TIBCO Nimbus Control Administration Guide. Software Release December 2012

Transcription

1 TIBCO Nimbus Control Administration Guide Software Release December 2012

2 Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED TIBCO SOFTWARE IS SOLELY TO ENABLE THE FUNCTIONALITY (OR PROVIDE LIMITED ADD-ON FUNCTIONALITY) OF THE LICENSED TIBCO SOFTWARE. THE EMBEDDED OR BUNDLED SOFTWARE IS NOT LICENSED TO BE USED OR ACCESSED BY ANY OTHER TIBCO SOFTWARE OR FOR ANY OTHER PURPOSE. USE OF TIBCO SOFTWARE AND THIS DOCUMENT IS SUBJECT TO THE TERMS AND CONDITIONS OF A LICENSE AGREEMENT FOUND IN EITHER A SEPARATELY EXECUTED SOFTWARE LICENSE AGREEMENT, OR, IF THERE IS NO SUCH SEPARATE AGREEMENT, THE CLICKWRAP END USER LICENSE AGREEMENT WHICH IS DISPLAYED DURING DOWNLOAD OR INSTALLATION OF THE SOFTWARE (AND WHICH IS DUPLICATED IN THE LICENSE FILE) OR IF THERE IS NO SUCH SOFTWARE LICENSE AGREEMENT OR CLICKWRAP END USER LICENSE AGREEMENT, THE LICENSE(S) LOCATED IN THE LICENSE FILE(S) OF THE SOFTWARE. USE OF THIS DOCUMENT IS SUBJECT TO THOSE TERMS AND CONDITIONS, AND YOUR USE HEREOF SHALL CONSTITUTE ACCEPTANCE OF AND AN AGREEMENT TO BE BOUND BY THE SAME. This document contains confidential information that is subject to U.S. and international copyright laws and treaties. No part of this document may be reproduced in any form without the written authorization of TIBCO Software Inc. TIBCO, Two-Second Advantage and Nimbus Control are either registered trademarks or trademarks of TIBCO Software Inc. in the United States and/or other countries. All other product and company names and marks mentioned in this document are the property of their respective owners and are mentioned for identification purposes only. THIS SOFTWARE MAY BE AVAILABLE ON MULTIPLE OPERATING SYSTEMS. HOWEVER, NOT ALL OPERATING SYSTEM PLATFORMS FOR A SPECIFIC SOFTWARE VERSION ARE RELEASED AT THE SAME TIME. SEE THE RELEASE NOTE FOR THE AVAILABILITY OF THIS SOFTWARE VERSION ON A SPECIFIC OPERATING SYSTEM PLATFORM. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. THIS DOCUMENT COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE INFORMATION HEREIN; THESE CHANGES WILL BE INCORPORATED IN NEW EDITIONS OF THIS DOCUMENT. TIBCO SOFTWARE INC. MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED IN THIS DOCUMENT AT ANY TIME. THE CONTENTS OF THIS DOCUMENT MAY BE MODIFIED AND/OR QUALIFIED, DIRECTLY OR INDIRECTLY, BY OTHER DOCUMENTATION WHICH ACCOMPANIES THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY RELEASE NOTES AND "READ ME" FILES. Copyright TIBCO Software Inc. ALL RIGHTS RESERVED. TIBCO Software Inc. Confidential Information

3 Contents 3 Table of Contents Chapter 1 Introduction About the... Administration Guide... 9 About Nimbus Control New Features in this Release 1.1 Chapter 2 Installation 2.1 Planning Installation Planning Licensing Nimbus Control Licensing Upgrading from Previous Releases Migrating a process repository Migrating Web Server settings Installing... the Client 23 Installing... the Web Server Configuring Authentication Configuring LDAP Integration Configuring SSO via Windows Authentication (IWA) Configuring SSO via Netegrity SiteMinder Authentication Integrating Nimbus Control with SharePoint Configuring a SharePoint Integration Upgrading a SharePoint Integration Adding Control Web Parts to other SharePoint sites Integrating with a SharePoint document library Installing... the Action Server 66 Installing... the Business Intelligence Server Installing the Nimbus Control Performance Monitor Uninstalling Nimbus Control Chapter 3 Security

