inubit 6.1 inubit Process Engine Administrator and Developer Guide

Transcription

1 inubit 6.1 inubit Process Engine Administrator and Developer Guide

2 Copyright Bosch Software Innovations GmbH Schöneberger Ufer Berlin Germany Phone: Fax: URL: Bosch Software Innovations GmbH 2013 Legal Provisions The information and data, including URLs and other references on an Internet basis, contained in this documentation may be changed without prior notice. The product documentation was carefully prepared. However, the information contained therein cannot be guaranteed to reflect the properties of inubit. The liability of Bosch Software Innovations GmbH encompasses only the provisions stated in the sales and delivery conditions. The users are responsible for compliance with all applicable copyrights. Regardless of applicability of the respective copyright laws, no portion of this document may be reproduced or transferred for any purpose, regardless of the means or resources used, electronically or automatically, without prior explicit written approval from Bosch Software Innovations GmbH. Bosch Software Innovations GmbH may be the owner of patents, patent applications, trademarks, copyrights or other rights of intellectual property that concern the content of this document. The provision of this document does not grant license rights to these patents, trademarks, copyrights or other intellectual property, unless this was explicitly granted by Bosch Software Innovations GmbH in a written license agreement. Software provided by Bosch Software Innovations GmbH may include software components of other producers. inubit is a registered trademark of Bosch Software Innovations GmbH. All other product and company names listed in this document may be registered trademarks of their respective owners.

3 Table of Contents 3 Table of Contents Notes on the Administrator and Developer Guide...13 Scope of the Documentation...13 Tips, Notes and Links in the Documentation...15 Further Information and Support The inubit Architecture Components Communication of the Components General Settings of the inubit Software Configuring Monitoring Configuring Audit Logs Configuring System Log Activating and Configuring Server Traces Workflow Logs Web Service Logs Adding User-defined Columns to Queue Manager or System Log Administering Users, Server, Proxy, Threads, Languages etc Configuring inubit User Accounts Activating the Maintenance Mode Activating Maintenance Mode Before Starting the inubit Process Engine Defining Name and ID of the inubit Process Engine Defining a Password for the Process Engine Defining Working Memory for Workflows Retrieving Status of the inubit Process Engine via HTTP Configuring the Thread Pool for Workflows LDAP User Synchronization Configuring Miscellaneous Allowing inubit Workbench Updates Defining a Test Workflow Defining a Notify Workflow Input Message for the Notify Workflow Defining a Tag Name Workflow Allow Saving Deployment Artifacts Internationalization: Defining Languages for Diagrams...42 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

4 4 Table of Contents MIME-Types Mapping Table Java System Properties Activating/Deactivating Notification of Changes Reporting Configuring Access to the Repository Configuring the Revision Configuring the Portal Server Configuring Portal Deployment Configuring the Solution Center Server Solution Center Portlet Configuration Installation Notes Installing via the Command Line Installing/Uninstalling inubit Process Engine as Service (Un)installing the inubit Process Engine as Service Under Windows Obtaining Administrator s Rights for Vista/Windows Installing the inubit Process Engine Under Linux as Service Post-installing Components of the inubit Software Installing Drivers Updating the License via inubit Workbench Configuring Tomcat and JBoss Configuring the Tomcat Application Server Configuring the JBoss Application Server Configuring Secure Connections Configuring SSL Connections and Server Authentication Activating Traces for HTTPS Connections Configuring a HTTP(S) Proxy Server for inubit Workbench and/or inubit Process Engine Configuring a Proxy Server between inubit Workbench and inubit Process Engine Configuring Proxy Server between inubit Process Engine and Remote Computers Changing HTTP(S) Ports Managing Users Changing the User-Specific Working Directory of the inubit Workbench Administrating Users Creating Users inubit 6.1: inubit Process Engine: Administrator and Developer Guide

5 Table of Contents Assigning Users to Additional User Groups and Editing the Assignment Editing Users: Assigning Roles and Groups, Defining Addresses Blocking User Manually Unblocking Users Deleting Users Changing User Passwords Using LDAP User Directories Configuring the Connection to the LDAP Server and the User Synchronization Importing User from the LDAP Directory Exporting Users/User Groups Importing Users/User Groups Managing User Groups Creating User Groups Renaming and Moving User Groups Deleting User Groups Managing User Roles Creating and Configuring Roles Deleting User Roles Using Process Roles Creating Process Roles Assigning Process Roles and Changing Existing Process Role Assignments Delete Role Assignments Deleting a Process Role Technical Monitoring Queue Manager: Monitoring Running Processes Queue Manager Functions Adding Columns in Queue Manager/System Log Scheduler Manager: Scheduled Processes Enabling and Disabling Schedulers Displaying the Configuration of the Scheduler Change Configuration of the Scheduler Starting Scheduled Processes Displaying Technical Workflows for Processes Connection Manager: Monitoring Systems Activating Watchdogs for Monitoring Systems Monitoring inubit Process Engines by Remote Computers inubit 6.1: inubit Process Engine: Administrator and Developer Guide

6 6 Table of Contents Updating Monitored Components Login in to Monitored Component Starting/Stopping Monitored Remote Connectors Key Manager: Managing Certificates Centrally Updating Certificates in the Key Manager Audit Log: Monitoring User Actions System Log Displaying Process Steps Displaying Error Messages Displaying Workflows Displaying Message Logs Restarting Processes Server Trace Log: Displaying Server Traces Workbench Trace Log Error Messages in Monitoring Remote Monitoring Using the Command Line Interface (StartCLI) Changing the Monitoring Table Views Navigating in Monitoring Tables Sorting Filtering the Table Contents Showing/Hiding Columns Moving Columns Saving, Displaying and Deleting Table Views Managing inubit Databases Switching inubit Monitoring Database Creating Tables and Columns in the inubit Monitoring Database Switching inubit Task Database Dialog Database Manager Alerting Events Triggering Alerts and Notification Paths Events Triggered by the System Environment Events Triggered by the inubit Process Engine Activating Notifications Activating the SNMP Alert inubit 6.1: inubit Process Engine: Administrator and Developer Guide

7 Table of Contents 7 10 Backup and Restore Backup and Restore Creating a Backup Restoring System or User/User Groups Point-in-Time Recovery (PITR) Activating and Configuring PITR Restoring an inubit System with a PITR-Archive Switching UDDI V3 to Oracle Creating Application and Diagram Profiles Application Profiles Functional Principle Locations for Storing Application Profiles Parameterizing Program Calls Diagram Profiles: Profiles for Modeling Elements Creating User-defined Tasks (BPDs only) Using the su Mode Remote Connector Installing a Remote Connector Configuring System Connectors as Remote Connectors Configuring a Secure Connection to the inubit Process Engine Activating HTTP-/HTTPS Communication with Remote Computers via a Proxy Server Starting a Remote Connector Manually Starting the Remote Connector as Service Managing Remote Connectors Monitoring Configuring Log File, Debug Level and Parser Expanding the Remote Connector Administering Liferay Version Portal Roles and Rights Liferay 5.2 Organizational Structures Organizations Communities User Groups and Users inubit 6.1: inubit Process Engine: Administrator and Developer Guide

8 8 Table of Contents 14.3 Managing Organizations Creating Organizations Assigning Organization Roles Adding Pages for Selected Organizations Managing Communities Creating Communities Defining Default Communities, Roles and User Groups Assigning Users, User Groups or Organizations to Communities Assigning Community Roles Adding Pages to a Community or Organization Deleting a Community Managing User Groups and Users Adding User Groups Creating Users Assigning Users to a User Group Assigning Users to an Organization, a Community or a Role Deactivating and Deleting Users Managing Portal Roles Creating Portal Roles Assigning Regular Roles Specifying Visibility of Pages for Selected Defining Default Roles Managing Portlets Adding Portlets to a Page Specifying Visibility of Portlets for Selected Roles Deleting Portlets Configuring Liferay Configuring Authentication Configuring Locales Configuring Password Policies Deploying Non-inubit Portlets Switching Liferay Database Synchronizing Liferay Users with LDAP Performing Backup Replacing Portal Logo Selecting Pre-defined Themes inubit 6.1: inubit Process Engine: Administrator and Developer Guide

9 Table of Contents Adding Themes Defining Layout Template for a Page Defining a Portal Name Load Balancing with inubit Portlets Administering Liferay Version Configuration of the Liferay Portal Enterprise Edition Enhancing the Enterprise Portal Portal Roles and Rights Organizational Structures Organizations Communities User Groups, Teams and Users Managing Organizations Creating Organizations Assigning Organization Roles Adding Pages for Selected Organizations Managing Communities Creating Communities Defining Default Communities, Roles and User Groups Assigning Users, User Groups or Organizations to Communities Assigning Community Roles Adding Pages to a Community or Organization Deleting a Community Managing User Groups and Users Adding User Groups Creating Users Assigning Users to a User Group Assigning Users to an Organization, a Community or a Role Deactivating and Deleting Users Managing Portal Roles Creating Portal Roles Assigning Regular Roles Specifying Visibility of Pages for Selected Defining Default Roles Managing Portlets Adding Portlets to a Page inubit 6.1: inubit Process Engine: Administrator and Developer Guide

10 10 Table of Contents Specifying Visibility of Portlets for Selected Roles Removing Portlets from Pages Configuring Liferay Configuring Authentication Configuring Locales Configuring Password Policies Deploying Non-inubit Portlets Switching Liferay Database Synchronizing Liferay Users with LDAP Performing Backup Replacing Portal Logo Selecting Pre-defined Themes Adding Themes Defining Layout Template for a Page Defining a Portal Name Load Balancing with inubit Portlets Defining the Session Timeout Security Measures User Administration Defining Patterns for Passwords (Minimum Length, Permissible Characters) Roles and Rights Data Visibility Communication and System Connections Executing External Programs and Shell Commands Code Injection Passwords for System Connectors Third-party Components JBoss Tomcat UDDI Patches for Tomcat and JBoss Checklist User Administration Checklist Connection Systems/Business Partner Checklist Hardening Optimizing Performance inubit 6.1: inubit Process Engine: Administrator and Developer Guide

11 Table of Contents Optimizing the inubit Software Optimizing the Java Virtual Machine (JVM) Optimizing Network and Hardware Benchmark Workflows Preparing and Executing Benchmark Workflows Configuring the Benchmark Suite and the Benchmark Procedure Creating Your Own Benchmark Workflows Setting Your Own Reference Values Displaying the Benchmark Report Calling Syntax of the Benchmark Script Clustering Load-sharing Cluster High-availability Cluster Installing Activating and Configuring Clustering Configuring Modules Implementing Thin Clients Function Calls Offered by the Thin Client Interface Listing Sample Implementations Example: Thin Client and SOAP Example: Thin Client with EJB/RMI Protocol Developing and Installing Plug-ins Developing Plug-ins Installing the Plug-in SDK Server Plug-ins Java-based Client Plug-ins Generating Wizards for Client Plug-ins Utility Classes Adding Plug-ins to inubit Software Installing Plug-ins Registering Plug-ins External Interface inubit 6.1: inubit Process Engine: Administrator and Developer Guide

12 12 Table of Contents 21.1 Generating an HTTP-Request Managing Tasks HTTP Requests Filtering and Sorting the Output Querying Models Parameters for Models and Nodes Querying Process Instances Querying Users and Roles Displaying a Diagram as a Graphic Retrieving a Report inubit 6.1: inubit Process Engine: Administrator and Developer Guide

13 Notes on the Administrator and Developer Guide 13 Target audience This guide offers detailed information for system administrators, system integrators and developers, who manage, configure and expand the inubit software or parts thereof. Required knowledge Developing new plug-ins Good Java knowledge and familiarity with usage of common Internet protocols Developing Thin Clients Good programming and SOAP knowledge, familiarity with usage of common Internet protocols Clustering and high availability Basic knowledge of the inubit architecture and its monitoring components as well as in-depth system administration knowledge Scope of the Documentation inubit provides comprehensive documentation and is available as a printed manual, a PDF file and as online help in the inubit Workbench. The documentation covers the following content: inubit - Quick Start Describes the hardware and software prerequisites, the installation and the first steps. - Migration Guide - Tutorials For novices. Using technical scenarios the tutorials detail the use of the most important components of inubit. inubit Workbench, inubit Process Engine und inubit Enterprise Portal: - User Guide Explains how to work with the inubit Workbench, the Designer, working with different diagram types, modules, with metadata and workflow variables, simulations, tests, technically-based monitoring and reporting. - Administrator and Developer Guide Administrative topics such as the configuration of inubit Process Engine, backup and restore, user administration, security aspects, monitoring and clustering, development of plug-ins and Thin Clients. - Modules Guide inubit 6.1: inubit Process Engine: Administrator and Developer Guide

14 14 Use and configuration of Data Converter, Format Adapter, Utilities, Workflow and Web Service Controls. - System Connectors Guide Everything involving the use and configuration of system connectors. inubit Solution Center User Guide Information about creating business models, working with Business Solutions, creating views, integrating processes and default models and the REST interface. - Administrator Guide Explains how to backup and restore data, to install the Solution Center as a service, to adjust ports, to configure the portal, the database and HTTPS, to manage users and import diagrams. inubit WebModeler Administrator and User Guide Everything about creating and editing models, adjusting ports, configuring the database and HTTPS. You can download the most current documentation in the inubit User Portal from the software tab at Further information The following information is enclosed as a booklet with the DVD, or as files in the installation package: readme.txt Notes on the installation and migration of inubit. Read this file thoroughly before installing or updating inubit! Quick Start System requirements and installation instruction as booklet delivered with the inubit-dvd. API documentation for plug-in software development kit Found under <is-installdir>/documentation/apidoc/ index.html. JavaScript-Framework of the inubit Found under <is-installdir>/documentation/jsdoc/ index.html inubit 6.1: inubit Process Engine: Administrator and Developer Guide

15 15 Tips, Notes and Links in the Documentation Tips offering useful information for working with inubit. Notes that must be read and observed. Failure to follow the instructions may lead to data loss or may cause serious system problems. References to other text locations within this or any other inubit manual are labeled with an arrow. Links to external web pages. Further Information and Support Press releases and white papers are available from our website For further inquiries, please contact our support by: Telephone: SupportSystem: We wish you every success in working with inubit. Your team from Bosch Software Innovations GmbH! inubit 6.1: inubit Process Engine: Administrator and Developer Guide

16 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

17 1 The inubit Architecture 17 This section details the following topics: Components, p. 17 Communication of the Components, p. 19 Overview The inubit software consists of different components which can be combined with each other for use in the most diverse application scenarios due to their consistency: Business Analyst Mobile Clients inubit Workbench inubit WebModeler inubit Enterprise Portal inubit Process Cockpit Task list inubit Solution Cockpit iphone Modeling & Simulation inubit Process Engine inubit Enterprise Service Bus View Engine Business Repository Legacy Application Legacy Application Legacy Application 1.1 Components inubit Workbench The inubit Workbench is a J2SE based client with a graphical user interface for the following tasks: Business modeling and simulation Technical configuration of the integration segments between the different systems and business partners Administration of the inubit Process Engine/Enterprise Service Engine and its users inubit 6.1: inubit Process Engine: Administrator and Developer Guide

18 18 The inubit Architecture Components Technical monitoring of the inubit software and its processes Refer to - General Settings of the inubit Software (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 21) - Managing Users (inubit Process Engine: Administrator and Developer Guide, chap. 6, p. 69) - Technical Monitoring (inubit Process Engine: Administrator and Developer Guide, chap. 7, p. 89) inubit Process Engine / Enterprise Service Bus (ESB) The inubit Process Engine/ESB are the core components of the inubit software. They ensure the process execution and the technical integration of systems and services. The inubit Process Engine/ESB run either as a servlet in the servlet engine Jakarta Tomcat or in the application server JBoss, depending on the licensed edition: Entry, Standard and Professional Edition The Entry, Standard and Professional Editions of the inubit software use Apache Jakarta Tomcat as Web and HTTP server. If you have installed the enclosed Tomcat, it is already reasonably configured so that the inubit Process Engine may be operated without requiring any further customization. For notes on configuration refer to Configuring the Tomcat Application Server (inubit Process Engine: Administrator and Developer Guide, chap. 4.1, p. 59). Enterprise and Enterprise Plus Edition The Enterprise and Enterprise Plus Editions of inubit software are based on the JBoss application server that uses Jakarta Tomcat internally as the Web server and Servlet engine. If you have installed the enclosed Tomcat, it is already reasonably configured so that the inubit Process Engine may be operated without requiring any further customization. For notes on configuration refer to Configuring the JBoss Application Server (inubit Process Engine: Administrator and Developer Guide, chap. 4.2, p. 60). In case business applications cannot be accessed directly for security reasons, then a Remote Connector can be deployed: A Remote Connector executes a system connector on a legacy system, remote systems or non-remote-capable systems and thus allows for its integration. Refer to Remote Connector (inubit Process Engine: Administrator and Developer Guide, chap. 13, p. 149) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

19 The inubit Architecture Communication of the Components 19 inubit Enterprise Portal The inubit Enterprise Portal is based on the Liferay portal server and can be used as a basis for a corporate intranet and for interacting with business partners. The inubit Enterprise Portal supports the open portlet standards JSR 168 and JSR 286. In the inubit Enterprise Portal the inubit WebModeler, the inubit Process Cockpit and the inubit Solution Cockpit can be integrated and aggregated in a uniform and user-friendly interface. Refer to Using inubit Enterprise Portal (Workbench: User Guide, chap. 20, p. 485). View Engine The View Engine is a part of the inubit Solution Center and allows for automatized generation and customization of user interfaces when implementing Business Solutions. Business Repository The Business Repository is used for central storing and managing data and information. Refer to Repository: Managing Files Centrally (Workbench: User Guide, chap. 19, p. 467). Mobile Clients Processes executed by the inubit software can also be controlled, edited and monitored via mobile terminals, for example iphones. 1.2 Communication of the Components Data formats Within the inubit software, XML is consistently used as a central data format, without prescribing a meta format. inubit Process Engine The inubit Process Engine/ESB and the application server (JBoss or Tomcat) form an integrated application. As a result, there is no communication via network components. Client/server communication The inubit Process Engine/ESB and the inubit Workbench use SOAP to communicate with each other via HTTP(S). inubit 6.1: inubit Process Engine: Administrator and Developer Guide

20 20 The inubit Architecture Communication of the Components This communication can be secured via SSL. It is thus possible to configure and administer the inubit Process Engine not only in the local network, but also remotely via an Internet connection secured by firewalls. System Connectors The inubit Process Engine/ESB can communicate with standard software via application-specific system connectors, for example with ERP systems, CRM systems or databases. Refer to System Connectors (Workbench/Process Engine: System Connectors Guide, chap. 1, p. 19). Remote Connector In case business applications cannot be accessed directly for security reasons, then a Remote Connector can be deployed: A Remote Connector executes a system connector on a legacy system, remote systems or non-remote-capable systems and thus allows for its integration. Remote Connectors use SOAP via HTTP(S) for communicating with the inubit Process Engine/ESB. Refer to Security Measures (inubit Process Engine: Administrator and Developer Guide, chap. 16, p. 237) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

21 2 General Settings of the inubit Software 21 This section details the following topics: Configuring Monitoring, p. 21 Administering Users, Server, Proxy, Threads, Languages etc., p. 25 Configuring the Portal Server, p. 47 Configuring Portal Deployment, p. 48 Configuring the Solution Center Server, p. 49 Solution Center Portlet Configuration, p Configuring Monitoring This section details the following topics: Configuring Audit Logs, p. 21 Configuring System Log, p. 22 Activating and Configuring Server Traces, p. 22 Workflow Logs, p. 23 Web Service Logs, p. 24 Adding User-defined Columns to Queue Manager or System Log, p Configuring Audit Logs Location for storing log file The log file is stored in the directory <inubit-installdir>/ server/ibis_root/log. Use Refer to Audit Log: Monitoring User Actions (inubit Process Engine: Administrator and Developer Guide, chap. 7.5, p. 105). inubit 6.1: inubit Process Engine: Administrator and Developer Guide

22 22 General Settings of the inubit Software Configuring Monitoring Call up inubit Workbench > Configuration > General Settings > Monitoring > Audit Option Maximum size of the audit log file Number of backup of audit log files Description State in KB. If this size is not reached, the current audit log file, audit.log, is closed and archived. In this case it is saved with a sequential number, e. g. audit.log.5. Information regarding the maximum number of files created for archiving the file audit.log Configuring System Log Location for storing log file The log file is stored in the directory <inubit-installdir>/ server/ibis_root/log. Use Refer to System Log (inubit Process Engine: Administrator and Developer Guide, chap. 7.6, p. 107). Call up inubit Workbench > Configuration > General Settings > Monitoring > System Option Maximum size of the system log file Number of backups of the system log files Description State in KB. If this size is reached, the current system log file is closed and archived. In this case it is saved with a sequential number, e. g. system.log.5. Information regarding the maximum number of files created for archiving the file Activating and Configuring Server Traces Location for storing log file The log file is stored in the directory <inubit-installdir>/ server/ibis_root/log inubit 6.1: inubit Process Engine: Administrator and Developer Guide

23 General Settings of the inubit Software Configuring Monitoring 23 Use Refer to Server Trace Log: Displaying Server Traces (inubit Process Engine: Administrator and Developer Guide, chap. 7.7, p. 111). Option Server trace Call up inubit Workbench > Configuration > General Settings > Monitoring > Trace Description To enable/disable the server trace. Note: To avoid performance problems, activate this option only for analyzing errors. Trace Level DEBUG: General debugging (SuchAndSuch method was called up using SuchAndSuch parameter) using messages that are pertinent for the software developer. INFO: Information, e. g. start a program, stop a program, create connection to host Foo, processing takes x seconds, ). WARNING: Occurrence of an unexpected situation that will probably not impair operation. ERROR: Error messages, such as Exception was noted. Processing was continued for now and the Administrator must respond to it. FATAL: Serious error that leads to aborting the program. Maximum size of trace log files Number of backups of the trace log files Custom server trace Once the stated size has been reached, the current trace log is saved with a sequential number. Information regarding the maximum number of files created for archiving the trace.log file. For adding individual loggers, e. g. for self-developed plug-ins. After adding the logger, click for specifying log level, layout, path and output file name and maximum size in the same dialog. Once the file has reached the maximum size, it is renamed and saved as backup. You can also specify the number of backup files. Refer to Workflow Logs Location for storing log file The log file is stored in the directory <inubit-installdir>/ server/ibis_root/log. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

24 24 General Settings of the inubit Software Configuring Monitoring Use The log file contains process steps of technical workflows, which can be displayed in the System Log. Refer to Displaying Process Steps (inubit Process Engine: Administrator and Developer Guide, chap , p. 109). Call up inubit Workbench > Configuration > General Settings > Monitoring > Workflow Option Maximum size of the workflow log file Number of backup of the workflow log files Description Once the stated size has been reached, the respective workflow log file workflow.log is closed and archived in the workflow directory of a specific user. In other words, it is saved with a sequential number (e.g. workflow.log.5). Information regarding the maximum number of files created for archiving individual workflow log files (workflow.log) Web Service Logs Use For logging call up and response parameters as well as error messages in Web Services Connectors Call up inubit Workbench > Configuration > General Settings> Monitoring > Web Service Option Use custom log output Maximum size of web service log file (only if checkbox for Use custom log output is deactivated) Number of backups for the web service log files (only if checkbox for Use custom log output is deactivated) Description If activated, you can configure log output by using the Use custom log output parameter. If the given size is reached, then the current web service log file webservice.log is closed and archived. It is given a running number, for example webservice.log.5. Maximum number of files that will be made to archive the web service log files (webservice.log) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

25 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. 25 Option Custom log output Description Configure the output via a log4j appender configuration. The button opens a dialog where you can add or adjust an appender. Configure custom log output (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 25) Storage location of log file The webservice.log log file is stored in the <inubit-installdir>/server/ibis_root/log directory. Configure custom log output 1. In the row custom log output, click the button. A dialog opens. 2. Select the log level from the drop-down list. 3. Click the button and enter a configuration. Alternatively, you can insert a supplied sample appender by using the pull-down menu Output definition (log4j appender) > Insert example. 4. If necessary, adapt the configuration. 5. Validate the configuration by using the pull-down menu Output definition (log4j appender) >Validate configuration (locally). 6. Cick OK to save the appender configuration. 7. Save the Web Service log configuration Adding User-defined Columns to Queue Manager or System Log Refer to Adding Columns in Queue Manager/System Log (inubit Process Engine: Administrator and Developer Guide, chap , p. 94). 2.2 Administering Users, Server, Proxy, Threads, Languages etc. This section details the following topics: Configuring inubit User Accounts, p. 26 Activating the Maintenance Mode, p. 28 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

26 26 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. Activating Maintenance Mode Before Starting the inubit Process Engine, p. 28 Defining Name and ID of the inubit Process Engine, p. 29 Defining a Password for the Process Engine, p. 29 Defining Working Memory for Workflows, p. 30 Retrieving Status of the inubit Process Engine via HTTP, p. 30 Configuring the Thread Pool for Workflows, p. 30 LDAP User Synchronization, p. 31 Configuring Miscellaneous, p. 32 Reporting, p. 45 Configuring Access to the Repository, p. 46 Configuring the Revision, p Configuring inubit User Accounts Call Up inubit Workbench > Configuration > General Settings> Administration > User. Option Max. number of password failures Block inactive user Block after (in days) Delete inactive user Delete after (in days) Explanation Maximum number of failed login attempts. If this number is exceeded, the user is blocked for security reasons. Users having the role System Administrator cannot be locked. This is to ensure that administrative users can always log in. Any administrative user can unlock accounts. All successful logins and unsuccessful login attempts can be traced in the Audit Log. If SNMP messaging is activated, then, SNMP traps are sent, if user accounts have been locked after too many unsuccessful login attempts. Refer to Activating the SNMP Alert (inubit Process Engine: Administrator and Developer Guide, chap. 9.3, p. 128). If activated, users are blocked who have not logged in since a specified number of days. Specification after how many days users are blocked. If checked, users who have not logged in since a specified number of days, are deleted. Specification after how many days users are deleted inubit 6.1: inubit Process Engine: Administrator and Developer Guide

27 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. 27 Option Use initial password Initial Password Restrict password validity Validity (in days) Expanded password control Port filter for SOAP clients If activated, the same initial password is always used when creating a new user. After logging in for the first time, the user is prompted to change the initial password. Specification of the initial password. If activated, the validity of a password expires after a specified period of time. After this time has elapsed users are prompted to change their password at the next login. After how many days passwords expire. If activated, a newly assigned password is only accepted if the user has not used it in the last 3 months and the password is different to the last 5 passwords used. If activated, only clients have access via the port listed in the Ports allowed option. Ports allowed Comma-separated list of ports used for clients (e. g. inubit Workbenches) to connect to the inubit Process Engine. Allow users to store passwords Explanation When checked, users can let their passwords store when logging in on the inubit Workbench and do not need to re-enter them on their next log-in. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

28 28 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Activating the Maintenance Mode Call up inubit Workbench > Configuration > General Settings > Administration > Server Option Maintenance mode Activate maintenance mode if maximum hard disc was exceeded Explanation In maintenance mode you can, for example, deploy patches or workflows. The modifications take effect, as soon as the maintenance mode is deactivated again. In maintenance mode the inubit Process Engine acts as follows: No more new workflows are started (exception: those started manually in the test mode), because - the scheduler do not start new workflows, - listeners cannot be accessed externally anymore. Web Services Connectors and the repository return a 503- HTTP-Code. The inubit Enterprise Portal cannot be called externally anymore. Workflows which are already running are executed until they are finished. Note: The maintenance mode is activated automatically, if your license has expired! After inserting a valid license, you need to deactivate the maintenance mode manually. If this option is checked, the maintenance mode is activated automatically, if the defined threshold value is exceeded. The threshold value is defined in the option Max. hard disk usage in %. Refer to Hard disk usage (inubit Process Engine: Administrator and Developer Guide, chap. 9, p. 125) Note: In order to let the hard disk usage monitor, the option Hard disk usage must be activated! Refer to JVM memory (inubit Process Engine: Administrator and Developer Guide, chap. 9, p. 125) Activating Maintenance Mode Before Starting the inubit Process Engine In exceptional situations, for example after a considerable downtime or restores, it is helpful, to put the inubit Process Engine into operation stepwise. To do so, you can activate the maintenance mode before starting the inubit Process Engine inubit 6.1: inubit Process Engine: Administrator and Developer Guide

29 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Open the file inubit-installdir>/server/ibis_root/ conf/ibis_config.xml. 2. Add the following element: <Property name="servermaintenancemode" type="boolean"> true </Property> If the element already exists and its value is false, change the value into true. 3. Save your changes. 4. Restart the inubit Process Engine Defining Name and ID of the inubit Process Engine Call up inubit Workbench > Configuration > General Settings > Administration > Server Option Server id Server host name Description Freely definable name. Is displayed in the title and status bar of the inubit Workbench and facilitates identifying the servers and their error mails when using several servers. The ID is initially filled with the server host name. Name of the server the inubit Process Engine is installed on. The name is identified by a gethostname() on the IP address(es). The server host name is available as system variable ISServerName Defining a Password for the Process Engine Call up inubit Workbench > Configuration > General Settings > Administration > Server Option Password for the Process Engine Description Password for the inubit Process Engine. Is required for the communication between the portal server or the External Interface and inubit Process Engine. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

30 30 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Defining Working Memory for Workflows Call up inubit Workbench > Configuration > General Settings > Administration > Server Option Available working memory in MB Maximum working memory for workflows (in percent) Description Available working memory in MB. Maximum available working memory for workflows where the memory utilization has not been specified manually. For information about how the memory load of a Technical Workflow can be specified manually: refer to Memory restriction (Workbench: User Guide, chap. 2, p. 109) Retrieving Status of the inubit Process Engine via HTTP Call up inubit Workbench > Configuration > General Settings > Administration > Server Option Status web page Description If activated, then the status details as, for example, the JVM load, the system load and inubit Process Engine configuration settings are displayed at the URL servlet/status Configuring the Thread Pool for Workflows Call up inubit Workbench > Configuration > General Settings > Administration > Threads Option Number of workflow threads Description Maximum number of threads executed in parallel by the inubit Process Engine. Per thread exactly one process can be executed. Note: the maximum number depends on your license! inubit 6.1: inubit Process Engine: Administrator and Developer Guide

31 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. 31 Option Priority of the workflow thread Number of GUI threads Priority of the GUI thread Description To determine the operating system priority of the threads. Maximum number of parallel GUI threads of the inubit Process Engine. GUI threads are used for communication between the inubit Workbench and the inubit Process Engine. To determine the operating system priority of GUI threads. Restart the inubit Process Engine to activate your changes! Refer to Optimizing Performance (inubit Process Engine: Administrator and Developer Guide, chap. 17, p. 249) LDAP User Synchronization Call up inubit Workbench > Configuration > General settings > Administration > LDAP user synchronization Option Automatic synchronization Synchronization interval Server name Server port Login Password Search domain Filter Search domain is a group Group filter Group attribute Description Refer to Using LDAP User Directories (inubit Process Engine: Administrator and Developer Guide, chap. 6.4, p. 75). You can refer to groups within your LDAP directories containing the required inubit users by activating the option Search domain is a group and defining group filters and attributes. If the option is activated, then the required user data (for example login and password) is not searched directly in the given search domain when importing or synchronizing the data. Instead, the group attribute is used as a reference to the actual search domain where the required user data can be found. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

32 32 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. Option User properties mapping Description Refer to Optional: Transfer attributes from LDAP (inubit Process Engine: Administrator and Developer Guide, chap. 6, p. 77). Restart the inubit Process Engine to activate your changes! Configuring Miscellaneous This section details the following topics: Allowing inubit Workbench Updates, p. 33 Defining a Test Workflow, p. 33 Defining a Notify Workflow, p. 34 Input Message for the Notify Workflow, p. 34 Defining a Tag Name Workflow, p. 41 Allow Saving Deployment Artifacts, p. 42 Internationalization: Defining Languages for Diagrams, p. 42 MIME-Types Mapping Table, p. 43 Java System Properties, p. 44 Activating/Deactivating Notification of Changes, p inubit 6.1: inubit Process Engine: Administrator and Developer Guide

33 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Allowing inubit Workbench Updates Call up inubit Workbench > Configuration > General Settings > Administration > Miscellaneous Option Workbench updates allowed Description If the option is activated users can update their inubit Workbenches themselves when a patch is available on the inubit Process Engine. When updating users can optionally also download the current version of the documentation. The button in the status bar of the inubit Workbench is displayed every time a patch is available on the inubit Process Engine. Refer to Updating the inubit Workbench (Workbench: User Guide, chap. 1.3, p. 34). When updating the inubit Workbench, the files ibis.jar and ibis-tools.jar are stored in a temporary directory of the inubit Workbench and the copied into the directory <inubitinstalldir>client/lib. If there files with the same name in the directory, they are overwritten. Afterwards the temp directory is deleted. If users activate the including documentation option when updating inubit Workbench, the most current documentation is stored as compressed zip file (documentation.zip) in the directory <inubit-installdir>/server/ibis_root/conf/ deploy and decompressed in the directory <inubitinstalldir>/documentation Defining a Test Workflow You can specify a Technical Workflow that checks diagrams for compliance with specific conditions. Additionally, the test workflow is always executed when Technical Workflows are deployed. Refer to Validating Diagrams against a Validation Workflow (Workbench: User Guide, chap. 16.3, p. 411). Call up inubit Workbench > Configuration > General Settings > Administration > Miscellaneous Option Description Validation workflow The button opens a wizard for selecting a local or server-based Technical Workflow. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

34 34 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Defining a Notify Workflow Call up inubit Workbench > Configuration > General Settings > Administration > Miscellaneous Option Notify workflow Description You can define a Technical Workflow that records changes of to technical and business diagrams in the inubit software (for example, creating new elements, updating and deleting elements) as well as changed modules and that forwards them as an XML output messages including all determined changes via a system connector to an external system. Thus, you can e.g. synchronize data of the inubit Process Engine with external databases. Before you can define a Technical Workflow as Notify workflow you must create in the inubit Workbench a respective Technical Workflow. Refer to Sample notify workflow (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 37) The Notify workflow is always executed when diagrams are published, deployed (on the target system only), or deleted. The button opens a wizard for selecting a local or server-based Technical Workflow Input Message for the Notify Workflow The following XML structure will be passed to the Notify workflow after deployment: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

35 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. 35 <?xml version="1.0" encoding="utf-8"?> <Notification operation="deploy" type="deploy"> <User>root</User> <TargetISServerID>ber-pdl-2086.inubit.com</TargetISServerID> <TargetISServerName>ber-pdl-2086.inubit.com</TargetISServerName> <TargetISSOAPPortNr>8000</TargetISSOAPPortNr> <TargetUserName>miller</TargetUserName> <SourceISServerID>ber-pdl-2086.inubit.com</SourceISServerID> <SourceISServerName>ber-pdl-2086.inubit.com</SourceISServerName> <SourceISSOAPPortNr>8000</SourceISSOAPPortNr> <SourceUserName>brown</SourceUserName> <DeployProtocol> <Deploy> <Name>PM_ProcessMonitor_Grid-4-1</Name> <OldName>PM_ProcessMonitor_Grid-4</OldName> <Type>module</Type> <Info>renamed</Info> <Date> :23:51</Date> <UserOrUserGroup>user2</UserOrUserGroup> <SourceUserOrUserGroup>user1</SourceUserOrUserGroup> <ModuleType>Web Application Connector</ModuleType> <TargetVersion>1</TargetVersion> </Deploy> <Deploy> <Name>GroupScBod.xsd</Name> <Type>repository_object</Type> <Info>modified</Info> <Date> :27:05</Date> <UserOrUserGroup>odo</UserOrUserGroup> <Version>1.6</Version> <Path>/Root/odo/SolutionCenter/BODSchemas/GroupScBod.xsd</Path> <ContentType>application/x-xsd+xml</ContentType> <SourcePath> /Root/admin/SolutionCenter/BODSchemas/GroupScBod.xsd </SourcePath> <SourceUserOrUserGroup>admin</SourceUserOrUserGroup> </Deploy> </DeployProtocol> </Notification> User User carrying out the deployment TargetISServerID inubit 6.1: inubit Process Engine: Administrator and Developer Guide

