IBM i2 Intelligence Analysis Platform Windows Deployment Guide

Transcription

1 IBM i2 Intelligence Analysis Platform Windows Deployment Guide Version 3 Release 0 SC

2 Note Before using this information and the product it supports, read the information in Notices on page 71. This edition applies to version 3, release 0, modification 11 of IBM i2 Intelligence Analysis Platform (product number 5725-G22) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2012, US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

3 Contents Chapter 1. About this guide Chapter 2. Contacting IBM support... 3 Chapter 3. Deployment planning Physical model Data model Intelligence Analysis Platform schemas Security model Dimensions and values Permissions and tags Intelligence Analysis Platform principal provider 9 Data acquisition Chapter 4. The IBM i2 Intelligence Analysis Platform deployment toolkit. 13 Deployment methods Deployment sequence Chapter 5. Preparing the environment 19 Software prerequisites Creating the configuration directory Chapter 6. Setting the default values 23 Chapter 7. Optional: Providing a JDBC driver Chapter 8. Specifying credentials Chapter 9. Creating an example deployment Chapter 10. Configuring the Intelligence Analysis Platform Configuring the environment Optional: Setting the HTTP Server properties.. 31 Optional: Setting the Intelligence Analysis Platform environment properties Specifying the deployment structure Configuring the applications Specifying a security schema Setting default permissions for items Specifying the platform schema and the charting scheme Setting global application properties Chapter 11. Optional: Clearing data from the system Chapter 12. Redeploying the Intelligence Analysis Platform Chapter 13. Migrating the Intelligence Analysis Platform Chapter 14. Setting up WebSphere Application Server Liberty profile security Chapter 15. Intelligence Analysis Platform clients Opening the Intelligence Portal Connecting Analyst's Notebook Premium to the Intelligence Analysis Platform Chapter 16. Monitor your deployment 51 Deployment toolkit validation Deployment monitoring Logged information Chapter 17. Backup strategy Core components Additional components Backing up your system while it is offline Appendix A. Security schemas Security schema definitions Security dimension definitions Security tag group definitions Security tag definitions Creating a security schema Appendix B. The topology Intelligence Analysis Platform data sources Databases Applications Appendix C. Indexing Creating a custom alternative term index Appendix D. Setting up a localized deployment Specifying the index language Enabling bi-directional text support Notices Trademarks Copyright IBM Corp. 2012, 2015 iii

4 iv Windows Deployment Guide

5 Chapter 1. About this guide This guide describes how to deploy the IBM i2 Intelligence Analysis Platform. The instructions use the Intelligence Analysis Platform deployment toolkit, which produces a set of deployment artifacts that make both the initial process and subsequent upgrades easier to manage. The instructions assume that you have access to one of the supported database management systems as well as an Intelligence Analysis Platform distribution. The following are the supported database management systems: v IBM DB2 Enterprise Server, Advanced Enterprise Server, Workgroup Server, or Advanced Workgroup Server editions at version 9.7 Fix Pack 10, 10.1, or 10.5 Fix Pack 5 v Microsoft SQL Server 2008 Service Pack 4, 2012, or 2014 v Oracle Database 11g Standard Edition Release 2 (Patch ) Attention: While IBM takes reasonable steps to verify the suitability of Intelligence Analysis Platform for Internet deployment, this guide covers aspects of a deployment only at the application level. It does not address lower-level issues such as guarding networks against penetration, firewall configurations to avoid DoS or DDoS attacks, load balancing and the like. In deploying Intelligence Analysis Platform, follow industry-standard practices and recommendations for protection of your systems. IBM accepts no liability for the consequences of such attacks on your systems. Intended audience This guide is intended for readers who are familiar with deploying web services into existing infrastructures that use an application server and one of the supported databases. Furthermore, the guide is aimed specifically at enabling deployments of the Intelligence Analysis Platform on servers that run Microsoft Windows. Copyright IBM Corp. 2012,

6 2 Windows Deployment Guide

7 Chapter 2. Contacting IBM support IBM Support provides assistance with product defects, answers FAQs, and helps users to resolve problems with the product. About this task After trying to find your answer or solution by using other self-help options such as technotes, you can contact IBM Support. Before contacting IBM Support, your company or organization must have an active IBM software subscription and support contract, and you must be authorized to submit problems to IBM. For information about the types of available support, see the Support portfolio topic in the Software Support Handbook. Procedure To contact IBM Support about a problem: 1. Define the problem, gather background information, and determine the severity of the problem. For more information, see the Getting IBM Support topic in the Software Support Handbook. 2. Gather diagnostic information. 3. Submit the problem to IBM Support in one of the following ways: a. Online through the IBM Support Portal at support. You can open, update, and view all of your service requests from the Service Request portlet on the Service Request page. b. By phone: For the phone number to call in your region, see the Directory of worldwide contacts web page at Results If the problem that you submit is for a software defect or for missing or inaccurate documentation, IBM Support creates an Authorized Program Analysis Report (APAR). The APAR describes the problem in detail. Whenever possible, IBM Support provides a workaround that you can implement until the APAR is resolved and a fix is delivered. IBM publishes resolved APARs on the IBM Support website daily, so that other users who experience the same problem can benefit from the same resolution. Copyright IBM Corp. 2012,

