waveware Server

Connection Establishment

In order to establish a connection from the client to the waveware server, information in the 'Server' field of the client login window is evaluated.

With the help of prefixes, you can activate various special features when establishing a connection directly via the client.

It is always recommended to establish an encrypted connection using "https". Further special features when setting up under 'Secure Client Connections'. If possible, avoid unencrypted connections ("http" and without a prefix).

Connection problems often occur because of the following reasons:

• Firewall or Reverse-Proxy does not support any HTTP/2
  • Try with the prefix "web+https" or "web+http".
• Proxy does not support any HTTP/2- or local connections
  • Try with the prefix "noproxy" or "noproxy+web+https" or "noproxy+web+http"

Setup

If you have a valid certificate (see also 'Certificate Creation with Let's Encrypt'), you have to make this known to the waveware server. To do this, open the waveware server settings via the menu ribbon 'Global settings' of the DataManagement and scroll to the 'GRPC settings' area.

You can make the settings for the certificate in two ways:

• Windows Certificate Store
  As an alternative to using PEM certificates, the Windows certificate store can be used.
  
  At this point you need to provide the certificate's fingerprint. You can also specify several certificates in the 'Thumbprint of the Certificate' field by separating them with a comma (comma-separated list). You do not have to specify a specific certificate store. The specified certificate is automatically searched for in the following certificate stores:

  Value	Description
  CertificateAuthority	Certificate stores of intermediate certification authorities.
  My	Certificate store for personal certificates.
  Root	Certificate store for trusted root certification authorities.

  It should be noted that the certificate selected in this way contains the private key and this can be exported. When importing the certificate into the certificate store, activate the import option 'Mark key as exportable'. After the import, the sentence "You have a private key for this certificate" appears in the certificate properties under 'General'.
• Direct Path Specification
  If a PEM (Privacy Enhanced Mail) certificate is to be used, the full path to the certificate and the full path to the private key file must be specified. Both paths are to be specified from the point of view of the waveware server. In addition, access rights to the paths are required for the user under which the waveware server service is running.
  

After saving the settings, you have to manually restart the waveware server service once so that the settings are applied.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    ...
    <userSettings>
          <LoyHutz.Server.Core.Lib.Properties.Settings>
              ...
              <setting name="GrpcCertificateSettings" serializeAs="String">
                  <value>CertFullPath=C:\Data\Cert\cert.pem;CertKeyPath=C:\Data\Cert\key.pem;CertStore=;CertThumbprint=</value>
              </setting>
             ...
         </LoyHutz.Server.Core.Lib.Properties.Settings>
     </userSettings>
</configuration>

<setting name="GrpcCertificateSettings" serializeAs="String">
   <value>CertFullPath=C:\Data\Cert\cert.pem;CertKeyPath=C:\Data\Cert\key.pem;CertStore=;CertThumbprint=</value>
</setting>

Use Secure Client Connections

In order to use secure client connections after setup, it is sufficient to enter the prefix "tls://" in front of the server name in the respective client.

Application Example 

The API authentication is illustrated in the following Javascript:

var salt = "";
// salt holen
$.ajax({
url: "Api/GetSalt",
dataType: "text",
success: function (result) {
    // salt auswerten
    salt = eval("(" + result + ")");
    // passwort hash generieren
    var pwHash = new jsSHA(unescape(encodeURIComponent(password)), "ASCII").getHash("SHA-256", "B64");
    var transportHash = new jsSHA(pwHash + salt, "ASCII").getHash("SHA-256", "B64");
    // authentifizierungs funktion aufrufen
    $.ajax({
        url: "Api/Authenticate",
        data: "installid=" + encodeURIComponent(installId) + "&username=" + encodeURIComponent(username) + "&password=" + encodeURIComponent(transportHash) + "&mandantid=" + encodeURIComponent(mandantId),
        dataType: "text",
        success: function (result) {
            result = checkForError(result);
            if (result === false)
            return;
}}));

The 'jsSHA' library is used to generate the hash (http://caligatio.github.io/jsSHA). The AJAX/REST requests are executes with the aid of jQuery.