RE:Anywhere for Remote Access Installation Guide

RE:Anywhere for Remote Access Installation Guide

030508 2008 Blackbaud, Inc. This publication, or any part thereof, may not be reproduced or transmitted in any form or by any means, electronic, or mechanical, including photocopying, recording, storage in an information retrieval system, or otherwise, without the prior written permission of Blackbaud, Inc. The information in this manual has been carefully checked and is believed to be accurate. Blackbaud, Inc., assumes no responsibility for any inaccuracies, errors, or omissions in this manual. In no event will Blackbaud, Inc., be liable for direct, indirect, special, incidental, or consequential damages resulting from any defect or omission in this manual, even if advised of the possibility of damages. In the interest of continuing product development, Blackbaud, Inc., reserves the right to make improvements in this manual and the products it describes at any time, without notice or obligation. All Blackbaud product names appearing herein are trademarks or registered trademarks of Blackbaud, Inc. All other products and company names mentioned herein are trademarks of their respective holder. RE7Enterprise-WebInstallUK-030508

RE:Anywhere for Remote Access Installation Guide INSTALLATION......................................1 Frequently Used Terms.................................................. 2 Overview............................................................. 4 Considerations......................................................... 4 RE:Anywhere and Network Security...................................... 6 Installing RE:Anywhere................................................. 8 Additional Installation Steps for Windows Server 2003...................... 23 POST-INSTALLATION.................................31 Setting Up Correct Security Privileges.................................... 32 Accessing and Logging into RE:Anywhere................................. 43 Navigating in RE:Anywhere............................................ 44 RE:Anywhere and Installing ActiveX Controls............................. 45 Differences between The Raiser s Edge and RE:Anywhere................... 46 Troubleshooting....................................................... 46 INDEX............................................51

What Is In This Guide? In the The RE:Anywhere for Remote Access Installation Guide, you learn how to install and establish security for the Web version of The Raiser s Edge. Considerations on page 4 Installing RE:Anywhere on page 8 Setting Up Correct Security Privileges on page 32 Accessing and Logging into RE:Anywhere on page 43 RE:Anywhere and Installing ActiveX Controls on page 45 Troubleshooting on page 46 How Do I Use These Guides? The Raiser s Edge user guides contain examples, scenarios, procedures, graphics, and conceptual information. Side margins contain notes, tips, warnings, and space for you to write your own notes. To find help quickly and easily, you can access the Raiser s Edge documentation from several places. User Guides. You can access PDF versions of the guides by selecting Help, User Guides from the shell menu bar or by clicking Help on the Raiser s Edge bar in the program. You can also access the guides on our Web site at www.blackbaud.co.uk. From the menu bar, select Support, User Guides. In a PDF, page numbers in the Table of Contents, Index, and all cross-references are hyperlinks. For example, click the page number by any heading or procedure on a Table of Contents page to go directly to that page. Help File. In addition to user guides, you can learn about The Raiser s Edge by accessing the help file in the program. Select Help, The Raiser s Edge Help Topics from the shell menu bar or press F1 on your keyboard from anywhere in the program. Narrow your search in the help file by enclosing your search in quotation marks on the Search tab. For example, instead of entering Load Defaults, enter Load Defaults. The help file searches for the complete phrase in quotes instead of individual words. Icons The following icons are used in the side margins to denote additional information such as notes, warnings, time-savers, or definitions. You can also use these margins to write your own notes.

VI WELCOME The notepad symbol designates a note or tip related to the information in the main text column. The traffic light indicates a cautionary note. Generally, we use this icon to point out a step that may have unwanted results. The clock symbol designates a shortcut or timesaving action. The dictionary symbol designates the definition of a frequently used term.

Installation Contents Frequently Used Terms........................................... 2 Overview........................................................4 Considerations....................................................4 Pre-Installation....................................................4 Installation...................................................... 5 Post-Installation...................................................6 RE:Anywhere and Network Security.................................6 Accessing RE:Anywhere............................................6 Internet........................................................7 Intranet........................................................6 Firewall Issues..................................................7 Examples of Security Options........................................7 RE:Anywhere and The Raiser s Edge Security.......................... 8 Installing RE:Anywhere........................................... 8 Additional Installation Steps for Windows Server 2003................ 23 Procedure Installing RE:Anywhere with a SQL Server database.................... 10 Installing RE:Anywhere with an Oracle database........................16

2 CHAPTER 1 RE:Anywhere for Remote Access expands your office beyond the boundaries of a building or campus. This powerful program gives you the ability to access your database from anywhere in the world hotel rooms, conference centers, or even your home. RE:Anywhere contains many of the features available in The Raiser s Edge. The information you can view and edit is structured similarly in both programs. We have taken advantage of recent advances in Web development tools, and the Web environment itself, to bring you a robust Web version of The Raiser s Edge. RE:Anywhere brings the power of the Internet to your organisation. Frequently Used Terms These terms are used throughout this Installation Guide. Understanding some Internet terminology can be difficult; this section can help you decipher some of the terms. ASP. Short for Active Server Page, a specification for a dynamically created Web page with an.asp extension that contains either Visual Basic or JavaScript code. When a browser requests an ASP page, the Web server generates a page with HTML code and sends it back to the browser. ASP pages are similar to CGI scripts, but they enable Visual Basic programmers to work with familiar tools. ActiveX. ActiveX is a set of technologies enabling software components to communicate with each other in a networked environment, regardless of the programming language in which the components were created. It is used primarily to develop interactive content for the World Wide Web. Cache. Cache is computer memory with a very short access time. A computer uses it to store frequently used instructions or data. Most Web browsers have a cache setting that stores recently used objects (such as Web pages) for quick viewing. This cache is used primarily for your browser s Back button or on Web sites with the same images on multiple pages. Domain. A group of computers and devices on a network. Domain name. A name that identifies one or more computers on the network. Domain names are also used in Web addresses (see URL). For example, blackbaud.com is the domain name of our Web server located at http://www.blackbaud.com. Encrypted. The translation of data into a secret code. Encryption is the most effective way to achieve data security. FAT. Short for File Allocation Table. An operating system uses this table to locate files on a disk. Firewall. A system designed to prevent unauthorised access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorised Internet users from accessing private networks, especially Intranets, connected to the Internet. All messages entering or leaving the Intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria. FTP. Short for File Transfer Protocol, the protocol used on the Internet for sending files.