8 4 Windows Deployment Guide

9 Chapter 3. Deployment planning Physical model Planning a deployment of the Intelligence Analysis Platform ensures that the system matches the needs of your organization. By understanding the organizational requirements and tailoring the solution before you begin, you can avoid multiple deployment iterations. Before you start a deployment, take time to ensure that you understand the following aspects of the proposed system: v v v v The physical architecture into which the Intelligence Analysis Platform is to be deployed The structure of the data to be analyzed, both existing and planned The security infrastructure into which the Intelligence Analysis Platform must integrate The locations of any external data sources that need to be accessed A deployment of the Intelligence Analysis Platform consists of an application that is hosted on a server running IBM WebSphere Application Server Liberty profile. The application provides the functionality for clients to create, edit, delete, visualize, and analyze information. Users can interact with the platform by using the Intelligence Portal or IBM i2 Analyst's Notebook Premium. A deployment of the Intelligence Analysis Platform also contains a data store, called the Analysis Repository, that is hosted in a compatible database management system. The server that hosts the Intelligence Analysis Platform application must have an instance of IBM HTTP Server that acts as a proxy server for client requests. When you deploy the Intelligence Analysis Platform by following all the instructions in this guide, the physical architecture matches this diagram: Copyright IBM Corp. 2012,

10 Note: Before you begin deployment, you need to know the network address of the server that is intended to host the Intelligence Analysis Platform. This information is required on several occasions during the deployment procedure. Data model The Intelligence Analysis Platform models data in terms of entities, links, and properties (ELP). When you deploy the platform, you must decide how your information can be represented by entities, links, and properties of different types. ELP makes up the basic concept in the Intelligence Analysis Platform data model. Entities and links can be named collectively as items. v An entity represents a real-world object, such as a Person or a Car. v v A link associates two entities with each other. For example, a Person entity might be associated with a Car entity through an Owns link. A property stores a value that characterizes an entity or a link. For example, a Person entity might have properties that record its given name, surname, date of birth, and hair color. Starting from these basic concepts, the Intelligence Analysis Platform data model is designed to support rich analytical abilities. When you deploy the platform, you specify a schema that expresses your data in ELP terms. A well-designed schema allows users to request effective searches, view properly aligned results, and perform valuable results analysis. 6 Windows Deployment Guide

11 Intelligence Analysis Platform schemas The Intelligence Analysis Platform schema describes the items that users interact with when they use your deployment. The schema also defines the relationships that can exist between items of different types, and therefore the structure of the data in the Analysis Repository. Your deployment of the Intelligence Analysis Platform must have a schema that is appropriate for the information in your domain. The schema fulfills the following roles: v v v It describes the data that platform users interact with in terms of entity types, link types, property types, and property group types. It defines what types of links are allowed between entities of particular types, aiding analysis and data quality. It specifies what entities and links look like when they are visualized as results on charts. Note: The last role is the responsibility of a charting scheme. An Intelligence Analysis Platform schema defines the item types that you identify in your data. Every deployment requires a schema, and there are three ways to choose or create one. v v v The Intelligence Analysis Platform deployment toolkit includes example schemas that target particular domains: commercial insurance, law enforcement, and military intelligence. If one of the supplied schemas matches your requirements, you can use it without modification. Alternatively, one of the supplied schemas might contain some of the entity and link types that you need. If you can meet your requirements by expanding or modifying the existing types, then you can edit the schema to make it fit for purpose. If none of the supplied schemas is appropriate, then you can create your own schema that precisely matches the data in your organization. You can view, edit, and create Intelligence Analysis Platform schemas with Analysis Repository Schema Designer, which is a tool that IBM provides with the platform. Analysis Repository Schema Designer displays the structure of your schema, and ensures that the schema files that you create are compatible with the platform. Chapter 3. Deployment planning 7

