Hyperion Shared Services TM. Readme. Release Service Pack 1 ( )

Transcription

1 Hyperion Shared Services TM Release Service Pack 1 ( ) Readme [Skip Navigation Links] About This Service Pack...2 What is in the Service Pack?... 2 New Features...2 Enhancement to Infrastructure Support...2 Performance Fixes...2 Functional Bug Fixes...3 Supported Platforms... 3 Supported Languages... 3 Defects Fixed... 3 Shared Services Shared Services Utilities...4 Workspace... 5 Essbase... 5 Essbase Server...5 Essbase Administration Services...5 Planning... 6 Financial Management... 6 Business Rules All System 9 Products (including Shared Services)... 6 Hyperion Configuration Utility... 7 Known Issues Installing Release Service Pack Contents of this Service Pack... 7 Summary of Installation Steps... 8 Procedures for All System 9 Product Host Machines... 9 Procedures for Shared Services... 9 Procedures for System 9 J2EE Web Applications Other than Shared Services Procedures for Essbase Adding interop-sdk.jar to the Server...14 Optional: Implementing Custom Authentication Module Updating Environment Variable...14

2 Procedures for Financial Management Updating Environment Variable...15 Optional: Adding Custom Authentication Module to Classpath...15 Procedures for Workspace Core Service Preparing System 9 J2EE Web Application Archives for Deployment Regenerating the SSO Encryption Key (Optional) About This Service Pack This Readme file describes the defects fixed in Hyperion Shared Services TM Service Pack 1 as well as the necessary requirements and instructions for applying it. Caution: Failure to carefully read and understand the service pack requirements may result in applying a fix that can cause your application to malfunction, including interruption of service and/or loss of data. Release Service Pack 1 is cumulative and contains fixes made available through Service Fix Release through Release This service pack can be applied to any release base release installation or to any xx installation. What is in the Service Pack? New Features The following new features are included in this service pack. Support for custom authentication module. For details, see the Custom Authentication Information document (Custom_authentication_instructions.pdf) included in this archive. Mechanism to periodically change the encryption key to better secure System 9 products. See Regenerating the SSO Encryption Key for information. Restricted access in User Management Console Enhancement to Infrastructure Support High availability support for Shared Services Web application and OpenLDAP using Oracle Clusterware. See Oracle Enterprise Performance Management / Business Intelligence White papers web site for a whitepaper that discusses how to implement Oracle Clusterware support for Shared Services. Performance Fixes Performance improvements made in this service pack include the following: Improved performance while listing users and groups in Workspace, Planning, and Business Rules Improved System 9 login performance Improved provisioning performance in User Management Console Faster startup of System 9 products Improved performance while using the Import/Export Utility

3 Functional Bug Fixes Some of the important bug fixes in this service pack include following: Essbase Security refresh bug fixes Fixes to Projects listing in the User Management Console to correct intermittent disappearance of projects Fixes to application status listing in the User Management Console to correct intermittent mislabeling of application status Fixes to reduce the number of calls made by System 9 products to LDAP/MSAD servers Fixes to correct Financial Management taskflow issues Fixes to correct issues in the UpdateNativeDir Utility Supported Platforms This service pack can be applied to all supported platforms for release See the Installation Start Here, for a list of supported platforms. Supported Languages This release supports English only. Defects Fixed Release Service Pack 1 includes the following defect fixes. Shared Services Top of Document User Management Console issues. The User Management Console experienced intermittent issues with displaying the list of projects. Some projects were not shown in the project list after a period of time. There were also delays in displaying the list of projects Erroneous display of application state. The User Management Console displayed application state as unintegrated after Shared Services is restarted Search while master OpenLDAP is inactive. When the master OpenLDAP is not active, native users, groups, and roles can be searched only once External user directory configuration with custom object classes. Configuration of external user directories in User Management Console fails if custom object classes are defined in the external providers Deprovisioning issues if Shared Services is deployed on Oracle Application Server. Deprovisioning of users and groups fails when Shared Services is deployed on Oracle Application Server Search for users with numeric characters in user names. Show all search for user names containing 11 (or more) numeric characters failed in Shared Services. The UI listed only one user.