4 4 3.1 Administration Guide 69 Securing... a Process Repository Chapter 4 Configuration Web Server Configuration Configuring the Web Server Configuring MIME mappings Configuring Web Server Logging Configuring Page Hit Logging Configuring Web Hit Logging Action Server Configuration Configuring the Action Server Configuring SMTP Configuring SMTP Logging Configuring LDAP Synchronization Testing LDAP Synchronization Configuring LDAP Synchronization Logging Business... Intelligence Server Configuration Configuring the Business Intelligence Server Testing the Business Intelligence Server Synchronizing the Business Intelligence Server Configuring Business Intelligence Server Logging Chapter 5 User Management Creating... Users and User Groups Importing Resources Importing User Roles 5.1 Chapter 6 Administration Importing and Exporting Data Exporting Diagrams as XML Exporting Data to a Database Importing Data Tables Backing... Up Data Nimbus Backup Utility Third-party Backup utilities

5 Contents Metric Configuration Updating Excel Macros Creating SQL Queries Scheduling and Updating SQL Queries Integrating with SAP BW and SAP NetWeaver BI Integrating with Microsoft Office Business Scorecard Manager Integrating with Cognos Metrics Manager Integrating with Microsoft Office PerformancePoint Integrating with Third-party Applications Integrating with SAP NetWeaver Integrating with a Novell File Server Integrating with Generic Portals Registering with SAP Solution Manager Integrating with OpenText Document Management Integrating with tibbr Chapter 7 Maintenance Recovering Deleted Maps and Diagrams Checking Performance Checking Maps Archiving Maps Managing Database Tables Synchronizing the Web Server Monitoring Web Server Performance 7.8 Restarting, Stopping and Starting the Web Server Managing Nimbus Control Services Replacing File Link Paths Viewing... Map Paths 7.12 Enabling Administrator Access to all Diagrams 7.5 Chapter 8 Customization Customizing the Web Server

6 6 Administration Guide Chapter 9 Troubleshooting Chapter 10Support and Feedback

7 Chapter 1 Introduction Nimbus Control Administration Guide

8 Chapter 1 Introduction About the Administration Guide This guide is designed to provide Nimbus Control administrators with information on performing the following tasks: Installing components of the Nimbus Control suite, including migration of data from previous major versions Configuring components of the Nimbus Control suite Managing Nimbus Control users Administering the Nimbus Control suite Maintaining the Nimbus Control suite. Audience The intended audience for this guide includes: IT staff responsible for providing the technical infrastructure in which the Nimbus Control suite is deployed IT staff responsible for the setup of Nimbus Control The nominated Nimbus Control administrators responsible for the day-to-day management of the Nimbus Control suite.

9 About the Administration Guide About Nimbus Control Nimbus Control is a software suite designed to enable organizations to capture, analyze and communicate a common set of processes that can be used to manage an organization. The suite consists of five primary components: Desktop Client The Desktop Client is a Windows-based application that provides authors with the tools in which to create and manage process maps, supporting information and documents. Web Server The Web Server allows users to access and collaborate on data, anywhere across the internet or corporate intranet. It runs as a standalone application that interacts with IIS using a small ISAPI extension that serves to redirect the requests to the application. The Web Server can also be integrated into a SharePoint solution. Action Server The Action Server runs as five separate Windows-based services in the background - , Lock, Office Integration and LDAP services. The primary tasks are to act as the Nimbus Control Server by utilizing basic SMTP services to provide a gateway into a corporation's system, and to integrate with Directory Services. Business Intelligence Server The Business Intelligence Server provides the ability to send SMS text messages and notifications when defined measures are breached. Windows Server Performance Monitor Plug-in The Windows Server Performance Monitor Plug-in provides system administrators with the ability to monitor the internal behaviour of the Web Server and allows all of the normal capabilities of Performance Monitor to be used. How is data managed? Nimbus Control data is managed in three databases: Process Repository The process repository is a folder in the file system that holds the process diagrams and all process-related information (resources, metadata, access rights). It consists of a number of flat files and DBISAM database tables and index files. The Document Registry The Document Registry is a document management system that holds supporting files related to processes (forms, media files, templates, spreadsheets, application links, policy documents, etc). Business Intelligence Repository The Business Intelligence Repository tracks trend data for the key metrics in order to produce graphs and launch alerts.

