innovaphone wiki - User contributions [en]

Howto:Innovaphone built-in music on hold

2012-08-10T12:34:32Z

Kloyenz: /* Related Articles */

'''FAQ:'''
Can I download the innovaphone built-in music on hold as a wave file?

'''Answer:'''

yes, you can. You have here also different versions of the innovaphone moh.

It is the moh.zip file

== Related Articles ==

http://download.innovaphone.com/ice/download/p/published/TOOLS/



[[Category:Faq|{{PAGENAME}}]]



'''Link not working anymore'''

Reference8:Delegated Authentication

2010-03-10T10:09:55Z

Kloyenz: /* Configuration */

== Applies to ==
All devices with firmware version 8 and later.

== Overview ==
Each device has its own administrator/viewer accounts.

In version 8 and later a single device can act as an authentication server for the rest of the devices. User accounts that are managed on the authentication server can be used to login on each device in the installation. You can also configure devices to accept user accounts from a PBX or a Windows domain.

== How it works ==
Version 8 devices can use Kerberos to authenticate users that are not managed locally but on a remote Kerberos server.

=== Kerberos ===
A Kerberos server manages users and services for a realm that is specified by a distinct name. It shares a secret password with each user and each service.
Users can obtain a ticket for a service from the Kerberos server if they proove that they know their own password.
Services can then authenticate users by validating tickets instead of passwords. Therefore many devices can be accessed using the same user credentials but only the Kerberos server and the user have to know it.

=== Logging in ===
The main idea of how the centralized login process works in version 8 is the following:

[[Image:Login_kerberos_basic.png]]

# The browser sends user name and password to the box, using '''HTTPS basic authentication'''.
# The box then uses '''Kerberos''' to obtain a ticket on behalf of the user from the Kerberos server for its own web server.
If that was successful the password is valid and the user is authenticated.

=== Cross realm authentication ===
Cross-realm authentication means that users from one realm/domain can login to services from another realm/domain. To do so, the realms have to trust each other and have a shared secret password to decrypt tickets from the other realm. This password has to be configured on both Kerberos servers. The picture shows how cross-realm authentication is used to login with a Windows domain user at an innovaphone box.

[[Image:Login kerberos basic crossrealm.png]]

# The browser sends user name and password of a Windows domain user to the box, using HTTPS basic authentication.
# The box authenticates with the user credentials against the Windows Kerberos server and gets back a ticket-granting ticket.
# The box uses the ticket-granting ticket to get a ticket for the innovaphone Kerberos server.
# The box uses the cross-realm ticket to obtain a ticket on behalf of the user from the innovaphone Kerberos server for its own web server.
If that was successful the password is valid and the user is authenticated.

=== HTTPS for encryption ===
The box needs username and password in the clear to delegate authentication. Basic authentication is used to send that information from the web browser to the box. This message exchange has to be encrypted using HTTPS.

In order to protect user passwords from eavesdropping and to stay compatible with existing configurations at the same time, our devices implement the following behaviour if Kerberos is enabled.

'''HTTP'''
* No change to the normal behaviour
* Digest or Basic authentication is offered
* Local users from the box, only
'''HTTPS'''
* Basic authentication, only
* Local users and remote Kerberos users.

As a consequence you have to use HTTPS if you want to login with a Kerberos user account.

=== Authorization ===
Tickets issued by an innovaphone Kerberos server contain some information whether the user is an administrator or a viewer. When it comes to cross-realm authentication with a Windows domain the innovaphone Kerberos server can map between Windows group memberships and administrator rights.

=== Kerberos servers on the innovaphone platform ===
V8 gateways are capable of hosting multiple Kerberos servers at a time.

==== Stand-alone Kerberos server ====
Each gateway can host a single Kerberos server that can be configured freely.

==== The PBX as a Kerberos server ====
Each PBX also provides for Kerberos authentication for its users without additional configuration:
* The ''System Name'' of the PBX is the name of the realm.
* Users with both a password and rights defined can be used for delegated authentication.
* The ''Name'' of the user object in the PBX can be used as the user name for authentication.
* Users with the right ''Full PBX Administration'' are administrators in the Kerberos realm. Users with other rights are viewers.
* LDAP replication also works with the Kerberos information.
* There is a special user called ''_KADMIN_'' that can be used to add devices to the realm but not to login to the user interface.

== Configuration ==
'''Important Note:''' Every device that will use kerberos should have a valid NTP server wich is in sync with the other devices
=== Setting up the Kerberos server ===
The Kerberos server of a PBX is configured using the PBX/Security page (see [[Reference8:Administration/PBX/Security]]).