4 Provisioning performance issues. Listing the projects and applications while provisioning users or groups using the User Management Console took longer when the number of registered applications was greater than Additional user directory requests. Additional requests to LDAP and Active Directory user directories were made with filter (uid=doesnotexist) during user login and search Slow startup. Shared Services made several calls to external user directories (LDAP or MSAD) to build group and user cache, causing slow startup performance Custom authentication module. Support for custom authentication module that allows customers to override the default Shared Services authentication mechanism with their own implementation of authentication was not available Custom Authentication Module. By default, in Release , Native Directory was not enabled to use the custom authentication module and external user directories were configured to use it. It was not possible to change the default behavior by editing the CSS.xml Application creation and registration. Unable to create and register an application with Shared Services using a Native Directory user account that was deleted and then re-created , , and Unauthorized access to Shared Services. Users from configured user directories who were not provisioned to System 9 applications could log into the User Management Console and view a list of all users, groups and roles in the system and Regenerating encryption key. Users could not change the single signon token encryption key in different environments (for example, Dev and Prod) ACL of OpenLDAP was too long. Native directory users could connect to OpenLDAP and view a list of users and groups using an LDAP browser System 9 products were not able to route connections to available domain controllers in load-balanced deployments. Because JVM cached IP address of the domain controller that was in use, System 9 products were not able to establish connections with a different domain controller in load-balanced deployments Execution of the CreateFKIndex.sql returned an error. Because CreateFKIndex.sql attempted to create an existing index, the error such column list already indexed was thrown Shared Services failed to start. Shared Services failed to start if the target application for a taskflow was not available Shared Services and OpenLDAP high availability. High availability and fail-over support was not available for Shared Services Web application and OpenLDAP Change Native Directory Password screen displayed HTTP error 500. In deployments where Shared Services was deployed on WebSphere application server, HTTP error 500 was thrown when users accessed the Change Native Directory Password screen. Shared Services Utilities If a configured external user directory was not reachable, the UpdateNativeDirectory Utility deleted Native Directory data, including provisioning data, pertaining to users and groups from the unreachable user directory. This was the default (and documented) behavior of the UpdateNativeDirectory utility in previous releases. The utility has been updated to throw communication exception if a configured external user directory is not reachable.

5 Import/Export Utility: Performance. The process for exporting data from a remote server takes much more time than the process for exporting data from the Shared Services server machine Import/Export Utility: CSV file. The import process for users and groups using a Comma Separated Value (CSV) file failed if the internal_id element was not specified in the CSV file Import/Export Utility: Import operation fails. The process of importing users and groups as members into a Native Directory group failed if any of the user or group member being imported is invalid. Other import operations were not affected. Workspace Workspace login. Login to Workspace fails when configured for Oracle DB user in TrustedPass mode Workspace login. User login to Workspace takes a longer time (greater than 15 seconds) when there are more than 10 applications registered with Shared Services Performance issues. The listing of groups that have more than 500 native groups is taking approximately 5 minutes in Reporting and Analysis Access Control List screen Login with $TRUSTEDPASS$. Database users could not log in to Workspace if $TRUSTEDPASS$ was set Performance degradation with large number of users. When a large number of users were provisioned, performance degradation was observed in the following: o o getusers() BI+ SDK API listing users in Reporting and Analysis Access Control List screen Essbase Essbase Server Essbase user retrieval. When two or more providers of the same type (for example, MSAD) are configured in the search order (for example, MSAD1 and MSAD2) and users from both of them are included in a Native Group that is provisioned to Essbase, only users from the last provider (for example, MSAD2) are returned to Essbase Essbase Server failed to respond. While authenticating Essbase users by connecting to load-balanced external LDAP user directories configured in Shared Services, Essbase Server became unresponsive Essbase synchronization process was slow. The process of synchronizing Essbase security with Shared Services security took a long time. Essbase Administration Services Shared Services not responding. Shared Services hangs when creating more than one application in Essbase Administrative Services Console Registration process. Registration of Oracle s Essbase Administration Services with Shared Services using IBM DB2 database fails. SharedServices_Admin.log logs the message [Hyperion][DB2 JDBC Driver][DB2]CURSOR Cxx NOT IN PREPARED STATE when Shared Services is using IBM DB2 database Deployment failed. Planning and Essbase Administration Services deployment failed.

