Page History

...

js7.web.server: Authentication Settings

• This setting specifies public access to an Agent if incoming HTTP connections are to be used. If used with a value true then no authentication is applied.
• Default: false

js7.web.server: Job Script Execution Encoding

• This setting specifies the codepage to be used if Agents are operated for Windows. For details see JS7 - Unicode Support.

• The following codepages are supported:
  
  

  Code Block
  title List of supported codepages collapse true
  js7.windows.codepages { 37 = "IBM037" # IBM EBCDIC US-Canada 437 = "IBM437" # OEM United States 737 = "x-IBM737" # ibm737 OEM Greek (formerly 437G); Greek (DOS) 775 = "IBM775" # ibm775 OEM Baltic; Baltic (DOS) 850 = "IBM850" # ibm850 OEM Multilingual Latin 1; Western European (DOS) 852 = "IBM852" # ibm852 OEM Latin 2; Central European (DOS) 855 = "IBM855" # OEM Cyrillic (primarily Russian) 857 = "IBM857" # ibm857 OEM Turkish; Turkish (DOS) 858 = "IBM00858" # OEM Multilingual Latin 1 + Euro symbol 860 = "IBM860" # OEM Portuguese; Portuguese (DOS) 861 = "IBM861" # ibm861 OEM Icelandic; Icelandic (DOS) 862 = "IBM862" # DOS-862 OEM Hebrew; Hebrew (DOS) 863 = "IBM863" # OEM French Canadian; French Canadian (DOS) 864 = "IBM864" # OEM Arabic; Arabic (864) 865 = "IBM865" # OEM Nordic; Nordic (DOS) 866 = "IBM866" # cp866 OEM Russian; Cyrillic (DOS) 869 = "IBM869" # ibm869 OEM Modern Greek; Greek, Modern (DOS) 870 = "IBM870" # IBM EBCDIC Multilingual/ROECE (Latin 2); IBM EBCDIC Multilingual Latin 2 874 = "x-IBM874" # windows-874 Thai (Windows) 875 = "x-IBM875" # cp875 IBM EBCDIC Greek Modern 949 = "x-windows-949" # ks_c_5601-1987 ANSI/OEM Korean (Unified Hangul Code) 950 = "x-windows-950" # big5 ANSI/OEM Traditional Chinese (Taiwan; Hong Kong SAR, PRC); Chinese Traditional (Big5) 1026 = "IBM1026" # IBM EBCDIC Turkish (Latin 5) 1047 = "IBM1047" # IBM EBCDIC Latin 1/Open System 1140 = "IBM01140" # IBM EBCDIC US-Canada (037 + Euro symbol); IBM EBCDIC (US-Canada-Euro) 1141 = "IBM01141" # IBM EBCDIC Germany (20273 + Euro symbol); IBM EBCDIC (Germany-Euro) 1142 = "IBM01142" # IBM EBCDIC Denmark-Norway (20277 + Euro symbol); IBM EBCDIC (Denmark-Norway-Euro) 1143 = "IBM01143" # IBM EBCDIC Finland-Sweden (20278 + Euro symbol); IBM EBCDIC (Finland-Sweden-Euro) 1144 = "IBM01144" # IBM EBCDIC Italy (20280 + Euro symbol); IBM EBCDIC (Italy-Euro) 1145 = "IBM01145" # IBM EBCDIC Latin America-Spain (20284 + Euro symbol); IBM EBCDIC (Spain-Euro) 1146 = "IBM01146" # IBM EBCDIC United Kingdom (20285 + Euro symbol); IBM EBCDIC (UK-Euro) 1147 = "IBM01147" # IBM EBCDIC