Configuration of the stand-alone Kerberos server is done using the General/Kerberos page (see [[Reference8:Configuration/General/Kerberos]]).
# Enter a LDAP password. This password is used to encrypt keys in the LDAP directory of the server.
# Configure the name of the realm.
Now the server is running. You can now create and manage user accounts.

=== Setting up the client devices ===
Configuration of the clients is done using the General/Admin page from the web administration interface (see [[Reference8:Configuration/General/Admin]]).

# Configure the ''Server Locations'' of the Kerberos servers of all involved realms. Don't forget servers that are needed for cross-realm authentication.
# ''Join'' the desired Kerberos realm. You will need administrator credentials from that realm in order to do that.
Now the device can authenticate users from the realm for HTTPS connections. You can deactivate the local user accounts on the device, if needed.

Note: The box that hosts the Kerberos server might also be a client device and have to join the realm.

=== Setting up cross-realm authentication ===
# On the server device, specify the ''Trusted Realms'', the corresponding passwords and the methods of authorization mapping.
# Configure the ''Server Location'' on each client device.

There are different methods of mapping authorization between realm:
* keep (works only with innovaphone servers)
* Grant administrator access to all users
* Grant viewer access to all users
* Map the Windows domain group membership from the ticket to administrator or viewer rights

If you use the latter, please specify the RID of the groups that shall have administrator or viewer rights, respectively.

==== Determining the RID of a Windows domain group ====
The RID (relative ID) of a Windows domain group is the last numeric part of the domain group SID (secure ID).

The easiest way to determine it for a group you are a member of is using the following command:

whoami /groups /sid

[Group 1] = "DOMAIN\Domain-Users" S-1-5-21-854245398-616249376-725345543-'''513'''
[Group 2] = "DOMAIN\Admins" S-1-5-21-854245398-616249376-725345543-'''1180'''

In this example the RID for ''DOMAIN\Domain-Users'' is ''513'' and the RID for ''DOMAIN\Admins'' is ''1180''.

==== Prerequisites for Windows groups ====
You can use a Windows group for authorization if
* it is in the domain of the users
* it is a global security group
* it does not contain nested groups

== Using it ==
Once configured you can use Kerberos user accounts for logging in to the administation interface of boxes using your web browser.
=== Use HTTPS for Kerberos users ===
Delegated authentication works only with HTTPS connections. Using HTTP the boxes accept only local user accounts.

=== User names ===
To distinguish between local users and users of a Kerberos realm, the name of the realm has to be prepended to the user name, separated by a backslash (''\''). Alternatively you can prepend the realm to the user name separated by an at (''@'').

Example:
* Local user: ''admin''
* Remote user: ''REALM\username'' or ''username@REALM''

Mind that realm names are case sensitive and that they are usually written in upper case letters.

== Security considerations ==
=== Use local users only for recovery purposes ===
Although the old local user accounts of devices can still be used to login, this should not be done.

We recommend to choose a different secure administrator password for each device. After Single Sign-On has been configured, the list of admin passwords should be locked away and used only for recovery purposes. For normal configuration only user accounts from the Kerberos realm should be used to access devices.

We recommend that because it is much easier to change the password of or delete a compromised user account on the Kerberos server than changing the local administrator passwords on each device.

[[Category:Concept|{{PAGENAME}}]]

Howto:ClickToDial

2009-08-27T13:55:25Z

Kloyenz: /* Login and Security */

==Applies To==
This information applies to

* IP110
* IP200
* IP230
* IP240
* IP150
Build 60900 and later.



==More Information==
innovaphone ClickToDial is an application witch allows calling a number market on the screen of the PC using a IP-Phone
ClickToDial is able to read numbers out from almost any web-browser (Explorer, Firefox, Google Chrome tested), Word, Notepad, Outlook (Exchange), PowerPoint, Acrobat and many other applications.

Please note that innovaphone ClickToDial is freeware, innovaphone will not respond on claims or eventual damages and will not guaranties any support. Using this application is on your own risk.
The innovaphone ClickToDial is a first party application interfacing the phone and not the PBX. Therefore an innovaphone IP-Phone is required (IP110/200/230/240/150).

Here you can download the application [[Media:ClickToDial.zip]]

Because this application is addressed to the end-user you can find also a small User manual here, in German language [[Media:UserManual_ClickToDial_de.pdf]] and in Italian language [[Media:UserManual_ClickToDial_it.pdf]]

===Problem Details===
ClickToDial searches in the clipboard of your PC for a number, correct it and send the number to your innovaphone IP-Phone. To launch the call just mark the number on the screen and click CTRL+C+C. The first CTRL+C will copy the marked text to the clipboard and the second “C” starts the application and data transmission.
Copy text to the clipboard using CTRL+C is a system feature of windows and works from nearly all applications. Please note anyway that ClickToDial will not work with Excel.
It is not necessary to mark exactly the beginning or the number, the software will analyse the marked Text up to 200 characters starting from the first marked letter:

