Webserver Configuration

You can configure the web server in the Internet Information Services (IIS) Manager. You can find the IIS-Manager by the following steps:

• Windows Server 2016: Open the Server Manager, then navigate to Tools ‣ Internet Information Services (IIS) Manager.

• Windows 10: Press Start and search for inetmgr.

Configure the Application Identity

The IIS application pool identity is the user account under which a web application pool’s work process is executed. By default, a special virtual account called ApplicationPoolIdentity is used for this purpose, which provides a secure and isolated environment with restricted permissions for each application pool. However, in an Active Directory environment, this default account may not have all the necessary group permissions to authenticate users when they log in to SpaceObServer Web Access. If an error message with PrincipalOperationException appears in the event log when an AD user logs in, the identity of the application pool can be configured to use a service account with the necessary permissions:

• tokenGroups

• sAMAccountName

• userPrincipalName

• objectSid

• displayName

• distinguishedName

• memberOf

• member (on groups)

Open the Advanced Settings of the IIS Application Pool (spaceobserver_apppool) to configure the correct user account under Identity.

Add an URL to access SpaceObServer Web Access

Here you can find the steps how to add an custom URL or IP-address to access SpaceObServer Web Access in your browser.

1. Start the IIS-Manager.

2. In the left pane of the IIS-Manager, navigate to the site SpaceObServer Web Access and open the context menu via right-click.

3. In the context menu, select Edit Bindings…. The Site Bindings window appears.

4. The web page is accessible via all the addresses listed in the Site Bindings window. Press the Add button to add a new URL or IP-address.

5. Close the IIS-Manager.

6. Now SpaceObServer Web Access is accessible via your new added address.

Connect the web server with the installation folder of SpaceObServer Web Access

1. Start the IIS-Manager.

2. In the left pane of the IIS-Manager, navigate to the site SpaceObServer Web Access and open the context menu via right-click.

3. In the context menu, select Manage Website ‣ Advanced Settings…. The Advanced Settings window appears.

4. In the Advanced Settings window, change the Physical Path to the installation path of SpaceObServer Web Access. The default path is INSTALLATIONPATH.

5. Close the window via the OK button.

6. In the right pane, in the section Manage Website, select Restart to restart the web site.

7. Now the site SpaceObServer Web Access is bound to the installed data.

HTTPS-Configuration (recommended)

Important

You should activate SSL encryption for SpaceObServer Web Access in the IIS Manager to ensure encrypted data exchange. For production use, configure a domain certificate. For testing, you can use a self-signed certificate.

Option 1: Domain-Certificate

1.1 Obtain Certificate from Certificate Authority

1. Purchase SSL certificate from a trusted CA (e.g., DigiCert, Let’s Encrypt, etc.)

2. Generate Certificate Signing Request (CSR) through IIS or certificate provider

3. Complete certificate validation process

4. Download certificate files (.crt and .key or .pfx)

1.2 Import Certificate to Windows Certificate Store

1. Open Microsoft Management Console (mmc.exe)

2. Add Certificates snap-in for Local Computer

3. Navigate to Personal ‣ Certificates

4. Right-click and select All Tasks ‣ Import

5. Import the certificate file (.pfx or .crt with private key)

Option 2: Self-Signed Certificate

2.1 Create Self-Signed Certificate

1. Open IIS Manager

2. Select server name in left panel

3. Double-click Server Certificates

4. Click Create Self-Signed Certificate in Actions panel

5. Enter friendly name (e.g., SpaceObServer Web Access)

6. Select Web Hosting certificate store

7. Click OK

Configure HTTPS Binding

1. Right-click on the Web Access site

2. Select Edit Bindings

3. Click Add button

4. Configure binding:

   • Type: https

   • IP Address: All Unassigned (or specific IP)

   • Port: 443

   • Host name: Your server’s FQDN (e.g., webaccess.company.com)

   • SSL Certificate: Select your certificate in dropdown menu

Configure SSL Settings

1. Select your Web Access site in IIS Manager

2. Double-click SSL Settings

3. Check Require SSL

4. Select client certificate requirements:

   • Ignore: No client certificates required

   • Accept: Optional client certificates

   • Require: Mandatory client certificates

5. Click Apply