12 Security model The IBM i2 Intelligence Analysis Platform security model enables the platform to determine the rights of individual users to manipulate the items that they are working with. When you deploy the platform, you provide a security schema that categorizes users, and defines how those categories affect their access to information. The Intelligence Analysis Platform security model bases its behavior on the interaction between security dimensions of users and the security permissions of items. Dimensions and values A security dimension is a way to distinguish different kinds of Intelligence Analysis Platform user, with the aim of determining what rights they receive. The security dimensions for any deployment of the platform are defined in the security schema for that deployment. For a particular deployment of the Intelligence Analysis Platform, there might be several different ways of distinguishing users, resulting in multiple dimensions. For example: v v Users might be distinguished according to their clearance to see items with different security classifications. Users might be distinguished according to their job titles. Each security dimension contains a set of values that classify the users within that dimension. To continue the example, the different dimensions might have values as follows: Dimension name Security classification Job title Dimension values Top Secret, Secret, Confidential, Restricted Clerk, Analyst, Manager In some dimensions (such as security classification), the values form a sequence from which each user takes a single value. In such cases, the values are considered to be levels, where each value encompasses all the values below it. In dimensions where the values do not form a sequence, users can take one or more values. Every user of an Intelligence Analysis Platform deployment must be assigned at least one value for each of the dimensions in that deployment. 8 Windows Deployment Guide

13 Permissions and tags Every item in the Intelligence Analysis Platform has a set of security permissions that associate the dimension values of a user with their ability to view or edit that item. There are two types of security permissions: v A security access permission affects whether a user with a particular dimension value can see an item at all; and if they can, whether they can also edit it. v A security grant permission affects whether a user can change the security permissions of an item. For example, the security permissions for an item might dictate that a user with a "Top Secret" dimension value can view it, but a user with a "Restricted" value cannot. Similarly, the permissions might specify that only users with the "Manager" value are able to change which other users can edit an item. There are two ways to set the security permissions for an item, depending on the requirements of the deployment: v v Specify each security permission separately for each item. In a deployment that uses this approach, the security schema defines only security dimensions, and users see the names and values of those dimensions in the Intelligence Portal. Use security tags as a way to specify several related security permissions at the same time. In a deployment that uses this approach, the security schema defines security dimensions and security tags, and users see the names of the tags in the Intelligence Portal. Because of these different approaches, every item in the Intelligence Analysis Platform has either two lists of permissions (access and grant), or one list of tags. The effect of "tagging" an item is to set the permissions for several kinds of user with a single action. Intelligence Analysis Platform principal provider In a deployment of the Intelligence Analysis Platform, the security schema defines the available security dimensions, and all the values that users can have in those dimensions. All deployments have a custom security schema that reflects their particular requirements. To complete the security model, the Intelligence Analysis Platform also needs a mechanism that can associate dimension values from the security schema with particular users. This task is the responsibility of a principal provider, which you specify during deployment. The Intelligence Analysis Platform deployment toolkit includes a principal provider that interacts with the user and group management function in WebSphere Application Server Liberty profile. The groups that users are in become the dimension values of those users. More information about dimension values can be found in Appendix A. Security Schemas. Chapter 3. Deployment planning 9

14 10 Windows Deployment Guide To use the supplied principal provider, the dimension values in your security schema must match the names of user groups in the application server. The deployment toolkit contains an example security schema that illustrates the approach, including some security tag definitions that use the dimension values. However, a real deployment always requires you to create your own security schema.

15 Data acquisition The Intelligence Analysis Platform is not limited to operating on data that users enter through the Intelligence Portal. The platform supports several mechanisms for interacting with data that comes from outside the system, some of which have implications for deployment. Depending on the type, the format, and the intended use of external data, the Intelligence Analysis Platform can acquire it in different ways. You can arrange for data to be imported directly, or you can configure the platform to connect to external systems and retrieve data when it is requested. Acquisition type Description Suitable data File import Use the Analyst's Notebook Premium importer or the Analyst's Notebook Premium chart item uploader to add smaller amounts of data from text files, spreadsheets, or charts to the Analysis Repository. A record of the telephone calls between two individuals that are being investigated. Data load direct Data access on-demand Use a custom application to add a larger amount of data to the Analysis Repository in a one-off operation. This method is appropriate for data that is not going to be updated in the original source. Use a custom Intelligence Analysis Platform service to connect directly to data that is still being updated regularly in its original source. Custom services can be deployed alongside a standard platform deployment. The records of a closed investigation. The records of an active investigation. Note: Data load ELP stage, which was supported in previous versions of the platform, is not supported in Intelligence Analysis Platform When a data acquisition solution requires a custom configuration of the Intelligence Analysis Platform, you can deploy it at the same time as the platform or modify an existing deployment. For more information about data acquisition solutions, see Intelligence Analysis Platform Developer Essentials on GitHub. Chapter 3. Deployment planning 11