6 Missing file name. The readme procedure to deploy the service fix to Essbase Administration Services was missing a required file name. Planning Performance issues. Slow performance while listing users and groups to set access privileges on Planning artifacts Performance degradation in multi-application environment. In environments where a large number of applications were present, performance degradation was observed while listing users and groups on the ACL screens in Planning and Business Rules Inactive Planning applications. After about 30 minutes, Planning applications in User Management Console were listed as inactive. Financial Management Shared Services refused connections. Shared Services refused connections after Hyperion Financial Management reports were run 10 times Registered app is not active error. Active Financial Management application was, sometimes, listed as inactive Taskflow Scheduler fails to start. Shared Services Taskflow Scheduler was not started when Shared Services server started up Taskflow scheduler run issue. A taskflow scheduled to run for a finite number of times (by setting repeat count) continued to run beyond the set number of iterations Missing taskflows. Task flows were missing when case of the Base DN or the Base DN itself was changed Taskflow error. Access Control button in Taskflow (Manage Taskflow UI) caused a browser error in French locale New taskflows were not available in Taskflow Listing Summary screen. Starting Shared Services creates a temporary file (TempCESProxy<number>.tmp). If this file was deleted, new taskflows were not listed in the Taskflow Listing Summary screen even though the taskflows were stored in the Shared Services repository In SSL-enabled environments, users could not connect to taskflows managed by Enterprise Performance Management Architect (EPMA). HTTP error 500 was thrown when users attempted to connect to EPMA-managed taskflows in an SSL-enabled environment Could not access Manage Taskflows screen. A blank screen was displayed when accessing Manage Task Flows screen. Business Rules Performance issues: If a large number of applications were present, system performance deteriorated when listing users and groups in the ACL screen of Oracle s Hyperion Business Rules. All System 9 Products (including Shared Services) Login process was slow. The login process for an external user was slow if the user was a member of a Native Directory group that has multiple nested parent groups.

7 Database connection was not closed properly. Database connection was not closed properly when a Relational Database was used as external user directory. Hyperion Configuration Utility Automated deployment failed. In UNIX environments only, automated deployment of Shared Services to application server failed to properly configure the Domain.xml file. Manual deployment issue. Manual deployment of System 9 products to WebLogic and WebSphere application servers on Windows and UNIX did not work as designed. Known Issues The following are the known issues of this release: Top of Document Search for provisioned users. If Oracle Internet Directory (OID) is used as an external user directory, search for provisioned users returns all users from OID. Workaround: This is an OID bug (bug# ) that has been fixed in OID version Upgrade OID to version to fix this issue. Bulk provisioning performance. Slight performance degradation is observed while using the Import/Export Utility to bulk provision users and groups. Installing Release Service Pack 1 The section includes important information about installing this service pack. Contents of this Service Pack The service pack contains these files: css-9_3_1.jar interop.war hubconfig.jar interop-sdk.jar csslocal.schema CreateFKIndex.sql SharedServicesHandler.zip SharedServicesHandler.tar UpdateNativeDir.zip UpdateNativeDir.tar cssimportexport.zip cssimportexport.tar Custom_Authentication_Javadocs.zip Custom_authentication_instructions.html This readme file Top of Document

8 Extract the contents of this service pack archive into a temporary directory. If you are implementing a custom authentication module, before installing this service pack, read the Custom Authentication Information document (Custom_authentication_instructions.pdf) included in this archive for important information about custom authentication module. Note: Some procedures in this document use the jar command to create enterprise and web archives. You must have JDK in your system classpath to effectively use the jar command. Summary of Installation Steps This section provides an overview of the tasks you must complete to deploy this service pack. To install this service pack perform steps appropriate for your deployment. You must perform step 1 and 2, and a combination of the remaining steps: 1. Replace the existing css-9_3_1.jar on each machine that hosts a System 9 product. See Procedures for All System 9 Product Host Machines. 2. Apply service pack to Shared Services deployment. See Procedures for Shared Services. a. Update Shared Services repository and OpenLDAP schema. b. Create a backup copy of CMS.properties file and CSS.xml file. c. If you are implementing a custom authentication module, prepare interop.war for redeployment. d. Deploy interop.war. e. Restore CMS.properties file and CSS.xml file from backup copies. f. Modify CMS.properties to set the upgrade flag. g. (Optional) Modify CSS.xml and specify settings for the custom authentication module. h. (Optional): If you experience the symptoms described by bug# , remove existing entries, other than system, from the CES_USERS table in the Shared Services database. 3. Apply service pack to each System 9 J2EE Web application, other than Shared Services, in your deployment. See Procedures for System 9 J2EE Web Applications Other than Shared Services. a. Prepare the Web application archives for redeployment. This step includes the optional step of adding a custom authentication module to your product s Web Archive. b. Redeploy the Web application archive. c. Update Java system property in System 9 product startup scripts. 4. Apply service pack to Essbase deployment. See Procedures for Essbase. a. Add interop-sdk.jar to the Essbase server host. b. (Optional): Implement a custom authentication module. c. Update Java system property used by Essbase server.

