Subversion Repositories oidplus

Rev

Rev 218 | Go to most recent revision | Details | Last modification | View Log | RSS feed

Rev Author Line No. Line
217 daniel-mar 1 
<!DOCTYPE html>
2 
 
3 
<html lang="en">
4 
 
5 
<head>
6 
        <title>Procedural documentation related to privacy</title>
7 
</head>
8 
 
9 
<body>
10 
        <style>
11 
        h2 {
12 
                font-size:large !important;
13 
        }
14 
        h3 {
15 
                font-size:medium !important;
16 
        }
17 
        </style>
18 
        <h1>Procedural documentation related to privacy</h1>
19 
        <p><em>Revision: 14 March 2020</em></p>
20 
        <p><strong><em>Important</em></strong><em>: This document is written by ViaThinkSoft (the developer of the software &ldquo;OIDplus&rdquo;) and gives general information how OIDplus works regarding privacy related topics. Since OIDplus is a web-software that can be downloaded, installed and operated by anyone on their own server systems, this document DOES NOT describe how the owners/administrators of this particular installation of OIDplus are handling your data. Therefore, the owner of this system should provide an additional/individual privacy statement.</em></p>
21 
        <h2><strong><u>Parties / Terminology</u></strong></h2>
22 
        <p><strong>ViaThinkSoft</strong> is the developer of the program &ldquo;OIDplus&rdquo;. OIDplus is a system that organizations (or workgroups, single developers etc.) can download and install on their own web servers. The code and the database is located on the server of that organization, hereinafter referred to as <strong>system owner</strong>. The system administrator (<strong>system admin</strong>) is a person in that organization who manages and maintains the OIDplus software. The system admin is usually also the same person who manages the web server&rsquo;s hardware/software.</p>
23 
        <p><strong>OIDplus</strong> is a system to manage and publish information about Object Identifiers (OIDs) and their <strong>Registration Authorities</strong> (hereinafter referred to as <strong>RA</strong>, or <strong>owner of an</strong> <strong>OID</strong>). Some of the information can be marked as hidden/confidential, which means the information is only visible to privileged users (e.g. the system admin) and not to the public.</p>
24 
        <p><strong>Object Identifiers</strong> are organized in a hierarchical structure where RAs are delegating OIDs underneath the OIDs they are managing, to other RAs. In the context of a specific RA and OID, the &ldquo;<strong>Superior RA</strong>&rdquo; is the RA that has delegated the root OID of a specific RA. However, the statements about &ldquo;Superior RAs&rdquo; in this document do only apply if the Superior RA is using OIDplus to delegate the OID.</p>
25 
        <h2><strong><u>Definition of sever-side and client-side</u></strong></h2>
26 
        <p>OIDplus is a web application written in the programming languages PHP (running on server-side) and HTML/JavaScript (running on client-side).</p>
27 
        <h3><u>Server side</u></h3>
28 
        <p>The PHP scripts of OIDplus are processed through a PHP script interpreter running on top of a web server software (&ldquo;HTTP web server daemon&rdquo;), for example &ldquo;Apache&rdquo;. The actual data of OIDplus (OIDs, RAs, &hellip;) is stored in a DBMS (Database Management Software) e.g. &ldquo;MySQL&rdquo;. The DBMS is usually installed on the same server machine where PHP/Apache is installed, but it can be installed on any machine by the server administrator.</p>
29 
        <h3><u>Client side</u></h3>
30 
        <p>While the user browses OIDplus, the server-side serves HTML and JavaScript contents to the client computer. Using a web browser software (like &ldquo;Chrome&rdquo; or &ldquo;Firefox&rdquo;), these contents are processed and displayed on the screen. Various JavaScript scripts are either required to run OIDplus or are improving the user experience, e.g. by reloading OID descriptions without reloading the whole page while the user browses OIDplus. There might be a few external JavaScripts included (Polyfill and ReCaptcha), which are described at the end of the document.</p>
31 
        <h2><strong><u>Scope of this document</u></strong></h2>
32 