36 36 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. inubit server ID of the target server TargetISServerName inubit server name of the target server TargetISSOAPPortNr inubit SOAP port number of the target server TargetUserName Name of the user on the target server to whom the diagram is to be deployed SourceISServerID inubit server ID of the source server SourceISServerName inubit server name of the source server SourceISSOAPPortNr inubit SOAP port number of the source server SourceUserName User name on the source server DeployProtocol Start of the deployment protocol section Name New name of the module/diagram OldName Old name of the module/diagram Type - module: module - diagram: diagram - repository_object: Repository object Info Deployment message Date Deployment execution date UserOrUserGroup User or user group in which the diagrams has been deployed Version Version of the newly created objects on the target system (comment deployed assigned automatically Path Path to the Repository objects on the target system ContentType File type (MIME type) SourcePath Path to the Repository objects on the source system SourceUserOrUserGroup inubit 6.1: inubit Process Engine: Administrator and Developer Guide

37 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. 37 User or user group the modules/diagrams are saved on the source server ModuleType/DiagramType Module type/diagram type TargetVersion target system version Sample notify workflow The Notify workflow forwards information about the newly created Technical Workflow TestWorkflow to an external system, e.g.: The Notify workflow receives via the Empty input module mod_ EntryPoint an input message containing information about a newly created workflow. The information about the change event is specified in the operation attribute and indicates in this sample a newly created workflow by using the create attribute (information about modified or deleted workflows are specified by using the modify or delete attributes): inubit 6.1: inubit Process Engine: Administrator and Developer Guide

38 38 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. The XML input message is passed on to the following XSLT Converter modules that extracts version data from before and after the applied change and that creates a structure with which the following XML Diff module can determine the change difference: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

39 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. 39 The XML Diff utility determines the change difference of extracted data and creates an XML output message containing all resulting changes in the form of Difference elements of the insert type that results from the new creation of a workflow event. This output message is passed on to a system connector to forward the change information to an external system: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

40 40 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc. This output message is transmitted to a system connector that forwards the change information to an external system inubit 6.1: inubit Process Engine: Administrator and Developer Guide

41 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Defining a Tag Name Workflow Call up inubit Workbench > Configuration > General Settings > Administration > Miscellaneous Option Tag name workflow Description You can define a Technical Workflow which automatically generates a suggestion for a tag name. The suggestion is displayed when the Create tag dialog is displayed. Before you can define a Technical Workflow as tag name workflow, you must create a corresponding Technical Workflow which returns a string or an XML structure. If the tag name workflow returns an XML structure, the entries can only be selected in the Create tag dialog; entering another tag name is not allowed. The button opens a wizard for selecting a local or server-based Technical Workflow. Example The XML structure returned by the tag name workflow must look as follows: <?xml version="1.0" encoding="utf-8"?> <tags xmlns:xsi=" <tag description="description of Tag A">Tag A</tag> <tag description="description of Tag B" selected="true">tag B</tag> <tag description="description of Tag C"> <branch>branch A</branch>Tag C </tag> <tag>tag D</tag> </tags> You can preselect both the Tag field and the Description field in the the Create tag dialog using the selected="true" attribute. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

42 42 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Allow Saving Deployment Artifacts Call up inubit Workbench > Configuration> General Settings > Administration > Miscellaneous Option Save deployment artifacts Description If you activate this option, you can save the result of a deployment, e.g. to archive the deployed states in an external version control system. Refer to Deployment of Diagrams, Modules, Metadata, and Repository Files (Workbench: User Guide, chap. 1.6, p. 37) Internationalization: Defining Languages for Diagrams Call up inubit Workbench > Configuration> General Settings > Administration > Miscellaneous Option Default language Description Defines the default language for element names, diagram and element comments as well as for reports. Additional languages The button opens a wizard for selecting more diagram languages. If more languages are selected, you can enter and display texts for diagrams and elements in the selected languages. Refer to Internationalization: Maintaining Multi-Lingual Texts (Workbench: User Guide, chap. 2.20, p. 96) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

43 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc MIME-Types Mapping Table Call up inubit Workbench > Configuration> General Settings > Administration > Miscellaneous > MIME types mapping table Option Description MIME types mapping tables The button opens a table, in which file extensions are mapped onto MIME types. When adding a file, its MIME type is set automatically based on these mappings. You can create more mappings so that other, until now unknown file types are recognized automatically. This way, you avoid having to change MIME types manually after adding a file to the repository. Refer to MIME type (Workbench: User Guide, chap. 19, p. 481) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

44 44 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Java System Properties Call up inubit Workbench > Configuration> General Settings > Administration > Miscellaneous > Java System Properties Option Description Java System Properties The button opens a table of all additional Java system properties, which are already set: JINTEGRA_OUTGOING_CONNECTION_TIMEOUT Specifies the timeout for communication between J-Integra and the Exchange Server. If this property is not set, then there will be now timeout. Relevant when using the Exchange connector, if J-Integra addresses COM objects like the Exchange Server. Refer to properties.html com.sun.xml.ws.assembler.client Activates/deactivates logging of client-sided Web Service requests in the log file of Tomcat/JBoss (depending on your installation). com.sun.xml.ws.assembler.server Activates/Deactivates logging of server-sided Web Service responses in the log file of Tomcat/JBoss (depending on your installation). You can add further Java systems properties, for example, to log Web Service messages, Refer to Logging SOAP Messages (Workbench/Process Engine: System Connectors Guide, chap , p. 431). to disable the transfer of plain-text passwords.,refer to Dialog VFS Connector base configuration (Workbench/Process Engine: System Connectors Guide, chap , p. 384) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

45 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Activating/Deactivating Notification of Changes Call up inubit Workbench > Configuration > General Settings > Administration > Miscellaneous > Visualize diagram modifications at the link between BPD and TWF Option Visualize diagram modifications at the link between BPD und TWF Description If this option is activated, the link between connected Business Process Diagrams and Technical Workflows displays a construction site symbol as soon as modifications are applied to the diagrams. If the alert is activated, the diagram owner are additionally informed by about the types of modifications. For minor modifications, the display of the construction site symbol and the alert can be disabled in the diagram properties. Refer to - Publishing Modules and Diagrams (Workbench: User Guide, chap. 1.5, p. 35) - Activating Notifications (inubit Process Engine: Administrator and Developer Guide, chap. 9.2, p. 127) - Configuring the Change Notification for Linked BPDs and TWFs (Workbench: User Guide, chap. 6, p. 165) Reporting Call up inubit Workbench > Configuration > General Settings > Administration > Reporting Option System statistic log Log interval Description If activated, then statistical data is written via the system to the database of the inubit Process Engine. The data may be displayed via the Report tab. Refer to Reporting and Business Process Monitoring (Workbench: User Guide, chap. 13, p. 327). Time interval during which the statistical data is to be collected. The interval must not fall below the default value of 5 minutes to avoid performance problems. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

46 46 General Settings of the inubit Software Administering Users, Server, Proxy, Threads, Languages etc Configuring Access to the Repository Call up inubit Workbench > Configuration > General Settings > Administration > Repository Option WebDAV access to repository HTTP access to repository Activate directory listing Garbage Collection Start Garbage Collection Interval Description For activating the WebDAV interface of the Repository at <ServerName>:8000/ibis/servlet/RepositoryWebdav Activates the HTTP interface of the Repository and thus enables accessing files in the Repository via a Web browser. Refer to Accessing Files in the Repository via URL or path (Workbench: User Guide, chap , p. 479). Enables navigating through the Repository s global area with a Web browser. First start of the garbage collection of the repository, by default at 11:00 PM on the server s start-up day Interval for the garbage collection of the repository after first start, by default 1 day Configuring the Revision Call up inubit Workbench > Configuration > General Settings> Adminsitration > Revision Option Activate Revision workflow (optional) Notify revision department address of the revision department Notify requester Description When activated, only workflows and modules can be deployed, which were checked and released by the revision department. The given workflow is always started when a tag release is requested. When the workflow terminates without an error, the release request is forwarded to the revision department. Create this workflow manually and configure it, for example, in such a way that it checks the syntax of module names automatically. Notify revision department about tag release requests. When a tag release is requested, a notification is sent to the given address. Specify here if the requester will be notified about tags released/rejected inubit 6.1: inubit Process Engine: Administrator and Developer Guide

47 General Settings of the inubit Software Configuring the Portal Server Configuring the Portal Server Call up inubit Workbench > Configuration > General Settings >Portal > Server configuration Option Portal server Plug-in class of the portal server URL of the portal server Login for portal server Password for portal server URL of the Process Engine Log files of the portlets Description For selecting and activating a portal server. Note: You must define a portal server in order to use the option Portal-Deployment. Class name of the portal plug-ins implementation. URL of the portal server. If you do not install the portal server on the same computer as the inubit Process Engine, you need to adjust the URL. Name of the portal user. On delivery the user name is root. Password of the user, who is given at the option Portal Login. On delivery the password is inubit. URL of the inubit Process Engine. Directory for storing portlets log files. The path refers to the installation directory of the inubit Process Engine. Note: The trace level of the Task list and monitoring portlets depends on the trace level of the inubit Process Engine at exactly that point in time, when the portlets are deployed. Refer to Trace Level (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 23) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

48 48 General Settings of the inubit Software Configuring Portal Deployment 2.4 Configuring Portal Deployment Call up inubit Workbench > Configuration > General Settings > Portal > Portal deployment Option Portlets archive name Task lists on the portal Monitoring portlets on the portal Report portlet Name of the report portlet URLs of the report portlet Process portlet Name of the process portlet URLs of the Process Portlet Description Default value for the name of the *.war file and the directory where the inubit portlets which are included in delivery are stored. You find the directory in <inubit-installdir>/server/ Tomcat/webapps. The default value is suggested on deployment, you can enter any other name. The values 2/2 (initial state) show, that there are two task lists and both are active. If you add further task lists or deactivate existing task lists, these values are adjusted. The button opens a dialog where you can create new task lists are active and activate/deactivate existing task lists. Refer to - Portlet Task List in the inubit Process Cockpit (Workbench: User Guide, chap. 20.9, p. 506) - Adjusting Task Lists (Workbench: User Guide, chap , p. 511) The values 1/1 (initial state) show, that there is one monitoring portlet and that it is active. The values always adjust to the number of configured and activated or de-activated monitoring portlets. The button opens the XSLT style sheet where you can define which monitoring portlets are active and what contents they display. For information about configuring different monitoring portlets refer to Monitoring Portlets in the inubit Process Cockpit (Workbench: User Guide, chap. 20.7, p. 493). Activates the report portlet. Name of the report portlet. Refer to Using the Report Viewer (Workbench: User Guide, chap. 13.6, p. 334). Space-delimited list of the URLs of all servers for which data is to be collected for reports, to have them displayed in the report portlet. Activates the report portlet. Refer to Portlet Process Viewer in the inubit Process Cockpit (Workbench: User Guide, chap. 20.8, p. 497). Name of the process portlet. Whitespace separated list of the URL of all servers for which process data ist to be collected, to have them be displayed in the process portlet inubit 6.1: inubit Process Engine: Administrator and Developer Guide

49 General Settings of the inubit Software Configuring the Solution Center Server 49 Option Portlet archives (Administration/Deployment) Download WAR Description Note: To display this option you must first configure a portal server. Refer to Portal server (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 47) The button opens a dialog, in which you can assemble web applications of the inubit Process Engine to a portlet archive and make them available on the configured portal server. You need to re-deploy portlets after performing the following actions: Task lists: creating, activating, deactivating, changing name or category Monitoring-Portlets: creating, activating, deactivating, changing name or category Web Application Connector: creating, activating, deactivating, changing name, changing category, changing permissions After all other actions, as for example modifications at modules in the portlet workflow, it is sufficient to re-initialize the portlet. Refer to - Deploying Web Applications as Portlet Archive (Workbench: User Guide, chap , p. 519) - Re-initializing Web Applications (Workbench: User Guide, chap , p. 523) For exporting all portlets, so that they may, for example, be made available to an arbitrary portal server. All portlets in the directory <inubit-installdir>/server/ Tomcat/webapps/isp are compressed to a *.war file and stored into the selected directory. For an overview over the portlets refer to the file <inubitinstalldir>/server/tomcat/webapps/isp/web-inf/ portlet.xml. 2.5 Configuring the Solution Center Server Call up inubit Workbench > Configuration > General Settings > Solution Center > Server configuration Option Solution Center integration Description For activating/deactivating the integration of the Solution Center into the inubit software inubit 6.1: inubit Process Engine: Administrator and Developer Guide

50 50 General Settings of the inubit Software Solution Center Portlet Configuration Option URL of the Solution Center Login for the Solution Center Password for the Solution Center Register Process Engine at Solution Center Register Portal at Solution Center Description URL of the Solution Center User name for logging in to the Solution Center. Password for logging in to the Solution Center. Click the button to register the Process Engine at the Solution Center using the internal user account. Click the button to pass the portal settings to the Solution Center. Hence, the Solution Center registers itself at the portal. 2.6 Solution Center Portlet Configuration Use These settings preselect the portlet settings if a Solution Center portlet is newly instantiated. Afterwards, you can adapt these settings separately for each portlet instance in the portlet preferences. Call up inubit Workbench > Configuration > General Settings> Solution Center > Portlet configuration default Option Start node Show object path Add associations via combobox Desription UUID or path (XPath 1.0) of the start node, e.g.: /scc:solutions /scc:solutions/bfm3:businessfoundation XPath queries always refer to this node. Displaying or hiding the path to navigate to the objects activated: All objects possible are displayed as combobox from which you can select one to assign it to another object. deactivated: All objects possible are displayed in a search window from which you can select one to assign it to another object inubit 6.1: inubit Process Engine: Administrator and Developer Guide

51 General Settings of the inubit Software Solution Center Portlet Configuration 51 Option Desription Visibility of the side bar visible: The sidebar which shows the object browser, the history, and the clipboard is displayed. hidden: The sidebar is hidden at start-up. The user is allowed to display it again. disabled: The sidebar is not displayed. The user is not allowed to display it. Show object browser Show recent objects Show clipboard Show toolbox Show home page button Show edit button Show view menu Show search field Use save input mode for HTML Displaying or hiding the Object Browser Displaying or hiding the history Displaying or hiding the clipboard Displaying or hiding the toolbox Displaying or hiding the button to navigate quickly to the Solution Center homepage. Displaying or hiding the button to switch to the edit mode. If this button is hidden for a portlet instance, users can only display the data in the Solution Center portlet, but they are not allowed to edit them. Displaying or hiding the view menu button. If this button is hidden for a portlet instance, users can only use the data s default view in the Solution Center portlet. Users are neither allowed to switch to another view, nor to edit a view. Displaying or hiding the search field. If this field is hidden for a portlet instance, users cannot use the search function in the Solution Center portlet. To gain higher security and stability levels all scripts will be automatically removed from a HTML input once this flag is set. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

52 52 General Settings of the inubit Software Solution Center Portlet Configuration inubit 6.1: inubit Process Engine: Administrator and Developer Guide

53 3 Installation Notes 53 This section details the following topics: Installing via the Command Line, p. 53 Installing/Uninstalling inubit Process Engine as Service, p. 53 Post-installing Components of the inubit Software, p. 57 Installing Drivers, p. 57 Updating the License via inubit Workbench, p. 58 This section contains additional installation information. Information about the inubit standard installation can be found in the Quick Start. 3.1 Installing via the Command Line Prerequisites You have copied the installation file setup*.exe to your computer or inserted the product DVD into your DVD drive. 1. Open the command line. 2. Call up the installation file corresponding to your operating system using the parameter -i console, e. g.: setup[os-version].exe -i console. If the parameter is missing, the installation wizard is displayed! 3.2 Installing/Uninstalling inubit Process Engine as Service This section details the following topics: (Un)installing the inubit Process Engine as Service Under Windows, p. 54 Obtaining Administrator s Rights for Vista/Windows 7, p. 55 Installing the inubit Process Engine Under Linux as Service, p. 56 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

54 54 Installation Notes Installing/Uninstalling inubit Process Engine as Service You can make the inubit Process Engine available as a service and start, stop, abort or continue it after an error on a local or remote computer. Additionally you can configure start and recovery options. Scripts for installing/uninstalling the inubit Process Engine as a service are included in delivery of the inubit software. To modify a service script, for example, if adding proxies, uninstall the service, change the script, and reinstall the service (Un)installing the inubit Process Engine as Service Under Windows Prerequisites You need administrator rights to execute the script. When installing under Vista: The Vista operation system does not provide the normal command prompt with administrator rights! For information how to obtain these rights under Vista refer to Obtaining Administrator s Rights for Vista/Windows 7 (inubit Process Engine: Administrator and Developer Guide, chap , p. 55). Under Windows 7 you can also use the runas command. For this, you also need the system administrator s user name and password. 1. Open a command prompt. 2. Navigate to the script directory. You find the scripts for installing/de-installing in the following directories: - Tomcat: <inubit-installdir>/server/tomcat/bin - JBoss: <inubit-installdir>/server/jboss/bin 3. Execute the appropriate script: - Installing: ibis_nt_service_install.cmd - De-installing: ibis_nt_service_uninstall.cmd After installation, the inubit Process Engine will have the automatic start type and will start as soon as the computer is booted up. You can change the start type under Start > Settings > System Control - Administration - Services inubit 6.1: inubit Process Engine: Administrator and Developer Guide

55 Installation Notes Installing/Uninstalling inubit Process Engine as Service Obtaining Administrator s Rights for Vista/Windows 7 1. Click the Windows logo in the left bottom corner (used to be the Start button). 2. Into the search field enter cmd.exe and press CTRL+SHIFT+ENTER: This shortcut is the equivalent of the RUNAS command or the GUI option Run as administrator. The UAC warning dialog opens: 3. Click Continue. The command prompt opens: Note, that the title bar of the command prompt now reads Administrator:. Now, you dispose of administrator s rights. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

56 56 Installation Notes Installing/Uninstalling inubit Process Engine as Service Installing the inubit Process Engine Under Linux as Service Prerequisites You must have root rights to install the script for starting the inubit Process Engine. The required file may be found here, depending on whether your inubit Process Engine runs under Tomcat or JBoss: Tomcat: <inubit-installdir>/server/tomcat/bin/inubitis JBoss: <inubit-installdir>/server/jboss/bin/inubitis 1. Copy the files as follows: As of inubit version 6.1 it is no more necessary to copy the inubitis.conf file to /etc/. If you still want to copy the inubitis.conf file to /etc/, you have to customize the path to this file in the script /etc/init.d/inubitis in order that it is used. cp <inubit-installdir>/server/tomcat/bin/ inubitis /etc/init.d/ cp <inubit-installdir>/server/tomcat/bin/ inubitis.conf /etc/ 2. Allocate the service to a run level and connect the service to the respective entries for starting and stopping, e. g.: cd /etc/init.d/rc3.d ln -s../inubitis S70inubitis ln -s../inubitis K03inubitis 3. Switch to the directory /etc 4. To list the available parameters, call up the script without parameters: cd /etc/init.d./inubitis start./inubitis status./inubitis stop./inubitis forcestop./inubitis restart 5. The paths for the following entries may need to be adjusted in the inubitis.conf file. - Installation directory. IS_DIR=/opt/inubit-IS - User, under which the service is to be run. IS_USER=is inubit 6.1: inubit Process Engine: Administrator and Developer Guide

57 Installation Notes Post-installing Components of the inubit Software Post-installing Components of the inubit Software 1. Stop the inubit Process Engine. 2. Start the installation wizard again. 3. As installation directory select the directory the inubit software is installed in. 4. As type of installation select User-defined. 5. Check all components which you want to install. When you select a component like UDDI which is subordinated to other components in the tree, then all superordinated components are installed again. 6. Start the installation. Your configuration files are not overwritten automatically. You can define for each file individually whether to keep its current version or let it overwrite. 3.4 Installing Drivers You may need to install additional programs such as database drivers on your inubit Process Engine when using, for example, Database Connectors. 1. In the inubit Workbench, display the Configuration tab. 2. From the menu bar, select Configuration > Upload library. A dialog opens. 3. To the right of the File(s) field click. A file explorer opens. 4. Navigate to the driver, select it and click Open. The file name is displayed in the File(s) field. 5. Select Driver library. 6. Click Finish. The file is loaded. If the upload was successful, a confirmation is displayed. 7. Restart Workbench and Process Engine. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

58 58 Installation Notes Updating the License via inubit Workbench 3.5 Updating the License via inubit Workbench A new license may be loaded to the inubit Process Engine by means of the inubit Workbench. To display license information, click in the menu bar on Help > About A dialog opens. You find the license details in the License Information tab. 1. Log in to the inubit Workbench as the System Administrator. 2. Display the Configuration > General Settings tab. 3. From the menu bar select Configuration > Update license file. A file explorer opens. 4. Navigate to the directory where your license file is stored. 5. Select the license file and click Open. The new license is saved in the directory <is-installdir>/ server/ibis_root/conf with the name license.xml. The existing license is renamed to license.xml.old inubit 6.1: inubit Process Engine: Administrator and Developer Guide

59 4 Configuring Tomcat and JBoss 59 This section details the following topics: Configuring the Tomcat Application Server, p. 59 Configuring the JBoss Application Server, p Configuring the Tomcat Application Server The inubit software uses Tomcat 6. For detailed information about configuring Jakarta Tomcat, refer to The following table provides an overview of several configuration options: Was? Servlet configuration Changing JVM memory Configuring log file Wo? <inubit-installdir>/server/tomcat/webapps/ibis/ WEB-INF/web.xml <inubit-installdir>/server/tomcat/bin/setenv.bat bzw. setenv.sh set JAVA_OPTS=-Xmx512M Refer to Optimizing the Java Virtual Machine (JVM) (inubit Process Engine: Administrator and Developer Guide, chap. 17.2, p. 251). Tomcat logs into the file <inubit-installdir>/server/ Tomcat/logs/catalina.out resp. *.log. Note (Linux only): This log file does not rotate, it grows without limit and can thus cause problems. In order to define a maximum size for the log file and let it rotate, use the Cronolog tool. Refer to inubit 6.1: inubit Process Engine: Administrator and Developer Guide

60 60 Configuring Tomcat and JBoss Configuring the JBoss Application Server 4.2 Configuring the JBoss Application Server Overview The inubit software uses JBoss What? JBoss configuration file Modifying JVM memory Windows start script Changing EJB ports For detailed information about the JBoss configuration, refer to community.jboss.org/wiki/ JBossApplicationServerOfficialDocumentationPage The following table provides an overview of JBoss configuration options: Where? EJB communication default port: 1099 <inubit-installdir>/server/jboss/server/default/ deploy/jboss-web.deployer/server.xml <inubit-installdir>/server/jboss/bin/run.conf.bat bzw. run.conf Refer to Optimizing the Java Virtual Machine (JVM) (inubit Process Engine: Administrator and Developer Guide, chap. 17.2, p. 251). <inubit-installdir>/jboss/bin/run.bat <inubit-installdir>/jboss/server/default/conf/ jboss-service.xml EJB RMI communication default port: 1098 Note: If you use EJB-RMI, you need the ibis_jboss_provider.jar file to make the inubit Workbench work. Copy the file into the <inubit-installdir>/client/lib/ext directory before you start the inubit Workbench! The Bosch Software Innovations GmbH provides you with the file upon request. Web application container IP All the others services <inubit-installdir>/server/jboss/server/default/ deploy/jboss-web.deployer/server.xml Default: Enter the IP address or the host name of the desired system. <inubit-installdir>/jboss/server/default/conf/ jboss-service.xml using the ${jboss.bind.address} variable Default: localhost For further information, refer to the JBoss documentation inubit 6.1: inubit Process Engine: Administrator and Developer Guide

61 5 Configuring Secure Connections 61 This section details the following topics: Configuring SSL Connections and Server Authentication, p. 61 Activating Traces for HTTPS Connections, p. 65 Configuring a HTTP(S) Proxy Server for inubit Workbench and/or inubit Process Engine, p. 65 Changing HTTP(S) Ports, p. 68 For information about the SSL configuration of the Remote Connector, refer to Configuring a Secure Connection to the inubit Process Engine (inubit Process Engine: Administrator and Developer Guide, chap. 13.3, p. 150). 5.1 Configuring SSL Connections and Server Authentication You can secure the communication between the inubit Process Engine and clients such as the inubit Workbench by using the HTTPS protocol that is secured by SSL/TLS. Overview When using HTTPS, inubit Process Engine and Enterprise Portal or inubit Process Engine and a web service consumer communicate via encrypted data. Additionally, clients (e.g. inubit Workbench, web browsers) can verify the certificate of the server (e.g. inubit Process Engine, Enterprise Portal) to authenticate the connection. As operator of the inubit Process Engine you create the keystore. A keystore contains certificates with the corresponding public keys and the private key belonging to the certificate. The public key is part of the certificate that the client uses to authenticate the server. Configure the HTTPS connection and deposit the keystore in the inubit Process Engine. The server certificate is deposited in the so-called trust store at the client (e.g. inubit Workbench) and there also you configure the HTTPS connection. In contrast to the keystore, the trust store contains certificates only. This allows the inubit Process Engine to access the private key, and the inubit Workbench to access the certificate, by means of a public key. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

62 62 Configuring Secure Connections Configuring SSL Connections and Server Authentication 1. Create a keystore and a self-signed certificate. To do so, call up the keytool via the command line in the directory <inubit-installdir>/_jvm/bin/keytool.exe. The following parameters generate a keystore ibis_demo_ keystore with a self-signed certificate with a public key. When generating, one password is assigned for the keystore and the certificate. Adjust the parameter values to your own IT environment (except -alias): keytool -genkey -alias tomcat -dname "CN=server.domain.com, O=inubit AG, C=DE" -keystore C:\keys\ibis_demo_keystore.jks -keyalg RSA When using another tool than keytool: The algorithm must be RSA! 2. Extract the certificate: keytool -export -alias tomcat -storepass PasswordKeystore -keystore C:\keys\ibis_demo_keystore.jks -file C:\ibis_demo_certificate.crt 3. Configure the inubit Process Engine. Depending on the used application server, open one of the following configuration files: - Tomcat: <inubit-installdir>/server/tomcat/conf/ server.xml - JBoss: <inubit-installdir>/server/jboss/server/ default/deploy/jboss-web.deployer/server.xml inubit 6.1: inubit Process Engine: Administrator and Developer Guide

63 Configuring Secure Connections Configuring SSL Connections and Server Authentication 63 Remove the annotations marks from the element below the entry SSL HTTP/1.1 Connector, adjust the attribute values and add the keystorefile, keystorepass, and optionally the keyalias attribute as follows: <Connector port="8443" protocol="http/1.1" URIEncoding="UTF-8" connectiontimeout="20000" maxthreads="150" minsparethreads="25" maxsparethreads="75" enablelookups="false" acceptcount="100" compression="on" compressionminsize="2048" compressablemimetype="text/html,text/xml,text/javascript" server="apache" emptysessionpath="true" SSLEnabled="true" scheme="https" secure="true" clientauth="false" sslprotocol="tls" keystorefile="/opt/is/is6/server/tomcat/conf/server.jks" keystorepass="inubit" keyalias="tomcat" /> - keystorefile JKS file name (private key and certificate) including path - keystorepass Keystore password - keyalias Alias name of the keystore entry. If this entry is missing, tomcat or the first entry in the keystore is used. 4. Restart the inubit Process Engine. 5. Add the certificate to the client's truststore. With the following command you copy the certificate to the client computer and import it to the truststore: keytool -import -alias tomcat -file C:\ibis_demo_certificate.crt -keystore C:\ibis_demo_truststore.jks 6. Confirm the call back Trust this certificate? 7. If you use are self-signed certificate, you need to declare the truststore for Java, because the Java framework checks the server certificate s reliability. If the truststore is not declared, the communication with the inubit Process Engine via HTTPS fails, for example when publishing a service into the UDDI, when loading documents from the inubit Process Engine via the XSLT function document() or when loading an URL in the XML Editor. The truststore must be declared in the start script of the inubit Process Engine and the inubit Workbench: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

64 64 Configuring Secure Connections Configuring SSL Connections and Server Authentication a. Open the start script of the inubit Process Engine: - Tomcat: <inubit-installdir>/server/tomcat/ bin/setenv.bat resp..sh - JBoss: <inubit-installdir>/server/jboss/bin/ run.conf resp. run.conf.bat b. Open the inubit Workbench start script in <inubitinstalldir>/client/bin/start_local.bat resp. sh. c. Add the following and adjust the path to your truststore: set JVM_PARAMS=%JVM_PARAMS% -Djavax.net.ssl.trustStore=C:\ibis_demo_ truststore.jks 8. To view the content of the truststore use the following command: keytool -keystore C:\keys\ibis_demo_truststore.jks -list -v 9. Restart the inubit Workbench. 10. Create a new application profile based on an HTTPS connection, for example IBISSoapServlet, and enter the path of the truststore file. Refer to Creating and Deleting Login Profiles (Workbench: User Guide, chap. 1.7, p. 44) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

65 Configuring Secure Connections Activating Traces for HTTPS Connections Activating Traces for HTTPS Connections In order to obtain meaningful traces for HTTPS connections between inubit Workbench and inubit Process Engine, the start scripts of the two components can be adjusted. 1. Close the inubit Workbench and stop the inubit Process Engine. 2. Open the following start scripts: - inubit Workbench <inubit-installdir>/client/bin/start_local.bat or.sh - inubit Process Engine - Tomcat <inubit-installdir>/server/tomcat/bin/ setenv.sh - JBoss: <inubit-installdir>/server/jboss/bin/ run.conf or run.conf.bat 3. Insert the following lines: - inubit Workbench: set JAVA_PARAMS=%JAVA_PARAMS% -Djavax.net.debug= ssl,handshake,data, trustmanager - inubit Process Engine: set JAVA_PARAMS=%JAVA_PARAMS% -Djavax.net.debug=ssl,handshake,data, trustmanager 4. Restart the inubit Process Engine and the inubit Workbench. Also refer to - Activating and Configuring Server Traces (inubit Process Engine: Administrator and Developer Guide, chap , p. 22) - Server Trace Log: Displaying Server Traces (inubit Process Engine: Administrator and Developer Guide, chap. 7.7, p. 111) 5.3 Configuring a HTTP(S) Proxy Server for inubit Workbench and/or inubit Process Engine This section details the following topics: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

66 66 Configuring Secure Connections Configuring a HTTP(S) Proxy Server for inubit Workbench and/or inubit Process Engine Configuring a Proxy Server between inubit Workbench and inubit Process Engine, p. 66 Configuring Proxy Server between inubit Process Engine and Remote Computers, p. 67 Proxy-Servers can be used for the communication between the inubit Workbench and the inubit Process Engine, the inubit Process Engine and remote computers, Remote Connectors and other remote computers. Refer to Activating HTTP-/HTTPS Communication with Remote Computers via a Proxy Server (inubit Process Engine: Administrator and Developer Guide, chap. 13.4, p. 151). A proxy server can be used for aims like Increasing security Computers on the local network should not have direct Internet access; a proxy server may be used as an interface between the two networks. Bandwidth control The proxy server may allocate different resources to different user groups dependent upon utilization Configuring a Proxy Server between inubit Workbench and inubit Process Engine 1. Stop the inubit Workbench. 2. Open the start script <inubit-installdir>/client/bin/ start_local.bat or.sh. 3. Insert the lines matching to your protocol and adjust the values: - HTTP set JAVA_PARAMS=%JAVA_PARAMS% -Dhttp.proxyHost=Proxy_IP_or_URL set JAVA_PARAMS=%JAVA_PARAMS% -Dhttp.proxyPort=8080 set JAVA_PARAMS=%JAVA_PARAMS% -Dhttp.proxyUserName=username set JAVA_PARAMS=%JAVA_PARAMS% -Dhttp.proxyPassword=password set JAVA_PARAMS=%JAVA_PARAMS% -Dhttp.nonProxyHosts=*.yourcompany.com - HTTPS inubit 6.1: inubit Process Engine: Administrator and Developer Guide

67 Configuring Secure Connections Configuring a HTTP(S) Proxy Server for inubit Workbench and/or inubit Process Engine 67 set JAVA_PARAMS=%JAVA_PARAMS% -Dhttps.proxyHost=Proxy_IP_or_URL set JAVA_PARAMS=%JAVA_PARAMS% -Dhttps.proxyPort=8080 set JAVA_PARAMS=%JAVA_PARAMS% -Dhttps.proxyUserName=username set JAVA_PARAMS=%JAVA_PARAMS% -Dhttps.proxyPassword=password set JAVA_PARAMS=%JAVA_PARAMS% -Dhttps.nonProxyHosts=*.yourcompany.com 4. Restart the inubit Workbench Configuring Proxy Server between inubit Process Engine and Remote Computers In some networks HTTP- and HTPPS accesses are possible only via a proxy server. You configure this proxy server centrally at the inubit Process Engine. Additionally, you can make exceptions, that means, define remote computers that are connected to directly and not via the proxy server. Use a proxy server if there are errors when publishing and deploying Web Service Input Listeners Medium Connectors with external access to XML Schemas. 1. In the inubit Workbench open the tab Configuration > General Settings. 2. Display the Administration > Proxy configuration category. 3. Check the Use proxy configuration option to activate the proxy settings to activate the following options. If you deactivate the Use proxy configuration after having configured proxy settings, your proxy configuration is preserved, but is not used anymore. The values in this configuration overwrite the values set in the start script. If you leave the value for Server blank and activate the Use proxy configuration option, no proxy is used. You find the start scripts under - Tomcat: <inubit-installdir/server/tomcat/bin/ setenv.bat resp. *.sh, - JBoss: <inubit-installdir/server/jboss/bin/ run.conf.bat resp. run.conf. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

68 68 Configuring Secure Connections Changing HTTP(S) Ports 4. Define your proxy settings. Click an option to display its explanation. 5. Save your changes. 5.4 Changing HTTP(S) Ports If necessary, you may change the HTTP(S) port of your inubit Process Engine. The following port numbers are given by default for the inubit Process Engine: HTTP: 8000 HTTPS: Open the configuration file corresponding to your operating system: - Tomcat: <inubit-installdir>/server/tomcat/conf/ server.xml - JBoss: <inubit-installdir>/server/jboss/server/ default/ deploy/jboss-web.deployer/server.xml 2. Change the ports. 3. Save your changes. 4. Restart the inubit Process Engine inubit 6.1: inubit Process Engine: Administrator and Developer Guide

69 6 Managing Users 69 This section details the following topics: Changing the User-Specific Working Directory of the inubit Workbench, p. 69 Administrating Users, p. 71 Changing User Passwords, p. 75 Using LDAP User Directories, p. 75 Exporting Users/User Groups, p. 78 Importing Users/User Groups, p. 78 Managing User Groups, p. 79 Managing User Roles, p. 82 Using Process Roles, p. 84 Overview The User Manager of the inubit Workbench provides support in managing users and user groups who have access to the inubit Workbench and to the inubit Process Engine. In the User Manager you can create and import users (user groups) or synchronize them with an LDAP directory, create user roles to control user rights. In addition to managing users you can also manage process roles inthe inubit software, provided you have licensed the Task Generator module. Refer to Task Generator (Data Converter) (Workbench/Process Engine: Modules Guide, chap. 4, p. 55). Rights and roles To manage users you must have the User Manager right. By default this right is assigned to the System Administrator and Project Lead roles included in delivery. Refer to Overview about right/role assignments (inubit Process Engine: Administrator and Developer Guide, chap. 6, p. 82). 6.1 Changing the User-Specific Working Directory of the inubit Workbench You can change the working directory of the inubit Workbench via the system environment variable INUBIT_TOOLSET_WORKDIR or the JVM parameter inubit.toolset.workdir. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