16 12 Windows Deployment Guide

17 Chapter 4. The IBM i2 Intelligence Analysis Platform deployment toolkit The Intelligence Analysis Platform deployment toolkit contains scripts and components that you need to deploy and maintain the Intelligence Analysis Platform. Directories The deployment toolkit contains files in several directories. On most occasions, you need to interact with only two of the directories: Directory configuration scripts Contents The configuration directory contains files that you must update with information specific to your deployment. The scripts directory contains the setup script that you use to create, deploy, and upgrade the application. The configuration directory contains files that you must update with information specific to your deployment. When you have provided this information, you can use the setup script to administer your Intelligence Analysis Platform deployment. The setup script The setup script completes specific actions that are called tasks. For a list of available tasks and other information, on the Intelligence Analysis Platform server, open a command prompt and navigate to IAP-Deployment-Toolkit\scripts, then run one of the following commands: setup -h The -h argument displays the usage, common tasks, and examples of use for the setup script. setup -a The -a argument displays the same content as when you use -h, and a list of additional tasks. setup -dh The -dh argument displays the help information for data access on-demand. Copyright IBM Corp. 2012,

18 Deployment methods The Intelligence Analysis Platform setup script provides a number of methods to deploy the platform. This flexibility is included so that you can build up a configuration incrementally to match your production environment. To build up your environment, it is suggested that you create the example deployment first. The example deployment can demonstrate a running system, and verify that your prerequisites are set up correctly. The example deployment uses default configuration property values with an example security mechanism, schema, and charting scheme. The deployment configures the application server to use a basic user registry that contains a demonstration user account. The configuration is then modified to match a test system. At this stage, the Intelligence Analysis Platform can be redeployed after every change so that you can continually test the deployment. You can clear any data from the system, at any time, before you redeploy the platform to ensure that demonstration and test data remains in those systems. After you complete configuring your deployment, and you are satisfied with that the system matches your requirements, you can deploy the Intelligence Analysis Platform with the tested configuration in a production system. In a production system, after you deploy the system, you must configure the application server security for the users in your environment. The following flowchart shows the suggested workflow for deploying the Intelligence Analysis Platform for a production environment: 14 Windows Deployment Guide

19 Chapter 4. The IBM i2 Intelligence Analysis Platform deployment toolkit 15

20 Deployment sequence Complete the actions in the deployment sequence by using the Intelligence Analysis Platform deployment toolkit. By building up the deployment incrementally, you can tailor the Intelligence Analysis Platform to the individual requirements of your organization, before deploying into a production environment. Create an example Intelligence Analysis Platform deployment The following list is an outline of the steps that you follow to an example Intelligence Analysis Platform deployment, from preparing the environment to connecting the first user: 1. Prepare the environment. 2. Set the default values. 3. Optional: Provide the JDBC driver. 4. Provide the user names and passwords that the deployment process requires. 5. Create the example deployment. 6. Connect to the Intelligence Analysis Platform by using the Intelligence Portal and Analyst's Notebook Premium as a user, and test that the Intelligence Analysis Platform application can be accessed. An example deployment gives you confidence that your prerequisites are set up correctly, and provides an opportunity to demonstrate the Intelligence Portal without the need for further configuration. Configure the Intelligence Analysis Platform You can use the Intelligence Analysis Platform deployment toolkit from the example deployment as a starting point for creating a custom configuration. After you have an example deployment, customize the configuration files to match your requirements: 1. Configure the environment. 2. Create an Intelligence Analysis Platform security schema for your environment. 3. Set the default permissions for new items. 4. Select or create an Intelligence Analysis Platform schema and charting scheme for your data. 5. Set the Intelligence Analysis Platform application global properties. 6. Connect to the Intelligence Analysis Platform by using the Intelligence Portal and Analyst's Notebook Premium as a user, and test that the Intelligence Analysis Platform application can be accessed. At this stage, the Intelligence Analysis Platform can be redeployed after every change, so that you can test the deployment. If you want to make changes to the structure of your data, or the permissions that are used to access that data, you must clear the data and the search indexes before you redeploy. 16 Windows Deployment Guide

21 Migrate the Intelligence Analysis Platform When you have completed customizing the deployment, you can migrate the Intelligence Analysis Platform to a production system by completing the following sequence: 1. Prepare the environment. 2. Copy the deployment toolkit from the test system to the production system. 3. Change the host names and any other specific settings for the production environment. 4. Run the script to deploy the Intelligence Analysis Platform. 5. Configure the application server security for your environment. 6. Connect to the Intelligence Analysis Platform by using the Intelligence Portal and Analyst's Notebook Premium as a user, and test that the Intelligence Analysis Platform application can be accessed. Chapter 4. The IBM i2 Intelligence Analysis Platform deployment toolkit 17

