Chapter 4.  Running system components

<< Prev   Next >>

4.1. General information

4.1.1. On Windows

When installing 1C:Enterprise , the following structure will be created in the Start ‑ Programs menu (see example for Windows 10):

1C:Enterprise
1C:Enterprise 8 (folder)
 1C:Enterprise (A.B.C.D)
 Thin client (A.B.C.D)
 Thick client (A.B.C.D)
 Designer (A.B.C.D)
 ReadMe – Additional Information
 Register server administration utility (A.B.C.D)
 1C:Enterprise server administration
 Start server (A.B.C.D)
 Install protection driver
 Remove protection driver

In the above list:

Item	Description
1C:Enterprise	Starts the 1C:Enterprise launcher (1cestart)
1C:Enterprise (A.B.C.D)	Starts the interactive launcher (1cv8s)
Thin client (A.B.C.D)	Starts 1C:Enterprise in thin client mode
Thick client (A.B.C.D)	Starts 1C:Enterprise in thick client mode
Designer (A.B.C.D)	Starts 1C:Enterprise in Designer mode
Install protection driver	Starts installation of the protection driver
Remove protection driver	Starts removal of the protection driver
ReadMe ‑Additional Information	Additional information not included in the documentation
1C:Enterprise 7.7 infobase converter (A.B.C.D)	Converts infobases from 1C:Enterprise 7.7 format
1C:Enterprise server administration	Server cluster administration utility (if any 1C:Enterprise server cluster access components are installed)
Start server (A.B.C.D)	Starts the 1C:Enterprise server as a service (if the Install 1C:Enterprise 8 server as Windows service check box was selected during server installation) or as an application (if the Install 1C:Enterprise 8 server as Windows service check box was cleared during server installation). In this case, server shutdown is identical to closing a regular application.
Register server administration utility (A.B.C.D)	Registers the 1C:Enterprise server administration utility (radmin.dll) for a specific version, so that you can connect to the servers of this version using the administration utility.

In this table:

• Specifying the name of an application without specifying a version means the application or file from the version that was installed latest.
• Specifying (A.B.C.D) next to an application name means that a separate menu item is created for each installed version, where A.B.C.D means the full number of the installed version. For example, if two versions are installed – 8.3.12.100 and 8.3.12 150 – two menu items will be created, Thin client (8.3.12.100) and Thin client (8.3.12.150).
• If the 64-bit version of the 1C:Enterprise is installed, the name of the menu folder and names of items in this folder will contain x86-64.

4.1.2. On macOS

When installing 1C: Enterprise, the following structure will be created in the Programs menu:

1C:Enterprise 8 (folder)
 1C:Enterprise
 A.B.C.D (folder)
   1C:Enterprise
   1C:Enterprise – Thin client
   1C:Enterprise – Thick client
   Remove 1C:Enterprise

In the above list:

Item	Purpose
1C:Enterprise	Starts the 1C:Enterprise launcher (1cestart)
A.B.C.D	Version application directory with full number A.B.C.D
1C:Enterprise	Starts the interactive launcher (1cv8s)
1C:Enterprise ‑ Thin client	Starts 1C:Enterprise in thin client mode
1C:Enterprise ‑ Thick client	Starts 1C:Enterprise in thick client mode
Remove 1C:Enterprise	Removes 1C:Enterprise of the version number which is the name of the folder to contain this menu item.

In this table:

• Specifying the name of an application without specifying a version means the application or file from the version that was installed latest.

4.2. Operating modes

1C:Enterprise supports the following operating modes:

Operating mode	Description
Designer	System configuration mode. In this mode, you can edit data structures, update configurations, create user lists, assign access rights to users, import and export data.
1C:Enterprise	Standard mode. You can enter and process data (perform operations with catalogs, documents, reports, and so on) based on the data structures created and configured in Designer. Three options are available for this mode: Thin client ‑ 1cv8c executable file Web client ‑ no executable file (web browser is used instead) Thick client ‑ 1cv8 executable file Thick client can run configurations created for earlier 1C:Enterprise versions, as well as configurations created in managed application mode. Thin client and web client can only run configurations created in managed application mode.

