Origins Release. Platform Installation Guide

Transcription

1 Origins Release Platform Installation Guide

2 igrafx Origins Release Platform Installation Guide igrafx, LLC. All rights reserved. The following software is the property of igrafx, LLC or its licensors and is protected by U.S. and international copyright laws: igrafx Platform, igrafx FlowCharter, igrafx Process, igrafx Process for Six Sigma, igrafx Enterprise Modeler, igrafx Enterprise Modeler Server. Any unauthorized reproduction in whole or in part is strictly prohibited. igrafx, Swimlane, igrafx FlowCharter, igrafx IDEF0, igrafx Process and igrafx Enterprise Modeler are trademarks or registered trademarks of igrafx, LLC and/or its subsidiaries in the U.S. and/or other countries. Adobe PDF is a registered trademark of Adobe Systems Incorporated in the United States and/or other countries. igrafx provides certain modeling and diagram objects in support of and based on the LEAD Reference Framework. Microsoft, Word, Excel, PowerPoint and SQL Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. SAP, the SAP logo and SAP Solution Manager are registered trademarks of SAP AG in Germany and in several other countries. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. MINITAB and all other trademarks and logos for the Company's products and services are the exclusive property of Minitab Inc. All other marks referenced remain the property of their respective owners. See minitab.com for more information. JMP is a registered trademark of SAS Institute Inc. in the USA and a trademark in all other countries. SQL Server 2014 Copyright 2014, Microsoft Corporation. All rights reserved. All other product, font and company names and logos are trademarks or registered trademarks of their respective companies. Not all of the above-referenced components are included in all versions of the software. Revision: Nov. 06, 2015

3 Contents Installing the igrafx Platform 7 Database Setup 8 Install SQL Server 8 Installing SQL Server Create a Database 10 Create a Database User 11 SQL Server 11 Oracle Scripts 12 Installation: Pre-deployed igrafx Platform on Windows 13 Install the Application Server 13 Next Steps 14 Installation: Pre-deployed igrafx Platform on Linux 15 Install the Application Server 15 Next Steps 16 Installation: GlassFish on Linux 17 Install GlassFish on Linux 17 3

4 Install the Oracle JDK 17 Download and Install GlassFish 17 Delete the Default Domain 19 Create a New Domain 20 Access the Secure Admin Console 21 Deployment via Glassfish Web Admin Console 22 Next Steps 24 Installation: Optional Steps 26 Installation: Connect the igrafx Platform to the Database 27 General Settings 27 Database Settings 29 Next Steps 32 Configuring a Proxy 33 Install Apache 33 Create a Configuration File 33 Enable the Configuration 35 Configure Tomcat for Use with a Proxy 36 Configuring Authentication 37 4

5 Default Security (Login Form) 37 SPNEGO/Negotiate with Login Form Fallback 38 Server-side Setup 38 Server-side Logging 39 Client-side Setup 39 Internet Explorer 39 Firefox 40 Chrome 40 igrafx Client 40 JASIG CAS (Central Authentication Service) 40 Preauthentication Scenarios 41 Managing Repositories 42 Creating a New Repository 42 Registering an Existing Repository 44 Renaming an Existing Repository 45 Disabling, Unregistering or Deleting a Repository 45 Disabling a Repository 46 Unregistering a Repository 46 5

6 Deleting a Repository 47 Migrating Repositories from Earlier igrafx Versions 47 Using the Migration Wizard 48 Specifying Mappings for Users 48 Specifying Mappings for Groups 49 Specifying Mappings for Item Roles 49 Default Role Mapping 50 Selecting Repository Level Rights to Import 50 6

7 Installing the igrafx Platform The igrafx platform is available in various installation packages for specific application server types. Please see the Licensed Software Download page at for the available packages and a short description of their content. Installing the igrafx platform involves the following steps: 1. Creating a database to hold the igrafx platform repositories. 2. Installing the igrafx platform application server. 3. Configuring a proxy. 4. Configuring authentication methods for the igrafx platform. 5. Creating a repository in igrafx Platform Administration. These steps are detailed in the following sections. Database Setup on page 8 Installation: Pre-deployed igrafx Platform on Windows on page 13 Installation: Pre-deployed igrafx Platform on Linux on page 15 Installation: GlassFish on Linux on page 17 Configuring a Proxy on page 33 Configuring Authentication on page 37 Managing Repositories on page 42 7

8 Database Setup Before you install the igrafx platform, you need to do the following database setup tasks: 1. Install Microsoft SQL Server. 2. Create the required databases. 3. Create and map a database user. These steps are described in the following sections. Some have special requirements depending on the database server you use. The explanations provided here use Microsoft SQL Server as an example. The required Oracle scripts, without detailed explanation, are listed in Oracle Scripts on page 12. Install SQL Server Microsoft SQL Server 2014 can be included as an option with your purchase of the igrafx platform. Alternatively, the igrafx platform runs on any supported version of Microsoft SQL Server. igrafx supports SQL Server 2014 supplied by igrafx, but does not provide technical support for SQL Server products purchased from Microsoft. Installing SQL Server 2014 Before installing SQL Server 2014, check the system requirements for running it at microsoft.com. The Microsoft SQL Server installer uses a wizard to prompt you through the installation steps. For setup to continue, you must click the Yes button to accept the license agreement when requested. For more detailed installation instructions, system requirements, and additional information related to Microsoft SQL Server, see the Microsoft resources that are available on the microsoft.com website or in the Planning section of the SQL Server setup wizard. To install SQL Server 2014, do the following: 8

