INSTALLATION GUIDE BIOVIA VAULT SERVER 2016

INSTALLATION GUIDE BIOVIA VAULT SERVER 2016

Copyright Notice 2015 Dassault Systèmes. All rights reserved. 3DEXPERIENCE, the Compass icon and the 3DS logo, CATIA, SOLIDWORKS, ENOVIA, DELMIA, SIMULIA, GEOVIA, EXALEAD, 3D VIA, BIOVIA and NETVIBES are commercial trademarks or registered trademarks of Dassault Systèmes or its subsidiaries in the U.S. and/or other countries. All other trademarks are owned by their respective owners. Use of any Dassault Systèmes or its subsidiaries trademarks is subject to their express written approval. Acknowledgments and References To print photographs or files of computational results (figures and/or data) obtained using BIOVIA software, acknowledge the source in an appropriate format. BIOVIA may grant permission to republish or reprint its copyrighted materials. Requests should be submitted to BIOVIA Support, either through electronic mail to biovia.support@3ds.com, or in writing to: BIOVIA Support 5005 Wateridge Vista Drive, San Diego, CA 92121 USA

Contents New Installation Overview 5 Vault Server Components 5 Installation Prerequisites 5 BIOVIA Workbook Download Archive File Contents 6 Install Direct 7 Verify Oracle Text Installation 8 Vault Server Database Schemas 8 Modify the RAS and Vault Configuration Files 9 Configuration Variables Reference 9 Recommended Tablespace Names 12 Recommended ASM Tablespace Names 12 Microsoft Windows Server Required Tasks 13 Assign Write Access to the System temp Folder 13 Install Microsoft Windows Server 14 Specify IIS Server Roles 14 Install Oracle Client 15 Install the Oracle Client 15 Prepare IIS for Secure Communications 15 Verify Settings 16 Verify BIOVIA Pipeline Pilot Server Installation 16 Configure SSL and Domain Authentication 16 Set up Vault Site and RAS Data Sources 17 Vault Site Data Source 17 RAS Data Source 18 Run Vault Server Database Scripts 18 Install BIOVIA Vault Server 20 Verify Vault Server Installation 20 Run the Vault Deployment Utility 21 Vault Foundation Hub Bootstrapper 23 Run VaultToHubBootstrapper 24 Users, Groups, and Permissions 25 Add Users 26 Add Vault and Workbook Groups 26 Assign Permissions to Groups 26 Installation Verification 28 Verify Vault Web Server Service and Vault Private Service 28 Verify the Accelrys Deployment Manager 28 Verify the RAS Service 28 Verify the Vault User and Repositories 28 Post-Installation Tasks 30 Install Vault Administration Tools 30 Enable Full-text Searching in Workbook 30 Install Workflow Designer 31 Set up the Database Web Service 31 Add a Database Web Service License Key 31 Change Resolver Order in Lookup Service 32 Change Data Source Order in DiscoverGateWebServiceResolver 33 Vault Server Set Up Page Reference 34 Log in to Vault Administration 36 Upgrade Installation 37 Before Upgrading Checklist 37 Vault Upgrade Task List 38 Back up Methods for Pipeline Pilot Protocol 38 Set User Account Control to Never Notify 38 Back Up the Vault Database 38 Uninstall Previous Versions 39 Uninstall Vault Server Components 39 Uninstall Vault Server 6.6 HF3 39 Uninstall Administration Console Installations 39 Uninstall Previous Workflow Designer 40 Uninstall Accelrys Electronic Lab Notebook Client 40 Delete the VaultLogs Folder 40 Upgrade the BIOVIA Vault Server Database 41 Extract the Zip Files 41 Create Tablespaces, Users and Schemas 41 Run Vault Deployment Utility in Upgrade Mode 42 Post Installation Tasks 43 Configure ADM Profiles 43 Configuration 45 Configure Application Permission for Pipeline Pilot 45 Clone to Latest 45 Queueing Property Extraction 45 Modify Administrator Account 45 Import the Experiment template.voexp Files 46 Load Balancing 48 Accelrys Vault Server Load Balancing 48 Load Balancer Prerequisites 49 Pipeline Pilot Server Load-balancing 50 Configure BIOVIA Vault Server Load Balancing 51 Port Numbers 52 Export a PFX File 52 Generate Crt, Key and Chain Files 52 Install PFX Files 53 Load Balancer Reference 54

Start Vault Services 55 Stop the Vault Services 55 Worksheets 56 Information Needed to Install the Accelrys Vault Database 56 Vault Server Worksheet 57 Upgrade Vault Server Worksheet 58 Oracle Database Information: 58 RAS and Vault Schema Information: 58 Middle-tier Information 58 Manual Tablespace Creation 60 Create the RAS Tablespaces 60 Create the Vault Tablespaces 61 Create Oracle Users 62 About the RAS Oracle Users 62 Create RAS Users 62 Create Vault Users 62 Vault Schema Objects 64 Verify Vault User and Repositories 64 Certificates 66 Create, Renew or Change a Certificate 66 Create a Self-signed Certificate 66 Create a PFX File from a Certificate 67 Add the Certificate to the Trusted Root Store 67 Integration with Inventory Management 68 CIMS Installation Prerequisites 68 CIMS on Web Core Server 68 Import CIMS Experiment Templates 68 CIMS Properties to Workbook Properties Mapping 69 Integration with BIOVIA Chemical Registration 71 Set up the Pipeline Pilot Server 71 Set Up User Authentication 72 Assign Permissions 72 Chemical Registration Limitations 72 Chemical Registration Integration Components 72 Chemical Registration Integration Protocols 73 Field Mappings 73 Field Mapping Configuration File 74 Document Vocabularies 75 Add ChemRegRunProtocol Permission 76 Assign Chemical Registration Permissions 76 Assign Users or Groups to the ChemRegRunProtocol Permission 77 Integration with CISPro 78 CISPro Integration Overview 78 Configure CISPro Integration 83 CISPro to Workbook Property Mapping 84 Expected Names for CISPro 87 Configure Multiple CISPro Servers 88