4.3. Starting a client application or Designer

4.3.1. General information

There are several ways to start 1C:Enterprise:

• Launcher (1cestart) ‑ recommended
• Interactive launcher (1cv8s)
• Executable file for the thick (1cv8) or thin (1cv8c) client of a specific version
• Web browser (web client only)

To start 1C:Enterprise, the following configuration files are used:

• Local configuration file,‑ 1cestart.cfg
• Local configuration file for all users, ‑ 1cestart.cfg
• Common configuration file ‑ 1cescmn.cfg (except Linux).

Each method is described below in more details.

4.3.2. Launcher

4.3.2.1. General information

Location of 1cestart file:

• On Windows OS:
  • 32-bit application in the 64-bit OS: %PROGRAMFILES(x86)%\1cv8\common
  • Otherwise: %PROGRAMFILES%\1cv8\common
• On Linux:
  • 32-bit OS: /opt/1C/v8.3/i386
  • 64-bit OS: /opt/1C/v8.3/i386
• On macOS:
  • 64-bit OS: /opt/1cv8/A.B.C.D Where A.B.C.D ‑ is the full number of client application version. For example, for 1C:Enterprise 8.3.7.1000, 1cestart is located in /opt/1cv8/8.3.7.1000.

The launcher starts all types of client applications (thick client, thin client, web client), as well as Designer.

The launcher can be started without parameters or with a reference to a specific infobase.

If the client computer is Windows-based:

• The launcher can also be located on a network resource (no additional software components required). It can be used both for initial installation of 1C:Enterprise and installation of new versions. If the launcher finds a shared configuration file in its directory, a link to this configuration file is saved as a value of CommonCfgLocation parameter of the local configuration file.
• When installing 1C:Enterprise from the launcher, you might be prompted to restart the operating system.

4.3.2.2. Starting without parameters

If you start the launcher without parameters, the startup procedure is as follows:

• If the launcher is started from a network disk, the launcher searches for a shared configuration file in the launcher directory. If the file is found, the launcher reads the parameters from the file.
• The launcher searches for a local configuration file. If the file is found, the launcher reads the parameters from the file.
• The launcher searches for installed 1C:Enterprise versions using the data read from InstalledLocation parameters of the configuration files. If this parameter is not specified in configuration files, the launcher closes and an error message is displayed.
• The latest installed 1C:Enterprise version is determined.
• The launcher determines the latest version available for installation in directories read from DistributiveLocation parameters of the configuration files.
• If a later version available for installation is found, the new version is automatically installed with parameters read from InstallComponents parameters of the configuration files. If this parameter is undefined, thin client, thick client, and 1C:Enterprise server access components are installed.

  Installation can be performed if:

  • User who starts the launcher is a local administrator
  • User who starts the launcher is not a local administrator but has sufficient rights to install applications (AlwaysInstallElevated registry key)
• The interactive launcher is started from the directory of the specified 1C:Enterprise version. The /AppAutoCheckVersion parameter is specified for the startup.

4.3.2.3. Starting with an infobase specified

If you start the launcher with an infobase name specified in/IBName parameter, the startup procedure is as follows:

• Data is read from local (1cestart.cfg) and shared (1cescmn.cfg) configuration files.
• A common list of infobases is created from the local infobase list and CommonInfoBases parameter of the configuration files.
• If the specified infobase name is not found in this list, the launcher closes and an error message is displayed.
• If the infobase name is found, the client is started with startup parameters determined by infobase properties. The following parameters are determined by the infobase properties:
  • Client type
  • Version number required
  • Other parameters stored in infobase properties
• The /AppAutoCheckVersion parameter is specified for the startup.

4.3.3. Interactive launcher

4.3.3.1. General information

Location of 1cv8s file:

• On Windows OS:
  • 32-bit application in the 64-bit OS: %PROGRAMFILES(x86)%\1cv8\A.B.C.D\bin
  • Otherwise: %PROGRAMFILES%\1cv8\A.B.C.D\bin
• On Linux:
  • 32-bit OS: /opt/1C/v8.3/i386
  • 64-bit OS: /opt/1C/v8.3/i386
• On macOS:
  • 64-bit OS: /opt/1cv8/A.B.C.D

Where A.B.C.D ‑ is the full number of client application version.

