Introduction

Each target system is connected to the CoreOne Suite with a system connector. This system connector acts as the bridge between the CoreOne Suite logic and the target system. In many cases, the system connector can be executed directly on one of the application server, as the target system is directly accessible from the application server. But there are many cases where there are technical limitations. To name a few:

The application server is part of a different Active Directory Domain than the target system
The target system is in a different network zone, that is not directly accessible
The connector needs to run in 32-bit as used libraries to connect to the system are only available in 32-bit

If such a case occurs, you will need to configure an additional system connector and in some cases one or more routers. Below is an example of such an architecutre.

Target Network Configuration

Whenever you are adding a target system to the CoreOne Suite configuration, you have to select a target network. That target network identifies in which target network the system is placed. In the example above, we have 5 target networks. Every target system in the “APP Network Zone” is connectable by the default “Local Network” target network, that’s automatically created. If you want to add a system to the “Target System Zone”, you have to add that to the list of target networks in the Admin UI.

When adding the target network, you will need to specify the following parameters.

Parameters

Property	Data Type	Mandatory	Example	Description

Property	Data Type	Example	Description
`Name`	String	Target System Zone	The name of the target network. This name will also be used in the router configuration.
`Target URI`	String	`net.tcp://10.10.11.100:9001`	The net:tcp address of the next hop. In the example above, the “Target System Zone” is not accessible directly from the “APP Network Zone” which is why we will specify the IP:Port of Router 1.
`Binding Name`	String	`SystemConnectorClientBinding`	Static value.
`Endpiont Behaviour Name`	String	`SystemConnectorClientEndpointBehaviour`	Static value.
`Endpoint DNS Identity`	String	`Router1.SystemConnector.CoreOne.ITSENSE.local`	The last entry of the Subject Alternative Names of the certificate that should be used to prove the identity of the target server. Note: The application service (client) has to have access to the public key of the routers certificate

Router Configuration

Each of the routers will take the incoming message, read the target network destination from the header, check the local configuration for the next hop, and forward the message to the next hop. It’s therefore necessary to add all the destination target networks and their next hop to the configuration file. Such configuration files are attached below.

Host configuration

First of all, we will configure the router itself. On line 22, we add the host section, where we configure which URI the router is listening to. In this case, it’s net.tcp://10.10.11.100:9001 which should match the Target URI from the target network example above. This configuration also references the behavior SystemConnectorServiceBehaviours which can be found on line 63. In that behavior configuration, we specify with the certificate that router 1 will encrypt its content. In this case, it’s Router1.SystemConnector.CoreOne.ITSENSE.local certificate. Similar to the target network configuration we, therefore, have the following requirements:

The router service user has to have access to the private key of this certificate.
The calling party, in this case, the application service, has to have access to the public key of this certificate, in order to validate the message.

On line 23 we specify all the public certificates that we can use to verify a sender's message. In our case, only the application server will initiate the communication and we, therefore, add that public certificate (Client.SystemConnector.CoreOne.ITSENSE.local) to the list. And we have the following requirements:

The router service user has to have access to the public key of this certificate.

Routing Configuration

On line 27 we can find our routing configuration. Here we have to add all target networks, with their next hop. In our Router 1 example we route all traffic destined for Default Network to the next hop net.tcp://10.10.12.100:9002. That destination has to match the configuration of Router 2, i.e. the Port and the certificate Router2.SystemConnector.CoreOne.ITSENSE.local. So again we have the following requirements:

Router service 1 has to have access to the public key of the router 2 certificate, in order to validate the message.

This configuration also references the SystemConnectorEndpointBehaviours found on line 53. Here again, we specify with which certificate router 1 will encrypt its content sent to the next hops. This is again the Router1.SystemConnector.CoreOne.ITSENSE.local certificate. And we have the following requirements:

The router service user has to have access to the private key of this certificate.
The next hop and the application service, in this case, the Router 2 and the application service, have to have access to the public key of this certificate, in order to validate the message.

Configuration Examples

Router 1

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <configSections>
    <sectionGroup name="serviceHostConfigGroup">
      <section
        name="hostConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Host.ServiceHostConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
      <section
        name="routingConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Target.TargetConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
    </sectionGroup>
  </configSections>

  <serviceHostConfigGroup>
    <hostConfig>
      <host baseUri="net.tcp://10.10.11.100:9001" publishMetadata="false" bindingName="RouterBinding" serviceBehavioursName="SystemConnectorServiceBehaviours" includeExceptionDetailsInFaults="true" />
      <hostX509ClientListCertificateValidator>
        <clientCertificate findValue="Client.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
      </hostX509ClientListCertificateValidator>
    </hostConfig>
    <routingConfig>
      <targets>
        <target targetName="Default Network" targetUri="net.tcp://10.10.12.100:9002" bindingName="SystemConnectorBinding" endpointBehavioursName="SystemConnectorEndpointBehaviours" endpointDnsIdentity="Router2.SystemConnector.CoreOne.ITSENSE.local" />
      </targets>
    </routingConfig>
  </serviceHostConfigGroup>