9 1. Insert the Microsoft SQL Server 2014 DVD. 2. Run the setup.exe program. 3. Click System configuration checker. If the checker reports any issues, it is recommended that you fix the issues before continuing with the installation. 4. Click Installation in the navigation area on the left. The Installation dialog box appears. 5. Click New SQL Server stand-alone installation or add features to an existing installation. 6. Follow the prompts in the Microsoft SQL Server Setup wizard. Note the following igrafx platform requirements (other configuration options can use the default settings or be configured as desired): On the Feature Selection page, select the following features: Database Engine Services Full-Text and Semantic Extractions for Search Management Tools - Complete Documentation Components (optional). On the Server Configuration page, Service Accounts tab, specify the Account Name, Password, and Startup Type for SQL Server Database Engine and SQL Full-text Filter Daemon (if you wish to use full text search on your repositories). The logon Account Name and Password can use built-in system accounts, a local account, local group, domain group, or domain user accounts for SQL Server services. igrafx recommends assigning the minimum level of user rights available. Set the SQL Server Database Engine Startup Type to Automatic and set the SQL Full-text Filter Daemon Startup Type to Manual. For more information, see the SQL Server Configuration - Service Accounts topic in the SQL Server 2014 Books Online. On the Database Engine Configuration page, Server Configuration tab, choose Mixed Mode. This enables the Microsoft SQL Server Management Studio to define a local Microsoft SQL server user that can be used to connect the igrafx platform application server with 9

10 the database backend. Alternately, you can obtain an Active Directory user or service account from your IT department to use for administration and connecting from the application server to the database server. Create a Database igrafx supports Microsoft SQL Server and Oracle servers. You can install SQL Server 2014 from the igrafx platform installation media, if you purchased it with your igrafx platform license, or use your own licensed installer. The required steps are summarized in Database Setup on page 1. There are two different types of table structures required by the igrafx platform: the administrative tables and the repository tables. These two structures can share the same database or can be separated into different databases. You can also combine multiple repositories into one database. Having repositories share the same database is not recommended in an environment where you require backups of individual repositories, because if you need to roll back to a database backup and you have more than one repository in a database you will restore all of them at the same time even if no restore is required for the other repositories. The ideal scenario depends on your environment and backup requirements. Sharing the same database for multiple repositories is useful if you are not interested in individual backups and want to keep the number of databases as low as possible. Also, if you have only one repository, you may prefer having the administrative tables together with the repository to share the same backup and keep them consistent. For the best performance and data security, keep the administrative tables and repository tables separate, and avoid having more than one repository per database. All backups should be made on the same schedule, to ensure consistency if a recovery is required. To create a database, do the following: 1. Open Microsoft Server Management Studio. 2. Right-click on the Databases folder and select New Database. 3. Specify a database name. 4. Optionally, on the Options tab, change the settings for collation, etc., to meet your requirements. 5. Click OK to create the database. 10

11 Create a Database User To connect the igrafx platform application server with the database, you need either a local or directory (i.e. Active Directory) user. The roles or permissions required for this user depends on the database version you use. If you use multiple databases, as described above, you can use the same or separate users depending on your needs. SQL Server To create a SQL Server user, do the following: 1. Open Microsoft Server Management Studio. 2. Right-click on the Security / Logins folder and select New Login. 3. Add a Windows or SQL Server authenticated user. 4. On the Server Role page, keep the public default role. 5. On the User Mapping page, map the user to the database and assign the following database roles: public db_owner Or, alternately: public db_datareader db_datawriter db_ddladmin 11

12 Oracle Scripts The scripts provided below are a suggestion only, and will require adjustment to meet your corporate standards, system requirements, and performance needs. -- Administrative Tables CREATE TABLESPACE IGRAFX_ADMIN datafile 'IGRAFX_ADMIN.dbf' size 64 M autoextend on next 32 M maxsize 512 M extent management local; -- Repository Tables CREATE TABLESPACE IGRAFX_REPO datafile 'IGRAFX_REPO.dbf' size 512 M autoextend on next 512 M maxsize M extent management local; -- ROLE CREATE ROLE IGRAFX_RL_OWNER; GRANT CREATE SESSION,ALTER SESSION,CREATE TABLE,CREATE VIEW,CREATE SYNONYM,CREATE PROCEDURE,CREATE SEQUENCE,CREATE MATERIALIZED VIEW,CREATE TRIGGER TO IGRAFX_RL_OWNER; -- USER for Admin tablespace CREATE TEMPORARY TABLESPACE IGRAFX_ADMIN_TMP TEMPFILE 'IGRAFX_ADMIN_TMP.dbf' size 32 M autoextend on next 32 M maxsize 512 M extent management local uniform size 16 M; CREATE USER IGRAFX_U_APP IDENTIFIED BY "igrafxpassword" default tablespace IGRAFX_ADMIN quota unlimited on IGRAFX_ ADMIN quota unlimited on IGRAFX_REPO temporary tablespace IGRAFX_ADMIN_TMP; GRANT IGRAFX_RL_OWNER TO IGRAFX_U_APP; -- USER for Repository tablespace CREATE TEMPORARY TABLESPACE IGRAFX_REPO_TMP TEMPFILE 'IGRAFX_REPO_TMP.dbf' size 64 M autoextend on next 64 M maxsize 512 M extent management local uniform size 16 M; CREATE USER IGRAFX_U_REPO IDENTIFIED BY "igrafxpassword" default tablespace IGRAFX_REPO unlimited on IGRAFX_REPO temporary tablespace IGRAFX_REPO_TMP; GRANT IGRAFX_RL_OWNER TO IGRAFX_U_REPO; -- Profile considerations CREATE PROFILE IGRAFX_PROFILE LIMIT PASSWORD_LIFE_TIME UNLIMITED; ALTER PROFILE IGRAFX_PROFILE LIMIT FAILED_LOGIN_ATTEMPTS UNLIMITED; ALTER USER IGRAFX_U_APP PROFILE IGRAFX_PROFILE; ALTER USER IGRAFX_U_REPO PROFILE IGRAFX_PROFILE; 12