The launcher starts all types of client applications (thick client, thin client, web client), as well as Designer.

The interactive launcher uses some 1C:Enterprise components, so starting a client application that matches version of the interactive launcher is faster than starting an arbitrary client application. The interactive launcher can be started both interactively and through the launcher.

After the first startup, the interactive launcher generates a common list of infobases and writes it to ibases.v8i file. This list includes infobases for all 1C:Enterprise versions. When transferring lists of infobases for 1C:Enterprise 8.0 and 8.1, user confirmation is required. Further automatic updates of infobase lists are not supported. During the first startup, paths to configuration template directories from previous versions are determined and written in ConfigurationTemplatesLocation parameter of 1cestart.cfg file.

The interactive launcher can be started without parameters or with a reference to a specific infobase.

4.3.3.2. Starting without parameters

If you start the interactive launcher without parameters, you are prompted to select an infobase.

After the infobase is selected, the interactive launcher follows this procedure:

• If the interactive launcher is started from launcher or from program menu (with or without /AppAutoCheckVersion+ parameter):
  • The 1C:Enterprise version required to start the infobase is determined and the executable files of this version are found.
  • If the required 1C:Enterprise version is not installed and cannot be installed on the computer, the launcher closes and an error message is displayed.
  • Then, the name of client to be started and other startup parameters are determined. The client is started with the specified parameters (including /AppAutoCheckVersion parameter) from the directory of the required 1C:Enterprise version.
  • If the version directory does not contain the required client, the launcher closes and an error message is displayed.
• If the interactive launcher is started from the directory of a specific version with /AppAutoCheckVersion- parameter specified:
  • The executable files of the client must match 1C:Enterprise version whose interactive launcher was started.
  • If the auto client type selection is enabled for the infobase, thin client is started and /AppAutoCheckMode parameter is passed to it.

4.3.3.3. Starting with parameters

Starting the interactive launcher with an infobase specified (using /IBName parameter) is identical to starting the regular launcher.

4.3.4. Client for a specific 1C:Enterprise version

A specific client (thin or thick) can be started in two ways:

• By selecting the respective menu item (depends on the client operating system used). The client application type will determine the presence of the words “thin client” or “thick client” in the menu item name.
• By running the executable file of the required client (depends on the client operating system used). Thus, to start the thin client of a specific version, you must run the following file:
  • On Windows OS:
    • 32-bit application in the 64-bit OS: %PROGRAMFILES(x86)%\1cv8\A.B.C.D\bin\1cv8c.
    • Otherwise: %PROGRAMFILES%\1cv8\A.B.C.D\bin\1cv8c.
  • On Linux:
    • 32-bit OS: /opt/1C/v8.3/i386/1cv8c.
    • 64-bit OS: /opt/1C/v8.3/x86_64/1cv8c.
  • On macOS:
    • 64-bit OS: /opt/1cv8/A.B.C.D/1cv8c.

      Where A.B.C.D ‑ is the full number of client application version. Starting a client application with a version selection (from the list of the installed applications) is supported when running Windows and macOS only.

When starting a file infobase, installation of the latest version of a client application is attempted first (using DistributiveLocation parameter of the configuration files), and then the infobase is opened using the latest version installed on the computer. To disable installation of new versions, use /AppAutoCheckVersion- parameter of the client application startup command line. To enable or disable installation of the new version, use Automated installation of the new version check box in a settings dialog box of a launcher window or /AppAutoInstallLastVersion parameter of the client application startup command line.

If the client is started without the /AppAutoCheckMode parameter, the infobase is opened using the selected client version without picking the client application view.

4.3.5. Determining application bitness

Several versions of the client application with different bitness may be installed on the client computer. In some situations, you may need to specify bitness of the client application for a specific infobase. You can specify client bitness for each infobase if necessary.