22 18 Windows Deployment Guide

23 Chapter 5. Preparing the environment Software prerequisites Before you can deploy the Intelligence Analysis Platform, you must install the deployment toolkit and prerequisites. In addition, you must ensure that the Intelligence Analysis Platform deployment toolkit contains the correct directory structure. The IBM i2 Intelligence Analysis Platform has prerequisite software that you must install before you can deploy the platform itself. For the Intelligence Analysis Platform, the prerequisites are: v The Intelligence Analysis Platform distribution, installed according to the instructions in the IBM i2 Intelligence Analysis Platform Release Notes. v One of the supported database management systems: IBM DB2 Enterprise Server, Advanced Enterprise Server, Workgroup Server, or Advanced Workgroup Server editions at version 9.7 Fix Pack 10, 10.1, or 10.5 Fix Pack 5 Microsoft SQL Server 2008 Service Pack 4, 2012, or 2014 Oracle Database 11g Standard Edition Release 2 (Patch ) v The deployment toolkit automatically configures an IBM HTTP Server instance on the server where the Intelligence Analysis Platform application is deployed to act as a reverse proxy. To support this approach, you must install the following software: IBM HTTP Server Web server plug-ins for WebSphere Application Server Installing prerequisite software When you install the prerequisite software, you must do so according to the following specifications. IBM DB2 Enterprise Server, Advanced Enterprise Server, Workgroup Server, or Advanced Workgroup Server editions at version 9.7 Fix Pack 10, 10.1, or 10.5 Fix Pack 5 If you choose to use the DB2 database management system, DB2 you can use all of the default settings, except that it is not necessary to set up a response file. You can also turn off DB2 notifications. During setup, DB2 creates a Windows user account (db2admin), and two Windows groups (DB2ADMNS, DB2USERS). To work successfully with DB2, ensure that your Windows user account is a member of the DB2ADMNS Windows group. Copyright IBM Corp. 2012,

24 Microsoft SQL Server 2008 Service Pack 4, 2012, or 2014 If you choose to use the Microsoft SQL Server database management system, you can use all of the default settings, except that you must enable SQL Server Authentication. Oracle Database 11g Standard Edition Release 2 (Patch ) If you choose to use the Oracle database management system, you can use all of the default settings, except that you must set the character set to Unicode (AL32UT8). Oracle database creation is not currently handled by the deployment scripts, so you must create the database manually, and the database must be configured to use a unique user. To work with the example values given in this guide, you must create the database on the server that hosts the Intelligence Analysis Platform application, and it must be of type WriteStore. Note: Regardless of the database management system, the user that you use to run the deployment scripts must have permission to create and modify the database. HTTP server and reverse proxy An Intelligence Analysis Platform deployment requires a reverse proxy server that routes client requests to the appropriate destination. For IBM HTTP Server, you must change the installation location from the default setting to shorten the path length and avoid spaces, for example C:\IBM\HTTPServer. All the other options can use the default settings. Finally, in addition to installing the prerequisite software, you must ensure that Microsoft Internet Information Server is either inactive or not present on the Intelligence Analysis Platform server. Creating the configuration directory 20 Windows Deployment Guide All Intelligence Analysis Platform deployments rely on settings from files in the deployment toolkit's configuration directory. Create the configuration directory that the deployment toolkit script uses to deploy the Intelligence Analysis Platform. About this task The deployment toolkit script uses information in the IAP-Deployment-Toolkit\ configuration directory. However, the configuration directory does not exist in the toolkit by default so that when you install a new version of the Intelligence Analysis Platform, your configuration is not overwritten. Instead, a new installation of the deployment toolkit contains a directory with the name configuration-example. The configuration-example directory contains further directories that store settings files for each server type, and a common directory that stores files that are used across the system. You must make a copy of configuration-example to use as the working configuration directory. Procedure 1. Navigate to the IAP-Deployment-Toolkit directory.

25 2. Make a copy of the configuration-example directory in the same location, and name it configuration. Results The configuration directory is your working area for the rest of the deployment procedure. The configuration directory can be transferred to other Intelligence Analysis Platform , or later, deployment toolkits. As the configurationexample directory remains as a store for clean configuration files that you can revert to, do not modify files in the configuration-example directory. Chapter 5. Preparing the environment 21

26 22 Windows Deployment Guide

27 Chapter 6. Setting the default values The Intelligence Analysis Platform deployment toolkit can set many of the required environment properties to default values. The configuration is then prepared for an example deployment. Before you begin You must have prepared your environment according to the instructions in Chapter 5, Preparing the environment, on page 19. About this task Use the setup script to set default values in the properties files that are listed. The default installation directories that are used by IBM Installation Manager match the values that are set by the script. If a prerequisite is not installed in the default directory, you must manually set the value of the corresponding property. The script also sets the directory to install WebSphere Application Server Liberty profile and IBM Java SDK. The script interacts with the following files: v configuration\environment\http-server.properties v configuration\environment\iap\environment.properties v configuration\environment\topology.xml v db2jcc4.jar Procedure 1. If your database management system is not DB2, copy the version of topology.xml that is specific to the database management system you are using from the examples directory into IAP-Deployment-Toolkit\configuration\ environment. The topology files are in the following location: IAP-Deployment-Toolkit\configuration\examples\topology\database management system type\topology.xml. If you are using Oracle, you must populate the instance-name attribute. 2. On the Intelligence Analysis Platform server, open a command prompt and navigate to IAP-Deployment-Toolkit\scripts. 3. To set the default values, run the following command: setup -t generatedefaults 4. Check the default values in each file to ensure that they match your environment, and modify if required. What to do next Before you deploy the Intelligence Analysis Platform, you must complete the instructions in Chapter 8, Specifying credentials, on page 27. Copyright IBM Corp. 2012,