New Installation Overview Complete the steps listed below to install BIOVIA Vault Server version 2016. Copy and extract the installation archive files (.zip) from the BIOVIA products from the Download Center for the following required products: BIOVIA Workbook2016, includes BIOVIA Vault Server2016 BIOVIA Foundation and Foundation Hub. BIOVIA Direct. Install BIOVIA Direct on the Oracle instance that is used for BIOVIA Vault Server. Prepare Microsoft Windows Server for the Vault Installation Configure certificates for yourbiovia Vault Server middle tier servers. Install the BIOVIA Vault Server database. Install Foundation. Install Foundation Hub. Install Accelrys Vault Server. Run the Vault Deployment Utility from 2016. Configure the Deployment Manager for 2016. Install BIOVIA Workbook client, Administration and Workflow Designer client from 2016. Vault Server Components BIOVIA Vault Server uses the following components: BIOVIA Direct BIOVIA Foundation BIOVIA Foundation Hub RAS RAS is the data warehouse component of BIOVIA Vault Server. RAS provides data schemas optimized for analysis and searching. New data schemas are automatically created as data models are loaded into the server. Vault Deployment Utility BIOVIA Vault Server installer BIOVIA Vault Administration Console installer Workflow Designer installer Installation Prerequisites BIOVIA Vault Server performs prerequisite checks before installing the server. The system must meet the conditions listed in the following table. When your hardware meets the requirements, you can continue with the BIOVIA Vault Server installation. If the Vault Setup installer reports deficits, select Help for instructions on how to configure the prerequisites. Use this checklist to verify that you have performed the prerequisite tasks. New Installation Overview Page 5

Requirement Description Done Secure socket layer (SSL) certificate and a personal information exchange (.pfx) file exist for the Vault server. Sufficient disk space has been allocated for the Vault repositories. The Oracle database is prepared for installation. The certificate and file are required for the BIOVIA Vault Server installation and for BIOVIA Workbookclient to connect to the Vault middle tier server. When using a load balancer, a SSL certificate is required for the load balancer end-point. See the BIOVIA Vault Server Systems Requirements guide. For more information, see Verify Oracle Text Installation and Oracle Client Installation BIOVIA Direct is installed. See the BIOVIA Direct Installation Guide. Prepare Windows server for the BIOVIA Vault Server installation. Install Oracle 32 bit client. Prepare IIS for SSL. Prepare the installation worksheets. Extract installation files from the BIOVIA_Workbook_x.zip. Prepare Microsoft Windows Server for the Vault Installation BIOVIA Workbook Download Archive File Contents The BIOVIA_Workbook_2016.zip file contains the files required for installing BIOVIA Vault Server and the BIOVIA Workbook. You can find the files ina location similar to the following: Server Installation Files File Name \BIOVIA_Workbook_2016\Client and Server Installers\Setup.exe \BIOVIA_Workbook_2016\Client and Server Installers\VaultAdministrationConsoleInstaller.exe \BIOVIA_Workbook_2016\Client and Server Installers\WorkflowDesignerInstaller.exe \BIOVIA_Workbook_2016\Client and Server Installers\VaultDeploymentUtility\VaultDeploymentUtility. exe Description BIOVIA Vault Server middle tier installer BIOVIA Vault Administration Consol e installer Workflow Designer installer Vault Deployment Utility (VDU) Page 6 BIOVIA Vault Server Installation Guide

Client Installation Files File Name \BIOVIA_Workbook_2016\Client and Server InstallersBIOVIA.Workbook.2016.64bit.msi \BIOVIA_Workbook_2016\Client and Server Installers\BIOVIA.Workbook.2016.msi Description BIOVIA Workbook client X64 installer BIOVIA Workbook client X86 installer Scripts File Name \BIOVIA_Workbook_ 2016\DatabaseScripts\AddRepository.bat \BIOVIA_Workbook_ 2016\DatabaseScripts\CreateNewRepositoryUser.bat \BIOVIA_Workbook_ 2016\DatabaseScripts\CreateTablespaces.bat \BIOVIA_Workbook_ 2016\DatabaseScripts\CreateUserAccounts.bat \BIOVIA_Workbook_ 2016\DatabaseScripts\DelExternalReps.bat \BIOVIA_Workbook_ 2016\DatabaseScripts\DeployDatabaseSchemas.bat \BIOVIA_Workbook_ 2016\DatabaseScripts\ReportSchemaState.bat \BIOVIA_Workbook_2016\DatabaseScripts\Pre- Install Check Scripts\PreInstallCheck.bat Description Creates a new versioned repository. Creates the schema owner of a new versioned repository. Creates new tablespaces. Creates the schema owners for RAS and Vault Deletes external version 5 repositories. Deploys a new BIOVIA Vault Server database and upgrades BIOVIA Vault Server database. Validates the BIOVIA Vault Server database after it is installed or upgraded. Check pre-installation or preupgrade state of the server. Install Direct IMPORTANT! You must install BIOVIA Direct on the same computer as the Oracle database installation. For more information, see the BIOVIA Direct Installation Guide for your operating system. New Installation Overview Page 7