        <p>This document contains information about the OIDplus software only. It is independent from the behavior of the client-side software (web browser, Operating system, firewalls, &hellip;), independent from the behavior of hardware (network routers or firewalls, &hellip;), independent from the behavior of the server-side software (Apache, PHP, MySQL, Operating system, &hellip;) and the practices how the system administrator is operating the server software, stores log files, manages firewalls etc.</p>
33 
        <h2><strong><u>OID information</u></strong></h2>
34 
        <p>The main purpose of OIDplus is to show and manage information of OID information.</p>
35 
        <p>Some attributes of Object Identifiers (like ASN.1 identifiers) can only be changed by the Superior RA and not by the RA of that OID. On the other hand, some other information (like the title and description) can only be changed by the RA owning the OID and not by the Superior RA. The system admin can edit all information.</p>
36 
        <h3><em>Hidden OID information</em></h3>
37 
        <p>A superior RA can set the &ldquo;hidden&rdquo; flag to an OID they delegate. This means the OID and all its subsequent OIDs are invisible to the public. However, the public can see the existence of hidden OIDs by a notice &ldquo;<em>XX OIDs are hidden. Log in to see them</em>&rdquo;.</p>
38 
        <p>The system admin can see all OIDs, even if they are hidden.</p>
39 
        <p>An owner of an OID can see all OIDs in the OID tree chain that are directing to his root OID, even if some of them are hidden.</p>
40 
        <p>If you are an <strong>owner of an OID</strong> and want to make your OID hidden from the public, please contact your <strong>superior RA</strong> (preferential) or the <strong>system admin</strong> and ask them to mark your OID as hidden. Please note that this will also hide all OIDs that you delegate to yourself or other RAs.</p>
41 
        <h3><em>Overview: Managed information about OIDs:</em></h3>
42 
        <table border="1">
43 
        <tbody>
44 
        <tr>
45 
        <td width="111">
46 
        <p><strong>Attribute:</strong></p>
47 
        </td>
48 
        <td width="196">
49 
        <p><strong>Can only be changed by:</strong></p>
50 
        </td>
51 
        <td width="154">
52 
        <p><strong>If not marked &ldquo;hidden&ldquo;, visible to:</strong></p>
53 
        </td>
54 
        <td width="154">
55 
        <p><strong>If marked &ldquo;hidden&ldquo;, visible to:</strong></p>
56 
        </td>
57 
        </tr>
58 
        <tr>
59 
        <td width="111">
60 
        <p>Numeric Identifier</p>
61 
        </td>
62 
        <td width="196">
63 
        <p>Superior RA<br /> System admin<br /> (can only be defined during creation and never be updated!)</p>
64 
        </td>
65 
        <td width="154">
66 
        <p>Public<br /> RA<br /> Superior RA<br /> System admin</p>
67 
        </td>
68 
        <td width="154">
69 
        <p>Superior RA<br /> System admin</p>
70 
        </td>
71 
        </tr>
72 
        <tr>
73 
        <td width="111">
74 
        <p>Alphanumeric identifier (for ASN.1 notation)</p>
75 
        </td>
76 
        <td width="196">
77 
        <p>Superior RA<br /> System admin</p>
78 
        </td>
79 
        <td width="154">
80 
        <p>Public<br /> RA<br /> Superior RA<br /> System admin</p>
81 
        </td>
82 
        <td width="154">
83 
        <p>Superior RA<br /> System admin</p>
84 
        </td>
85 
        </tr>
86 
        <tr>
87 
        <td width="111">
88 
        <p>Unicode label</p>
89 
        <p>(for IRI notation)</p>
90 
        </td>
91 
        <td width="196">
92 
        <p>Superior RA<br /> System admin</p>
93 
        </td>
94 
        <td width="154">
95 
        <p>Public<br /> RA<br /> Superior RA<br /> System admin</p>
96 
        </td>
97 
        <td width="154">
98 
        <p>Superior RA<br /> System admin</p>
99 
        </td>
100 
        </tr>
101 
        <tr>
102 
        <td width="111">
103 
        <p>RA</p>
104 
        </td>
105 
        <td width="196">
106 
        <p>Superior RA<br /> System admin</p>
107 
        </td>
108 
        <td width="154">
109 
        <p>Public<br /> RA<br /> Superior RA<br /> System admin</p>
110 
        </td>
111 
        <td width="154">
112 
        <p>Superior RA<br /> System admin</p>
113 
        </td>
114 
        </tr>
115 
        <tr>
116 
        <td width="111">