10 Chapter 1 Introduction New Features in this Release The following features and functionality have been added to this release: Reduce potential timeouts in SMTP servers and peak loads in the web server caused by too many queued-up s Previously, the service would attempt to send all pending s. This could cause timeouts in some SMTP servers due to hundreds (or even thousands) of system notifications and also peaks in load in the web server where many users follow links in s. To rectify this, the service can now be configured to restrict the maximum number of s that are sent (per hour) and the maximum connection time to a SMTP server. See Configuring SMTP . Name verification in the configuration options disabled The option to verify addresses against the server before sending messages (VerifyNames) is now set as disabled by default. This option is rarely supported on SMTP servers as it allows spammers to check if addresses are real. See Configuring SMTP . Greater logging for the Web Server synchronization operation The logging for the Web Server synchronization operation has been extended to allow greater detail of logging. See Synchronizing the Web Server. Run Action Server services as a single process To reduce the amount of resources used, especially on servers hosting multiple author clients, all Action Server services can be run as a single process. See Managing Nimbus Control Services. Export total number of page hits based on total number of Web Server logins The Web Log Utility now allows users to export the total number of page hits based on the total number of user logins in the Web Server. See Configuring Web Hit Logging. Integrate with tibbrâ Integrate Nimbus Control with the social networking tool tibbr â. The integration allows tibbr discussions to be created from storyboard titles and keywords. Users can search for tibbr discussions in their My Searches and add messages to their tibbr Wall through their My Workspace. See Integrating with tibbr.

11 New Features in this Release Display document drop-down fields in users' acknowledgement To-Dos 11 Display selected document drop-down fields in users' acknowledgement To-Do lists in the Web Server for document-related To-Dos. See Configuring the Web Server.

12 Chapter 2 Installation Nimbus Control Administration Guide

13 Planning Planning Installation Planning For information on planning the installation of the Nimbus Control suite, including hardware and software requirements, sizing requirements and deployment options, please refer to the Installation Planning Guide that can be downloaded from Tibco's Documentation site ( 2.2 Licensing Nimbus Control Licensing Trial Period When installing Nimbus Control for the first time, you will be granted a 7 day trial period in which to assess the software. Within this trial period you will have an unlimited number of user licenses and modules. Licensing Nimbus Control After the 7 day trial a license code must be obtained from Nimbus Support in order to continue using the software. The license code determines the number of process authors and end users you will have in a single process repository (additional licenses can be purchased at any time). Note that process author licenses can be used by end users if required. To obtain a license code you must provide Nimbus Support with the current license code. To do this, from the Help menu choose Registration in the Author Client. Copy the current code and paste it into an to Nimbus Support (nimbus-support@tibco.com). You will be provided with a new license code which can then be pasted into the Registration window to update the number of process authors and end users, and the expiry date if appropriate. The license details are stored as part of the Nimbus Control process repository database. These details are shared between all Nimbus Control suite components and all Nimbus Control users sharing the process repository.

14 Chapter 2 Installation Upgrading from Previous Releases If a previous major version of Nimbus Control is installed, the data within the current process repository must be migrated to the latest version before it can be used with the Nimbus Control suite Migrating a process repository Before upgrading from a previous major version to the latest version, you must first migrate the process repository. A process repository is essentially a data folder in the file system which holds process diagrams and other process-related information. During the migration process, the existing table structures in the process repository are converted in order to make them compatible with the latest release. Following the migration process the latest version can then be installed. Archived Maps Archived maps will be converted to the new format as part of the migration process and will be accessible to users as they were in the old version. However, any compressed static archived maps (.arc) will not be upgraded to the latest version. Instead you will be prompted to select a backup folder to automatically move these files into during the migration. Since.arc files cannot be upgraded, access to compressed archived maps is only available by maintaining the old version of Nimbus Control with the old process repository. Prerequisites Before migrating a process repository, the following points should be considered and the relevant actions taken: Prevent users from accessing the process repository To allow you to back up your process repository and migrate the data to the new format, all users must be logged out of the Author Client and the web server. Author Client. You can view if any users are still active in the Author Client (from the Tools menu choose Users, then Active Users). Web Server. To prevent users from accessing the web server, the web server must be stopped. See Restarting, Stopping and Starting the Web Server for information on stopping the Nimbus Control web server. Stop Nimbus Control services In order to ensure a consistent backup, all Nimbus Control services must be stopped before running a backup. See Managing Nimbus Control Services for information on stopping Nimbus Control services. Stop Nimbus Control scheduled tasks No scheduled tasks, such as the System Synchronization utility (ssync.exe) should be running on the process repository. Back up your data Before proceeding with migrating your data, it is strongly advised to take a complete backup of your existing process repository. This allows you to roll-back if any problems occur. See Backing Up Data for more information on how to obtain a consistent copy of a process repository.