To specify bitness of a client application, you can use (in descending priority order):

• /AppArch startup command line parameter
• Infobase property
• Interactive launcher property

Use any of these methods to select one of 4 client bitness options:

• 32 (x86) ‑ always starts the 32-bit version of a client application. The 64-bit versions will be ignored regardless of their release date.
• 64 (x86-64) ‑always starts the 64-bit version of a client application. The 32-bit versions will be ignored regardless of their release date.
• 32 (x86) priority ‑ gives priority to the 32-bit version of a client application. However, if a 64-bit version has a later release date, it will be used instead.‑
• 64 (x64) priority ‑ gives priority to the 64-bit version of a client application. However, if a 32-bit version has a later release date, it will be used instead.‑

If bitness of a client application is not explicitly specified, the 32 (x86) priority option is used by default.

See also:

• Startup window settings
• Command line parameters
• 1cestart.cfg
• 1cescmn.cfg
• *.v8i

4.3.6. Web client

4.3.6.1. General information

To run the web client, start the browser and type in an infobase URL. Make sure the browser is set up properly. You can have an infobase opened in several tabs of one web browser at the same time.

4.3.6.2. Language and regional settings

You can select the language of web client interface using one of the following methods (in ascending priority):

• Preferred language settings in your web browser
• Command-line parameter L

When you choose an interface language:

• The locale language is chosen while processing the query to a resource that corresponds to the infobase (for example, http://localhost/demo):
  • If URL contains the L parameter, the value of this parameter is read. If the language is not chosen after reading the parameter, the Accept-Language header is read.
  • If URL does not have any parameters, the standard HTTP header ‑ Accept-Language containing information on the browser's preferred languages is read.
• The language is chosen based on the locales available on the server:
  • If an exact match is not found (for example, the option specifies en_US language, which is not available), the language name is truncated and a new search is performed (the search for en in this example).
• If no matching language is found, the default English (en) language is used.
  • The selected language is added to the base application URL (in the example, the result is http://localhost/demo/en), and the web browser is automatically redirected to the new URL.

Regional settings of a web client session affecting how certain values are displayed (for example, Day and Date) can be specified using the following methods (in ascending priority):

• Preferred language settings in your web browser
• Command-line parameter VL

The regional settings of a session are configured in the following way:

• If the URL contains VL parameter, the regional settings matching the locale code in this parameter are used. If the parameter contains an invalid locale code, the web client closes and an error message is displayed.
• If URL does not have any parameters, the standard HTTP header ‑ Accept-Language containing information on the browser's preferred languages is read.

4.3.6.3. Authentication with a POST request

In some situations, you may need to run 1C:Enterprise without the standard user authentication window. This option might come in handy when you need to performed authentication in 1C:Enterprise using a specialized form (for example, integrated into a website), or when infobase user credentials are stored in a separate database.

To meet these requirements, you can authenticate a web client session using POST request to infobase resource: e1cib/start. In this case, the startup process follows this procedure:

• POST request is made to authenticate the client.
• If the authentication is successful the session is created on behalf of the user specified in the POST request.
• The web client is started and the following parameters from POST request are passed to web client's command line: LowClientConnectionSpeed, LaunchParameter, LocaleCode, Zone.
• Web client connects to the session authenticated in step 2.

The request contains the following parameters:

User name.

User Password.

Default value ‑ empty string.

Connection speed.

Values:

• on ‑ low connection speed
• off ‑ normal connection speed (default)

Parameters that must be passed to the application (similar to C parameter of a web client command line).

Default value ‑ empty string.

Interface language.

Interface locale.

Separator values.

Determines the system behavior in case of authentication error. Values:

• error ‑ returns error code ‑ 402 and error message
• start ‑ runs web client with 1C:Enterprise authentication request
• redirect ‑ redirects to URL passed in AuthFailRedirectURL parameter

The default value is‑ error.

Contains the URL to follow in case of authentication error, if the AuthFailHandling parameter is set to redirect. This URL must be absolute.