117 
        <p>Comment</p>
118 
        </td>
119 
        <td width="196">
120 
        <p>Superior RA<br /> System admin</p>
121 
        </td>
122 
        <td width="154">
123 
        <p>Public<br /> RA<br /> Superior RA<br /> System admin</p>
124 
        </td>
125 
        <td width="154">
126 
        <p>Superior RA<br /> System admin</p>
127 
        </td>
128 
        </tr>
129 
        <tr>
130 
        <td width="111">
131 
        <p>&ldquo;Hidden&rdquo; flag</p>
132 
        </td>
133 
        <td width="196">
134 
        <p>Superior RA<br /> System admin</p>
135 
        </td>
136 
        <td width="154">
137 
        <p>Public<br /> RA<br /> Superior RA<br /> System admin</p>
138 
        </td>
139 
        <td width="154">
140 
        <p>Superior RA<br /> System admin</p>
141 
        </td>
142 
        </tr>
143 
        <tr>
144 
        <td width="111">
145 
        <p>Title</p>
146 
        </td>
147 
        <td width="196">
148 
        <p>RA<br /> System admin</p>
149 
        </td>
150 
        <td width="154">
151 
        <p>Public<br /> RA<br /> Superior RA<br /> System admin</p>
152 
        </td>
153 
        <td width="154">
154 
        <p>Superior RA<br /> System admin</p>
155 
        </td>
156 
        </tr>
157 
        <tr>
158 
        <td width="111">
159 
        <p>Description</p>
160 
        </td>
161 
        <td width="196">
162 
        <p>RA<br /> System admin</p>
163 
        </td>
164 
        <td width="154">
165 
        <p>Public<br /> RA<br /> Superior RA<br /> System admin</p>
166 
        </td>
167 
        <td width="154">
168 
        <p>Superior RA<br /> System admin</p>
169 
        </td>
170 
        </tr>
171 
        </tbody>
172 
        </table>
173 
        <h2><strong><u>RA information</u></strong></h2>
174 
        <p>The information about RAs owning OIDs can be seen publicly. A RA can manage their contact data in the OIDplus system (log in area) and mark their information as &ldquo;private&rdquo; to limit the information visible to the public.</p>
175 
        <p>Following RA information are always displayed (even if marked &ldquo;private&rdquo;):</p>
176 
        <h3><em>Overview: Managed information about RAs:</em></h3>
177 
        <table border="1">
178 
        <tbody>
179 
        <tr>
180 
        <td width="111">
181 
        <p><strong>Attribute:</strong></p>
182 
        </td>
183 
        <td width="196">
184 
        <p><strong>Can only be changed by:</strong></p>
185 
        </td>
186 
        <td width="154">
187 
        <p><strong>If not marked &ldquo;private&ldquo;, visible to:</strong></p>
188 
        </td>
189 
        <td width="154">
190 
        <p><strong>If marked &ldquo;private&ldquo;, visible to:</strong></p>
191 
        </td>
192 
        </tr>
193 
        <tr>
194 
        <td width="111">
195 
        <p>Email-Address</p>
196 
        </td>
197 
        <td width="196">
198 
        <p>RA</p>
199 
        </td>
200 
        <td width="154">
201 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
202 
        </td>
203 
        <td width="154">
204 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
205 
        </td>
206 
        </tr>
207 
        <tr>
208 
        <td width="111">
209 
        <p>Name</p>
210 
        </td>
211 
        <td width="196">
212 
        <p>RA</p>
213 
        </td>
214 
        <td width="154">
215 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
216 
        </td>
217 
        <td width="154">
218 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
219 
        </td>
220 
        </tr>
221 
        <tr>
222 
        <td width="111">
223 
        <p>Organization</p>
224 
        </td>
225 
        <td width="196">
226 
        <p>RA</p>
227 
        </td>
228 
        <td width="154">
229 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
230 
        </td>
231 
        <td width="154">
232 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
233 
        </td>
234 
        </tr>
235 
        <tr>
236 
        <td width="111">
237 
        <p>Office</p>
238 
        </td>
239 
        <td width="196">
240 
        <p>RA</p>
241 
        </td>
242 
        <td width="154">
243 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
244 
        </td>
245 
        <td width="154">
246 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
247 
        </td>
248 