15 Upgrading from Previous Releases 15 Note: The Deleted Maps folder is emptied during the migration process. If you wish to retain this data in the old version format, you must ensure that this folder is backed up too. The default location is <Process Repository directory>\deleted. Delete the cache folder To ensure you have any improvements to the indexing of the web server's cache table, when upgrading to the latest version it is advisable to delete the current Cache folder. The web server must be stopped first. When the web server is restarted, the Cache table will be rebuilt. The default location is <Installation directory>\cache. Migrating a process repository The following steps detail how to migrate a process repository. 1. Download the latest version of Nimbus Control. 2. Create a new folder in which to install the new version of Nimbus Control. For example: C:\Nimbus Control Before copying the process repository you must ensure that there are no users currently logged in to either the Author Client or the web server. Please refer to the prerequisites above for more information. 3. Copy the existing Process Repository, Scorecard Repository, Process RepositoryATTACH, and any other data folders that you've created, into the folder created in Step 2. Copying them ensures that the existing data is still available if a roll-back is required. 4. Restrict the permission on the previous installation folder to allow only those users that require access to access it. 5. Run the appropriate migration tool. The migration tools are found in the Utilities folder on the downloaded image: Existing Version Migration Tool (to use) Nimbus Control 8.1.x CtrlMigration81To90.exe Nimbus Control 8.0.x CtrlMigration80To81.exe Control x CtrlMigration70To80.exe Control x CtrlMigration65To70.exe control-es 6.4.x CtrlMigration64To65.exe control-es 6.3.x CtrlMigration63To64.exe control-es 6.2.x CtrlMigration62To63.exe Notes: When migrating the process repository, you will be presented with the option to change the save location for archived maps and to set the default time zones for actions. If upgrading from 7.x or earlier, please take into consideration that these options will be presented at the final stage of the migration process and the process cannot complete until these options are selected. It should also be noted that from v8.1, acknowledgement requests are handled differently. If you

16 16 Chapter 2 Installation are migrating a process repository from 8.0 or earlier, an Acknowledgement Migration Impact Assessment step will require your action. The choice you make will be dependent on the extent to which you use and enforce acknowledgement requests. Click Help on the window for further information. 6. Select Upgrade Control Process Repository, then click Next. 7. Click Browse and select the process repository that you copied in Step 3, then click Next. 8. Enter the user name and password of a Control administrator, then click Next. 9. Confirm you have backed up the process repository by clicking Next. 10.Click Start to begin migrating the process repository. Each of the required tools will run consecutively until the data has been migrated to the latest version. Post Migration Once you have migrated the process repository you can install the Nimbus Control suite. Install the Client into the new folder structure created in Step 2. If access to the previous web server is still required, rename the IIS virtual directory name (e.g. to 'Control810'). Install the web server using the previous virtual directory name (by default this is NimbusControl). Install all other components and integrations, as required. Inform all desktop users about the new shortcut required to access the new Author Client. Additional Notes: Users will be able to access the new web server using the same URL as before; however users requiring access to the previous web server will require the updated URL using the renamed virtual directory. Network client users will require a new desktop shortcut. Usually there is no requirement to re-license the suite as the license details are migrated as part of the migration process. However, prior to the release of version 9, the license code format was different and therefore migration from version 8 or earlier will require a new license code to be requested. Upgrading v8.1 packaged maps Run CtrlMigration81To90.exe. Select Upgrade Packaged Maps, then click Next. Click Browse and select the CPK or CEP file to upgrade, then click Next. Click Start. Upgrading v8.0 packaged maps Run CtrlMigration80To81.exe. Select Upgrade Packaged Maps, then click Next. Click Browse and select the CPK or CEP file to upgrade, then click Next. Click Start. Repeat steps 1-4 using CtrlMigration81To90.exe.

17 Upgrading from Previous Releases 17 Upgrading v6.3.x, 6.4.x, 6.5.x and 7.0.x packaged maps Run CtrlMigration70To80.exe. Select Upgrade Packaged Maps, then click Next. Click Browse and select the CPK or CEP file to upgrade, then click Next. Click Start. Repeat steps 1-4, first using CtrlMigration80o81.exe, then CtrlMigration81To90.exe. Upgrading v6.2 packaged maps Run CtrlMigration62To63.exe. Select Upgrade Packaged Maps, then click Next. Click Browse and select the CPK or CEP file to upgrade, then click Next. Click Start. Repeat steps 1 to 4, first using CtrlMigration70To80.exe, then CtrlMigration80To81.exe and finally CtrlMigration81To90.exe. Upgrading v6.5 and 7.0.x statement sets Run CtrlMigration70To80.exe. Select Upgrade Packaged Statement Set, then click Next. Click Browse and select the FPK file to upgrade, then click Next. Click Start. Upgrading v8.x packaged storyboards Run CtrlMigration81To90.exe. Select Upgrade Packaged Storyboard, then click Next. Click Browse and select the SPK file to upgrade, then click Next. Click Start. Upgrading v7.x packaged storyboards Run CtrlMigration70To80.exe. Select Upgrade Packaged Storyboard, then click Next. Click Browse and select the SPK file to upgrade, then click Next. Click Start. Repeat steps 1-4 using CtrlMigration81To90.exe.