9 5. Apply service pack to Financial Management deployment. See Procedures for Financial Management. a. Update Financial Management environment variable. b. (Optional): Implement a custom authentication module. 6. Apply service pack to BI Plus Core Services deployment. See Procedures for Workspace Core Services. Procedures for All System 9 Product Host Machines You must add the css-9_3_1.jar contained in this service pack to a common location on each machine that hosts a System 9 product. To add the css-9_3_1.jar to a common location: 1. Stop all System 9 products and processes. 2. On each System 9 product host machine, replace HYPERION_HOME/common/CSS/9.3.1/lib/css- 9_3_1.jar with the css-9_3_1.jar file provided with this service pack. 3. (Optional): If you are implementing a custom authentication module, copy the Java archive of the custom authentication module into HYPERION_HOME/common/CSS/9.3.1/lib. Procedures for Shared Services Important Information if you experienced the symptoms reported in bug# : Before applying this service pack, assign workflow ownership to Shared Services administrator (admin) if Shared Services reassigned the ownership of taskflows to users such as user@msad1, user@msad12, and user@msad123 from their actual owner (user@msad) because of bug # If you do not reassign ownership of such workflows to admin, you will not be able to retrieve them after applying this service fix. To assign roles to users from the Access Control screen, click the Access Control button on the Manage Taskflow screen. To apply this service pack, follow these steps. 1. Shut down Shared Services and Native Directory. 2. Update Shared Service repository. You may need to seek DBA assistance to complete this step. Note: This step creates a database index. If you created this database index while applying a service fix, an error message that states that the index already exists is thrown. You can ignore this error. a. Connect to the Shared Service database using the database user credentials specified while configuring Shared Services. b. Execute CreateFKIndex.sql. Validate that the indexes were created. 3. Update OpenLDAP schema. a. Verify that OpenLDAP is not running. b. From the directory where the contents of this service pack were extracted, copy csslocal.schema into HYPERION_HOME/SharedServices/9.3.1/openLDAP/etc/schema directory (Windows) or HYPERION_HOME/SharedServices/9.3.1/openLDAP/usr/local/etc/openldap/schema

10 directory (UNIX). Add indexes for these attributes in OpenLDAP using Windows or UNIX instructions. cssisactive uniquemember cssprovisionedidentity cssprovisionedapp cssprovisionedrole Windows Instructions a. Make a backup copy of HYPERION_HOME/SharedServices/9.3.1/openLDAP/var/openldapdata directory. b. Open HYPERION_HOME/SharedServices/9.3.1/openLDAP/slapd.conf file. c. In the indices section append entries for cssisactive, uniquemember, cssprovisionedidentity, cssprovisionedapp, and cssprovisionedrole attributes. After the changes, the indices section would look as below: # Indices to maintain index objectclass eq index cn,ou,cssidentity,member,cssroledn,cssproductcode,cssversion eq index cssdisplaynamedefault eq,sub index cssmanagedby,cssusermember,cssgroupmember eq,sub index cssisactive,uniquemember,cssprovisionedidentity,cssprovisionedapp,cssprovision edrole eq d. Save and close the slapd.conf file. e. Rebuild indices. Note: Verify that OpenLDAP and Shared Services are shutdown. i. Create indexingldap.bat file by copying HYPERION_HOME/SharedServices/9.3.1/openLDAP/configureHubLDAP.bat. ii. Edit indexingldap.bat. Remove the statement that references the slapadd command. iii. Save and close indexingldap.bat. iv. Execute indexingldap.bat to rebuild the indices. v. Verify that indexing is completed successfully. If indexing is successful, the following files are created in openldap/var/openldap-data directory: cssisactive.bdb uniquemember.bdb UNIX Instructions a. Make a backup copy of HYPERION_HOME/SharedServices/9.3.1/openLDAP/usr/local/var/openldap-data directory.