Example:

This HTML page illustrates a native authentication form of an infobase located at http://localhost/demoapp.

<HTML xmlns="http://www.w3.org/1999/xhtml"><HEAD>
<META http-equiv="Content-Type" content="text/html; charset=utf-8" />
<BODY>
<FORM action="http://localhost/demoapp/e1cib/start" method="post">
 User: <INPUT id="usr" name="usr" /><BR />
 Password: <INPUT id="pwd" type="password" value="" name="pwd" />
 <BR />Low speed: <INPUT id="lowclientconnectionspeed" type="checkbox" name="lowclientconnectionspeed" /><BR />
 Startup parameter: <INPUT id="launchparameter" name="launchparameter" /><BR />
 Interface language: <SELECT id="systemlanguage" name="systemlanguage">
   <OPTION value="ru" selected="">Russian</OPTION>
   <OPTION value="en">English</OPTION>
 </SELECT><BR />
 Session locale code: <SELECT id="localecode" name="localecode">
   <OPTION value="ru" selected="">Russian</OPTION>
   <OPTION value="en">English</OPTION>
 </SELECT><BR />
 Data area: <INPUT id="zone" name="zone" />
 <INPUT id="authfailhandling" type="hidden" value="error" name="authfailhandling" />
 <P><INPUT type="submit" value="OK" /> </P>
</FORM>
</BODY>
</HTML>

The following authentication form is displayed:

4.3.7. Special startup parameters

4.3.7.1. /IBName parameter

The /IBName parameter specifies the name of infobase to open. The launcher (or the client executable file) will search for the specified infobase in the infobase list.

If multiple infobases with this name are found, the launcher closes and an error message is displayed.

If the infobase is found, it is opened using the specified parameters from the launcher (or from client executable file).

4.3.7.2. /AppAutoCheckVersion parameter

This parameter automatically selects the 1C:Enterprise version that can open the selected infobase.

If the startup line contains /AppAutoCheckVersion parameter, the following procedure is followed:

• The infobase version is determined. This information is obtained from Version parameter of *.v8i file (when in file infobase mode), or from response of the 1C:Enterprise server (when in client/server mode).
• If the version is 8.1 or 8.0, the executable files for the version are found and started. For 1C:Enterprise 8.0, DESIGNER command-line parameter is changed to CONFIG (for compatibility purposes).
• When using 8.2 and newer versions:
  • If the full version number is specified, a search for the required version is performed using InstalledLocation parameters of configuration files. If the required version is not installed on the computer, a search for the distribution package of the required version is performed using DistributiveLocation parameters of configuration files. If the distribution package was found, it is installed. If not, the application closes and an error message is displayed.
  • If partial version number is specified , the full version number is determined from DefaultVersion parameter of configuration files. If the full version number cannot be determined, a search for the latest installed version (InstalledLocation parameters of configuration files) and the latest version available for installation (DistributiveLocation parameters of configuration files) is performed. If the latest version available for installation is newer than the latest installed version, it is installed.

4.3.7.3. /AppAutoCheckMode parameter

This parameter allows to automatically select and run the client application.

When the application startup line contains /AppAutoCheckMode parameter, the procedure is as follows:

• The run mode for the specific user is defined.
• The default run mode of the infobase is defined.
• If a run mode does not match the client and the current user has the right to start client applications, the client application of the same version is restarted. Otherwise, the startup of the client application continues.

4.3.7.4. /url parameter

This parameter allows to open URL in the client application (with several preconditions). It is available for both thin and thick client applications.

The parameter functions as follows:

• If the parameter value contains an external URL (address of an infobase), a search for a running client application using this infobase will be performed on the computer, and the client application will open the object referenced by the URL. If the infobase is not opened in any client application, a client application is started with the /url command-line parameter specified.
• If the parameter value is an internal link, it is ignored and the client application is started as usual.