70 70 Managing Users Changing the User-Specific Working Directory of the inubit Workbench For every user, the first time he logs in a local working directory is created in <operating_system_specific_user-directory>/ inubit/toolset/<version>/work/<client-ip>/<username>. This working directory contains a tmp directory in which the content of the watch points is stored temporarily. Do not edit these files and do not delete the tmp directory. The working directory is preserved after installing a patch and also not deleted when de-installing the inubit software. Using the system environment variable Prerequisites The working directory must already exist. The user must have full access (reading/writing) to the working directory. Windows Control Panel > System > Advanced > Environment Variables > New Linux If you are using, for example, the Bash shell, then edit its configuration file ~/.bashrc and insert the following line: export INUBIT_TOOLSET_WORKDIR=~/my_folder Using the JVM parameter 1. Open the start script <inubit-installdir>/client/bin/ start_local.bat or sh, respectively. 2. Insert the following line: set JVM_PARAMS=%JVM_PARAMS% -Dinubit.toolset.workdir=<Absolute_path_to_working_ directory> 3. Save your changes. When starting the inubit Workbench again, the new parameter is read and the working directory is created in the given location inubit 6.1: inubit Process Engine: Administrator and Developer Guide

71 Managing Users Administrating Users Administrating Users This section details the following topics: Creating Users, p. 71 Assigning Users to Additional User Groups and Editing the Assignment, p. 72 Editing Users: Assigning Roles and Groups, Defining Addresses, p. 73 Blocking User Manually, p. 73 Unblocking Users, p. 74 Deleting Users, p. 74 Data visibility The visibility of data is controlled via the allocation of users to groups. The following applies: Each user has exactly one specific user role. Each user can display and edit her own data (modules, diagrams, Repository files). Each user belongs to one primary user group and can display and edit its data. Each user can display the data of her higher-level group. Each user can be assigned to one or more additional user groups and can display and edit their data Creating Users Prerequisites The user group the user should be assigned to already exist. Refer to Creating User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 80). 1. In the inubit Workbench display the tab Configuration > User Manager. 2. Select the group to which you want to add a new user. 3. Open the context menu and select New user. A dialog opens. The user group and user role are already preset. 4. Enter the user data or change the preset user data. 5. Click OK. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

72 72 Managing Users Administrating Users The dialog closes, the user is created and displayed in the user hierarchy. Share the password with the newly created user and recommend to modify immediately after the first login to the Workbench. Refer to Changing Your Own Password (Workbench: User Guide, chap. 1.8, p. 45) Assigning Users to Additional User Groups and Editing the Assignment You can assign one or more additional user groups to users. After having been assigned, users can display and edit the diagrams of these additional user groups, not only the diagrams of their own and their higher-level user group. The users are linked with the additional user group and hence are called linked users. By changing the data of a linked user or by deleting the user you directly change the data of the original user or delete the original user. As long as users are accessing the additional user groups diagrams, they cannot edit or display the diagrams of their own or their higherlevel user group. The root user is special and can always access the diagrams of her own user group. For information about changing to an additional user group refer to Switch to Additional User Group (Workbench: User Guide, chap. 1.4, p. 34). 1. Log-in to the inubit Workbench as root user. 1. Display the Configuration > User Manager tab. 2. Select the user you want to assign one or more additional user groups or whose assignment to additional user groups you want to edit. 3. Open the context menu and select Edit assignment to additional user groups. A dialog opens up. The primary user group of the user is already selected. It was assigned when creating the user. You cannot remove this selection. 4. Select all groups the user is to be assigned to. To delete an existing assignment, remove the corresponding selection. 5. Click OK to close the dialog inubit 6.1: inubit Process Engine: Administrator and Developer Guide

73 Managing Users Administrating Users 73 The linked user is displayed below the selected groups. A link symbol signals that the user is only linked to the groups, for example: If you have deleted the assignment to an additional group the user concerned is not displayed below this group any longer Editing Users: Assigning Roles and Groups, Defining Addresses It is possible to allocate existing users to another user group or role and change the user data. 1. In the inubit Workbench display the Configuration > User Manager tab. 2. Select the user you want to edit. 3. Open the context menu and choose Edit User Data. A dialog opens. 4. Change the user data. 5. Click OK. The dialog closes and the modified data is stored Blocking User Manually You can block users manually. Blocked users can no longer log in to the inubit Workbench. Blocked users who are already logged in but then blocked cannot continue working and must log out. The root user cannot be blocked! Blocked users are indicated in the User Manager tab by the white symbol, unblocked users by the yellow symbol: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

74 74 Managing Users Administrating Users Users can also be blocked automatically, refer to Block inactive user (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 26) 1. In the inubit Workbench display the Configuration > User Manager > User tab. 2. Select the user to be blocked. 3. Open the context menu and select Block User. A white symbol appears in the user hierarchy to the left of the user Unblocking Users Unblocked users may conduct all actions they were authorized to do before the block, in accordance with their role. Only blocked users can be unblocked. 1. In the inubit Workbench display the Configuration > User Manager tab. 2. Select the user to be unblocked. 3. Open the context menu and choose Unblock User. A yellow symbol is displayed in the user hierarchy to the left of the user Deleting Users The user root cannot be deleted. The user currently logged in cannot delete herself. When deleting users, their modules, diagrams and Repository files are also deleted! inubit 6.1: inubit Process Engine: Administrator and Developer Guide

75 Managing Users Changing User Passwords In the inubit Workbench display the Configuration > User Manager tab. 2. Select the user to be deleted. 3. Open the context menu and select Delete User. 4. Confirm the prompt. The selected users and their modules/diagrams are deleted and no longer displayed in the user hierarchy. 6.3 Changing User Passwords You can change other users passwords. Prerequisites You are logged in as root user. 1. In the inubit Workbench display the Configuration > User Manager tab. 2. From the user tree select the user whose password is to be changed. 3. Open the context menu and select Change Password. A dialog is displayed. 4. Enter a new password and repeat the entry in the input field Repeat new password. 5. Click OK to close the dialog. 6.4 Using LDAP User Directories This section details the following topics: Configuring the Connection to the LDAP Server and the User Synchronization, p. 76 Importing User from the LDAP Directory, p. 77 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

76 76 Managing Users Using LDAP User Directories Overview You can import users from directories of an LDAP server. Thereafter, you can choose whether you want to manage the imported users in the inubit software or on the LDAP server: Manage users in the inubit software You let the user data import once and manage it in the inubit software. Subsequent changes to the user data on the LDAP server do not affect the user data in the inubit software. Manage users on the LDAP server You import user data into the inubit software, activate synchronization and then manage the user data on the LDAP server. Changed user data is synchronized with the inubit software at configured intervals. If you create new users on the LDAP server after the first import of user data, then you must first import them into the inubit software, so that the new users are also compared regularly with the data on the LDAP server. The synchronization is unidirectional. Changes made to the user data in the inubit software are not transferred to the LDAP server! The LDAP server must be accessible to allow synchronized users to log into the inubit software. If the LDAP server cannot be accessed, login attempts to the inubit software will fail! If automatic synchronization is disabled, the LDAP last passwords that the users used are valid Configuring the Connection to the LDAP Server and the User Synchronization 1. In the inubit Workbench, display the Configuration > General Settings tab. 2. Display the Administration > LDAP User Synchronization configuration category. 3. Enter the server name, the server port, login and password. Refer to LDAP User Synchronization (inubit Process Engine: Administrator and Developer Guide, chap , p. 31). The Search domain name must be complete in order to clearly identify the user. 4. If you want to manage user data on the LDAP server in the future, then activate the option Automatic synchronization inubit 6.1: inubit Process Engine: Administrator and Developer Guide

77 Managing Users Using LDAP User Directories With the Synchronization interval option define the time interval, which is to be used for synchronizing user data. Refer to Importing User from the LDAP Directory (inubit Process Engine: Administrator and Developer Guide, chap , p. 77). 6. Optional: Transfer attributes from LDAP You can map LDAP attributes onto user properties of the inubit software: a. To the right of the option User properties mapping click. The dialog Property Table opens up. b. Via the context menu add the inubit user property. Enter the LDAP attribute as value of the inubit user property. 7. Save your changes Importing User from the LDAP Directory Prerequisites The access to the LDAP Server is already configured. Refer to Configuring the Connection to the LDAP Server and the User Synchronization (inubit Process Engine: Administrator and Developer Guide, chap , p. 76). 1. In the inubit Workbench display the Configuration > User Manager tab. 2. Select an arbitrary group. 3. Select Edit > Import > Import LDAP User. A dialog with the connection data to the LDAP server is displayed. 4. Click Next. A dialog opens listing the available users. 5. Select all the users whose data is to be imported/synchronized. 6. Click Next. A dialog for password entry is displayed. 7. Enter the password and repeat it. The password is used to log in to the inubit Workbench for onetime user import. It is only used when users are imported once and are not automatically synchronized. 8. Click Next. A dialog containing the current user data is displayed. - For each user enter the user name for login to inubit Workbench. - For each user choose a user role and a user group. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

78 78 Managing Users Exporting Users/User Groups 9. Click Finish. If the import was successful, a confirmation is received. The imported or synchronized user data is displayed in the User Manager. 6.5 Exporting Users/User Groups When exporting a user or a user group, all modules, workflows and optionally Repository files belonging to this user/user group are exported. The user group admin cannot be exported! When exporting user groups linked users are not exported. For information about linked users refer to Assigning Users to Additional User Groups and Editing the Assignment (inubit Process Engine: Administrator and Developer Guide, chap , p. 72). 1. In the inubit Workbench, display the Configuration > User Manager tab. 2. Select the user or the user group which you want to export. 3. Open the context menu and select Export user or Export user group. The export wizard opens and guides you through the export. The data is stored as *.zip file into the selected directory. 6.6 Importing Users/User Groups You can import users and user groups. The user or user groups must be available as export files (<group_name>.usergroup.zip> or <user_name>.user.zip). The import is rejected if a user or user group with the same name already exists in the selected group or in another group inubit 6.1: inubit Process Engine: Administrator and Developer Guide

79 Managing Users Managing User Groups 79 Importing single users Individual users can be imported into existing user groups on the target inubit Process Engine. You select the group when importing the user. The user groups the individual belonged to are not created automatically. You need to create them first. In case users already exist on the target inubit Process Engine their import is rejected. Roles If the import file contains roles with already exist on the target inubit Process Engine with the same name, then you can choose whether you want to keep the roles on the target inubit Process Engine or overwrite them. Importing users with roles from versions < 6 When importing users with roles from older versions you can keep the existing user roles if you like. You can assign the stakeholder roles contained in the inubit software subsequently. 1. In the inubit Workbench display the Configuration > User Manager tab. 2. Select the user group into which the new user or the new user group should be imported. 3. Open the context menu and select Import User or Import user group, respectively. A dialog opens. 4. Next to the File field click. A file explorer opens. 5. Navigate to the directory where the import file is located and load the file. 6. Optionally: In the dialog you can select another group as import target and thus correct your first choice. 7. Click OK to close the dialog. The import is completed, provided there is no user/user group with the same name in the selected group. 6.7 Managing User Groups This section details the following topics: Creating User Groups, p. 80 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

80 80 Managing Users Managing User Groups Renaming and Moving User Groups, p. 81 Deleting User Groups, p. 81 As the system administrator you are able to create any number of user groups. As a rule, one user group forms one organization unit, for example a company or department. A group directory is created for each user group on the inubit Process Engine, which the users of the same group may utilize as a directory for common objects (modules, workflows). Multi-client capability Groups can be structured hierarchically, which means that a group may be a sub-group of exactly one other group. The nesting depth is unlimited. This allows managing multiple clients within one inubit installation. The collaboration with different organizations is guaranteed by means of a higher-level user group directory. Different organizations can use this directory to exchange modules and diagrams that may be relevant in their collaboration Creating User Groups Follow the Organization Diagram of the company and the group of individuals who will be working with the inubit Workbench. In the hierarchy pyramid proceed from top to bottom. 1. In the inubit Workbench display the Configuration > User Manager tab. 2. Select the group in which the new user group should be created. 3. Open the context menu and select New User Group. A dialog opens. 4. Enter the name of the new user group. 5. Optionally, add a comment. 6. Click OK to close the dialog. The new user group appears in the user group directory tree inubit 6.1: inubit Process Engine: Administrator and Developer Guide

81 Managing Users Managing User Groups Renaming and Moving User Groups Existing user groups may be moved, their names and possible existing comments may be changed. 1. In the inubit Workbench display the Configuration > User Manager tab. 2. Select the group you want to edit. The Admin group cannot be edited! 3. Open the context menu and select Edit user group. A dialog is displayed. 4. Execute your changes: - Rename the group. - To move the group, select another group from the Higher-level group of the user list. - Edit the comment. 5. Click OK to close the dialog. The modified user group appears in the tree structure on the left side of the User tab Deleting User Groups The Admin group cannot be deleted! When deleting a user group, all groups and users including their modules and diagrams are deleted as well! 1. In the inubit Workbench display the Configuration > User Manager tab. 2. Select the user group that is to be removed. 3. Choose Edit > User Group > Delete User Group. Alternatively, open the context menu and choose Delete User Group. 4. Confirm the prompt. The user group is no longer displayed in the tree structure on the left side of the User tab. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

82 82 Managing Users Managing User Roles 6.8 Managing User Roles This section details the following topics: Creating and Configuring Roles, p. 83 Deleting User Roles, p. 84 Overview The role concept ensures that users of the inubit software are only able to display and modify those functions and rights they are authorized for. A user role is a collection of rights and may be freely configured. The rights grant users access to certain functions of the inubit Workbench and access to certain data objects. Overview about right/role assignments You can find an overview about all roles and their rights in the inubit Workbench in the Configuration > User Roles tab. Pre-configured roles The inubit software contains some pre-configured roles. You can use and adjust them or add further roles and configure them freely. The following roles are included in the scope of delivery: System Administrator This role manages and maintains the system in the operational field. This role owns all available rights. The right assignments cannot be changed. Project Lead This role leads and manages a project. The role has similar rights like the system administrator. Some rights for technical monitoring (access to the Audit Log, the Connection Manager and the Process Data Logger), the option to create application and diagram profiles and the access to the metadata and plug-in manager are missing. SOA Developer This role transposes business models into Technical Workflows or BPEL diagrams and can access all diagram types because these are needed for generating and linking. This role has similar rights like the project lead, but without configuration rights, without the right to use the su mode and has only restricted access to modules and system connectors as well as access to process maps and BPDs. Business Analyst inubit 6.1: inubit Process Engine: Administrator and Developer Guide

83 Managing Users Managing User Roles 83 This role creates and maintains business models. Thus the role can access all non-technical diagram types as, for example, Business Process Diagrams, Organizational Diagrams and SOA Maps. Additionally, a Business Analyst can create business rules, use the Repository, versioning (only create tag) and the Report Generator for creating reports. EAI Developer This roles integrates third-party systems via Technical Workflows. Unlike the SOA developer the EAI developer can access all modules and system connectors as well as to process maps and BPDs. Tasklist User This role takes part in projects. Typical role owners are members of specialist departments. In inubit Workbench this role only has the right to display and use the Tasklist tab. The role Tasklist User is only displayed if the Task Generator Module is licensed Creating and Configuring Roles 1. In the inubit Workbench, display the Configuration > User Roles tab. 2. Select a role. 3. Open the context menu and choose New User Role. A dialog opens. 4. Enter the name of the new user role. 5. Click OK to close the dialog. The new user role is sorted alphabetically in the tree structure and displayed. In the right area there is a summary of all rights that may be assigned to the role. 6. Select all the rights that are to be allocated to the new user role. If working in teams, it is important that the team members be able assign the diagrams and modules to the group or higher-level group directory. If diagrams and modules are only assigned to their own particular user directory, the other group members will not be able to see them and/or develop them further. To assign a new user role to a team member, activate the rights for Designer and Module Editor that contain groups and superordinate groups. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

84 84 Managing Users Using Process Roles 7. To save, click. Now, you can assign the role to users. Refer to Creating User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 80) Deleting User Roles User roles can only be deleted if no more users have been allocated to the role. 1. In inubit Workbench display the Configuration > User Roles tab. 2. Select the role to be deleted. 3. Open the context menu and choose Delete User Role. 4. Confirm the prompt with OK. The role is deleted and no longer displayed in the User Roles tab. 6.9 Using Process Roles This section details the following topics: Creating Process Roles, p. 85 Assigning Process Roles and Changing Existing Process Role Assignments, p. 85 Delete Role Assignments, p. 86 Deleting a Process Role, p. 87 Overview You use process roles to assign tasks to inubit users. Tasks are either displayed in the task list in a browser or in Tasklist tab in inubit Workbench inubit 6.1: inubit Process Engine: Administrator and Developer Guide

85 Managing Users Using Process Roles Creating Process Roles 1. In the inubit Workbench display the Configuration > Process roles tab. 2. In the left area, select the Process roles folder. 3. Open the context menu and select New process role. A dialog is displayed. 4. Enter the name of the new process role. 5. Optionally, enter a comment. To change the comment later, select the role, open the context menu, and select Edit properties. 6. Click OK to close the dialog. The process role is generated. You can now use the process role, for instance to assign roles in the Task Generator or in an Organization Diagram. Refer to - Assigning Process Roles and Changing Existing Process Role Assignments (inubit Process Engine: Administrator and Developer Guide, chap , p. 85) - Permissions Dialog (Workbench/Process Engine: Modules Guide, chap , p. 127) - Assigning Users and Process Roles (Workbench: User Guide, chap. 8.2, p. 224) Assigning Process Roles and Changing Existing Process Role Assignments You can directly assign process roles to inubit users. If you are using organization diagrams, then you can alternatively assign process roles based on role elements to inubit users. Refer to Assigning Users and Process Roles (Workbench: User Guide, chap. 8.2, p. 224). 1. In the inubit Workbench display the Configuration > User Manager tab. 2. Select the user to whom you want to assign a process role. 3. Open the context menu and select Edit process role. A dialog opens. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

86 86 Managing Users Using Process Roles 4. Enable the check boxes for those process roles you want to assign to the user. You can change existing assignments by selecting further check boxes or removing checks. 5. Click OK to close the dialog. In order to check your changes, open the Process Roles tab. In organization diagrams you can also assign process roles to the Role and Supervisor (role) elements, refer to Assigning Users and Process Roles (Workbench: User Guide, chap. 8.2, p. 224). 6. Changing a process role assignment Select the user whose role assignment you want to change. 7. Open the context menu and select Edit process role. The Process role assignment dialog opens again. 8. Change the assignments by selecting or deselecting checkboxes. 9. Click OK to close. The changes are displayed in the tab. 10. Suspending a role assignment Expand the process role in which you want to change the user s assignment to Suspend role. 11. Select the user. Open the context menu and select Suspend role assignment. 12. Confirm the prompt. The dialog closes, and the user is no longer displayed below the role Delete Role Assignments 1. In inubit Workbench display the Configuration > Process Roles tab. 2. At the process role whose role assignment you want to delete click the + button. 3. Select the user. 4. Open the context menu and select Suspend role assignment. 5. Confirm the call back. The assignment is deleted. The user is not displayed below the process role anymore inubit 6.1: inubit Process Engine: Administrator and Developer Guide

87 Managing Users Using Process Roles Deleting a Process Role Prerequisites A process role can only be deleted when it no longer has any assigned users. Refer to Delete Role Assignments (inubit Process Engine: Administrator and Developer Guide, chap , p. 86). 1. In the inubit Workbench display the Configuration > Process Roles tab. 2. Select the role to be deleted. 3. Open the context menu and select Delete process role. 4. Confirm the call back. The process role is deleted and no longer displayed in the tab. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

88 88 Managing Users Using Process Roles inubit 6.1: inubit Process Engine: Administrator and Developer Guide

89 7 Technical Monitoring 89 This section details the following topics: Queue Manager: Monitoring Running Processes, p. 90 Scheduler Manager: Scheduled Processes, p. 94 Connection Manager: Monitoring Systems, p. 97 Key Manager: Managing Certificates Centrally, p. 103 Audit Log: Monitoring User Actions, p. 105 System Log, p. 107 Server Trace Log: Displaying Server Traces, p. 111 Workbench Trace Log, p. 112 Error Messages in Monitoring, p. 113 Remote Monitoring Using the Command Line Interface (StartCLI), p. 113 Changing the Monitoring Table Views, p. 114 Monitoring functions The Technical Monitoring of the inubit software offers the following features: Monitoring running workflows With the Queue Manager you supervise the status of all not yet successfully finished and waiting processes. You can also stop, restart, continue and delete processes. Displaying start times of scheduled workflows In the Scheduler Manager all schedules are displayed which are configured in system connectors in active Technical Workflows. Supervising all systems controlled by Watchdogs In the Connection Manager all systems are displayed which are registered at the inubit Process Engine and are controlled by a Watchdog. Supervising the validity of certificates In the Key Manager you supervise the validity of certificates in your active system connectors and in partner management objects. Displaying the status of finished workflows In the System Log already executed Technical Workflows and system processes are displayed. For each entry detailed information as for example status, priority and process ID is available. Supervising administrative user actions By using the Audit Log you control the administrative actions users perform on the inubit Process Engine (for example log-in/log-out) as well as changes of modules and workflows (creating, modifying, deleting). Displaying logs of the inubit Workbench and inubit Process Engine inubit 6.1: inubit Process Engine: Administrator and Developer Guide

90 90 Technical Monitoring Queue Manager: Monitoring Running Processes Remote access to monitoring and option for remotely activating logging Roles and rights For monitoring workflows in group and higher-level group directories there are the rights Monitoring > Monitoring for group directory and Monitoring > Monitoring for higher-level group directory. You can activate these rights when configuring the roles included in delivery and when creating new roles. Also refer to Overview about right/role assignments (inubit Process Engine: Administrator and Developer Guide, chap. 6, p. 82). 7.1 Queue Manager: Monitoring Running Processes This section details the following topics: Queue Manager Functions, p. 93 Adding Columns in Queue Manager/System Log, p. 94 Call Up inubit Workbench > Monitoring tab > Queue Manager The Queue Manager offers the following options: Viewing the status of all not yet successfully completed and waiting processes Refer to Possible process statuses (inubit Process Engine: Administrator and Developer Guide, chap. 7, p. 91) Stopping processes, restarting them, continuing them, continuing them on another tag or deleting them Analyzing errors occurring Information about table columns In the Queue Manager, the following information is displayed: Column name Global process ID Explanation Identifier. Identical to the process ID as long as it is not set explicitly. Refer to Changing the ISGlobalProcessId (Workbench: User Guide, chap , p. 375) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

91 Technical Monitoring Queue Manager: Monitoring Running Processes 91 Column name Process ID Workflow Name Module name Tag Branch Module type Beginning Next start Status File name and size Owners Priority Explanation Unique process identifier. Name of the workflow. Module at which the process currently waits. Displays the tag on which the process is executed. Displays the branch in which the process is executed. Type of the module at which the process currently waits. Date and time the processing was started. Date and time the processing will be restarted. Only available if a scheduler has been configured. Status of the selected process. Name and size of the module input message. Login name of user who created the workflow. The values are specified when configuring the workflow. Possible process statuses Processes in the Queue Manager have one of the following statuses: Status Processing Waiting Explanation Messages are being processed. The process waits, for example at a multiplexer for another process, at a system connector, Workflow Starter or Wait module with scheduler for a specific date and time or at a Task Generator for user interaction. In this state the process does not consume any resources. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

92 92 Technical Monitoring Queue Manager: Monitoring Running Processes Status Queued Error Retry Suspend Explanation The process is not yet started and waits for a free workflow thread. The maximum number of parallel threads depends on your license, on the configuration of the workflow threadpool of the inubit software and on the parallelism settings of the diagram the process belongs to. Refer to - Configuring the Thread Pool for Workflows (inubit Process Engine: Administrator and Developer Guide, chap , p. 30) - Parallel execution (Workbench: User Guide, chap. 2, p. 105) An error is preventing further processing. A system connector is attempting to establish a connection. Process was stopped manually. Configuring views and storing views You can filter and sort table data, hide/display columns, and store the configured views. Furthermore, you can add customized columns. Refer to - Changing the Monitoring Table Views (inubit Process Engine: Administrator and Developer Guide, chap. 7.11, p. 114) - Adding Columns in Queue Manager/System Log (inubit Process Engine: Administrator and Developer Guide, chap , p. 94) Roles and rights In order to manage processes in Queue Manager the role system administrator is required. Location for storing table data The table data is stored in the is monitoring database. Publishing data You can also make the table data available in the inubit Enterprise Portal in a portlet. Refer to Creating Monitoring Portlets (Workbench: User Guide, chap , p. 494) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

93 Technical Monitoring Queue Manager: Monitoring Running Processes Queue Manager Functions In the Queue Manager, the following commands are found in the process context menu: Stop Opens a query dialog, asking if the process should be stopped immediately or once the current module has been finished: - Immediately: the execution is stopped immediately, the processing of the current module is not finished. - After the module: execution is stopped after the module. Start Starts the process. Start immediately with file Open a file explorer to select the file to be used to start the process. Start immediately with modified file Loads the start file and the start variables of the workflow into an editor. You can edit the start file and the variables. When you click OK, the workflow is started again with using the modified data. Delete Deletes the process. The input messages and interim results are removed as well. Delete all filtered processes Deletes all processes matching the currently active filter criteria. Force tag change For moving the tag the process is executed on. Refer to Changing a Tag During the Execution (Workbench: User Guide, chap , p. 459). Show error message Displays the error message text. View process steps Displays the completed steps of the process. Show workflow Displays the name of the workflow the process belongs to. After clicking on the name the workflow is displayed in Designer. View file Displays the input messages of the selected process. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

94 94 Technical Monitoring Scheduler Manager: Scheduled Processes Adding Columns in Queue Manager/System Log 1. In the inubit Workbench, display the Configuration > General tab. 2. Open the Monitoring > User-Defined Columns configuration category. 3. Double click in the Value column, in the row that is used to expand the Queue Manager or the System Log. Enter the name for the new column. The name must be identical with the name of the referenced variable. 4. Save the changes to transfer the changes to the server. The names assigned in the Value column are displayed in the Queue Manager or System Log. The column names you provided are only used in the Queue Manager or System Log. In the dialog, the names from the Configuration tab are used to hide/display the columns. 7.2 Scheduler Manager: Scheduled Processes This section details the following topics: Enabling and Disabling Schedulers, p. 95 Displaying the Configuration of the Scheduler, p. 96 Change Configuration of the Scheduler, p. 96 Starting Scheduled Processes, p. 97 Displaying Technical Workflows for Processes, p. 97 Call Up inubit Workbench > Monitoring > Scheduler Manager The Scheduler Manager displays all schedules which are configured in system connectors in active Technical Workflows. Refer to Dialog Scheduler (Workbench/Process Engine: System Connectors Guide, chap , p. 22). You can modify the configuration of the schedules as well as display and start technical workflows inubit 6.1: inubit Process Engine: Administrator and Developer Guide

95 Technical Monitoring Scheduler Manager: Scheduled Processes 95 Table columns In the Scheduler Manager, the following information is displayed: Column name Workflow name Module name Tag Branch Module type Scheduler status Next start Owner Explanation Name of the workflow for which a scheduler has been established. Name of the system connector to which scheduler is configured. Name of the tag the workflow execution is based upon. Name of the branch, the workflow is executed in. Type of system connector (e.g. FTP Connector) Enabled/disabled Date of the next processing in the schedule. Owner of workflows where the scheduler has been established. Configuring views and storing views You can filter and sort table data, hide/display columns, and store the configured views. Refer to Changing the Monitoring Table Views (inubit Process Engine: Administrator and Developer Guide, chap. 7.11, p. 114). Publishing data You can also make the table data available in the inubit Enterprise Portal in a portlet. Refer to Creating Monitoring Portlets (Workbench: User Guide, chap , p. 494). Location for storing table data The table data is stored in the is monitoring database. Refer to Managing inubit Databases (inubit Process Engine: Administrator and Developer Guide, chap. 8, p. 119) Enabling and Disabling Schedulers Input System Connectors: When you disable the scheduler of an input system connector, then the applicable workflow is not able to process any messages and the incoming messages are saved in the Input Queue. Output System Connectors: When you disable the scheduler of an inubit 6.1: inubit Process Engine: Administrator and Developer Guide

96 96 Technical Monitoring Scheduler Manager: Scheduled Processes output connector, then the messages to be sent are collected in the output queue of the workflow or sent directly after finishing the workflow process. 1. In the Scheduler Manager select the scheduler process to be enabled or disabled. 2. Open the context menu and select Activate Scheduler or Deactivate Scheduler. The scheduler status will switch to Active or Inactive Displaying the Configuration of the Scheduler 1. In the Scheduler Manager select the scheduler process to see the configuration. 2. Open the context menu and select Show Configuration. For the active schedule, a dialog opens that displays the processing schedule. For an inactive schedule, a message is displayed that no schedule is active Change Configuration of the Scheduler 1. In the Scheduler Manager select the scheduler process for which the schedule is to be changed. 2. Open the context menu and select Change schedule. After confirming the dialog, the schedule of the system connector is opened in the Editor module. The scheduler can now be edited. Remember to republish the system connector after editing, if necessary inubit 6.1: inubit Process Engine: Administrator and Developer Guide

97 Technical Monitoring Connection Manager: Monitoring Systems Starting Scheduled Processes 1. In the Scheduler Manager select the scheduler process to be started. 2. Open the context menu and select Start process immediately Displaying Technical Workflows for Processes The applicable Technical Workflow may be displayed for all scheduled processes: 1. In the Scheduler Manager, select the scheduler process to see the Technical Workflow. 2. Open the context menu and select Show Workflow. The Technical Workflow is displayed in Designer. 7.3 Connection Manager: Monitoring Systems This section details the following topics: Activating Watchdogs for Monitoring Systems, p. 99 Monitoring inubit Process Engines by Remote Computers, p. 100 Updating Monitored Components, p. 101 Login in to Monitored Component, p. 102 Starting/Stopping Monitored Remote Connectors, p. 103 Call Up inubit Workbench > Monitoring > Connection Manager In the Connection Manager, all systems that are logged on to the inubit Process Engine and are monitored by a watchdog are displayed. The following systems are automatically monitored and displayed in the Connection Manager: inubit Workbenches inubit 6.1: inubit Process Engine: Administrator and Developer Guide

98 98 Technical Monitoring Connection Manager: Monitoring Systems Are displayed as soon as users log onto the inubit Process Engine with their inubit Workbenches. Enterprise Portal Server The connection is displayed as soon as users actually use an inubit Web Application. You must activate the monitoring of connections to other inubit Process Engines and Remote Connectors manually, refer to Activating Watchdogs for Monitoring Systems (inubit Process Engine: Administrator and Developer Guide, chap , p. 99). Table columns In the Connection Manager the following information is displayed: Column name System ID System type Version Status Last connection Last update license valid until Explanation The following information is displayed depending on the system type: inubit Workbench: Name of the computer used to log on to the inubit Workbench and name of the user who logged on to this inubit Workbench Remote Connector: URL and port number of the remote connector inubit Process Engine: URL of server Enterprise Portal Server: String portal and name of the user who logged in at the portal server lastly. Type of the system for which the connection is to be monitored System version. OK or Error. Error is displayed if the time interval for sending the ping signal to the monitored system has been exceeded by a factor of three. Date the last ping signal was received. Date the license of the system was updated last Date the system license expires Configuring views and storing views You can filter and sort table data, hide/display columns, and store the configured views. Refer to Changing the Monitoring Table Views (inubit Process Engine: Administrator and Developer Guide, chap. 7.11, p. 114) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

99 Technical Monitoring Connection Manager: Monitoring Systems 99 Publishing data You can also make the table data available in the inubit Enterprise Portal in a portlet. Refer to Creating Monitoring Portlets (Workbench: User Guide, chap , p. 494). Location for storing table data The table data is stored in the is monitoring database. Refer to Managing inubit Databases (inubit Process Engine: Administrator and Developer Guide, chap. 8, p. 119) Activating Watchdogs for Monitoring Systems A watchdog can monitor the connection to the following systems: Remote Connectors Other inubit Process Engines If the connection is disrupted, then this is signaled to the responsible persons, for example via mail. For information about enabling the messaging mechanism - for Remote Connectors: Configuring Log File, Debug Level and Parser (inubit Process Engine: Administrator and Developer Guide, chap , p. 154) - For other inubit Process Engines: Alerting (inubit Process Engine: Administrator and Developer Guide, chap. 9, p. 125) Background For every component, a separate watchdog process is started on the computer on which the system is installed. The watchdog waits on the port for a ping signal from the system to be monitored. Ping is a program used by the monitored system to check if the inubit Process Engine and the watchdog can be reached on the IP network. If the watchdog no longer receives ping signals from the system to be monitored, then the respective connection in the Connection Manager will receive an Error status; the watchdog sends a message (provided the notification mechanism is enabled) and ends automatically. Requirements The system to be monitored has already started. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

100 100 Technical Monitoring Connection Manager: Monitoring Systems Starting a watchdog 1. Display the Monitoring > Connection Manager tab. 2. Open the context menu of the table and select Add. A dialog is displayed. 3. Do one of the following: - Select the URL of the component to be monitored. - Adjust the URL of the inubit Process Engine. 4. Optionally: To establish a secure connection with the selected component, click SSL. The Dialog SSL Configuration (Workbench/Process Engine: System Connectors Guide, chap , p. 24) for configuring the server and client authentication opens. 5. Define the time interval between the ping signals. 6. Test the port. 7. Click Finish. The watchdog is started; if there is an error function in the monitored system, the status is set to Error after three times the length of the interval. Stopping a watchdog 1. In the Connection Manager, select the system that you no longer want to monitor. 2. Open the context menu and select Delete. The watchdog process is stopped, the connection to the selected system is cancelled and no longer displayed in the table of the Connection Manager Monitoring inubit Process Engines by Remote Computers If you activate a watchdog for an inubit Process Engine in the inubit Workbench, then the watchdog will run on the same computer as this inubit Process Engine. In case this computer fails, monitoring the inubit Process Engine is no longer possible. You therefore have the option of monitoring an inubit Process Engine by means of a script from a remote computer. You need to install an inubit Workbench on the remote computer inubit 6.1: inubit Process Engine: Administrator and Developer Guide

101 Technical Monitoring Connection Manager: Monitoring Systems Open the script in the directory <inubit-installdir>/ client/bin/check_is_status.bat or check_is_ status.sh. 2. Enter in the row set START_URL the URL of the inubit Process Engine to be monitored. 3. Start the script. When executing the script, the inubit Process Engine is tested to determine whether the script was executed and if a login was successful. If this is the case, 0 is returned; if an error occurred, a 1 is returned Updating Monitored Components The following removed components may be updated using the inubit Workbench: Remote Connectors Other inubit Process Engines Select one of the following options: Update the component system files. Here, the files ibis.jar and ibis-tools.jar from the directory <inubit-installdir>/server/ibis-root/conf/ deploy are compared to the component files in the directory lib (for the file ibis.jar the version is compared, and for ibistools.jar the size is compared). If the files currently on the components have a lower version/different size, then an update is started. Transfer driver or plug-ins you developed yourself. Requirements Only available if the updated component has a different version from the inubit Process Engine. Access and write rights are required for the removed component. 1. In the Connection Manager, select the component to be updated. 2. Open the context menu: - to update remote connectors or inubit Process Engines, select Update System Libraries. This command installs updated system files on the selected component. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

102 102 Technical Monitoring Connection Manager: Monitoring Systems After the installation is complete, remote connectors are automatically restarted; the inubit Process Engine must be rebooted manually. - To load self-developed plug-ins or drivers on the inubit Process Engine, select Upload Library. A login dialog is displayed. 3. Log in and start the update. Cancelling upload 1. To stop an upload that has already started, select the component in the Connection Manager. 2. Open the context menu and select Cancel Upload Login in to Monitored Component In the Connection Manager, you can log in to a watchdog-monitored system in order to configure it. Requirements A user account for the components is available. The component is monitored by a watchdog and has an OK status. The component and the inubit Workbench used to log in, should have the same patch level. A warning will be displayed if that is not the case. 1. In the Connection Manager, select the component you wish to log in to. 2. Open the context menu and select Log in A login dialog opens: 3. Enter the user identification used to log in. 4. Click Log in. You are logged in to the component. The inubit Workbench is updated. In the status bar of the inubit Workbench your current user name, your current user group and the URL of the component are displayed. Logging out To logout from the component, select File > Exit Server inubit 6.1: inubit Process Engine: Administrator and Developer Guide

