innovaphone wiki - User contributions [en]

Reference11r1:Concept myPBX Video

2017-04-08T00:26:44Z

Mario.moser:

[[Category:Concept|myPBX Video]]
From version 10 the myPBX launcher can add a video codec to innovaphone hardware and software phones.

== How it works ==
* myPBX video adds an H.264 video codec to innovaphone hardware and software phones.
* The video codec is part of the myPBX launcher and uses the webcam, windows for H.264 encoding and graphic card of the computer for H.264 decoding. If the graphic does not support H.264, which would be uncommon, windows will be used for the decoding process. Windows is not used by default because its decoder introduces a long delay (1-2 sec.), unacceptable for a video call. This delay is not present in Windows 8.

* Default resolution is 352x288
** myPBX checks the resolution supported by the webcam. If available, 352x288 is used. Otherwise, 320x240
** likewise is done for the frame rate: if available, 30 fps is used, if not 15 fps
* The windows h264 encoder is configured to deliver an average data rate of 250 kbps.
* The video codec communicates with the phone using SOAP over Websocket. Once it is connected the phone negotiates video calls.
* The endpoint for video streams is the video codec on the computer. The endpoint for audio streams is still the audio codec on the phone.

[[Image:MyPBX video.png]]

== Requirements ==
=== PBX ===
* Recent firmware (v11 or higher)
* myPBX license (enabled at the user object)
* Video license (enabled at the user object)

Note: The video license information must be available in the PBX at the time of the registration of the phone.

=== Phone ===
* innovaphone hardware phone with recent firmware (v11 or higher) (not for DECT phones like IP61, IP62, IP63)
* innovaphone software phone (v11 or higher)

=== Computer ===
* myPBX launcher (v11 or higher)
* Windows 7
* .NET 4
* Graphics card with H.264 hardware support (otherwise video will be shown with delay)
* Webcam.

The video codec uses UDP ports starting from 50000.

== Configuration ==
In the following, it is assumed that the user already has a phone configured and myPBX running.
=== PBX ===
* Enable the video license on the user object.
=== Launcher ===
* Enable video telephony
* Configure a default call type (e.g. Audio-video)
* If needed, configure a proxy server for connecting to the phone. Otherwise leave the field empty.

[[Image:MyPBX video config.png]]

== Usage ==

=== Activation ===
If the launcher is connected to the selected phone, a camera button shows up in the web application next to the selected phone.

[[Image:MyPBX video activation.png]]

Clicking the button activates or deactivates video. When the call is terminated, the button is reset to the default setting, given by the default call type configured in the launcher.

From version 11 media escalation and one-way video is supported. That means that the user can add and remove video during a phone call. Adding video only activates sending the own video image. Deactivating video deactivates both directions.

=== Video telephony ===
When there is a video call, the launcher activates the webcam of the PC and opens a window showing your own image and the image of the remote party. If you hang up the window is closed and the webcam is deactivated.

[[Image:myPBX_video_window.png]]

=== Three-party video conference ===
myPBX supports three-party video conferences without an external MCU. The mixing of video streams is done at the computer starting the conference. Since the video rate is not very high and the maximum resolution used by myPBX is 352x288 any computer should handle this operation properly.

[[Image:myPBX_video_window_3pty.png]]

== Troubleshooting ==
=== Check list ===
If video doesn't work please check the following for both the caller and the callee.
* The user has an activated video or UC license.
* Only one myPBX instance is running for the user.
* Only one phone is registered to the selected device of the user.
* Video and application sharing is activated in the configuration of the myPBX launcher.
* The right phone is selected in myPBX.

Also check the myPBX trace for error messages.

=== Error messages in the myPBX trace ===
Here are some hints what might be the reason for error messages that occur in the myPBX trace.

RemoteMediaConnection(video): Connection failed (websocket error CouldNotDetermineLocalAddress)
RemoteVideoCodec: RemoteMediaChannel failed (invalid local address)

Is the websocket connection blocked by an anti-virus software or a personal firewall? Try deactivating it for a test. Configure exceptions/permissions for myPBX, if needed.

RemoteMediaConnection(video): Connection failed (websocket error AuthenticationFailed)

Is another instance of myPBX launcher connected to that phone? Only one instance is allowed at a time.
Please also check, that the Userobject has a local password set.