        </tr>
249 
        <tr>
250 
        <td width="111">
251 
        <p>Personal name</p>
252 
        </td>
253 
        <td width="196">
254 
        <p>RA</p>
255 
        </td>
256 
        <td width="154">
257 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
258 
        </td>
259 
        <td width="154">
260 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
261 
        </td>
262 
        </tr>
263 
        <tr>
264 
        <td width="111">
265 
        <p>Privacy flag</p>
266 
        </td>
267 
        <td width="196">
268 
        <p>RA</p>
269 
        </td>
270 
        <td width="154">
271 
        <p>RA</p>
272 
        <p>System admin</p>
273 
        </td>
274 
        <td width="154">
275 
        <p>RA</p>
276 
        <p>System admin</p>
277 
        </td>
278 
        </tr>
279 
        <tr>
280 
        <td width="111">
281 
        <p>Street</p>
282 
        </td>
283 
        <td width="196">
284 
        <p>RA</p>
285 
        </td>
286 
        <td width="154">
287 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
288 
        </td>
289 
        <td width="154">
290 
        <p>RA</p>
291 
        <p>System admin</p>
292 
        </td>
293 
        </tr>
294 
        <tr>
295 
        <td width="111">
296 
        <p>ZIP/Town</p>
297 
        </td>
298 
        <td width="196">
299 
        <p>RA</p>
300 
        </td>
301 
        <td width="154">
302 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
303 
        </td>
304 
        <td width="154">
305 
        <p>RA</p>
306 
        <p>System admin</p>
307 
        </td>
308 
        </tr>
309 
        <tr>
310 
        <td width="111">
311 
        <p>Country</p>
312 
        </td>
313 
        <td width="196">
314 
        <p>RA</p>
315 
        </td>
316 
        <td width="154">
317 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
318 
        </td>
319 
        <td width="154">
320 
        <p>RA</p>
321 
        <p>System admin</p>
322 
        </td>
323 
        </tr>
324 
        <tr>
325 
        <td width="111">
326 
        <p>Phone</p>
327 
        </td>
328 
        <td width="196">
329 
        <p>RA</p>
330 
        </td>
331 
        <td width="154">
332 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
333 
        </td>
334 
        <td width="154">
335 
        <p>RA</p>
336 
        <p>System admin</p>
337 
        </td>
338 
        </tr>
339 
        <tr>
340 
        <td width="111">
341 
        <p>Mobile</p>
342 
        </td>
343 
        <td width="196">
344 
        <p>RA</p>
345 
        </td>
346 
        <td width="154">
347 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
348 
        </td>
349 
        <td width="154">
350 
        <p>RA</p>
351 
        <p>System admin</p>
352 
        </td>
353 
        </tr>
354 
        <tr>
355 
        <td width="111">
356 
        <p>Fax</p>
357 
        </td>
358 
        <td width="196">
359 
        <p>RA</p>
360 
        </td>
361 
        <td width="154">
362 
        <p>Public<br /> Superior RA<br /> RA<br /> System admin</p>
363 
        </td>
364 
        <td width="154">
365 
        <p>RA</p>
366 
        <p>System admin</p>
367 
        </td>
368 
        </tr>
369 
        </tbody>
370 
        </table>
371 
        <h2><strong><u>Invitation of RAs</u></strong></h2>
372 
        <p>When an OID is created by a RA or by the system admin, the owner of the OID will be defined by an email address (which will be shown publicly). Therefore, it is possible to own an OID, even if you are not registered in the OIDplus system.</p>
373 
        <p>When the OID is created and the RA with such an email address does not exists, the creator will be asked if they want to send an invitation. If they agree, an email will be sent to this email address, allowing them to click a link to register to the OIDplus system, so that they can add more contact data as well as be able to delegate and edit OID information.</p>
374 
        <p>Currently, a RA cannot register themselves. They need an invitation by the system admin or their superior RA to be able to register to the OIDplus system. (Note: To re-send an invitation, the system admin or superior RA needs to click &ldquo;Update&rdquo; at the OID delegation table, so that they are asked again to send the invitation).</p>
375 