28 24 Windows Deployment Guide

29 Chapter 7. Optional: Providing a JDBC driver The application server requires a JDBC driver to enable communication with the database. If you provide the driver to the deployment toolkit, the toolkit can deploy it to the correct location on the Intelligence Analysis Platform server. About this task Depending on the type of database management system that you have installed, the steps for providing a JDBC driver differ. Select the steps that relate to the database management system that you have installed. Procedure 1. Locate the JDBC driver for your database management system. v If you are using DB2, locate the IBM\SQLLIB\java\db2jcc4.jar file. v If you are using SQL Server, download the jtds dist.zip file from and extract the contents. v If you are using Oracle, locate the Product\11.2.0\dbhome_1\jdbc\lib\ ojdbc6.jar file. 2. Copy the relevant driver file for your database management system to the IAP-Deployment-Toolkit\configuration\environment\common\jdbc-drivers directory. Copyright IBM Corp. 2012,

30 26 Windows Deployment Guide

31 Chapter 8. Specifying credentials The database in a deployment of the Intelligence Analysis Platform secures content with a user name and password. The script that interacts with these components use credentials that are stored in the credentials.properties file. Before you begin There are two ways to approach the credentials.properties file. You can modify the example file in the deployment toolkit, or you can use the setup script to generate a skeleton file. If you use the script, you must complete your changes to topology.xml before you generate the credentials.properties file. About this task For each database that is identified in topology.xml, you must specify a user name and a password in the credentials.properties file. The setup script uses this file when it interacts with the components of the Intelligence Analysis Platform. When the platform is deployed and operating normally, you can delete credentials.properties. Important: It is seldom appropriate to retain a permanent, unencrypted record of user names and passwords. The credentials.properties file stores credentials in the following format: db.component.user-name=user name db.component.password=password The name of each credential has three parts: Part component user-name or password Description The database identifier Indicates whether the value is a user name or a password For example: db.write1.user-name=admin db.write1.password=password Procedure The deployment toolkit includes an example credentials.properties file that contains blank placeholders for a deployment of the Intelligence Analysis Platform. 1. Optional: If you want to add blank placeholders to the example credentials.properties file through the script, rather than edit it: a. Open a command prompt, and navigate to IAP-Deployment-Toolkit\ scripts. b. Run the following command to create a skeleton credentials file: setup -t generatecredentialsfile Copyright IBM Corp. 2012,

32 The command adds any placeholders to the credentials.properties file in the example. The names of the credentials that the file contains are derived directly from topology.xml. 2. Using a text editor, open the IAP-Deployment-Toolkit\configuration\ environment\credentials.properties file. 3. Enter the user names and passwords to use with each component. Note: If you are using SQL Server, the specified database user name must have SQL Server Authentication as the authentication method. 4. Save and close the credentials.properties file. Results The credentials.properties file is now ready for use by the script. After you deploy the Intelligence Analysis Platform, you can safely delete the file to prevent storing unencrypted user name and passwords. 28 Windows Deployment Guide

33 Chapter 9. Creating an example deployment Create an example deployment of the Intelligence Analysis Platform. An example demonstrates a working Intelligence Analysis Platform deployment that a user can log in to and create, edit, delete, visualize, and analyze information. Before you begin v You must have prepared your environment according to the instructions in Chapter 5, Preparing the environment, on page 19. v You must have configured your environment according to the instructions in Chapter 6, Setting the default values, on page 23. v You must have a valid credentials.properties file according to the instructions in Chapter 8, Specifying credentials, on page 27. About this task The example deployment results in an Intelligence Analysis Platform running with the example security schema and matching WebSphere Application Server Liberty profile security groups and users. You can use an example deployment to log in to the Intelligence Analysis Platform through the Intelligence Portal as the example user. The example user has the following credentials: v The user name is Jenny v The password is Jenny The example deployment uses the law-enforcement-schema.xml schema as the platform schema with the associated law-enforcement-schema-chartingschemes.xml. For more information on the Intelligence Analysis Platform schema, see Specifying the platform schema and the charting scheme on page 36. Procedure 1. On the Intelligence Analysis Platform server, open a command prompt and navigate to IAP-Deployment-Toolkit\scripts. 2. To deploy the example, run the following command: setup -t deployexample 3. To start the WebSphere Application Server Liberty profile server, run the following command: setup -t startliberty 4. Start, or restart, the IBM HTTP Server that hosts the reverse proxy. Results The Intelligence Analysis Platform example deployment is complete. To log in to the Intelligence Analysis Platform through the Intelligence Portal with the example user, follow the instructions in Opening the Intelligence Portal on page 49. What to do next Configure the example deployment to match your organizational needs. At a minimum, complete the following steps: v Create an Intelligence Analysis Platform security schema for your environment. Copyright IBM Corp. 2012,