I NSTALLATION 3 HTML. Short for Hyper Text Markup Language, the authoring language used to create documents on the World Wide Web. IE. Short for Internet Explorer, Microsoft s Web browser that enables you to view Web pages. IE is a graphical browser, which means it can display graphics as well as text. It can also present multimedia information, including sound and video. IIS. Short for Internet Information Server, Microsoft s software that turns regular Windows servers into Web servers. Internet Service Provider. See ISP. Intranet. A network within an organisation accessible only by the organisation's members, employees, or others with authorisation. IP address. An identifier for a computer or device on a TCP/IP network. Networks using the TCP/IP protocol route messages based on the IP address of the destination. The format of an IP address is a 32-bit numeric address written as four numbers separated by periods. Each number can be zero to 255. For instance, 172.20.0.0 could be an example of an IP address. ISP. Short for Internet Service Provider, a company that provides access to the Internet. NetBIOS. Short for Network Basic Input Output System, an application programming interface (API) that augments the DOS BIOS by adding special functions for local area networks (LANs). Almost all LANs for PCs are based on the NetBIOS. Some LAN manufacturers have even extended the NetBIOS, adding additional network capabilities. NTFS. Short for NT File System. Windows NT and Windows 2000 can use this system to help keep track of the files on the computer. NTFS provides more security control for the file system than FAT. Protocol. An agreed-upon format for transmitting data between two devices. The protocol determines the following: the type of error checking used data compression method (if any) how the sending device indicates it has finished sending a message how the receiving device indicates it has received a message TCP/IP. Short for Transmission Control Protocol/Internet Protocol, the suite of communications protocols used to connect hosts on the Internet. TCP/IP uses several protocols, the two main ones being TCP and IP. TCP/IP is the de facto standard for transmitting data over networks. Even network operation systems with their own protocols, such as NetWare, support TCP/IP. URL. Short for Uniform Resource Locator, the global address of documents and other resources on the World Wide Web. For example, the URL of Blackbaud s Web site is http://www.blackbaud.co.uk. Username. A name used to gain access to a computer system. Usernames, and often passwords, are required in multi-user systems. In most such systems, users can choose their own usernames and passwords. Virtual directory. A directory name used in an address that corresponds to a physical directory on a Web server.

4 CHAPTER 1 Web browser. A software application used to locate and display Web pages. Microsoft Internet Explorer is a Web browser. Web server. A computer that delivers (serves up) Web pages. Every Web server has an IP address and possibly a domain name. Any computer can be turned into a Web server by installing Web server software and connecting the machine to the Internet. Overview RE:Anywhere is designed to give you the power of The Raiser s Edge on the Web. It delivers data from your Raiser s Edge database to your users through a Web server. The data is then presented to a Web browser (Internet Explorer 5.x) using Web pages and forms. Changes to data can be made on the forms and sent back to the Web server where the information is processed, stored, and saved in the database. A network connection ensures data is transferred successfully between the database, Web server, and browser. When using RE:Anywhere on the Internet, you should set up proper security to limit access to your database. Blackbaud does not accept any responsibility for incursion into your system. You should use knowledgeable technical staff or consulting services to determine your organisation s security needs. For more information about security, see RE:Anywhere and Network Security on page 6 and chapter two, Post-Installation. Considerations Please read this entire guide before beginning the RE:Anywhere installation. When installing RE:Anywhere you should consider the following: Pre-Installation Hardware requirements are subject to change and updated as necessary. We recommend visiting www.blackbaud.com for the most recent hardware requirements. Make sure your hardware meets the minimum processing speed and memory requirements. For more information about system requirements, see the hardware specifications document on our Web site at www.blackbaud.com/products. Additionally, RE:Anywhere requires a mouse to navigate some fields and screens and should be viewed on monitors with an 800 x 600 or higher resolution. Make sure you have a CD-ROM drive you can access from the Web server. Set up your Web server s Internet connection if you want to use RE:Anywhere to access your database from the Web. To set up your Internet connection, contact your local Internet Service Provider (ISP). Your ISP can also register your domain name. For the Web server, RE:Anywhere is developed to run on Microsoft s Internet Information Server (IIS), version 5 or 6. IIS 5 is included in Windows 2000. Windows Server 2003 includes IIS 6. If you are using Windows Server 2003, you must specify some additional settings in IIS after installation. For more information, see Additional Installation Steps for Windows Server 2003 on page 23.

I NSTALLATION 5 Set up a permanent connection between your Web server and Raiser s Edge database. Please read RE:Anywhere and Network Security on page 6 of this guide for important information in setting up and maintaining your Web environment. Install The Raiser s Edge 7 workstation components on your Web server and log into your Raiser s Edge database at least once before you install The Raiser s Edge for the Web. We strongly recommend you use separate database and Web servers. However, if you are using the same server for both your database and Web site, do not install the client components as part of the deploy package. The database server installation automatically installs client components on the server. For security reasons, we strongly recommend you install both The Raiser s Edge 7 and RE:Anywhere to directories on local drives formatted with the NTFS file system. This will allow you to tightly control secure access to the files on your Web server. FAT formatted hard disks are not secure. Install Microsoft Internet Explorer, version 5.x or higher on your Web server (if not already installed). For the workstation, Microsoft s Internet Explorer (IE), version 5.x is also required. IE version 5.x installs automatically with The Raiser s Edge 7. IE version 5.x has been tested and certified by Blackbaud to work reliably with RE:Anywhere. Other browsers are not supported and may not display or operate correctly with RE:Anywhere. Plan your Web and network security. For more information about security, see RE:Anywhere and Network Security on page 6. If you want to preview reports on RE:Anywhere, you must install a printer driver to your Web server before you install RE:Anywhere. A printer does not have to be connected to the server, but the driver must be installed and designated as the default printer. This action must be performed under the Administrator account. Reports will still print at the user s computer, not at the Web server. If you use NTFS formatted drives, you should specify that the printer be shared. If you are using the same server for your database and Web site, do not install the client components as part of the deploy package. The database server installation automatically installs client components on the server. Installation Log in as Administrator. If you are performing a manual installation, know the names of your Raiser s Edge database and server, or the name of your Oracle Service. If you do not know this information, contact your system administrator. You can also find this information in the Blackbaud Management Console.If you select the Use Deployment Information option during installation, the RE:Anywhere setup program automatically obtains this information from the Blackbaud Management Console. Know what server protocol you want to use to connect the Web server and the database server. We strongly recommend TCP/IP; however, the protocol you use depends on the protocol specified on the Raiser s Edge database server. If you do not know which protocol you are using, contact your system administrator. This information is also available on the Blackbaud Management Console when you click the Databases option.