13 Installation: Pre-deployed igrafx Platform on Windows This topic provides a full list of steps required to install the igrafx platform on Windows using a pre-deployed igrafx platform on an Apache Tomcat server. Note: These instructions are based on Microsoft Windows Server 2012 R2, but should similarly apply to other Windows Server versions as well. Install the Application Server 1. Transfer the file igrafxplatform-16.x.x.xxxx-origins-full.zip to the host. 2. Extract the zip file and place the resulting folder in the location you want the server to use. 3. Navigate to the \Windows folder. 4. Locate and double-click the file install_service.bat. Note: If you want to use a different port, you can specify one by starting the script from a command line and appending the desired port, like this: install_service.bat Open a firewall for port 8080 or your manually-defined port. 6. Check the log file (\apache-tomcat \logs\catalina*.out) for error messages and resolve them as appropriate. 7. Check that the application runs at or the alternate port you specified. 13

14 Next Steps To complete the installation, you need to continue as described in the following topics: Finish the installation and connect the igrafx platform to the database as described in Installation: Connect the igrafx Platform to the Database on page 27. Create a repository in the new database as described in Creating a New Repository on page 42. For instructions on configuring a proxy, see Configuring a Proxy on page 33. For instructions on configuring authentication methods for the igrafx platform, see Configuring Authentication on page 37. Optionally, you can install extensions for the igrafx platform as described in Installation: Optional Steps on page 26. Finally, you can update your existing igrafx repositories, at version 15.x or earlier, to version 16.0 as described in the igrafx Repository Migration Guide. 14

15 Installation: Pre-deployed igrafx Platform on Linux This topic provides a full list of steps required to install the igrafx platform on Linux using Tomcat. These steps are detailed in the following sections. Note: This installation was tested with Ubuntu LTS, but can apply to other, similar versions and distributions. For alternate distributions, you may need to adjust the steps accordingly. Install the Application Server To install the igrafx platform, do the following: 1. Install the application. sudo apt-get install unzip sudo apt-get install default-jre 2. Transfer the file igrafxplatform-16*-full.zip to the host. unzip -qud ice igrafxplatform-16*-predeployed.zip sudo chmod +x ~/ice/linux/igxinstall.sh cd ~/ice/linux/ sudo./igxinstall.sh 3. Run through the installation steps and accept the default settings, if possible. Then, open a browser and test to see if you can reach the application by accessing the hostname and specified port with the URL " For troubleshooting, see the log files in /opt/igrafx/ice/logs/ and /var/igrafx/icedata. 15

16 4. Transfer the extension.zip file to the host. unzip ~/extensions.zip sudo mv ~/extensions /var/igrafx/icedata/ sudo service igrafxplatform stop sudo service igrafxplatform start Note: The installation script creates user igrafxplatform, which is used to run the Tomcat service. The name of the Tomcat service is also igrafxplatform. It is not a requirement that those names be the same. Next Steps To complete the installation, you need to continue as described in the following topics: Finish the installation and connect the igrafx platform to the database as described in Installation: Connect the igrafx Platform to the Database on page 27. Create a repository in the new database as described in Creating a New Repository on page 42. For instructions on configuring a proxy, see Configuring a Proxy on page 33. For instructions on configuring authentication methods for the igrafx platform, see Configuring Authentication on page 37. Optionally, you can install extensions for the igrafx platform as described in Installation: Optional Steps on page 26. Finally, you can update your existing igrafx repositories, at version 15.x or earlier, to version 16.0 as described in the igrafx Repository Migration Guide. 16