Let's examine in more details how the search for a client application is performed. The search procedure is as follows:

• The search for a running client application that uses the infobase with the connection string specified in the parameter is performed. The search is not case-sensitive regarding host computer name and infobase name. DNS names are not converted into IP addresses or back. Therefore, if the client application contains a DNS address in the connection string and the external link contains an IP address, the search will fail.
• If the client application is found and it does not have a modal or blocking window opened, the client application is activated and the URL received from the /url command-line parameter value is passed to it.
• If the found client application has a modal or blocking window opened, the client application is ignored and the search continues.
• If no client application is found, a client application is started and the URL received from the /url command-line parameter value is passed to it.
• If the URL passed to the launcher or the client application only contains an infobase address (for example, e1c://host/ib-name), the client application is started and no other actions are performed.

When following an internal link, the procedure is as follows:

• The link is opened after calling the AtSystemStartup handler.
• If the client application runs in Forms in separate windows mode and the internal link target is a navigation point, the link is opened instead of opening the desktop. Otherwise, the desktop is opened and then the target form is opened.
• In case of error, a diagnostic message is displayed and application continues to run.

If several parameters are specified in startup command line:

• If /Execute parameter is specified, /url parameter is ignored.
• If /url parameter containing an absolute URL is specified, any infobase connection parameters specified elsewhere are ignored. The following command line parameters are ignored: /F, /S, /WS, /IBName. For /IBConnection parameter, parts of the connection string describing the infobase are ignored.

To follow the links, you can use external URLs in the following formats:

• e1c: ‑ for thick and thin client
• http: or https: ‑ for thin client only

You can use the following methods for the same effect as using /url parameter:

• FollowTheURL() 1C:Enterprise language method
• Dialog box accessible from the infobase list window
• Standard full-text search form (only for e1c: format)

4.3.8. Infobase connection methods

There are several ways to locate an infobase and connect to it. To specify a method for a specific infobase, go to the infobase adding dialog box:

• The infobase is located on a local computer or a computer in a local network.

  It is used by the thin and thick client in file mode.

  When the thin client runs in file mode on the computer where the thin client was started, a specialized environment is set. In this specialized environment:

  • Server components required for the system operation are loaded
  • Application configuration is loaded
  • Other actions needed for normal infobase operation are performed

    Interaction between the thin client and the specialized environment is organized over the same protocols that are used when working in client/server mode or via the web server. Thus, the specialized environment operates as a server for the thin client. The environment is not a separate OS process; instead, it runs as a part of the thin client process.

• The infobase is located on the 1C:Enterprise server.

  It is used by the thin and thick clients in client/server mode.

• The infobase is located on a web server.

  It is used by the thin client and web client in file mode and client/server mode.

  To connect to the infobase via the web server, install and configure the web server properly.

  When connecting to the infobase via the web server, specify the URL as an infobase connection string. For example, http://MyServer/DemoBase.

4.3.9. Selecting an infobase

The next step of 1C:Enterprise startup is infobase selection.‑  Infobase selection is performed in 1C:Enterprise startup window.

The Infobases list contains the list of infobases. Each item in this list points to a directory where 1C:Enterprise infobase files (for file mode) or a server with a server infobase (for client/server mode) are stored.

Select any infobase from this list. To select the infobase, double-click its name.

Change, Add, and Remove buttons are used to manage the 1C:Enterprise infobase list (or you can use shortcuts: F2, Ins, and Del).

The window is resizable. Size and location of the window are memorized after the session ends.

When all 1C:Enterprise startup parameters are specified, click 1C:Enterprise to run 1C:Enterprise, or Designer to run Designer. Or, click Exit to cancel the 1C:Enterprise startup.

The Go to link command is used to run the client application when the external URL of the application object is available. After clicking this hyperlink, a dialog box opens where you can type in the URL and click Go to.

As an alternative to selecting an infobase from the list, you can run 1C:Enterprise by using a .v8i file and specifying the infobase parameters in the client application startup command line. In this mode, you can use infobases that are not included in the infobase list. When accessing an infobase not included in the local infobase list, please remember that the configuration data will not be cached for this infobase resulting in much slower operations. To avoid this slowdown, add the infobase to the infobase list.

4.3.10. Client/server version mismatch

When in client/server mode, the client application version might differ from the server version. In this case, 1C:Enterprise cannot run ‑ The client and server versions must match exactly.