103 Technical Monitoring Key Manager: Managing Certificates Centrally Starting/Stopping Monitored Remote Connectors This function is only available for remote connectors with a status of OK. Starting 1. In the Connection Manager, select the remote connector to be restarted. 2. Open the context menu and select Restart. The remote connector and the watchdog process are first stopped and then restarted. In Windows systems both processes are only visible in the Task Manager. Stopping This option is especially useful for Windows systems: after a restart via the inubit Workbench, the remote connector and watchdog processes are only visible in the Task Manager as Java processes among (possibly) many others, but no longer in their own DOS prompt. With the Stop option it is still possible to target the right process to be stopped. 1. In the Connection Manager, select the remote connector to be stopped. 2. Open the context menu and select Stop. The remote connector and its watchdog process are stopped. In Connection Manager the remote connector is displayed along with an error status. 7.4 Key Manager: Managing Certificates Centrally This section details the following topics: Updating Certificates in the Key Manager, p. 105 Call Up inubit Workbench > tab Monitoring > Key Manager inubit 6.1: inubit Process Engine: Administrator and Developer Guide

104 104 Technical Monitoring Key Manager: Managing Certificates Centrally The Key Manager monitors the temporal validity of all certificates used by active System Connectors, including all objects of the partner management. If a certificate expires, you can exchange it in the Key Manager by loading a new truststore or keystore file. Table columns In the Key Manager, the following information is displayed: Column name Module name Property name Property description Tag Module type Key URL Key validity Owner Explanation Name of the system connector Property name of the system connector containing the key. Use the property name to access the property. Provides technical information about the property. Tag which has been assigned to the system connector by tagging. Type of the system connector URL of the system connector Expiration date of certificate User role of user who created the system connector Configuring views and storing views You can filter and sort table data, hide/display columns, and store the configured views. Refer to Changing the Monitoring Table Views (inubit Process Engine: Administrator and Developer Guide, chap. 7.11, p. 114). Publishing data You can also make the table data available in the inubit Enterprise Portal in a portlet. Refer to Creating Monitoring Portlets (Workbench: User Guide, chap , p. 494). Location for storing table data The table data is stored in the is monitoring database. Refer to Managing inubit Databases (inubit Process Engine: Administrator and Developer Guide, chap. 8, p. 119) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

105 Technical Monitoring Audit Log: Monitoring User Actions Updating Certificates in the Key Manager Prerequisites For accessing system connectors configured as Remote Connectors, you must have a user account for the remote computer! 1. In the Key Manager, select the System Connector whose certificate is to be renewed. 2. Open the context menu and select one of the following commands: - Modify For loading a certificate and using it immediately. A dialog is displayed. Select a new truststore file and load it. - Modify later For loading a certificate and using it later from a selected point in time on. A dialog is displayed. The dialog s title always complies with the module type and name. a. Select a new truststore file and load it. b. Define the starting date and time of the certificate. 3. Click OK to close the dialog. 7.5 Audit Log: Monitoring User Actions Call Up inubit Workbench > Monitoring > Audit Log With the audit log, all administrative actions that users execute on the inubit Process Engine can be monitored (e. g. login/logout), as well as changes to module and workflow configurations. All actions are displayed along with user, time stamp and context information, making it possible to determine at any time who did what when. Table columns In the Audit Log the following information is displayed: Column name Action Explanation Actions triggered by a user. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

106 106 Technical Monitoring Audit Log: Monitoring User Actions Column name Object name Time Status Message User Explanation Name of the object that triggered an action is displayed. If the action was executed in su mode, then the name of the parent user is shown behind the name of the object in brackets. If an object has been moved from a user (group) to another user (group), the previous user (group) and the new user (group) is displayed next to the object name, each separated by a slash. If an object has been renamed, a slash and the previous name are displayed next to the new name. If an object located in a user group has been created or renamed, the user group name is displayed in double parentheses at the end of the entry. Date the action was triggered. Possible values: OK/Error. In case of Error status, the error message relating to the failed action can be displayed via the context menu. In case of Error status, the applicable error message is displayed here. Name of user who triggered the action. Only those users who were created in the same or in a subordinate group are displayed. Location for storing table data The table data is stored in the is monitoring database. Refer to Managing inubit Databases (inubit Process Engine: Administrator and Developer Guide, chap. 8, p. 119). Configuring Audit Log The table data is stored additionally in the Audit log in the file system. You can configure the maximum size of the Audit log file and the number of backups. Refer to Configuring Audit Logs (inubit Process Engine: Administrator and Developer Guide, chap , p. 21). Configuring views and storing views You can filter and sort table data, hide/display columns, and store the configured views. Refer to Changing the Monitoring Table Views (inubit Process Engine: Administrator and Developer Guide, chap. 7.11, p. 114) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

107 Technical Monitoring System Log 107 Publishing data You can also make the table data available in the inubit Enterprise Portal in a portlet. Refer to Creating Monitoring Portlets (Workbench: User Guide, chap , p. 494). 7.6 System Log This section details the following topics: Displaying Process Steps, p. 109 Displaying Error Messages, p. 110 Displaying Workflows, p. 110 Displaying Message Logs, p. 110 Restarting Processes, p. 111 Call Up inubit Workbench > Monitoring > System Log The system log displays the Technical Workflows and system processes already executed. For every entry detailed information, such as status, priorities and process IDs is available. From the system log, it is possible to display the workflows, their process steps and any existing error messages. Additionally, it is possible to filter and sort log entries and to customize them to the log tables. Table columns In the System Log, the following information is displayed: Column name Global process ID Process ID Workflow name Tag Explanation Identifier. Identical to the process ID as long as it is not set explicitly. Refer to Changing the ISGlobalProcessId (Workbench: User Guide, chap , p. 375). A number that uniquely identifies the workflow process. Name used to create the Technical Workflow. Displays the tag under which the workflow was executed. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

108 108 Technical Monitoring System Log Column name Input module Output module Size of the input file Size of output file Beginning End Duration Status Message Owners Priority Explanation Name of the first module in the Technical Workflow. Name of the last module in the Technical Workflow. In bytes. In bytes. Date and time the workflow was started. Date and time the workflow was finished. Total modules execution time (end time minus start time) in milliseconds. Two possible values: OK or Error If the workflow processing has OK status, then the column is empty. If the workflow processing finished with an Error, the respective message is displayed. Several messages are separated by a colon. Displays the login name of the person who created the workflow. Displays the priority allocated to the Technical Workflow during configuration. Location for storing table data The table data is stored in the is monitoring database. Refer to Managing inubit Databases (inubit Process Engine: Administrator and Developer Guide, chap. 8, p. 119). Configuring System Log The table data is stored additionally in the Audit log in the file system. You can configure the maximum size of the system log file and the number of backups. Refer to Configuring System Log (inubit Process Engine: Administrator and Developer Guide, chap , p. 22). Configuring views and storing views You can filter and sort table data, hide/display columns, and store the configured views. Furthermore, you can add customized columns. Refer to - Changing the Monitoring Table Views (inubit Process Engine: Administrator and Developer Guide, chap. 7.11, p. 114) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

109 Technical Monitoring System Log Adding Columns in Queue Manager/System Log (inubit Process Engine: Administrator and Developer Guide, chap , p. 94) Publishing data You can also make the table data available in the inubit Enterprise Portal in a portlet. Refer to Creating Monitoring Portlets (Workbench: User Guide, chap , p. 494) Displaying Process Steps In the System log it is possible to display detailed information about the individual, already finished steps and the applicable Technical Workflows for every process. 1. In the system log, select the process details to be displayed. 2. Open the context menu and select View Process Steps. Alternatively, double-click the process. For every process, a dialog opens. You can display several process step windows simultaneously. The following information is displayed in addition to the workflow: Column name Workflow Module name Predecessor Successor Message Start End Description Name of the workflow that belongs to the process steps List of all modules participating in the workflow Predecessor module, if available Successor module, if available Error message, if an error appeared in the first module of the row Date and time the execution of the module was started Date and time the execution of the module ended 3. To find the details of a specific module in a table faster, click Technical Workflow in the module. The corresponding entry is highlighted in color in the table. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

110 110 Technical Monitoring System Log Displaying Error Messages The error messages for every process completed with errors is displayed in the system log. 1. In the system log, select the process for which the error message should be displayed. 2. Open the context menu and select Show Error Message. An error message is displayed Displaying Workflows Displays the name of the selected workflow. Clicking on the name displays the workflow in Designer. 1. In the system log select the workflow to be displayed. 2. Open the context menu and select Show Workflow. The name of the workflow is displayed; click it. The Technical Workflow is displayed in the Designer tab Displaying Message Logs This function lists all archived input and output messages and displays them. Prerequisites Input/Output Message Logging is activated at the module and/or at the diagram. Refer to Input/Output Message Logging - on the diagram: Execution Tab (TWF and BPEL only) (Workbench: User Guide, chap , p. 105) - on the module: Input/output message logging (Workbench/ Process Engine: System Connectors Guide, chap. 1, p. 21) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

111 Technical Monitoring Server Trace Log: Displaying Server Traces Restarting Processes You can select a message, which was already processed, to start a workflow again. Prerequisites Input/Output Message Logging is activated at the module and/or at the diagram. Refer to Input/Output Message Logging - at the diagram: Execution Tab (TWF and BPEL only) (Workbench: User Guide, chap , p. 105) - at the module: Input/output message logging (Workbench/ Process Engine: System Connectors Guide, chap. 1, p. 21) Start the entire workflow a. Select Start process again with > Input. All input messages are listed, which were archived by the Input/ Output Message Logging. b. Select a message. The selected message is used to start the workflow execution directly after the Input System Connector. Start the Output Connector again a. Select Start process again with > Output. All output messages are listed, which were archived by the Input/Output Message Logging. b. Select a message. The Output System Connector is started again with the selected message. 7.7 Server Trace Log: Displaying Server Traces Call Up inubit Workbench > Monitoring > Server Trace Log When the trace log is activated, all logged messages and errors of the inubit Process Engine are displayed here. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

112 112 Technical Monitoring Workbench Trace Log Configuring and activating the Server trace You can configure the maximum size of the log and the number of backups, amongst others. Activating and Configuring Server Traces (inubit Process Engine: Administrator and Developer Guide, chap , p. 22) Storing the server trace Use the context menu of the view to save the currently displayed trace log as *.log or *.txt to a file. Searching the server trace Refer to Searching in inubit Workbench (Workbench: User Guide, chap. 1.9, p. 45). 7.8 Workbench Trace Log Call up inubit Workbench > Monitoring > Workbench Trace Log tab When the trace log is activated, in this tab all logged actions and errors of the inubit Workbench are displayed. Activating and configuring the Workbench Trace You can configure the maximum size of the log and the number of backups. Refer to Logging (Workbench: User Guide, chap. 1, p. 30) Storing the Workbench trace Use the context menu of the view to save the currently displayed trace log as *.log or *.txt to a file. Searching the Workbench trace Refer to Searching in inubit Workbench (Workbench: User Guide, chap. 1.9, p. 45) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

113 Technical Monitoring Error Messages in Monitoring Error Messages in Monitoring If monitoring is not available, an error message is displayed when clicking on the Monitoring tab. Possible causes are a defective database from which monitoring is drawing display information, a damaged database script. 1. Stop the server. 2. Do one of the following: - If you have got good SQL knowledge, configure the faulty entries in the database script <inubit-installdir>/ server/ibis_root/log/db/logs.script. - Rename the directory <inubit-installdir>/server/ ibis_root/log/db, for instance, to <inubitinstalldir>/server/ibis_root/log/defective-db. 3. Start the server. A directory db is created using a new, correct database script logs.script. Monitoring is available again Remote Monitoring Using the Command Line Interface (StartCLI) The command line tool StartCLI opens a server shell for access to the remote inubit Process Engine. It is used to query the following information: Version Content of the Queue Manager (number of workflows with a certain status, internal queue size) List of all users logged in Uptime Server time Internal VM memory requirement Alive check Number of errors in workflows Enable, disable, download trace Send, display, delete messages (IS) Available IPv4 addresses for the local host inubit 6.1: inubit Process Engine: Administrator and Developer Guide

114 114 Technical Monitoring Changing the Monitoring Table Views Starting the script The script for opening the server shell is found in: inubit Workbench <inubit-installdir>/client/bin/startcli.sh(bat) inubit Process Engine (if no inubit Workbench is installed) <inubit-installdir>/server/<tomcat resp. JBoss>/ bin/startcli.sh(bat) During startup submit the URL of the inubit Process Engine to be accessed to the script, as well as the user login data used for working. To list all the options available to start the StartCLI, start the script with the option -h. After the script starts, you can view a list of all StartCLI commands by entering either help or? Changing the Monitoring Table Views The number of table entries displayed in the various monitoring tabs can become very large. Various options are thus provided to customize the table display. These are described in the following sections: Navigating in Monitoring Tables, p. 114 Sorting, p. 115 Filtering the Table Contents, p. 115 Showing/Hiding Columns, p. 116 Moving Columns, p. 117 Saving, Displaying and Deleting Table Views., p Navigating in Monitoring Tables The navigation tools are located on the right, above the monitoring tables. Row number of currently selected row/number of rows visible. If you enter a row number and press Enter, the specified row is displayed and highlighted inubit 6.1: inubit Process Engine: Administrator and Developer Guide

115 Technical Monitoring Changing the Monitoring Table Views 115 Displays the first or last row of the table. Useful for jumping quickly to the start or end of large tables Sorting You can sort the contents of the monitoring tables. The figure shows an extract from a log with the facility to sort on multiple columns. Sorting 1. Click the header of the column on which you want to sort the table. 2. The table is sorted. An up arrow in the column header indicates that the table was sorted in ascending order on the selected column. Reversing/cancelling the sort 1. Click the column header again; the up arrow in the table header indicates that the sort has been reversed. 2. If you now click again, the sort is cancelled. No arrow is now displayed in the table header. Alternatively, click in the View field on the empty line. Multiple sorting Within a sort you can also sort the rows further by clicking in the headers of additional columns. Numbers are displayed in front of the column headings showing the sort sequence of the columns Filtering the Table Contents You can filter the contents of the monitoring tables on one or more criteria. Only the rows that match the specified filter criteria are then displayed. All other rows are hidden. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

116 116 Technical Monitoring Changing the Monitoring Table Views Filtering 1. Click in the yellow row below the column header you want to use as the criterion for filtering the table contents. A dialog is displayed. All the various entries in that column are displayed. Select the checkboxes for the entries that are to serve as filter criteria. These entries continue to be displayed while all others are hidden. Alternatively, enter the filter criterion (or a part thereof) directly in the text input field above the list. This is useful if all the entries you want displayed contain a common (partial) character string. 2. Click OK. The table contents are filtered in accordance with your specification; in the example shown, entering the partial character string System would cause just the entries System-Connection and System-Start to be displayed. The filter criterion is displayed in the yellow cell at the head of the filtered column as long as the filter is active. Displaying all To cancel the filter on a column, open the dialog for the column then click All. The column filter is removed. If no further filters are defined, the full contents of the table are now displayed; the label All is displayed in the yellow cell. If there are further filters defined, the contents of the table that match the remaining filters are now displayed Showing/Hiding Columns To improve readability of the monitoring tables you can selectively hide and reveal individual columns. 1. Open the context menu for a table header. The following menu is displayed containing all the available columns. 2. To hide a column, delete the check mark from the corresponding checkbox. 3. To show a column, select its checkbox inubit 6.1: inubit Process Engine: Administrator and Developer Guide

117 Technical Monitoring Changing the Monitoring Table Views Moving Columns You can move table columns by simply dragging and dropping them Saving, Displaying and Deleting Table Views. You can save all the changes that you have made to monitoring tables in the Queue Manager, Scheduler Manager, Connection Manager oder Key Manager as named table views.you can store as many views as you like. The views are stored in the directory <Operation_system_ specific_user_directory>/inubit/toolset/<version>/ conf/view. Storing table views 1. Configure the table as desired. 2. In the field View, enter a name for the view. 3. Click to save the view. Displaying table views Select am entry from the drop-down list of the field View. Returning to the unfiltered view Select the empty row from the drop-down list of the field View. Deleting table views 1. Display the view you wish to delete. 2. Click. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

118 118 Technical Monitoring Changing the Monitoring Table Views inubit 6.1: inubit Process Engine: Administrator and Developer Guide

119 8 Managing inubit Databases 119 This section details the following topics: Switching inubit Monitoring Database, p. 119 Creating Tables and Columns in the inubit Monitoring Database, p. 120 Switching inubit Task Database, p. 122 Dialog Database Manager, p. 123 Use The inubit software uses two H2 databases for storing the following data: inubit Monitoring Database - Data displayed in the Queue Manager, Scheduler Manager, Connection Manager, Key Manager - Reports, created by Process Data Loggers inubit Task Database Tasks generated by Task Generators In a production environment, you should switch to another database. The database user needs at least the CREATE TABLE, CREATE INDEX, and DROP INDEX rights. To avoid problems with special characters, you should activate UTF-8 encoding for the databases. 8.1 Switching inubit Monitoring Database In the H2 database which is included in delivery, the tables for monitoring are limited to 50,000 entries. At least one database entry is written for every workflow execution. If 110 workflows are executed every day, then these are each visible for about one year. The oldest entries are removed from the file system and transferred to a log file for archiving as soon as a maximum of 50,000 entries has been reached. The decision of which scenario will initiate a switch to another database depends on how many workflow executions take place during what timeframe and for how long the entries are to remain visible on the monitor. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

120 120 Managing inubit Databases Creating Tables and Columns in the inubit Monitoring Database If many workflows are executed simultaneously, or one workflow is executed more frequently, then the maximum number of entries in the H2 database may be reached quickly. By means of the enclosed configuration files it is then possible to switch to a database such as MSSQL, MySQL, Oracle or PostgreSQL, for example. 1. Install the JDBC driver which is appropriate for your selected database system. Refer to Installing Drivers (inubit Process Engine: Administrator and Developer Guide, chap. 3.4, p. 57). 2. In your database system create a schema. 3. Stop the inubit Process Engine. 4. Rename the configuration file of the H2 database, for example from logsdbconfig.xml to logsdbconfig.xml.h2. The configuration files are located in the directory <inubitinstalldir>/server/ibis_root/conf/. 5. Remove the configuration file ending you want to switch to, thus naming the file logsdbconfig.xml. 6. In the logsdbconfig.xml file adjust the values of the elements url, user and password, according to your database and work environment. The maximum number of entries in a database is each specified in the configuration file; e. g. <maximumlimit>41000</ maximumlimit> for a MySQL database. If increasing the number limit, please note the comment about the element! The comment contains a reference to the maximum number. 7. Restart the inubit Process Engine. 8.2 Creating Tables and Columns in the inubit Monitoring Database 1. Open the Dialog Database Manager (inubit Process Engine: Administrator and Developer Guide, chap. 8.4, p. 123). 2. Click Add. The dialog for adding a new table is displayed: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

121 Managing inubit Databases Creating Tables and Columns in the inubit Monitoring Database Enter the name of the table and click OK. The new table is displayed in the table overview. 4. In the Column tab click. The dialog for creating a new table column is displayed: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

122 122 Managing inubit Databases Switching inubit Task Database 5. Fill the dialog and close it with OK. The new column is displayed. Continue to create new columns, until you have configured the table according to your requirements. The, you can start filling the table with data. 8.3 Switching inubit Task Database 1. Install the JDBC driver which is appropriate for your selected database system. Refer to Installing Drivers (inubit Process Engine: Administrator and Developer Guide, chap. 3.4, p. 57). 2. In the database system create a new schema. 3. Stop the inubit Process Engine. 4. Open the configuration file of the inubit task database in the following directory: <inubit-installdir>/server/ibis_ root/conf/tasksdbconfig.xml inubit 6.1: inubit Process Engine: Administrator and Developer Guide

123 Managing inubit Databases Dialog Database Manager Comment out the <connection> element of the h2 Task Database. 6. Remove the comment characters of the <connection> element belonging to the database system you are using. 7. As values of the user and password elements enter the login data of your database user. 8. Adjust the value of the url element according to your database system and your working environment. Example: For a MySQL based database system containing a schema test on the computer myserver the value is: <url> jdbc:mysql://myserver:3306/ test?sockettimeout= </url> 9. Restart the inubit Process Engine. 8.4 Dialog Database Manager Call up Tab Configuration > General Settings, from the menu bar select Configuration > DB Manager Process Data Logger Refer to Process Data Logger (Utility) (Workbench/Process Engine: Modules Guide, chap. 20, p. 237). Complex Lookup Table Refer to Complex Lookup Table (Data Converter) (Workbench/ Process Engine: Modules Guide, chap. 1, p. 15). In this dialog, you administrate database tables. You can create, edit and delete tables in the selected database. The dialog offers the following options: Database Displays a list of all Database Connectors which are already published and the internal inubit monitoring database. When you select a database, its tables are displayed in the area Table Overview. Table overview Displays all tables of the selected database. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

124 124 Managing inubit Databases Dialog Database Manager If you have chosen the inubit monitoring database, only those tables are listed, which are writable. In the table, the following functions are available: Function Description Creates a new table. For renaming the selected table. Deletes the selected table. Sorts the tables alphabetically. Reloads the data from the database and refreshes the display. STRG+F Opens the search input field. Refer to Searching in inubit Workbench (Workbench: User Guide, chap. 1.9, p. 45). All functions are also available by using the table s context menu. Once you select a table, its structure is displayed next to it. Database info Displays name and version of the selected database. Table <Name> Info In the table, the column names, column types, lengths and possibly existing default values are given. Additionally, it is displayed whether the column is nullable. You can create new columns, edit existing columns or delete them. All entries and changes are committed immediately to the database without confirmation request. The last column of a database table cannot be deleted. In this case you must delete the whole table inubit 6.1: inubit Process Engine: Administrator and Developer Guide

125 9 Alerting 125 This section details the following topics: Events Triggering Alerts and Notification Paths, p. 125 Activating Notifications, p. 127 Activating the SNMP Alert, p. 128 Use The inubit software has a powerful alerting mechanism that can be used to obtain information about events as they occur in real-time via and/or SNMP. To use alerts, you first need to activate and configure monitoring of the events in question, and then do the same for one or both alerting mechanisms ( /snmp). 9.1 Events Triggering Alerts and Notification Paths The tables in the next sections list all events triggering alerts and state for each event whether notification via or SNMP is possible: Events Triggered by the System Environment, p. 125 Events Triggered by the inubit Process Engine, p Events Triggered by the System Environment You configure and activate monitoring of the following events in the inubit Workbench, tab Configuration > General Settings, configuration category Monitoring > System environment : Event Description SNMP Time interval for system environment check Hard disk usage Time interval for checking the hard disk usage and the memory load of the JVM. Attention: Too short intervals may impact the performance! Activates the monitoring of the hard disk. Max. hard disk usage in % Upper limit of hard disk usage; alert is triggered when limit is reached. x x JVM memory Activates the monitoring of the JVM. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

126 126 Alerting Events Triggering Alerts and Notification Paths Event Description SNMP Max. JVM memory load Upper limit of JVM memory load; alert is triggered when limit is reached. x x Events Triggered by the inubit Process Engine Workflows Monitoring of the following events is activated in the Configuration > General tab in the Monitoring > inubit Process Engine configuration category. Event Description SNMP Max. size of queue Max. faulty workflows Max. workflow executions Max. number of workflows in queue; alert is triggered when maximum is reached. Maximum number of faulty workflow executions permissible within a time interval, before the alert is triggered. Maximum number of workflow executions measured in a specified time interval. Exceeding this triggers the alert. x x x x x x Connections, timeouts, certificates, licenses and users Monitoring must be activated individually for following events: Event Description SNMP Canceling a connection to the monitored components Errors and timeouts during Technical Workflows Expiration of certificates in system connectors Monitoring of remote connections, for instance, is configured in the Connection Manager. Errors and timeouts are displayed in the Queue Manager. To be configured in the BPEL properties dialog and Technical Workflow diagrams, refer to After incorrect execution to (Workbench: User Guide, chap. 2, p. 107) All monitored certificates are displayed in the Key Manager. Warnings are sent daily beginning two weeks before expiration. Monitoring is triggered with the e- mail alert. x x x inubit 6.1: inubit Process Engine: Administrator and Developer Guide

127 Alerting Activating Notifications 127 Event Description SNMP Expiration of the inubit license Warnings are sent daily beginning two weeks before expiration; License monitoring is triggered with the alert and SNMP activation, respectively. x x User blocked because an incorrect password was entered too many times. Refer to Configuring inubit User Accounts (inubit Process Engine: Administrator and Developer Guide, chap , p. 26). x x User blocked because of inactivity x x User deleted because of inactivity x x 9.2 Activating Notifications For alert activating events the inubit software may send s to the root user with the System Administrator role. Refer to - For Technical Workflow diagrams you can define individual e- mail recipients, refer to After incorrect execution to (Workbench: User Guide, chap. 2, p. 107) - For a list of events that trigger an alert and may trigger an e- mail notification, refer to Events Triggering Alerts and Notification Paths (inubit Process Engine: Administrator and Developer Guide, chap. 9, p. 125) 1. Define an recipient a. In the inubit Workbench display the Configuration > User Roles tab. b. Expand the System Administrator user role folder and select the user root. c. Open the context menu and select change user data. A dialog opens. d. Enter a valid address. e. Confirm by clicking on OK. The dialog closes. 2. Activate notifications a. Display the Configuration > General tab. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

128 128 Alerting Activating the SNMP Alert b. Select the Monitoring > Notification configuration category. c. Activate the Notifications enabled option. d. In the Server name field enter the IP address or name of your server. e. Activate the Authentication option if the mail server expects a login. Then enter the login name and password. f. Save the information. 9.3 Activating the SNMP Alert The inubit Process Engine can send SNMP traps to a SNMP Manager to report the occurrence of certain events. The SNMP traps are sent as enterprisespecific traps. The general TrapID ( generic trap type ) therefore always has the value 6. Bosch Software Innovations GmbH uses the enterprise ID for inubit-generated traps. For a list of events that trigger an alert and may trigger an notification, refer to Events Triggering Alerts and Notification Paths (inubit Process Engine: Administrator and Developer Guide, chap. 9.1, p. 125). Events and their traps If the SNMP alert is activated and the following events occur, the company-specific TrapID (specific trap code) listed next to it is sent: Event Max. number of workflow executions during a time frame was exceeded Max. number of faulty workflow executions within the time frame was exceeded Max. number of workflows in the workflow queue was exceeded TrapID The configured maximum hard disc capacity is reached. 4 inubit Process Engine using more JVM than permitted 5 A user was blocked because an incorrect password was entered too many times. 6 A user was blocked because of inactivity 7 A user was deleted because of inactivity inubit 6.1: inubit Process Engine: Administrator and Developer Guide

129 Alerting Activating the SNMP Alert 129 Event Warnings about license expiration are sent daily beginning two weeks before expiration. TrapID 9 PITR is using more hard disk space than permitted.. 10 Examples OID for max. exceeded hard disk space: OID for max. JVM exceeded: Requirement An SNMP Manager must be installed as the recipient of the SNMP traps. The SNMP traps of the inubit Process Engine must be registered in the SNMP Manager. For this purpose the Object Identifier (OID) of the inubit software must be stated in the configuration of the SNMP Manager ( ). Bosch Software Innovations GmbH is happy to provide you with an MIB file (Management Information Base) on request. Please contact the inubit support. 1. In the inubit Workbench, display the Configuration > General tab. 2. Display the Monitoring > SNMP Alarming configuration category. 3. Check the Activate option. With this option you are activating the sending of SNMP traps if the alert is triggered. 4. Fill in the other fields. 5. Save your changes. The SNMP alerting is now activated. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

130 130 Alerting Activating the SNMP Alert inubit 6.1: inubit Process Engine: Administrator and Developer Guide

131 10 Backup and Restore 131 This section details the following topics: Backup and Restore, p. 132 Point-in-Time Recovery (PITR), p. 134 Overview The inubit software offers the following functions for data backup and restore: Backup and Restore When using Backup, system and user data of the inubit software are saved online in a specified time interval, using the Backup Connector. Using the saved data, the system status at the backup time can be restored offline. Refer to - Creating a Backup (inubit Process Engine: Administrator and Developer Guide, chap , p. 133) - Restoring System or User/User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 133) Point-in-Time Recovery (PITR) By means of the PITR, system and user data and optionally transaction data of the inubit software are saved continuously while in use. Based on the backup copies, any system status can be restored. Depending on the use and load of the inubit software, very large amounts of data can be generated. The point in time to which the system can be rolled back depends on the size of the available memory. Refer to - Activating and Configuring PITR (inubit Process Engine: Administrator and Developer Guide, chap , p. 136) - Restoring an inubit System with a PITR-Archive (inubit Process Engine: Administrator and Developer Guide, chap , p. 138) This feature must be activated in your license in order for you to use it. To extend your license, please insidesales@bosch-si.com. Usage Example In order to be able to restore your system safely and efficiently, it is reasonable to combine both backup functions of the inubit software and an operation system backup with each other, for example like this: Weekly full backup of the complete operation system, including the used databases, with added daily differential backup. Daily system and user group backup of the inubit software, preferably at night, when only few workflows are executed. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

132 132 Backup and Restore Backup and Restore Continuous logging of system and transaction data of the inubit software via PITR Backup and Restore This section details the following topics: Creating a Backup, p. 133 Restoring System or User/User Groups, p. 133 Overview The inubit software offers two backup types: System backup Saves the current status of the inubit software. The following directories are always saved: - inubit configuration (<inubit-installdir>/server/ ibis_root/conf, except for the EDI rules in the edi directory) - inubit Process Engine log directory <inubit-installdir>/ server/ibis_root/log - User group admin (comprises all users) User/User group backup Saves selected users or user groups, including their subordinate user groups. Apart from user data (incl. linked users data), all workflows, modules, Repository and Monitoring files of the selected users or user groups are saved. For information about linked users refer to Assigning Users to Additional User Groups and Editing the Assignment (inubit Process Engine: Administrator and Developer Guide, chap , p. 72). You can save other data as well, refer to Extended backup options (Workbench/Process Engine: System Connectors Guide, chap. 4, p. 44). Running Processes and Data Consistency In order to ensure the consistency of the backup, the backup is started only after all workflows with the status Processing have finished their current task, or when the workflows of the selected user/user group, resp., are completed. New workflows are not started. The workflows are released after completion of the backup inubit 6.1: inubit Process Engine: Administrator and Developer Guide

133 Backup and Restore Backup and Restore Creating a Backup Start the backup at a point in time, when as few as possible workflows are active! 1. Create a Technical Workflow. 2. Add a Backup Connector. 3. When configuring the Backup Connector, select the option System in order to create a system backup, or the option User/ user group to save user data. 4. Enter the name of the backup file. The backup file will be written to a default directory and overwritten with each execution of the Backup Connector. Thereby, already contained data are lost. Refer to Backup Connector (Workbench/Process Engine: System Connectors Guide, chap. 4, p. 43). 5. Optionally: Save all backup files a. In the Backup Connector, select the option Write to output stream. b. In the Technical Workflow, add a File or FTP Connector and connect it with the Backup Connector. Now the current backup file is saved under the given name into the selected directory Restoring System or User/User Groups In order to restore offline a selected system status or user/user group status, use the Restore application. A system backup overwrites the inubit installation which is to be restored. If you have, e. g., created more user groups after a backup, then these user groups will not be there any more after restoring. For user/user group backups only that group is completely reset which is replaced by the backup. If you, for example, restore a backup of the admin group, then all user groups below admin are reset. If you restore the backup of a sub-group of Admin, then only the selected group is reset, all other sub-groups of admin are preserved. Prerequisites When restoring a system backup: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

134 134 Backup and Restore Point-in-Time Recovery (PITR) The operation system, on which the system backup was created, is identical with the operation system, on which the target system is installed. The inubit Process Engine is stopped. 1. Open a command line prompt 2. In the directory <inubit-installdir>/server/restore/ open the script restore.bat or.sh. Pass on the absolute path of the file, which contains the backup, as parameter. To get explanations about the parameters, call restore.bat or.sh with the parameter -h. 3. Only for restoring user/user groups: For each user and user group to be restored, a confirmation request is displayed. Confirm all user/user groups, you wish to restore, with y. Restoring Portal communities or organizations (optional) 4. Start the Process Engine or the Enterprise Portal. 5. Start the script suitable for your platform with the backup file saved before in the <inubit-installdir>/server/restore/ directory: - restoreportal.bat -file <backup file> - restoreportal.sh -file <backup file> For each community/organization to be restored, a confirmation request is displayed. Confirm all communities/organization, you wish to restore, with y Point-in-Time Recovery (PITR) This section details the following topics: Activating and Configuring PITR, p. 136 Restoring an inubit System with a PITR-Archive, p. 138 Switching UDDI V3 to Oracle, p. 138 The Point-in-Time Recovery feature enables you to reset an inubit system into a consistent status, which was available at any point in time inubit 6.1: inubit Process Engine: Administrator and Developer Guide

135 Backup and Restore Point-in-Time Recovery (PITR) 135 This feature must be activated in your license in order for you to use it. To extend your license, please Functional principle For PITR, all data and actions are continuously written into a second file system, in addition to the actual file system of the inubit software. Optionally, transaction data (input and output messages as well as variables) can be included into the PITR. Log files of running workflows are not logged. Data and actions are archived block by block into directories below the PITR working directory. The block size is configurable. Directory names are made according to the pattern ibis_root<timestamp_ blockstart-blockend>. For the archive directories to be available in case of need, they must be archived by appropriate measurements. The available memory defines the backup horizon. In order to recover the inubit software to a consistent status at a specified point in time, the inubit Process Engine is stopped and the archive, which was created at the corresponding point in time, is imported via a script. PITR for other inubit components Database-based components and the Repository are not yet included in the PITR of the inubit software. For these components, you need to ensure yourself that appropriate data archives are available. Replace the provided databases by PITR-capable databases like Oracle and use their PITR functions. Logging and monitoring the database of the inubit software Refer to Switching inubit Monitoring Database (inubit Process Engine: Administrator and Developer Guide, chap. 8.1, p. 119). inubit Enterprise Portal Refer to Switching Liferay Database (inubit Process Engine: Administrator and Developer Guide, chap , p. 186). Repository Refer to Switching the Repository to an Oracle Database (Workbench: User Guide, chap. 19.1, p. 467). UDDI Refer to Switching UDDI V3 to Oracle (inubit Process Engine: Administrator and Developer Guide, chap , p. 138). inubit Task Database Refer to Switching inubit Task Database (inubit Process Engine: Administrator and Developer Guide, chap. 8.3, p. 122). Configuration of components for PITR is complex and depends on a variety of system-specific parameters. Therefore, the documentation inubit 6.1: inubit Process Engine: Administrator and Developer Guide

136 136 Backup and Restore Point-in-Time Recovery (PITR) can only give first details. If require, Bosch Software Innovations GmbH would be glad to give you support Activating and Configuring PITR Prerequisites Sufficient disk space on another hard disk system than the one, on which the inubit software writes to Your workflows must be idempotent, that means: a workflow, which is executed at a point in time A, will create the same result at the point in time A+x, too. Example 1: 10:31 a.m.: A workflow with a Wait makes an Insert into the database. 12:00 a.m.: System is reset to 10:15 a.m. and the inubit Process Engine is restarted 12:01 a.m.: The Wait of the workflow is exceeded, therefore the workflow is executed immediately after restarting and makes an Insert or InsertOrUpdate into the database, again. With not-idempotent workflow design the implications are: - For Insert: A new entry into the database is created and hence there are two orders of a customer - For InsertOrUpdate: The status of the order changes, e. g. from in progress to new. With idempotent design, there is a PreCondition check provided in the workflow and the system is consistent from the business view, even after the PITR. Example 2: 11:00 a.m.: A task is edited by a clerk. 13:00 p.m.: The system is reset to 10:30. The task is displayed to the clerk again. 1. In the inubit Workbench, display the tab Configuration > General Settings. 2. Display the Administration > Point in Time Recovery configuration category inubit 6.1: inubit Process Engine: Administrator and Developer Guide