17 Installation: GlassFish on Linux This topic provides a full list of steps required to install the igrafx platform on Ubuntu using Oracle GlassFish. These steps are detailed in the following sections. Note: These instructions were created using GlassFish and tested with Ubuntu LTS. Install GlassFish on Linux The following installation steps create a GlassFish environment in which multiple ICE instances can be hosted in parallel. Install the Oracle JDK Install the Oracle SDK with the following commands: sudo add-apt-repository ppa:webupd8team/java sudo apt-get update sudo apt-get install oracle-java8-installer sudo apt-get install oracle-java8-set-default Download and Install GlassFish If you a require a version other that GlassFish 4.1.1, please check the Oracle Glassfish Download page for more information. Note: You may need to adjust the steps described here to accommodate variations in different versions of GlassFish. If your company has a standardized GlassFish environment, we recommend using that existing environment. This means that the installation path, required settings and options specified here may differ from your environmental and security requirements. Download GlassFish wget 17

18 Extract the zip file. sudo apt-get install unzip sudo unzip -qd /usr/share/igrafx ~/glassfish zip Add the binaries directory to the PATH variable. sudo vi /etc/profile.d/glassfish.sh //Add the following line to the file: export PATH=/usr/share/igrafx/glassfish4/bin:$PATH //Save the file and make it executable, then run it: sudo chmod +x /etc/profile.d/glassfish.sh sudo /etc/profile.d/glassfish.sh Create a group and a user for GlassFish. sudo addgroup --system glassfish sudo adduser --system --shell /bin/bash --ingroup glassfish glassfish sudo chown glassfish:glassfish /home/glassfish/.* If you want to use asadmin manually from the glassfish bash, you can add the following commands: sudo su glassfish echo "export PATH=/usr/share/igrafx/glassfish4/bin:\$PATH" >> ~/.bashrc exit 18

19 Increase the max number of open files limit for the user running GlassFish. sudo vi /etc/security/limits.conf //Add the following lines #Added during GlassFish installation glassfish soft nofile glassfish hard nofile //Open the following file: sudo vi /etc/pam.d/su //Add these lines to the open file: #Added during GlassFish installation session required pam_limits.so Change the permissions of the GlassFish directory. sudo chown -R glassfish:glassfish /usr/share/igrafx/glassfish4 Delete the Default Domain sudo su - glassfish asadmin delete-domain domain1 19

20 Create a New Domain Create a password file and add the required passwords. If you are no longer in the GlassFish user space you need to switch to it. vi ~/passwd.gf //Add these lines and replace the password with the one you you want to use for the new domain: AS_ADMIN_PASSWORD=password AS_ADMIN_MASTERPASSWORD=password //Change the permissions of the file: chmod 600 ~/passwd.gf The following commands create a domain called igrafx and start it. The "--passwordfile" option will feed the password into the creation process, and later, into nodes you might want to create. Another option would be "--savemasterpassword=true", but during cluster creation this produces a bit more work as the nodes require CLI interaction to be created. asadmin create-domain --passwordfile /home/glassfish/passwd.gf igrafx asadmin start-domain igrafx // You will be asked to provide a password to start the domain. You need to enter the password you specified in the passwd.gf file. Check that GlassFish is running by opening a browser and going to " Then, stop the server and exit the GlassFish user space. asadmin stop-domain igrafx exit The file glassfish will make GlassFish start at boot time. To use it, transfer the file igrafxplatform-16.x.x.xxxx-origins-ear.zip to the host. Extract it and move it to the appropriate folder. If you chose a different domain name than "igrafx", you must modify the file accordingly. That file also expects to find Java in /usr/lib/jvm/java-8-oracle. If you have it installed somewhere else, just change the JPS variable. unzip -qd ice igrafxplatform-16*-ear.zip sudo mv ~/ice/glassfish /etc/init.d/glassfish sudo chmod +x /etc/init.d/glassfish sudo chown root:root /etc/init.d/glassfish sudo update-rc.d glassfish defaults sudo update-rc.d glassfish enable 20

21 The script writes to a log file that prints any startup errors, so create that first. sudo touch /var/log/glassfish sudo chown glassfish:glassfish /var/log/glassfish Verify that the script works: sudo service glassfish start You will get an [OK] or [Fail] response in the CLI. For troubleshooting purposes, you can find some log files here: tail -n 200 -f /var/log/glassfish tail -n 200 -f /usr/share/igrafx/glassfish4/glassfish/domains/igrafx/logs/server.log You may consider some changes in the configuration depending on your environment. Again, those changes depend on your environment and usage scenario, and there are other options for optimizing the application server. sudo vi /usr/share/igrafx/glassfish4/glassfish/domains/igrafx/config/domain.xml //replace these two JVM options: -client -Xmx512m //with these: -server -XX:+AggressiveHeap -Xmx1400m -Xms1400m -Xss128k -XX:+DisableExplicitGC -XX:-UseLoopPredicate -XX:+UseCompressedOops Don't forget to restart the service after you've made those changes. Access the Secure Admin Console If you want to access the admin console from any machine other than the one you installed GlassFish on, you need to enable the admin console for remote access. If you deployed on a console-only Ubuntu setup (recommended) you have to do this step. In a production environment, it is not 21