Verify Oracle Text Installation You must install Oracle Text in the Oracle database used by BIOVIA Vault Server and RAS. The RAS data warehouse component requires the Oracle Text in the RAS database to manage and retrieve text by indexing documents or textual content. Note: To perform this task, permissions are required to log in to SQL Plus on the database-tier computer. To verify the installation of Oracle Text: 1. Start SQL*Plus and log in to the Oracle instance where you plan to install the RAS database. 2. Execute the following command to determine the users on this computer select username from dba_users where username = 'CTXSYS'; If the user CTXSYS is not included in the list, the Oracle Text is not installed on your computer. For information on installing Oracle Text on the computer, refer to your Oracle documentation. 3. (Optional) Unlock the CTXSYS account and reset the password, type the following: alter user ctxsys identified by new_ctxsys_password account unlock; When the CTXSYS account is locked, the account is not prevented from creating text indexes. The CTXSYS account owns packages that a DBA might want to use while logged in as the CTXSYS account. To verify that Full Text Indexing is set up properly when running Linux x86-64 or Solaris SPARC64, see Enable Full Text Searching. Vault Server Database Schemas The BIOVIA Vault Server database consists of a RAS schema and Vault schemas including the following: Site Home Workflow Tools Versioned Repositories You must use the database scripts available in the <extracted archive file location>\biovia_ Workbook_2016\DatabaseScripts\ folder to create the schemas. Run the scripts to create the schemas on the Vault middle tier computer. You must also: Create the Global Administrator user account for Vault. Vault requires a valid Microsoft Windows directory user account or a local operating system administrator account to use as the Vault Global Administrator account. BIOVIA recommends creating an Active Directory Administrator account that you can share across your network with standard domain user privileges. The Vault Global Administrator account is used in the SQL scripts that create the Vault repository schemas, created in the Site repository, and referenced by the installation scripts as vault.admin. Modify RAS and Vault configuration files for your environment. Run the following database scripts in this order: CreateTablespaces.bat CreateUserAccounts.bat Page 8 BIOVIA Vault Server Installation Guide

PreInstallCheck.bat DeployDatabaseSchemas.bat ReportSchemaState.bat Modify the RAS and Vault Configuration Files The RAS and Vault configuration files are available in the <extracted archive file location>\biovia_workbook_2016\databasescripts\ folder. The configuration files contain variables such as data file name and location information, Oracle user information, and the default Vault Global Administrator account, for example, the vault.admin user name and domain. You need to modify the following configuration files with variables for your environment: variables.db.config variables.fileservice.config variables.ras.config variables.setup.config vaultvariables.nb1.config vaultvariables.site.config vaultvariables.user1.config vaultvariables.wftools.config IMPORTANT! To modify the RAS and Vault configuration files: 1. Before you edit the configuration files, make a copy of each file, and move the copy to a different folder. Moving the copies to a different location enables keeping a back-up, unaltered version, of the original configuration files. 2. In the \\\BIOVIA_Workbook_2016\DatabaseScripts folder, open each configuration file in a text editor. 3. Change the variables to values that correspond to your environment. For more information on the configuration variables for each file, see Configuration Variables Reference. 4. Save the files. Configuration Variables Reference After setting up your Oracle database, you need to specify variables in BIOVIA Vault Server configuration files that provide parameters for interacting with the database, the BIOVIA Vault repository, and the BIOVIA Workbook client. The following tables list the configuration file by name, the parameter that requires an environment specific variable, and the values to use from the Oracle database configuration. New Installation Overview Page 9

Configuration File Parameter Variable Values Notes variables.db.config DbServer DbPort DbServiceNamce Oracle Server name Oracle Port Oracle Service name Provides the Oracle server connection information and tablespace names. Tablespace names are optional. BIOVIA recommends that you keep the default tablespace names listed in this file. For more information, see Variables Set Up Configuration. Edit the variables.db.config file to update the following variables: RepDatabaseServer = DbServer RepListenerPort = DbPort RepDBServiceName = DbServiceName Change the VaultTempTablspace from the default value of VaultTemp to the actual value for the Temporary Tablespace at your site, such as, Temp. Variables.RAS.config RASSchema RASSchemapass RASUser RASUserpass DirectUser Oracle user password Oracle user password Oracle user Specify the Direct user account to use with Vault, the supported user accounts are supported values are: C$MDLICHEM80 C$DIRECT90 C$DIRECT91 C$DIRECT95 Page 10 BIOVIA Vault Server Installation Guide

Configuration File Parameter Variable Values variables.setup.config vaultvariables.siteconfig vaultvariables.nb#.config DefaultTablespaceP ath SiteUser Sitepass uname domain siterouser siterouserpas RepositoryUser Repositorypass Repository name * Oracle data files path Oracle user password 'vault.admi n' SiteUser.ro Sitepass.ro Oracle user password 'General' Notes Provides the tablespace location and names. You can use the following: Local windows file system Linux file system Oracle Automatic Storage Management (ASM) To distribute table spaces across multiple data stores, add additional location variables pointing to the alternate data store. Use the Vault Global Administrator as the network and domain account. Create the Vault Global Administrator before installing BIOVIA Vault Server. Replace the SYMYX IC domain with the actual domain name for your site. Use the Vault Site read-only (SiteUser.ro) user name when configuring the Vault Site Datasource in BIOVIA Pipeline Pilot Server. Represents the versioned repositories. Create a new.config file, and replacing # symbol with the number for each versioned repository that you are creating. You must use consecutive numbers for the repositories such as vaultvariables.nb1.c onfig vaultvariables.nb2.c onfig vaultvariables.nb3.c onfig * Create an unique repository name surrounded by single quotes. New Installation Overview Page 11

