• Authentication

• Connection to D2000

• Linking the D2000 Session with the HTTP Session

• Monitoring of user and system statistics

The implementation of the SmartWeb server is built on the philosophy of not duplicating functionality that already exists in D2000. For this reason SmartWeb does not have, for example, its own user management, but instead integrates closely with D2000 functionality in the areas where it makes sense; these are mentioned in the following chapters.

Authentication

SmartWeb can authenticate a user against D2000 in the following ways:

1. verification of the entered name/password against a D2000 user (+ supplementary verification in an authentication RPC to restrict login to selected users only)

2. verification of the entered name/password in a custom authentication RPC + the name/password entered in the SmartWeb configuration is used to automatically create the D2000 session for communication with D2000

3. automatic login with a preconfigured name/password (i.e. without showing the login screen)

4. additional validation, on top of options 1) and 2), using a client certificate installed on selected devices from which the application will be accessed

   1. the verification can be performed locally on the SmartWeb server,

   2. or remotely in an authentication RPC in D2000

In addition to the authentication methods listed above, the SmartWeb server can call configured logOn/logOut RPC methods for every user who logs in/out. It is also possible to change a user's name and password via the API.

We currently support the following authentication methods; they can be extended in the future according to client requirements.

• HTTP BASIC for the REST API

• HTTP FORM for the Comet API

Connection to D2000

The connection to D2000 is made through the JAPI library, so all the capabilities provided by JAPI can be used to implement the connection to D2000, such as:

• a reverse connection because of a SmartWeb server in a demilitarized zone

• a secured connection

• redundant connections

Linking the D2000 Session with the HTTP Session

For every logged-in user a unique D2000 session is created, unique to their session, and it lasts until they log out (the exception being authentication via HTTP BASIC, where a single D2000 session is shared by all API calls under the same user). The web HTTP session of a logged-in user is linked to the D2000 session, and in case either the D2000 session (externally, e.g. via the system console) or the HTTP session (e.g. by logging out) is terminated, the linked session is automatically terminated as well, so that resources that are no longer used are not held. The SmartWeb server can terminate both sessions (D2000 and HTTP) in case of inactivity on the client side for a period defined by the timeout logout parameter for the user in D2000. Note that session expiration occurs on client inactivity; sending data from the server side by the Publish/Subscribe concept is not considered client activity.

Monitoring of user and system statistics

SmartWeb provides a REST API for monitoring the application of D2000 RPC method calls for a specific user as well as globally for the whole system. It is also possible to obtain system statistics about the state of the SmartWeb server, for monitoring and troubleshooting performance problems.