Echelon SmartServer 2.2 - Manual (Page 529)

530 Appendix C – Securing the SmartServer
If you secure this folder, add a new realm with the URL of the folder for each user group. For SOAP
applications, create a new user group for SOAP applications such as “soapuser”. The following
WebParams.dat file demonstrates the recommended settings for securing the /WSDL folder.
(Users)
all:ilon:ilon
soapuser:soap:soap
supervisor:super:super
supervisor:super1:super
enduser:Tom:cat
enduser:Steve:dog
enduser2:Jack:mouse
enduser2:Dave:rat
(Locations)
everywhere:*.*.*.*
(Realms)
/WSDL/*:soapuser:everywhere
/WSDL/*:all:everywhere
/WSDL/*:supervisor:everywhere
/WSDL/*:enduser:everywhere
/WSDL/*:enduser2:everywhere
Securing Files
You can protect a file in the SmartServer by creating a realm using the following format:
/<dir path>/<file name>:<group>:<location>
Note: For *.gz files in the /user/Echelon folder, do not include the .gz extension in the file name. The
.gz extension is used for compressed files. For example, to secure the View Event Scheduler.html.gz
file, create a realm using the following format:
/user/Echelon/ViewEventScheduler.html:all:everywhere
/user/Echelon/Menu.html file
You can automatically secure all the files in the user/Echelon folder by securing the
/user/Echelon/Menu.html file. The protected files can still be accessed by your custom Web pages.
If you secure only the /user/Echelon/Menu.html file in the /Echelon folder, Web page security will
still function when you access other files in the /Echelon folder through a factory or custom frameset.
Note: If you directly access a file in the user/Echelon folder using its URL, the web page may appear
briefly before the Login-in dialog is displayed. The information momentarily displayed on the Web
page (the port numbers for the Web server and Telnet) is statically added to the HTML page and is not
dynamically retrieved from the SmartServer; therefore, no security risk exists.
To prevent Web pages from being displayed prior to the Login-in dialog, you have to secure all the
files in the user/Echelon folder; therefore, secure only the /user/Echelon/Menu.html file.
Examples for Securing a SmartServer
This section demonstrates how to secure SmartServer Web pages based on the number of user groups,
the level of security (minimal to complete password protection), and the types of pages being accessed
(system or custom). Example WebParams.dat files based on the scenario are then provided.
The example WebParams.dat files are based on a Web site consisting of the SmartServer home page,
which is not secured, and the system frameset (access through a button on the SmartServer home
page). A menu.htm file is used for the system frameset. These examples are for i.LON Vision Web
pages only.
Tip: Examples 2 and 7 illustrate the most common scenarios for single and multiple user groups,