Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Current »

Introduction

Each target system is connected to the CoreOne Suite with a system connector. This system connector acts as the bridge between the CoreOne Suite logic and the target system. In many cases, the system connector can be executed directly on one of the application server, as the target system is directly accessible from the application server. But there are many cases where there are technical limitations. To name a few:

  • The application server is part of a different Active Directory Domain than the target system

  • The target system is in a different network zone, that is not directly accessible

  • The connector needs to run in 32-bit as used libraries to connect to the system are only available in 32-bit

If such a case occurs, you will need to configure an additional system connector and in some cases one or more routers. Below is an example of such an architecutre.

Target Network Configuration

Whenever you are adding a target system to the CoreOne Suite configuration, you have to select a target network. That target network identifies in which target network the system is placed. In the example above, we have 5 target networks. Every target system in the “APP Network Zone” is connectable by the default “Local Network” target network, that’s automatically created. If you want to add a system to the “Target System Zone”, you have to add that to the list of target networks in the Admin UI.

When adding the target network, you will need to specify the following parameters.

Parameters

Property

Data Type

Mandatory

Example

Description

Name

String

(tick)

Target System Zone

The name of the target network. This name will also be used in the router configuration.

Target URI

String

(tick)

net.tcp://10.10.11.100:9001

The net:tcp address of the next hop. In the example above, the “Target System Zone” is not accessible directly from the “APP Network Zone” which is why we will specify the IP:Port of Router 1.

Binding Name

String

(tick)

SystemConnectorClientBinding

Static value.

Endpiont Behaviour Name

String

(tick)

SystemConnectorClientEndpointBehaviour

Static value.

Endpoint DNS Identity

String

(tick)

Router1.SystemConnector.CoreOne.ITSENSE.local

The Subject Alternative Name of the certificate that should be used to encrypt the content that is sent to the Target URI.

Note:

  • The application service (client) has to have access to the public key of the routers certificate, in order to validate the messages.

Router Configuration

Each of the router will take the incoming message, read the target network destination from the header, check the local configuration for the next hop and forward the message to the next hop. It’s therefore necessary to add all the destination target networks and their next hop to the configuration file. Such a configuration files are attached below.

Host configuration

First of all we will configure the router itself. On line 22, we add the host section, where we configure on which URI the router is listening. In this case it’s net.tcp://10.10.11.100:9001 which should match the Target URI from the target network example above. This configuration also references the behaviour SystemConnectorServiceBehaviours which can be found on line 63. In that behaviour configuration we specify with with certificate the router 1 will encrypt it’s content. In this case it’s the Router1.SystemConnector.CoreOne.ITSENSE.local certificate. Similar to the target network configuration we therefore have the following requirements:

  • The router service user has to have access to the private key of this certificate.

  • The calling party, in this case the application service, has to have access to the public key of this certificate, in order to validate the message.

On line 23 we specify all the public certificates that we can use to verify a sender's message. In our case only the application server will initiate the communication and we therefore add that public certificate (Client.SystemConnector.CoreOne.ITSENSE.local) to the list. And we have the following requirements:

  • The router service user has to have access to the public key of this certificate.

Routing Configuration

On line 27 we can find our routing configuration. Here we have to add all target networks, with their next hop. In our Router 1 example we route all traffic destined for Default Network to the next hop net.tcp://10.10.12.100:9002. That destination has to match the configuration of Router 2, i.e. the Port and the certificate Router2.SystemConnector.CoreOne.ITSENSE.local. So again we have the following requirements:

  • The router service 1 has to have access to the public key of router 2 certificate, in order to validate the message.

This configuration also references the SystemConnectorEndpointBehaviours found on line 53. Here again we specify with which certificate the router 1 will encrypt it’s content sent to the next hops. This is again the Router1.SystemConnector.CoreOne.ITSENSE.local certificate. And we have the following requirements:

  • The router service user has to have access to the private key of this certificate.