6 CHAPTER 1 Post-Installation Change the Supervisor password in RE:Anywhere. Set up security. For more information about configuring security, see chapter two, Post-Installation. To create letters or email directly from a constituent record you must specify some Internet Explorer security settings on client machines. Additionally, on client machines with Office XP, service pack 3 or greater must be installed. For more information, see Browser Settings for Creating Letters and Email from Constituent Records on page 41. RE:Anywhere and Network Security For more information on SSL installation and configuration, consult your IIS documentation and the Microsoft and VeriSign Web sites. One of the most important decisions you have to make when planning the configuration of RE:Anywhere is how to allow secure access to your database from your Web server. With the variety of possible network configurations available, this becomes a complex issue with many solutions. No matter which security configuration you select, you should enable your IIS server to run Secure Socket Layer (SSL). SSL provides a level of encryption to all incoming and outgoing HTTP requests equal to that of an online banking or secure e-commerce site. SSL affords a level of safety while the information travels on the Internet. This section outlines basic issues to provide you with information you need to make decisions for your organisation. We recommend you discuss these options with your Network Administrator, Firewall Vendor, or Internet Service Provider. Accessing RE:Anywhere There are two possible options for accessing RE:Anywhere based on whether your users are physically located outside the organisation and accessing the database through the Internet, or whether they are located inside it and accessing the database through an intranet. Intranet RE:Anywhere can run on a Web server within your organisation accessible only to those logged onto your internal network. This method is secure, since all users have to be authenticated as valid users of your internal network before gaining access to RE:Anywhere, but it does not allow access to the program directly from your Web site. This solution requires users located outside your organisation to dial into your network. This may not be feasible for a large number of simultaneous users, depending on your hardware available for such access.

I NSTALLATION 7 Internet RE:Anywhere can run on a Web server visible on the Internet through your ISP, allowing you to access the Web site from a browser through an Internet connection provided by an ISP (such as Earthlink or America Online). However, the Web server must be physically located on the same network as the Raiser s Edge database, it cannot be hosted by your ISP. With this method, others may be able to see your Web site but will be unable to log in without a Raiser s Edge for the Web login name and password. You should have a firewall in place to prohibit unauthorised access to your internal network through your organisation s Internet connection. If such a firewall exists between the Web server and your internal network, then you must consider how you will allow access to your Raiser s Edge database from your Web server. This is discussed further in the following section, Firewall Issues. Firewall Issues If you plan to install RE:Anywhere on an Internet server, you need to consider where to place the database. Users within your organisation probably access The Raiser s Edge database through The Raiser s Edge 7 desktop application. For this reason, your database most likely needs to be on your organisation s network, behind the firewall. This is the safest place for your database and reduces the chances of unauthorised access. How do you allow the Web server to access the database through the firewall? You have more than one option or combination of options to accomplish this; you should consider all of them carefully. Your options depend on the make and model of your firewall software. Work with knowledgeable technical staff or consultants to determine your organisation s needs. A Firewall vendor and Internet Service Provider may also have good suggestions. Listed below are a few possible options. Blackbaud does not accept any responsibility for incursion into your system. It is your organisation s responsibility to ensure your system is secure. Work with a firewall security consultant to decide the best way to set up your system. Examples of Security Options Open a pinhole in your firewall. A pinhole is created by allowing access only through a particular port in your firewall. In the case of RE:Anywhere, you can allow database transactions to pass through the port assigned only to your database. Some firewalls have a feature known as packet filtering. This option permits specific IP addresses to have access through your firewall. All your internal computers have IP addresses. Packet filtering allows computers with these pre-defined IP addresses to access internal machines (in our case, the database server) from the Web server through the firewall. A filter is added between the Web server and the Internet to prohibit access to the Web server unless a pre-defined address is used. Additionally, you can use Secure Socket Layer (SSL). SSL is a data security method available as part of your IIS program. SSL encrypts all data passing between the Web browser and the client. The data is secure while in transit through the firewall and decrypted once the client accesses it. If your Web server is communicating with your database through a firewall, be sure you do not configure your firewall to filter UDP packets. Adaptive Server Anywhere TCP/IP uses UDP packets to communicate. UDP is the default filter on most firewalls.

8 CHAPTER 1 RE:Anywhere and The Raiser s Edge Security RE:Anywhere is designed to respect the security settings you specify in Administration in The Raiser s Edge. Users of RE:Anywhere are granted or denied access to information based on your security settings in The Raiser s Edge. In The Raiser s Edge Enterprise, you can integrate Windows authentication so that users are able to access The Raiser s Edge through their Windows log in information without the need to enter a Raiser s Edge user name or password. To enable the use of integrated Windows authentication logins in RE:Anywhere, the IIS Virtual Directory containing the RE:Anywhere application must be configured to support a non-anonymous authentication mode. This enables the connecting user to be authenticated to an existing Windows domain account instead of through the anonymous account. Consult your IIS documentation for information about how to configure your virtual directory appropriately, and see the following Microsoft knowledgebase articles for additional information. Windows 2000: http://support.microsoft.com/default.aspx?scid=kb;en-us;308160 Windows Server 2003: http://support.microsoft.com/default.aspx?kbid=324274 Installing RE:Anywhere You should shut down your Web server service before you begin installing RE:Anywhere. You must stop your Web server service when you install RE:Anywhere. If you do not, a screen appears during the installation process informing you that the installation program will shut down the Web server. If it shuts down the Web server service, the installation program automatically restarts it when RE:Anywhere installation is complete. When you install RE:Anywhere, the setup program performs several functions, including: Creating the directory of your choice on your hard drive in which to place RE:Anywhere files. Locating your pre-installed The Raiser s Edge 7 client program and adding additional program files to its subdirectories. Creating a number of subdirectories under the RE:Anywhere installation directory. Creating a Virtual Directory (REWeb70) to the RE:Anywhere installation directory and granting the anonymous user rights to read and execute the contents of the directory and the contents of all its subdirectories. Configuring the Virtual Directory to be an IIS Web Application Directory and setting it to run In-Process with IIS. Installing the Seagate Crystal Reports ActiveX and Java Smartviewers in a subdirectory of the RE:Anywhere installation and creating a Virtual Directory (REWeb70Viewers) for them. Separate procedures are included for installing RE:Anywhere with SQL Server and Oracle databases. If you are using a SQL Server database, see Installing RE:Anywhere with a SQL Server database on page 10.

