WebDAV Authentication
To access a file on the Intrexx Portal Server from the portal, the portal user must be authenticated.
The following authentication types are available:
-
Intrexx Authentication
-
Authentication against a Windows domain using a username and password
-
Authentication with SSO via Windows Integrated Authentication (IIS)
-
LDAP Authentication
-
Others
Step-by-Step
To configure authentication for WebDAV, follow these steps:
-
Launch the "Users" module.
-
Click the "Users" menu item.
-
Select the "Configuration..." entry from.
The "User Manager Configuration" dialog box appears.
-
Click the "
" icon to the right of "WebDAV."
The "Binding: WebDAV" dialog box appears.
Intrexx Authentication
Regardless of whether they are members of local domains, all users log in to the portal using the username and password from the "Users" module. In the lower section of the dialog box, select a user who will assume the role of the anonymous user. An anonymous user is a user who accesses the portal without logging in. This account is used for all users before they log in. The authentication type can be changed at a later time from Intrexx authentication to authentication via a web server. However, the change should not be made until after the users have been imported.
Authentication against a Windows domain using a username and password
With this type of authentication, the user's username and password from the Windows Active Directory domain are used and verified.
Intrexx Version 12.0.0
Authentication with SSO via Windows Integrated Authentication (IIS)
This authentication type enables SSO (single sign-on) using Integrated Windows Authentication and IIS (see " Setting Up Windows - IIS (Internet Information Services)").
For this authentication type to work, you must configure your portal for Windows Auth.
In addition, we need to make a few adjustments related to the IIS. These are described below.
Step-by-Step
-
Create a new directory for the IIS website (e.g., C:\InetPub\ixsite) that you added as part of the Intrexx deployment (see " Adding a Website in IIS").
-
Navigate to the htmlroot directory (org/<portalname>/external/htmlroot).
-
Copy the " bin " directory and the " web.config " file to the clipboard.
-
Copy the " bin" directory and the "web.config " file into the newly created directory for the IIS website (e.g., C:\InetPub\ixsite).
-
Open the web.config file. the adjustments described below.
-
Add the following code snippet to the web.config file:
<modules runAllManagedModulesForAllRequests="true" runManagedModulesForWebDavRequests="false"> <remove name="WebDAVModule" /> <add name="IxProxyHeadersHttpModule" preCondition="managedHandler" type="UnitedPlanet.Intrexx.Web.IxProxyHeadersHttpModule" /> <add name="IntrexxWindowsAuthHttpModule" preCondition="managedHandler" type="UnitedPlanet.Intrexx.Web.IxWindowsAuthHttpModule" /> </modules> <handlers> <remove name="WebDAV"/> <remove name="OPTIONSVerbHandler"/> <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" /> <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" /> <remove name="ExtensionlessUrlHandler-Integrated-4.0" /> <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" /> <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" /> <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /> </handlers> -
Remove the <conditions> block under ReverseProxyInboundRule.
