DPE WebServices & WebApplications

Breaking changes in DPE 2.5.199.0 - READ CAREFULLY!

Overview

Secure DPE tokens

DPE 2.5 is using secure authentication tokens
DPE Service clients cannot construct secure DPE tokens on their own but have to request them from an API endpoint /api/token (see API description).
Tokens forwarded from DPE web app to other applications (or received from other apps) should be secure tokens.
Secure DPE tokens cannot be deconstructed into user and password

DPE Service Access More Restrictive

More service calls are only allowed with valid authentication

web.config

See https://learn.davidsystems.com/dpe2v5/dpe-server/learn-and-explore-dpe-server/configuring-web-config-files#Configuringweb.configFiles-AutomaticLogoutfunction

Forms authentication has to be removed from web.config. The DPE Setup does this automatically for newly installed web.config.

If your are copying a previous web.config to your new installation you have to do it manually, so comment out or remove the authentication section:

XML

<!--
<authentication mode="Forms">
  <forms name="MyFormsAuthCookie" timeout="1440" slidingExpiration="true" loginUrl="Logon.aspx" ticketCompatibilityMode="Framework40" />
</authentication>
-->

Content Manager Details Templates

See https://learn.davidsystems.com/dpe2v5/content-manager/learn-and-explore-cm/details-pane-configuration/introduction-to-details-pane-templates/configuration-options-for-single-selection-of-entry/audio-download-links

If you are using download links in your ContentManager details template you have to replace them in the following way:

Old

CODE

DownloadMedium.ashx?{{model.FullEntryId}}

New

CODE

DownloadMedium.ashx?{{model.FullEntryIdAuth}}

Workflow System

Workflows

AccessToken

The workflow argument AccessToken has to be used (= forwarded) in all DPE activities offering an AccessToken property.
We have adapted all standard workflows, make sure you use the newest version.

Calling DPE Services Directly

If your workflow calls DPE Services directly via .Net proxy classes you have to instantiate the ProxyContainer differently:

Old

CODE

New ProxyContainer(User, Password, Environment.MachineName, TimeSpan.FromSeconds(120))

New

CODE

MixedAuthHeader auth = If (AccessToken Is Nothing, new MixedAuthHeader(User, Password, Environment.MachineName), MixedAuthHeader.FromAnyToken(AccessToken))
New ProxyContainer(auth, TimeSpan.FromSeconds(120))

Workflow Compatibility

Please ensure to use only Workflow Templates released within with Release.

Please request project specific Workflow Template updates from DAVID Support Team, before updating your system.

Product compatibility list for DPE 2.5.199.0 and later

Minimum required versions of other DAVID products compatible with Secure DPE tokens:

Application	Version	Comment
DBM	5.8.8220.0	Older versions work as long as DpeTokenAcceptMode is not set to "Secure"
MTE	7.10.1783.0
CAE	0.7.12
WDA	-	Not implemented/supported yet in WDA. WDA will not understand secure token in URL, so forwarding logon will not work. Nevertheless you can logon in WDA as long as DpeTokenAcceptMode is not set to "Secure"
ROAD Backend	1.3.567.1	Older versions work as long as DpeTokenAcceptMode is not set to "Secure"
ROAD InstaRecorder	1.1.73
ROAD Admin	??
ROAD Scheduling	??

DPE Server Config Options

web.config

Description

DpeTokenCreateMode

Specifies which kind of token is returned from /api/token REST endpoint

Secure (default): returns signed, secure DPE token
Unsecure: returns unsecure DPE v1.0 token containing password
Disabled: return status code 500 on GET /api/token

It also allowed to set a comma-separated list for various clients, e.g.

Secure,dpe:Unsecure

Clients have to use the query parameter "client" when requesting the token to support this.

DpeTokenAcceptMode

Specifies the behavior when DPE tokens are validated

Secure: only secure DPE tokens are accepted
WarningOnNotSecure: accepts secure and unsecure DPE tokens but logs a warning for unsecure
Disabled: returns status code 500 on POST /api/token
Any: accepts any request (= turns off validation)
Any other value (default): accepts secure and unsecure DPE tokens

Currently the default is to still accept unsecure tokens. This will change in the future.

ParameterServiceSecurity

High (default): all Parameter Service calls require authentication
Low: some Parameter Service calls are allowed without authentication; needed to run older SAF Servers (e.g. 2.4) with DPE Server 2.5

Proposed Migration Order

Step	Component	Comments
1	Update to DPE Server 2.5	In web.config temporarily set ParameterServiceSecurity = Low (needed for older SAF Servers) Make sure forms authentication mode is commented out or removed
2	Update DPE Processors	But NOT WorkflowServer
3	Backup all installed workflows	By checking them in Workflow Templates page and exporting them
4	Stop WorkflowServer	Ensure that Workflow queue is empty before doing this
5	Update all workflows	To newest version, also see workflow version list above
6	Start WorkflowServer
7	DPE web.config	Remove ParameterServiceSecurity = Low from web.config