I NSTALLATION 9 If you are using an Oracle database, see Installing RE:Anywhere with an Oracle database on page 16. Also, a few additional steps must be taken after you install RE:Anywhere on a Windows 2003 server. For more information about these steps, see Additional Installation Steps for Windows Server 2003 on page 23.

10 CHAPTER 1 Installing RE:Anywhere with a SQL Server database If you want to preview reports and mailings, you must install a local shared printer driver on your Web server before you install RE:Anywhere. 1. From your Web server, insert the Blackbaud CD into the CD-ROM drive. 2. From Windows, select Run from the Start button on the taskbar and type D:\REWEB\SETUP.EXE, where D is the location of (or complete path to) the CD-ROM drive. Setup begins. If you do not have any printer drivers installed on your Web server, a message appears. To preview reports and mailings, you must have a printer driver installed on your Web server before installing RE:Anywhere. If you use NTFS formatted drives, you must specify that the printer is shared. 3. To preview reports and mailings, you must have a local printer driver installed onto the Web server before you install RE:Anywhere. Click Yes to cancel RE:Anywhere installation so you can install a printer driver on your Web server. The driver must be installed on the Administrator user name profile (the same user name you log in under to install RE:Anywhere). You must specify that the printer be shared. If you do not want to install a printer driver at this time, click No to continue. However, we strongly recommend you install a printer driver on your Web server before you install RE:Anywhere so you will be able to preview reports and mailings.

I NSTALLATION 11 The InstallShield Wizard screen appears. 4. Click Next. A screen with The Raiser s Edge for the Web licence agreement appears. 5. If you accept the terms of the licence agreement, click Yes. A status screen appears.

12 CHAPTER 1 If the setup program determines that you have the proper Internet Server components installed on your Web server, a screen appears where you can select a configuration method. Certain security and firewall settings may prevent RE:Anywhere setup program from accessing the Blackbaud Management Console. In these cases, you must use the Manually Enter Database Information configuration option. 6. To continue the installation, the RE:Anywhere setup program needs the server and database name of your Raiser s Edge 7 database server. If you want the setup program to access the Blackbaud Management Console and obtain this information, mark the Use Deployment Information option and proceed to the next step in this procedure. If you want to enter your server and database name manually, mark the Manually Enter Database Information option and proceed to step 9. 7. Click Next. The Deployment Output Location screen appears.

I NSTALLATION 13 8. Browse to the directory on your network in which you created your deployment package with the Deployment Wizard in the Blackbaud Management Console. Proceed to step 11 of this procedure. 9. Click Next. If you selected the Manually Enter Database Information option, a screen appears where you can enter your server and database information. 10. Enter the name of the Server on which your database is located. Enter the name of your Database. The database name is assigned in the Blackbaud Management Console. If you are unsure of your Server or Database names, you can find them in the Blackbaud Management Console, or check with your database administrator. 11. Click Next. If the setup program detects more than one virtual Web site on your Web server, a screen appears so you can select the site to which you want to install the virtual directories for The Raiser s Edge for the Web.

14 CHAPTER 1 If you have only one virtual Web site on your server, the installation defaults to that site and this screen does not appear. 12. In the Web Sites field, select the Web site to which you want to install the program. 13. Click Next. A screen appears where you can select the destination for The Raiser s Edge for the Web files. 14. Specify the directory where you want to install the RE:Anywhere server application files. The default location is based on the location of the virtual Web site to which the program s virtual directories will be installed. Use Browse, if necessary, to select a new location.

I NSTALLATION 15 15. Click Next to begin installing files and creating the virtual directory. A screen appears where you can select the program folder for RE:Anywhere. 16. Specify the name of the RE:Anywhere folder that will be created. The default is The Raiser s Edge For the Web 7. You can change the name or select an existing folder in the list. 17. Click Next. A status screen displays information about the installation process.

16 CHAPTER 1 When the installation is finished, the Setup Complete screen appears. We strongly recommend you set up security privileges for RE:Anywhere as soon as you finish the installation process. 18. Before you can log into RE:Anywhere, you must restart your computer. Check an option to indicate whether you want to restart your computer now or later. 19. Click Finish. Follow the instructions in the Accessing and Logging into section of the Installation Guide to begin using RE:Anywhere. We strongly recommend setting up security privileges for RE:Anywhere as soon as you finish the installation process. See the following chapter of this book for more information about setting up security. Installing RE:Anywhere with an Oracle database If you want to preview reports and mailings, you must install a local shared printer driver on your Web server before you install RE:Anywhere. 1. From your Web server, insert the Blackbaud CD into the CD-ROM drive.

I NSTALLATION 17 2. From Windows, select Run from the Start button on the taskbar and type D:\REWEB\SETUP.EXE, where D is the location of (or complete path to) the CD-ROM drive. Setup begins. If you do not have any printer drivers installed on your Web server, a message appears. 3. To preview reports and mailings, you must have a local printer driver installed onto the Web server before you install RE:Anywhere. Click Yes to cancel the RE:Anywhere installation so you can install a printer driver on your Web server. The driver must be installed on the Administrator user name profile (the same user name you log in under to install RE:Anywhere). You must specify that the printer be shared. If you do not want to install a printer driver at this time, click No to continue. However, we strongly recommend you install a printer driver on your Web server before you install RE:Anywhere so you will be able to preview reports and mailings. To preview reports and mailings, you must have a printer driver installed on your Web server before installing RE:Anywhere. If you use NTFS formatted drives, you must specify that the printer is shared.

18 CHAPTER 1 The InstallShield Wizard screen appears. 4. Click Next. A screen with The Raiser s Edge for the Web licence agreement appears. 5. If you accept the terms of the licence agreement, click Yes. A status screen appears.