Configuration File Parameter Variable Values Notes vaultvariables.user1.conf ig RepositoryUser Repositorypass Oracle user password Represents the Home repository. VaultVariables.wftools.co nfig WFToolsUser WFToolpass Oracle user password Represents the Workflow repository. variables.fileservice.con fig FileserviceUser Fileservicepass Oracle user password Represents the FileService repository. Recommended Tablespace Names The recommended tablespace names for the Vault database are: VaultTablespace = Vault VaultTempTablspace = Temp VaultIndexTablespace = VAULTIDX VaultLobTablespace = VAULTLOB FileServiceTablespace = FileService The recommended tablespace names for the RAS database are: RasDefltTablespace = symyxdb RasUserTablespace = symyxuser RasIndexTablespace = symyxind RasLobTablespace = symyxlob RasTmpTablespace = symyxtemp RasauditTablespace = symyxaudit RasauditindexTablespace = symyxauditindex RasauditLobTablespace = symyxauditlob Recommended ASM Tablespace Names When using Oracle Automatic Storage Management (ASM), the recommended tablespace names for the Vault database are: --Used as the ASM location for all tablespaces unless overridden below DEFINE DefaultASMDataDeclaration=+DATA01 --vault tablespaces DEFINE VaultDefaultPath=^DefaultASMDataDeclaration DEFINE VaultTempPath=^DefaultASMDataDeclaration DEFINE VaultIndexPath=^DefaultASMDataDeclaration DEFINE VaultLobPath=^DefaultASMDataDeclaration DEFINE FileServicePath=^DefaultASMDataDeclaration --ras tablespaces DEFINE symyxdbpath=^defaultasmdatadeclaration DEFINE symyxindpath=^defaultasmdatadeclaration DEFINE symyxlobpath=^defaultasmdatadeclaration Page 12 BIOVIA Vault Server Installation Guide

DEFINE symyxuserpath=^defaultasmdatadeclaration DEFINE symyxauditpath=^defaultasmdatadeclaration DEFINE symyxauditindexpath=^defaultasmdatadeclaration DEFINE symyxauditlobpath=^defaultasmdatadeclaration DEFINE symyxtemppath=^defaultasmdatadeclaration Microsoft Windows Server Required Tasks You must perform the following tasks on your Microsoft Windows Server before you install BIOVIA Vault Server. Add the Microsoft Internet Information Servics (IIS) application server and web server roles. For more information, see Install the Application Server Role on Your Server and Installing IIS 7.5 on Windows Server 2008 R2. Provide the network service read/write access to the system \temp folder. Remove the IUSR_VaultServer_computer account from the Guests group. Assign Write Access to the System temp Folder The Network Service account user requires write access to the system temp folder. Provide the Network Service account write access to the system temp folder on the computer where you plan to install BIOVIA Vault Server. To assign write access to the system temp folder: 1. Determine the location of the Windows System temp folder. 2. On the Vault Server computer, select Start > Control Panel > System and Security > System. 3. In System properties, click Advanced system settings. 4. In System Properties, click Environmental Variables. 5. In the System variables section, scroll down to locate the TEMP variable, for example: c:\windows\temp 6. In Windows Explorer, navigate to the location of the \temp folder. 7. Right-click the temp folder, select Properties, and click the Security tab. 8. In Temp Properties, in Group or user names, determine if permissions were write permissions are granted for the NETWORK_SERVICE account user. 9. Do one of the following: If the VaultServer_computer\NETWORK SERVICE account user has writer permissions, you can end this task. If the NETWORK SERVICE account user exists, select the VaultServer_computer\NETWORK SERVICE, and do the following: a. Click Advanced, click Change Permissions, and then grant the following permissions: Modify Read and Execute List Folder Contents Read Write New Installation Overview Page 13

If the VaultServer_computer\NETWORK SERVICE account user does not have the Modify permission, click Edit. a. Add the Modify permission. b. In the Windows Security dialog indicating that permissions changed, click Yes. The task is complete. If the VaultServer_computer\NETWORK SERVICE account user is not listed, click Edit. a. The Permissions for Temp, click Add. b. In Select Users, Computers, or Groups, click Locations. c. In Locations, select the Vault Server, and click OK. d. In Select Users, Computers, or Groups, in Object Name, type NETWORK SERVICE. e. Click Check names. f. Click OK. g. Grant the permissions to the NETWORK SERVICE account user, see a step 12. h. Verify that the NETWORK SERVICE account user has the Modify permission. i. Add the Modify permission, if the permission was not granted when you added the NETWORK SERVICE account user. j. In the Windows Security dialog, click OK or Apply, and then click Yes in the Security dialog. Install Microsoft Windows Server Perform the following tasks to ready Microsoft Windows Server x64 for the BIOVIA Vault Server installation: Follow Microsoft's guide for the installation or upgrade of a server to Microsoft Windows Server 2008 R2 SP1 or 2012. Use the standard server role. For more information, see System Requirements and Installation Information for Windows Server 2012 R2. Apply all critical Windows updates. Install anti-virus software, and then run a full scan to make sure there are no viruses on the server. Add the server to the appropriate domain. Specify IIS Server Roles Define the following application server roles on Microsoft Internet Information Servers (IIS)..NET Framework 3.5.1 and 4.5.1 Web Server (IIS) Support Windows Process Activation Service Support HTTP Activation Web Server (IIS) role Message Queuing role Install the role services for Web Server IIS Role: ASP.NET IIS 6 Metabase Compatibility Use the IIS Manager to add the application server roles and roles services. For more information, see Installing the Web Server Role. Page 14 BIOVIA Vault Server Installation Guide

