General Settings |
  
|
General Settings |
|
The General Settings allow you to manage several basic server configuration settings.
These configuration settings are stored in the Virtual File System (VFS). The settings affect all server instances that share the VFS.
File System Settings
Lock File System prevents anyone from making changes to the contents of the Virtual File System. Once your Web services are 'in production', you may wish to prevent developers from changing any Service Definition Files, for example. Note that the server itself will still be able to write to the "\system\logs" subfolders.
Allow Administrator Group Access allows users that are members of the "Administrators" group to make changes to the file system (add, update, delete and rename files) even when the file system is locked. This may be useful to allow Administrators to delete unwanted log files, for example. This option is only relevant when the "Lock File System" option is checked.
Note that user "Administrator" always has access to the file system, even when it is locked.
Authentication Settings
SOAP/AM Server supports two types of HTTP authentication: Basic and Digest. Authentication is used to verify the identity of a client application user when access to a protected resource is requested.
This option allows you to disable Basic or Digest Authentication (but not both). If Basic Authentication is disabled, client applications are forced to use the more secure Digest Authentication. If the client application does not support Digest Authentication, it won't be able to access restricted resources through the Server.
Digest Authentication, disabled by default, allows clients to authenticate using Basic Authentication only. This primary purpose of this feature is to support some buggy client applications that only support Basic Authentication and are confused by the presence of a Digest Authentication header. A Digest Authentication header is returned by SOAP/AM when Digest Authentication is enabled and the client application attempts to access a protected resource.
Basic Authentication is simpler and supported by virtually all client software, but is not very secure -- the user name and password are merely base-64 encoded. An eavesdropper on the client session can easily learn the user name and password, which it can reuse to gain access to the server (although this problem is moot if a secure HTTPS connection is used since it encrypts all communications).
Digest Authentication is very secure, but because of its complexity is not supported by all client software (check with the manufacturer). Digest Authentication uses a highly secure technique for transferring the user's credentials so that an eavesdropper cannot reuse them to gain access to the server.
HTTP Log Settings
This option enables or disables the HTTP Logging feature. By default, this feature is turned off. Refer to HTTP Log Files for more information on HTTP logging.