22 desirable to have the admin console available publicly. You should take additional measures to secure the access to the console; for example, by limiting the access to a defined IP or subnet on the network level. To activate the secure admin console, you need to set up a password for the admin user, then activate the secure admin, followed by a restart of the domain. sudo su glassfish asadmin --port 4848 change-admin-password You will be asked for the admin username. Press the Enter key to use the default username. The next question is for the current admin password. As it is currently empty, just press Enter again. On the next two questions you need to provide the new password. asadmin --port 4848 enable-secure-admin asadmin --port 4848 restart-domain exit //In case you ever need to roll back and deactivate it: asadmin --port 4848 disable-secure-admin Now you should be able to access the admin console via Deployment via Glassfish Web Admin Console Before you can deploy the application, you need to prepare a couple of things on the GlassFish application server host. Create a folder that the application server is allowed to write to: sudo mkdir /home/glassfish/icebase sudo chown glassfish:glassfish /home/glassfish/icebase Add the extensions folder to icebase. See Installation: Optional Steps on page 26 for further information unzip ~/extensions.zip sudo mv ~/extensions /home/glassfish/icebase sudo chown -R glassfish:glassfish /home/glassfish/icebase 22

23 If you didn t install the GlassFish server in the previous section, you'll need to transfer the file igrafxplatform-16.x.x.xxxx-origins-ear.zip to the host and extract it. unzip -qd ice igrafxplatform-16*-ear.zip Then, log in to the admin console, using the username and password you set during the installation. The following steps depend on the actual scenario you want to install. You can use the admin server, a standalone server, or a cluster installation. You will need to adapt the steps to the desired installation scenario. For simplicity, we recommend deploying the application on top of the existing server instance. In the admin console, go to the System Properties subtab, and create system properties for igrafx.basedirectory log4j.configuration Provide the appropriate path setting depending on the choices you made earlier. Make sure you click the Save button, otherwise your changes will not be applied. 23

24 Go to the Applications page. Click Deploy. Select the Local Package option, then select the EAR file you just extracted. Keep all the defaults and click OK. Opening will now open the igrafx platform. Next Steps To complete the installation, you need to continue as described in the following topics: Finish the installation and connect the igrafx platform to the database as described in Installation: Connect the igrafx Platform to the Database on page 27. Create a repository in the new database as described in Creating a New Repository on page 42. For instructions on configuring a proxy, see Configuring a Proxy on page 33. For instructions on configuring authentication methods for the igrafx platform, see Configuring Authentication on page 37. Optionally, you can install extensions for the igrafx platform as described in Installation: Optional Steps on page

25 Finally, you can update your existing igrafx repositories, at version 15.x or earlier, to version 16.0 as described in the igrafx Repository Migration Guide. 25

26 Installation: Optional Steps As an option, igrafx may make extensions packages available to provide extra functionality to the igrafx platform. One such package contains the Google Analytics extensions that allow igrafx to gather anonymous utilization and performance statistics. These statistics don't contain any personal user information or content data; igrafx uses the collected statistics to improve the user experience and performance of the application. To install an extensions package, do the following: 1. Download the extension package from the igrafx Licensed Software Download page, 2. Extract the contents and place the \extensions folder in the basedirectory folder. The resulting folder structure will look like this:../igrafxdata/extensions/ga/ or /var/igrafx/icedata/extensions/ga. 3. Restart the service to activate the changes. The extensions folder may contain customizations developed specifically for you, or optional features that igrafx provides outside of the standard installation package. For more information, please contact your account manager or professional services contact. 26

27 Installation: Connect the igrafx Platform to the Database In a new installation, when you access the igrafx platform URL, you are automatically forwarded to an Installation page, where you can complete the installation from within the browser. This page has two sections: General Settings and Database Settings, which are described below. General Settings Figure 1 on the next page shows the General Settings section on the Installation page. 27

28 Figure 1. General Settings on the Installation page In the Administrator Username and Administrator Password fields, you define an initial user who can access the application after you have completed this setup step. You can keep this user, or you may want to delete this user at a later point in time, For example, you may want to delete this user after you have connected to your Active Directory in the UserManagement/Directories page and have real administrative users available. For the site URL, you must provide the DNS name you want to use for the application. You can change this later from the Administration area in the igrafx platform user interface, but it is important that you use a valid URL that you can access. If you are not sure, use the default value, which will be the hostname and port you opened this site with, such as If you use an invalid URL you may not be able to access the application later! 28

29 Database Settings In the Database Settings area, provide the details necessary for connecting the application with the database layer. The fields that appear in this area depend on the Database Type setting. The most common scenario, and the recommended one, is to use Microsoft SQL with a JDBC connection, as show in Figure 2 on the next page. 29

30 Figure 2. Database Settings for SQL Server on the Installation page Database settings for Oracle are shown in Figure 3 on the next page. 30

31 Figure 3. Database Settings for Oracle on the Installation page Specify values for all fields, then click the Test Connection button to make sure they are correct. Then, click the Install igrafx Platform button. 31

32 After the installation is successfully completed, the login screen appears. You can now log in to the application with the administrator user you just created. Next Steps Create a repository in the new database as described in Creating a New Repository on page 42. Manage igrafx platform users as described in the "Managing Users and Groups" topic in the igrafx platform Help. Add and activate new licenses on the License Management page. Configure a proxy as described in Configuring a Proxy on the next page. 32