137 Backup and Restore Point-in-Time Recovery (PITR) Use the following options to configure the PITR: Option Activate PITR Activate PITR for transaction data PITR working directory Max. usage of the hard disk with the PITR working directory PITR block Max. number of files Max. number of archives Smallest PITR unit Explanation Activates point-in-time recovery (PITR). PITR makes it possible to recover any state of the inubit Process Engine and thus minimize data losses in the case of an error. When activated, the workflows' transaction data (in- and output messages and variables) are also included in the PITR. Note: This feature may consume large amounts of memory under load Directory for storing PITR data. Note: Due to the large amounts of data select a directory on another partition than the IS partition. When activated, every five minutes the hard drive's workload is monitored. If the given threshold value is exceeded an alarm is triggered. In order to deliver the alarm, or SNMP alerts must be activated and configured. In order to deliver the alarm, or SNMP alerts must be activated and configured, refer to: - Activating Notifications (inubit Process Engine: Administrator and Developer Guide, chap. 9.2, p. 127) - Activating the SNMP Alert (inubit Process Engine: Administrator and Developer Guide, chap. 9.3, p. 128) By defining the PITR block's size you set the size of the individual PITR data unit. After the given time interval has expired, all data which was written during the interval is finalized. A new directory is created for the next time interval. Max. number of files per directory in the PITR working directory. As soon as the maximum number is exceeded, the oldest archives are deleted until the total number of archives is smaller than the maximum number. Note: Recovering data is possible only as long as the corresponding archive exists. Set the number at least to the value 2! Otherwise, the archive will be overwritten immediately after expiration of the time interval, which is given in the option PITR block. Defines the smallest unit of time which can be used for recovery. When selecting a unit consider how often your data are updated: if a file is updated ten times per second while a minute is selected as smallest PITR unit, then important data may be missing. 4. Save your changes. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

138 138 Backup and Restore Point-in-Time Recovery (PITR) Restoring an inubit System with a PITR-Archive You import the PITR working directory offline via a provided script. Prerequisites A functioning installation of the inubit software is available. If there is none, restore the installation based on the backup of the operation system. The PITR archive containing the data, which was written at the point in time to be recovered, already exists. 1. Stop the inubit Process Engine. 2. If you have converted the Repository to a database: Delete the directory <inubit-installdir>/server/ibis_ root/ibis_data/repository, so that the index for the oracle database is re-generated. Otherwise the index might reference data in the database which were not yet existing at the point in time to be recovered. 3. Open a command line prompt, go to the directory <inubitinstalldir>\server\restore\ and call the script restorepointintimerecovery.bat or.sh. Pass on the recovery-point-in-time as option in the format yyyy.mm.dd_ HH:MM:SS,sss. The directory <inubit-installdir>\server\ibis_root is time stamped and moved into the directory <inubitinstalldir>/server/restore. The ibis_root is restored on basis of the selected PITR archive. 4. If used: Restore the data of the Repository, UDDI and monitoring databases. 5. Restart the inubit Process Engine Switching UDDI V3 to Oracle The UDDI V3 writes into a provided H2 database. Replace this by a PITR-capable database. The UDDI V2 cannot be used together with PITR! Change the UDDI version in the Dialog UDDI Data Settings (Workbench/Process Engine: System Connectors Guide, chap , p. 451) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

139 Backup and Restore Point-in-Time Recovery (PITR) Stop the inubit Process Engine. 2. Extract the file WEB-INF/classes/hibernate.cfg.xml from one of the following files (depending on the application server used): - Tomcat: <inubit-installdir>/server/tomcat/ webapps/uddi.war - JBoss: <inubit-installdir>/server/jboss/server/ default/deploy/uddi.war 3. In the file hibernate.cfg.xml change the database connection settings as follows: <property name="connection.driver_class"> oracle.jdbc.driver.oracledriver </property> <property name="connection.url"> jdbc:oracle:thin:@host:1521:xe </property> 4. Enter the access data of an existing database user in the following elements: <property name="connection.username"> <property name="connection.password"> 5. Save your changes and copy the modified file back to the file uddi.war. 6. Restart the inubit Process Engine. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

140 140 Backup and Restore Point-in-Time Recovery (PITR) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

141 11 Creating Application and Diagram Profiles 141 This section details the following topics: Application Profiles, p. 141 Diagram Profiles: Profiles for Modeling Elements, p Application Profiles This section details the following topics: Functional Principle, p. 142 Locations for Storing Application Profiles, p. 142 Parameterizing Program Calls, p. 143 Call up inubit Workbench > Configuration tab > menu bar Configuration > Application profiles Use In an application profile, you specify, which external application is used for opening a file from the inubit software. Application profiles are useful in the following scenarios, for example: While executing a task data should be displayed and edited in an external program. The online help should be displayed in another browser than the default system browser. Messages in watch points should be displayed in specific editors. You can create new application profiles and edit the application profiles provided by the inubit software. Provided application profiles The inubit software includes the following application profiles: The provided application profiles are used by the inubit software. Do not delete these application profiles! Generic Application Uses file types mapping as provided by your operation system. For example, in Windows systems, files having the extension.doc are always opened with the application MS Word. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

142 142 Creating Application and Diagram Profiles Application Profiles This application profile is used if there is no specific profile available. Specific application profiles By using the following application profiles you can overwrite the settings of the Generic Application application profile: - Browser Opens the given Web browser for testing Web forms, on clicking a URL and for displaying the online help. - Client Opens the given client, if a an link (mailto:) is clicked in a diagram s comment, for example. - PDF Viewer Can be used, for example, for displaying process model reports. - Script Editor Opens an external editor for script editing. This profile is used by the Execution Connector, amongst others, to display scripts in an external editor Functional Principle On calling up an application profile the defined program is searched for and started on the user s computer. If the program does not exist on the computer or in another path, then each user can overwrite the global settings of the application profile by individual local settings Locations for Storing Application Profiles The global and local application profile settings are stored in the following directories: Global settings <inubit-installdir>/server/ibis_root/conf/app Local settings <OperationSystemSpecificUserDirectory>/inubit/ Toolset/<Version>/conf/app Only administrators can access this directory under Windows inubit 6.1: inubit Process Engine: Administrator and Developer Guide

143 Creating Application and Diagram Profiles Diagram Profiles: Profiles for Modeling Elements Parameterizing Program Calls You can hand over parameters when calling up external programs. You can insert the following parameters into the entry field Parameters by using the button: {File} For handing over, for example, the input message of a workflow as temporary file to the external program. If you do not use other parameters, enter the parameter "{File}". This ensures that paths including blanks are interpreted correctly. Without quotes paths including blanks could be interpreted as lists of multiple files. {XPath:Path} For handing over, for example, a node value from an XML input message to the called program. The button opens the XPath wizard, which you can use to create XPath expressions for reading the node value. Refer to XPath Assistant (Workbench: User Guide, chap. 1.17, p. 66) Diagram Profiles: Profiles for Modeling Elements Call up inubit Workbench > Configuration tab > menu bar Configuration > Diagram profiles inubit 6.1: inubit Process Engine: Administrator and Developer Guide

144 144 Creating Application and Diagram Profiles Diagram Profiles: Profiles for Modeling Elements Use A diagram profile defines which elements users can use for modeling diagrams. You can specifically reduce the various diagram types modeling languages complexity for selected user roles by assigning a profile to a role. For information how users can change their profiles refer to Changing the Diagram Profile (Workbench: User Guide, chap. 2.14, p. 89). In this dialog all existing profiles for each diagram types are displayed. You can create, edit and delete profiles. Creating a profile 1. Select the diagram type for which you want to create a profile. 2. Open the context menu and select Add. A dialog opens. 3. In the dialog, for each of the displayed languages enter a profile name. 4. Close the dialog with OK inubit 6.1: inubit Process Engine: Administrator and Developer Guide

145 Creating Application and Diagram Profiles Diagram Profiles: Profiles for Modeling Elements 145 The profile is created and displayed underneath the selected diagram type. Now you can create groups and add elements by using drag n drop. Assigning profile rights to roles Before users can use the profile you must assign the corresponding right to one or more roles. The right s name is identical with the profile s name. Refer to Managing User Roles (inubit Process Engine: Administrator and Developer Guide, chap. 6.8, p. 82) Creating User-defined Tasks (BPDs only) Use Creating your own task elements in your own group, optionally Creating a new group 1. Open the Configuration tab. 2. Choose the Configuration > Diagram profiles menu entry. 3. Choose the profile a user-defined task is to be added. 4. Choose the context menu entry Add group in the Selected groups/elements area. A dialog opens. 5. Enter the name of the group in the German and English tab. Creating a new task 1. Choose the context menu entry Add user-defined task in the Selected groups/elements area. A dialog opens. 2. Enter the task name. 3. Enter the stereotype. 4. Click on OK to save the changes. Now, the user-defined task is displayed in the specified group in the Tools docking window. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

146 146 Creating Application and Diagram Profiles Diagram Profiles: Profiles for Modeling Elements inubit 6.1: inubit Process Engine: Administrator and Developer Guide

147 12 Using the su Mode 147 The su mode (Switch User Mode) allows you to execute functions of the inubit software with the rights of other users instead your own. Using the su mode you can acquire the rights of any user belonging to your or a subordinated group without knowing the applicable password. Special status for user root The user root with the role system administrator in the group admin is the only user who can acquire the rights of all inubit Workbench users. No user can acquire the rights of the user root. Traceability In the su mode, the name of the currently logged-in user and the originally logged-in user are displayed in the status bar, for example miller(root). This means, that the user root has acquired the rights of the user miller. Refer to Status Bar (Workbench: User Guide, chap , p. 25). Modifications of modules and diagrams made in the su mode may be traced using the version information of the modified components. Among other things, this information shows the name of the user who made the changes, for example: Refer to Displaying Version Information (Workbench: User Guide, chap. 18.2, p. 446). Requirements You must have a role with the Switch User Mode right. By default only the System Administrator role has this right. Choose the user name to be used from the group hierarchy: a. From the menu bar select File > New Login As. All users belonging to the same or a subordinated group are listed: b. Click a user. Alternatively, choose the user name directly: a. From the menu bar select File > Login new as > User Selection. A dialog is displayed. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

148 148 Using the su Mode b. Select an account from the list or enter a user name. The inubit Workbench is refreshed and thereafter displayed as configured for the selected user. Going back Select File > Exit su mode. The inubit Workbench is refreshed and thereafter displayed as configured according to the rights of your own role inubit 6.1: inubit Process Engine: Administrator and Developer Guide

149 13 Remote Connector 149 This section details the following topics: Installing a Remote Connector, p. 150 Configuring System Connectors as Remote Connectors, p. 150 Configuring a Secure Connection to the inubit Process Engine, p. 150 Activating HTTP-/HTTPS Communication with Remote Computers via a Proxy Server, p. 151 Starting a Remote Connector Manually, p. 152 Starting the Remote Connector as Service, p. 152 Managing Remote Connectors, p. 153 Expanding the Remote Connector, p. 154 Use A Remote Connector is an application on a remote computer executing one or more System Connectors. It is controlled by an inubit Process Engine. Deploying a Remote Connector is useful to connect an inubit system with applications which cannot be connected directly for security reasons. The Remote Connector is installed on the interface between the company network and the Internet: Runtime behavior A Remote Connector can process ten parallel accesses of System Connectors at most. All other accesses are queued. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

150 150 Remote Connector Installing a Remote Connector 13.1 Installing a Remote Connector Prerequisites The Remote Connector must be accessible via a URL because Remote Connector and inubit Process Engine communicate with each other via HTTP/HTTPS. 1. On the remote computer, start the inubit setup and select the installation type Remote Connector. 2. Configure the System Connector, which is to be executed by the Remote Connector. Refer to Configuring System Connectors as Remote Connectors (inubit Process Engine: Administrator and Developer Guide, chap. 13.2, p. 150) Configuring System Connectors as Remote Connectors 1. Create a system connector. 2. When configuring it, in the Dialog Remote Connector Configuration (Workbench/Process Engine: System Connectors Guide, chap. 1, p. 25) select the option Remote Connector and enter the URL of the Remote Connector Configuring a Secure Connection to the inubit Process Engine Since version Generate a keystore and truststore file. 2. Stop the Remote Connector. 3. Open the configuration file of the Remote Connector <inubitinstalldir>/remoteconnector/conf/remote_conf.xml inubit 6.1: inubit Process Engine: Administrator and Developer Guide

151 Remote Connector Activating HTTP-/HTTPS Communication with Remote Computers via a Proxy Server Enter the paths and passwords of the keystore or truststore files in the respectively name elements (<TrustStorePassword>, <TrustStoreFile>, <KeyStoreFile>, <KeyStorePassword>). 5. Additionally, it is possible to limit the address range the remote connector accepts queries from (<IP>, by default all queries are accepted) and change the port of the remote connectors (<Port>). 6. Restart the Remote Connector. Versions < Generate the keystore and truststore files. 2. Stop the Remote Connector. 3. Restart the Remote Connector using the necessary parameters. You find the following parameters in the start script of the Remote Connector: - parameters for defining paths and passwords of the key- and truststore files, - parameters for restricting the address space, - parameters for changing the port. Refer to Configuring SSL Connections and Server Authentication (inubit Process Engine: Administrator and Developer Guide, chap. 5.1, p. 61) Activating HTTP-/HTTPS Communication with Remote Computers via a Proxy Server You can configure the Remote Connector in such a way that it uses a proxy server for accessing remote computers. Responses of the remote computers are also forwarded via the proxy server to the Remote Connector. 1. Stop the Remote Connector. 2. In a text editor, open one of the following files: - <inubit-installdir>/remoteconnector/bin/start_ rc.bat - If the Remote Connector is installed as a service: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

152 152 Remote Connector Starting a Remote Connector Manually <inubit-installdir>/remoteconnector/bin/rc_nt_ service_install.cmd 3. Activate using the proxy servers and define its name and port number by including the following options into the environment variable JAVA_OPTS, for example: - HTTP: set JVM_PARAMS=%JVM_PARAMS% -Dhttp.proxySet=true -Dhttp.proxyHost=proxy.inubit.com -Dhttp.proxyPort=84 - HTTP set JVM_PARAMS=%JVM_PARAMS% -Dhttps.proxySet=true -Dhttps.proxyHost=proxy.inubit.com -Dhttp.proxyPort= Restart the Remote Connector Starting a Remote Connector Manually There is a start script for starting the Remote Connector included in the scope of delivery. It can be found (depending on the operating system used) in the following directory: Windows: <inubit-installdir>\remoteconnector\bin\start_ rc.bat Linux: <inubit-installdir>/remoteconnector/bin/start_ rc.sh 13.6 Starting the Remote Connector as Service Windows For installing/de-installing there are scripts included in the scope of the inubit software delivery. The scripts can be found in the following directories: Installing: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

153 Remote Connector Managing Remote Connectors 153 <inubit-installdir>\remoteconnector\bin\rc_nt_ service_install.cmd Installation is carried out in the same way as the installation of the inubit Process Engine as a service, refer to (Un)installing the inubit Process Engine as Service Under Windows (inubit Process Engine: Administrator and Developer Guide, chap , p. 54). After a successful installation, you find under Start > Settings > System Control > Administration > Services the entry inubit Remote Connector. Uninstalling: <inubit-installdir>\remoteconnector\bin\rc_nt_ service_uninstall.cmd Linux The Linux script for installing the Remote Connector as a service consists of the runlevel script inubitrc and the configuration file inubitrc.conf. The script can be found in the following directories depending on your operating system: Tomcat: <inubit-installdir>/tomcat/bin/inubitrc.sh JBoss: <inubit-installdir>/jboss/bin/inubitrc.sh Installation is carried out in the same way as the installation of the inubit Process Engine as a service, refer to Installing the inubit Process Engine Under Linux as Service (inubit Process Engine: Administrator and Developer Guide, chap , p. 56) Managing Remote Connectors This section details the following topics: Monitoring, p. 154 Configuring Log File, Debug Level and Parser, p. 154 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

154 154 Remote Connector Expanding the Remote Connector Monitoring You can monitor, update, start and stop Remote Connectors in the Connection Manager via Watchdogs. Refer to - Activating Watchdogs for Monitoring Systems (inubit Process Engine: Administrator and Developer Guide, chap , p. 99) - Updating Monitored Components (inubit Process Engine: Administrator and Developer Guide, chap , p. 101) - Starting/Stopping Monitored Remote Connectors (inubit Process Engine: Administrator and Developer Guide, chap , p. 103) Configuring Log File, Debug Level and Parser Since version Stop the Remote Connector. 2. Open the configuration file of the Remote Connector in the directory <inubit-installdir>/remoteconnector/conf/ remote_conf.xml. 3. Change the information in the following elements: - Log File: LogFileSize, LogFileName, LogFileBackupIndex - Debug Level: <DebugLevel>, for debugging, enter the value Debug. 4. Restart the Remote Connector. Versions < Stop the Remote Connector. 2. Restart the Remote Connector using the appropriate parameters Expanding the Remote Connector In order to expand the functions of the Remote Connector, you can, for instance, add JDBC drivers for other databases or for independently developed plug-ins inubit 6.1: inubit Process Engine: Administrator and Developer Guide

155 Remote Connector Expanding the Remote Connector Stop the Remote Connector. 2. Upload the driver. Refer to Installing Drivers (inubit Process Engine: Administrator and Developer Guide, chap. 3.4, p. 57). 3. Restart the Remote Connector. Refer to Updating Monitored Components (inubit Process Engine: Administrator and Developer Guide, chap , p. 101). inubit 6.1: inubit Process Engine: Administrator and Developer Guide

156 156 Remote Connector Expanding the Remote Connector inubit 6.1: inubit Process Engine: Administrator and Developer Guide

157 14 Administering Liferay Version This section details the following topics: Portal Roles and Rights, p. 158 Liferay 5.2 Organizational Structures, p. 160 Managing Organizations, p. 164 Managing Communities, p. 166 Managing User Groups and Users, p. 172 Managing Portal Roles, p. 177 Managing Portlets, p. 179 Configuring Liferay 5.2, p. 182 By default, the inubit software is installed with the portal server Liferay version For information about Liferay version 6, refer to Administering Liferay Version 6 (inubit Process Engine: Administrator and Developer Guide, chap. 15, p. 195). Alternatively, you can install Liferay version 5.2. To do so, when installing the inubit software, select the installation type User defined and the option Liferay 5.2. Liferay version 4.2, which was delivered with older versions, is not supported anymore. Overview The inubit Enterprise Portal based on the portal server Liferay 5.2 can be utilized as a basis for intranets and for interacting with business partners. You can combine your business processes within a homogeneous graphical user interface and integrate your own employees, customers and business partners based on their roles into your business processes. The main component of the inubit Enterprise Portal is the inubit Process Cockpit which offers the most relevant functions as preconfigured BPM portlets. For more information refer to - Activating and Displaying the inubit Enterprise Portal (Workbench: User Guide, chap. 20.3, p. 487) - Developing Your Own Web Application (Tutorials, chap. 5.2, p. 82) - Calculation of Concurrent Users (Workbench: User Guide, chap. 20.1, p. 486) Further information Bosch Software Innovations GmbH recommends for further information: Liferay 5.2: Liferay Portal Administrator's Guide, Third Ed - As printed book: Rich Sezov, Liferay Press 2009, ISBN- 10: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

158 158 Administering Liferay Version 5.2 Portal Roles and Rights - As PDF: Liferay 5.0: Development Documentation Liferay Portal Enterprise Intranets, Jonas X. Yuan, Packt Publishing, Birmingham, UK, 2008, ISBN-10: Portal Web Services For a list of all Web Services offered by the inubit Enterprise Portal based on Liferay 5.2 refer to axis. The inubit Enterprise Portal must already be activated. Technical information For the communication between the portal server and the inubit Process Engine SOAP is used. Therefore, it is of no importance whether the two systems are installed on the same or on different computers. Portlets are deployed into the portal via Web Service calls from the inubit Process Engine. The inubit software and the inubit Enterprise Portal are 100% JSR-168 compliant. This standard allows the integration of any portlets provided that they have been developed in accordance with the JSR- 168 standard. Of course, you can use any other portal server with the inubit software rather than the one supplied. For information about the necessary configuration steps contact Bosch Software Innovations GmbH Portal Roles and Rights Portal roles A portal role is a container for rights. Liferay 5.2 s portal roles are independent of the inubit roles. Access must be set up to both components for users wishing to use both. By default, the portal server is provided with the following portal roles: Administrator inubit 6.1: inubit Process Engine: Administrator and Developer Guide

159 Administering Liferay Version 5.2 Portal Roles and Rights 159 Possesses all rights, e. g. the rights to create portal users, portal roles and communities. Administrators may add resources such as pages and content to communities' private pages and also possess private pages of their own. Power User Power users possess a personal area in which they may add and delete pages and content. However, this function is deactivated in the inubit Enterprise Portal. To activate this function open the <inubit-installdir>/server/tomcat/webapps/root/ WEB-INF/classes/portal-ext.properties file and set the property private.pages=false. User Users may perform the tasks assigned to them on the private pages of their community but they do not have a private area and can neither add nor delete pages. New users are automatically assigned the User role. Guest Guests can only view the public areas of the communities and have no areas of their own. Several pre-configured users are supplied with inubit software; their login details are displayed on the login page of the Enterprise Server. Organization areas In addition to the roles, the portal server has the concept of organizational areas. These can be of the following types: Company Organization Locations inubit 6.1: inubit Process Engine: Administrator and Developer Guide

160 160 Administering Liferay Version 5.2 Liferay 5.2 Organizational Structures Organizations and locations represent a hierarchical company structure. The company can comprise many organizations and each organization can have many locations. A user can belong to any number of location and organizations. Roles and individual rights can be assigned to organizations and locations. By default, locations inherit rights from their organizations. Scopes The rights associated with a role may be assigned different scopes so that a role may, for example, be allowed to perform different actions in different communities. There are various types of scopes, e. g. the Community type. A community is a grouping of users based, for example, on their skills or interests. A user can belong to any number of communities. Roles and individual rights can have a scope of Community or Company. User group A user group is also a grouping of users. However, unlike organizations, locations and communities, no context is connected to user groups. The purpose of a user group is simply to help the administrator when assigning roles and rights as the administrator can assign roles and rights to a group instead of to individual users. A user can belong to any number of user groups. Roles can be assigned to a user group. A user inherits the rights of the user group(s) he belongs to Liferay 5.2 Organizational Structures This section details the following topics: Organizations, p. 162 Communities, p. 162 User Groups and Users, p. 163 Organizational concepts In order to organize the portal users, it is important to understand the different organizational concepts provided by Liferay 5.2: Portals are accessed by users. User administration can be organized in the form of user groups inubit 6.1: inubit Process Engine: Administrator and Developer Guide

161 Administering Liferay Version 5.2 Liferay 5.2 Organizational Structures 161 Users belong to organizations. Organizations can be based on a hierarchical structure. Users, user groups, and organizations can belong to communities. Communities are groupings of users based, for example, on their skills or interests. Roles and permissions User access to web applications and data is organized with portal roles and permissions: A portal role is a container for permission. There are roles for users, user groups, organizations and communities: - Regular portal roles Refer to Assigning Regular Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 178). - Organizational roles Refer to Assigning Organization Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 165). - Community roles Refer to Assigning Community Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 169). These roles are used to assign permissions for actions and locations to role owners, e.g. for adding web applications within a community. The following figure illustrates the described concept: The portal roles of Liferay 5.2 are independent of the inubit user roles. For users wishing to use both components, access must be provided separately to both components. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

162 162 Administering Liferay Version 5.2 Liferay 5.2 Organizational Structures Portlet permissions Each portlet can have individual permissions. Portlet permissions set up with the inubit software can be defined both in the Web Application Connector and in the Task Generator. Also refer to - Web Application Connector (Workbench/Process Engine: System Connectors Guide, chap. 39, p. 391) - Task Generator (Data Converter) (Workbench/Process Engine: Modules Guide, chap. 4, p. 55) Synchronization of roles All portal roles are automatically available in the inubit software in order to use them for instance in business rules. Inheritance concept Roles (and with it the rights assigned to the role) which are assigned to an organization are inherited to all sub organizations. Each user who belongs to a user group inherits its permissions. Each member of a community inherits its roles and permissions Organizations The organization concept is used to visualize the hierarchical framework of a company: a local company branch can e.g. be represented as a location type organization and company departments can be subordinated as regular organizations to other regular organizations. You can also define an organization for external business partners like suppliers in order to provide access to the portal for him and enter his address. Refer to Managing Organizations (inubit Process Engine: Administrator and Developer Guide, chap. 14.3, p. 164) Communities A community is a grouping of users based, for example, on their skills or interests. A community contains one or more portal pages. As soon as one user is assigned to a community, which contains at least one page, this community is displayed in the service menu under My Places inubit 6.1: inubit Process Engine: Administrator and Developer Guide

163 Administering Liferay Version 5.2 Liferay 5.2 Organizational Structures 163 Users can either be assigned directly or indirectly through an organization or a user group to a community. They can belong to an unlimited number of communities. In case a default community has been created all new users are automatically assigned to this default community. Portlets on a default community page are visible to all members of the default community, unless portlet permissions are explicitly restricted. Also refer to - Managing Communities (inubit Process Engine: Administrator and Developer Guide, chap. 14.4, p. 166) - Defining Default Communities, Roles and User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 168) User Groups and Users User group A user group is a grouping of users. However, unlike organizations and communities user groups have no context associated with them. The purpose of a user group is simply to help the administrator in assigning roles and permissions to a group of users instead of individual users. A user can belong to any number of user groups. Roles can be assigned to user groups. Every user that belongs to a user group inherits its roles or permissions. User A user can be assigned to one or more communities, organizations, user groups and/or roles. By means of such assignments, he receives permission to display pages and carry out actions. In case a default role has been created, each new user is assigned to this default role. Also refer to - Managing User Groups and Users (inubit Process Engine: Administrator and Developer Guide, chap. 14.5, p. 172) - Defining Default Communities, Roles and User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 168) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

164 164 Administering Liferay Version 5.2 Managing Organizations 14.3 Managing Organizations This section details the following topics: Creating Organizations, p. 165 Assigning Organization Roles, p. 165 Adding Pages for Selected Organizations, p. 166 Overview An organization has the following attributes: unique name, type, group ID, several addresses (office address, mailing address, billing address, shipping address), telephone numbers, address, URL address and service opening hours for different departments. Further attributes can be defined for an organization. Actions Via the control panel the following actions are available for each organization: Edit Allows you to edit the organization. Manage Pages Allows you to create and edit an organization's portal pages. Refer to Adding Pages to a Community or Organization (inubit Process Engine: Administrator and Developer Guide, chap , p. 170). Assign User Roles Allows you to assign organization-scoped roles to users. Refer to Assigning Organization Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 165). Assign Members Allows you to choose from available users. Add User Allows you to enter a new user. View Users Shows a list of assigned users. Add Regular Organization Allows you to add subordinate organization of regular organization type. Add Location Allows you to add subordinate organization of location type. View Suborganizations Shows a list of subordinate organizations. Delete inubit 6.1: inubit Process Engine: Administrator and Developer Guide

165 Administering Liferay Version 5.2 Managing Organizations 165 Allows you to delete current organization after confirmation prompt. An organization can only be deleted if no subordinate organization is linked and no user is assigned to it Creating Organizations You can create an unlimited number of organizations. 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Organizations. A list of all available organizations is displayed. 4. Click. The organization input field is displayed. 5. Enter a name. 6. In the Type list, select Regular Organization. 7. To select a higher-level organization, click. A regular organization must already exist. Otherwise, no higherlevel organizations can be selected. 8. Click one organization to select it. The dialog closes. 9. Save the new organization. Your operation is confirmed. 10. Return to the list of organizations by clicking View All. The new organization appears in the list Assigning Organization Roles As administrator you can assign the following roles to members of an organization: Organization Owner: Organization owners are superusers of their organization and are allowed to assign organization roles to other users. Organization Administrator inubit 6.1: inubit Process Engine: Administrator and Developer Guide

166 166 Administering Liferay Version 5.2 Managing Communities Organization administrators are superusers of their organization, are allowed to manage their organization's pages with all administrative permissions, but they are not able to assign to other users the status of organization administrator. Organization Member All users of an organization have this role. 1. In the service menu, click Control Panel. 2. In the Portal area, click Organizations. 3. Next to the desired organization, click Actions > Assign User Roles. The organization roles are displayed. 4. Click the role to which you want to assign a member. 5. Click the Available tab. All users are displayed that belong to the selected organization. 6. Select the checkbox for the user to whom you want to assign the organization role. 7. Click Update Associations. If the user is successfully assigned, the confirmation message is displayed at the top of the page Adding Pages for Selected Organizations Refer to Adding Pages to a Community or Organization (inubit Process Engine: Administrator and Developer Guide, chap , p. 170) Managing Communities This section details the following topics: Creating Communities, p. 168 Defining Default Communities, Roles and User Groups, p inubit 6.1: inubit Process Engine: Administrator and Developer Guide

167 Administering Liferay Version 5.2 Managing Communities 167 Assigning Users, User Groups or Organizations to Communities, p. 168 Assigning Community Roles, p. 169 Adding Pages to a Community or Organization, p. 170 Deleting a Community, p. 172 Actions Via the control panel the following actions are available for each community: Edit: Allows you to edit properties. Manage Pages: Allows you to create and edit community portal pages. Refer to Adding Pages to a Community or Organization (inubit Process Engine: Administrator and Developer Guide, chap , p. 170). Assign User Roles Refer to Assigning Community Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 169). Assign Members: Allows you to choose from available users. Delete: Allows you to delete current communities after confirmation prompt. Types and areas The following types of communities exist: Open communities allow a user to join or leave them at any time without any kind of administrator's approval. Restricted communities require that users be added to the community by a community administrator. Users may use the communities portlet to request membership. In private communities the administrator explicitly assigns new users. A private community does not show up at all in the communities portlet. Every community can have a public and a private area: A public area is also visible for guests if the know the correct URL. A private area is only visible for logged-in users that are members of this community. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

168 168 Administering Liferay Version 5.2 Managing Communities Creating Communities 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Communities. A list of all available communities is displayed. 4. Click. The community input field is displayed. 5. Enter a name. 6. In the Type list, select a type. 7. Save the new community. Your operation is confirmed and the new community appears in the list Defining Default Communities, Roles and User Groups You can define defaults for communities, roles and user groups. Newly created users are then automatically assigned as members of these defaults. Keep in mind: These plain text entries don't work as links. If you change the default names of communities, roles or user groups, these changes must be updated here, accordingly. Otherwise, new users are assigned to defaults that no longer exist and, afterwards, they do not have access rights to the portal. 1. In the service menu, click Control Panel. 2. In the Portal area, click Settings. 3. In the Configuration area on the right, click Default User Associations. 4. Enter the default names of the community, role or user group. You can also enter several names per community, role or user group. 5. Save your changes Assigning Users, User Groups or Organizations to Communities You can assign members to a community in the form of users, organizations and user groups inubit 6.1: inubit Process Engine: Administrator and Developer Guide

169 Administering Liferay Version 5.2 Managing Communities Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Communities. A list of all available communities is displayed. 4. Next to the desired community, click Actions. 5. Select Assign Members. 6. Depending on what you want to assign, select one of the following tabs: Users, Organizations or User Groups. 7. Click the Available tab. 8. Select the checkbox for the desired user, user group or organization whom you want to assign to the community. 9. Above the table, click Update Associations to save your assignments. A confirmation message is displayed at the top of the page Assigning Community Roles In every community you can assign the following community roles to members: Community Administrator: Community administrators are superusers of their organization but they are not able to assign to other users the status of community administrator. Community Member: All users belonging to a community have this role. Community Owner: Community owners are superusers of their community and are allowed to assign community roles to other users. 1. In the service menu, click Control Panel. 2. In the Portal area, click Communities. 3. Next to the desired community, click Actions > Assign User Roles. 4. Click the role to which you want to assign a member. 5. Click the Available tab. All users are displayed that belong to the selected community. 6. Select the checkbox for the user to whom you want to assign the community role. 7. Click Update Associations. A confirmation message is displayed at the top of the page. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

170 170 Administering Liferay Version 5.2 Managing Communities Adding Pages to a Community or Organization 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Communities. A list of all available communities is displayed. 4. Next to the desired community, click Actions. 5. Select Manage Pages. The following page is displayed: On this page you can define subordinate pages, their names, page types and visibility. The pages of a community are represented in the form of a directory tree. Every page can have subordinate pages. The standard page type is portlet. The page types Portlet, Panel, Embedded, Web Content, URL, Link-to-Page are linked to corresponding layout templates. The first page must conform to one of the following page types: Portlet, Panel, Embedded or Web Content. 6. In the directory tree, click the subordinate page that you want to edit inubit 6.1: inubit Process Engine: Administrator and Developer Guide

171 Administering Liferay Version 5.2 Managing Communities Click the Page tab: You can e.g. define the language for Name and HTML Title, a friendly URL or an icon. The properties vary according to the selected page type. 8. Configure visibility: Click Permissions. A table with pre-configured access rights for the specific page according to different roles is displayed: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

172 172 Administering Liferay Version 5.2 Managing User Groups and Users 9. Define for each role the permissions assigned to its owner on the current page by selecting the checkbox. 10. Click Submit to save defined permissions. 11. Click the Back tab. 12. Click Save. Your operation is confirmed. 13. Open the page in the same browser tab by clicking Back to <CommunityName> Deleting a Community Communities can be deleted while members are still assigned to them. 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Communities. A list of all available communities is displayed. 4. Next to the desired community, click Actions. 5. Select Delete. A confirmation prompt appears. 6. Confirm by clicking OK. The community is no longer displayed in the list of available communities Managing User Groups and Users This section details the following topics: Adding User Groups, p. 173 Creating Users, p. 174 Assigning Users to a User Group, p. 175 Assigning Users to an Organization, a Community or a Role, p. 175 Deactivating and Deleting Users, p inubit 6.1: inubit Process Engine: Administrator and Developer Guide

173 Administering Liferay Version 5.2 Managing User Groups and Users 173 User group actions Via the control panel the following actions are available for user groups: Edit: Allows you to edit name and description. Permissions: Allows you to define which roles have administrative permissions for this user group. Manage Pages: Allows you to create and edit page templates that users can define for themselves. In the inubit Enterprise Portal based on Liferay 5.2 users are not allowed to add individual pages. Therefore, the Manage Pages action cannot be used effectively. Assign Members: Allows you to choose from available users View Users: Allows you to display the list of assigned users Delete: Allows you to delete the current user group after confirmation prompt. A user group can only be deleted if no user is assigned to it. User actions Via the control panel the following actions are available for users: Edit: Allows you to edit user properties. Permissions: Allows you to define which roles have administrative permissions for this user. Impersonate User: Allows you to open a new browser tab that displays the website within the bounds of permissions applying to current user. Deactivate: Allows you to deactivate the selected user. Refer to Deactivating and Deleting Users (inubit Process Engine: Administrator and Developer Guide, chap , p. 176) Adding User Groups You can create an unlimited number of user groups. 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click User Groups. A list of all available user groups is displayed. 4. Click Add. The user groups input field is displayed. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

174 174 Administering Liferay Version 5.2 Managing User Groups and Users 5. Enter a name. 6. Save your new user group. The new user group is displayed in the list of available user groups Creating Users 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Users. A list of all available users is displayed. 4. Click Add. The user input field is displayed. 5. Enter user information or select items from the list boxes. The portal automatically assigns a user ID. 6. Click Save. In the menu on the right, further options are displayed. You can define e.g. passwords, addresses and telephone numbers of the new user. 7. Click the Password option. The input fields for defining the user password are displayed. 8. Define a password. Select the Password Reset Required checkbox if the password should only be used once when logging in for the first time. After the first login, the system requires the user to reset the password. 9. Click Save down to the right in the service menu. The new user is created and automatically assigned the default role Power User and the default community inubit Cockpit. If new users have no access to the default community, check if the names of the default community in the Default User Associations dialog and the one in the list of available communities are identical. Refer to Defining Default Communities, Roles and User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 168) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

175 Administering Liferay Version 5.2 Managing User Groups and Users Assigning Users to a User Group 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click User Groups. A list of all available user groups is displayed. 4. Next to the desired user group, click Actions > Assign Members. 5. Click the Available tab. All available users are displayed in a checkbox list. A checked box indicates that these users are already member of the respective user group. To find a user more quickly, use the search function and limit the number of displayed users. 6. Select the checkboxes for the users that you want to assign to the user group. 7. Click Update Associations. To add all available users to the user group, select the checkbox in the left upper corner of the table header. 8. Click Current to display the newly assigned users Assigning Users to an Organization, a Community or a Role 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Users. A list of all available users is displayed. 4. Next to the desired user, click Actions > Edit. The page for editing user information opens. 5. Depending on where you want to assign the user, in the service menu on the right, select either organizations, communities or roles. A list of available assignments is displayed. 6. Click Select. A list of all available organizations, communities or roles is displayed. 7. Select the desired organization, community or role. The updated assignment list of the current user is displayed. 8. Save your changes. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