Install Oracle Client Download the Oracle 32-bit client software or the version appropriate for your Oracle database from Oracle Software Downloads. For more information, see BIOVIA Vault Server System Requirements for the supported Oracle client versions. BIOVIA Vault Server uses the 32-bit version of the Oracle.DataAccess.dll, odp.net. You must install the Administrator option version of the Oracle client on the BIOVIA Vault Server middle-tier computer. Install the Oracle Client The Oracle Client installer creates an Oracle Home folder when patching an existing Oracle Client. Confirm that you have selected the original Oracle Home folder when installing an Oracle Client patch. Install Oracle 32-bit Client. For more information, see Oracle s software installation guide for instructions. 1. Modify the sqlnet.ora file in Oracle_Client_Home\network\admin with the following parameters: sqlnet.authentication_services = (NONE) 2. Comment out the names.directory_path parameter if it exists, for example: # names.directory_path = (TNSNAMES, EZCONNECT) 3. Set the Path environment to point to ORACLE_Client_HOME\network.admin. 4. (Optional) create an environment variable called TNS_ADMIN that points to ORACLE_Client_ HOME\network.admin. 5. (Optional) Test the network connection to the target Oracle database using in SQL*Plus or SQL*Plus Worksheet. To use a Transparent Network Substrate (TNS) alias to connect to the database, you must have a tnsnames.ora file. For more information about using the Oracle Net Configuration Assistant to create a tnsnames.ora file, see the Oracle Net Services Installation Guide. Prepare IIS for Secure Communications BIOVIA Vault Server uses Secure Sockets Layer (SSL) to secure client-server communications. The Microsoft Internet Information Services (IIS) Web site must have an SSL certificate for clients to connect to the BIOVIA Vault Server. Prior to installing Vault, obtain an SSL certificate for your server. Use a certificate issued from a trusted Certificate Authority (CA) on the client computers that connect to the Vault. Contact your Information Technology department to learn about certificate requirements and options for your site. Use of a certificate from a non-trusted CA requires that each client manually accept the certificate before connecting to Vault computer. You must obtain a certificate that is issued to the server name in the form that you plan to use for client connections. Use the fully qualified domain name of the server, for example, vaultserver.your_company.com. To request and import a certificate into IIS: Determine the server name that you plan to use for your Vault server. Submit a certificate request for that server to a trusted CA. Import the certificate into IIS. Apply the certificate to the default web site in which Vault is installed. New Installation Overview Page 15

See also: Certificates Verify Settings Before installing the BIOVIA Vault Server, verify the configuration settings for the following access and IIS settings: Install the Microsoft Internet Information Service (IIS) web server or verify the IIS installation. Use the Server Manager and expand Roles to enable anonymous authentication and disable all other authentication options: In the Server Manager select Web Service (IIS) > Internet Information Service > Computer Name > Sites > Default Web Site > Authentication. Enable the HTTP and HTTPS protocols. The default HTTPS port number is 443. Verify that the IIS Admin Service and the World Wide Web Publishing Service are started. Restart the server Restart the middle-tier server after all pre-installation tasks have been completed to ensure that all software is properly initialized and ready for the BIOVIA Vault Server installation. Verify BIOVIA Pipeline Pilot Server Installation Installing and upgrading BIOVIA Workbook 2016 require running a BIOVIA Foundation Pipeline Pilot server. Foundation Pipeline Pilot server is required for authenticating and managing users in BIOVIA Workbook. The license file for BIOVIA Workbook 2016 is included in your Workbook installation package. To verify that Pipeline Pilot server is installed correctly: On the installation server, click Start > All Program Files > BIOVIA > Pipeline Pilot Server 2016 Home page. Configure SSL and Domain Authentication BIOVIA Vault Server and the BIOVIA Workbook client use BIOVIA Foundation Pipeline Pilot single-sign on authentication. You must configure SSL and domain authentication in Foundation Pipeline Pilot. SAML is not supported. Prerequisites Before configuring SSL and domain authentication, do the following: Create a.pfx from the signing authority certificate for the server. Make note of the path to the folder containing the.pfx file and the password for the.pfx file. Foundation Pipeline Pilot is installed and operational by verifying your ability to log in to the Foundation Pipeline Pilot Administration Portal. To configure SSL and domain authentication: 1. Using Foundation Pipeline Pilot, navigate to the OpenSSL program in the following location: <install_root>\apps\scitegic\core\packages_ <platform>\openssl\openssl- 0.9.8 u\bin 2. Open a command window as an Administrator. 3. Change the current directory to the OpenSSL directory. Page 16 BIOVIA Vault Server Installation Guide

4. Run the following commands: openssl pkcs12 -in c:\cert\<cert.pfx> -out c:\cert\ses-signed.crt -nokeys -nodes openssl pkcs12 -in c:\cert\<cert.pfx> -out c:\cert\ses-signed.key - nocerts -nodes openssl pkcs12 -in c:\cert\<cert.pfx> -out c:\cert\ses-signed.chain - chain -nodes 5. Copy the ses-signed.crt, ses-signed.key, and ses-signed.chain output files to the <install_root>\web\conf folder. 6. From the FoundationPipeline Pilot Server Home Page, open the Administration Portal. 7. In the Sign In dialog, type your credentials. Use the default user name, scitegicadmin, and password, scitegic. 8. In Admin Pages, expand Security, and select SSL Certificate. 9. In SSL Certificate, select Obtain a certificate from a recognized signing authority as the Certificate, and click Save Option. 10. Log out and restart the Pipeline Pilot Services. 11. In the Administration Portal > Admin Pages, expand Security, and select Authentication. 12. In Authentication Method, in the Check users against group, click An external user directory, and select Domain. 13. In Settings, select Accept passwords via SSL only, and then, click Save. 14. Under the Admin Pages node, expand Setup. 15. Select Global Properties. 16. From the Package list, select BIOVIA Workbook, and record the ConfigFilePath value. 17. Change the location of ConfigFilePath to the FoundationPipeline Pilot <install_ root>\apps\scitegic\notebook\dataroot\, and then select Update. Set up Vault Site and RAS Data Sources Note: You cannot test the data source until after installing Vault server. Set up the Vault Site and RAS data sources on the BIOVIA Foundation Pipeline Pilot server to enable the Experiment Status Report protocol function in the BIOVIA Workbook client. 1. Open a browser and enter the fully qualified path with the port number for the Foundation Pipeline Pilot server Administration Portal such as the following: https://pp85.xyz.com:9943/admin 2. In the Pipeline Pilot and Foundation Server Administration Portal, log in as the configured admin user and then click Setup > Data Sources. 3. Click Add Data Source, and follow the instructions for adding a data source provided in the Pipeline Pilot server data sources panel help. 4. Click Test to verify the data source is valid, go to step 6. 5. If the test fails, see "Data Sources" on the Administrators tab in the Foundation Pipeline Pilot Help Center to make the corrections. 6. After the data source test passes, click Save. Vault Site Data Source To configure the Vault Site data source: New Installation Overview Page 17

