OASIS Security Information

This article describes OASIS architecture and its impacts on security. The software is continually changing and evolving, so some information may become out of date.

For more information, contact OASIS Support by email at Support@OasisSalesSoftware.com or by phone at 501-843-6750.

Architecture Notes

• Legacy OASIS is a 2-tiered client server Java based SWING application
• The UI for OASIS O4 is browser based only (HTML 5 CSS and javascript)
• O4 extends the existing architecture using a secure sync technology
• Both legacy and OASIS O4 maybe used together as a hybrid implementation
• If activated, the Customer Portal allows customers of the OASIS user to access shipping and other information
• Published JSON APIs are available

Legacy OASIS

• Legacy OASIS is currently the dominant OASIS implementation
• Design assumes the system will be used behind a firewall
• Any use of legacy OASIS outside the firewall should be over a VPN
• The key file to protect for legacy OASIS is the preferences file
• Database connect information is store in the preference file
• Legacy OASIS can be used with SQL Anywhere, SQL Server, or Oracle

O4

• O4 is a browser-based version of OASIS with the same features
  • 2019 – Read only quote information, samples, some reports and “tiles”
  • 2020 – Began beta testing the O4 Project editor
  • 2021 – Finishing Project editor beta and starting submittals beta
  • 2022 – Orders and accounting features will be in BETA (early release now)
• Over time, the O4 browser version will replace legacy OASIS
• Access is https – although http is allowed for testing
• Data is always stored in two data centers for redundancy
• Architecture is not published for security reasons
• One of the data centers may be on a hosting service

Database Sync Technologies

• Efficiently moves OASIS data across the internet with the ability to prioritize transactions
• Data is sent using https and a series of security tokens
• Hybrid solution supporting any database supported by OASIS
• The Sync technology is an add on service included with OASIS O4

Support Services

• All services are https based using various network protocols
• Locator Service – and OASIS service used to locate network-based services (e.g. support services)
• Software Update – OASIS service for delivering updates to legacy OASIS
• Support Notification Service – Not used a lot, but a rapid notification service to indicate support service is required (e.g. version out of date)
• Open Ticket – A support service allowing user to send information about software errors for the support team to resolve
• Submittal Subscription – manufacturer published specification sheets pre-annotated by Ingen Software
• Configurator Services – relay to pass data between a manufacturer’s product configurator website and OASIS

JSON/REST Connectivity

• User requests to pull data from OASIS are best solved using JSON
• Users already using JSON to pull data into reporting systems like Microsoft’s Power BI
• Current implementation requires a user and password for security – this will change in the future to allow tokens to be generated instead
• Only published JSON calls will be supported
• JSON connectivity is not available in legacy OASIS only implementations (O4 web services are required)

Manufacturer Connectivity

• Protocols and security vary based on implementation
• Connectivity software can only be developed and certified by Ingen Software
• Only connectivity points pre-defined by Ingen Software are implemented and documented on the OASIS support sites