The file will then look like this:
<?xml version="1.0" encoding="UTF-8"?> <configuration> <!-- Configuration section-handler declaration area. --> <configSections> <sectionGroup name="intrexxConfigurationGroup"> <section name="intrexxConfiguration" allowDefinition="Everywhere" allowLocation="true" type="UnitedPlanet.Intrexx.Web.IntrexxConfigurationSection" /> </sectionGroup> </configSections> <!-- Intrexx configuration settings. --> <intrexxConfigurationGroup> <intrexxConfiguration enableKerberosDelegation="false"> <kerberos excludeContextPaths="css,images,include,script,thirdparty,tmp,userfiles,download,is" servicePrincipalNames="" /> <!-- Define custom HTTP headers to be sent to the backend server. --> <customHttpHeaders> <!-- <add name="X-MY-HEADER-NAME" value="MyHeaderValue"/> --> </customHttpHeaders> </intrexxConfiguration> </intrexxConfigurationGroup> <system.web> <compilation debug="true" targetFramework="4.5.1" /> <httpRuntime maxQueryStringLength="32768" maxUrlLength="65536" targetFramework="4.5.1" /> <authentication mode="Windows" /> <authorization> <deny users="?" /> </authorization> </system.web> <system.webServer> <modules runAllManagedModulesForAllRequests="true" runManagedModulesForWebDavRequests="false"> <remove name="WebDAVModule" /> <add name="IxProxyHeadersHttpModule" preCondition="managedHandler" type="UnitedPlanet.Intrexx.Web.IxProxyHeadersHttpModule" /> <add name="IntrexxWindowsAuthHttpModule" preCondition="managedHandler" type="UnitedPlanet.Intrexx.Web.IxWindowsAuthHttpModule" /> </modules> <handlers> <remove name="WebDAV"/> <remove name="OPTIONSVerbHandler"/> <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" /> <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" /> <remove name="ExtensionlessUrlHandler-Integrated-4.0" /> <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" /> <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" /> <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /> </handlers> <defaultDocument> <files> <clear /> <add value="default.ixsp" /> </files> </defaultDocument> <rewrite> <rules> <rule name="RequestBlockingRule" stopProcessing="true"> <match url=".*" /> <conditions logicalGrouping="MatchAll" trackAllCaptures="false"> <add input="{URL}" pattern="/WEB-INF/*" /> </conditions> <action statusCode="404" statusDescription="The resource you are looking for is unavailable." statusReason="File or directory not found." type="CustomResponse" /> </rule> <rule name="ReverseProxyInboundRule" stopProcessing="true"> <match url="(.*)" /> <action type="Rewrite" url="http://localhost:1337/{R:1}" /> </rule> <rule name="WebSockets" stopProcessing="true"> <match url="wss://(.*)" /> <action type="Rewrite" url="ws://localhost:1337/{R:1}" /> </rule> </rules> </rewrite> <staticContent> <clientCache cacheControlMaxAge="3650.00:00:00" cacheControlMode="UseMaxAge" /> <!-- remove first in case they are defined in IIS already, which would cause a runtime error --> <remove fileExtension=".woff" /> <mimeMap fileExtension=".woff" mimeType="font/woff" /> <remove fileExtension=".woff2" /> <mimeMap fileExtension=".woff2" mimeType="font/woff2" /> </staticContent> <httpProtocol> <customHeaders> <add name="X-Frame-Options" value="SAMEORIGIN" /> </customHeaders> </httpProtocol> <httpErrors errorMode="Custom" existingResponse="PassThrough" /> <!-- Enable this to set the maximum allowed file size for file uploads. Default is 2 GB. --> <security> <requestFiltering> <requestLimits maxAllowedContentLength="2147483646" maxQueryString="32768" maxUrl="65536" /> </requestFiltering> </security> </system.webServer> <!-- Enable this to deactivate Windows Authentication for Application API access. --> <!-- <location path="api/app"> <system.web> <authorization> <allow users="*" /> </authorization> </system.web> <system.webServer> <security> <authentication> <windowsAuthentication enabled="false" /> <anonymousAuthentication enabled="true" /> </authentication> </security> </system.webServer> </location> --> </configuration> -
Start IIS.
-
Under "Sites," select the appropriate site.
-
Right-click.
-
Select "Manage Website > Advanced Settings."
The "Advanced Settings" dialog box appears.
-
Select the "Physical Path" entry.
-
Click the three-dot button.
-
Select the directory you created earlier for the IIS website (for example, C:\InetPub\ixsite).
-
Click "OK."
-
Restart IIS.
Intrexx Version 12.0.1
-
-
Authentication with SSO via Windows Integrated Authentication (IIS)
This authentication type enables SSO (single sign-on) using Integrated Windows Authentication and IIS (see " Windows - Setting Up IIS (Internet Information Services)").
For this authentication type to work, you must configure your portal for Windows Auth.
In addition, you'll need to make a few adjustments related to IIS. These are described below.
Step-by-Step
-
Create a new directory for the IIS website (e.g., C:\InetPub\ixsite) that you added as part of the Intrexx deployment (see " Add a Website in IIS").
-
Navigate to the htmlroot directory (org/<portalname>/external/htmlroot).