11 b. Open HYPERION_HOME/SharedServices/9.3.1/openLDAP/usr/local/etc/openldap/slapd.conf file. c. In the Indices section append cssisactive, uniquemember, cssprovisionedidentity, cssprovisionedapp, and cssprovisionedrole attributes as separate statement. After the changes, the indices section should look as below: # Indices to maintain index objectclass eq index cn,ou,cssidentity,member,cssroledn,cssproductcode,cssversion eq index cssdisplaynamedefault eq,sub index cssmanagedby,cssusermember,cssgroupmember eq,sub index cssisactive,uniquemember,cssprovisionedidentity,cssprovisionedapp,cssprovision edrole eq d. Save and close slapd.conf file. e. Rebuild indices. Note: Verify that OpenLDAP and Shared Services are shutdown. i. Create indexingldap.sh file by copying HYPERION_HOME/SharedServices/9.3.1/openLDAP/postLDAPInstall.sh. ii. Edit indexingldap.sh. Remove all the statements in the file, except the following: Incantation line, for example #!/bin/sh. Statement that defines the settings for LIBPATH (AIX), SHLIB_PATH (HP-UX), or LD_LIBRARY_PATH (all other UNIX systems), and OPENLDAP_HOME and the statements for exporting these environment variables. Statement to execute the slapindex command. Statement to execute the chmod command to set the file permissions. iii. Save and close the indexingldap.sh file. iv. Execute indexingldap.sh to rebuild the indices. v. Verify that indexing is completed successfully. If indexing is successful, the following files are created in openldap/usr/local/var/openldap-data directory: cssisactive.bdb uniquemember.bdb 4. From the directory where the service pack archive was extracted, copy hubconfig.jar and interop.war files into HYPERION_HOME/SharedServices/9.3.1/AppServer/InstallableApps/common directory, overwriting the existing file. 5. Create a backup copy of CMS.properties file and CSS.xml file. Generally, these files are located in HYPERION_HOME/deployments/APP_SERVER/SharedServices9/config directory. 6. (Optional): If you are implementing a custom authentication module, prepare the Web application archive (interop.war) for deployment. Be sure to use the interop.war included in this service pack. 7. Deploy interop.war to the application server.

12 You may use the Hyperion Configuration Utility to perform this step or perform a manual deployment. See Shared Services Installation Guide for details. 8. Replace CMS.properties and CSS.xml files with the backup copies you created in step 5. Generally, these files should be restored in HYPERION_HOME/deployments/APP_SERVER/SharedServices9/config directory. 9. Update CMS.properties by adding the following property: css.install.upgrade=true Note: This property may already be present in CMS.properties with its value set to false. 10. Optional: Perform this step only if you experience the symptoms reported in bug# From the CES_USERS table in the Shared Services database, remove all the existing entries other than the system user. Execute the following SQL Statement to complete this step: DELETE FROM CES_USERS WHERE name <> 'system' 11. Update Shared Services file or script that sets custom parameters. Note: You can also pass the -Dsun.net.inetaddr.ttl=0 property to the JVM by updating the JVM settings using the application server s Administration console. a. Using a text editor, open setcustomparamssharedservices9.bat (Windows) or setcustomparamssharedservices9.sh (UNIX). This file is located in HYPERION_HOME/deployments/APP_SERVER_NAME/bin, where APP_SERVER_NAME indicates the name of the application server you are using; for example, WebLogic9 or Tomcat5. For example, this file is located in C:/HYPERION/deployments/WebLogic9/bin if Shared Services is deployed to WebLogic on a Windows server. b. Specify the Java system property by modifying the JAVA_OPTS directive to include - Dsun.net.inetaddr.ttl=0. After making the changes, your JAVA_OPTS directive may be as follows: SET JAVA_OPTS=-Dhyperion.home=C:\Hyperion -server -Xms128m -Xmx1024m - Dsun.net.inetaddr.ttl=0 %JAVA_OPTS% c. Save and close the file. 12. Optional: Perform this step only if you are implementing a custom authentication module. Edit CSS.xml to configure Shared Services to use custom authentication. For details, see the Custom Authentication Information document (Custom_authentication_instructions.pdf) included in this archive. 13. Restart Shared Services. 14. Optional: If the SharedServices_Admin.log contains the message [Hyperion][DB2 JDBC Driver][DB2]CURSOR Cxx NOT IN PREPARED STATE when Shared Services is deployed to use DB2 database, edit HYPERION_HOME/deployments/<App_Server_And_Version>/SharedServices9/config/scheduler. properties and append ;WithHoldCursors=false to the JDBC URL. After this change, JDBC URL property should be as follows: org.quartz.datasource.myds.url = jdbc:hyperion:db2://dbhostname:port#;databasename=dbname;maxpooledstatements=40;dyna micsections=999;withholdcursors=false 15. Optional: Perform this step only if you reassigned the ownership of taskflows to the Shared Services administrator to recover workflows reassigned because of bug #