        <p>In addition to the invitation system, the system administrator can create RA accounts without email address verification.</p>
376 
        <h2><strong><u>Publishing RAs/OIDs to oid-info.com</u></strong></h2>
377 
        <p>oid-info.com is a web page which collects and displays information about OIDs, like a Wiki. OIDplus contains features to submit data of its own database to oid-info.com</p>
378 
        <p>There are two possibilities:</p>
379 
        <ol>
380 
        <li>Manual transfer: The system admin can create an XML file that contains OID and RA information (only the parts which can be seen by the public anyway) and can upload this XML file to oid-info.com</li>
381 
        <li>If the OIDplus system is registered to ViaThinkSoft and the OID-info.com transfer is enabled (see below), ViaThinkSoft will automatically fetch the XML data from the OIDplus system using an encrypted interface and submits the data to the oid-info.com administrator.</li>
382 
        </ol>
383 
        <h2><strong><u>Unique system ID</u></strong></h2>
384 
        <p>During initial setup, a public/private-key-pair will be created which can be used for various purposes, e.g. to encrypt data between OIDplus and ViaThinkSoft if the &ldquo;system registration&rdquo; service is used (see below) or to sign OID-over-WHOIS responses.</p>
385 
        <p>From this public key, a unique system ID will be derivated. The unique system ID and the public key can be seen in the setup screen.</p>
386 
        <h2><strong><u>System registration and automatic publishing to oid-info.com</u></strong></h2>
387 
        <p>During initial setup, the system admin can choose between following options:</p>
388 
        <p>0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Register to directory service and automatically publish RA/OID data at oid-info.com<br /> 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Only register to directory service<br /> 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Hide system</p>
389 
        <p>This setting can always be changed in the administrator login / control panel.</p>
390 
        <h3><em><u>Registering the system to the directory service (option 0 and 1)</u></em></h3>
391 
        <p>The registration of your OIDplus system has various advantages:</p>
392 
        <ul>
393 
        <li>The public key of your system will be published, so that users can check the integrity of your data (e.g. signed OID-over-WHOIS requests).</li>
394 
        <li>Since the 31-bit System ID can have hash conflicts, ViaThinkSoft will make sure that the System ID is only used by your system (it will force other OIDplus systems with the same system ID to change their IDs).</li>
395 
        <li>ViaThinkSoft can acknowledge the system name, admin email and OID root arcs. Therefore, your system can be found using referral WHOIS.</li>
396 
        <li>You can optionally enable the automatic publishing of your public OID information to the repository oid-info.com.</li>
397 
        <li>Your OIDplus version will be reported to ViaThinkSoft. If a severe bug or security vulnerability is affecting your system, ViaThinkSoft can warn you via email.</li>
398 
        <li>The directory service will automatically create a X.509 security certificate for you (NOT a SSL certificate!) which can be used for various verifications.</li>
399 
        </ul>
400 
        <p>If privacy level option 0 or 1 was chosen, the OIDplus system will regularly contact the ViaThinkSoft server through a secure connection and send following information:</p>
401 
        <ul>
402 
        <li>Privacy level (0, 1 or 2)</li>
403 
        <li>System ID</li>
404 
        <li>Public Key</li>
405 
        <li>Current URL</li>
406 
        <li>Administrator email address</li>
407 
        <li>System title</li>
408 
        <li>List of OID roots that this system is sending</li>
409 
        <li>Version of your system (SVN revision)</li>
410 
        <li>Installation type (ZIPed SVN snapshot or SVN working copy)</li>
411 
        </ul>
412 
        <p>ViaThinkSoft will store this data internally and publish parts into the public directory service located at <a href="https://oidplus.viathinksoft.com/oidplus/?goto=oid%3A1.3.6.1.4.1.37476.30.9">https://oidplus.viathinksoft.com/oidplus/?goto=oid%3A1.3.6.1.4.1.37476.30.9</a> :</p>
413 
        <p>The public record contains:</p>
414 
        <ul>
415 