  • The next hop and the application service, in this case the Router 2 and the application service, have to have access to the public key of this certificate, in order to validate the message.

Configuration Examples

Router 1

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <configSections>
    <sectionGroup name="serviceHostConfigGroup">
      <section
        name="hostConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Host.ServiceHostConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
      <section
        name="routingConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Target.TargetConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
    </sectionGroup>
  </configSections>

  <serviceHostConfigGroup>
    <hostConfig>
      <host baseUri="net.tcp://10.10.11.100:9001" publishMetadata="false" bindingName="RouterBinding" serviceBehavioursName="SystemConnectorServiceBehaviours" includeExceptionDetailsInFaults="true" />
      <hostX509ClientListCertificateValidator>
        <clientCertificate findValue="Client.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
      </hostX509ClientListCertificateValidator>
    </hostConfig>
    <routingConfig>
      <targets>
        <target targetName="Default Network" targetUri="net.tcp://10.10.12.100:9002" bindingName="SystemConnectorBinding" endpointBehavioursName="SystemConnectorEndpointBehaviours" endpointDnsIdentity="Router2.SystemConnector.CoreOne.ITSENSE.local" />
      </targets>
    </routingConfig>
  </serviceHostConfigGroup>

  <system.serviceModel>
    <bindings>
      <netTcpBinding>
        <binding name="RouterBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
        <binding name="SystemConnectorBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="SystemConnectorEndpointBehaviours">
          <clientCredentials>
            <clientCertificate findValue="Router1.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/>
            <serviceCertificate>
              <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="SystemConnectorServiceBehaviours">
          <serviceCredentials>
            <clientCertificate>
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="iTsense.Moving.Backend.SystemConnector.Runner.Security.HostX509ClientListCertificateValidator, iTsense.Moving.Backend.SystemConnector.Runner"/>
            </clientCertificate>
            <serviceCertificate findValue="Router1.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
  </startup>
</configuration>

Router 2

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <configSections>
    <sectionGroup name="serviceHostConfigGroup">
      <section
        name="hostConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Host.ServiceHostConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
      <section
        name="routingConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Target.TargetConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
    </sectionGroup>
  </configSections>

  <serviceHostConfigGroup>
    <hostConfig>
      <host baseUri="net.tcp://10.10.12.100:9002" publishMetadata="false" bindingName="RouterBinding" serviceBehavioursName="SystemConnectorServiceBehaviours" includeExceptionDetailsInFaults="true" />
      <hostX509ClientListCertificateValidator>
        <clientCertificate findValue="Router1.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
      </hostX509ClientListCertificateValidator>
    </hostConfig>
    <routingConfig>
      <targets>
        <target targetName="Default Network" targetUri="net.tcp://localh10.10.13.100ost:9003" bindingName="SystemConnectorBinding" endpointBehavioursName="SystemConnectorEndpointBehaviours" endpointDnsIdentity="Router3.SystemConnector.CoreOne.ITSENSE.local" />
      </targets>
    </routingConfig>
  </serviceHostConfigGroup>

  <system.serviceModel>
    <bindings>
      <netTcpBinding>
        <binding name="RouterBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
        <binding name="SystemConnectorBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="SystemConnectorEndpointBehaviours">
          <clientCredentials>
            <clientCertificate findValue="Router2.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/>
            <serviceCertificate>
              <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="SystemConnectorServiceBehaviours">
          <serviceCredentials>
            <clientCertificate>
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="iTsense.Moving.Backend.SystemConnector.Runner.Security.HostX509ClientListCertificateValidator, iTsense.Moving.Backend.SystemConnector.Runner"/>
            </clientCertificate>
            <serviceCertificate findValue="Router2.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
  </startup>
</configuration>

Router 3

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <configSections>
    <sectionGroup name="serviceHostConfigGroup">
      <section
        name="hostConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Host.ServiceHostConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
      <section
        name="routingConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Target.TargetConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
    </sectionGroup>
  </configSections>