13 i. Log in to Financial Management or Performance Management Architect as Shared Services administrator and navigate to the Manage Taskflow screen. This screen displays the taskflows you reassigned to Shared Services administrator. ii. Assign manage role to the original owners of the recovered taskflows. Procedures for System 9 J2EE Web Applications Other than Shared Services Oracle recommends that you back up System 9 product data before redeploying your application archive. Note: Perform this procedure for each System 9 Web application deployment. Do not use this procedure to apply this service pack to the following products: Shared Services Oracle Essbase Oracle's Hyperion Reporting and Analysis Core Services Oracle Hyperion Financial Management To deploy this service pack for J2EE Web applications other than Shared Services: 1. Verify that all System 9 products are shut down. 2. Prepare the Web or enterprise archive of each web application for redeployment. This step includes the optional step of adding a custom authentication module to your product s Web Archive. See Preparing System 9 J2EE Web Application Archive for Redeployment. 3. Redeploy the Web application archive; for example, HyperionPlanning.ear, to the application server. You may use the Hyperion Configuration Utility to perform this step or perform a manual deployment. See the System 9 product s installation guide for detailed instructions. Caution: During the deployment process, you can configure the product database as well. If you choose to configure the database, to avoid losing data, you must ensure that existing database tables are preserved. To preserve existing database tables during the database configuration process, select the Reuse Existing Tables option while redeploying System 9 applications. 4. Update product file or script that sets custom parameters. Note: You can also pass the -Dsun.net.inetaddr.ttl=0 property to the JVM by updating the JVM settings using the application server s Administration console. a. Using a text editor, open the file or script that the product uses to set custom parameters. Generally, this file is named setcustomparamsproduct_name where PRODUCT_NAME identifies a System 9 J2EE Web application. For example, setcustomparamsaas.bat is used to set custom parameters for Essbase Administration Services. Similar products are available for other applications. This file is located in HYPERION_HOME/deployments/APP_SERVER_NAME/bin, where APP_SERVER_NAME indicates the name of the application server you are using; for example, WebLogic9 or Tomcat5. For example, this file is located in C:/HYPERION/deployments/WebLogic9/bin if Essbase Administration Services is deployed to WebLogic on a Windows server. b. Specify the Java system property by modifying the JAVA_OPTS directive to include - Dsun.net.inetaddr.ttl=0. After making the changes, your JAVA_OPTS directive may be as