        <li>System ID</li>
416 
        <li>Public key</li>
417 
        <li>Current URL</li>
418 
        </ul>
419 
        <p>The other information will stay on the ViaThinkSoft internal database and will not be shared with other parties.</p>
420 
        <p>If the system admin enabled this option and want to revoke the permission, the system admin has to change the privacy level in the administrator login / control panel. The system will automatically contact the ViaThinkSoft server again and performs a deletion of all data.</p>
421 
        <p>Please note that the deletion of the record in the directory service does not delete OID/RA information which is already submitted at oid-info.com (if option 0 was chosen). To delete this data, the system admin needs to contact the OID Repository Webmaster at <a href="mailto:admin@oid-info.com">admin@oid-info.com</a></p>
422 
        <h3><em><u>Publish RA/OID data at oid-info.com (option 0)</u></em></h3>
423 
        <p>If privacy level option 0 is chosen, the system regularly contacts the ViaThinkSoft server through a secure connection and sends the public RA/OID data. ViaThinkSoft will store this data and redirect it to the OID Repository Webmaster who will review the data and eventually submit it to the public repository www.oid-info.com</p>
424 
        <p>If the system admin enabled this option and want to revoke the permission, the system admin has to change the privacy level in the administrator login / control panel to option 1 or 2 (to avoid that data is sent again). To remove already submitted OIDs, the system admin needs to contact the OID Repository Webmaster at <a href="mailto:admin@oid-info.com">admin@oid-info.com</a></p>
425 
        <h3><em><u>Hide system (option 2)</u></em></h3>
426 
        <p>If privacy level option 2 was chosen, the system will neither contact ViaThinkSoft, nor oid-info.com.</p>
427 
        <h2><strong><u>Log files</u></strong></h2>
428 
        <h3><em><u>Logs by OIDplus</u></em></h3>
429 
        <p>OIDplus manages log entries for specific events like logins, OID/RA modifications, creating and deletion of OIDs, etc.</p>
430 
        <p>These log messages are stored in the DBMS only.</p>
431 
        <p>All log events are visible to the system admin.</p>
432 
        <p>Some events are visible to the RA and/or the Superior RA.</p>
433 
        <p>Log events may show the IP addresses of the computer that was connected to the OIDplus system and the email address if the RA was logged in using their credentials.</p>
434 
        <p>OIDplus does not provide a function to delete log events. A deletion must be done in the database directly, e.g. using a database client like phpMyAdmin.</p>
435 
        <h3><em><u>Logs by host software, firewalls etc.</u></em></h3>
436 
        <p>Beside logs created by OIDplus, other client- or server-side software involved in processing the web requests (like the Apache web server, the PHP script interpreter, the MySQL database server, the Operating System, the web browser or various firewalls) might log traffic and queries in various ways. These logs are independent of OIDplus and need to be managed by the system administrator and/or network administrators.</p>
437 
        <p>If you are concerned about the contents of the log files, please contact the system administrator.</p>
438 
        <h2><strong><u>Cookies</u></strong></h2>
439 
        <p>OIDplus does only use cookies for the following purposes:</p>
440 
        <table border="1">
441 
        <tbody>
442 
        <tr>
443 
        <td width="122">
444 
        <p><strong>Cookie</strong></p>
445 
        </td>
446 
        <td width="114">
447 
        <p><strong>Category</strong></p>
448 
        </td>
449 
        <td width="139">
450 
        <p><strong>Usage</strong></p>
451 
        </td>
452 
        <td width="118">
453 
        <p><strong>Will be created:</strong></p>
454 
        </td>
455 
        <td width="126">
456 
        <p><strong>Will be deleted:</strong></p>
457 
        </td>
458 
        </tr>
459 
        <tr>
460 
        <td width="122">
461 
        <p>Login-Cookie</p>
462 
        </td>
463 
        <td width="114">
464 
        <p>Essential</p>
465 
        </td>
466 
        <td width="139">
467 
        <p>Contains a session key that is used to determine the user&rsquo;s log-in-state and the permissions.</p>
468 