RemoteMediaConnection(video): ConnectFailed (No registration at device XYZ)

No phone is registered to the selected device. Register a phone or select a different device in myPBX.

RemoteMediaConnection(video): ConnectFailed (Not supported or unlicensed on device XYZ)

The selected phone does not support remote video. Old firmware? Third-party product? No video license? Video license not activated at the user object?

== Known issues ==

=== Media relay disables Video===
myPBX Video-Calls does not work if at PBX "Media Relay" is set to ON or it is set to AUTO and media-relay is selected.

=== Antivirus ===
Some antivirus are blocking websocket connection and therefore it is necessary to add an exception for myPBX application. If you are having this problem myPBX gets the loopback address as local address. You should see '''local address 127.0.0.1''' in myPBX trace log. 
* Avast! you should add myPBX under "Web Shield/Expert Settings/Exclusions/Processes to exclude"
* Kapsersky-Antivirus. You should add myPBX under "Einstellungen/Vertrauenswürdige Zone/Vertrauenswürdige Anwendungen/ hinzufügen"

=== Integrated Webcam in Dell Vostro Laptops ===
MyPbx/Pc crashes when using the integrated webcam. External ones are ok. 
* The problem at our side was caused by the software '''Dell Webcam Central''', apparently installed by default in this laptop model. Please uninstall this software if you encounter any problem with the integrated webcam. 

=== Webcam support under Media Foundation from Microsoft ===
According to Microsoft ( http://msdn.microsoft.com/en-us/library/windows/desktop/bb970511(v=vs.85).aspx ) only webcams that support UVC1.1 (USB Video Class) will work under Media Foundation.

So far we only found problems with a Wireless Webcam from Logilink/Technaxx.

http://www.logilink.eu/showproduct/UA0098.htm

=== Interoperability ===
Third party video phones must be registered using SIP. Video is not supported for non-innovaphone devices that are registered using H.323.

=== Microsoft Update for the Windows 7 h264 decoder ===
The video card is used for h264 decoding because the Windows h264 decoder in Windows 7 introduces a delay of about 1 sec. 
Microsoft released in February a platform update for Windows 7 which includes a fix for this issue. 
http://support.microsoft.com/kb/2670838/en-us 
In this document it is mentioned that the update "improves the features and performance of the following components" and one of them is the "H.264 Video Decoder". 
The only problem is that there maybe some incompatibilities with some systems. So please, read the document carefully before installing it. 
This update would only be necessary for those whose video card does not support h264 decoding and therefore experience the delay in the incoming video stream. 

=== CISCO Adaptive Security Appliance ===
Enabled IP-Compression (ip-comp) can cause problems related to video transmission. If you don't have remote users which connected with modem, this feature can be normaly disabled.

Reference12r1:PBX/Config/myPBX

2016-09-11T15:35:15Z

Mario.moser: /* Call List Service */

myPBX is the web application of the innovaphone PBX for end users.

= Configuration =
== Common Settings ==
* '''Enable''' Turns the application on or off. It is disabled by default.
* '''Launcher URL''' The URL that should be configured in the myPBX launcher.
* '''Start in web browser''' Click this link to start myPBX in the web browser right away.

== Authentication ==
myPBX can use the Netlogon service of the Box for authenticating users against a Windows domain. For that the Netlogon service has to be connected to a domain controller.
* '''PBX only''' Login is allowed with PBX user password only.
* '''Netlogon only''' Login is allowed with Windows password only.
* '''PBX and Netlogon''' Login is allowed with both PBX user password and Windows password.

== Call List Service ==
myPBX can use the innovaphone reporting as a database for call lists.

* '''Type''' The type of the reporting service
** <code>off</code>: do not use reporting for call lists
** <code>LOCAL-AP</code>: running on the same box
** <code>REMOTE-AP</code>: running on a different box. The myPBX client decides which protocol to use (HTTP or HTTPS), depending on the URL (http or https)used to connect to the PBX.
** <code>LOCAL-CF</code>: use the local CF card for call-lists. This is possible on devices without the Linux AP running. The call list service must be configured for this under [[Reference11:Services/Call-Lists]].