  <system.serviceModel>
    <bindings>
      <netTcpBinding>
        <binding name="RouterBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
        <binding name="SystemConnectorBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="SystemConnectorEndpointBehaviours">
          <clientCredentials>
            <clientCertificate findValue="Router1.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/>
            <serviceCertificate>
              <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="SystemConnectorServiceBehaviours">
          <serviceCredentials>
            <clientCertificate>
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="iTsense.Moving.Backend.SystemConnector.Runner.Security.HostX509ClientListCertificateValidator, iTsense.Moving.Backend.SystemConnector.Runner"/>
            </clientCertificate>
            <serviceCertificate findValue="Router1.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
  </startup>
</configuration>

Router 2

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <configSections>
    <sectionGroup name="serviceHostConfigGroup">
      <section
        name="hostConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Host.ServiceHostConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
      <section
        name="routingConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Target.TargetConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
    </sectionGroup>
  </configSections>

  <serviceHostConfigGroup>
    <hostConfig>
      <host baseUri="net.tcp://10.10.12.100:9002" publishMetadata="false" bindingName="RouterBinding" serviceBehavioursName="SystemConnectorServiceBehaviours" includeExceptionDetailsInFaults="true" />
      <hostX509ClientListCertificateValidator>
        <clientCertificate findValue="Router1.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
      </hostX509ClientListCertificateValidator>
    </hostConfig>
    <routingConfig>
      <targets>
        <target targetName="Default Network" targetUri="net.tcp://localh10.10.13.100ost:9003" bindingName="SystemConnectorBinding" endpointBehavioursName="SystemConnectorEndpointBehaviours" endpointDnsIdentity="Router3.SystemConnector.CoreOne.ITSENSE.local" />
      </targets>
    </routingConfig>
  </serviceHostConfigGroup>

  <system.serviceModel>
    <bindings>
      <netTcpBinding>
        <binding name="RouterBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
        <binding name="SystemConnectorBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="SystemConnectorEndpointBehaviours">
          <clientCredentials>
            <clientCertificate findValue="Router2.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/>
            <serviceCertificate>
              <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="SystemConnectorServiceBehaviours">
          <serviceCredentials>
            <clientCertificate>
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="iTsense.Moving.Backend.SystemConnector.Runner.Security.HostX509ClientListCertificateValidator, iTsense.Moving.Backend.SystemConnector.Runner"/>
            </clientCertificate>
            <serviceCertificate findValue="Router2.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
  </startup>
</configuration>

Router 3

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <configSections>
    <sectionGroup name="serviceHostConfigGroup">
      <section
        name="hostConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Host.ServiceHostConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
      <section
        name="routingConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Target.TargetConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
    </sectionGroup>
  </configSections>

  <serviceHostConfigGroup>
    <hostConfig>
      <host baseUri="net.tcp://10.10.13.100:9003" publishMetadata="false" bindingName="RouterBinding" serviceBehavioursName="SystemConnectorServiceBehaviours" includeExceptionDetailsInFaults="true" />
      <hostX509ClientListCertificateValidator>
        <clientCertificate findValue="Router2.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
      </hostX509ClientListCertificateValidator>
    </hostConfig>
    <routingConfig>
      <targets>
        <target targetName="Default Network" targetUri="net.tcp://10.10.14.100:9000" bindingName="SystemConnectorBinding" endpointBehavioursName="SystemConnectorEndpointBehaviours" endpointDnsIdentity="Host.SystemConnector.CoreOne.ITSENSE.local" >
          <validators>
            <validator type="iTsense.Moving.Backend.SystemConnector.Router.MessageValidator.Simulator.ValidatorSimulator, iTsense.Moving.Backend.SystemConnector.Router" processRequests="true" processResponses="true" />
          </validators>
        </target>
      </targets>
    </routingConfig>
  </serviceHostConfigGroup>

  <system.serviceModel>
    <bindings>
      <netTcpBinding>
        <binding name="RouterBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
        <binding name="SystemConnectorBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="SystemConnectorEndpointBehaviours">
          <clientCredentials>
            <clientCertificate findValue="Router3.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/>
            <serviceCertificate>
              <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="SystemConnectorServiceBehaviours">
          <serviceCredentials>
            <clientCertificate>
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="iTsense.Moving.Backend.SystemConnector.Runner.Security.HostX509ClientListCertificateValidator, iTsense.Moving.Backend.SystemConnector.Runner"/>
            </clientCertificate>
            <serviceCertificate findValue="Router3.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
  </startup>
</configuration>

CoreOne Suite Dokumentation

Communication with System Connectors and Routers