33 Configuring a Proxy A proxy can be very useful for preventing exposure of the application server nodes and instances to the internet. The main reason for a proxy in this case is to make the application available via an URL defined by a DNS entry made by your network administrator and to route the default http port 80 to the network port the web server is actually using. These instructions cover using Apache to set up a simple HTTP proxy, in three steps: 1. Install Apache. 2. Create a configuration file. 3. Enable the configuration. Although this example uses an Apache proxy, you can use any other proxy or network routing solution by adapting the settings appropriately. Your network administrator can help you with identifying the required options for your infrastructure. If you installed a pre-deployed igrafx platform on Linux using Tomcat, be sure to also follow the instructions in Configure Tomcat for Use with a Proxy on page 36. Install Apache Install Apache and the required modules by issuing the following commands: sudo apt-get install apache2 apache2-utils sudo a2dissite default sudo a2enmod proxy sudo a2enmod proxy_http Create a Configuration File Create a virtual host configuration file by issuing the following command: sudo vi /etc/apache2/sites-available/igrafxplatform.conf 33

34 Copy the following template into the file. You must change the ServerName, ProxyPass, and ProxyPassReverse values to fit your requirements. It is recommended that you also set a VALID ServerAdmin address. 34

35 You need to make sure you provide the correct IP and Port for your instance. Depending on the installation scenario, your port may be different than You can discover the port through the admin browser, by accessing the server instance. Go to the Properties tab to see the values for HTTP_LISTENER_PORT. <VirtualHost *:80> ServerAdmin ServerName PUT_YOUR_DNS_NAME_HERE ProxyRequests Off ProxyPreserveHost Off ProxyPass / ProxyPassReverse / DocumentRoot /var/www <Directory /> Options FollowSymLinks AllowOverride None </Directory> <Directory /var/www/> Options Indexes FollowSymLinks MultiViews AllowOverride None Order allow,deny allow from all </Directory> ErrorLog ${APACHE_LOG_DIR}/error_proxy.log LogLevel warn CustomLog ${APACHE_LOG_DIR}/access_proxy.log combined </VirtualHost> Enable the Configuration The next step is to enable the virtual host created above. sudo a2ensite IGRAFXPLATFORM.conf sudo service apache2 reload 35

36 Configure Tomcat for Use with a Proxy Note: These instructions apply only to pre-deployed igrafx platform installations on Linux using Apache Tomcat. When Tomcat is used as the igrafx Platform application server, it needs to be configured to be aware of the proxy server. If you set up a proxy (Apache or otherwise), you need to make changes to the server.xml file located in the conf directory of your Tomcat server. In the server.xml file, find the following connector port settings: <Connector port="${igrafx.http.port}" protocol="http/1.1" connectiontimeout="20000" redirectport="8443" /> Change them as shown below: <Connector port="${igrafx.http.port}" protocol="http/1.1" connectiontimeout="20000" proxyname="put_your_dns_name_here" proxyport="80" redirectport="8443" /> After making these changes, be sure to restart Tomcat. 36

37 Configuring Authentication The igrafx platform supports a variety of authentication schemes in Kerberos, providing multiple methods for recognizing which users are currently logged in. To enable a specific authentication scheme, start your igrafx platform application server with the following system variable: -Dspring.profiles.active=profile_name Replace profile_name with the actual name of the profile. If no profile is specified, the default security profile will be used, which requires a login via a login dialog box when the user starts a new session. Depending on the profile, a few additional configuration variables need to be set. The authentication scheme you select will affect the way you can log in to the application through the web as well as through the client. Note: In all scenarios, it is assumed that the user that is authenticated also exists in one of the configured User Directories within the igrafx platform. For example, if you configure SPNEGO/Negotiate, but do not add your Active Directory as a User Directory within the application, the authenticated user will see a 403 Forbidden error page. The following schemes are available: Default Security (Login Form) below SPNEGO/Negotiate with Login Form Fallback on the next page Server-side Setup on the next page Client-side Setup on page 39 JASIG CAS (Central Authentication Service) on page 40 Preauthentication Scenarios on page 41 Default Security (Login Form) The default authentication scheme needs no special setup and will always require the user to enter their credentials, logging in through the 37

38 web as well as the client. If the profile name is not set, or is set to defaultsecurity, this scheme will be active. SPNEGO/Negotiate with Login Form Fallback The SPNEGO/Negotiate setup allows single sign-on from Windows computers using the web as well as the igrafx client. If SSO fails, the user will be redirected to a login form and can still log in using their credentials. There is configuration required on the server side as well as the client side. Once both sides are correctly configured, you will be automatically authenticated as your current Windows user when opening the browser and browsing to your igrafx platform instance. If the authentication fails, you will be forwarded to the form-based login. When SPNEGO is enabled on the server side, you can also use the igrafx client to connect to your igrafx platform instance by choosing "Use Single Sign-On" in the Open Repository dialog box. Note: Due to the SPNEGO/Negotiate protocol, you cannot log in using a browser or igrafx client on the same machine where your igrafx platform instance is running. You must use a second machine in the domain to test SSO. Server-side Setup After installing the igrafx platform, edit the file ICE_BASEDIRECTORY/igrafx.properties. If it doesn't exist, create it. Add the following three lines and populate them with the information required. Please contact your system administrator for information on how to create a principal and create a keytab, as well as on the contents of your krb5.conf (Linux) or krb5.ini (Windows). A guide can be found here: igrafx.usercentral.negotiate.principal=http/igrafx.local@igrafx.local igrafx.usercentral.negotiate.keytab=file:c:/ssowebapp.keytab igrafx.usercentral.negotiate.krb5conf=c:/krb5.ini 38