For LOCAL-AP or REMOTE-AP
* '''Host''' The IP address of the reporting service
* '''User''' The ''User'' name of the ''Linux web server credentials'' of the Linux application platform providing the reporting service
* '''Password''' The password of the ''Linux web server credentials''

For LOCAL-CF
* '''Host''' The IP address or Hostname of the device which hosts the myPBX service (don't use loopback IP Address)
* '''User''' The admin user of the device which hosts the myPBX service
* '''Password''' The admin password of the device which hosts the myPBX service

'''Note:''' Additional Administrator Accounts can't be used as "User" for the LOCAL-CF feature. It must be the main administration login of the device.

== Preferences ==
* '''Logo URI''' The URI to a customized logo image that will be displayed in the myPBX web application. The image size should be 220x150px or less. Leave empty to keep the standard logo. The file format should be PNG or JPEG or an other format that is supported by web browsers.

= Access =
== URLs ==
There is a start page that opens the application in a dedicated browser window and that allows for choosing the language from a list.
http://IP-ADDRESS/PBX0/MY/start.htm

The application can also be accessed directly. This is the URL to be configured at the myPBX launcher or a smart phone.
http://IP-ADDRESS/PBX0/MY/client.htm
In this case the language can be selected by adding <code>?lang=XX</code> to the URL with <code>XX</code> being the ISO 639-1 language code. For an example <code>fr</code> means French.

== Login ==
People can login using the credentials from their PBX user object:

* user name (H.323-ID)
* password

Only users with a password can login.

= Related Articles =
* [[{{NAMESPACE}}:Services/Call-Lists]]
* [[{{NAMESPACE}}:Services/Netlogon/Config]]
* [[{{NAMESPACE}}:Concept myPBX]]

Reference12r1:Concept Netlogon Windows Authentication

2016-01-31T01:18:16Z

Mario.moser: /* Added Link to MS KB for Script to set Password*/

[[Category:Concept|Netlogon and myPBX Windows Authentication]]
In version 12r1 users can use their windows password for logging-in to myPBX. myPBX uses NTLM over the netlogon protocol for verifying windows passwords against the Active Directory.

== Applies to ==
* innovaphone devices with a PBX from version 12r1.

== How it works ==
=== Connection to the domain controller ===
The netlogon service of the PBX needs to connect to the DC. It authenticates using a computer account in the domain.
# DNS is used to retrieve the IP address of the DC (SRV record for ''_ldap._tcp.example.com'').
# The endpoint mapper on the DC is asked for the actual port of the netlogon server on the DC.
# A connetion is established to the netlogon server. For authentication the configured computer name and computer password is used.

=== Login with windows password in myPBX ===
The login process using windows credentials works in three steps.

[[Image:Netlogon_overview.png]]

;NTLM authentication:
First an NTLM handshake is done, involving the netlogon service on the PBX and the windows domain controller. NTLM is a challenge response mechanism. The web application calculates a hash value of the entered windows password and a challenge given by the PBX. The PBX asks the Windows server, that also knows the password, to verify the hash. In the end the PBX knows if the entered password was correct. Also the PBX and the web application have a shared secret, called the NTLM session key, that can be used for encryption.

;Temporary credentials:
The PBX creates temporary credentials for the myPBX login and stores them at the user object. After that it encrypts the credentials using the NTLM session key and sends them to the web application.

;Login:
For the actual login, myPBX uses the temporary credentials. When the user logs out the credentials are deleted both in the PBX and the Browser.

=== Characteristics ===
* The windows password is just used to calculate hashes. It is never stored or transmitted over the network.
* The temporary credentials are stored in the PBX at the user object and the DOM storage of the browser. So the user doesn't have to enter the windows password again, if the PBX or the browser is restarted.
* On logout the temporary credentials are deleted in the DOM Storage of the browser and in the PBX. So the next time the user is asked again for the windows password.

[[Image:Netlogon pbx sessions.png]]

== Requirements ==
;Windows domain:
* A computer account for the innovaphone device with a known password.
* User authentication using NTLM must be enabled.

;PBX:
* Firmware from version 12r1.
* Working DNS configuration.
* The usernames (Name) of the user objects in the PBX must match the Windows usernames (samAccountName).
* Netlogon authentication must be enabled on the myPBX configuration page.

