structure. Step 1: Clone the directory structure Open Windows Explorer. Copy the full contents of the following folder to a new location:- {Program Files}\IDBS\ActivityBase Web\Web Site Make a note of the full pathname of new location. Step 2: Add the ActivityBase Web application to Internet Information Services (IIS) Follow the steps in the section How To: Add the ActivityBase Web application to Internet Information Services (IIS) to add the Web application to IIS. Note that a unique alias must be used to identify the new instance. It is strongly recommend that the new Web application instance is created and run inside a separate application pool. This will isolate it and prevent any failures from causing the existing instance processes to also fail. Page 41 of 47

42 How To: Enable external Windows authentication Overview The ActivityBase Web client supports external Windows authentication of users. This feature allows users to login to the ActivityBase Web client using their Windows username and password. It is controlled via the ASP.NET Membership Provider configuration section in the Web Server configuration file. Step 1: Disable the ActivityBase Oracle Membership Provider Open the Web server configuration file (web.config) on the server machine. Any preferred XML Editor can be used. Locate the providers configuration section under <membership>. Comment out the following line as shown below. <! <add name="activitybasemembershipprovider" type="idbs.activitybase.web.common.infrastructure. ActivityBaseMembershipProvider, Idbs.ActivityBase.Web.Common, Version= , Culture=neutral, PublicKeyToken=4b804261e436dd17" connectionstringname="activitybaseproviderservice" applicationname="/" /> --> Step 2: Enable the Active Directory Membership Provider Locate the <connectionstrings> configuration section. Set the connection string for your Windows Active Directory service. For example: <add name="activedirectoryservices" connectionstring=" LDAP://domain.testing.com/CN=Users,DC=domain,DC=testing,DC=com " /> Uncomment the following line as shown below. <add name="activedirectorymembershipprovider" type="system.web.security.activedirectorymembershipprovider" connectionstringname="activedirectoryservices" connectionprotection="secure" applicationname="/" attributemapusername = "SAMAccountName" /> Step 3: Set the Default Membership Provider Locate the <system.web><membership> configuration section. Change the default provider to use the Active Directory Membership Provider. <membership defaultprovider="activedirectorymembershipprovider"> Next, locate the <servicecredentials><usernameauthentication> configuration section below <system.servicemodel>. Change the username authentication settings to use the Active Directory Membership Provider. <usernameauthentication usernamepasswordvalidationmode="membershipprovider" membershipprovidername="activedirectorymembershipprovider" /> Page 42 of 47

43 For further information on configuring the Active Directory Membership Provider for ASP.NET, please refer to the following Microsoft Guidance document Step 4: Set the Application Pool Identity Open Internet Information Services (IIS) Manager on the server machine. Locate the application pool for the ActivityBase Web application. Select Advanced Settings under Edit Application Pool in the Actions pane. Under the Process Model settings change the value of the Identity property to use the built-in account Network Service. Restart IIS for the changes to take effect. From a Command Prompt run: iisreset. Page 43 of 47

44 Troubleshooting HTTP Error Not Found HTTP Error Not Found. The resource you are looking for has been removed, had its name changed, or is temporarily unavailable. This error usually means that the Web site could not be found. This may occur if IIS is not running, or when the ActivityBase Web application has not been installed correctly in IIS. Follow the instructions in the section How To: Add the ActivityBase Web application to Internet Information Services (IIS). Once complete, test the Web site by choosing the Browse Application option under the Manage Application action in IIS. HTTP Error Not Found HTTP Error Not Found. The page you are requesting cannot be served because of the extension configuration. If the page is a script, add a handler. If the file should be downloaded, add a MIME map. If the error is seen when launching the ActivityBase Web client application in the browser then it is possible that ASP.NET is not installed. Follow the steps in the section titled Server Roles Installation to install ASP.NET as part of the Web Server (IIS) role. If the error is observed when either; starting the IDBS Plate Creator application, trying to create or maintain a Template, or running a Testset or Test Occasion using RWC, then it is likely that a handler mapping is not defined for *.svc files types in IIS. Normally, this will be done automatically when the Windows Communication Foundation HTTP Activation feature is installed, which is part of the.net Framework pre-requisite server feature. Follow the steps in the section titled Server Features Installation to install.net Framework HTTP Error Service Unavailable HTTP Error 503 The service is unavailable This error is generated by the Windows Process Activation Service (WAS - formerly W3SVC) service, which is responsible for creating IIS worker processes to handle incoming http requests. When WAS fails to create a worker process, it will generate this error. There are a number of reasons why WAS may fail to start an IIS worker process. The most likely include; invalid application pool configuration, failure to create the process due to incorrect application pool identity settings, bad IIS configuration that causes the worker process to fail to initialize. Check the application pool is configured correctly by following the instructions in the section Configure the Application Pool. Open a Command Prompt. Check that the application pool is running by executing the following command:- %systemroot%\syswow64\inetsrv\appcmd.exe list apppools If the application pool is not running execute the following command to restart it:- %systemroot%\syswow64\inetsrv\appcmd.exe start apppool DefaultAppPool (Replace DefaultAppPool with the name of the application pool). Attempt the request again and verify that the error has gone away. If an error remains, it is possible that a more serious application fault is causing a process crash which is taking down the application pool. Normally, if an IIS worker process fails to initialize, or WAS is unable to Page 44 of 47