1. Log in to the Foundation Pipeline Pilot Administration Portal. 2. In Admin Pages, click Data Sources. 3. In Data Sources, select the data source. 4. In Name, type the name of your Vault Site read-only database, VAULT_SITE. 5. (Optional) In Description, add a description of the data source. 6. From the Type list, select ODBC (PP) as the connection option. 7. From the Driver list, select Oracle. 8. In Driver Version, select Latest from the list. 9. In Server, type the fully-qualified domain name of the Oracle database server. 10. In Port, type the Oracle database server port number. 11. In ServiceID, type the Oracle database service name. 12. In the Optional DB Username, type the read-only account that you had created for the Vault Site in the file, vaultvariables.site.config. Note: The Optional DB Username and Optional DB Password are required. 13. In the Optional DB Password, type the password associated with the user name. You cannot test the data source connection until after installing BIOVIA Vault Server. RAS Data Source To edit the RAS data source: 1. In to the FoundationPipeline Pilot Administration Portal, in Admin Pages, click Data Sources. 2. In Data Sources, select the data source. 3. In Name, type the name of your RAS read-only database, RAS. 4. (Optional) In Description, add a description of the data source. 5. From the Type list, select ODBC (PP) as the connection option. 6. From the Driver list, select Oracle. 7. In Driver Version, select Latest. 8. In Server, type the fully-qualified domain name of the Oracle database server. 9. In Port, type the Oracle database server port number. 10. In ServiceID, type the Oracle database service name. 11. In the DB Username, type the RAS User schema owner name, for example, symyxdbuser. Note: The Optional DB Username and Optional DB Password are required. 12. In the DB Password, type the password associated with the user name. Run Vault Server Database Scripts You must have system administrators privileges and Oracle DBA role privileges to configure the database, user accounts, and deploy the database schemas. IMPORTANT! If you are using BIOVIA Direct 9.5 with Oracle 12c you must run the following command as an Oracle system account before running PreInstallCheck.bat: grant inherit privileges on user <system> to C$DIRECT95; for BIOVIA Direct 9.5 Page 18 BIOVIA Vault Server Installation Guide

The BIOVIA Vault Server database installation requires running three scripts that create the tablespaces, user accounts with grants, and Vault schemas, required for Vault to function. Run the installation scripts before installing Vault. Run the database installation scripts on the Vault middle tier computer. To run the database scripts: 1. Open a command in the directory where you extracted the BIOVIA_Workbook_2016.zip. 2. Navigate to the DatabaseScripts folder. 3. Run CreateTablespaces.bat, at the command, type: CreateTablespaces.bat <Oracle_systemuser> <Oracle_systempass> 4. Do one of the following to check for errors: in the command line output or the CreateTablespaces.log file located in \\BIOVIA_Workbook_ 2016\DatabaseScripts\Logs\ folder. 5. Correct any errors before running the next script. 6. Run CreateUserAccounts.bat, at the command, type: CreateUserAccounts.bat <Oracle_systemuser> <Oracle_systempass> 7. Check for errors in the command line output or the CreateUsers.log, CreateVaultRoleAndProfile.log, and SetupRAS.log files located in the \\BIOVIA_ Workbook_2016\DatabaseScripts\Logs\ folder. 8. Correct any errors before running the next script. 9. Run PreInstallCheck.bat located in the \\BIOVIA_Workbook_ 2016\DatabaseScripts\Pre-Install Check Scripts\ folder. Use the instructions for running this script located in the \\BIOVIA_Workbook_ 2016\DatabaseScripts\Pre-Install Check Scripts\ folder. You are prompted to provide Oracle account information. The instructions provide the details required to run the script. 10. Check for errors in the log files. Correct any errors before running the next script. 11. Run the DeployDatabaseSchemas.bat script. After running the script, the message, Deployment Successfully completed displays in the command window. 12. Review the DeploySummary.log for any errors. 13. Run the ReportSchemaState.bat script. 14. After running the script, review the SchemaStateReport.log file located in the \\BIOVIA_ Workbook_2016\DatabaseScripts\Logs\ folder. Note: You can find additional detailed logging in \\BIOVIA_Workbook_2016\DatabaseScripts\logs directory. New Installation Overview Page 19

Install BIOVIA Vault Server IMPORTANT! Permissions required. Log in as a member of the Windows Administrators group. Disable Windows User Access Control (UAC) before running the BIOVIA Vault Server installer. To install BIOVIA Vault Server: 1. Navigate to the Setup.exe located in the folder extracted from the zip file. 2. Double-click to run the Setup.exe. 3. In the Vault Server Setup wizard, on the End-User License Agreement page, click "I accept the terms in the License Agreement", and click Next. 4. In Prerequisites, correct any deficits, and restart the installer, or click Next. For more information, see Vault Server Installation Prerequisites. 5. In Vault Server Setup, provide the information that is relevant for your site. For more information, see Vault Server Set Up Page. 6. Click Save to keep a record of the parameters that you enter in the Vault Server Setup page for future use. 7. In the SMTP Connection fields, type the connection information for using SMTP. 8. In the Pipeline Pilot server Authentication, specify the URL for the Pipeline Pilot server server using https://<server_name>. The URL uses the fully-qualified domain name, for example, https://<pipeline Pilot server_ Name>:HTTPS_port_number. The default port number is 9943. 9. After entering the BIOVIA Pipeline Pilot server URL, click Test, and enter the Pipeline Pilot server user credentials to test the connection. 10. Click Install. 11. Click Finish. Verify Vault Server Installation After installing the BIOVIA Vault Server, you can verify that the server is working properly by launching the Vault Service web pages. Accelrys Deployment Manager RAS Status Vault Web Private Service. Vault Web Service. The URLs for the Vault Web Service and the Vault Web Private Service contain the number 6.6 regardless of the version installed, for example, https://>fully-qualified server name</symyx/vault/6.6/symyx.vault.service/vaultserverservice.svc. If the Vault server is working properly each page displays successfully without errors. To verify the Vault server installation: 1. From Start > All Programs > Accelrys > Vault, click Accelrys Deployment Manager. 2. In the Accelrys Deployment Manager page, test the links. 3. Open the remaining Vault Service pages, and review the contents of the pages. Page 20 BIOVIA Vault Server Installation Guide