176 176 Administering Liferay Version 5.2 Managing User Groups and Users Deactivating and Deleting Users Users must be deactivated before they can be deleted. Deactivated users can be reactivated again or definitely deleted. 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Users. A list of all available and active users is displayed 4. Select all users that you want to delete. 5. Click Deactivate : 6. Confirm the prompt. The deactivated users are removed from the displayed list. 7. To display and delete all deactivated users, go to the Active dropdown list on top of the page in the Search area and select No. 8. Click Search. A list of all deactivated users is displayed. 9. Select all users that you want to delete and click Delete. To reactivate users, click Restore. 10. Confirm the prompt. The selected users are removed from the list inubit 6.1: inubit Process Engine: Administrator and Developer Guide

177 Administering Liferay Version 5.2 Managing Portal Roles Managing Portal Roles This section details the following topics: Creating Portal Roles, p. 177 Assigning Regular Roles, p. 178 Specifying Visibility of Pages for Selected, p. 178 Defining Default Roles, p. 179 Actions Via the control panel the following actions are available for each role: Edit: Allows you to edit attributes. Permissions: Allows you to define which roles have administrative permissions to edit this role. Define Permissions: Allows you to define for the selected role which portlets are basically visible to it and which portal-wide permissions apply to it. Refer to Specifying Visibility of Portlets for Selected Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 181). Assign Members: Allows you to assign members, communities, organizations and groups to the selected role. These users will inherit any permissions given to the role. View Users: Allows you to display a list of assigned users. Delete: Allows you to delete regular roles after confirmation prompt. The pre-configure roles such as administrator, guest, power user and user cannot be deleted Creating Portal Roles 1. In the service menu, click Control Panel. 2. In the Portal area, click User Groups. A list of all available user groups is displayed. 3. Click Add. The name input field is displayed. 4. Enter a name for the new role. 5. Select the role type. Refer to Roles and permissions (inubit Process Engine: Administrator and Developer Guide, chap. 14, p. 161). inubit 6.1: inubit Process Engine: Administrator and Developer Guide

178 178 Administering Liferay Version 5.2 Managing Portal Roles 6. Click Save. The newly created role is displayed in the list Assigning Regular Roles If you follow the procedure described here you can only assign regular roles to users, but no community and organization roles! Refer to Assigning Organization Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 165) and Assigning Community Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 169). 1. In the service menu, click Control Panel. 2. In the Portal area, click Roles. A list of all available roles is displayed. 3. Next to the regular role that you want to assign to one or more users, click Actions > Assign Members. The Users > Current tab is displayed. A list of all users who currently hold the selected role is displayed. 4. Click the Available tab. A list of all the available users is displayed. 5. Select the checkboxes for all users to whom you want to assign the role. 6. Click Update Associations. If the user is successfully assigned to a role, the confirmation message is displayed at the top of the page Specifying Visibility of Pages for Selected You can specify the visibility of individual pages or hide them for defined roles. 1. Log in as Administrator. 2. Display the page for which you want to specify the visibility. 3. In the service menu, click Manage Pages. The Manage Pages dialog is displayed inubit 6.1: inubit Process Engine: Administrator and Developer Guide

179 Administering Liferay Version 5.2 Managing Portlets In the directory tree, select the desired page to display its properties. 5. Click Permissions. A table listing all roles and their corresponding permissions is displayed: 6. Select the role that is meant to have permission to display the page Defining Default Roles Refer to Defining Default Communities, Roles and User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 168) Managing Portlets This section details the following topics: Adding Portlets to a Page, p. 180 Specifying Visibility of Portlets for Selected Roles, p. 181 Deleting Portlets, p. 182 When managing portlets the following procedure is recommended: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

180 180 Administering Liferay Version 5.2 Managing Portlets 1. Configuring the portlet via the control panel, e.g. defining for which roles the portlet should be visible 2. Adding the configured portlet to one or more pages. Proceeding like this has the great advantage that the portlets on all pages can be managed from one central configuration point. You can change a portlet configuration even after adding it to a page. These changes do not affect the other instances of the portlet. Thus, you can individually change single portlet instances. But it also makes it much more difficult to ensure a uniform configuration of all portlet instances Adding Portlets to a Page 1. Display the page to which you want to add portlets. 2. In the service menu, click Add Application. A list of all application categories is displayed. 3. Click the category to which your portlet belongs. For portlets created with the inubit software the category is defined in the Web Application Connector. By default, these portlets all belong to the inubit category. Refer to Dialog Web Application (Workbench/Process Engine: System Connectors Guide, chap , p. 394). All portlets belonging to the selected category are displayed. 4. Next to the desired portlet, click Add or drag the portlet to the portal page: 5. To close the Add Application dialog, click the red X at the top of the dialog. The selected portlet is now displayed on the portal page inubit 6.1: inubit Process Engine: Administrator and Developer Guide

181 Administering Liferay Version 5.2 Managing Portlets Specifying Visibility of Portlets for Selected Roles You can specifically define for each portlet for whom it should be visible. Roles are used to make portlets visible. You define the visible portlets for each role, and you define the users, user groups, and user subgroups for each role. A list containing all portlets available in the portal can be displayed in the control panel by clicking Portal > Plugins Configuration. Next to each portlet you find a corresponding list of roles that have permission to add the respective portlet to a page: You select a portlet from the list of available portlets and then define the actions within this portlet that the role will have permission to perform. 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Roles. A list of all available roles is displayed. 4. Next to the desired role, click Actions > Define Permissions. A list of all available portlets for this role is displayed. 5. Click Add Portlet Permissions. A list of all available portlets is displayed. 6. Click the portlet that you want to add. An editing page opens. To grant permissions, your first define the scope for which the permissions of the actions View and Configuration apply. You can either select Portal or Communities. - Granting Portal permissions means that permission to the action will be granted across the portal, in any community or organization. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

182 182 Administering Liferay Version 5.2 Configuring Liferay If you select Community, a button appears to select a specific community. The assigned rights apply to the communities they are assigned to. a. Click Select. A dialog opens displaying a list of all available communities. b. Select a community. The dialog closes and the selection is accepted. 7. Click Save. A list is displayed containing all portlets visible for the selected role Deleting Portlets All users with an administrator role (Administrator, Community Administrator, Organization Administrator) are allowed to delete portlets from the portal. 1. Display the page containing the portlet instance that is to be deleted. 2. Click Remove at the top right of the portlet: 3. Confirm the prompt. The portlet is removed from the page Configuring Liferay 5.2 This section details the following topics: Configuring Authentication, p. 183 Configuring Locales, p. 184 Configuring Password Policies, p. 185 Deploying Non-inubit Portlets, p. 185 Switching Liferay Database, p inubit 6.1: inubit Process Engine: Administrator and Developer Guide

183 Administering Liferay Version 5.2 Configuring Liferay Synchronizing Liferay Users with LDAP, p. 188 Performing Backup, p. 189 Replacing Portal Logo, p. 189 Selecting Pre-defined Themes, p. 189 Adding Themes, p. 190 Defining Layout Template for a Page, p. 191 Defining a Portal Name, p. 193 Load Balancing with inubit Portlets, p. 193 Many central Liferay configuration options are integrated in the file <inubit-installdir>/server/tomcat/webapps/root/web- INF/classes/portal-ext.properties. The specifications contained in this file overwrite the specifications of the original configuration file portal.properties in portal-impl.jar. Further information can be found in the Liferay documentation Configuring Authentication 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Settings. The Settings page is displayed. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

184 184 Administering Liferay Version 5.2 Configuring Liferay In the service menu on the right, click Authentication. The General tab is displayed: 5. Define if users must authenticate by address, screen name or user ID. By selecting the corresponding checkbox, you can allow users to automatically log in. 6. Save your selection Configuring Locales You can change the number of languages that can be selected and, thus, change the possible locale settings. Each available language is represented by a flag icon on the login page of the Guest community. 1. Stop the inubit Process Engine. 2. Open the following file: - Tomcat: <inubit-installdir>/server/tomcat/ webapps/root/web-inf/classes/portalext.properties. - JBoss: <inubit-installdir>/server/jboss/server/ default/deploy/root.war/web-inf/classes/ portal-ext.properties 3. Add the following row: locales=de_de,en_us 4. Start the inubit Process Engine inubit 6.1: inubit Process Engine: Administrator and Developer Guide

185 Administering Liferay Version 5.2 Configuring Liferay Now, only the two indicated languages (German and English) are available Configuring Password Policies Password policies can improve the security of your portal. You can define different password policies for individual organizations or users. 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Password Policies. The list of currently available password policies is displayed. You can edit existing password policies, add new ones, and define who has permissions for which policies and you can assign members to the policies. 4. Save your changes. More complex requirements for password policies can be configured in the portal-ext.properties file. Refer to Liferay Administration Guide, Chapter Advanced Liferay Configuration, The portalext.properties File, Passwords Deploying Non-inubit Portlets Liferay provides hot deployment of layout templates, JSR 168- or JSR 286-compliant portlets and themes: all *.war files stored in the <inubit-installdir>server/portal/liferay5/deploy directory can automatically be accessed via the Liferay repository. The Liferay repository is managed in the Control Panel in the Server > Plugins Installation > Install More Portlets button > Configuration tab. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

186 186 Administering Liferay Version 5.2 Configuring Liferay Switching Liferay Database By default, Liferay is delivered with an HSQL database. Bosch Software Innovations GmbH recommends for the productive use of the system to replace the pre-configured HSQL database with an external relational database system such as MySQL, PostgreSQL or Oracle, for example. The following instructions explain how to replace the HSQL database with a MySQL database system. After having replaced the database you dispose of a default Liferay installation without inubit Process Cockpit. You can then customize Liferay according to your requirements. If you wish to let the inubit Process Cockpit restore, contact inubit support. You can find examples for further database management systems in the portal.properties in the archive portal-impl.jar in one of the following directories: Tomcat: <inubit-installdir>/server/tomcat/webapps/ ROOT/WEB-INF/lib JBoss: <inubit-installdir>/server/jboss/server/ default/deploy/root.war/web-inf/lib Bosch Software Innovations GmbH highly recommends using the same database for the development and test system as subsequently for the real-time operating system. This facilitates the import of already existing data and preferences and prevents an error-prone migration. Prerequisites When replacing the HSQL database by a MySQL database: The database schema already exist. 1. Stop the inubit Process Engine. Install the DB driver 2. Install the database driver. The database driver must not be installed more than once. Before starting the installation, check if the database driver is already installed. Refer to - Switching inubit Monitoring Database (inubit Process Engine: Administrator and Developer Guide, chap. 8, p. 119) - Switching inubit Task Database (inubit Process Engine: Administrator and Developer Guide, chap. 8, p. 122) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

187 Administering Liferay Version 5.2 Configuring Liferay Depending on the application server in use, copy the driver for the database that you want to use to one of the following directories: - Tomcat: <inubit-installdir>/server/tomcat/ common/lib. - JBoss: <inubit-installdir>/server/jboss/server/ default/lib. Adjust the DB portal settings 4. Adjust the database settings in the portal-ext.properties file as described below: - Tomcat: <inubit-installdir>/server/tomcat/ webapps/root/web-inf/classes/portalext.properties - JBoss: <inubit-installdir>/server/jboss/server/ default/deploy/root.war/web-inf/classes/ portal-ext.properties # MySQL #jdbc.default.driverclassname=com.mysql.jdbc.d river #jdbc.default.url=jdbc:mysql://<localhost>/ <schemaname>?useunicode=true&characterencoding =UTF-8&useFastDateParsing=false #jdbc.default.username=<myname> #jdbc.default.password=<mypassword> Define default start page 5. In case you do not wish to restore the inubit Process Cockpit but wish to customize Liferay individually: Define which page should be opened automatically after the log-in at the portal server: a. Open the file portal-ext.properties belonging to your application server in use. b. At the parameter default.landing.page.path=/group/ inubit-cockpit/ replace the value inubit-cockpit by your desired default community. c. Save the changes. If you do not change the parameter and try to log-in at the portal server using root/inubit after having replaced the database, an error message is displayed. This is caused by the attempt to open the page belonging the inubit Process Cockpit which does not exist in your current database. 6. Restart the inubit Process Engine. The default portal user James Smith (user name: root/password: inubit) and the required database tables are automatically generated. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

188 188 Administering Liferay Version 5.2 Configuring Liferay Synchronizing Liferay Users with LDAP You can synchronize user data from a directory service such as OpenLDAP with Liferay to realize an authentication with LDAP. 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Settings. The Settings page is displayed. 4. In the Configuration area on the right, click Authentication. 5. Select the LDAP tab. 6. Enable and configure LDAP settings, e.g.: - Required: If Required is selected, only the Active Directory password is allowed for login, otherwise you can also use the Liferay password. 7. Save your changes inubit 6.1: inubit Process Engine: Administrator and Developer Guide

189 Administering Liferay Version 5.2 Configuring Liferay Performing Backup For the backup, use the corresponding tools of your specific operating system and include the following data in the backup process: Configuration file: - Tomcat: <inubit-installdir>/server/tomcat/ webapps/root/web-inf/classes/portalext.properties - JBoss: <inubit-installdir>/server/jboss/server/ default/deploy/root.war/web-inf/classes/ portal-ext.properties Database and Liferay repository in <inubit-installdir>/ server/portal/liferay5 Portlets and themes in <inubit-installdir>/server/ Tomcat/webapps Replacing Portal Logo You can replace the logo which is displayed in the left upper corner of the portal welcome page. Refer to Company logo (Workbench: User Guide, chap. 4., p. 490). 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Settings. The Settings page is displayed. 4. In the service menu on the right, select Miscellaneous > Display settings. 5. In the Logo section, click Change. 6. Click Browse to select a file to upload. 7. Save the new logo file. The new logo is displayed in the left upper corner of the service menu Selecting Pre-defined Themes A theme contains layout specifications in order e.g. to confer a uniform look to a community's website. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

190 190 Administering Liferay Version 5.2 Configuring Liferay Log in as Administrator. 2. In the service menu, click Manage Pages. - Changing a theme for a community: a. Click the Look and Feel tab. b. Select one of the available themes. A confirmation message is displayed at the top of the page. - Changing a theme for a subordinate page: a. Click the Pages tab. b. Click the desired page in the directory tree. c. Click the Look and Feel tab displayed below the breadcrumb path of the selected page: d. Select one of the available themes Adding Themes You can add further themes to the portal by selecting from a list of themes familiar to the system. 1. Log in as Administrator. 2. In the service menu, click Control Panel inubit 6.1: inubit Process Engine: Administrator and Developer Guide

191 Administering Liferay Version 5.2 Configuring Liferay In the Server area, click Plugins Installation. 4. Click the Theme Plugins tab. A list of currently available themes is displayed. 5. Click Install More Themes. A list of known themes is displayed. 6. Select a theme. Themes from other suppliers can be installed by using the Upload File dialog. For more information about creating new themes, refer to Liferay Administration Guide: Advanced Liferay Configuration > The portal-ext.properties File > Theme Liferay Development Documentation: Creating Liferay Themes Defining Layout Template for a Page Layout templates define the area where users can position portlets on a page. Users of private pages and administrators of communities or public websites can define a layout template for each page. 1. Display the page for which you want to change the layout template. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

192 192 Administering Liferay Version 5.2 Configuring Liferay In the service menu, click Layout Template. All available layout templates are displayed: 3. Click the desired layout template. 4. Save your changes. The last displayed page is displayed again with the new layout template inubit 6.1: inubit Process Engine: Administrator and Developer Guide

193 Administering Liferay Version 5.2 Configuring Liferay Defining a Portal Name The portal name is also displayed in the title bar of the browser, e.g.: 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Settings. 4. In the Name field, enter the desired name. The portal automatically connects the logo with a link to the portal's starting page. By default, the starting page of the inubit software when delivered is the login page of the Guest community. 5. Save your changes. The change is immediately displayed Load Balancing with inubit Portlets Each portlet instance belongs to a browser session and is linked to an inubit Process Engine. In order to deal with large numbers of users you can distribute the execution of the portlet instances between multiple inubit Process Engines. The portlets of the inubit Process Cockpit cannot be balanced in the described way. For further information on how to balance the inubit 6.1: inubit Process Engine: Administrator and Developer Guide

194 194 Administering Liferay Version 5.2 Configuring Liferay 5.2 execution of these portlets, contact Bosch Software Innovations GmbH. Prerequisites All Integration Servers that are meant to balance the load must be listed in the Web Application Connector of the portlet in the Load balancing field. Refer to Dialog Web Application (Workbench/Process Engine: System Connectors Guide, chap , p. 394). The passwords of all Integration Servers must be identical. Refer to Password for the Process Engine (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 29) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

195 15 Administering Liferay Version This section details the following topics: Configuration of the Liferay Portal Enterprise Edition, p. 196 Portal Roles and Rights, p. 198 Organizational Structures, p. 200 Managing Organizations, p. 203 Managing Communities, p. 206 Managing User Groups and Users, p. 213 Managing Portal Roles, p. 217 Managing Portlets, p. 220 Configuring Liferay 6, p. 223 By default, the inubit software is installed with the portal server Liferay version You can also use an already installed Liferay Portal Enterprise Edition 6.0 SP2. To do this, you must adjust your Liferay installation (refer to Configuration of the Liferay Portal Enterprise Edition (inubit Process Engine: Administrator and Developer Guide, chap. 15, p. 196)). Alternatively, you can install Liferay version 5.2. To do so, when installing inubit software, select the installation type User defined and the option Liferay 5.2. For information about Liferay version 5.2, refer to Administering Liferay Version 5.2 (inubit Process Engine: Administrator and Developer Guide, chap. 14, p. 157) Liferay version 4.2, which was delivered with older versions, is not supported anymore. Overview The inubit Enterprise Portal based on the portal server Liferay 6 can be utilized as a basis for intranets and for interacting with business partners. You can combine your business processes within a homogeneous graphical user interface and integrate your own employees, customers and business partners based on their roles into your business processes. The main component of the inubit Enterprise Portal is the inubit Process Cockpit which offers the most relevant functions as preconfigured BPM portlets. For more information refer to - Activating and Displaying the inubit Enterprise Portal (Workbench: User Guide, chap. 20.3, p. 487) - Developing Your Own Web Application (Tutorials, chap. 5.2, p. 82) - Calculation of Concurrent Users (Workbench: User Guide, chap. 20.1, p. 486) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

196 196 Administering Liferay Version 6 Configuration of the Liferay Portal Enterprise Edition Further information Bosch Software Innovations GmbH recommends the following: Liferay 6: Administrator Guide Liferay 6: Liferay Developer Guide pdf Liferay Portal 6 Enterprise Intranets, Jonas X. Yuan, Packt Publishing, Birmingham, UK, 2010, ISBN: Portal Web Services For a list of all Web Services offered by the inubit Enterprise Portal based on Liferay refer to axis. The inubit Enterprise Portal must already be activated. Technical information For the communication between the portal server and the inubit Process Engine SOAP is used. Therefore, it is of no importance whether the two systems are installed on the same or on different computers. Portlets are deployed into the portal via a Web service call from the inubit Process Engine. The inubit software and the inubit Enterprise Portal are 100% JSR-168 compliant. This standard allows the integration of any portlets provided that they have been developed in accordance with the JSR- 168 standard. Of course, you can use any other portal server with inubit software rather than the one supplied. For information about the necessary configuration steps contact Bosch Software Innovations GmbH Configuration of the Liferay Portal Enterprise Edition Prerequisites You have installed at least the inubit version 6.1. You have installed the Liferay Portal 6.0 Enterprise Edition SP inubit 6.1: inubit Process Engine: Administrator and Developer Guide

197 Administering Liferay Version 6 Configuration of the Liferay Portal Enterprise Edition Enhancing the Enterprise Portal Backing Up Data Save the portal, and in particular the file portal-ext.properties if you have made any changes there. Enhancing the Java environment Copy the two files bcprov.jar and ibis_ext.jar from directory <inubit-installdir>/_jvm/jre/lib/ext to directory <JAVA_ HOME>/jre/lib/ext of the Java environment used by your Liferay installation. Installing the inubit bootstrap plug-in 1. Start the portal. 2. Copy the bootstrap plug-in liferay-ibis60- InubitBootstrapPlugin-6_0_12-ext war from directory <inubit-installdir>/server/portal/ liferay6/inubitplugins to the portal deploy directory (default: <portal-home>/deploy). The deployment starts automatically. 3. Wait until the prompt to reboot appears in file <portal-home>/ <tomcat>/logs/catalina.out. 4. Stop the portal. Installing the inubit Liferay integration plug-in 1. Start the portal. 2. Copy the Liferay integration plug-in liferay-ibis60- InubitLiferayIntegration-6_0_12-ext war to the (now changed) Liferay 6 deploy directory <portal-home>/ portal/liferay6/deploy. 3. Wait until the prompt to reboot appears in file <portal-home>/ <tomcat>/logs/catalina.out. 4. Stop the portal. Adjusting configuration file portal-ext.properties Installation of the Liferay integration plug-in configured the standard HSQL-DB database. Configure your previous database. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

198 198 Administering Liferay Version 6 Portal Roles and Rights 1. Open the file <inubit-installdir>/server/tomcat/ webapps/root/web-inf/classes/portalext.properties comment out all jdbc.default.* entries with a '#' at the beginning of the line. 2. Open the saved file portal-ext.properties. Refer to Backing Up Data (inubit Process Engine: Administrator and Developer Guide, chap. 15, p. 197). 3. Copy your database configuration from the saved file portalext.properties and insert the configuration at the end of the file into <inubit-installdir>/server/tomcat/webapps/ ROOT/WEB-INF/classes/portal-ext.properties. 4. Start the portal followed by the Workbench. 5. Configure the portal of the Liferay Enterprise Edition in the workbench under Configuration > General settings > Portal > Server configuration. a. Select the Liferay portal server. b. Adjust the URL of the portal server. 6. Save your entries. 7. Go to the page Configuration > General settings > Portal > Portal deployment. 8. In the Portlet archive (administration/deployment) line, click the button at the right end of the line. In the dialog that appears, Liferay Enterprise Edition is entered as the connected portal and the value is displayed as the version. Communication between the inubit Process Engine and the portal has now been established. You can now deploy and work with your portlets such as the ProcessViewer Portal Roles and Rights Portal roles A portal role is a container for rights. Liferay 6 s portal roles are independent of the inubit roles. Access must be set up to both components for users wishing to use both. By default, the portal server is provided with the following portal roles: Administrator inubit 6.1: inubit Process Engine: Administrator and Developer Guide

199 Administering Liferay Version 6 Portal Roles and Rights 199 Possesses all rights, e. g. the rights to create portal users, portal roles and communities. Administrators may add resources such as pages and content to communities' private pages and also possess private pages of their own. Power User Power users possess a personal area in which they may add and delete pages and content. However, this function is deactivated in the inubit Enterprise Portal. To activate this function open the <inubit-installdir>/server/tomcat/webapps/root/ WEB-INF/classes/portal-ext.properties file and set the property private.pages=false. User Users may perform the tasks assigned to them on the private pages of their community but they do not have a private area and can neither add nor delete pages. New users are automatically assigned the User role. Guest Guests can only view the public areas of the communities and have no areas of their own. Several pre-configured users are supplied with inubit software; their login details are displayed on the login page of the Enterprise Server. Organization areas In addition to the roles, the portal server has the concept of organizational areas. These can be of the following types: Company Organization Locations Organizations and locations represent a hierarchical company structure. The company can comprise many organizations and each organization can have many locations. A user can belong to exactly one location and one organization. Roles and individual rights can be assigned to organizations and locations. By default, locations inherit rights from their organizations. Scopes The rights associated with a role may be assigned different scopes so that a role may, for example, be allowed to perform different actions in different communities. There are various types of scopes, e. g. the Community type. A community is a grouping of users based, for example, on their skills or interests. A user can belong to any number of communities. Roles and individual rights can have a scope of Community or Company. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

200 200 Administering Liferay Version 6 Organizational Structures User group A user group is also a grouping of users. However, unlike organizations, locations and communities, no context is connected to user groups. The purpose of a user group is simply to help the administrator when assigning roles and rights as the administrator can assign roles and rights to a group instead of to individual users. A user can belong to any number of user groups. Both roles and individual rights can be assigned to a user group. Each user who belongs to a group inherits its roles or rights Organizational Structures This section details the following topics: Organizations, p. 202 Communities, p. 202 User Groups, Teams and Users, p. 203 Organizational concepts In order to organize the portal users, it is important to understand the different organizational concepts provided by Liferay 6: Portals are accessed by users. User administration can be organized in the form of user groups. Users belong to organizations. Organizations can be based on a hierarchical structure. Users, user groups, and organizations can belong to communities. Communities are groupings of users based, for example, on their skills or interests. Roles and permissions User access to web applications and data is organized with portal roles and permissions: A portal role is a container for permission. There are roles for users, user groups, organizations and communities: - Regular portal roles Refer to Assigning Regular Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 218). - Organizational roles Refer to Assigning Organization Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 205) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

201 Administering Liferay Version 6 Organizational Structures Community roles Refer to Assigning Community Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 209). These roles are used to assign permissions for actions and locations to role owners, e.g. for adding web applications within a community. The following figure illustrates the described concept: The portal roles of Liferay 6 are independent of the inubit user roles. For users wishing to use both components, access must be provided separately to both components. Portlet permissions Each portlet can have individual permissions. Portlet permissions set up with inubit software can be defined both in the Web Application Connector and in the Task Generator. Also refer to - Web Application Connector (Workbench/Process Engine: System Connectors Guide, chap. 39, p. 391) - Task Generator (Data Converter) (Workbench/Process Engine: Modules Guide, chap. 4, p. 55) Synchronization of roles All portal roles are automatically available in the inubit software in order to use them for instance in business rules. Inheritance concept Roles (and with it the rights assigned to the role) which are assigned to an organization are inherited to all sub organizations. Each user who belongs to a role inherits its permissions. Each user who belongs to a user group inherits its permissions. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

202 202 Administering Liferay Version 6 Organizational Structures Each member of a community inherits its roles and permissions Organizations The organization concept is used to visualize the hierarchical framework of a company: a local company branch can e.g. be represented as a location type organization and company departments can be subordinated as regular organizations to other regular organizations. You can also define an organization for external business partners like suppliers in order to provide access to the portal for him and enter his address. Refer to Managing Organizations (inubit Process Engine: Administrator and Developer Guide, chap. 15.4, p. 203) Communities A community is a grouping of users based, for example, on their skills or interests. A community contains one or more portal pages. As soon as one user is assigned to a community, which contains at least one page, this community is displayed in the service menu under My Places. Users can either be assigned directly or indirectly through an organization or a user group to a community. They can belong to an unlimited number of communities. In case a default community has been created all new users are automatically assigned to this default community. Portlets on a default community page are visible to all members of the default community, unless portlet permissions are explicitly restricted. Also refer to - Managing Communities (inubit Process Engine: Administrator and Developer Guide, chap. 15.5, p. 206) - Defining Default Communities, Roles and User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 208) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

203 Administering Liferay Version 6 Managing Organizations User Groups, Teams and Users User group A user group is a grouping of users. However, unlike organizations and communities user groups have no context associated with them. The purpose of a user group is simply to help the administrator in assigning roles and permissions to a group of users instead of individual users. A user can belong to any number of user groups. Roles can be assigned to user groups. Every user that belongs to a user group inherits its roles or permissions. Teams Teams are sub-structures of communities or organizations. They can be used for organizing users within a community or organization. User A user can be assigned to one or more communities, organizations, user groups and/or roles. By means of such assignments, he receives permission to display pages and carry out actions. In case a default role has been created, each new user is assigned to this default role. Also refer to - Managing User Groups and Users (inubit Process Engine: Administrator and Developer Guide, chap. 15.6, p. 213) - Defining Default Communities, Roles and User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 208) 15.4 Managing Organizations This section details the following topics: Creating Organizations, p. 205 Assigning Organization Roles, p. 205 Adding Pages for Selected Organizations, p. 206 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

204 204 Administering Liferay Version 6 Managing Organizations Overview An organization has the following attributes: unique name, type, group ID, several addresses (office address, mailing address, billing address, shipping address), telephone numbers, address, URL address and service opening hours for different departments. Further attributes can be defined for an organization. Actions Via the control panel the following actions are available for each organization: Edit Allows you to edit the organization. Manage Pages Allows you to create and edit an organization's portal pages. Refer to Adding Pages to a Community or Organization (inubit Process Engine: Administrator and Developer Guide, chap , p. 209). Managing teams Creating, editing and deleting teams. Refer to Teams (inubit Process Engine: Administrator and Developer Guide, chap. 15, p. 203) Assign User Roles Allows you to assign organization-scoped roles to users. Refer to Assigning Organization Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 205). Assign Members Allows you to choose from available users. Add User Allows you to enter a new user. View Users Shows a list of assigned users. Add Regular Organization Allows you to add subordinate organization of regular organization type. Add Location Allows you to add subordinate organization of location type. View Suborganizations Shows a list of subordinate organizations. Delete Allows you to delete current organization after confirmation prompt. An organization can only be deleted if no subordinate organization is linked and no user is assigned to it inubit 6.1: inubit Process Engine: Administrator and Developer Guide

205 Administering Liferay Version 6 Managing Organizations Creating Organizations You can create an unlimited number of organizations. 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Organizations. A list of all available organizations is displayed. 4. Click Add. The organization input field is displayed. 5. Enter a name. 6. In the Type list, select Regular Organization. 7. To select a higher-level organization, click. A regular organization must already exist. Otherwise, no higherlevel organizations can be selected. 8. Click one organization to select it. The dialog closes. 9. Save the new organization. Your operation is confirmed. 10. Return to the list of organizations by clicking View All. The new organization appears in the list Assigning Organization Roles As administrator you can assign the following roles to members of an organization: Organization Owner: Organization owners are superusers of their organization and are allowed to assign organization roles to other users. Organization Administrator Organization administrators are superusers of their organization, are allowed to manage their organization's pages with all administrative permissions, but they are not able to assign to other users the status of organization administrator. Organization Member All users of an organization have this role. 1. Click Control Panel. 2. In the Portal area, click Organizations. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

206 206 Administering Liferay Version 6 Managing Communities 3. Next to the desired organization, click Actions > Assign User Roles. The organization roles are displayed. 4. Click the role to which you want to assign a member. 5. Click the Available tab. All users are displayed that belong to the selected organization. 6. Select the checkbox for the user to whom you want to assign the organization role. 7. Click Update Associations. If the user is successfully assigned, the confirmation message is displayed at the top of the page Adding Pages for Selected Organizations Refer to Adding Pages to a Community or Organization (inubit Process Engine: Administrator and Developer Guide, chap , p. 209) Managing Communities This section details the following topics: Creating Communities, p. 207 Defining Default Communities, Roles and User Groups, p. 208 Assigning Users, User Groups or Organizations to Communities, p. 208 Assigning Community Roles, p. 209 Adding Pages to a Community or Organization, p. 209 Deleting a Community, p. 212 Actions Via the control panel the following actions are available for each community: Edit: Allows you to edit properties inubit 6.1: inubit Process Engine: Administrator and Developer Guide

207 Administering Liferay Version 6 Managing Communities 207 Manage Pages: Allows you to create and edit community portal pages. Refer to Adding Pages to a Community or Organization (inubit Process Engine: Administrator and Developer Guide, chap , p. 209). Managing teams Creating, editing and deleting teams. Assign User Roles Refer to Assigning Community Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 209). Assign Members: Allows you to choose from available users. Delete: Allows you to delete current communities after confirmation prompt. Types and areas The following types of communities exist: Open communities allow a user to join or leave them at any time without any kind of administrator's approval. Restricted communities require that users be added to the community by a community administrator. Users may use the communities portlet to request membership. In private communities the administrator explicitly assigns new users. A private community does not show up at all in the communities portlet. Every community can have a public and a private area: A public area is also visible for guests if the know the correct URL. A private area is only visible for logged-in users that are members of this community Creating Communities 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Communities. A list of all available communities is displayed. 4. Click. The community input field is displayed. 5. Enter a name. 6. In the Type list, select a type. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

208 208 Administering Liferay Version 6 Managing Communities 7. Save the new community. Your operation is confirmed and the new community appears in the list Defining Default Communities, Roles and User Groups You can define defaults for communities, roles and user groups. Newly created users are then automatically assigned as members of these defaults. Keep in mind: These plain text entries don't work as links. If you change the default names of communities, roles or user groups, these changes must be updated here, accordingly. Otherwise, new users are assigned to defaults that no longer exist and, afterwards, they do not have access rights to the portal. 1. In the service menu, click Control Panel. 2. In the Portal area, click Settings. 3. In the Configuration area on the right, click Default User Associations. 4. Enter the default names of the community, role or user group. You can also enter several names per community, role or user group. 5. Save your changes Assigning Users, User Groups or Organizations to Communities You can assign members to a community in the form of users, organizations and user groups. 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Communities. A list of all available communities is displayed. 4. Next to the desired community, click Actions. 5. Select Assign Members. 6. Depending on what you want to assign, select one of the following tabs: Users, Organizations or User Groups. 7. Click the Available tab inubit 6.1: inubit Process Engine: Administrator and Developer Guide

209 Administering Liferay Version 6 Managing Communities Select the checkbox for the desired user, user group or organization whom you want to assign to the community. 9. Above the table, click Update Associations to save your assignments. A confirmation message is displayed at the top of the page Assigning Community Roles In every community you can assign the following community roles to members: Community Administrator: Community administrators are superusers of their organization but they are not able to assign to other users the status of community administrator. Community Member: All users belonging to a community have this role. Community Owner: Community owners are superusers of their community and are allowed to assign community roles to other users. 1. In the service menu, click Control Panel. 2. In the Portal area, click Communities. 3. Next to the desired community, click Actions > Assign User Roles. 4. Click the role to which you want to assign a member. 5. Click the Available tab. All users are displayed that belong to the selected community. 6. Select the checkbox for the user to whom you want to assign the community role. 7. Click Update Associations. A confirmation message is displayed at the top of the page Adding Pages to a Community or Organization 1. Log in as Administrator. 2. In the service menu, click Control Panel. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

210 210 Administering Liferay Version 6 Managing Communities 3. In the Portal area, click Communities. A list of all available communities is displayed. 4. Next to the desired community, click Actions. 5. Select Manage Pages. The following page is displayed: On this page you can define subordinate pages, their names, page types and visibility. The pages of a community are represented in the form of a directory tree. Every page can have subordinate pages. The standard page type is portlet. The page types Portlet, Panel, Embedded, Web Content, URL, Link-to-Page are linked to corresponding layout templates. The first page must conform to one of the following page types: Portlet, Panel, Embedded or Web Content. 6. In the directory tree, click the subordinate page that you want to edit inubit 6.1: inubit Process Engine: Administrator and Developer Guide

211 Administering Liferay Version 6 Managing Communities Click the Page tab: You can e.g. define the language for Name and HTML Title, a friendly URL or an icon. The properties vary according to the selected page type. 8. Configure visibility: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

212 212 Administering Liferay Version 6 Managing Communities Click Permissions. A table with pre-configured access rights for the specific page according to different roles is displayed: 9. Define for each role the permissions assigned to its owner on the current page by selecting the checkbox. 10. Click Save to save defined permissions. 11. Click the Back tab. 12. Click Save. Your operation is confirmed. 13. Open the page in the same browser tab by clicking Back to <CommunityName> Deleting a Community Communities can be deleted while members are still assigned to them. 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Communities. A list of all available communities is displayed inubit 6.1: inubit Process Engine: Administrator and Developer Guide

