Encrypting / securing the communication between client and server

rbuser

Hi All,

I'm writing a multitier GUI application where the client uses the
TrsClientReport component to invoke a report from the Report-Server
application using TrsServer.

My question is how can I secure/encrypt the data between the client and
server if I don't want to use a VPN?

Any ideas/help will be appreciated.

Thanks

fleming

nardmoseley

The ClientReport/ClientReportExplorer are designed to support the following
two configurations. However only configuration A is working with the current
release. I might be able to patch the code to get configuration B working.
Post a response here if you are interested and I will research this further.


A. TCP direct connection to server
-------------------------------------

This is the standard type of connection in which the ClientReport
communicates directly to the ReportServer over a tcp socket.

ReportServer <------> ClientReport
(tcp)



B. HTTP connection to WebTier
-----------------------------------

In this configuration the ClientReport communicates over http (or https) to
a web server application. The WebTier application acts a proxy, passing
requests thru to the report server. Using https would enable secure
communications over the internet to the WebTier.

ReportServer <-------> WebTier <--------> ClientReport
(tcp) (http)

--
Nard Moseley
Digital Metaphors
http://www.digital-metaphors.com

rbuser

Hi Nard,

Thanks for your reply.

I'm not clear on configuration B and how it may help. Does configuration
B require the client to be a browser-based?

My client is a Delphi GUI app. that uses TSocketConnection and
clientdatasets to retrieve data from an application server app. The
client app. also calls upon a reportServer app. (ala RB) so it can
render reports. So my config is like so:

ReportServer <-------(TCP)---------> Client

Currently we're using a VPN over the internet. We'd like to not have to
use the VPN, so I wrote an encrypting interceptor for the the
TSocketConnection component. But since RB client/server components have
their own protocol of communication over TCP I cannot use the
interceptor - it is only good for native Delphi client-server communication.

Perhaps in a future version you can have the client and server
components can implement a similar feature to the "interceptor" property
of TSocket Component.

Thanks

fleming

nardmoseley

I know that you have a Delphi GUI app that is the client. Perhaps for
additional clarity I should have specified TrsClientReport rather than
ClientReport.

To make the communication between the TrsClientReport and TrsWebTier secure
you would use https. This requires that you have a web server running with a
digital certificate installed. The ReportServer app could run on a separate
machine behind a firewall or on the same machine as the WebTier app - your
choice.

ReportServer <-------> WebTier <--------> TrsClientReport
(tcp) (https)

On the Sever side, the above configuration requires that you have a web
server, such as IIS running. You would use the TrsWebTier component to build
an ISAPI application - like those shown in the demos and tutorials. You
would install a digital certificate to IIS and configure IIS so that the
WebTier app requires HTTPS to communicate.

On the Client side of things you would specify the ClientReport.Connection
as something like:

TrsClientReport.ServerConnection.Address :=
https://myComponany.com/rbWebPub/Report.dll
TrsClientReport.ServerConnection.Port := 443

Hope that helps.....


--
Nard Moseley
Digital Metaphors
http://www.digital-metaphors.com

rbuser

Aaahhh.... this might work for me. This configuration works, does it?

Thanks I'll look into this. :-)


fleming

nardmoseley

No it does not currently work - see my original post. I offered to research
it if you are interested. Seems like you are interested so I will research
it and see whether it is feasible to patch the current code base.


--
Nard Moseley
Digital Metaphors Corporation
http://www.digital-metaphors.com

rbuser

Hi Nard,

Please do research it. I did try it anyway, and I got an "Internal
Server Error(500)". Is that what is expected in the current version?

This would be a better solution for me instead of re-architecting my
applications.

It may even be perfect - once it works - because there is a related
webapplication that we have which may be able to share some the same
reports that the GUI client renders.

Please keep me posted.

Thanks

fleming

rbuser

Hi Nard,

Just wondering what the status was on this? Will there be something for
me to test anytime soon?

Let me know, thanks.

fleming

nardmoseley

I will research this and post more info. Might be earlier to mid next week
before I post a response here...



--
Nard Moseley
Digital Metaphors Corporation
http://www.digital-metaphors.com

nardmoseley

I have created a patch for the WebTier that enables the ClientReport to use
HTTP to communicate with the report server. It needs to be tested.

Anyone interested in testing this patch can send a request to
support@digital-metpahors.com




--
Nard Moseley
Digital Metaphors
http://www.digital-metaphors.com

rbuser

Hi Nard,

Cool. I sent my request.

fleming