39 To allow authentication using Kerberos/Negotiate, use the profile name spnegosecurity. After making these changes, restart your application server. Caution: The igrafx platform currently ships with a JRE version that is tested with Kerberos. Not all JRE versions are guaranteed to support Kerberos authentication. Server-side Logging If there is any need to enable debugging, two things can be set to show more debug output. 1. In the igrafx.properties file, add the following line: igrafx.usercentral.negotiate.debug=true 2. Add the following to your log4j.properties file: log4j.logger.org.springframework.security.extensions.kerberos=debug After adding and saving both settings, restart your application server. Client-side Setup Internet Explorer Go to Tools > Internet Options > Security > Local Intranet > Sites > Advanced and add the host name where your igrafx platform instance is located to the list of trusted intranet sites. If the igrafx platform can be reached reached at specify igrafx.yourcompany.com and click Add. Note: If SSO usage is common in your company, it is most likely already configured in your network zone. 39

40 Firefox Open Firefox and type _about:config_ into the address bar. If there is a warning about potentially voiding your warranty, click I'll be careful. Type negotiate-auth.trusted into the search field. Only one entry should remain, network.negotiate-auth.trusted-uris. Double-click it and type in the host name of the server where your igrafx platform instance will be located. If the igrafx platform can be reached at specify igrafx.yourcompany.com. If you need to enter multiple URIs, separate them using commas. Note: If Firefox is not configured for SSO, it will not fall back to basic authentication, but will display a blank page instead. Chrome Chrome uses the same configuration information as Internet Explorer, so following the steps for Internet Explorer will allow this type of authentication for Chrome. igrafx Client There is no special configuration required within the igrafx client to allow "Negotiate." When connecting to a repository, choose "Use Single Sign- On." JASIG CAS (Central Authentication Service) After installing the igrafx platform, edit the file ICE_BASEDIRECTORY/igrafx.properties. If it doesn't exist, create it. Add or update the following lines and modify them to use your CAS server's URL: igrafx.usercentral.cas.logouturl= igrafx.usercentral.cas.casurl= igrafx.usercentral.cas.loginurl= To allow authentication using CAS, use the profile name cassecurity. After making these changes, restart your application server. 40

41 The CAS authentication scheme will work only for the web-based login. The igrafx client login will be the same as in the default authentication scheme. Resources: Preauthentication Scenarios When you are installing the igrafx platform on an application server that authenticates its users before they actually reach the deployed applications, the igrafx platform runs in a preauthenticated environment, where it is not necessary to authenticate the user because the server has done that. To enable this authentication scheme, use the profile name preauthsecurity. After making this change, restart your application server. The igrafx platform will then read the principal from the HTTP request that the application server passes on. The preauthentication scheme will work only for the web-based login. The igrafx client login will be the same as in the default authentication scheme. 41

42 Managing Repositories The Manage Repositories page lets you manage repositories in several ways. You can Create new repositories Register and migrate existing repositories that were created outside of this igrafx platform instance Rename, disable, unregister or delete existing repositories These capabilities are described in the following sections. Creating a New Repository To create a new repository, do the following: 1. Go to the /Admin/Repositories/Manage page by clicking Administration, and then Repositories in the main navigation area. The Manage Repositories page appears. 2. Click the Create New Repository button. The Create New Repository page appears. The Settings tab presents a list of fields to fill in, which can vary based on what you select in some of them, as follows: Repository Name This is the name that will be used for the repository in the igrafx platform UI. For example when someone needs to choose a repository from a list of available ones, this is the name that will appear in that list. It can include spaces and special characters such as hyphens, underscores, or other punctuation. Short Name This name is used to represent the repository in URLs and other places where the full Repository Name you specify may not be valid. It cannot be over 15 characters long or include special characters. 42

43 Connection Type The igrafx platform supports two methods for connecting to the back-end database: JDBC (Java Database Connectivity) provides a Java-based database connection and is typically used with Oracle databases. A JDBC connection is required if you want to have a single database hosting multiple repositories using the Table Prefix setting. JNDI (Java Naming and Directory Interface) is a Java-based directory service that can discover and connect to the database using the value specified in the JNDI Name field. Database Type Hostname Port Specifies which of the two supported types of back-end database, Oracle or Microsoft SQL Server, that this database represents. The name of the host, for JDBC connections. This is typically the name of the computer that hosts the Oracle or Microsoft SQL Server database. For databases connected via JDBC, the UDP port that your database instance is listening to. Database name SID Schema For Microsoft SQL Server databases connected via JDBC, the actual name of the database that you re connecting to. For Oracle databases connected via JDBC, the identifier of the Oracle instance to be used for this repository. For Oracle databases connected via JDBC, the identifier for the Oracle schema to be used for this repository. 43