;Network:
* TCP connections from the PBX to the domain controller must be possible.

== Configuration ==
* Create a computer account in the windows domain and set a password using an appropriate tool.
(Example at[https://support.microsoft.com/en-us/kb/216393] Sample 2
* Configure the netlogon service on the innovaphone device on page Services/Netlogon/Config.
* Activate netlogon authentication on page PBX/Config/myPBX.

== Usage ==
Depending on the configuration on page PBX/Config/myPBX users can use their PBX user password, their Windows password or both for myPBX login.

== Restrictions ==
* Only a single windows domain is supported.
* Since NTLM hashes are not very secure, HTTPS should be used for the communication between myPBX and the PBX.
* The windows session is not reused for authentication in myPBX. The user has to enter the windows password in myPBX.

== Tracing and logging ==
The log gives basic information about up and downtime of the service and the NTLM handshakes that are done.
<pre>
LOG NETLOGON 0 Service up
LOG NETLOGON 0 Authentication for 'exampleuser' failed (error c0000064)
LOG NETLOGON 0 Service down
</pre>

The trace contains more detailed information for tracking down problems and all the exchanged protocol messages. The protocol messages have been removed in the following example for better readability.
<pre>
NETLOGON: state ABORT
NETLOGON: state RECONNECT
NETLOGON: starting Domain(example.com) Computer(PBX-NETLOGON) ComputerPassword(XXX)
NETLOGON: state DNS
NETLOGON.0 -> dns.0 : DNS_GETHOSTBYNAME example.com ctx=0x0 flags=0x1 port=0
dns.0 -> NETLOGON.0 : DNS_GETHOSTBYNAME_RESULT ctx=0x0 result=0 addr=10.0.05 port=389
NETLOGON: state EPM_CONNECT
NETLOGON: connect to endpoint mapper at 10.0.05:135 (dc-w2k8.example.com)
NETLOGON: state EPM_BIND_HEAD
NETLOGON: state EPM_BIND_BODY
NETLOGON: state EPM_MAP_HEAD
NETLOGON: state EPM_MAP_BODY ........
NETLOGON: state EPM_DISCONNECT
NETLOGON: state NETLOGON_CONNECT
NETLOGON: connect to netlogon_service at 10.0.05:49159 (dc-w2k8.example.com)
NETLOGON: state NETLOGON_BIND_HEAD
NETLOGON: state NETLOGON_CHALLENGE_HEAD
NETLOGON: state NETLOGON_CHALLENGE_BODY ....
NETLOGON: state NETLOGON_AUTHENTICATE_HEAD
NETLOGON: encryption parameters ClientChallenge(e5cb2fd5f5218531) ServerChallenge(7338e9e65867e383) SessionKey(0978a50b44003835ac420ae6e69dfa89)
NETLOGON: state NETLOGON_AUTHENTICATE_BODY
NETLOGON: state NETLOGON_ALTER_HEAD
NETLOGON: state NETLOGON_ALTER_BODY
NETLOGON: state NETLOGON_DUMMYROUTINE_HEAD
NETLOGON: state NETLOGON_DUMMYROUTINE_BODY
NETLOGON: state CONNECTED
NETLOGON.0 -> NETLOGON.0 : NETLOGON_NTLM(0, exampleuser)
challenge: 86fee2c0fa1e6ee6
nt_response: 58881d894b81835edd0bfe758e468a0a0cd553e8c9f7a702
lm_response: 09e25853e618688157c0faadb0861818f367056548ea9496
NETLOGON: start authentication Username(exampleuser) Challenge(86fee2c0fa1e6ee6) NtResponse(58881d894b81835edd0bfe758e468a0a0cd553e8c9f7a702) LmResponse(09e25853e618688157c0faadb0861818f367056548ea9496)
NETLOGON: state AUTHENTICATE_HEAD
NETLOGON: state AUTHENTICATE_BODY d...
NETLOGON: authentication failed (error c0000064)
NETLOGON: state CONNECTED
NETLOGON.0 -> NETLOGON_SOCKET.44 : SOCKET_RECV(16)
NETLOGON.0 -> NETLOGON.0 : NETLOGON_NTLM_RESULT(0, FAILED, c0000064, )
</pre>