##Knowledge Base

####advanced security for webservices

    parameters:
        enable_application_access_control: true|false

####REST encryption

    API-Headers
    
    servicetoken -> *****
    x-wsse -> UsernameToken Username="*", PasswordDigest="*", Nonce="*", Created="*"

    Body encryption
    
    KeyMixer(PasswordDigest + FixedKey)
    
    life_style_tools_ciphering:
        mcrypt_cypher_name: 'MCRYPT_RIJNDAEL_256'
        mcrypt_mode_name: 'MCRYPT_MODE_CBC'
    
    parameters:
        rest_auth_wsse_lifetime: 32000
        rest_auth_secured_against_replay_attack: false|false
        
###inital backend login (from mysql dump)

Login: SuperAdmin#42#42

Password: Cipher;Me;Now#9

### configuration application firewall

If you want to create a new application it is very important to create roles to
read and write to this application first, because if you want to add attributes
or roles and the application firewall is active, you are not able to insert, update, view
or edit this application.

All application read/write access is stored in the application "WebserviceConsumer", this
application must assigned to the service consumer.

For instance you want to create a new application named "SsoUserWsAdmin" you have to do
the following steps first:

- go to menu entry "DB Manager -> Applications" and check if the application "WebserviceConsumer" exists
- now you have to create two new roles "SsoUserWsAdmin:write" and "SsoUserWsAdmin:read" for this application
- go to "Overview -> Demo" and go to "Application Role - Add"
- make sure that you use a valid credentials
- know trigger the following request

        <?xml version="1.0"?>
        <SsoRequest>
          <Credentials>
            <ServiceProvider>
              <ServiceToken>***</ServiceToken>
              <ServiceName>MyService</ServiceName>
            </ServiceProvider>
            <ServiceTrigger>
              <Username>***</Username>
              <UserIdentifier>***</UserIdentifier>
            </ServiceTrigger>
            <ServiceCountry>
              <Code>DE</Code>
            </ServiceCountry>
          </Credentials>
          <ApplicationRole>
            <Add>
              <Key>
                <ApplicationType>
                  <Name>WebserviceConsumer</Name>
                </ApplicationType>
              </Key>
              <Value>
                <RoleType>
                  <Name>SsoUserWsAdmin:write</Name>
                  <Description>some description</Description>
                </RoleType>
              </Value>
            </Add>
          </ApplicationRole>
        </SsoRequest>

- and this request

        <?xml version="1.0"?>
        <SsoRequest>
          <Credentials>
            <ServiceProvider>
              <ServiceToken>***</ServiceToken>
              <ServiceName>MyService</ServiceName>
            </ServiceProvider>
            <ServiceTrigger>
              <Username>***</Username>
              <UserIdentifier>***</UserIdentifier>
            </ServiceTrigger>
            <ServiceCountry>
              <Code>DE</Code>
            </ServiceCountry>
          </Credentials>
          <ApplicationRole>
            <Add>
              <Key>
                <ApplicationType>
                  <Name>WebserviceConsumer</Name>
                </ApplicationType>
              </Key>
              <Value>
                <RoleType>
                  <Name>SsoUserWsAdmin:read</Name>
                  <Description>some description</Description>
                </RoleType>
              </Value>
            </Add>
          </ApplicationRole>
        </SsoRequest>
        
- the next step is to create the application "WebserviceConsumer"
- go to "Overview -> Demo" and go to "Application - Add"
- make sure that you use valid credentials
- know trigger the following request

        <?xml version="1.0"?>
        <SsoRequest>
          <Credentials>
            <ServiceProvider>
              <ServiceToken>***</ServiceToken>
              <ServiceName>MyService</ServiceName>
            </ServiceProvider>
            <ServiceTrigger>
              <Username>***</Username>
              <UserIdentifier>***</UserIdentifier>
            </ServiceTrigger>
            <ServiceCountry>
              <Code>DE</Code>
            </ServiceCountry>
          </Credentials>
          <Application>
            <Add>
              <Value>
                <ApplicationType>
                  <Name>WebserviceConsumer</Name>
                  <Description>some description</Description>
                </ApplicationType>
              </Value>
            </Add>
          </Application>
        </SsoRequest>

- to work with this application your "Service User" now needs the roles for this application
- you can use the administration backend to add this roles or trigger the webservices 
- to add the roles to your service admin with the backend go to "DB Manager -> Users"
- pick your service user and click show
- click "Show Applications" search the part with "WebserviceConsumer"
- click "Show Roles" 
- click "Add Roles" and select the roles "SsoUserWsAdmin:write" and "SsoUserWsAdmin:read"
- now your service user is able to read and write to this application

notes: if you assigned the role "SsoUserWsAdmin:write" the read role is not required, 
because the read access is automatically granted