Interfaces: Security Levels and Authentication - Versionsgeschichte

Odelice am 23. März 2026 um 12:41 Uhr

2026-03-23T12:41:27Z

Odelice am 26. Mai 2025 um 14:35 Uhr

2025-05-26T14:35:41Z

Odelice am 26. Mai 2025 um 14:35 Uhr

2025-05-26T14:35:19Z

Odelice am 14. Februar 2025 um 09:23 Uhr

2025-02-14T09:23:09Z

Odelice: jwt for oauth2

2025-02-14T09:22:46Z

jwt for oauth2

Bhauser: /* Managing Credentials */

2024-11-22T14:28:45Z

Managing Credentials

Bhauser am 22. November 2024 um 14:27 Uhr

2024-11-22T14:27:14Z

Odelice: /* Authentication */

2024-11-21T07:01:35Z

Authentication

Odelice: /* Authentication */

2024-11-19T10:17:07Z

Authentication

Odelice am 19. November 2024 um 08:25 Uhr

2024-11-19T08:25:22Z

@@ Zeile 19: / Zeile 19: @@
 * '''Certificates:''' *.crt, *.cer, *.pem, *.der, or *.p7b
 * '''Private Key:''' *.der, *.pem, or *.ssh (OpenSSH)<br>
-Please make sure that the certificate chain in the provided certificate is complete.<br><br>
+'''As of DGS version 3.8.41, the certificate can also be imported into DGS as a PFX file – the certificate and the private key are extracted from the PFX in the process. Please make sure that, if present, the certificate chain is fully included in the certificate (or PFX) (if required by the client).'''<br><br>
 The following authentication options are specific to the [https://interface.heidler-strichcode.de?version=v2 RESTv2 interface].
-<br>DataGatewayServer Version '''3.8.39''' or higher is needed.
+<br>DataGatewayServer Version '''3.8.44''' or higher is needed.
 ==Basic Authentication==
 The Basic authentication is a simple authentication scheme integrated into the HTTP protocol. The client sends the authentication header in every HTTP request, which contains the username and password.

← Nächstältere Version		Version vom 26. Mai 2025, 14:35 Uhr
Zeile 1:		Zeile 1:
−	[[en:Schnittstellen:_Security_Levels_und_Authentifizierung]]	+	[[de:Schnittstellen:_Security_Levels_und_Authentifizierung]]
	The HVS32 can be operated in cloud environments without concerns, assuming that the connection from the host system (ERP or WMS, hereinafter referred to as ERP for simplicity) to HVS32 is within a shared, secure, internal network.<br>However, if the shipping software HVS32 needs to be publicly accessible — meaning that the host system (ERP/WMS) and the shipping software HVS32 are not located in the same network (LAN, vLAN, vNET, private cloud) — the communication between the two systems must be secured.<br>This implies that both the connection must be encrypted, and each incoming connection must be authenticated and authorized.		The HVS32 can be operated in cloud environments without concerns, assuming that the connection from the host system (ERP or WMS, hereinafter referred to as ERP for simplicity) to HVS32 is within a shared, secure, internal network.<br>However, if the shipping software HVS32 needs to be publicly accessible — meaning that the host system (ERP/WMS) and the shipping software HVS32 are not located in the same network (LAN, vLAN, vNET, private cloud) — the communication between the two systems must be secured.<br>This implies that both the connection must be encrypted, and each incoming connection must be authenticated and authorized.

@@ Zeile 293: / Zeile 293: @@
 </syntaxhighlight>
 </div></div>
-<br><br>
+<br>
 ==Managing Client Credentials in the DGS==

← Nächstältere Version		Version vom 14. Februar 2025, 09:23 Uhr
Zeile 1:		Zeile 1:
−	[[~~null~~]]	+	[[en:Schnittstellen:_Security_Levels_und_Authentifizierung]]
	The HVS32 can be operated in cloud environments without concerns, assuming that the connection from the host system (ERP or WMS, hereinafter referred to as ERP for simplicity) to HVS32 is within a shared, secure, internal network.<br>However, if the shipping software HVS32 needs to be publicly accessible — meaning that the host system (ERP/WMS) and the shipping software HVS32 are not located in the same network (LAN, vLAN, vNET, private cloud) — the communication between the two systems must be secured.<br>This implies that both the connection must be encrypted, and each incoming connection must be authenticated and authorized.		The HVS32 can be operated in cloud environments without concerns, assuming that the connection from the host system (ERP or WMS, hereinafter referred to as ERP for simplicity) to HVS32 is within a shared, secure, internal network.<br>However, if the shipping software HVS32 needs to be publicly accessible — meaning that the host system (ERP/WMS) and the shipping software HVS32 are not located in the same network (LAN, vLAN, vNET, private cloud) — the communication between the two systems must be secured.<br>This implies that both the connection must be encrypted, and each incoming connection must be authenticated and authorized.

