Configure the iMIS SOA web service

Preparing your SOA host

For the SOA service to receive connections and pass Windows security, configure the following on the machine that is hosting the SOA service:

Install iMIS. This installs the SOA service host with the correct database connection information.
Disable simple file sharing. In Windows Explorer, go to Folder Options > View > Advanced settings.

Note: Missing this can cause the following error:
A remote side security requirement was not fulfilled during authentication. Try increasing the ProtectionLevel and/or ImpersonationLevel.

Securing your SOA service for external access

If IIS is installed on your computer, then iMIS SOA is integrated with IIS so there is no separate service. The default port is 808. You can change this port through IIS administration. For example:

<setting key="EntityManagerDefaultBaseUri" value="net.tcp://10.10.10.10:808/NetTcp"/>

Note: You can use a TCP port other than port 808 if it is a valid TCP port and is not in use by any other service. Because the default port for net.tcp is 808, ASI recommends that you increment from there.
The 10.10.10.10 IP address is an example only. Use your own IP address.

Note: If you change the default port, you must change the EntityManagerDefaultBaseUri key in the site web.config files, as well as any client that uses SOA.

Do the following to help prevent unauthorized access through SOA:

Limit access to this port to specifically trusted IP addresses only:
- At minimum, the addresses of any iMIS servers that will be using SOA, or hosting content items that use SOA.
- The addresses of any other machines hosting in-house applications that use Windows Communication Foundation (WCF) to consume the SOA service.
To secure the host service’s port, configure Internet Protocol Security (IPSec) to prevent unauthorized access. For complete walkthroughs of IPSec on Windows, see Microsoft’s IPSec guidance.

Enabling the SOA service protocol

Using IIS, you will not see the ASI SOA host service because it is integrated under IIS. Because of this integration, you must do the following to turn on NetTcp for your sites, for each virtual root you create:

Open Internet Information Services (IIS) Manager on the iMIS server.
In the Connections pane, select Sites.
In the Sites pane, select the virtual root.

In the Actions pane, select Manage Web Site > Advanced Settings.
Make sure net.tcp appears in Enabled Protocols:

Repeat this process for each of your virtual roots.

Note: After you change any iMIS system configuration item, restart the SOA service to ensure that the changes take effect.

Restricting services access using IP address

By default, iMIS SOA provides the following levels of security to customer data:

Transport Layer Security (TLS)
A required user name and password
User type access rights (ClaimsMap)

In addition, you can protect your customer data by disabling external access, or by restricting SOA or web services access to use by internal systems and trusted partners only. To achieve this, use your Microsoft IIS server to restrict services access by IP address. Regardless of which IIS server version you have, the approach centers on the EntityService.svc file to restrict SOA or ASICommon/Services directory in the web root to restrict access to web services. Choose one of the following strategies:

DISABLE – If you do not need outside access to your database, disable external access by renaming SOA/EntityService.svc or ASICommon/Services.
RESTRICT – Add another level of security by applying the specific IP address restrictions to EntityService.svc or ASICommon/Services.

Note: To use EntityService.svc, you must have a security certificate from a certificate authority installed.

Restricting services access through IP address

By default, IIS installations do not enable IP restrictions, so restricting IPs requires a few more steps.

Do the following to restrict services access by IP:

Ensure that your server has IP security enabled.
- Windows Server 2012 or Windows Server 2012 R2:
  1. On the taskbar, click Server Manager.
  2. In Server Manager, click the Manage menu, and then click Add Roles and Features.
  3. In the Add Roles and Features wizard, click Next.
  4. Select the installation type and click Next.
  5. Select the destination server and click Next.
  6. On the Server Roles page, expand Web Server (IIS) > Web Server > Security, and then select IP and Domain Restrictions.
  7. Click Next.
  8. On the Select features page, click Next.
  9. On the Confirm installation selections page, click Install.
  10. On the Results page, click Close.
- Windows 2008/R2:
  1. Go to Start > Administrative Tools > Server Manager.
  2. Select Roles > Web Server.
  3. Select Add Role Services.
  4. Ensure IP and Domain Restrictions is checked.
- Windows 7:
  1. Go to Start > Control Panel > Programs and Features.
  2. Select Turn Windows features on and off.
  3. Go to World Wide Web Services > Security.
  4. Ensure IP Security is checked.
  5. Click OK and close.
Enable read/write on IIS IPv4 Address and Domain Restrictions:
1. Open Internet Information Service Manager.
2. In the Connections pane, select the machine name.
3. In the <Machine Name> Home pane, click Feature Delegation.
4. Ensure that IPv4 Address and Domain Restrictions are set to Read/Write.

Edit the applicationHost.config file under C:\Windows\System32\inetsrv\config. You must modify the applicationHost.config file to access the service at the application level.

Modify the following line:

<section name="ipSecurity" overrideModeDefault="Deny" />

change to:

<section name="ipSecurity" overrideModeDefault="Allow" />

Also modify the following:

<sectionGroup name="security">
	<section name="ipSecurity" overrideModeDefault="Deny" />

change to:

<sectionGroup name="security">
	<section name="ipSecurity" overrideModeDefault="Allow" />

Add IP restrictions to the web.config files:

Locate the web.config files in the root of the website:
- C:\Program Files (x86)\ASI\iMIS\Net\web.config
- C:\AsiPlatform\Asi.Scheduler_[your instance]\web.config
Right-click on the web.config file.
Select Properties.
Ensure the Read-only check box is clear.
Open the web.config file with a text editor.
At the bottom of the file, above the </configuration> line, add the appropriate IP restrictions for the services to which you want to restrict access:

SOA:

<location path="SOA/EntityService.svc">
	<system.webServer>
	<security>
	<ipSecurity allowUnlisted="false">
		<add ipAddress="127.0.0.1" allowed="true" />
	</ipSecurity>
	</security>
	</system.webServer>
</location>

MembershipWebService:

<location path="[iMIS instance]/AsiCommon/Services/Membership/MembershipWebService.asmx">
	<system.webServer>
	<security>
	<ipSecurity allowUnlisted="false">
		<add ipAddress="127.0.0.1" allowed="true" />
	</ipSecurity>
	</security>
	</system.webServer>
</location>

ClientLog:

<location path="[iMIS instance]/AsiCommon/Services/ClientLog/loggingservice.asmx">
	<system.webServer>
	<security>
	<ipSecurity allowUnlisted="false">
		<add ipAddress="127.0.0.1" allowed="true" />
	</ipSecurity>
	</security>
	</system.webServer>
</location>

QueryService:

<location path="[iMIS instance]/AsiCommon/Services/Query/queryservice.asmx">
	<system.webServer>
	<security>
	<ipSecurity allowUnlisted="false">
		<add ipAddress="127.0.0.1" allowed="true" />
	</ipSecurity>
	</security>
	</system.webServer>
</location>

SiteMapWebService:

<location path="[iMIS instance]/AsiCommon/Services/SiteMap/SiteMapWebService.asmx">
	<system.webServer>
	<security>
	<ipSecurity allowUnlisted="false">
		<add ipAddress="127.0.0.1" allowed="true" />
	</ipSecurity>
	</security>
	</system.webServer>
</location>

For example, these IP restrictions restrict external/http/soap access to only the local computer

Securing other web services

Security for these web services is set in the web.config file, which defaults to C:\Program Files (x86)\ASI\iMIS\Net\.