France (20297 + Euro symbol); IBM EBCDIC (France-Euro) 1148 = "IBM01148" # IBM EBCDIC International (500 + Euro symbol); IBM EBCDIC (International-Euro) 1149 = "IBM01149" # IBM EBCDIC Icelandic (20871 + Euro symbol); IBM EBCDIC (Icelandic-Euro) 1200 = "UTF-16LE" # utf-16 Unicode UTF-16, little endian byte order (BMP of ISO 10646); available only to managed applications 1201 = "UTF-16BE" # unicodeFFFE Unicode UTF-16, big endian byte order; available only to managed applications 1250 = "windows-1250" # windows-1250 ANSI Central European; Central European (Windows) 1251 = "windows-1251" # windows-1251 ANSI Cyrillic; Cyrillic (Windows) 1252 = "windows-1252" # windows-1252 ANSI Latin 1; Western European (Windows) 1253 = "windows-1253" # windows-1253 ANSI Greek; Greek (Windows) 1254 = "windows-1254" # windows-1254 ANSI Turkish; Turkish (Windows) 1255 = "windows-1255" # windows-1255 ANSI Hebrew; Hebrew (Windows) 1256 = "windows-1256" # windows-1256 ANSI Arabic; Arabic (Windows) 1257 = "windows-1257" # windows-1257 ANSI Baltic; Baltic (Windows) 1258 = "windows-1258" # windows-1258 ANSI/OEM Vietnamese; Vietnamese (Windows) 12000 = "UTF-32LE" # utf-32 Unicode UTF-32, little endian byte order; available only to managed applications 12001 = "UTF-32BE" # utf-32BE Unicode UTF-32, big endian byte order; available only to managed applications 20127 = "US-ASCII" # us-ascii US-ASCII (7-bit) 20866 = "KOI8-R" # koi8-r Russian (KOI8-R); Cyrillic (KOI8-R) 20905 = "KOI8-U" # IBM EBCDIC Turkish 20932 = "EUC-JP" # EUC-JP Japanese (JIS 0208-1990 and 0212-1990) 21025 = "x-IBM1025" # cp1025 IBM EBCDIC Cyrillic Serbian-Bulgarian 28591 = "iso-8859-1" # iso-8859-1 ISO 8859-1 Latin 1; Western European (ISO) 28592 = "iso-8859-2" # iso-8859-2 ISO 8859-2 Central European; Central European (ISO) 28593 = "iso-8859-3" # iso-8859-3 ISO 8859-3 Latin 3 28594 = "iso-8859-4" # iso-8859-4 ISO 8859-4 Baltic 28595 = "iso-8859-5" # iso-8859-5 ISO 8859-5 Cyrillic 28596 = "iso-8859-6" # iso-8859-6 ISO 8859-6 Arabic 28597 = "iso-8859-7" # iso-8859-7 ISO 8859-7 Greek 28598 = "iso-8859-8" # iso-8859-8 ISO 8859-8 Hebrew; Hebrew (ISO-Visual) 28599 = "iso-8859-9" # iso-8859-9 ISO 8859-9 Turkish 28603 = "iso-8859-13" # iso-8859-13 ISO 8859-13 Estonian 28605 = "iso-8859-15" # iso-8859-15 ISO 8859-15 Latin 9 50220 = "iso-2022-jp" # iso-2022-jp ISO 2022 Japanese with no halfwidth Katakana; Japanese (JIS) 50222 = "iso-2022-jp" # iso-2022-jp ISO 2022 Japanese JIS X 0201-1989; Japanese (JIS-Allow 1 byte Kana - SO/SI) 50225 = "iso-2022-kr" # iso-2022-kr ISO 2022 Korean 65001 = "UTF-8" # utf-8 Unicode (UTF-8) }