I NSTALLATION 19 If the setup program determines that you have the proper Internet Server components installed on your Web server, a screen appears where you can select a configuration method. 6. To continue the installation, the RE:Anywhere setup program needs the Oracle Service name of your Raiser s Edge 7 database server. If you want the setup program to access the Blackbaud Management Console and obtain this information, mark the Use Deployment Information option. If you want to enter the service name manually, mark the Manually Enter Database Information option and proceed to step 9. 7. Click Next. The Deployment Output Location screen appears. Certain security and firewall settings may prevent RE:Anywhere setup program from accessing the Blackbaud Management Console. In these cases, you must use the Manually Enter Database Information configuration option.

20 CHAPTER 1 8. Browse to the directory on your network in which you created your deployment package with the Deployment Wizard in the Blackbaud Management Console. Proceed to step 11 of this procedure. 9. Click Next. The Raiser s Edge 7 Database screen appears. 10. Enter your Oracle Service name. If you do not know your Oracle Service name, contact your system administrator. You can also find this information in the Blackbaud Management Console. From the console, click the Databases link. 11. Click Next. A screen appears where you can enter Server Protocol Options. 12. Select your server protocol: TCP/IP, NetBIOS, SPX, or IPX. This should be the same protocol used on your Raiser s Edge database server.

I NSTALLATION 21 13. Click Next. If the setup program detects more than one virtual Web site on your Web server, a screen appears so you can select the site to which you want to install the virtual directories for The Raiser s Edge for the Web. If you have only one virtual Web site on your server, this screen does not appear. 14. In the Web Sites field, select the Web site to which you want to install the program. 15. Click Next. A screen appears where you can select the destination for The Raiser s Edge for the Web files.

22 CHAPTER 1 16. Specify the directory where you want to install the RE:Anywhere server application files. The default location is based on the location of the virtual Web site to which the program s virtual directories will be installed. Use Browse, if necessary, to select a new location. 17. Click Next to begin installing files and creating the virtual directory. A screen appears where you can select the program folder for RE:Anywhere. 18. Specify the name of the RE:Anywhere folder that will be created. The default is The Raiser s Edge For the Web 7. You can change the name or select an existing folder in the list. 19. Click Next. A status screen displays information about the installation process.

I NSTALLATION 23 When the installation is finished, the Setup Complete screen appears. 20. Before you can log into RE:Anywhere, you must restart your computer. Check an option to indicate whether you want to restart your computer now or later. 21. Click Finish. Follow the instructions in the Accessing and Logging into section of the Installation Guide to begin using RE:Anywhere. We strongly recommend setting up security privileges for RE:Anywhere as soon as you finish the installation process. See the following chapter of this book for more information about setting up security. Additional Installation Steps for Windows Server 2003 We strongly recommend you set up security privileges for RE:Anywhere as soon as you finish the installation process. To run RE:Anywhere on Windows Server 2003, you must perform several additional steps after the installation completes. You need to enable sub-authentication in IIS. Windows Server 2003 includes IIS 6. In earlier versions of IIS, by default you could use sub-authentication to manage passwords on anonymous accounts. IIS 6 does not enable sub-authentication by default. However, you can enable sub-authentication to manage passwords for anonymous accounts using the following steps: Register IISSubA.dll. Click Start, Run and enter the following command: rundll32.exe c:\windows\system32\iissuba.dll,registeriissuba Note that c:\windows is the default path for the Windows folder in Windows Server 2003. If your installation uses a different path, you must adjust the command accordingly.

24 CHAPTER 1 In IIS 6, run all worker processes using Anonymous authentication as Local System. This means that on the Identity tab of the Application Pool used by RE:Anywhere, the Local System setting must be selected.

I NSTALLATION 25 In IIS 6, set the status of the Web Service Extension for Server Side Includes and Active Server Pages to Allowed. You must map the.fun file extension to the MIME type of application/x-javascript. This enables files containing client-side JavaScript functions to be downloaded and cached for better performance. Open My Computer and select Manage. Expand Services and Applications on the Computer Management tree view.

26 CHAPTER 1 Right-click on Internet Information Services (IIS) Manager and select Properties from the menu. Click MIME Types. A screen appears listing file extensions in alphabetical order.

I NSTALLATION 27 Scroll through the list of extensions and look for the.fun extension. If it is in the list and mapped to the application/x-javascript MIME type, you need not do anything more. If the.fun extension does not appear in the list, click New. Enter.fun as the extension and application/x-javascript as the MIME type, and click OK. To preview reports and mailings, a new Application Pool needs to be added to IIS (based on the default pool). The Report Viewer application then needs to be set to use this pool. Open My Computer. Select Manage, Internet Information Services. Right-click on Application Pools and select New Pool.

28 CHAPTER 1 Specify a name and select to use existing pool as a template and choose DefaultAppPool. The identity of the new pool can be left at Network Service as long as DefaultAppPool is set to Local System. Under Web Sites, select ReWebRepView70, right-click and select Properties. Under Virtual Directory, Application Pool, select the new application pool created above. During installation the setup program automatically performs these functions: Sets the application-level metabase property AnonymousPasswordSync to True. Sets the application-level metabase property AspEnableParentPaths to True. Creates a script mapping for the.fun extension (client-side JavaScript include files).

After enabling sub-authentication, adding the.fun extension, and adding a new application pool in IIS 6, you must specify security settings for RE:Anywhere. Establish the same settings detailed in Security Rights for Anonymous Users on page 37. Then, for Windows Server 2003 you must create an additional setting. If The Raiser s Edge is a network server installation, the BBREWeb7Group may need to be given read and write permissions for \Program Files\Common Files\Blackbaud (or its equivalent if you installed to another directory). I NSTALLATION 29

30 CHAPTER 1

Post-Installation Contents Setting Up Correct Security Privileges.............................. 32 Anonymous User Security......................................... 32 Security Rights for Anonymous Users................................ 37 Additional Security Settings for RE:Anywhere Dashboards............... 38 Setting Up a More Secure Site Without Anonymous Access............... 38 Additional Security Settings for Oracle Databases...................... 40 Browser Settings for Creating Letters and Email from Constituent Records... 41 Accessing and Logging into RE:Anywhere.......................... 43 Navigating in RE:Anywhere...................................... 44 RE:Anywhere and Installing ActiveX Controls....................... 45 Differences between The Raiser s Edge 7 and RE:Anywhere........... 46 Troubleshooting................................................ 46 Procedures Setting anonymous user access permissions............................ 33 Specifying additional security settings for Oracle databases............... 40 Setting up a more secure site without anonymous access................. 39 Accessing and logging into RE:Anywhere............................. 43 Loading ActiveX features into RE:Anywhere.......................... 45 Determining which account is used when a user logs into the Web server as an Anonymous user.............................................. 48