In case of client and server version mismatch, the client application (thin or thick client) searches for and installs the version that matches the server version. The search for distribution packages of the client application is performed in the following order:

• 1C:Enterprise installation directory (specified in InstalledLocation property of 1cestart.cfg and 1cescmn.cfg files)
• Directories specified as locations of distribution packages of new versions (DistributiveLocation property of 1cestart.cfg and 1cescmn.cfg files, as well as CommonCfgLocation property of 1cestart.cfg file)
• URL that is returned in the server version mismatch exception (PublishDistributiveLocation parameter of conf.cfg file and pubdst attribute of ws element in default.vrd file)
• Internet services used to obtain client application distribution packages

Please keep in mind that:

• Thin client is only used to search for and get the distribution package using the Internet services if you choose to connect to the infobase over HTTP.
• If you use a client/server connection, getting the distribution package from the URL specified in the client and server version mismatch exception is performed by the thin client.
• If the infobase list (*.v8i file) includes a version that is not available for installation, the latest version available on the computer is used to open the infobase. In this case, the path to distribution package of the required client version can be received from the 1C:Enterprise server.

4.3.11. FIle mode version mismatch

When in file mode, all client applications working with an infobase at the same time must have the same version. The required version is determined by the version of the client application that established first connection to 1Cv8.1CD file of the infobase. First connection is a connection that was established when no other client applications were connected to the infobase.

4.3.12. User authentication

If a list of users allowed to access the infobase (to create or edit this list, use Designer) is available, the 1C:Enterprise. Infobase access dialog box is displayed.

Fig. 19. User authentication

Specify a username in this dialog box:

• Click the User field and choose a name from a list, or
• Type the username in User field, if the list is very long or Show in list option is not enabled in the user settings

If a password is set for the user, enter the password in the Password field. Then, click OK to complete the user authentication and proceed. To close 1C:Enterprise instead, click Cancel.

4.3.13. Using certificates

4.3.13.1. General information

When sending information over public communication channels (Internet), protecting this information from interception and spoofing is particularly important. This chapter examines the issue of establishing secure connections in a 1C:Enterprise-based system.

Let us review the general procedure of establishing a secure connection. It is based upon Public Key Infrastructure (PKI) that associates public keys with respective user identities using a certification authority.

A simple example illustrates how PKI operates. Let us assume that any person can contact a certificate issuer to check validity of any certificate issued by it.

Let us further assume that Policeman meets Stranger and wants to verify that the person he just met is indeed Stranger.‑ To do this, Policeman asks Stranger to show her ID. Before showing the ID, Stranger wants to make sure that the person in front of him is indeed Policeman. She asks Policeman for his badge, calls the Police HQ, and asks them to check the badge number to verify that the person in front of her ‑ is Policeman. After the authentication, Stranger shows her ID to Policeman. The ID has a unique number; it also says it is issued by the Ministry of Documents. Policeman contacts the Ministry of Documents and asks them to check the ID number to verify that the person in front of him is Stranger.‑

However, if Stranger travels to another country, the above authentication algorithm will not work, because Policeman in another country knows nothing about the Ministry of Documents. Therefore, Stranger will be detained until another method to determine her identity is found.

Now, let us translate this into terms of PKI objects and network infrastructure. 1C:Enterprise client application acts the role of Stranger. Web server used by the client application to access the infobase acts the role of Policeman. Ministry of Documents and Police HQ are Certification authorities. Stranger's ID and Policeman's badge are Certificates used to establish the HTTPS connection.

Let us go through the procedure once again, now in the correct terms. When a client application attempts to connect to the web server, the client application verifies the server's certificate. The verification is performed via certification authority specified in the web server's certificate (provided that the certification authority is in the list of root certification authorities on the computer with the client application). If verification is successful, the client application provides its client certificate to web server for verification. The server verifies the certificate using its list of root certification authorities. If the verification is successful, ‑ the client application and the web server establish a secure HTTPS connection. The client application then encrypts data sent to the server (and decrypts data received from the server) using the server's public key, while the server ‑ encrypts and decrypts data using its private key. The client application and the web server ‑ use different private keys, unknown to the other party.