213 Administering Liferay Version 6 Managing User Groups and Users Next to the desired community, click Actions. 5. Select Delete. A confirmation prompt appears. 6. Confirm by clicking OK. The community is no longer displayed in the list of available communities Managing User Groups and Users This section details the following topics: Adding User Groups, p. 214 Creating Users, p. 214 Assigning Users to a User Group, p. 215 Assigning Users to an Organization, a Community or a Role, p. 216 Deactivating and Deleting Users, p. 216 User group actions Via the control panel the following actions are available for user groups: Edit: Allows you to edit name and description. Permissions: Allows you to define which roles have administrative permissions for this user group. Manage Pages: Allows you to create and edit page templates that users can define for themselves. In the inubit Enterprise Portal based on Liferay 6 users are not allowed to add individual pages. Therefore, the Manage Pages action cannot be used effectively. Assign Members: Allows you to choose from available users View Users: Allows you to display the list of assigned users Delete: Allows you to delete the current user group after confirmation prompt. A user group can only be deleted if no user is assigned to it. User actions Via the control panel the following actions are available for users: Edit: Allows you to edit user properties. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

214 214 Administering Liferay Version 6 Managing User Groups and Users Permissions: Allows you to define which roles have administrative permissions for this user. Impersonate User: Allows you to open a new browser tab that displays the website within the bounds of permissions applying to current user. Deactivate: Allows you to deactivate the selected user. Refer to Deactivating and Deleting Users (inubit Process Engine: Administrator and Developer Guide, chap , p. 216) Adding User Groups You can create an unlimited number of user groups. 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click User Groups. A list of all available user groups is displayed. 4. Click Add. The user groups input field is displayed. 5. Enter a name. 6. Save your new user group. The new user group is displayed in the list of available user groups Creating Users 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Users. A list of all available users is displayed. 4. Click Add. The user input field is displayed. 5. Enter user information or select items from the list boxes. The portal automatically assigns a user ID. 6. Click Save. In the menu on the right, further options are displayed. You can define e.g. passwords, addresses and telephone numbers of the new user inubit 6.1: inubit Process Engine: Administrator and Developer Guide

215 Administering Liferay Version 6 Managing User Groups and Users Click the Password option. The input fields for defining the user password are displayed. 8. Define a password. Select the Password Reset Required checkbox if the password should only be used once when logging in for the first time. After the first login, the system requires the user to reset the password. 9. Click Save down to the right in the service menu. The new user is created and automatically assigned the default role Power User and the default community inubit Cockpit. If new users have no access to the default community, check if the names of the default community in the Default User Associations dialog and the one in the list of available communities are identical. Refer to Defining Default Communities, Roles and User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 208) Assigning Users to a User Group 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click User Groups. A list of all available user groups is displayed. 4. Next to the desired user group, click Actions > Assign Members. 5. Click the Available tab. All available users are displayed in a checkbox list. A checked box indicates that these users are already member of the respective user group. To find a user more quickly, use the search function and limit the number of displayed users. 6. Select the checkboxes for the users that you want to assign to the user group. 7. Click Update Associations. To add all available users to the user group, select the checkbox in the left upper corner of the table header. 8. Click Current to display the newly assigned users. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

216 216 Administering Liferay Version 6 Managing User Groups and Users Assigning Users to an Organization, a Community or a Role 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Users. A list of all available users is displayed. 4. Next to the desired user, click Actions > Edit. The page for editing user information opens. 5. Depending on where you want to assign the user, in the service menu on the right, select either organizations, communities or roles. A list of available assignments is displayed. 6. Click Select. A list of all available organizations, communities or roles is displayed. 7. Select the desired organization, community or role. The updated assignment list of the current user is displayed. 8. Save your changes Deactivating and Deleting Users Users must be deactivated before they can be deleted. Deactivated users can be reactivated again or definitely deleted. 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Users. A list of all available and active users is displayed. 4. Select all users that you want to delete inubit 6.1: inubit Process Engine: Administrator and Developer Guide

217 Administering Liferay Version 6 Managing Portal Roles Click Deactivate : 6. Confirm the prompt. The deactivated users are removed from the displayed list. 7. To display and delete all deactivated users, go to the Active dropdown list on top of the page in the Search area and select No. 8. Click Search. A list of all deactivated users is displayed. 9. Select all users that you want to delete and click Delete. To reactivate users, click Activate. 10. Confirm the prompt. The selected users are removed from the list Managing Portal Roles This section details the following topics: Creating Portal Roles, p. 218 Assigning Regular Roles, p. 218 Specifying Visibility of Pages for Selected, p. 219 Defining Default Roles, p. 220 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

218 218 Administering Liferay Version 6 Managing Portal Roles Actions Via the control panel the following actions are available for each role: Edit: Allows you to edit attributes. Permissions: Allows you to define which roles have administrative permissions to edit this role. Define Permissions: Allows you to define for the selected role which portlets are basically visible to it and which portal-wide permissions apply to it. Refer to Specifying Visibility of Portlets for Selected Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 222). Assign Members: Allows you to assign members, communities, organizations and groups to the selected role. These users will inherit any permissions given to the role. View Users: Allows you to display a list of assigned users. Delete: Allows you to delete regular roles after confirmation prompt. The pre-configure roles such as administrator, guest, power user and user cannot be deleted Creating Portal Roles 1. Click Control Panel. 2. In the Portal area, click User Groups. A list of all available user groups is displayed. 3. Click Add. The name input field is displayed. 4. Enter a name for the new role. 5. Select the role type. Refer to Roles and permissions (inubit Process Engine: Administrator and Developer Guide, chap. 15, p. 200). 6. Click Save. The newly created role is displayed in the list Assigning Regular Roles If you follow the procedure described here you can only assign regular roles to users, but no community and organization roles! Refer to inubit 6.1: inubit Process Engine: Administrator and Developer Guide

219 Administering Liferay Version 6 Managing Portal Roles 219 Assigning Organization Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 205) and Assigning Community Roles (inubit Process Engine: Administrator and Developer Guide, chap , p. 209). 1. Click Control Panel. 2. In the Portal area, click Roles A list of all available roles is displayed. 3. Next to the regular role that you want to assign to one or more users, click Actions > Assign Members. The Users > Current tab is displayed. A list of all users who currently hold the selected role is displayed. 4. Click the Available tab. A list of all the available users is displayed. 5. Select the checkboxes for all users to whom you want to assign the role. 6. Click Update Associations. If the user is successfully assigned to a role, the confirmation message is displayed at the top of the page Specifying Visibility of Pages for Selected You can specify the visibility of individual pages or hide them for defined roles. 1. Log in as Administrator. 2. Display the page for which you want to specify the visibility. 3. From the Manage menu, select Page. The Manage Pages dialog is displayed. 4. In the directory tree, select the desired page to display its properties. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

220 220 Administering Liferay Version 6 Managing Portlets 5. Click Permissions. A table listing all roles and their corresponding permissions is displayed: 6. Select the role that is meant to have permission to display the page. 7. Save the changes Defining Default Roles Refer to Defining Default Communities, Roles and User Groups (inubit Process Engine: Administrator and Developer Guide, chap , p. 208) Managing Portlets This section details the following topics: Adding Portlets to a Page, p inubit 6.1: inubit Process Engine: Administrator and Developer Guide

221 Administering Liferay Version 6 Managing Portlets 221 Specifying Visibility of Portlets for Selected Roles, p. 222 Removing Portlets from Pages, p. 223 When managing portlets the following procedure is recommended: 1. Configuring the portlet via the control panel, e.g. defining for which roles the portlet should be visible 2. Adding the configured portlet to one or more pages. Proceeding like this has the great advantage that all portlets on all pages can be managed from one central configuration point. You can change a portlet configuration even after adding it to a page. These changes do not affect the other instances of the portlet. Thus, you can individually change single portlet instances. But it also makes it much more difficult to ensure a uniform configuration of all portlet instances Adding Portlets to a Page 1. Display the page to which you want to add portlets. 2. Click Add > More applications. A list of all available applications is displayed. 3. Click the category to which your portlet belongs. For portlets created with the inubit software the category is defined in the Web Application Connector. By default, these portlets all belong to the inubit category. Refer to Dialog Web Application (Workbench/Process Engine: System Connectors Guide, chap , p. 394). All portlets belonging to the selected category are displayed. 4. Next to the desired portlet, click Add or drag the portlet to the portal page: 5. To close the Add Application dialog, click the red X at the top of the dialog. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

222 222 Administering Liferay Version 6 Managing Portlets The selected portlet is now displayed on the portal page Specifying Visibility of Portlets for Selected Roles You can specifically define for each portlet for whom it should be visible. Roles are used to make portlets visible. You define the visible portlets for each role, and you define the users, user groups, and user subgroups for each role. A list containing all portlets available in the portal can be displayed in the control panel by clicking Portal > Plugins Configuration. Next to each portlet you find a corresponding list of roles that have permission to add the respective portlet to a page: You select a portlet from the list of available portlets and then define the actions within this portlet that the role will have permission to perform. 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Roles. A list of all available roles is displayed. 4. Next to the desired role, click Actions > Define Permissions. A list for selecting portlets is displayed. 5. Select the portlet you wish to add from the list. A list of all available actions is displayed. 6. Check the desired actions. 7. Optionally: You can restrict the actions scope. As a default each action is mit restricted: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

223 Administering Liferay Version 6 Configuring Liferay a. Click Limit Scope. The available communities are displayed another window. b. Click a community. The window closes. All selected communities are displayed in the Scope column. For removing a community click the X of the community. 8. Click Save. A list is displayed containing all portlets visible for the selected role Removing Portlets from Pages All users with an administrator role (Administrator, Community Administrator, Organization Administrator) are allowed to delete portlets from pages. 1. Display the page containing the portlet instance that is to be deleted. 2. Click Remove at the top right of the portlet: 3. Confirm the prompt. The portlet is removed from the page Configuring Liferay 6 This section details the following topics: Configuring Authentication, p. 224 Configuring Locales, p. 225 Configuring Password Policies, p. 226 Deploying Non-inubit Portlets, p. 226 Switching Liferay Database, p. 227 Synchronizing Liferay Users with LDAP, p. 229 Performing Backup, p. 230 Replacing Portal Logo, p. 230 inubit 6.1: inubit Process Engine: Administrator and Developer Guide

224 224 Administering Liferay Version 6 Configuring Liferay 6 Selecting Pre-defined Themes, p. 231 Adding Themes, p. 232 Defining Layout Template for a Page, p. 233 Defining a Portal Name, p. 234 Load Balancing with inubit Portlets, p. 234 Defining the Session Timeout, p. 235 Many central Liferay configuration options are integrated in the file <inubit-installdir>\server\tomcat\webapps\root\web- INF\classes\portal-ext.properties. The specifications contained in this file overwrite the specifications of the original configuration file portal.properties in portal-impl.jar. Further information can be found in the Liferay documentation. All settings stored in the USER EDITABLE SECTION at the end of the file are untouched by patches and are commented out in the protected area Configuring Authentication 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Settings. The Settings page is displayed inubit 6.1: inubit Process Engine: Administrator and Developer Guide

225 Administering Liferay Version 6 Configuring Liferay In the service menu on the right, click Authentication. The General tab is displayed: 5. Define if users must authenticate by address, screen name or user ID. By selecting the corresponding checkbox, you can allow users to automatically log in. 6. Save your selection Configuring Locales You can change the number of languages that can be selected and, thus, change the possible locale settings. Each available language is represented by a flag icon on the login page of the Guest community. 1. Open the control panel. 2. Click on the Portal Settings entry in the Portal section. 3. Click on the Display Settings in the inubit Enterprise Portal menu. 4. Remove the codes of all languages, which should not be displayed, from the field Available Languages. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

226 226 Administering Liferay Version 6 Configuring Liferay 6 5. Click on Save. 6. Leave the control panel and go back to the inubit Cockpit. 7. Sign out from the portal. Now, only the indicated languages (e.g. German and English) are available Configuring Password Policies Password policies can improve the security of your portal. You can define different password policies for individual organizations or users. 1. Log in as Administrator. 2. In the service menu, click Control Panel. 3. In the Portal area, click Password Policies. The list of currently available password policies is displayed. You can edit existing password policies, add new ones, and define who has permissions for which policies and you can assign members to the policies. 4. Save your changes. More complex requirements for password policies can be configured in the portal-ext.properties file. Refer to Liferay Administration Guide, Chapter Advanced Liferay Configuration, The portalext.properties File, Passwords Deploying Non-inubit Portlets Liferay provides hot deployment of layout templates, JSR 168- or JSR 286-compliant portlets and themes: all *.war files stored in the <inubit-installdir>server/portal/liferay6/deploy directory can automatically be accessed via the Liferay repository. The Liferay repository is managed in the Control Panel in the Server > Plugins Installation > Install More Portlets button > Configuration tab inubit 6.1: inubit Process Engine: Administrator and Developer Guide

227 Administering Liferay Version 6 Configuring Liferay Switching Liferay Database By default, Liferay is delivered with an HSQL database. Bosch Software Innovations GmbH recommends for the productive use of the system to replace the pre-configured HSQL database with an external relational database system such as MySQL, PostgreSQL or Oracle, for example. Bosch Software Innovations GmbH highly recommends using the same database for the development and test system as subsequently for the real-time operating system. This facilitates the import of already existing data and preferences and prevents an error-prone migration. As of Liferay 6 you can export your database via the control panel, too. Prerequisites When replacing the HSQL database by a MySQL database: The database schema already exist. To avoid problems with special characters, you should activate UTF-8 encoding for the database. Installing database driver The database driver must not be installed more than once. Exactly one of the following prereqisites must be met. - You have already installed the desired database driver for another database. Refer to - Switching inubit Monitoring Database (inubit Process Engine: Administrator and Developer Guide, chap. 8, p. 119) - Switching inubit Task Database (inubit Process Engine: Administrator and Developer Guide, chap. 8, p. 122) - You have copied the driver for the database that you want to use to one of the following directories: - Tomcat: <inubit-installdir>/server/tomcat/ common/lib - JBoss: <inubit-installdir>/server/jboss/ server/default/lib 1. Open the control panel. 2. In the Server section click on the Server Administration entry. 3. Click on the Data Migration entry. 4. Enter the values of your new database: - JDBC Driver Class Name - JDBC URL inubit 6.1: inubit Process Engine: Administrator and Developer Guide

228 228 Administering Liferay Version 6 Configuring Liferay 6 - JDBC User name - JDBC Password 5. Click on Execute. The database is migrated and then the portal is shut down. 6. Open one of the following files: - Tomcat: <inubit-installdir>/server/tomcat/ webapps/root/web-inf/classes/portalext.properties - JBoss: <inubit-installdir>/server/jboss/server/ default/deploy/root.war/web-inf/classes/ portal-ext.properties 7. Move the parameters suited for your Liferay database to the USER EDITABLE SECTION section, i.e.: #jdbc.default.driverclassname=com.mysql.jdbc.driver #jdbc.default.url=jdbc:mysql://localhost:3306/ liferay606?useunicode=true&characterencoding=utf- 8&useFastDateParsing=false #jdbc.default.username=liferay606 #jdbc.default.password=inubit You can find examples for further database management systems in the portal.properties in the archive portal-impl.jar in one of the following directories: - Tomcat: <inubit-installdir>/server/tomcat/ webapps/root/web-inf/lib - JBoss: <inubit-installdir>/server/jboss/server/ default/deploy/root.war/web-inf/lib 8. Add # comment signs at the beginning of each line in the section between start JDBC Database configuration and end JDBC Database configuration if necessary. 9. Remove the # comment signs from the beginning of each line of the parameters moved in step 7 and adjust the values according to your destination database. When updating the inubit Liferay plugins the parameters in the USER EDITABLE SECTION are considered and not overwritten in the Plugin section. 10. Adjust the hibernate dialect. a. Ensure that all lines containing hibernate.dialect start with a comment sign #. b. Copy the hibernate.dialect line suitable for your database into the USER EDITABLE SECTION. c. Remove the comment sign # from the beginning of the line. 11. Restart the inubit Process Engine inubit 6.1: inubit Process Engine: Administrator and Developer Guide

229 Administering Liferay Version 6 Configuring Liferay Synchronizing Liferay Users with LDAP You can synchronize user data from a directory service such as OpenLDAP with Liferay to realize an authentication with LDAP. 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Portal settings. The Portal settings page is displayed. 4. In the Configuration area on the right, click Authentication. 5. Select the LDAP tab. 6. Enable and configure LDAP settings, e.g.: - Required: If Required is selected, only the Active Directory password is allowed for login, otherwise you can also use the Liferay password. - In the LDAP Servers area all configured servers are listed. You have the following options: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

230 230 Administering Liferay Version 6 Configuring Liferay 6 - Use the arrow buttons to change the servers order. - Click Edit to open to edit the selected server s settings. - Click Delete to remove a server. - Click Add to add a new LDAP server. 7. Save your changes Performing Backup For the backup, use the corresponding tools of your specific operating system and include the following data in the backup process: Configuration file: - Tomcat: <inubit-installdir>/server/tomcat/ webapps/root/web-inf/classes/portalext.properties - JBoss: <inubit-installdir>/server/jboss/server/ default/deploy/root.war/web-inf/classes/ portal-ext.properties Database and Liferay repository in <inubit-installdir>\ server\portal\liferay6 Portlets and themes in <inubit-installdir>\server\ Tomcat\webapps Replacing Portal Logo You can replace the logo which is displayed in the left upper corner of the portal welcome page. Refer to Company logo (Workbench: User Guide, chap. 4., p. 490). 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Settings. The Settings page is displayed. 4. In the service menu on the right, select Miscellaneous > Display settings. 5. In the Logo section, click Change. 6. Click Browse to select a file to upload. 7. Save the new logo file inubit 6.1: inubit Process Engine: Administrator and Developer Guide

231 Administering Liferay Version 6 Configuring Liferay The new logo is displayed on the portal pages and in the service menu Selecting Pre-defined Themes A theme contains layout specifications in order e.g. to confer a uniform look to a community's website. 1. Log in as administrator. 2. Click Manage > Page. - Changing a theme for a community: a. Click the Look and Feel tab. b. Select one of the available themes. A confirmation message is displayed at the top of the page. - Changing a theme for a subordinate page: a. Click the Pages tab. b. Click the desired page in the directory tree. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

232 232 Administering Liferay Version 6 Configuring Liferay 6 c. Click the Look and Feel tab displayed below the breadcrumb path of the selected page: d. Select one of the available themes Adding Themes You can add further themes to the portal by selecting from a list of themes familiar to the system. 1. Log in as Administrator. 2. Click Control Panel. 3. In the Server area, click Plugins Installation. 4. Click the Theme Plugins tab. A list of currently available themes is displayed. 5. Click Install More Themes. A list of known themes is displayed. 6. Select a theme inubit 6.1: inubit Process Engine: Administrator and Developer Guide

233 Administering Liferay Version 6 Configuring Liferay Themes from other suppliers can be installed by using the Upload File dialog. For more information about creating new themes, refer to Liferay Administration Guide: Advanced Liferay Configuration > The portal-ext.properties File > Theme Liferay Development Documentation: Creating Liferay Themes Defining Layout Template for a Page Layout templates define the area where users can position portlets on a page. Users of private pages and administrators of communities or public Web sites can define a layout template for each page. 1. Display the page for which you want to change the layout template. 2. Click Manage > Page Layout. All available layout templates are displayed. 3. Click the desired layout template. 4. Save your changes. The last displayed page is displayed again with the new layout template. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

234 234 Administering Liferay Version 6 Configuring Liferay Defining a Portal Name The portal name is also displayed in the title bar of the browser or tab, resp., e.g.: 1. Log in as Administrator. 2. Click Control Panel. 3. In the Portal area, click Settings. 4. In the Name field, enter the desired name. The portal automatically connects the logo with a link to the portal's starting page. By default, the starting page of the inubit software when delivered is the login page of the Guest community. 5. Save your changes. The change is immediately displayed Load Balancing with inubit Portlets Each portlet instance belongs to a browser session and is linked to an inubit Process Engine. In order to deal with large numbers of users you can distribute the execution of the portlet instances between multiple inubit Process Engines. The portlets of the inubit Process Cockpit cannot be balanced in the described way. For further information on how to balance the execution of these portlets, contact Bosch Software Innovations GmbH inubit 6.1: inubit Process Engine: Administrator and Developer Guide

235 Administering Liferay Version 6 Configuring Liferay Prerequisites All Integration Servers that are meant to balance the load must be listed in the Web Application Connector of the portlet in the Load balancing field. Refer to Dialog Web Application (Workbench/Process Engine: System Connectors Guide, chap , p. 394). The passwords of all Integration Servers must be identical. Refer to Password for the Process Engine (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 29) Defining the Session Timeout You configure the session timeout (default: 600 minutes) via the session-timeout property in the <inubit-installdir>/ server/tomcat/webapps/root/web-inf/web.xml. If you have installed the Solution Center and you have increased this value, you have to configure the session timeout for the Solution Center, too. Therefore, you increase the session-timeout property in the <inubit-installdir>/server/tomcat/webapps/sc/web- INF/web.xml file to a value equal or greater than the value you have configured for the portal. Each patch overwrites the <inubit-installdir>/server/ Tomcat/webapps/sc/WEB-INF/web.xml file so you have to change the file after the patch again. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

236 236 Administering Liferay Version 6 Configuring Liferay inubit 6.1: inubit Process Engine: Administrator and Developer Guide

237 16 Security Measures 237 This section details the following topics: User Administration, p. 237 Roles and Rights, p. 239 Data Visibility, p. 240 Communication and System Connections, p. 240 Executing External Programs and Shell Commands, p. 242 Code Injection, p. 242 Passwords for System Connectors, p. 242 Third-party Components, p. 243 Checklist User Administration, p. 246 Checklist Connection Systems/Business Partner, p. 247 Checklist Hardening, p. 247 Overview This section contains tips how to secure the inubit environment, notes about possible safety risks and check lists for efficient safety measures User Administration This section details the following topics: Defining Patterns for Passwords (Minimum Length, Permissible Characters), p. 238 Overview User must authenticate themselves by entering a user name and password to log-in to the inubit Process Engine via the inubit Workbench. To access user administration, you must have the right for the User Manager component. By default, this rights is assigned to users with System Administrator or Project Lead roles. Further options Additionally, the inubit software offers the following options: Logging login attempts All successful and failed login attempts may be traced in the Audit Log in the inubit Workbench. Blocking user accounts after several failed logins inubit 6.1: inubit Process Engine: Administrator and Developer Guide

238 238 Security Measures User Administration Prevents brute force attacks (UserFailedLoginLimit property). This block affects all users, except users with the System Administrator role, to ensure that the administrative user is always able to log in. Blocked accounts can only be unblocked by a system administrator. Refer to Maximum number of failed login attempts. If this number is exceeded, the user is blocked for security reasons. (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 26) Deleting and disabling user accounts All user accounts can be deleted or disabled by system or group administrators. Following a period of inactivity, users can automatically be disabled after a specified period. Refer to Block inactive user (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 26) and Delete inactive user (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 26) Passwords with minimum lengths and permitted symbols Configure patterns for new passwords. Refer to Defining Patterns for Passwords (Minimum Length, Permissible Characters) (inubit Process Engine: Administrator and Developer Guide, chap , p. 238). Maximum validity period for passwords A user with the System Administrator role can specify a maximum validity period for passwords for all users. After this period has expired the account is blocked and the user is prompted to enter a new password at the next login. This mechanism is not valid for the root user. Refer to Restrict password validity (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 27) Defining Patterns for Passwords (Minimum Length, Permissible Characters) You can define patterns for user passwords and specify, for example, that passwords, must consist of more than eight characters and contain exactly one capital letter and one number. 1. Open the file <inubit-installdir>/server/ibis_root/ conf/ibis_config.xml. 2. Use the following properties to define the patterns: - UserPasswordLimit inubit 6.1: inubit Process Engine: Administrator and Developer Guide

239 Security Measures Roles and Rights 239 Activates/deactivates the verification of a new password or one, which must be notified, against the property UserPasswordLimitPattern. The property UserPasswordLimitNegative defines if the password must match the pattern. - UserPasswordLimitPattern Used to define patterns for new passwords, as for example their minimum length or allowed characters. Criteria for allowed passwords are specified by using a regular expression. The regular expression must comply with the Java class Pattern syntax (of the JDK). Refer to The example in the file specifies that a password must consist of at least eight characters, exactly one capital and one number. - UserPasswordLimitNegative Inverts the meaning of the property value UserPasswordLimitPattern. - If false, a password must comply with the criteria of the property UserPasswordLimitPattern. All passwords are accepted, which are matching the pattern. All others are rejected. - If true, the password must _not_ comply with the criteria of the property UserPasswordLimitPattern. All passwords are accepted, which are not matching the pattern. All others are rejected. 3. Restart the inubit Process Engine to activate the changes Roles and Rights The role concept ensures that inubit users are only able to use the functions and rights they have been authorized to use. A role is a collection of rights that control the access to all functions and objects. This allows you to specify in detail, for instance, what rights each role has. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

240 240 Security Measures Data Visibility The inubit software is delivered with pre-configured roles. These preconfigured roles may be modified but not deleted. A random number of additional roles may also be defined and configured for their actual requirements. Exactly one role may be allocated to each user. Users involved in creating workflows in the system should have the Advanced User role and should also be allocated the Monitoring right. This ensures that the users have all the necessary rights for creating workflows, but prevents them from creating their own users, for example Data Visibility Data visibility is controlled by allocating users to groups: Every user can display his/her own data (modules, workflows) in the inubit Workbench and is able to edit them. Every user can also display his/her own group's data and that of the group immediately superordinate to hers. Every user is able to be a member of exactly one group. Groups may be structured hierarchically. In other words, a group may be a sub-group of exactly one other group. The nesting depth is unlimited. For information about filing user data, refer to Changing the User- Specific Working Directory of the inubit Workbench (inubit Process Engine: Administrator and Developer Guide, chap. 6.1, p. 69) Communication and System Connections inubit Process Engine The inubit Process Engine and the application server (JBoss, or Tomcat) form an integrated application. As a result, there is no communication via network components. inubit Process Engine/Remote Connector The Remote Connector is based on the same source code as the inubit Process Engine. The inubit Process Engine communicates with the remote connector via SOAP. This protocol may be backed up using HTTPS inubit 6.1: inubit Process Engine: Administrator and Developer Guide

241 Security Measures Communication and System Connections 241 inubit Process Engine/ inubit Workbench The client/server architecture of inubit software requires communication between the inubit Process Engine and the inubit Workbench. This communication is also based on the SOAP protocol and may be backed up using SSL to protect the transferred data. HTTPS communication may be encrypted to prevent passwords from being stolen during communication between inubit Workbench and the server. Partner and IT systems There is always a potential security risk when linking business partners with other IT systems. Which protective measures are possible and necessary must be determined individually, because the measures greatly depend on the communication path used. All the settings for message processing and communication may be configured specifically for each partner (e.g. IP addresses, public keys). Ports The SSL ports used for HTTPS communication between the inubit Workbench and the SSL-based protocols for communication with business partners can be separated. This prevents a business partner from connecting to the inubit Process Engine with a inubit Workbench. Every SSL port may be supplied with its own certificate. HTTP-based protocols may be protected by utilizing SSL-secured HTTP connections (HTTPS). For this purpose, it is necessary to configure the SSL port and the private key to be used. Centralized SSL key management In order to communicate with other systems/business partners, the system needs the other system's public keys. These are provided specific to each partner in the System Connectors (modules for connecting a system using an SSL-based protocol, e.g. HTTPS). The business partners' SSL keys are filed in the module properties of the system connectors using the following systematics: <inubitinstalldir>/server/ibis_root/<group>/<sub-group>/ <user>/<modulename>.xml. The inubit software has a central SSL key monitoring component along with the SSL Key Manager. The keystores of the enabled system connectors are managed here; disabled system connectors cannot establish a connection. In due time, before their validity expires, s are automatically sent to a specified address (usually owners of connectors) for notification. Before the SSL key expires, a notification may be sent automatically via to the mailing address specified in the Configuration tab. The SSL Key Manager also allows new certificates to be stored, inubit 6.1: inubit Process Engine: Administrator and Developer Guide

242 242 Security Measures Executing External Programs and Shell Commands including those which are valid before the old certificate expires. The inubit software automatically uses the new certificate once it becomes valid Executing External Programs and Shell Commands The Execution Connector allows the execution of all external programs and shell commands the user has authorization for and under which the inubit Process Engine is running. The Execution Connector can thus present a security risk. If the Execution Connector is not needed in processes, the root user should rescind other users' right to use this module. All the files mentioned in this chapter are further protected by restricting the reading rights of all configuration files Code Injection Certain areas of the inubit software have default protection against command sequences that are transmitted as input. In the login screen, for example, input is filtered so as only to process valid entries (e.g. user names). Data entering via the Web Service Connector is not checked automatically. This test must be completed by the relevant workflow Passwords for System Connectors Passwords for system connectors are encrypted with 3DES and saved in the module. For each module, the file system has one XML file in the following structure: Root user: <inubit-install>/server/ibis_root/root/module All others: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

243 Security Measures Third-party Components 243 <inubit-install>/server/ibis_root/<group>/<subgroup>/<user>/module 16.8 Third-party Components This section details the following topics: JBoss, p. 243 Tomcat, p. 244 UDDI, p. 245 Patches for Tomcat and JBoss, p. 245 The third party components JBoss and Tomcat are installed as part of the standard installation of the inubit software; known weaknesses and unused components are then removed. The following sections describe the rules to be applied. A list of all the third party components used may be obtained on request from Bosch Software Innovations GmbH JBoss The following JBoss components are not required by the inubit software and were therefore removed: WS4EE AOP Deployment Utility (for aspect-based applications) JBoss Web service components Management Web application Mail and monitoring services The components were installed in the following directories; the presence or absence of these directories and files will therefore verify that the components have been removed. $(JBOSS_HOME)/jar-versions.xml $(JBOSS_HOME)/docs $(JBOSS_HOME)/client/* $(JBOSS_HOME)/server/all $(JBOSS_HOME)/server/minimal $(JBOSS_HOME)/server/default/deploy/conf/jbossminimal.xml inubit 6.1: inubit Process Engine: Administrator and Developer Guide

244 244 Security Measures Third-party Components $(JBOSS_HOME)/server/default/deploy/conf/ $(JBOSS_HOME)/server/default/deploy/jbossaop.deployer $(JBOSS_HOME)/server/default/deploy/jbossbean.deployer $(JBOSS_HOME)/server/default/deploy/jboss-ws4ee.sar $(JBOSS_HOME)/server/default/deploy/jbossws14.sar $(JBOSS_HOME)/server/default/deploy/management $(JBOSS_HOME)/server/default/deploy/bshdeployer.xml $(JBOSS_HOME)/server/default/deploy/clientdeployer-service.xml $(JBOSS_HOME)/server/default/deploy/mail-ra.rar $(JBOSS_HOME)/server/default/deploy/mailservice.xml $(JBOSS_HOME)/server/default/deploy/monitoringservice.xml $(JBOSS_HOME)/server/default/deploy/propertiesservice.xml $(JBOSS_HOME)/server/default/deploy/schedulemanager-service.xml $(JBOSS_HOME)/server/default/deploy/schedulerservice.xml $(JBOSS_HOME)/server/default/deploy/sqlexceptionservice.xml JBoss opens ports for various services. To protect JBoss, all ports not required should be closed to incoming data by the local packet filter Tomcat Tomcat functions as the servlet container within the JBoss application server and only executes the code originating from the inubit software. The following Tomcat components were removed because they are not necessary to the functioning of the inubit software: Tomcat Management Console Sample applications Load balancer Web application Removal of these components may be verified by the absence of the following directories and files following the installation (<inubit-installdir>/server/jboss/server/default/ deploy): balancer inubit 6.1: inubit Process Engine: Administrator and Developer Guide

245 Security Measures Third-party Components 245 jsp-example servlets-examples tomcat-docs host-manager manager host-manager.xml manager.xml UDDI A UDDI (Universal Description, Discovery and Integration) functions as a repository for storing WSDL files, to simplify the use of Web Services interfaces for other applications. If you provide a public UDDI, your services published are also made public and are publicly searchable. This is why you should secure your Web Services in this case. Refer to Dialog WS-Security Configuration (Workbench/Process Engine: System Connectors Guide, chap , p. 453). Utilizing UDDI is not a requirement for using Web Services. The inubit software may, therefore, also be installed without juddi Patches for Tomcat and JBoss New versions of Tomcat and JBoss are only integrated into new releases of the inubit software after they have been tested extensively. The decision of which versions to integrate is incumbent upon Bosch Software Innovations GmbH. For security reasons, Bosch Software Innovations GmbH follows the philosophy of not switching to a more current version, unless urgently required, in order to benefit from the respective practical experience testing of the components. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

246 246 Security Measures Checklist User Administration 16.9 Checklist User Administration Review Info Status Max. 5 failed login attempts to inubit Workbench Failed logins to inubit Workbench are recorded in the audit log Block/delete of accounts not needed Maximum validity of passwords =90 days (except root user) 10-character passwords, at least one number, one capital letter, one lowercase letter, one special symbol Users who create workflows have no Admin rights IS user passwords not in plain text in the filing system. Execution Connector required? inubit Workbench > Configuration > General Settings > Administration > User option Refer to Max. number of password failures (inubit Process Engine: Administrator and Developer Guide, chap. 2, p. 26). inubit Workbench > Monitoring > Audit Log tab Only used accounts should exist <inubit-install>/server/ibis_root/ conf/ibis_config.xml UserPasswordTimeout: true UserPasswordTimeoutValue: TimeOut in days <inubit-install>/server/ibis_root/ conf/ibis_config.xml UserPasswordLimit: true UserPasswordLimitPattern: [Regular Expression] Refer to Defining Patterns for Passwords (Minimum Length, Permissible Characters) (inubit Process Engine: Administrator and Developer Guide, chap , p. 238). User configuration: Advanced user with monitoring <inubit-install>/<server>/ <parent group>/<group>/<user>/ user.xml Should only be released for workflow users if requested inubit 6.1: inubit Process Engine: Administrator and Developer Guide

247 Security Measures Checklist Connection Systems/Business Partner Checklist Connection Systems/Business Partner Review Info Status Configuration of private SSL Key SSL Key Manager Passwords of third-party systems/partners are not saved in plain text in the system connector <inubit-installdir>/server/jboss/ server/default/deploy/jbossweb.deployer/server.xml Enter the partner SSL Key in the key manager? <inubit-installdir>/ server/ibis_root/ <group>/<sub-group>/<user>/module Checklist Hardening Review Info Status Read and write rights for inubit installation only for users is JBoss components not needed, removed from file system JMX console password is a secure password. Modify the password in the shutdown script to correspond with the JMX password (refer to previous point). Tomcat components not needed, removed from the file system juddi not installed ls lsar JBoss/server/default/deploy/ jmx-console.war/web-inf/ classes/users.properties JBoss/bin/shutdown.sh Search for juddi.war in <inubitinstalldir> Refer to Configuring the JBoss Application Server (inubit Process Engine: Administrator and Developer Guide, chap. 4.2, p. 60). inubit 6.1: inubit Process Engine: Administrator and Developer Guide

248 248 Security Measures Checklist Hardening inubit 6.1: inubit Process Engine: Administrator and Developer Guide

249 17 Optimizing Performance 249 This section details the following topics: Optimizing the inubit Software, p. 249 Optimizing the Java Virtual Machine (JVM), p. 251 Optimizing Network and Hardware, p. 253 Benchmark Workflows, p. 254 This section explains options for improving the performance of the inubit software. General information Due to time constraints, workflows are usually developed and tested using smaller files than are actually used in the production operation. So right at the workflow design stage, you should try to take the actual or maximum file size into account! Measure the performance before and after every system optimization, to adequately determine if the optimization has brought about a performance improvement Optimizing the inubit Software Parallelizing By default, the inubit software may execute Technical Workflows and BPEL processes in several independent threads. The maximum number of threads that may be executed depends on the license and the configuration of the workflow threadpool. Additionally, several processes of a Technical Workflow or BPEL diagram may be executed in parallel. When using the inubit software on a single-processor machine, the use of at most ten parallel threads increases message throughput and optimizes the machine's load. A portion of the computing time can often not be used in an average machine, because one must wait for relatively slow, external events such as user input or the network connection. The wait time thus created may be used by other threads. However, if the machine is used to capacity by, for example, computation-intensive threads, the use of parallel threads will result in even more threads receiving proportional computing time, instead of having to wait for another, computation-intensive thread. To further increase performance or to use more than ten threads, a multi-processor machine with a inubit Process Engine based on JBoss is required. Refer to inubit 6.1: inubit Process Engine: Administrator and Developer Guide