[[Image:CtD_Nummer.PNG]]

In this example ClickToDial will found and correct the number. Particular characters in numbers like space, slash and similar are skipped.
The software also respects the international syntax for phone numbers, for example
+49(7031)73009-0 will be translated in 00497031730090.
If you are located in Germany the country code will be cancel and the detected number will be 07031730090, and if you are located in Sindelfingen (area code = 07031) it will be 730090.
ClickToDial will add also a trunk access number. So the real dialled number will be following the example 0730090.
If ClickToDial will not detect any number no action will happen, and so the IP-Phone will not go into the hands free mode (and dial out just the trunk access code).
All dialled numbers are threaded from the Phone like manually dialled numbers and so you will for example find the dialled number in your Phone memory.
Of course you must set parameters in the setup as explained in the installation section.
===Using ClickToDial===
To start ClickToDial just double click the application, no installation is necessary. If you want that the software starts automatically with the PC just copy ClickToDial in the autostart directory of your PC. So each time the PC is booting also ClickToDial is on and available. Please note that this application is very small and will require just some kByte of Memory.

Once launched the application this is shown in the task bar and you will see an icon indicating that the software is running (small fish in the “click” icon).
If you point with the mouse in the icon you will see the name of the application:

[[Image:CtD_Icon.PNG]]

Now just select (mark) the text on your PC-screen with then telephone number in and press CTRL+C and again C (hold the CTRL Key down until you press twice the “C” button). Your IP-Phone will go in the hands free mode and dial out. For a few seconds also in the upper left corner or in the taskbar appears the number dialled out. The rest of the operations like release or redial is done using the phone Keypad (witch is much better than any software solution).

Note: The CTRL key in some countries (for example in Germany) is named different:

[[Image:CtD_Tastatur.PNG]]

This is the CTRL-Key.

If you point to the ClickToDial icon and click the right mouse button a small menu appear:

[[Image:CtD_Menu.PNG]]

“Exit” will terminate (stop) the application

“Info” will show you the release number

“Setup” allows setting the parameters.

„Drop Call“ drops the call done by ClickToDial. This function is useful for example if a call has been started erroneously with ClickToDial, but now you are not near the IP-Phone to cancel the call using the Phone keypad.

===Installation/Configuration===
For the setup just select the menu item “Setup” as described before.
It will appear a screen similar this one:

[[Image:CtD_Setup.PNG]]

Please note that on the input fields you will see tooltips if the mouse is pointed on, this small online help will give you some more information about the meaning of the fields.

Enter the address of your IP-Phone.
The prefix for the external line is the number you have to dial to get an external trunk line (typically 0).
The prefix for international calls is more or less equal all over the world, just type “00” in like in the example.
Please note to insert your country code without the 00 prefix, so 49 for Germany and not 0049 (in the example you see 39 for Italy).
If in you country is working a uniformed national dialling plan Area and Town code are not necessary. In Italy for example there is such a uniformed dialling plan and thereforey those fields have to be empty like in the example.

But in Germany for example those field has to be filled up, here the example for Sindelfingen:

[[Image:CtD_Setup02.PNG]]

In this way the software understand that 0049(7099)xxx has to be converted in 07099xxx and a number like 07031xxx has to be converted in just xxxx.

Once done this simple setup press the save and exit button and terminate the setup. The changed configuration is available on runtime and so the new parameters are immediately effective. This allows you to change on the fly the IP address of you Phone if you change for example you location.

This setup information’s are stored in the registry user area of your PC. That means that for different users on the same PC individual profiles possible.

===Login and Security===
The first time ClickToDial send information to you phone user and password is required. A input mask will appear automatically. After this first authentication no more user/passwords are required until ClickToDial and the Phone is running (the session is on).

===Note===
When you dont want to login each time the phone is started you can change the ip in the setup to: username:password@ip of the phone like you can see in the example below:

[[Image:Clicktodialnologin.PNG]]

===System Requirements===
ClickToDial is designed for

* IP110
* IP200
* IP230
* IP240
* IP150
Build 60900 and later.

No 3rt party IP-Phones, DECT, Softphone or analogue terminal adapter are supported.

The software require Microsoft OS XP (tested) or higher.

===Known Problems===
In Excel it is not possible to dial-out.

Please note that numbers embedded in graphic information’s like Fax scans, pictures or similar will fail (no OCR).

The user has to know the IP-Address and a valid user/password to access the phone. The password level has to be Administrator (no Viewer).



[[Category:Howto|{{PAGENAME}}]]

File:Clicktodialnologin.PNG

2009-08-27T13:54:30Z

Kloyenz: Settings for no login @ click to dial

Settings for no login @ click to dial