44 Table Prefix For databases connected via JDBC, specify a value for this setting if you want to store more than one repository in a database. If you specify a table prefix, all of the database tables for this repository will be created with this prefix, allowing you to create other repositories in the same database using other database prefixes. JNDI Name User Password For databases connected via JNDI, the name or string used to identify the database to JNDI. For databases connected via JDBC, specify your user name in the database. For databases connected via JDBC, specify your database password. 3. Click the Create New Repository button. If all settings were correct, you are returned to the Manage Repositories page, where the repository you just created appears in the list of available repositories. Registering an Existing Repository The igrafx platform lets you register existing repositories those that were created with other instances of the igrafx platform to make them available in this instance. If you are migrating a repository from an earlier version of igrafx version 15, specifically see the migration instructions in Migrating Repositories from Earlier igrafx Versions on page 47. To register an existing repository to this instance of the igrafx platform, do the following: 1. Go to the /Admin/Repositories/Manage page by clicking Administration, and then Repositories in the main navigation area. The Manage Repositories page appears. 2. Click the Register Existing Repository button. The Register Existing Repository page appears. The Settings tab presents a list of fields to fill in, which can vary based on what you select in some of them, as described in Creating a New Repository on page

45 3. Click the Register Existing Repository button. If all settings were correct, you are returned to the Manage Repositories page, where the repository you just registered appears in the list of available repositories. Renaming an Existing Repository When creating new repositories or registering existing ones, you may find it necessary to rename a repository. In that case, do the following: 1. Go to the /Admin/Repositories/Manage page by clicking Administration, and then Repositories in the main navigation area. The Manage Repositories page appears. 2. In the list of available repositories, click the one you want to rename. The Manage [repository name] page appears. If necessary, select the Settings tab, which provides edit boxes for changing the two name settings for this repository. Repository Name This is the name that will be used for the repository in the igrafx platform UI. For example when someone needs to choose a repository from a list of available ones, this is the name that will appear in that list. It can include spaces and special characters such as hyphens, underscores, or other punctuation. Short Name This name is used to represent the repository in URLs and other places where the full Repository Name you specify may not be valid. It cannot be over 15 characters long or include special characters. Caution: Changing the Short Name of the repository can break external links to it and to objects it contains. When you edit either of these fields, a warning message appears, giving you the opportunity to cancel your edits. 3. When you have specified these two names, click the Save Changes button. Disabling, Unregistering or Deleting a Repository The Administrative tab on the Manage Repositories page lets you disable, unregister, or delete a repository, as described in the following sections. 45

46 Disabling a Repository Disable a repository if you want to make it unavailable, temporarily. You can easily re-enable it from the Manage Repositories page. To disable a repository, do the following: 1. Go to the /Admin/Repositories/Manage page by clicking Administration, and then Repositories in the main navigation area. The Manage Repositories page appears. 2. In the list of available repositories, click the one you want to disable. Then on the resulting Manage [repository name] page, click the Administrative tab. 3. Click the Disable button. It changes into an Enable button, indicating that the repository is disabled. Click this button to re-enable the repository, if necessary. You can also re-enable it from the list of repositories on the Manage Repositories page. Unregistering a Repository Unregister a repository when you want to make it unavailable from this instance of the igrafx platform, but do not want to delete it entirely. You can re-register it later, if necessary, as described in Registering an Existing Repository on page 44. To unregister a repository, do the following: 1. Go to the /Admin/Repositories/Manage page by clicking Administration, and then Repositories in the main navigation area. The Manage Repositories page appears. 2. In the list of available repositories, click the one you want to unregister. Then on the resulting Manage [repository name] page, click the Administrative tab. 3. Click the Unregister button. A Confirm Unregister button appears below the Unregister button and the words "Are you sure?" If you're not sure at this point that you want to unregister this repository, click an empty area of the page, and the "unregistration" is canceled. 4. To complete the unregistering process, click the Confirm Unregister button. The repository is unregistered. 46

47 Deleting a Repository To delete a repository, do the following: 1. Go to the /Admin/Repositories/Manage page by clicking Administration, and then Repositories in the main navigation area. The Manage Repositories page appears. 2. In the list of available repositories, click the one you want to delete. Then on the resulting Manage [repository name] page, click the Administrative tab. 3. Click the Delete button. A Confirm Delete button appears below the Delete button and the words "This can't be undone. It is permanent. All data will be deleted. Are you positive?" Caution: Deleting a repository cannot be undone. It is permanent. All data will be deleted. Be sure this is what you want to do before proceeding. If you're not sure at this point that you want to delete this repository, click an empty area of the page, and the deletion is canceled. 4. To complete the deletion process, click the Confirm Delete button. The repository is deleted. Migrating Repositories from Earlier igrafx Versions If you attempt to register a repository that was created in an earlier, 15-level version of igrafx, a migration wizard prompts you through the user/role/rights mapping decisions that are required for updating the repository to the current version. To migrate a version-15-level repository into the igrafx platform, do the following: 1. Access the igrafx platform in your browser. In the navigation area on the left, click Administration and then click Repositories. 2. On the Manage Repositories page, click the Register Existing Repository button. 3. On the Register Existing Repository page, the Settings tab presents a list of fields to fill in, which can vary based on what you select in some of them, as described in Creating a New Repository on page