250 250 Optimizing Performance Optimizing the inubit Software - Configuring the Thread Pool for Workflows (inubit Process Engine: Administrator and Developer Guide, chap , p. 30) - Activate parallel execution of Technical Workflow processes or BPEL diagrams: Execution Tab (TWF and BPEL only) (Workbench: User Guide, chap , p. 105) Load balancing You can distribute the execution of computation-intensive modules onto various cluster nodes. Refer to - Clustering (inubit Process Engine: Administrator and Developer Guide, chap. 18, p. 261) - Load balancing: Executing module in cluster (Workbench: User Guide, chap. 3, p. 128) Application Server Information on changes to increase the performance of the application server you are using may be obtained from the respective manufacturer's technical documentation. Performance analysis Object System load (hard disk, processor, memory) Execution times of workflows and modules Available working memory Memory load of the inubit Workbench Memory load of JVM Displayed in Tab Reporting > as default reports You can customize the report settings, refer to Standard reports (Workbench: User Guide, chap. 13, p. 327) Tab Configuration > General Settings, configuration category Administration > Server inubit Workbench > Status bar Refer to Memory usage/garbage Collector ( button) (Workbench: User Guide, chap. 1, p. 26). Read out with a workflow containing the IS Configuration utility. Refer to inubit IS Configuration (Utility) (Workbench/ Process Engine: Modules Guide, chap. 17, p. 219). Note for HP-UX If the message "OutOfMemoryError - Unable to create new native thread" is displayed, the following kernel parameters (e. g. using SAM administration tool) must be increased: max_thread_proc (min. 128) maxdsiz (min. 256MB) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

251 Optimizing Performance Optimizing the Java Virtual Machine (JVM) 251 nkthread nproc Also refer to guide/expanding_memory.html#expanding11.11pa-risc 17.2 Optimizing the Java Virtual Machine (JVM) This section explains the options for optimizing the memory allocation and garbage collection of JVM. Both factors are relevant to the performance of the application server (Tomcat/JBoss) in high-load scenarios. Optimizing JVM performance should always be completed before a hardware upgrade of the server is made. The performance improvements achieved are often underestimated! Linux systems are used successfully, especially in high-end segments, where in comparison to Windows systems, a larger maximum JVM heap is to be achieved. Background JVM has a special area in the working memory, known as the heap, where Java objects are generated and managed. A portion of this heap is permanently allocated, the other is virtually reserved and is only used once the allocated memory is no longer sufficient. The heap is cleaned up regularly by garbage collectors (GC), in order to free up unused memory. The work of the GC impairs performance. The more rarely a GC filters starts, the less time is taken up and the performance of the application server is that much better. Allocating the memory (memory allocation) and the garbage collection can be optimized with help from parameters defined when JVM starts. -Xms specifies the size of the fixed, initially allocated memory space of JVM. -Xmx defines the maximum size of the heaps. The size is calculated from the fixed allocated memory plus the virtually allocated memory. The maximum size also depends upon the operating system. If the heap memory is too small, then garbage collections will occur frequently. During these periods, the application will respond slowly, depending on the GC mechanism selected. This will lead to poor performance and slower response times. The heap is divided into two large segments: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

252 252 Optimizing Performance Optimizing the Java Virtual Machine (JVM) - Young Generation (YG): For newly generated objects that are often short lived and that are consequently more frequently collected as part of a simple GC. - Tenured Generation (TG): Includes older objects that have previously survived several GC runs during the young generation. A GC in this segment if often time consuming. The frequency of the GC in the tenured generation is essentially influenced by the size of the TG: the larger the TG, the less frequently the GC must search for used objects to free up memory space. - Permanent Generation (PG): Segment where objects are created that are already expected to have long life, such as class objects. All of these together constitute the JVM memory. A rule of thumb for dimensioning the working memory is: Xmx + (40% of Xmx) + memory for the operating system. Example: 1 GB MB MB = 1,9 GB memory It is best to increase the Xmx in 32MB steps. Make sure you provide enough real physical memory. Swapping leads to drastic performance losses. Multi-processor machines Parameter The best performance results were achieved in load tests with the following parameters: Explanation Global Parameter -server -Xms1024M -Xmx1024M -XX:MaxPermSize Activates the server mode of JVM. In server mode there are clearly far more older objects than young ones. Therefore, the ratio between YG and TG is set to 1:3. If Xms = Xmx then the effort of allocating additional memory is dropped and performance improves. Caution: if the value was chosen improperly then JVM may no longer be capable of catching errors! Maximum size of Permanent Generation. Young Generation -XX:NewSize=512m -XX:SurvivorRatio=2 -XX:TargetSurvivorRatio=80 Minimum size of the Young Generation: default value is 64 MB (often too small), better: offer as much memory as possible. Ratio of sizes of Eden compared to Survivor Spaces Target occupation of survivor spaces (in percent) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

253 Optimizing Performance Optimizing Network and Hardware 253 Parameter -XX:+UseParNewGC (in connection with ConcMarkSweep) Explanation Activates the parallel garbage collection (simple GC and full GC parallel). By default the Java Garbage Collection runs in one single thread. For more than two CPUs, the last three parameters should be replaced by -XX: +UseParallelGC, to activate the parallel GC in the Young Generation. For further information refer to - turbo/index.html tuning.html Note that all optimization information depends directly on the JVM version used. If necessary, Bosch Software Innovations GmbH is happy to provide support in optimizing your system. 32-bit vs. 64-bit installations The maximum size of the JVM memory also depends on the hardware used and the operating system. Generally, in a 32-bit architecture, a maximum of 4 GB of working memory may be addressed and the JVM memory may be about 1.5 GB. In order to utilize more working memory and thus JVM memory, it is possible to use a 64-bit operating system and a 64-bit JVM. This increases the useable working memory to 8 TB. Applications that have run on 32 bits can be executed on a 64-bit operating system. For Windows and Linux, the inubit software includes 64 Bit-JVM Optimizing Network and Hardware Another factor influencing system performance is the capacity of the connections between the inubit Workbench and the inubit Process Engine as well as the inubit Process Engine and thirdparty systems, for example database or partner systems. At least one ISDN connection with two-channel groupings must be used to ensure acceptable performance. A faster connection increases performance. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

254 254 Optimizing Performance Benchmark Workflows Hardware The hardware equipment also has significant influence on the performance of a system. In principle, a faster processor, more working memory and a faster hard disk drive will increase system performance. The following rule of thumb may be applied when dimensioning the working memory: messages and variables are retained during your processing in a workflow with non-streaming capable modules. A message that is about 100 MB will have three-fifths of the necessary working memory. If several processes of a Technical Workflow or BPEL diagram are executed in parallel, then the working memory must be sufficiently dimensioned for the maximum number of parallel running processes. The following module types are capable of streaming: - File Connector (Workbench/Process Engine: System Connectors Guide, chap. 10, p. 119) - FTP(s) Connector (Workbench/Process Engine: System Connectors Guide, chap. 11, p. 129) - OFTP Connector (Workbench/Process Engine: System Connectors Guide, chap. 23, p. 219) - Attachments for Web Services Connector (Workbench/Process Engine: System Connectors Guide, chap. 40, p. 399) - Attachments for RosettaNet HTTPS Connector (Workbench/ Process Engine: System Connectors Guide, chap. 29, p. 297) - Data Stream Modifier (Utility) (Workbench/Process Engine: Modules Guide, chap. 15, p. 215) - Empty (Workbench/Process Engine: Modules Guide, chap. 28.5, p. 270) - Assign (Workbench/Process Engine: Modules Guide, chap. 28.1, p. 265) - Joiner (Workbench/Process Engine: Modules Guide, chap. 28.7, p. 271) - Splitter (Workbench/Process Engine: Modules Guide, chap , p. 275) 17.4 Benchmark Workflows This section details the following topics: Preparing and Executing Benchmark Workflows, p. 256 Configuring the Benchmark Suite and the Benchmark Procedure, p. 256 Creating Your Own Benchmark Workflows, p inubit 6.1: inubit Process Engine: Administrator and Developer Guide

255 Optimizing Performance Benchmark Workflows 255 Setting Your Own Reference Values, p. 258 Displaying the Benchmark Report, p. 259 Calling Syntax of the Benchmark Script, p. 259 Usage You can use benchmark workflows to compare hardware that is to be used with the inubit software with a reference hardware and determine the following values: Absolute number of workflows executed Average execution time of the workflows CPU load How it works The benchmark workflows supplied are each executed once, five times and ten times in parallel in a pre-defined time period (standard 3 minutes). The number of workflow runs completed is compared with the values stored for the reference hardware. One factor, the inubit benchmark index, specifies the extent to which the tested hardware deviates from the reference hardware. The reference value is 10 and corresponds to 100 %. Deviations downwards or upwards show that fewer or more workflows have been processed on the tested hardware than on the reference hardware. Reference hardware You will find the features of the reference hardware used in the report file under the ServerTest entry with the attribute host='benchmarkreferenceserver'. Own benchmarks Alternatively, you can create your own benchmark workflows and use them in your own benchmark suites. You can use your own reference hardware to determine your own reference values and determine your own benchmark index. The indexes determined from your own reference values are not comparable with the inubit benchmark index included in the scope of delivery. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

256 256 Optimizing Performance Benchmark Workflows Preparing and Executing Benchmark Workflows 1. Import the diagram with the benchmark workflows: <inubit-installdir>/server/benchmark/ benchmark.diagramgroup.zip 2. Activate all the benchmark workflows. 3. Go to directory <inubit-installdir>/server/benchmark. 4. Open a command line window and set the width of the window to at least 140 characters so that only the overview line is refreshed. 5. Start the benchmark script suitable for your system: - Unix/Linux: benchmark.sh - Windows: benchmark.bat When a workflow is started for the first time, the server is optimized for the workflow. Therefore, in a warm-up phase, the benchmark workflows are executed fifty times before the actual benchmark workflows are started. 6. Display the benchmark report. Refer to Displaying the Benchmark Report (inubit Process Engine: Administrator and Developer Guide, chap , p. 259) Configuring the Benchmark Suite and the Benchmark Procedure Prerequisites You have prepared and executed the benchmark workflows. Refer to Preparing and Executing Benchmark Workflows (inubit Process Engine: Administrator and Developer Guide, chap , p. 256). 1. Open the benchmark.properties file in directory <inubit-installdir>/server/benchmark. This file is created during the first start of the benchmark scripts (refer to step 5 in section Preparing and Executing Benchmark Workflows (inubit Process Engine: Administrator and Developer Guide, chap. 17, p. 256)). 2. Adjust the following parameters: - benchmark.config.thread=[1 5 10] inubit 6.1: inubit Process Engine: Administrator and Developer Guide

257 Optimizing Performance Benchmark Workflows 257 Number of workflows executed in parallel for each of the configured runs (see also benchmark.config.runtime) - benchmark.config.runtime=3 Time for the benchmark of a workflow in a specific configuration - benchmark.config.server=localhost Host name or IP address of the system with the inubit Process Engine - benchmark.config.port=8000 Port for the communication with the inubit Process Engine - benchmark.config.calltimeout=10 Call timeout in seconds: after the time period specified elapses, the script is terminated with an error message if it was not possible to start the benchmark suite. - benchmark.suite.full Suite with the names of the HTTP connectors of the benchmark workflows to be executed (option -b full) - benchmark.suite.normal Standard suite with the names of the HTTP connectors of the benchmark workflows to be executed - benchmark.suite.fast Suite with the names of the HTTP connectors of the benchmark workflows to be executed (option -b fast) 3. Below the section List of Benchmark sets, modify an existing benchmark suite or create a new benchmark suite based on the following sample: - Name of the benchmark suite benchmark.suite.<name of the suite> - Names of the HTTP connectors of the workflows to be executed, separated by a comma and a space <HTTP connector1>[, <HTTP connector2>...] benchmark.suite.suite1=http_conn_twf1 4. Save your changes Creating Your Own Benchmark Workflows 1. Create a new workflow or use an existing workflow. 2. Insert an HTTP connector and connect it with the first module of the workflow. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

258 258 Optimizing Performance Benchmark Workflows 3. Create a new benchmark suite. Refer to Configuring the Benchmark Suite and the Benchmark Procedure (inubit Process Engine: Administrator and Developer Guide, chap , p. 256). 4. Enter the name of the workflow as a parameter value. 5. Save the modified configuration file under another name. 6. Start the benchmark script with the modified configuration file and with a modified report file Setting Your Own Reference Values 1. Execute a benchmark suite with the workflows you created and a benchmark suite created from this on the reference hardware. Refer to - Configuring the Benchmark Suite and the Benchmark Procedure (inubit Process Engine: Administrator and Developer Guide, chap , p. 256) - Creating Your Own Benchmark Workflows (inubit Process Engine: Administrator and Developer Guide, chap , p. 257) 2. Open the report file. 3. Remove the ServerInfo element and the TestCase elements under the ServerTest entry with the attribute host='benchmarkreferenceserver'. 4. Copy the ServerInfo element and the TestCase elements under the ServerTest entry with the attribute host='<name of the reference server>'. 5. Insert the copied entries under the ServerTest entry with the attribute host='benchmarkreferenceserver'. 6. Save the report file under a new name. 7. Transfer the new report file and the related configuration file to the systems whose inubit benchmark index you want to determine. 8. Start the benchmark script with the modified configuration file and the modified report file. Refer to Preparing and Executing Benchmark Workflows (inubit Process Engine: Administrator and Developer Guide, chap , p. 256). 9. Open the benchmark report. Refer to Displaying the Benchmark Report (inubit Process Engine: Administrator and Developer Guide, chap , p. 259) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

259 Optimizing Performance Benchmark Workflows 259 The index determined indicates how your current hardware deviates from your reference hardware Displaying the Benchmark Report 1. Go to directory <inubit-installdir>/server/benchmark. 2. Start the benchmark script with the option -pr (display selected report). - Unix/Linux: benchmark.sh -pr [report file] - Windows: benchmark.bat -pr [report file] You only have to specify the report file (standard: benchmarkreport.xml) if you specified another path and/or file name when starting the benchmark suite. 3. Open the report file in the workbench editor Calling Syntax of the Benchmark Script With the values you set when calling the script you overwrite the values in the configuration file <inubit-installdir>/server/ benchmark/benchmark.properties. Call up Start the benchmark script from the command line with the following call: benchmark [OPTIONS] -server <server_name> -r <report_file> -b -benchmark <benchmark Suite> Benchmark suite to be executed, e. g.: -b fast Refer to Configuring the Benchmark Suite and the Benchmark Procedure (inubit Process Engine: Administrator and Developer Guide, chap , p. 256). -c <configuration file> Path and file name of the configuration file Refer to Configuring the Benchmark Suite and the Benchmark Procedure (inubit Process Engine: Administrator and Developer Guide, chap , p. 256). -h --help inubit 6.1: inubit Process Engine: Administrator and Developer Guide

260 260 Optimizing Performance Benchmark Workflows Display help -port <port number> Port via which the inubit Process Engine can be reached, e. g.: - port pr <report file> Report file to be output -r <report file> Path and file name of a report file The file must already exist. -rt -runtime <duration> Maximum duration for the benchmark suite in minutes, e. g.: -rt 10 -server <IP address or host name> IP address or DNS name of the computer on which the inubit Process Engine is running, e. g.: -server ) -t -thread [<Thread1> <Thread2> <Thread3>...] Number of parallel threads or a group of threads, e. g.: -t [1 5 10]) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

261 18 Clustering 261 This section details the following topics: Load-sharing Cluster, p. 262 High-availability Cluster, p. 263 Installing, p. 263 Activating and Configuring Clustering, p. 264 Configuring Modules, p. 264 Use Computer clusters are used to increase processing power (load sharing) and/or guarantee high availability: Load sharing Distributes the computer load to several servers in a network and thus increases performance. High Availability Ensures availability of applications, even when errors occur, so that users are not aware of any service interruption. Installing and configuring clusters is complex and depends on a wide range of system- specific parameters. Thus, our documentation can only provide basic information. If desired, the Bosch Software Innovations GmbH will be glad to support you when configuring your cluster system. Editions of the inubit software The Professional and Enterprise Editions of the inubit software are suitable for clustering: Professional Edition In the Professional Edition the inubit Process Engine runs on an application server with Jakarta Tomcat as the integrated servlet engine. The workflow engine (responsible for processing workflows) is available in thread pool mode with 10 parallel workflow threads, thus allowing execution of up to 10 workflows simultaneously. The SOAP servlets on the inubit Process Engine are operated in multi-thread mode. The maximum number of simultaneous uploads or downloads depends upon the configured possible number of parallel client requests. The Professional Edition is suitable for use in a high-availability cluster, refer to High-availability Cluster (inubit Process Engine: Administrator and Developer Guide, chap. 18.2, p. 263). Enterprise Edition In the Enterprise Edition the inubit Process Engine runs in JBOSS as an application server and Jakarta Tomcat is used as the integrated servlet engine. The SOAP servlets on the inubit Process Engine are operated in thread mode; Java Beans are also supported. The Administrator configures the maximum inubit 6.1: inubit Process Engine: Administrator and Developer Guide

262 262 Clustering Load-sharing Cluster number of possible parallel client requests. The number of parallel workflow threads is unlimited, the inubit software may therefore be operated in a high-traffic environment. By utilizing JBOSS, the clustering runs mostly transparently for the applications, since only the configurations of JBOSS are changed and not the Java Code of the applications. The Enterprise Edition is suitable for use in a high-availability cluster as well as in a load-sharing cluster. Refer to - High-availability Cluster (inubit Process Engine: Administrator and Developer Guide, chap. 18.2, p. 263) - Load-sharing Cluster (inubit Process Engine: Administrator and Developer Guide, chap. 18.1, p. 262) 18.1 Load-sharing Cluster The inubit load-sharing cluster is operated as an active/active cluster. The clustering properties of the application server are used for this purpose. The master distributes the processing the individual modules to different workers. This does not apply to system connectors that always run on the master. The requirement for the load-sharing cluster is that the relevant workflows be activated for clustered operation. It must be closely monitored whether the gain in performance justifies the increased overhead. Performance may be increased by adding more workers. Operating inubit software as a load-sharing cluster does not automatically imply operation as a high-availability cluster, with regard to function or licensing. However, it is possible to operate a failover system simultaneously on the cluster nodes of the load-sharing cluster, in terms of a high-availability cluster. This failover system must be installed in addition to the cluster installation. In principle this is also recommended, as the entire cluster would otherwise fail if the master fails. This configuration does not need to be implemented for all cluster nodes. In order to ensure that the worker connects to the correct IP address it can be necessary to call up the worker as follows: run.{sh bat} -b <IP-Adresse> inubit 6.1: inubit Process Engine: Administrator and Developer Guide

263 Clustering High-availability Cluster High-availability Cluster The inubit high-availability cluster is an active/passive system. In other words, it consists of an active master that processes queries and several passive reserve nodes (slaves) on standby. All systems access a common database on a common ibis_root directory on one shared disk. Access is granted according to the shared nothing principle; only one instance may access the file system at a time. Requirements The requirement for operating the inubit Process Engine as a highavailability cluster is the use of a solution that meets at least one of the following criteria: Monitoring the machine, operating systems and other services (e. g. by script). Managing the resources such as virtual IP, SAN device (migration to the reserve node in case of error). Start of services on the reserve node after an error occurs. To ensure actual high availability, the system environment must also be highly available (e. g. power supply, shared disk and database). Archiving in SAN is recommended. Hot Standby/cold standby For a pure high-availability cluster the slaves may be operated on hot or cold standby: On hot standby, the reserve node is started automatically after an error and will assume all the tasks of the master. The data is transaction secured. On cold standby, the slave system must be started manually Installing External *.jar files For cluster installations, external *.jar files must be installed on each node, otherwise an exception is thrown. This applies, for example, to SAP Jars and all self-developed plug-ins. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

264 264 Clustering Activating and Configuring Clustering 18.4 Activating and Configuring Clustering Call up inubit Workbench > Configuration > General Settings > Administration > Clustering. Option Enable clustering Naming Context Factory JNDI Service URL Naming the Factory URL Packages EJB Name Explanation To enable clustering Name of the initial context factory. A complete class name with package must be provided. URL of the JNDI service which is used by the cluster nodes. Colon-separated list of package names for factory classes which generate URL context factories. Name of the EJB the nodes are distributed to. Changes to the configuration must be saved in order to be enabled! 18.5 Configuring Modules Refer to Load balancing: Executing module in cluster (Workbench: User Guide, chap., p. 128) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

265 19 Implementing Thin Clients 265 This section details the following topics: Function Calls Offered by the Thin Client Interface, p. 265 Listing, p. 266 Sample Implementations, p. 270 Use The thin client interface of the inubit software allows you to create thin clients in any programming language. These thin clients ensure the communication of different source and target applications with the inubit Process Engine and are used for the following tasks: Sending data to an inubit Process Engine to execute workflows in synchronous or asynchronous mode. Receiving data that has been processed by workflows on an inubit Process Engine. Available protocols SOAP EJB/RMI Refer to Function Calls Offered by the Thin Client Interface The following function calls can be used to communicate with the inubit software: connectsoap or connectejb: For connecting to the inubit Process Engine login: Login inubit Process Engine logout: Logout inubit Process Engine sendmessage: Sending messages asynchronously to the inubit Process Engine. receivemessage: Receiving messages asynchronously from the inubit Process Engine. convertmessage: Synchronously calling up a workflow for processing messages and variables in the inubit Process Engine. sendmessageuncompressed: Sending messages asynchronously to the inubit Process Engine. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

266 266 Implementing Thin Clients Listing receivemessageuncompressed: Receiving messages asynchronously from the inubit Process Engine. convertmessageuncompressed: Synchronously calling up a workflow for processing messages in the inubit Process Engine. All messages are base64-encoded and compressed Listing Listing 1 package com.inubit.ibis.utils; 2 3 import java.io.inputstream; 4 import java.io.outputstream; 5 import java.util.properties; 6 7 import com.inubit.ibis.plugins.utils.ibispluginpropertyhandler; 8 9 /** 10 * This interface implements is Java Thin Client. 11 * ThinClientSOAP uses SOAP protocol to communicate with is 12 * ThinClientEJB uses RMI protocol to communicate with is. 13 * 14 */ 15 public interface I_ThinClient { 16 /** 17 * Connect a ThinClient to the is via the XML-RPC protocol. 18 urlstring IBIS servlet URL 19 truststorefile trusted keystore, only for HTTPS relevant 20 InubitException 21 */ /** 24 * Connect a ThinClient to the is via the XML-RPC protocol. 25 * 26 urlstring IBIS servlet URL 27 truststorefile trusted keystore, only for HTTPS relevant /Listing (Abschnitt 1 von 5) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

267 Implementing Thin Clients Listing 267 Listing 28 keystorefile keystore file, only for HTTPS client authentication relevant 29 keystorepassword keystore password, only for HTTPS client authentication relevant 30 InubitException 31 */ /** 34 * Connect a ThinClient to the is via the SOAP protocol. 35 * Only ThinClientSOAP implements this method. 36 * 37 urlstring is servlet URL 38 truststorefile trusted keystore, only for HTTPS relevant 39 InubitException 40 */ 41 public void connectsoap(string urlstring, String truststorefile) throws InubitException; /** 44 * Connect a ThinClient to the is via the SOAP protocol. 45 * Only ThinClientSOAP implements this method. 46 * 47 urlstring is servlet URL 48 truststorefile trusted keystore, only for HTTPS relevant 49 keystorefile keystore file, only for HTTPS relevant, client authentication 50 keystorepassword keystore password, only for HTTPS relevant, client authentication 51 InubitException 52 */ 53 public void connectsoap(string urlstring, String truststorefile, String keystorefile, String keystorepassword) throws InubitException; /** 56 * Connect a ThinClient to the is via the EJB/RMI protocol. 57 * Only ThinClientEJB implements this method. 58 * 59 props the properties for the connection 60 InubitException 61 */ 62 public void connectejb(properties props) throws InubitException; /Listing (Abschnitt 2 von 5) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

268 268 Implementing Thin Clients Listing Listing /** 65 * Login a user to use a workflow on an is 66 * 67 username the username for the login 68 password the password for the login 69 the id of the user 70 InubitException 71 */ 72 public String login(string username, String password) throws InubitException; /** 75 * Logout user from is 76 InubitException 77 */ 78 public void logout() throws InubitException; /** 81 * Send a message asynchronously to is, compressed data transport. 82 * 83 filename the name of the file sent to the is 84 inputmessagestream the input message with the data to be sent to the is 85 InubitException 86 */ 87 public void sendmessage(string filename, 88 InputStream inputmessagestream) throws InubitException; /** 91 * Receive asynchronously processed message from is, compressed data transport. 92 * 93 filename the name of the file to be downloaded from the is 94 outputmessagestream the output stream to write the data from the server to 95 InubitException 96 */ 97 public void receivemessage(string filename, 98 OutputStream outputmessagestream) throws InubitException; /** /Listing (Abschnitt 3 von 5) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

269 Implementing Thin Clients Listing 269 Listing 101 * Synchronous message processing by IS, compressed data transport. 102 * 103 inputmessagestreams the input message with the data to be sent to the is 104 outputmessagestreams the output streams to write the data from the server to 105 InubitException 106 */ 107 public void convertmessage(inputstream[] inputmessagestreams, 108 OutputStream[] outputmessagestreams) throws InubitException; /** 111 * Synchronous message processing by is, compressed data transport. 112 * 113 inputmessagestreams the input message with the data to be sent to the is 114 outputmessagestreams the output streams to write the data from the server 115 variables can optionally be defined for workflow execution 116 InubitException 117 */ 118 public void convertmessage(inputstream[] inputmessagestreams, 119 OutputStream[] outputmessagestreams, IBISPluginPropertyHandler variables) throws InubitException; /** 122 * Send a message asynchronously to IS, uncompressed data transport. 123 * 124 filename the name of the file sent to the IS 125 inputmessagestream the input message with the data to be sent to the is 126 InubitException 127 */ 128 public void sendmessageuncompressed(string filename, 129 InputStream inputmessagestream) throws InubitException; /** 132 * Receive asynchronous processed message from IS, uncompressed data transport. 133 * 134 filename the name of the file to be downloaded from the is /Listing (Abschnitt 4 von 5) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

270 270 Implementing Thin Clients Sample Implementations Listing 135 outputmessagestream the output stream to write the data from the server to 136 InubitException 137 * 138 */ 139 public void receivemessageuncompressed(string filename, 140 OutputStream outputmessagestream) throws InubitException; /** 143 * Synchronous message processing by IS, uncompressed data transport. 144 * 145 inputmessagestreams the input message with the data to be sent to the IS 146 outputmessagestreams the output streams to write the data from the server 147 InubitException 148 */ 149 public void convertmessageuncompressed(inputstream[] inputmessagestreams, 150 OutputStream[] outputmessagestreams) throws InubitException; /** 153 * Returns the object data as serialized XML string 154 * 155 user 156 objectname 157 objecttype 158 object 159 InubitException 160 */ 161 public String getobject(string user, String objectname, String objecttype) throws InubitException;} /Listing (Abschnitt 5 von 5) 19.3 Sample Implementations This section details the following topics: inubit 6.1: inubit Process Engine: Administrator and Developer Guide

271 Implementing Thin Clients Sample Implementations 271 Example: Thin Client and SOAP, p. 272 Example: Thin Client with EJB/RMI Protocol, p Install the Java Development Kit from SUN (version 1.5 or higher). 2. Only when using another JRE for executing thin clients than the one installed along with the inubit software: Make sure that the files jsse.jar and jnet.jar are placed in the directory <java-home>/lib/ext. 3. Copy the files ibis.jar, ibis_tools.jar, and ibis_ tools2.jar from the directory <inubit-installdir>/ client/lib to the thin client computer. Enter the path of the files to the CLASSPATH. 4. Choose a protocol (SOAP, EJB/RMI) for implementation of your thin client and implement the thin client accordingly. inubit 6.1: inubit Process Engine: Administrator and Developer Guide

272 272 Implementing Thin Clients Sample Implementations Example: Thin Client and SOAP Listing 1 package com.inubit.ibis.demo; 2 import java.io.*; 3 import com.inubit.ibis.utils.i_thinclient; 4 import com.inubit.ibis.utils.thinclientsoap; 5 public class SoapClientDemo { 6 public static void main(string[] args) { 7 // check the parameters 8 if (args.length < 4) { 9 usage(); 10 System.exit(1); 11 } 12 // set the upload and download files 13 File uploadfile = new File(args[0]); 14 File downloadfile = new File(args[1]); 15 // set the login name and password of the Input System Connector 16 String login = args[2]; 17 String password = args[3]; 18 // create the SOAP thin client 19 I_ThinClient client = new ThinClientSOAP(); 20 try { 21 // connect the client to the local IS 22 client.connectsoap( 23 " null); 24 // login to the Input System Connector 25 String userid = client.login(login, password); 26 FileInputStream in = new FileInputStream(uploadFile); 27 FileOutputStream out = new FileOutputStream(downloadFile); 28 // perform a synchronous operation 29 client.convertmessage(new InputStream[]{in}, 30 new OutputStream[]{out}); 31 // logout the thin client 32 client.logout(); 33 System.out.println("SOAP demo finished successfully"); 34 } catch (Exception e) { 35 e.printstacktrace(); 36 } 37 } 38 /** 39 * Displays the usage parameters. 40 */ /Listing (Abschnitt 1 von 2) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

273 Implementing Thin Clients Sample Implementations 273 Listing 41 private static void usage() { 42 System.out.println("Usage: java " + 43 SoapClientDemo.class.getName() + 44 " <uploadfile> <downloadfile> <login> <password>"); 45 } 46 } /Listing (Abschnitt 2 von 2) Compiling Windows set IS_CLIB=<inubit-installdir>\client\lib javac classpath %IS_CLIB%\ibis.jar;%IS_ CLIB%\ibis_tools.jar SoapClientDemo.java Unix export IS_CLIB=<inubit-installdir>/client/lib javac classpath $IS_CLIB/ibis.jar:$IS_CLIB/ibis_ tools.jar SoapClientDemo.java Starting demo For testing, use a workflow with an inubit IS Connector configured as an input listener. Windows java cp.;%is_clib%\ibis.jar;%is_clib%\ibis_ tools.jar -Dsax.driver=org.apache.xerces.parsers.SAXParser com.inubit.ibis.demo.soapclientdemo input.xml output.csv catalog-in inubit Unix java cp.:$is_clib/ibis.jar:$is_clib/ibis_ tools.jar -Dsax.driver=org.apache.xerces.parsers.SAXParser com.inubit.ibis.demo.soapclientdemo input.xml output.csv catalog-in inubit inubit 6.1: inubit Process Engine: Administrator and Developer Guide

274 274 Implementing Thin Clients Sample Implementations Example: Thin Client with EJB/RMI Protocol Listing 1 package com.inubit.ibis.demo; 2 import java.io.*; 3 import java.util.properties; 4 import com.inubit.ibis.utils.i_thinclient; 5 import com.inubit.ibis.utils.thinclientejb; 6 7 public class EJBClientDemo { 8 public static void main(string[] args) { 9 // check the parameters 10 if (args.length < 4) { 11 usage(); 12 System.exit(1); 13 } 14 // set the upload and download files 15 File uploadfile = new File(args[0]); 16 File downloadfile = new File(args[1]); 17 // set the login name and password of the Input System 18 // Connector 19 String login = args[2]; 20 String password = args[3]; 21 // create the SOAP thin client 22 I_ThinClient client = new ThinClientEJB(); 23 try { 24 // connect the client to the local IS 25 Properties props = new Properties(); 26 props.setproperty("java.naming.factory.initial", 27 "org.jnp.interfaces.namingcontextfactory"); 28 props.setproperty("java.naming.provider.url", "localhost:1099"); 29 props.setproperty("java.naming.factory.url.pkgs", 30 "org.jboss.naming:org.jnp.interfaces"); 31 props.setproperty("ejb-name", "IBISEJBClient"); 32 client.connectejb(props); 33 // login to the Input System Connector 34 String userid = client.login(login, password); 35 FileInputStream in = new FileInputStream(uploadFile); 36 FileOutputStream out = new FileOutputStream(downloadFile); 37 // perform a synchronous operation 38 client.convertmessage(new InputStream[]{in}, 39 new OutputStream[]{out}); /Listing (Abschnitt 1 von 2) inubit 6.1: inubit Process Engine: Administrator and Developer Guide

275 Implementing Thin Clients Sample Implementations 275 Listing 40 // logout the thin client 41 client.logout(); 42 System.out.println("SOAP demo finished successfully"); 43 } catch (Exception e) { 44 e.printstacktrace(); 45 } 46 } 47 /** 48 * Displays the usage parameters. 49 */ 50 private static void usage() { 51 System.out.println("Usage: java " + 52 EJBClientDemo.class.getName() + 53 " <uploadfile> <downloadfile> <login> <password>"); 54 } 55 } 56 /** 57 * Synchronous message processing by is, compressed data transport. 58 inputmessagestreams the input message with the data to send to the is 59 outputmessagestreams the output streams to write the data from the server to 60 variables can optionally be defined for workflow execution 61 InubitException 62 */ 63 public void convertmessage(inputstream[] inputmessagestreams, 64 OutputStream[] outputmessagestreams, IBISPluginPropertyHandler 65 variables) throws InubitException; /Listing (Abschnitt 2 von 2) Compiling Windows set IS_CLIB=<inubit-installdir>\client\lib javac classpath %IS_CLIB%\ibis.jar;%IS_CLIB%\ibis_ tools.jar EJBClientDemo.java Starting java cp.;%is_clib%\ibis.jar;%is_clib%\ibis_ tools.jar;%is_clib%\ibis_jboss_provider.jar -Dsax.driver=org.apache.xerces.parsers.SAXParser com.inubit.ibis.demo.ejbclientdemo input.xml output.csv catalog-in inubit inubit 6.1: inubit Process Engine: Administrator and Developer Guide

276 276 Implementing Thin Clients Sample Implementations inubit 6.1: inubit Process Engine: Administrator and Developer Guide

277 20 Developing and Installing Plug-ins 277 This section details the following topics: Developing Plug-ins, p. 277 Adding Plug-ins to inubit Software, p. 284 Overview With Java based plug-ins you can extend the functionality of the inubit software. Thus, you can for example integrate enterprise applications with the inubit software for which there are not yet any system connectors provided. The number of plug-ins is not restricted. You must license all self-developed plug-ins and let them register before you can use them. Refer to Adding Plug-ins to inubit Software (inubit Process Engine: Administrator and Developer Guide, chap. 20.2, p. 284) Developing Plug-ins This section details the following topics: Installing the Plug-in SDK, p. 278 Server Plug-ins, p. 279 Java-based Client Plug-ins, p. 281 Generating Wizards for Client Plug-ins, p. 281 Utility Classes, p. 283 Overview There are two plug-in types that work together: Server plug-ins and Client plug-ins. You can assign exactly one Client plugin to every Server plug-in. Server plug-ins A server plug-in processes the input message of a process step and makes the processing results available as output message. It provides the technical implementation necessary for processing the input data into output data. Client plug-ins Client plus-ins are used in the inubit Workbench and provide a graphical user interface with dialogs in order to configure module instances and their parameters. The parameters stored in a inubit 6.1: inubit Process Engine: Administrator and Developer Guide

278 278 Developing and Installing Plug-ins Developing Plug-ins module control and configure the way in which the module processing during workflow execution is carried out by the Process Engine Installing the Plug-in SDK When installing the inubit software, select the die option Userdefined > Plug-in SDK. The plug-in SDK is copied into the directory <inubitinstalldir>/pluginsdk. For information about adding the plug-in SDK after the installation of the inubit software, refer to Post-installing Components of the inubit Software (inubit Process Engine: Administrator and Developer Guide, chap. 3.3, p. 57). The SDK is structured as follows: lib ibis.jar, ibis_tools.jar, and ibis_tools2.jar for compiling the plug-ins. src/com/inubit/ibis/plugins/examples/ ExampleConnector - example_connector.gif Sample graphic for the connector symbol. - ExampleConnector.java Client plug-in of the connector. - ExampleConnectorWizardPanel.java inubit 6.1: inubit Process Engine: Administrator and Developer Guide