32 CHAPTER 2 Setting Up Correct Security Privileges After installing RE:Anywhere, you need to set access privileges to some files from Windows Explorer. During installation, the setup program creates a user group called BBReweb7Group. The anonymous user is automatically added to this group. If you want to change the anonymous user, you can add the new user to BBReweb7Group and that user inherits all the security rights of the group. The RE:Anywhere setup program defaults the Anonymous User to the same Anonymous User account used by IIS. Some additional security settings are needed to enable functions such as previewing reports and viewing query results with an Oracle database. For more information about these settings, see Additional Security Settings for Oracle Databases on page 40. In Windows 2000 and 2003, you can set up security for anonymous users, or you can set up a more secure site that does not use anonymous access. If you do not want to use anonymous access, you can disable it after the RE:Anywhere install. If you do so, make sure you follow the instructions in Setting up a more secure site without anonymous access on page 39 to grant appropriate privileges to users accessing RE:Anywhere. Anonymous User Security The following instructions assume you are operating your Web server with an Anonymous User account. The RE:Anywhere setup program automatically assigns the Anonymous User account to the BBReweb7Group user group. Therefore, by setting security privileges for this group, you set access rights for your anonymous users. The Anonymous User account is used by all Web browsers when accessing files on the Web server. File and directory security rights you grant to this account will be the rights for all individuals accessing your Web server while browsing RE:Anywhere. The Anonymous User account is created by the IIS installation. The account is typically a local Windows account on the server with the name IUSR_<machine name>. If you are not sure which user account is your anonymous user and you want to find out, see Determining which account is used when a user logs into the Web server as an Anonymous user on page 48 of this guide.

P OST-INSTALLATION 33 Setting anonymous user access permissions During installation, the BBReweb7Group is created and the Anonymous user account is automatically added to this user group. Therefore, you can set access permissions for anonymous users by establishing settings for the BBReweb7Group. You must establish security for several directories. This procedure shows how to establish access permissions for the REWeb70 directory, but you can apply similar steps for other directories. See the table on page 37 for a full list of the directories and corresponding security settings you need to establish. 1. Open Windows Explorer or My Computer and locate the directory where you installed RE:Anywhere. The default directory is based on the location of the virtual Web site to which you installed RE:Anywhere s virtual directories. 2. Select the REWeb70 folder. 3. Right-click and a shortcut menu appears. Select Properties.

34 CHAPTER 2 4. Select the Security tab on the REWeb70 Properties screen. 5. To add the Reweb7Group to this list and give the group read and execute rights to the REWeb70 directory, click Add. The Select Users, Computers, or Groups screen appears. 6. Select your Web server in the Look in field. The BBReweb7Group should list in the Name column. 7. Select the BBReweb7Group and click Add.

P OST-INSTALLATION 35 8. Click OK. The REWeb70 Properties screen appears. The BBReweb7Group appears in the Name box. 9. To set permissions for the REWeb70 directory, check the Allow checkbox in the Read & Execute and Read rows. The settings you establish here will vary according to the directory for which you are establishing security. Some subdirectories require you to set more advanced rights (such as Delete). See the table on page 37 for a full list of the directories and corresponding security settings you need to establish. When you do not want a directory to inherit permissions from a parent folder, do one of two things. Either uncheck the Allow inheritable permissions from parent to propagate this object checkbox or check the opposite permission (Allow or Deny) to override the inherited permission.

36 CHAPTER 2 10. To set advanced access rights for a directory, click Advanced. The Access Control Settings screen appears. When setting rights for the RE7 SysDB, RE7 DLL, RE7 RPT, and RE7 TLB directories, you must check the Reset permissions on all child objects and enable propagation of inheritable permissions checkbox. See the table on page 37 for a full list of the directories and corresponding security settings you need to establish.

P OST-INSTALLATION 37 11. In the Permission Entries box, select the BBReweb7Group and click View/Edit. The Permission Entry screen appears. On the Permission Entry screen, you can check checkboxes to allow other rights such as Delete. When setting security for the REWeb70 directory only, check the Apply these permissions to objects and/or containers within this container only checkbox. For the other directories, leave the checkbox unchecked. 12. When you finish setting advanced rights, click OK. You return to the Access Control Settings screen. 13. Click OK. You return to the Properties screen. 14. Click OK. Repeat this procedure using the table on page 37 to assign appropriate rights to subdirectories for the BBReweb7Group. Check the Apply these permissions to objects and/or containers within this container only checkbox only when you set security for the REWeb70 directory. Security Rights for Anonymous Users The following table shows the permissions you must set in various directories on the Web server for the BBReweb7Group. The permissions include Read (R), Read and Execute (X), and FULL rights. Set the permissions so that they propagate down to all subdirectories and files within the specified directory. Directory or File Directory Permissions File Permissions Example Description RE7 Directory RX RX C:\Program Files\Blackbaud\The Raiser's Edge Raiser s Edge 7 install. This setting is necessary to enable Dashboards

38 CHAPTER 2 Directory or File Directory Permissions File Permissions Example Description RE7 SysDB Directory Program Files\Common Files\ System directory Program Files\Common Files\ Blackbaud directory FULL FULL C:\Program Files\Blackbaud\The Raiser's Edge\SYSDB RX RX C:\Program Files\ Common Files\ System RX RX C:\Program Files\ Common Files\ Blackbaud Subdirectory of The Raiser s Edge 7 install Contains ADO, MSADC, and OLE DB components Every directory above the REWeb70 install directory R R C:\ Needed to support FTP Exports from The Raiser s Edge 7 REWeb70 Directory and subdirectories FULL FULL C:\Inetpub\wwwroot\ REWEB70 Directory to which you installed RE:Anywhere Windows Temp directory FULL FULL C:\Windows\temp Windows system temp directory. This is not defined by default, you must add it in the Windows Control Panel. System32 directory RX RX C:\Windows\ System32 msvcp60.dll needed to support previewing reports. Additional Security Settings for RE:Anywhere Dashboards In order to use Dashboards, you must give the BBReweb70Group Full Control on the REWeb70 Temp subdirectory. Also, the BBReweb70Group should include the local user starting with IWAM_ (as long as such a user exists it does by default). The local user SYSTEM must also have Full Control over the REWeb70 Temp subdirectory. Setting Up a More Secure Site Without Anonymous Access A more secure alternative to the default setup of RE:Anywhere is to not use anonymous access. Instead, you can explicitly create a local Windows 2000 or 2003 group on your Web server, assign security rights to the group, and add each of your Raiser s Edge for the Web users to the group. You can then disable anonymous access to the RE:Anywhere Virtual Directory (REWeb70) using the Property menu command in the Internet Service Manager and enable only integrated Windows authentication.