        </td>
469 
        <td width="118">
470 
        <p>During login of a user or admin using their password.</p>
471 
        </td>
472 
        <td width="126">
473 
        <p>When the user is logged out, and/or the browser session closed.</p>
474 
        </td>
475 
        </tr>
476 
        <tr>
477 
        <td width="122">
478 
        <p>SSL-Detect-Cookie</p>
479 
        </td>
480 
        <td width="114">
481 
        <p>Essential</p>
482 
        </td>
483 
        <td width="139">
484 
        <p>If the option &ldquo;automatic SSL detection&rdquo; is enabled by the system admin, this cookie will check if the SSL port is open, to allow an automatic redirection of HTTP to HTTPS.</p>
485 
        </td>
486 
        <td width="118">
487 
        <p>During the first page visit</p>
488 
        </td>
489 
        <td width="126">
490 
        <p>When the browser session is closed.</p>
491 
        </td>
492 
        </tr>
493 
        </tbody>
494 
        </table>
495 
        <h2><strong><u>External JavaScripts</u></strong></h2>
496 
        <p>During the loading of the web page, various JavaScripts are included to improve the user experience and add essential functionalities. The basic scripts are the JavaScript files of OIDplus itself, which are stored on the server of the particular OIDplus installation.</p>
497 
        <p>There are two JavaScripts which are loaded from an external source/server:</p>
498 
        <h3><em><u>Polyfill (only if Internet Explorer is used)</u></em></h3>
499 
        <p>To make OIDplus compatible the web browser &ldquo;Internet Explorer&rdquo;, OIDplus will include a JavaScript script from &ldquo;polyfill.io&rdquo; which is a service by Financial Times.</p>
500 
        <p>Please see their <a href="https://polyfill.io/v3/privacy-policy/">Privacy Policy</a> and <a href="https://polyfill.io/v3/terms/">terms of service</a> for more information.</p>
501 
        <p>The polyfill JavaScript is only included if OIDplus detects that the web browser is Internet Explorer.</p>
502 
        <p>To disable the Polyfill feature, the system administrator needs to delete the following line in the source code file &ldquo;oidplus.js&rdquo; in the folder of the OIDplus installation.</p>
503 
        <p><code>oidplus_loadScript('https://polyfill.io/v3/polyfill.min.js?features=fetch%2CURL');</code></p>
504 
        <p>The deletion of this line on server-side and/or the blocking of the JavaScript on client-side will result in the page not working on &ldquo;Internet Explorer&rdquo; web browser.</p>
505 
        <h3><em><u>ReCAPTCHA (only if &ldquo;ReCAPTCHA&rdquo; is enabled)</u></em></h3>
506 
        <p>To protect sensitive functions of OIDplus (e.g. the login form) from hackers, the system administrator can enable &ldquo;ReCAPTCHA&rdquo; which is a service of Google. Before enabling ReCAPTCHA in the OIDplus setup/settings, the system administrator has to request an API key from Google. The usage of ReCAPTCHA will probably introduce additional cookies which are out of the control of OIDplus.</p>
507 
        <p>Please see <a href="https://policies.google.com/privacy">Google&rsquo;s Privacy Policy</a> and <a href="https://policies.google.com/terms">terms of service</a> for more information.</p>
508 
        <p>If the system administrator has not enabled the ReCAPTCHA feature, no external script will be included at all.</p>
509 
        <p>If the feature is enabled, blocking the ReCAPTCHA JavaScript on client-side will result in various functionalities (like the login form) not working.</p>
510 
        <h2><strong><u>Additional security / access controls</u></strong></h2>
511 
        <p>System administrators can choose other methods to disable access from the public, e.g. by using firewalls (so that clients cannot access the server at all) or by setting up a password protection at the level of the web server software (e.g. &ldquo;Basic Auth&rdquo; on Apache) on web-server level (so that the clients cannot access the directory where OIDplus is installed in).</p>
512 
        <h2><strong><u>Encrypted network connections</u></strong></h2>
513 
        <p>The server administrator is responsible for securing the network connections using &ldquo;HTTPS&rdquo;. This is done at web server level (i.e. an Apache module/setting) and independent from OIDplus.</p>
514 
</body>
515 
 
516 
</html>
517