34 v Set the default permissions for new items. v Select or create an Intelligence Analysis Platform schema and charting scheme for your data. v Configure the Intelligence Analysis Platform application to use your deployment artifacts. v Clear any test data from the system. v Redeploy the Intelligence Analysis Platform. v Configure the application server security for your environment. A deployment can be further configured in many ways, including the following: v Use a different database management system. v Configure the prerequisites in different ways. v Change the deployment language. v Configure single sign-on. 30 Windows Deployment Guide

35 Chapter 10. Configuring the Intelligence Analysis Platform Configuring the environment Configure the Intelligence Analysis Platform for your test and production systems. Complete any configuration changes there are from the example deployment to the test or production systems. The Intelligence Analysis Platform deployment toolkit automates many of the tasks that are typically involved in installing and configuring web applications. To perform these tasks, the toolkit requires information about the environment into which you are deploying the Intelligence Analysis Platform and settings for the Analysis Repository. About this task The following sections describe how to modify the configuration of a deployment. Change any settings that differ between the example deployment, and your test or production environment. Optional: Setting the HTTP Server properties The script in the deployment toolkit that deploys the Intelligence Analysis Platform require information about your HTTP Server. The values that describe your HTTP Server must be present in the http-server.properties file in the configuration\environment directory. About this task You can change any property values in http-server.properties from the default values. The values are configured by using the instructions in Chapter 6, Setting the default values, on page 23 and can then be edited as required. Note: Ensure that all file paths use forward slashes (/). Procedure 1. Using a text editor, open the http-server.properties file. You can find this file in the following location: IAP-Deployment-Toolkit\configuration\environment. 2. Using the descriptions in the file, ensure that the property values for the HTTP Server in your environment are correct. 3. Save and close the file. Optional: Setting the Intelligence Analysis Platform environment properties The script in the deployment toolkit that deploys the Intelligence Analysis Platform requires information about your application server, your database, and some other system components. The values that describe your environment must be present in the environment.properties file in the configuration\environment\iap directory. Copyright IBM Corp. 2012,

36 About this task You can change any property values in environment.properties from the default values. The settings are configured according to the instructions in Chapter 6, Setting the default values, on page 23 and can then be edited as required. Note: Ensure that all file paths use forward slashes (/). Procedure 1. Using a text editor, open the environment.properties file. You can find this file in the following location: IAP-Deployment-Toolkit\configuration\environment\ iap. 2. Using the descriptions in the file, ensure that the property values for the application server, the data directory, and the web help, are correct. Note: The deployment script uses these properties for setting up the environment and creating the Intelligence Analysis Platform application. As such, the values of these properties can overwrite values that are stored in other files. Treat the environment.properties file as the source of truth about your deployment. 3. Save and close the file. Specifying the deployment structure In the deployment toolkit, the topology.xml file contains information about the physical architecture of the Intelligence Analysis Platform. The topology.xml file contains the information that the setup script requires to identify the prerequisites that are being used, where the system stores information, and the fragments to combine to create the application. About this task When you deploy the Intelligence Analysis Platform, you must identify the host name of your server, and the location to store search index information. The values for the host name and search index location can be configured according to the instructions in Chapter 6, Setting the default values, on page 23 or manually by using the following information. Note: The topology.xml file can be extended to include extra data sources and custom applications. More information on the topology can be found in Appendix B. The topology. Procedure 1. If your database management system is not DB2, copy the version of topology.xml that is specific to the database management system you are using from the examples directory into IAP-Deployment-Toolkit\configuration\ environment. The topology files are in the following location: IAP-Deployment-Toolkit\configuration\examples\topology\database management system type\topology.xml. 2. Using an XML editor, open IAP-Deployment-Toolkit\configuration\ environment\topology.xml. 3. Populate the host-name attributes of the following elements: 32 Windows Deployment Guide