-
Copy the " bin " directory and the " web.config " file to the clipboard.
-
Copy the " bin" directory and the "web.config " file into the newly created directory for the IIS website (e.g., C:\InetPub\ixsite).
-
Open the web.config file. the adjustments described below.
-
Add the following code snippet to the web.config file:
<modules runAllManagedModulesForAllRequests="true" runManagedModulesForWebDavRequests="false"> <remove name="WebDAVModule" /> <add name="IxProxyHeadersHttpModule" preCondition="managedHandler" type="UnitedPlanet.Intrexx.Web.IxProxyHeadersHttpModule" /> <add name="IntrexxWindowsAuthHttpModule" preCondition="managedHandler" type="UnitedPlanet.Intrexx.Web.IxWindowsAuthHttpModule" /> </modules> <handlers> <remove name="WebDAV"/> <remove name="OPTIONSVerbHandler"/> <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" /> <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" /> <remove name="ExtensionlessUrlHandler-Integrated-4.0" /> <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" /> <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" /> <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /> </handlers> -
Remove the <conditions> block under ReverseProxyInboundRule.
The file will then look like this:
<?xml version="1.0" encoding="UTF-8"?> <configuration> <!-- Configuration section-handler declaration area. --> <configSections> <sectionGroup name="intrexxConfigurationGroup"> <section name="intrexxConfiguration" allowDefinition="Everywhere" allowLocation="true" type="UnitedPlanet.Intrexx.Web.IntrexxConfigurationSection" /> </sectionGroup> </configSections> <!-- Intrexx configuration settings. --> <intrexxConfigurationGroup> <intrexxConfiguration enableKerberosDelegation="false"> <kerberos excludeContextPaths="css,fonts,images,include,script,thirdparty,tmp" servicePrincipalNames="" /> <!-- Define custom HTTP headers to be sent to the backend server. --> <customHttpHeaders> <!-- <add name="X-MY-HEADER-NAME" value="MyHeaderValue"/> --> </customHttpHeaders> </intrexxConfiguration> </intrexxConfigurationGroup> <system.web> <compilation debug="true" targetFramework="4.5.1" /> <httpRuntime maxQueryStringLength="32768" maxUrlLength="65536" targetFramework="4.5.1" /> <authentication mode="Windows" /> <authorization> <deny users="?" /> </authorization> </system.web> <system.webServer> <modules runAllManagedModulesForAllRequests="true" runManagedModulesForWebDavRequests="false"> <remove name="WebDAVModule" /> <add name="IxProxyHeadersHttpModule" preCondition="managedHandler" type="UnitedPlanet.Intrexx.Web.IxProxyHeadersHttpModule" /> <add name="IntrexxWindowsAuthHttpModule" preCondition="managedHandler" type="UnitedPlanet.Intrexx.Web.IxWindowsAuthHttpModule" /> </modules> <handlers> <remove name="WebDAV"/> <remove name="OPTIONSVerbHandler"/> <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" /> <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" /> <remove name="ExtensionlessUrlHandler-Integrated-4.0" /> <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" /> <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" /> <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /> </handlers> <defaultDocument> <files> <clear /> <add value="default.ixsp" /> </files> </defaultDocument> <rewrite> <rules> <rule name="RequestBlockingRule" stopProcessing="true"> <match url=".*" /> <conditions logicalGrouping="MatchAll" trackAllCaptures="false"> <add input="{URL}" pattern="/WEB-INF/*" /> </conditions> <action statusCode="404" statusDescription="The resource you are looking for is unavailable." statusReason="File or directory not found." type="CustomResponse" /> </rule> <rule name="ReverseProxyInboundRule" stopProcessing="true"> <match url="(.*)" /> <action type="Rewrite" url="http://localhost:1337/{R:1}" /> </rule> <rule name="WebSockets" stopProcessing="true"> <match url="wss://(.*)" /> <action type="Rewrite" url="ws://localhost:1337/{R:1}" /> </rule> </rules> </rewrite> <staticContent> <clientCache cacheControlMaxAge="3650.00:00:00" cacheControlMode="UseMaxAge" /> <!