@@ Zeile 1: / Zeile 1: @@
-[[de:Schnittstellen:_Security_Levels_und_Authentifizierung]]
+[[null]]
 The HVS32 can be operated in cloud environments without concerns, assuming that the connection from the host system (ERP or WMS, hereinafter referred to as ERP for simplicity) to HVS32 is within a shared, secure, internal network.<br>However, if the shipping software HVS32 needs to be publicly accessible — meaning that the host system (ERP/WMS) and the shipping software HVS32 are not located in the same network (LAN, vLAN, vNET, private cloud) — the communication between the two systems must be secured.<br>This implies that both the connection must be encrypted, and each incoming connection must be authenticated and authorized.
@@ Zeile 174: / Zeile 174: @@
 '''Note:''' As the number of valid client IDs increases, so does the probability of unauthorized access being granted through a "brute-force attack."
 <div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto;">
 <div style="font-weight:bold;line-height:1.6;">Example of token request (generating access and refresh tokens with client ID + client secret)</div>
 <div class="mw-collapsible-content">
@@ Zeile 186: / Zeile 190: @@
 </syntaxhighlight>
 </div></div>
 <br>
 <div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto;">
 <div style="font-weight:bold;line-height:1.6;">Response of the token request</div>

@@ Zeile 293: / Zeile 293: @@
 [[File:Authorization Credentials 004.png|thumb|right|Show Credentials Dialog]]
 To manage your credentials, select the appropriate tab for the authentication method configured in the DGS (e.g., OAuth2.0 CC).
-* '''add'''<br>Here, you can create new credentials. Note that the password or client secret will only be displayed once in a dialog. Be sure to copy it to a secure location and ensure no unauthorized persons have access to it.
+* '''add'''<br>create new credentials. Note that the password or client secret will only be displayed once in a dialog. Be sure to copy it to a secure location and ensure no unauthorized persons have access to it.
-* '''change secret''' or '''change password'''<br>Here, you can assign a new password or client secret. As with the add function, the password or client secret will only be displayed once in a dialog.
+* '''change secret''' or '''change password'''<br>assign a new password or client secret. As with the add function, the password or client secret will only be displayed once in a dialog.
-* '''remove'''<br>Here, you can remove the selected credentials.
+* '''remove'''<br>remove the selected credentials.

← Nächstältere Version		Version vom 22. November 2024, 14:27 Uhr
Zeile 277:		Zeile 277:
	===Authorization Code===		===Authorization Code===
	This authentication method is exclusively available through the authentication system [[IRIS_cloud_system\|IRIS Cloudsystem]].		This authentication method is exclusively available through the authentication system [[IRIS_cloud_system\|IRIS Cloudsystem]].
		+
		+	==Managing Client Credentials in the DGS==
		+	The client credentials are managed in the DataGatewayServer. You can create new credentials or delete existing ones.<br>
		+	To do this, start the Credentials Configurator (.exe) located in the installation directory of the DataGatewayServer.
		+	===Config===
		+	[[File:Authorization Credentials 001.png\|thumb\|right\|Credentials Configurator - config]]
		+	On this screen, general configurations can be made.
		+	* '''check invalid logins'''<br>If this option is active, the number of invalid authentication attempts will be counted. After '''max invalid logins''' within '''timespan in seconds''', all credentials will be locked.
		+	* '''execute CODE RED for OAuth2.0 CC'''<br>If this option is active when using OAuth2.0 CC, a '''CODE RED''' will be triggered if a REFRESH TOKEN is reused multiple times. This action deactivates all ACCESS and REFRESH TOKENS, requiring new tokens to be requested via client credentials. Additionally, the DGS Configurator can be configured to send an email notification in the event of a CODE RED.
		+	* '''Lock Credentials / Unlock Credentials'''<br>With this button, all credentials can be locked or unlocked. For instance, if all client credentials were locked due to the '''check invalid logins''' option, they can be unlocked here. This action takes effect immediately without needing to save.
		+	* Save<br>This button persistently saves the settings and credentials. The options and credentials only become active after saving. A DGS restart is not required.
		+	===Managing Credentials===
		+	[[File:Authorization Credentials 002.png\|thumb\|right\|Credentials Configurator - OAuth2.0 CC]]
		+	[[File:Authorization Credentials 003.png\|thumb\|right\|Enter Username / ClientID]]
		+	[[File:Authorization Credentials 004.png\|thumb\|right\|Show Credentials Dialog]]
		+	To manage your credentials, select the appropriate tab for the authentication method configured in the DGS (e.g., OAuth2.0 CC).
		+	* '''add'''<br>Here, you can create new credentials. Note that the password or client secret will only be displayed once in a dialog. Be sure to copy it to a secure location and ensure no unauthorized persons have access to it.
		+	* '''change secret''' or '''change password'''<br>Here, you can assign a new password or client secret. As with the add function, the password or client secret will only be displayed once in a dialog.
		+	* '''remove'''<br>Here, you can remove the selected credentials.

@@ Zeile 14: / Zeile 14: @@
 =Authentication=
 Authentication mechanisms can only be considered "secure" when used in combination with other security mechanisms such as HTTPS/SSL. Encryption is achieved through HTTPS using TLSv1.2 or TLSv1.3 (if supported by the client).
 For encryption, a certificate with the corresponding private key is required. The following certificate formats are supported:
@@ Zeile 20: / Zeile 19: @@
 * '''Certificates:''' *.crt, *.cer, *.pem, *.der, or *.p7b
 * '''Private Key:''' *.der, *.pem, or *.ssh (OpenSSH)
 The following authentication options are specific to the [https://interface.heidler-strichcode.de?version=v2 RESTv2 interface].
 <br>DataGatewayServer Version '''3.8.31''' or higher is needed.
 ==Basic Authentication==