37 Element database application Attribute values Specify the host name of the server that is being used to store the WriteStore database. By default, the value is the name of the local host. Note: The instance name should also be updated to match your deployment. Specify the host name of the server for the Intelligence Analysis Platform. By default, the value is the name of the local host. For example:... <databases> <database dialect="db2" xa="true" instance-name="db2" database-name="writesto" database-type="writestore" id="write1" host-name="host" port-number="50000" max-pool-size="5" /> </databases> <applications> <application name="iap" host-name="host" http-server-host="true">... Note: If you set the http-server-host attribute of the <application> element to false, the Intelligence Analysis Platform deployment toolkit does not configure the HTTP Server with the Intelligence Analysis Platform configuration. 4. In the <lucene-index> element, set the full paths to the locations where the Intelligence Analysis Platform stores the main search index and the alternative terms. By default, the values are:... <lucene-indexes> <lucene-index id="ar" main-index-location="c:\ibm\iap\data\ar\main_index" alternatives-location="c:\ibm\iap\data\ar\alternatives" /> </lucene-indexes> Save your changes and close topology.xml. Results Your topology file is now ready to deploy the Intelligence Analysis Platform with an English locale that uses the default alternative term index. What to do next Depending on your requirements, you can continue with your deployment with the specified structure. Alternatively you can customize your topology in one of the following ways: v v To change the locale of your index, see Specifying the index language on page 69 To change the default terms in the index, see Creating a custom alternative term index on page 67 Chapter 10. Configuring the Intelligence Analysis Platform 33

38 Configuring the applications In a test or production deployment, before you deploy the Intelligence Analysis Platform, you must specify the security mechanism. A schema and charting scheme can be specified before the deployment, or created after by using Analysis Repository Schema Designer. About this task The deployment toolkit stores information for and about the instance of the Intelligence Analysis Platform that you are deploying in the IAP-Deployment- Toolkit\configuration\fragments directory. This location contains further directories that hold application configuration information, and a common directory that stores files that are used across the system. Specifying a security schema The security mechanism that IBM supplies with the deployment toolkit can associate application server users with their ability to view and edit items in the Intelligence Analysis Platform. To define the details of this association, you must create and deploy a security schema. About this task An Intelligence Analysis Platform security schema defines the security dimensions that exist in a deployment, and the dimension values that can be assigned to users. Optionally, a security schema also defines security tags that can be assigned to items in the Intelligence Analysis Platform. When you deploy the Intelligence Analysis Platform with the supplied security mechanism, the dimension values in the security schema map directly to user groups that are defined in the application server. Note: The IBM i2 Intelligence Analysis Platform Security White Paper contains more information about the security model. For convenience, an excerpt from that document is included as Appendix A: Security schemas. Note: For more information about creating a security schema, see Creating a security schema on page 59. Procedure 1. Navigate to the directory that contains the example security schema: IAP-Deployment-Toolkit\configuration\examples\security-schema. 2. Using an XML editor, open example-security-schema.xml. 3. Edit the example security schema so that it matches your security model, and so that the names of the dimension values it contains match the names of WebSphere Application Server Liberty profile user groups. Note: The Level attribute of the <AccessPermission> element must be in uppercase. The following are the allowed values: v NONE v READ_CLOAKED v READ_ONLY 34 Windows Deployment Guide

39 v UPDATE 4. Save the file to the deployment toolkit in the WEB-INF\classes directory of the common application fragment: IAP-Deployment-Toolkit\configuration\ fragments\common\web-inf\classes. Setting default permissions for items When a user (or the system) creates an item in the Analysis Repository, the Intelligence Analysis Platform applies a default set of permissions. During deployment, you can specify what the default permissions are. About this task The platform stores default permissions in the ApolloClientSettings.xml file that is in the "core" fragment: IAP-Deployment-Toolkit\configuration\fragments\core Depending on whether users of your deployment interact with security tags or security permissions, you need only to specify defaults for that approach: v v The settings for generating default security tags are stored in the <DefaultItemSecurityTags> element. The settings for generating default permissions are stored in the <DefaultAccessPermissions> and <DefaultGrantPermissions> elements. Note: The example ApolloClientSettings.xml file specifies the security tag approach. Procedure 1. Use an XML editor to open the ApolloClientSettings.xml file. 2. In the Access Control section, choose which security model to use by setting the contents of the <SecurityModel> element: Option SecurityTags SecurityPermissions Description Set up the system so that users configure item security through security tags by default. Set up the system so that users configure item security through security permissions by default. 3. Update the "default" elements with the identifiers of security tags or security dimensions from your security schema. For example: <!-- Security tags set on an item by default. Format: [Security tag ID 1];[Security tag ID 2];[Security tag ID n] --> <DefaultItemSecurityTags> 6f0a69d4-6edd-40ec-a372-c6db33262a58;d3cdf9a e3-8ffd c9a66 </DefaultItemSecurityTags> Or: <!-- Access permissions set on an item by default. Format: [DimensionId];[Value];[AccessLevel] --> <DefaultAccessPermissions> 03dee165-c232-47d7-a c011bc3e4;Unclassified;Update f873ad a-9a6f-fc2ad36314ed;human Informants;Update f873ad a-9a6f-fc2ad36314ed;open Source Intelligence;Update </DefaultAccessPermissions> <!-- Grant permissions set on an item by default. Format: [DimensionId];[Value];[AccessLevel] --> Chapter 10. Configuring the Intelligence Analysis Platform 35