Pro Cloud Server using IIS (Optional)

This topic describes the use of Microsoft’s Internet Information Server (IIS) to replace the Pro Cloud Server’s in-built webserver. IIS should be used only under certain conditions.

Background

The ability to use IIS was introduced in an early version of Sparx Systems Cloud Services (the product prior to the Pro Cloud Server) to allow Enterprise Architect users to implement a basic form of single sign-on (although the prompt for user credentials was not completely eliminated using this method).

In version 3 of the Pro Cloud Server, native support for Windows Active Directory and OpenID single sign-on was added, providing a more integrated, robust and secure single sign-on methodology.

Limitations

The main limitation of using IIS instead of the in-built PCS webserver is that functionality such as the Floating License Server and SBPI Integrations will not operate when Enterprise Architect users are connecting via IIS.  IIS Ports also do not support the use of 'Pro Features' such as OSLC and WebEA access. Basically, the IIS connection only allows Enterprise Architect clients to read data from a repository.

Recommendations

Given the above information, Sparx Systems would now only recommend the use of IIS when users:

• Are using a version of Pro Cloud Server prior to v3
• Are not using the Floating License Server component
• Are not using SBPI Integrations
• Are not using the native PCS single sign-on feature

Configuration

To configure IIS to host the Pro Cloud Server, you must first set the SparxCloudLink.sseap file to refer to the Pro Cloud Server, and then in Windows open the Internet Information Services (IIS) Manager and configure it to send requests to the appropriate module. Depending on your preferences you can choose either an HTTP Module or an ISAPI module.

Prior to setting up HTTP or ISAPI, these settings must be made in IIS:

• Application Pool settings
• Feature settings

For a secure HTTPS setup (optional):

• Set up a Certificate
• Set up HTTPS

Configuration Settings

Before setting up your HTTP module or ISAPI module, you must first check that the SSProCloud.config file for the service is configured as required, and note the Port used so that you can specify it when you go on to set the SparxCloudLink.sseap file to refer to the Pro Cloud Server.

The directory path containing the ISAPI .dll also contains the SparxCloudLink.sseap configuration file.

The path should resemble this example:

     C:\Program Files (x86)\Sparx Systems\Pro Cloud Server\ISAPI

Edit this file in a text editor, running as an Administrator.

The default contents are:

    [cloud]

    server=localhost

    port=803

server:

The address to look up the machine running the Pro Cloud Server. In most circumstances it is best to run the HTTP module and the Pro Cloud Server on the same machine. In this case, the default value of localhost can be used. If the Pro Cloud Server is running on a different machine, use the IP address or server name where the service is running.

port:

The Port the Pro Cloud Server is listening on for admin requests. By default this takes the value of 803, but this should be cross-referenced against your service configuration in the SSProCloud.config file.

Optional settings

These points are optional. For testing purposes you might prefer to leave these changes until any issues with IIS are resolved.

1. In the SSProCloud.config file, remove all the references to Ports other than the administration Port (default 803). In other words, remove the bracketed entries (…) from the config file.
2. Save the SSProCloud.config file.
3. Restart the Service.

Application Pool Settings

HTTP or ISAPI will require an Application Pool that is 32 bit and not managed code. This illustration shows the settings for 32 bit applications in the IIS Application Pools Advanced Settings view.

Feature Permissions

This illustration shows the access path and the 'Default Web Site | Handler' mappings to permit Script Execution.

Setting up a Certificate

In order to run the HTTPS service you must set up a security certificate in IIS. In the IIS Manager:

1. Under 'Connections', select the root connection (machine name).
2. Double-click on the 'Server Certificates' icon.
3. Click on 'Create Self Signed Certificate'.
4. Specify a simple, user-friendly name for the certificate.

Setting up HTTPS

To set the bindings through which HTTPS will operate, you must include a Port and a certificate in the site bindings.

In the IIS Manager:

• Under 'Connections', select the 'Default Web Site' option
• Under 'Actions' click on the 'Bindings' option
• In the Site Bindings window click on 'Add'

This will open the Add Site Binding window.

Set these parameters:

• Type: HTTPS
• Port: 443
• SSL Certificate: select the certificate created in Setting up a Certificate

HTTP Module

To set up the HTTP module in the Internet Information Services (IIS) Manager:

1. In the 'Connections' panel, select the machine properties (top of the tree).
2. Double-click on the Modules icon in the middle panel.
   
   This returns the 'Modules' list and the 'Actions' view.
3. In the 'Actions' list, click on the 'Configure Native Modules…' option.
   
   This opens the 'Configure Native Modules' view.
4. Click on the Register button to open the 'Register Native Module' dialog.
   
   Type in the name and the path of the SSCSIISHttpLink.dll file.
5. Click on the OK button. The 'SSCloudServices' checkbox will now be selected.
   
6. Click on the OK button to close the 'Configure Native Modules' dialog.
7. In the 'Connections' panel (see Step 1), click on your web site.
8. Double-click on the 'Handler Mappings' in the middle pane.
   
   This opens the Handler Mappings view:
   
9. In the 'Actions' list, click on the 'Add Module Mapping' option to open the 'Add Module Mapping' dialog.
10. As illustrated, set the 'Request path' and 'Name'.
11. In the 'Module' field, click on the drop-down arrow and select the module added in step 4.
    
12. Click on the Request Restrictions button. On the 'Request Restrictions' dialog, select the 'Access' tab. Select the 'Execute' radio button to enable Execute permission.
    
13. Select the 'Mappings' tab and deselect the 'Invoke Handler only if request is mapped to' checkbox.
14. Click on the OK button.
15. Close the 'Add Module Mapping' dialog by clicking on the OK button again.

To complete this HTTP module set up, see the Configuration Settings section at the start of this topic. You should then be able to connect to a model using Enterprise Architect via your IIS server using the HTTP module (e.g. via Port 80 or 443).

ISAPI Module

To configure an ISAPI module instead of the HTTP module:

1. In the 'Connections' panel, select the machine properties:
   
2. Double-click on the 'Handler Mappings' icon:
   
3. In the 'Actions' list, click on the 'Add Module Mapping' option.
4. In the 'Add Module Mapping' dialog, set 'Request path' to 'sparxCloudLink.sseap', 'Module' to 'IsapiModule', and 'Executable' to 'SSCSIISIsapiLink.dll', as shown.
   
5. Click on the Request Restrictions button. On the 'Request Restrictions' dialog, select the 'Access' tab. Select the 'Execute' radio button to enable Execute permission.
   
6. Select the 'Mappings' tab and deselect the 'Invoke Handler only if request is mapped to' checkbox, then click on the OK button to close the 'Request Restrictions' dialog.
7. Click on the OK button to close the 'Add Module Mapping' dialog. You should now be able to connect to a model using Enterprise Architect via your IIS server using ISAPI.

Learn more

• Import User IDs From Active Directory