P OST-INSTALLATION 39 Setting up a more secure site without anonymous access 1. From your Windows taskbar, click Start. Select Programs, Control Panel. From the Control Panel, select the Administrative Tools folder. Select Internet Services Manager. The Internet Information Services screen appears. 2. In the treeview on the left, click the plus sign beside Default Web Site. Select the REWeb70 folder. 3. Right-click and select Properties. 4. The REWeb70 Properties screen appears. Select the Directory Security tab.

40 CHAPTER 2 5. Click Edit in the Anonymous access and authentication control frame. The Authentication Methods screen appears. 6. Uncheck the Anonymous access checkbox. Not allowing anonymous access provides a higher level of security for your data by limiting users who can access your system. 7. Click OK. You return to the REWeb70 Properties screen. Now you must assign each of your Raiser s Edge users to the BBReweb7Group. If you have not already done so, apply the privileges outlined in the table on p. 37 to the group. As each user browses to the login page of RE:Anywhere, he will be asked to log into the network with his Windows 2000 account before logging into RE:Anywhere. Additional Security Settings for Oracle Databases In addition to the security settings for the directories on page 37, with Oracle databases, you must establish additional security settings to enable functions such as report previewing and printing, and viewing query results. Specifying additional security settings for Oracle databases 1. Stop and start the Oracle MTS Recovery service. For more information about this service, see the Oracle documentation at www.oracle.com. 2. Reset your installation of Internet Information Server (IIS). You can reset IIS from the command line using the iisreset command. For information about resetting IIS, see your IIS documentation. 3. Using Windows Explorer, locate your Ora92 directory.

P OST-INSTALLATION 41 4. Right-click on the Ora92 directory and select Properties. The Properties screen appears. 5. Select the Security tab. 6. In the Name box, select the BBReweb7Group. In the Allow column, check the Full Control checkbox. 7. Click OK to save your changes. Browser Settings for Creating Letters and Email from Constituent Records To create letters and emails directly from constituent records in RE:Anywhere, you need to specify several settings in Internet Explorer on client workstations. These settings do not need to be established on the server (unless you also plan to use the server as a client). Additionally, if you have Office XP, you must install service pack 3 or later. You must first include the RE:Anywhere server in an Internet Explorer Security Zone for which you feel safe manipulating the settings. For information about Security Zones and how to configure them, see the Internet Explorer help file.

42 CHAPTER 2 Then you must specify several settings for the Security Zone in which you included the RE:Anywhere server. From the Internet Explorer Tools menu, select Internet Options. Select the Security tab. Select the zone in which you placed the RE:Anywhere server and click Custom Level. The Security Settings screen appears. Under ActiveX controls and plug-ins, Download signed ActiveX controls, select either Enable or Prompt.

P OST-INSTALLATION 43 Under ActiveX controls and plug-ins, Run ActiveX controls and plug-ins, select either Enable or Prompt. Under ActiveX controls and plug-ins, Script ActiveX controls marked safe for scripting, select either Enable or Prompt. Under Miscellaneous, Access data sources across domains, select either Enable or Prompt. If you select Prompt, when you save a document or email as an action from Office, you must first return to your browser and click Yes on a message that states This page is accessing a data source on another domain. Do you want to allow this? before the item can save. If you have Microsoft Office XP installed, you need to install service pack 3 or later. To do so, go to http://office.microsoft.com, locate the Office Update link, and follow the instructions. Accessing and Logging into RE:Anywhere During installation, RE:Anywhere is added to the Program menu on your Web server. You can access RE:Anywhere from this menu or from Internet Explorer. Accessing and logging into RE:Anywhere 1. From your Web server, select Programs, The Raiser s Edge for the Web from the Start menu. Select REWeb7 to go to the Log in screen for RE:Anywhere. 2. To access RE:Anywhere from a workstation using Internet Explorer, type http://webservername/reweb70 in the URL Address box. 3. Replace webservername with the name of the machine where you installed RE:Anywhere. The Log in screen appears in your browser. We recommend you log off RE:Anywhere as soon as you finish working in it to prevent the program from locking your user name. This would prevent you from being able to log into The Raiser s Edge 7. Clicking in the The Raiser s Edge title bar does not log you off RE:Anywhere.

44 CHAPTER 2 We strongly recommend you change your User name and Password as soon as possible. 4. Enter your Raiser s Edge User Name and Password. The program ships with a default user name of supervisor and a password of admin. The user name and password are not case sensitive. All our programs are sent with the same user name and password. If you install RE:Anywhere to be accessible via the Internet, your database is accessible from the Internet. For this reason, it is very important that you change your user name and password as soon as possible. 5. If you want to view larger fonts on your browser, check the Download support for large fonts checkbox. In order to support large fonts, an ActiveX control must be loaded onto your machine. For more information about loading ActiveX controls, see RE:Anywhere and Installing ActiveX Controls on page 45. 6. Click Login to enter RE:Anywhere. Navigating in RE:Anywhere RE:Anywhere provides you with a wide variety of tools to make navigating in the program quick and easy. RE:Anywhere contains many of the same navigation devices used in The Raiser s Edge 7. By default, RE:Anywhere opens to the Home page. The Raiser s Edge bar on the left side of the screen contains links to all main areas of the program. The menu bar at the top of the browser window also provides quick and easy access to all areas of the program.

