K2 Site Configuration

You can do the following on the K2 Site Configuration page:

Create the K2 Site.
Select an existing site if one exists.
Select a binding if multiple IIS bindings are used.

If you create a new site with the installer, a K2 Self Signed Certificate will be automatically generated and used. If you choose an existing site, that site must already have a certificate.

When selecting "Use an existing Web Site", this site must already exist.

Depending on your environment, you may see a slightly different screen to the one shown here. You will at least see the Create a new Web site option.
On a simple full installation (single server) the Setup Manager uses the K2 User Account seen in the image below for the Application Pool, the K2 Service Account and the K2 Administrator account.
When doing a custom installation, you will see a slightly different screen where you can enter three different accounts (App Pool, Service, and Admin).

Feature	Description
Create a New Web Site	If you want to create a new site, type the name in the Web Site Name field, and K2 will create it automatically.
Use an Existing Web Site Name	The name of the site that was created under IIS. Use the Bindings button to select which binding to use. Note: The site can be created without closing the K2 Setup Manager. Click Refresh to reload the list of available web site options.
Test the User Account credentials	To test the username / password combination, click the Test button.

Feature

Description

Create a New Web Site

If you want to create a new site, type the name in the Web Site Name field, and K2 will create it automatically.

Use an Existing Web Site Name

The name of the site that was created under IIS. Use the Bindings button to select which binding to use.

Note: The site can be created without closing the K2 Setup Manager. Click Refresh to reload the list of available web site options.

Test the User Account credentials

To test the username / password combination, click the Test button.

If no site is listed in the Web Site drop down, one may need to be created. Type in the name of the web site you want to create, and K2 will do the rest. If a site was recently created and does not display, you may need to perform an IIS reset. Then, click the Refresh button on this page.

Bindings button and pop-up page

Bindings refers to the bindings for the website as set up in IIS.

The Setup Manager takes care of Bindings configuration in the background, the bindings page is not shown unless you click the Bindings button. The Bindings page is hidden except under the following conditions:

The Bindings page will be shown if you have a Binding on your website set up in IIS with a wildcard certificate and with no host name entry. In this case the Bindings page will show a Binding in this format:
https://[MachineName].[domain].com:443
You're free to use this if you do not want to set up a Host Header. If you want to use a Host Header, see the following points:
- If you select this Binding and are using IIS 7.5 (legacy), you will need to resolve the Binding by following the steps shown in this article:
  http://www.sslshopper.com/article-ssl-host-headers-in-iis-7.html
- If you are using IIS 8, simply edit the Binging in IIS and enter a host header.

If, during an Upgrade or Reconfigure, the selected Bindings don't match the STS Issuers in the database, the Resolve STS Issuers page will be shown. See the Resolve Security Token Service Issuers topic for more information.

Configure K2 Sites to use HTTPS Protocol

K2 recommends that you use the SSL (HTTPS protocol) when configuring K2 sites (Viewflow, K2 Designer, and SmartForms Runtime sites). If you don't use SSL you run the risk of unencrypted site traffic being intercepted.

If you configure all K2 sites to use SSL (HTTPS protocol), K2 recommends setting cookies as secure (described below). Using secure cookies prevents sending authentication and other cookies over unencrypted HTTP.

If your environment is not using HTTPS bindings to access Smartforms or Viewflow, you should reconfigure your bindings to use SSL to benefit from the added security in K2 Five.

Possible errors in mixed-protocol environments

In environments using both SSL and non-SSL bindings, cookies may be incorrectly set to secure. For example, the Designer site is set to HTTP but the runtime site is set to HTTPS. If accessing the site over HTTP when cookies are set to secure, the following issues will occur.

If you open the runtime site (configured for HTTPS) first and then open the Designer site, you get redirected to the login page. If you are using Windows STS you see a blank page that is stuck in a loop trying to authenticate you. If you are using Forms STS, you are redirected to the login page where you can enter credentials but you are returned to this page even if you submit valid credentials.

If you do encounter these issues you must disable secure cookies.

Enable or disable secure cookies

To enable or disable secure cookies, you must change the web.config file of each site (Viewflow, K2 Designer, and SmartForms Runtime sites) in the two places mentioned below:

Set the requireSSL value to either true or false:

<system.identityModel.services>
<federationConfiguration>
<cookieHandler requireSsl="false" path="/" />
<system.web>
<httpCookies httpOnlyCookies="true" requireSSL="false"/>

If the K2 Five Upgrade Manager does not detect HTTP bindings, cookies are set to secure.

Strict-Transport-Security (HSTS)

K2 recommends enabling HSTS if your K2 sites and web endpoints make use of SSL (HTTPS). In short, enabling HSTS tells the client browser to force the use of HTTPS for the domain.

See the HTTP Strict Transport Security Cheat Sheet for information on HSTS.

If you have non-K2 related sites and web services that use HTTP and the same host header, but run on different ports, these services could start failing if HSTS is enabled.
If HSTS is enabled by mistake and you run into issues due to a mixed protocol configuration, you can disable it by completely removing the following entry under the ViewFlow, K2 Designer, and SmartForms Runtime web.config files:
<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="Strict-Transport-Security" value="max-age=5184000;" />

What to do on this page

If the K2 Site is going to be installed over a load balanced environment, enter the load balanced URL here. Also, if HTTPS is chosen for the web site, you need to have already set up the binding and certificate.

To configure the K2 Site:

Option 1- Create a new web site:

Enter the name for the New web site or keep the default name, K2.
Click Next to proceed.
The Setup Manager will create the new web site.

Two bindings will be created with the default set to HTTP. The bindings page will not be shown unless you click on the Binding button and this is the only time a security certificate will be created (K2 self sign cert).

Option 2 - Use an existing Web site:

Select the web site to use from the Web Site drop down menu.
Click Next to proceed.

The bindings page will be shown next and a default selected. If HTTPS is selected, you must use your own security certificate. Only 2 binding may be chosen, 1 of each type.