Run the Vault Deployment Utility Before the BIOVIA Vault Server environment is uable, you must run the Vault Deployment Utility (VDU) to add the required system objects and default templates to the server. Note: The user logged in to the VDU must not have any BIOVIA Workbook items checked out when running the VDU. To run the VDU: 1. Open a command window. 2. Change the directory to the directory where you extracted the Accelrys_ELN_<version_number> archive file. The VDU file location is \\Accelrys_ELN_<version_number>\VaultDeploymentUtility. 3. Type the following command: VaultDeploymentUtility <server> <domain>\<administrator-user> <password> <deploymenttype> For example: VaultDeploymentUtility server1.xyz.com xyz\vault.admin mypassword new Use the following values in the command: <server> is the fully-qualified domain name for the BIOVIA Vault Server. <domain>\<administrator-user> is the Vault Administrator user and domain that you specified in the vaultvariables.site.config file. <password> is valid password for the Vault Administrator. <deploymenttype> is the type of deployment to execute. For a new installation of BIOVIA Workbook, the value is new. The Vault Deployment Utility could run for an extended period. Your command window output should look similar to the following: New installation deployment steps starting... Begin deployment step (1 of x): Stop Vault Services Successful Begin deployment step (2 of x): Publishing assemblies from C:\version_ number.x\accelrys_eln_6.x\vaultdeploymentutility\assemblies\assemblies.zip. Successful You can leave the VDU running and periodically check on its progress until the VDU is complete. For new BIOVIA Vault Server deployments, the VDU must perform many multiple steps. When all steps are successful, the BIOVIA Vault Server installation is complete. When the utility is complete, the command window displays the following output: Vault deployment completed successfully. Verify that the following Vault Services are running: Vault Client Service, Vault Message Processing Service, Vault Tomcat Server, Vault Workflow Service Install Accelrys Vault Server Page 21

IMPORTANT! If an error occurs, a message displays indication that, At least one deployment step failed. Examine the logs for details of the failure. For more information, see the VaultDeploymentUtility.Debug.log located in the same folder as the VDU executable. If VDU deployment ends due to an error, you must fix the problem, rename the VaultDeploymentUtility.Debug.log, and then, re-run the VDU. Re-running the VDU does not change the current installation, but could return several unsuccessful steps related to: Bootstrapping Users and Groups System namespace ADM System/Release Package NotebookExplorerContextualViewerConfiguration service permission Page 22 BIOVIA Vault Server Installation Guide

Vault Foundation Hub Bootstrapper Run the VaultToHubBootstrapper.exe after you have established a working BIOVIA Vault Server and BIOVIA Workbook environment. The Vault installer registers itself as an application on the BIOVIA Foundation Hub and sets a single application permission for the Vault Administrator, called the Symyx.Administrator Administrator in the Vault database. The remaining application permissions are published to Vault and the Foundation Hub by the Vault Deployment Utility. Before running the VaultToHubBootstrapper.exe, you can add users, groups, and permissions in the BIOVIA Vault Administration Console. After running the VaultToHubBootstrapper.exe and completing any changes you might need to resolve conflicts, you manage users, groups, and permissions in the Foundation Hub. After you complete the bootstrapping, all the Users and Groups that exist in the Hub are displayed in the BIOVIA Vault Administration Console. For example, if you created Users for Compose, the Users and Groups for Compose are displayed in the BIOVIA Vault Administration Console after you complete the bootstrapping of Hub-Vault. The VaultToHubBootstrapper.exe identifies the following conflicts. You should make corrections as needed using the Vault Administration Console. Application permissions assigned to Vault and Workbook users. The Foundation Hub only supports assigning permissions to groups. You must assign Vault and Workbook users to groups with the appropriate application permissions. After the VaultToHubBootstrapper.exe is finalized, application permissions assigned directly to users are ignored by Vault. Vault or Hub groups with different user sets. When the VaultToHubBootstrapper.exe is finalized, the authoritative groups and users are as defined in the Foundation Hub. User or groups with invalid email addresses. Vault allows any string to represent an email address. Foundation Hub requires valid formatted email addresses. If the users and groups have invalid email addresses, the VaultToHubBootstrapper.exe provides the information in the summary report. You must correct the email addresses before finalizing the VaultToHubBootstrapper.exe. The VaultToHubBootstrapper ignores the following conflicts. Foundation Hub resolves the conflicts by overwriting the values that exist in Vault. To resolve the conflicts manually, find: Vault or Hub user accounts with different active statuses. Vault or Hub users with different fullnames. Vault or Hub users or groups with different email addresses. Vault or Hub groups with different descriptions. When you have configured other applications in the Hub such as BIOVIA Pipeline Pilot, BIOVIA Draw, BIOVIA Compose and Capture, and Vault, the VaultToHubBootstrapper.exe creates the service accounts, with names that end with Service Account, for the applications as follows: BIOVIA Draw Service Account Capture Service Account Compose Service Account Foundation Hub Service Account Vault Foundation Hub Bootstrapper Page 23