• Default: The default codepage of the Windows operating system is used, for example 932 for Japan, 850 for Western Europe.

Security Configuration File: private.conf

js7.job.execution: Job Script Execution Permissions

• By default the Agent prevents any commands and scripts from being executed except for scripts located in specific directories. This setting allows any commands and scripts to be executed that the workflow has signed and the signature has been verified.

js7.job.execution: Job Script Termination

• The Agent can be instructed to terminate running jobs, see JS7 - FAQ - Does JS7 reliably kill running jobs?
• The following settings are in place to terminate running jobs by an Agent operated for a Unix OS:
  • The setting kill-with-sigterm-command specifies the OS command executed by the Agent to forward a SIGTERM signal to the running job.
  • The setting kill-with-sigkill-command specifies the OS command executed by the Agent to forward a SIGKILL signal to the running job.
• Both settings are specified as an array of arguments, i.e. "/bin/kill", "-KILL", "$pid" translates to the command: /bin/kill -KILL 99 provided that 99 were the Process ID of the running job.
• This setting can be applied should the Agent be operated for an OS that makes use of a different syntax for the kill command.

js7.configuration: Trusted Signature Keys

• The Agent expects a signature for any deployed objects such as workflows. Such signatures are created with a private key and are verified by the Agent according to the available certificates. 
• When deploying objects with JOC Cockpit:
  • for a Low Security Level JOC Cockpit creates the signature from a single private key that is used for any JOC Cockpit user accounts allowed to deploy objects.
  • for a Medium Security Level JOC Cockpit creates the signature from the private key of the JOC Cockpit user account that deploys objects.
  • for a High Security Level the user creates the signature outside of JOC Cockpit and uploads the signed objects.
• The Agent supports PGP public keys and X.509 certificates. This setting expects a directory that holds a number of public key files or certificate files.
• trusted-signature-keys
  • PGP: specifies the directory from which PGP public keys are used to verify the signature of deployed objects.
  • X509: specifies the directory from which X.509 certificates are used to verify the signature of deployed objects.

js7.auth.users: HTTPS Authentication and Authorization

• An additional authentication mechanism is applied when using HTTPS certificates or public keys for incoming connections, see below: the client of the incoming connection, i.e. a Controller, is required to provide a Client Authentication Certificate. This includes two certificates that are in place for a secure HTTPS connection: the Agent's Server Authentication Certificate and the Controller's Client Authentication Certificate. 
  • The fact that a given certificate is to be used for Server Authentication and/or Client Authentication is specified with the key usage when the certificate is being created and signed.
  • The distinguished name that is specified with the Agent's configuration has to match the Client Authentication Certificate's subject attribute of a Controller. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated.
• Controller
  • Settings in this section are used for incoming HTTPS connections from Controller instances.
  • distinguished-names: 
    • Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections from a Controller.
    • Any number of distinguished names can be specified allowing a number of incoming HTTPS connections from different Controllers.

js7.web.https: HTTPS Certificates

• This setting is used to specify the location of a keystore and any truststores used for HTTPS connections.
• Keystore and truststore files are expected in PKCS#12 format.
• keystore
  • The keystore includes the private key for the Agent's incoming HTTPS connections.
  • Private key types RSA and ECDSA are supported. 
  • file:  the full path to the location of the keystore file is expected.
    • Default: ${js7.config-directory}"/private/https-keystore.p12"
  • key-password: Any keys included with the keystore are protected with a password. The same password has to be used for all private keys in the given keystore.
  • store-password: The keystore file is protected by a password.
• truststores
  
  • A truststore contains the certificates or public keys for the Agent's incoming HTTPS connections.
    • Certificates are signed by a Certificate Authority (CA) - alternatively a self-signed certificate can be used.
    • It is recommended that certificates are used instead of public keys.
    • Certificates of type X.509 are supported.
  • file:  the full path to the location of the truststore file is expected.
    • Default: ${js7.config-directory}"/private/https-truststore.p12"
  • store-password: A truststore file is protected by a password.
  • A number of truststores can be specified by repeating the file and store-password settings.

js7.web.server: HTTPS Authentication

• This setting is used to specify the authentication type for HTTPS connections to an Agent.
• https-client-authentication
  
  • The value on (default) specifies that mutual authentication with certificates for Server Authentication and Client Authentication is used.
  • The value off specifies that HTTP Basic Authentication only is used.
• By default JS7 makes use of mutual authentication including both Server and Client Authentication Certificates. This setting can be switched off to use Server Authentication Certificates only.

...