14 follows: SET JAVA_OPTS=-Dhyperion.home=C:\Hyperion -Dsun.net.inetaddr.ttl=0 %JAVA_OPTS% c. Save and close the file. Procedures for Essbase Applying this service fix to Essbase Server involves these tasks: Adding interop-sdk.jar to a common location Implementing a custom authentication module Updating Environment variables Adding interop-sdk.jar to the Server To apply this service fix to Essbase Server: 1. Shut down System 9 products and processes including Essbase server. 2. On each Essbase Server host machine, copy interop-sdk.jar contained in this service pack into HYPERION_HOME/common/SharedServices/9.3.1/lib. Optional: Implementing Custom Authentication Module. 1. Make sure that all System 9 products are shut down. 2. Extract css-9_3_1.jar from this service pack to a temporary directory; for example, temp1. 3. Using the jar command, extract the contents of css-9_3_1.jar into another temporary directory; for example, temp2. 4. Delete css-9_3_1.jar from the temporary directory. 5. Using the jar command, extract the contents of the custom authentication module Java archive; for example, customauth.jar, into the temporary directory; for example, temp2, where you extracted the contents of css-9_3_1.jar. 6. Be sure to copy the files into the directory appropriate for the package structure of your class file. If you used a package called com.yourcompany.customauth, make sure your class is copied in the com/yourcompany/customauth folder within the temporary directory. 7. Using the jar command, create css-9_3_1.jar using the contents of the temporary directory temp2. 8. On the computer that hosts Essbase Server, replace HYPERION_HOME/common/CSS/9.3.1/lib/css- 9_3_1.jar with the css-9_3_1.jar from the preceding step. Updating Environment Variable Pass the Java system property -Dsun.net.inetaddr.ttl=0 to the JVM as an environment variable. Windows 1. Ensure that Essbase Server is not running. 2. Set the Windows system environment variable ESS_CSS_JVM_OPTION3 to - Dsun.net.inetaddr.ttl=0 If ESS_CSS_JVM_OPTION3 is already in use, set this value for the next available

15 ESS_CSS_JVM_OPTION; for example, ESS_CSS_JVM_OPTION4. For example, ESS_CSS_JVM_OPTION3 -Dsun.net.inetaddr.ttl=0 3. Start Essbase Server. UNIX 1. Stop Essbase Server. 2. Update hyperionenv.doc by adding the following property ESS_CSS_JVM_OPTION3= -Dsun.net.inetaddr.ttl=0 3. Start Essbase Server. Procedures for Financial Management Updating Environment Variable 1. On the Financial Management application server, append -Dsun.net.inetaddr.ttl=0 to the value of HKEY_LOCAL_MACHINE\SOFTWARE\Hyperion Solutions\Hyperion Financial Management\Server\Authentication\LibPath registry key. Use a space to separate this value from existing values of the registry key. Also, ensure that the property value is in enclosed quotation marks; for example "-Dsun.net.inetaddr.ttl=0". 2. Restart CASSecurity.exe for the new setting to take effect. Optional: Adding Custom Authentication Module to Classpath To add the custom module to the Financial Management classpath, you must update the Registry with the location and name of the custom module. To add the custom module to the Financial Management classpath: 1. Stop all Financial Management processes, especially CASSecurity.exe. 2. Make sure that the custom authentication module Java archive; for example, customauth.jar, is available in HYPERION_HOME/common/CSS/9.3.1/lib. 3. Append the location of the custom module Java archive; for example, %HYPERION_HOME%\COMMON\css\9.3.1\lib\customAuth.jar to the Financial Management value data of the following key. Be sure to use a semicolon (;) to separate the existing value data from the path that you append. HKEY_LOCAL_MACHINE\SOFTWARE\Hyperion Solutions\Hyperion Financial Management\Server\Authentication\ClassPath Procedures for Workspace Core Service Note: Complete this procedure only if you are implementing a custom authentication module. If you are implementing a custom authentication module, copy the custom authentication module.jar file to HYPERION_HOME/common/CSS/9.3.1/lib directory on the machine where Reporting and Analysis Core Services is deployed. Also, add the custom authentication.jar file to the Reporting and Analysis Core Services classpath. To add the custom authentication module to the Reporting and Analysis Core Services classpath: 1. Make sure that Workspace and Core Services are shut down. 2. Make sure that the custom authentication module Java archive; for example, customauth.jar, is available in HYPERION_HOME/common/CSS/9.3.1/lib.