Pipeline Pilot Service Account Vault Service Account If your Vault Server deployment has a user account that contains Service Account in its name such as with the Print To Notebook Service Account, the Foundation Hub does not accept the user account and displays an error in the bootstrapping application. In BIOVIA Vault Administration Console, change the Fullname for the account by removing the phrase Service Account, for example, Print To Notebook instead of Print To Notebook Service Account. The VaultToHubBootstrapper.exe provides a summary report listing the issues you must resolve. Before running the VaultToHubBootstrapper.exe, assign users to groups that have the same application permissions and resolve invalid email addresses using the BIOVIA Vault Administration Console. Repeat running the VaultToHubBootstrapper.exe until you feel confident that you have resolved the issues. In the event that you need to make changes to users and groups in the BIOVIA Vault Administration Console after finalizing the bootstrapper, see Users, Groups, and Permissions. Run VaultToHubBootstrapper BIOVIA Vault and BIOVIA Workbook users, groups, and permissions are managed in the BIOVIA Foundation Hub. You must run the VaultToHubBootstrapper to update users, groups, and permissions with the Foundation Hub. The VaultToHubBootstrapper tries to synchronize users and groups in the Vault database with users and groups in the Foundation Hub. For example, you might have a user in both systems with different information such as group membership, and email addresses. The VaultToHubBootstrapper synchronization process recognizes the Foundation Hub as the authority. The VaultToHubBootstrapper makes the following changes in the Hub database: If a Vault user or group does not exist in Hub, the user or group is added to Hub. If a Vault group matches a Hub group that has no permission assignments, the Vault permission assignments are added to the Hub group. If a Vault group matches to a Hub group that has no child members, the Vault child memberships are added to the Hub group. As the administrator, you must manually resolve issues that are reported by the VaultToHubBootstrapper. You must run the VaultToHubBootstrapper for initial and upgrade installations of Vault. Typically, no issues appear in the synchronization summary report of an initial installation. To run the VaultToHubBootstrapper.exe: 1. After installing a working environment, open a command prompt. 2. Navigate to <Vault installation location>\utilities. 3. From the Utilities folder, type the following command: VaultToHubBootstrapper.exe The synchronizer produces output similar to the following: Logging into Vault... Checking if valid to run... Logging into Hub... Starting bootstrapper... Bootstrapping Users... Bootstrapping Groups... Bootstrapping Group Membership... Page 24 BIOVIA Vault Server Installation Guide

Bootstrapping Permissions... Launching summary report... The bootstrapper has finished. 4. Read the summary report for issues to resolve manually. For more information, see Vault Foundation Hub Bootstrapper. 5. Do one of the following: Click No, to resolve issues, and then repeat running the VaultToHubBootstrapper. Click Yes, to finalize the synchronization between Vault and the Hub. After selecting Yes, future runs of the VaultToHubBootstrapper produces output similar to the following: E:\vault\Vault\Utilities>VaultToHubBootstrapper.exe Logging into Vault... Checking if valid to run... VaultToHubBootstrap has already been run and finalized, no need to rerun. When the bootstrapping application is completed, all the users and groups that exist in the Foundation Hub are also displayed in BIOVIA Vault Administration Console and BIOVIA Workflow Designer. Users, Groups, and Permissions In BIOVIA Vault Server and BIOVIA Workbook 2016, users, groups, and application permissions are published in BIOVIA Foundation Hub. The following groups and permissions are available in the Foundation Hub for use with Vault and Workbook users. Groups Global Administrator Manages aspects of the Vault server and Workbook client. The Global Administrator is granted Vault Administrator permissions. Users User members include: Message Processing Service Request Management vault.admin Workflow Service Repository Administrators Manage the repositories used by Vault and Workbook. Vault Services Literature Owner Message Processing Service Handles messages for indexing, and keeps the Workflow history current. The Message Processing Service user is a member of the Global Administrators group. Request Management Manages the laboratory work order process for Workbook users to integrate with BIOVIA Request Management. The Request Management user is a member of the Global Administrators group. Vault Foundation Hub Bootstrapper Page 25

vault.admin Performs system administrator tasks. The vault.admin user is a member of the Global Administrators group. Workflow service Manages implemented custom workflows. The Workflow service user is a member of the Global Administrators group. Add Users To add users, log in to BIOVIA with Global Foundation Hub Administrator permissions. You must also assign users to groups with the permissions the user needs to complete their specific responsibilities. You cannot assign permissions directly to users. To add groups: 1. Navigate to the Foundation Hub Home page using a URL similar to the following: https://<server_name>.<domain_name>:<port_number>/foundation/hub 2. Select Admin & Settings. 3. In the Admin and Settings page, under Security, click Users. 4. In the Users page, click Add User. 5. (Optional) In the Add User page, in the First Name field, type the user's first name. 6. In the Last Name field, type the user's surname. 7. (Optional) In the Email field, type the complete and valid email address for the user. 8. From the Group Memberships list, assign the user to a group, and then click Assign. 9. (Optional) Add the user to additional groups by repeating the previous step. 10. Under Account Credentials, click Add. 11. In Add Credential to New Unsaved User, in Username, type the user's account name. 12. From the Identity Provider list, select Domain. 13. In Domain, type the domain for the user account, and click OK. 14. Click OK. Add Vault and Workbook Groups To add the groups, log in to BIOVIA with Global Foundation Hub Administrator permissions. To add groups: 1. Navigate to the Foundation Hub Home page using a URL similar to the following: https://<server_name>.<domain_name>:<port_number>/foundation/hub 2. Select Admin & Settings. 3. On the Admin and Settings page, under Security, click Groups. 4. In Groups, click Add Group. 5. On the Add Group page, in the Name field, type the group name, and click OK. Assign Permissions to Groups You must add permissions to groups rather than directly to users. Log in to BIOVIA Foundation Hub with Global Administrator permissions. Page 26 BIOVIA Vault Server Installation Guide