Internet client / application server

Table of contents

• 1 Requirements
• 2 Server installation
• 2.1 Remove of the previous KONSISAppServer service
• 2.2 Software installation
• 3 Server configuration program
• 3.1 Assign Server Ports and URLs
• 3.2 Database driver
• 3.3 Database configuration
• 3.4 SSL-Certificate-Keystore
• 4 Starting the service
• 5 Client installation
• 6 Client with Java-Web-Start
• 6.1 http/https-server
• 6.2 starting a client
• 6.3 SSL-Encryption

IDL.KONSIS.FORECAST Versions:

• 2007.0 or above: client / application-server
• 2010.1 or above: Windows single-sign-on
• 2011.0 or above: SSL encryption
• 2014.0 or above: dedicated HTTP/HTTPS server, proxy enabled, separate configuration program

Sufficient band width and fast ping time (e.g. 2 Mbit, ping <40ms)

This step is necessary, if the KONSISAppServer, version 2013.0, is installed. To remove the service go to the directory where the server is installed, change to the "SYSTEM" directory and run the batch-script "Uninstall_KONSISAppServer.bat".

Install the IDL.KONSIS.FORECAST as server version. If the version 2013.0 is already installed, chose "Upgrade existing".

After successful installation the server configuration program starts. The configuration program also can be started later by running "configure.exe" in the installation directory.

The configuration program contains several panels to set up server ports, host names, database connections and SSL certificates.

• Host: Enter the host name of the machine where the server is installed.
• Default-Port: Port for the HTTP protocol. Default is port 80.
• SSL-Port: Port for the HTTPS protocol. This port should be preferred for the client-server connection. Default is port 443.
• Stop-Port: Port for stopping the server. Only used internally.
• Memory (MB): Enter the maximum amount of memory the server requires.
• Web-Start Host (optional): Host name used for java Web-Start. If the client shall be started using Java Web-Start, enter the URL where the client can access the server. If not entered the value from the "Host:" field is used.
• Financial-Reporting-Host (optional): If adhoc and web reporting is used you can enter the URL of the IDL Workplace Server here.
• Portal-URL (optional): If adhoc and web reporting is used you can enter the URL of the IDL Portal here.

With a click on the button "Search drivers" the existing drives on the system will be detected and listed in the entry fields. When using MS SQL Server no configuration is necessary.

JDBC drivers for Oracle:

• HOME-Folder-32-Bit: Path to the Oracle native-32Bit driver.
• HOME-Folder-64-Bit: Path to the Oracle native-64Bit driver.
• JDBC-Driver: Path to the Oracle JDBC-driver.

JDBC driver for DB2:

• Pure-JDBC-driver: Path to the Pure Java JDBC-driver for DB2.

On this panel all databases used by the clients can be configured. The connection will be tested using the "Test" button.

To add a database click the "+"-button. The following parameters have to be set for every database:

• Alias: Alias name for the database. The alias will be used in the login-dialogue on the client.
• Database-System: Type of the database system.
• DB-Name: Real name of the database. When using MS SQL Server the format is <server>.<database> or <server\instance>.<database>.
• Auth: Authentication method DB-User or IDL-User (see documentations "Internal User" and "Internal Password").
• Internal User: The server service always uses an internal user for connection to the database which has to be entered here. This user needs privileges for connect and read/write all views (with scheme idldb).
• Internal Password: The password for the internal user.
• Connect Lazy: If selected, a connection to the database will be established when the first client connects to the server. If not selected, a connection to the database will be established when the server starts up.
• Web-Service-DB: If a database is entered here, the server invokes web-services required for the mobile apps IDL.CONSOLIDATION.MONITOR and others.

The server runs the HTTPS protocol. If the client wants to check the authenticity of the server, the server needs a certificate with the matching server-name and signed by an official trust-centre.

Self-signed Certificate: When the configuration program creates a certificate it is self-signed. When the client connects for the first time, this certificate can be saved as trusted in the clients own trust store.

To create a certificate a new keystore has to be created.(button create) The following details are necessary for the certificate:

• Common Name (CN): The server name, which must be accessible by the client.
• Key Length (RSA): Default 2048.
• Valid (days): Validiy of the certificate, e.g. 1825 for 5 years.
• Organisation Unit (OU): Name of organisation unit
• Organisation Name (O): Name of company / group
• Locallity Name (L): City of the of company / group
• State Name (ST): Name of the state-country
• Country (C): Country code, e.g. DE for Germany, EN for England
• Certificate Password: Password for the private key.

When clicking the button "Create" the certificate will be saved in the chosen keystore. When closing the configuration program all changed parameters and the keystore are saved.

After successful configuration the server has to be installed as a windows-service. To do this run the script "installService.bat"

The service appears in the service-list with the name IDLAppServer. For debugging purposes the server can be started in a command-line mode using the script startIdlAppserver.bat.

A stand-alone internet-client can be installed by running "IDL.KONSIS.FORECAST Client" from the installation program. This client contains IDL.KONSIS.FORECAST and IDL.XLSLINK.

The Client installation files are located at \Konsis\Client on the install media. For unattached installation use the IDLKONSISFORECAST_Client.msi file insted of IDLKONSISFORECAST_Client.exe.

Command:

msiexec /passive APPDIR="<Zielverzeichnis-Client>" SHORTCUTDIR="<Zielverzeichnis-Starticon>" PROP_HOST=<host-name> PROP_PORT=<port-nr> /i IDLKONSISFORECAST_Client.msi /L*v <logfile-name>

Example (default-values will be used for propgram-directory and icon-directory):

msiexec /passive /i IDLKONSISFORECAST_Client.msi /L*v inst2.log

Example with modified values for target-directory, icon-directory and default values for host and port:

msiexec /passive APPDIR="C:\Program Files (x86)\IDL\IDL.KONSIS.FORECAST.Client" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IDL\IDL.KONSIS.FORECAST.Client" PROP_HOST=server.kunde.de PROP_PORT=444 /i IDLKONSISFORECAST_Client.msi /L*v inst.log

If the service IDLAppServer has been started successfully, the server can be accessed with the configured host-name or web-start host-name, respectively. The URL for HTTP protocol is named "http://<Hostname>/webstart/", the URL for HTTPS protocol is named "https://<Hostname>/webstart/".

Java-Runtime: To start the client with a link in a web-browser, a java-runtime version 1.7.0_55 (or higher) has to be installed.

You have to enter the URL in the web-browser, e.g. "http://<Hostname>/webstart/". A web page with 2 links should appear: "IDL.KONSIS.FORECAST" and "IDL.XLSLINK".

To start the client click on one of these links and java-web-start starts the download of the program files to the client cache. After downloading and verifying the files the client program will be started. In the login-dialogue the databases configured on the server are shown in the database drop-down box.

Start IDL.XLSLINK: In order to get IDL.XLSLINK work, IDL.KONSIS.FORECAST has to be started successfully on the client. IDL.XLSLINK needs the file idlgui.ini, witch is created by IDL.KONSIS.FORECAST.

To secure the communication between client and server, the client should only be started using the HTTPS Link: "https://<Hostname>/webstart/".

If the server is configured with an officially signed certificate, the client will start normally. If a self-signed certificate has been stored on the server, then a dialogue appears displaying details of the certificate. In this dialogue you can chose to trust this certificate. Then the certificate will be stored as "trusted" in a client trust store and the client will start.