This is a general description of establishing a secure connection. The next section contains a more detailed description.

4.3.13.2. Methods for establishing a secure connection

A secure connection can be established between a thin client (or a web client) and a web server used to access the infobase. Several methods can be used to establish a secure connection (depending on certificate availability at client or server). These methods are described below. Please keep in mind that all HTTPS connections are encrypted.

Server	Client	Description
Certificate+ Root-	Certificate- Root-	Server and client certificates are not verified. This is the only mode available in versions prior to 8.3.3.
Certificate+ Root-	Certificate- Root+	Server certificate is verified. Client certificate is not verified.
Certificate+ Root+	Certificate- Root- or Certificate- Root+	Not supported.
Certificate+ Root+	Certificate+ Root-	Server certificate is not verified. Client certificate is verified.
Certificate+ Root+	Certificate+ Root+	Both client and server certificates are verified.

Terms used in the table:

• Certificate ‑ indicates that a certificate is available (Certificate+) or unavailable (Certificate-):
  • Server certificate for server‑
  • Client certificate for client‑
• Root ‑ indicates that a certificate authority (CA) list to verify the presented certificate is available (Root+) or unavailable (Root-). CA list must allow verification of certificates presented by the client application or web server.

When using a web client, availability of a certificate or a root certificate list is determined by certificates installed in the certificate storage used by the web browser.

For the thin client, the certificate (and lists of root certificates) can be specified using the startup command line parameters or infobase startup parameters.

4.3.13.3. Certificate sources and formats

The following storages can be used as sources of certificates:

• System certificate storage ‑ for macOS and Windows.
• Certificate storage  in Linux is located in /etc/ssl/certs directory. All certificates located in this directory are considered as trusted.

  Some Linux distribution packages also support the following directories for root certificate storages:

  • Debian, Mint, Ubuntu ‑ /etc/ssl/certs/ca-certificates.crt
  • CentOS, Fedora, RedHat ‑ /etc/ssl/certs/ca-bundle.trusted.crt or /etc/pki/tls/certs/ca-bundle.crt
  • Alt Linux ‑ /etc/share/ca-certificates/ca-bundle.crt
• File certificates ‑ are for Linux, macOS, and Windows.

The following file certificate formats are supported:

• PEM (base-64 encoded X.509) ‑ encrypted keys and certificates under the X.509 standard in a text format. Certificate and key data is encoded using base-64 encoding. Private certificate keys are protected with passwords. This certificate file format is used by default by Apache web server, among others. If the private key of the client certificate is stored in a separate file, the content of this file must be added to the client certificate file.
• P12/PFX (PKCS#12) ‑ encrypted keys and certificates under the PKCS#12 standard. File can be protected with a password. This is the primary format for exporting and importing the system certificate storages in Windows. It is used, for example, by Microsoft Internet Information Services web server. Client certificate file contains its private key.

File extension determines format of the file:

• *.p12, *.pfx ‑ P12 file format
• *.pem ‑ PEM file format
• The default file format is PEM

4.4. Restarting 1C:Enterprise

In some situations, the infobase cannot be opened. 1C:Enterprise notifies the user and prompts to retry infobase connection in 60 seconds.

Typically, the infobase cannot be opened when:

• The configuration is already opened in Designer (when started in Designer mode)
• Exclusive mode is enabled for the infobase
• Versions of 1C:Enterprise client and server do not match
• 1C:Enterprise server is not found
• Database server is not found
• Connections to the infobase are prohibited by the administrator

In such situations, a window with related information is displayed, and the user is prompted to retry starting 1C:Enterprise in 1 minute or close the 1C:Enterprise launcher.

After the infobase is loaded or dynamic update of the infobase in client/server mode is performed, the user is also prompted to restart Designer.

When a critical error occurs while in 1C:Enterprise mode, the user is prompted to restart 1C:Enterprise with the same user parameters.

<< Prev   Next >>