  <serviceHostConfigGroup>
    <hostConfig>
      <host baseUri="net.tcp://10.10.13.100:9003" publishMetadata="false" bindingName="RouterBinding" serviceBehavioursName="SystemConnectorServiceBehaviours" includeExceptionDetailsInFaults="true" />
      <hostX509ClientListCertificateValidator>
        <clientCertificate findValue="Router2.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
      </hostX509ClientListCertificateValidator>
    </hostConfig>
    <routingConfig>
      <targets>
        <target targetName="Default Network" targetUri="net.tcp://10.10.14.100:9000" bindingName="SystemConnectorBinding" endpointBehavioursName="SystemConnectorEndpointBehaviours" endpointDnsIdentity="Host.SystemConnector.CoreOne.ITSENSE.local" >
          <validators>
            <validator type="iTsense.Moving.Backend.SystemConnector.Router.MessageValidator.Simulator.ValidatorSimulator, iTsense.Moving.Backend.SystemConnector.Router" processRequests="true" processResponses="true" />
          </validators>
        </target>
      </targets>
    </routingConfig>
  </serviceHostConfigGroup>

  <system.serviceModel>
    <bindings>
      <netTcpBinding>
        <binding name="RouterBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
        <binding name="SystemConnectorBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" />
            <transport clientCredentialType="Certificate" />
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="SystemConnectorEndpointBehaviours">
          <clientCredentials>
            <clientCertificate findValue="Router3.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/>
            <serviceCertificate>
              <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="SystemConnectorServiceBehaviours">
          <serviceCredentials>
            <clientCertificate>
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="iTsense.Moving.Backend.SystemConnector.Runner.Security.HostX509ClientListCertificateValidator, iTsense.Moving.Backend.SystemConnector.Runner"/>
            </clientCertificate>
            <serviceCertificate findValue="Router3.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
  </startup>
</configuration>

System Connector (Host) 

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <configSections>
    <sectionGroup name="serviceHostConfigGroup">
      <section
        name="hostConfig"
        type="iTsense.Moving.Backend.SystemConnector.Runner.Configuration.Host.ServiceHostConfigurationSection,iTsense.Moving.Backend.SystemConnector.Runner"
        allowLocation="true"
        allowDefinition="Everywhere"
      />
    </sectionGroup>
  </configSections>
  <appSettings>
    <add key="log4net.Internal.Debug" value="false"/>
  </appSettings>
  <serviceHostConfigGroup>
    <hostConfig>
      <host baseUri="net.tcp://localhost:9000" publishMetadata="true" bindingName="SystemConnectorBinding" serviceBehavioursName="SystemConnectorServiceBehaviours" includeExceptionDetailsInFaults="true" />
      <hostX509ClientListCertificateValidator>
        <clientCertificate findValue="Router3.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
      </hostX509ClientListCertificateValidator>
    </hostConfig>
  </serviceHostConfigGroup>
  <system.serviceModel>
    <bindings>
      <netTcpBinding>
        <binding name="SystemConnectorBinding" transferMode="Streamed">
          <security mode="TransportWithMessageCredential">
            <transport clientCredentialType="Certificate" />
            <message clientCredentialType="Certificate"/>
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior name="SystemConnectorServiceBehaviours">
          <serviceCredentials>
            <clientCertificate>
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="iTsense.Moving.Backend.SystemConnector.Runner.Security.HostX509ClientListCertificateValidator, iTsense.Moving.Backend.SystemConnector.Runner"/>
            </clientCertificate>
            <serviceCertificate findValue="Host.SystemConnector.CoreOne.ITSENSE.local" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
  </startup>
</configuration>
  • No labels

© ITSENSE AG. Alle Rechte vorbehalten. ITSENSE und CoreOne sind eingetragene Marken der ITSENSE AG.