16 3. Add the custom authentication Java archive to the classpath: a. Using a text editor, open HYPERION_HOME/common/workspacert/9.3.1/bin/workspace.app. b. Add an entry such as the following for the custom authentication Java archive: ${home}/common/css/9.3.1/lib/customauth.jar, where customauth.jar indicates the name of the custom authentication module's Java archive. c. Save and close workspace.app. 4. Start Core Services and Workspace. Preparing System 9 J2EE Web Application Archives for Deployment System 9 J2EE Web application archives may be packaged as an enterprise archive (.ear) or Web archive (.war). You should modify each product archive using these steps before deploying it to the application server. If you plan to implement a custom authentication module, you must have a Java archive (.jar) of fullytested custom Authentication module binaries. See the Custom Authentication Information document (Custom_authentication_instructions.pdf) included in this archive for details. Important: You must perform this procedure for each Web application in your System 9 deployment. To prepare a System 9 Web or enterprise archive for deployment: 1. Stop System 9 products and services, if they are running. 2. Find a System 9 Web application archive that you want to prepare for deployment. Generally, the product archive is available in the InstallableApps directory within the System 9 product installation directory. For example, Planning enterprise archive location is HYPERION_HOME/Planning/AppServer/InstallableApps/Common/HyperionPlanning.ear. 3. Create a backup copy of the application archive. 4. Create two temporary directories; for example, temp1 and temp2. 5. Copy the application archive into a temporary directory; for example, temp1. 6. Optional: Perform this step only if you are working with an enterprise archive; for example, HyperionPlanning.ear: a. Using the jar command, extract the contents of the enterprise archive into the temporary directory (temp1) b. Delete the enterprise archive from the temporary directory. c. Copy the Web archive (.war) from temp1 into a temporary directory; for example, temp2. 7. Using the jar command, extract the contents of the Web archive into the temporary directory (temp2). 8. Delete the Web archive from the temporary directory (temp2). 9. Perform these steps in the temporary directory; for example, temp2:

17 a. Replace WEB-INF/lib/css-9_3_1.jar with the css-9_3_1.jar file provided with this service pack. Note: If you are updating interop.war, do not replace css-9_3_1.jar. b. Workspace only: Delete WEB-INF/lib/css.jar. Rename the WEB-INF/lib/css-9_3_1.jar to css.jar. c. Optional: If you are deploying a custom authentication module, copy the custom authentication Java archive; for example, customauth.jar, into WEB-INF/lib directory within the temporary directory (temp2/web-inf/lib). 10. Using the jar command, create a Web archive of the contents of the temporary directory (temp2). Ensure that the Web archive has the name of the original application archive; for example, HyperionPlanning.war. Note: Verify that the Web or Enterprise archive you create maintains directory structure. 11. Optional: If your System 9 product deploys an enterprise archive, recreate the enterprise archive: a. Copy the Web archive; for example, HyperionPlanning.war, into temp1. b. Using the jar command, create an enterprise archive of the contents of the temporary directory (temp1). Ensure that the enterprise archive has the name of the original application archive; for example, HyperionPlanning.ear. 12. Replace the existing application archive by copying the archive into the InstallableApps directory within the System 9 product installation directory. For example, Planning enterprise archive (HyperionPlanning.ear ) should be copied into HYPERION_HOME/Planning/AppServer/InstallableApps/common. If your System 9 product deploys a Web archive, use the Web archive from step 10. If your System 9 product deploys an Enterprise archive, use the enterprise archive from step 11. Regenerating the SSO Encryption Key (Optional) Top of Document Use the SharedServicesHandler Utility to regenerate the SSO encryption key. The SharedServicesHandler Utility generates a new keystore file that can be used to encrypt and decrypt SSO tokens. Caution: Do not run the SharedServicesHandler Utility in a mixed environment that comprises x.xx, x, and earlier products. To run the SharedServicesHandler Utility: 1. Extract the contents of SharedServicesHandler.zip into a directory in the Shared Services host machine; for example, into HYPERION_HOME/common/utilities. 2. Open a command prompt window and navigate to the bin directory (for example; HYPERION_HOME/common/utilities/SharedServicesHandler/bin) within the directory where the SharedServicesHandler Utility was extracted.

18 3. Run SharedServicesHandler.bat (Windows) or SharedServicesHandler.sh (UNIX). The SharedServicesHandler Utility creates the keystore file sshandlertk in HYPERION_HOME/common/CSS. 4. Copy HYPERION_HOME/common/CSS/ssHandlerTK into the HYPERION_HOME/common/CSS directory (not into HYPERION_HOME/common/CSS/9.3.1 directory) on servers that host System 9 products, utilities, and any custom applications that use Shared Services security. 5. Restart all System 9 products, utilities, and custom applications that use Shared Services security APIs. Top of Document Copyright 2009, Oracle and / or its affiliates. All rights reserved.