Controlling Access to IOK files by Origin

Ensuring that Omniscope files cannot be forwarded or shared 

Domain-locking is a powerful and effective file security and revenue protection feature. Whereas Omniscope IOK files are normally free-standing and easily transferred (by e-mail attachment, FTP posting/downloading from web portals/pages/blogs, via folder synchronisation services like GDrive & Dropbox, etc.), domain-locked Omniscope files have the additional restriction that they must be opened directly from one and only one originating website download, meaning that the user attempting to open the file must have a current, valid User ID and Password credentials for the originating website to which the IOK is 'domain-locked'.

The Domain-locking option enables commercial publishers and others to require that anyone trying to open their files must be logged in to their website, and ensures that stale copies of files cannot be saved locally and forwarded to others. Sensitive corporate data can be protected such that if users' web credentials are revoked via AD/LDAP etc., they can no longer open or refresh any corporate Omniscope files they may still have copies of, because these files require http: authentication and are 'locked' to secure corporate domains. If an invalid user attempts to open a downloaded, forwarded, file-syched or otherwise locally-saved copy of a domain-locked file, Omniscope will not permit this and displays this notice:

Applying Domain Locking to an Omniscope file

In order to domain-lock a particular file, please follow the steps listed below:

1. Open the file you want to domain-lock.
2. Click on File > Save as 
3. Click the Domain-locked check box
4. Define/enter the domain restriction (see below).
5. Save the file and post it to the server

Defining the domain restriction

The domain restriction is a text string that specifies the top-level domain of the website you want to lock the file to. Do not enter the full web address; anything beyond just the domain will not work. For example, if you were to enter the domain "visokio.com", this would restrict the IOK file so it would only open from URLs such as:

"http://visokio.com/any/aaa/bbb/ccc/file.iok"

"http://www.visokio.com/any/path/to/file.iok"

"http://www2.visokio.com/file.iok"

If you were to enter "subdomain.visokio.com", this would restrict the .IOK/.IOM file so it would only open from URLs such as:

"http://subdomain.visokio.com/any/aaa/bbb/ccc/file.iok"

"http://www.subdomain.visokio.com/any/path/to/file.iok"

"http://www2.subdomain.visokio.com/file.iok"

Linking to domain-locked files

If you create a link directly to the domain-locked .IOK/.IOM file, this will not work, because the user's web browser downloads the file to a temporary location before starting Omniscope and opening the local copy.

You can test that domain locking is working by starting Omniscope and choosing Open from the web from the Open file dialog, then pasting the full URL to the .IOK/.IOM file such as "http://visokio.com/any/aaa/bbb/ccc/file.iok".

To create a smoother experience for the user, it is best to create a Visokio .ILF file on the server which references the domain-locked IOK/IOM file as follows:

• In Notepad, paste the full URL of the IOK/IOM file on the server into a blank text file
• Save as "filename.ILF", and upload to the server.
• Create a link to this .ILF file in the page content, instead of linking directly to the .IOK/.IOM file.
• Test by clicking this .ILF link in the browser...it should download the .ILF file to a temporary file and start Omniscope, which opens the ILF file and then the domain-locked IOK/IOM file directly from the server.

Example:

Here is a working example of domain-locking a file, testing the lock, than using an .ILF file link to provide access from HTML pages. 

Note: this demo visokio.com domain hasn't been password protected. Your domain generally will be password-protected.

 Bond Prices Demo file 

• This file is not domain-locked, therefore a locally-saved copy will open.

 Bond Prices Demo file - domain-locked

• This file is domain-locked to the visokio.com domain. If a locally-saved copy is opened, user will see the error message above.

Testing the domain-locked locked-status:

• To open a domain-locked file from a location other than the page it is locked to, start Omniscope and choose File > Open File > Open from the web, then paste the full URL of the file:

http://www.visokio.com/files/Resources/OUGuide/453_FileSecurity/Bond_prices_domain_locked.iok

Best practice is to link the user to the file via an Omniscope  .ILF file constructed as described above:

Click here to download the .ILF file pointing to the domain-locked file.