-- remove first in case they are defined in IIS already, which would cause a runtime error --> <remove fileExtension=".woff" /> <mimeMap fileExtension=".woff" mimeType="font/woff" /> <remove fileExtension=".woff2" /> <mimeMap fileExtension=".woff2" mimeType="font/woff2" /> </staticContent> <httpProtocol> <customHeaders> <add name="X-Frame-Options" value="SAMEORIGIN" /> </customHeaders> </httpProtocol> <httpErrors errorMode="Custom" existingResponse="PassThrough" /> <!-- Enable this to set the maximum allowed file size for file uploads. Default is 2 GB. --> <security> <requestFiltering> <requestLimits maxAllowedContentLength="2147483646" maxQueryString="32768" maxUrl="65536" /> </requestFiltering> </security> </system.webServer> <!-- Enable this to deactivate Windows Authentication for Application API access. --> <!-- <location path="api/app"> <system.web> <authorization> <allow users="*" /> </authorization> </system.web> <system.webServer> <security> <authentication> <windowsAuthentication enabled="false" /> <anonymousAuthentication enabled="true" /> </authentication> </security> </system.webServer> </location> --> </configuration> -
Start IIS.
-
Under "Sites," select the appropriate site.
-
Right-click.
-
Select "Manage Website > Advanced Settings."
The "Advanced Settings" dialog box appears.
-
Select the "Physical Path" entry.
-
Click the three-dot button.
-
Select the directory you created earlier for the IIS website (for example, C:\InetPub\ixsite).
-
Click "OK."
-
Restart IIS.
LDAP Authentication
Server Name (FQDN) / Port
Enter the server name (FQDN) and the port for authentication here.
The FQDN (Fully Qualified Domain Name) is composed of the hostname and the domain and thus refers to the complete and unique address of a website. It is used to locate specific hosts on the Internet so that they can be accessed through name resolution.
Encryption
Here, you can choose between LDAP and LDAPS.
When using LDAPS encryption, the certificate must be added to the portal properties. A message to that effect, which also explains the procedure, appears when you select LDAPS.
Authentication
Select the authentication method for your LDAP server here:
-
none
-
simple
-
secure (strong)
User
For LDAP bind login, there are three variables that are expanded at runtime in the following order:
$[LOGIN_NAME] - User's login name
$[LOGIN_DOMAIN] - User's login domain
$[DN] - User's distinguished name (usually populated via replication)For more information on LDAP authentication, click here.
Closing the dialog box
When you close the dialog box, a message will appear if the selected port does not match the standard. If you want to change the port right away, close the notification window by clicking the "
" close icon in the upper-right corner. If you close the message by clicking "OK," the dialog box will also close, unless there are any other messages to be displayed. The port can then be changed by reopening the dialog box.Generic Authentication
This authentication type is not available for WebDAV.
Others
Other authentication modules can be developed to meet your requirements. Examples of this include authentication using X.509 certificates, authentication on third-party systems, etc. If you have any questions, please contact the Consulting Department at INTREXX GmbH.
Example
You can find an example of how to create and implement your own authentication module at the following link:
Apply the authentication type to all bindings
This option is not available for WebDAV.
-
-
Select the desired authentication type.
-
Click "OK."
You will return to the "User Manager Configuration" dialog box.
-
Click "OK."
The adjustments for Intrexx 12.0.1 are related to the changes in access permissions for the "userfiles" directory ("<portal-directory> \external\htmlroot\userfiles"), where, if configured accordingly, portal users can upload image files and download them from there as well.
For more information on this topic, see the " Portal Properties - Security - Upload/Download" section.
Up through Intrexx 12.0.0, image files were made available via the Fronten web server (reverse proxy). Starting with Intrexx 12.0.1, this is done using the web server (Tomcat) integrated into Intrexx. For this reason, the "userfiles" directory must be removed from the configuration file.
For more information about the front-end web server (reverse proxy) and Embedded Tomcat, see the section " Using the Front-End Web Server (Reverse Proxy)."