P OST-INSTALLATION 45 RE:Anywhere and Installing ActiveX Controls ActiveX is a set of technologies enabling software components to communicate with each other in a networked environment, regardless of the programming language in which the components were created. It is used primarily to develop interactive content for the World Wide Web, although it can be used in desktop applications and other programs. In RE:Anywhere, four functions require an ActiveX control to be loaded onto your machine: supporting large fonts, editing a notepad, creating Quick Letters, and previewing a report. Loading ActiveX features into RE:Anywhere The first time you select a feature requiring an ActiveX control, a warning screen appears informing you that it must be loaded. For example, previewing reports requires you to load the Crystal ActiveX Report Viewer. 1. The first time you select Preview for a report, the following screen appears. You must also have a local printer driver installed to your Web server before you can preview a report. The printer does not actually have to be connected to the server, but the driver must be installed and designated as the default printer. If you use NTFS formatted drives, you should specify that the printer be shared. 2. Click Yes to load the Crystal ActiveX Report Viewer. When installation of the viewer is complete, you can preview reports.

46 CHAPTER 2 Differences between The Raiser s Edge and RE:Anywhere RE:Anywhere allows you to view and change information in The Raiser's Edge database using an interface similar to the shell. Knowledge of the shell will help you navigate and use RE:Anywhere. When you use RE:Anywhere, keep in mind this module is actually a Web site, not a Windows application. Some functionality you are familiar with in The Raiser s Edge operates differently in RE:Anywhere due to the differences between the Web site and desktop environments. Troubleshooting When I try to log into RE:Anywhere, I get a message stating ReWeb was unable to establish a connection with the database. Verify that the database is running. If you selected the Manually Enter Database Information installation option, make sure you entered the correct Raiser s Edge server name and database name for a SQL Server database, or Oracle Service name for an Oracle database. If you do not know this information, contact your system administrator. You can also find this information in the Blackbaud Management Console. To see the engine name, click the Server option in the console. To see the database name or Oracle Service name, click the Databases option. I cannot preview reports or mailings. You need to install a printer driver on your Web server. Install the driver (you do not need to install the actual printer) on the Administrator user name profile (the same user name you log in under to install RE:Anywhere). You must specify that the printer be shared. After installing the printer driver, re-install RE:Anywhere. When running an extremely large report, the following message appears: If you try to run a very large report in RE:Anywhere, the report may time out due to your default settings in Internet Explorer. We recommend you either narrow the report parameters or run the report using The Raiser s Edge 7 desktop application.

P OST-INSTALLATION 47 Increasing the default time setting for Internet Explorer by editing your registry keys will also enable you to run large reports in RE:Anywhere. However, we recommend you avoid doing this. Increasing the default time setting may enable a large report to run, but the performance of your Web server will be slowed and no other users will be able to run reports while a large report is processing. A message appears stating a file is in use, file is locked, access denied, or any message including the word authentication. These messages are usually the result of a problem with security rights on an NTFS formatted Web server. Check the security settings. For more information about security settings, see Setting Up Correct Security Privileges on page 32 of this guide. Errors on page messages appear in my Microsoft Internet Explorer status bar when loading pages or forms, and pages do not function properly. You must access RE:Anywhere with Microsoft Internet Explorer (IE) version 5.x. Only specific 5.x versions are supported. Microsoft frequently releases beta versions of IE; RE:Anywhere generally does not support these beta versions. To determine which version of IE you are using: From the IE menu bar, select Help, About Internet Explorer. The About Internet Explorer screen appears. In the Version line, you will see an eleven digit number. The first three digits are the major number and the remaining digits are the minor number. If you are using IE version 5.0 (major number 5.00), the minor number must be equal to or greater than 2919.6307. IE version 5.00.2919.6307 is also known as the release version of IE 5.01. If you are using IE version 5.5 (major number 5.50), the minor number must be equal to or greater than 4134.0600. IE version 5.50.4134.0600 is also known as the release version of IE 5.5. If your IE 5.0 or 5.5 version number is less than above, you should upgrade your browser. I cannot download any of the ActiveX controls. This may be a result of your firewall security. Check with your security consultant or system administrator. When I try to preview or print reports from The Raiser s Edge on my Web server (machine on which RE:Anywhere is installed) I get error messages. The version of the Crystal Report engine installed by RE:Anywhere differs from the version used by The Raiser s Edge. Because of this, it is not possible to print or preview reports in The Raiser s Edge from the Web server (the machine on which RE:Anywhere is physically installed). This affects only the Web server, not workstations. When I open a file exported in Crystal Reports format on my workstation, the report opens in the Design format and I cannot preview or print it. If I try to preview the report, a message appears telling me I need the appropriate DSN to connect to the database.

48 CHAPTER 2 The machine on which the exported file is being opened (i.e. the Web browser machine) must have the same DSN (Data Source Name) as the Web server. If that DSN does not exist on the browser machine, a message appears asking for the appropriate DSN when you try to preview the report. Use the ODBC Data Source Administrator (found in the Windows Control Panel) to add or edit the DSN so it matches that on the Web server. For more information about the ODBC Data Source Administrator, see your Windows documentation. The Anonymous user does not appear in the BBReweb7 security group. The Anonymous user may have been changed or deleted. Use the following procedure to determine your current anonymous user account. Then add the user to the BBReweb7Group. Determining which account is used when a user logs into the Web server as an Anonymous user 1. From your Windows taskbar, click Start. Select Settings, Control Panel. From the Control Panel, select the Administrative Tools folder. Select Internet Services Manager. The Internet Information Services screen appears. 2. In the treeview on the left, click the plus sign beside Default Web Site. Select the REWeb70 folder. 3. Right-click and select Properties.

P OST-INSTALLATION 49 4. Select the Directory Security tab on the REWeb70 Properties screen. 5. Click Edit in the Anonymous access and authentication control frame. The Authentication Methods screen appears. Depending on how you have configured security on your Web server, one or more of these options will be checked. If you want to allow Anonymous access, make sure the Anonymous Access checkbox is checked (RE:Anywhere setup checks this by default).

50 CHAPTER 2 6. Click Edit in the Anonymous access frame. The Anonymous User Account screen appears. By default, IIS sets the anonymous user account to IUSR_<machinename>. The Windows User Account currently selected as the Anonymous User is shown in the Username field. By default, IIS sets the anonymous user account to IUSR_<machinename>.