18 18 Chapter 2 Installation Migrating Web Server settings You can migrate the settings - configuration settings, skins, localization files and the Home page text - from one Web Server to another. This is useful when installing a new version of the Web Server as you can migrate the settings from an existing Web Server installation. The Nimbus Control Web Server Upgrade Utility can either be run before installing the new Web Server or after the Web Server has been installed. Note: The old settings are backed up and stored in '...\Documents and Settings\<User>\TEMP \Nimbus Upgrade'. It is advisable to delete the old Cache folder when upgrading to a new version of the Web Server. See Migrating a process repository for more information. Migrating settings before installing a new Web Server You can run the Nimbus Control Web Server Upgrade Utility before installing the new Web Server. This method will allow you to install the Web Server and migrate the settings from an existing Web Server in one operation. 1. Copy the Utilities and Web Server folders from the download image to a local drive. 2. Run WebUpgradeUtil.exe. Note: WebUpgradeUtil.exe is found in the Utilities folder. 3. Click Browse and select the current Web Server folder. 4. Select any of the following Web Server configuration settings to migrate to the new Web Server: Include Web Server configuration settings will merge any changes in the configuration settings file. Include Skin will merge any changes in the Skin.html. Note: Skin.html is found in...\control \Web Server\App, and controls various web appearance settings, such as various font colors, storyboard colors, menu appearance, etc. Include Localizations will merge any changes in the localization files. Include Home page sidebar will replace the MyPage.html (Home page text) file with the old version. 5. Click Next. The Web Server installation setup will appear. 6. Follow the steps to install the Web Server. For more information on installing the Web Server see Installing the Web Server. Migrating settings after installing a new Web Server If the new Web Server has already been installed you can still migrate the settings from an existing Web Server using the Nimbus Control Web Server Upgrade Utility. 1. Copy WebUpgradeUtil.exe to a local folder. Note: WebUpgradeUtil.exe is found in the Utilities folder on the download image. 2. Run WebUpgradeUtil.exe. 3. Click Browse and select the current Web Server folder. This is the Web Server that you are migrating settings from.

19 Upgrading from Previous Releases Select any of the following Web Server configuration settings to migrate to the new Web Server: Include Web Server configuration settings will merge any changes in the configuration settings file. Include Skin will merge any changes in the Skin.html. Note: Skin.html is found in...\control \Web Server\App, and controls various web appearance settings, such as various font colors, storyboard colors, menu appearance, etc. Include Localizations will merge any changes in the localization files. Include Home page sidebar will replace the MyPage.html (Home page text) file with the old version. 5. Click Next. Note: You will receive a message stating that the current Web Server installer cannot be found. 6. Click Next. 7. Click Browse and select the new Web Server folder, then click Next.

20 Chapter 2 Installation Installing the Client This topic describes how to install the Nimbus Control Client. For more information on the Client, including software and hardware requirements and sizing, see the Installation Planning Guide that is included in the Documents folder on the installation CD. Note: iscsi is not supported over TCP/IP. Prerequisites 120MB of disk space If upgrading from a previous version there must be no users currently using the old version. You must also migrate the process repository before installing Nimbus Control. See Upgrading a Process Repository for more information. You must be logged in to the local machine as an administrator. It is advised that you exit any other Windows applications that are currently running. Please read the Installation Planning Guide (included on the CD) before proceeding. This includes important information about disabling SMB2.x and Opportunistic Locking on Windows Server 2008/2008 R2 to avoid potential data corruption. Installing the Client 1. Do one of the following: Insert the CD and click Client Installation If the CD installation does not automatically start, from the CD run Setup.exe and click Client Installation. [Welcome] If no other Windows applications are running, click Next. Otherwise, terminate the installation in order to exit the applications, then re-run the setup. [Read Me File] If you are upgrading from a previous version of Control, read the warning and take any necessary steps. Click Next to proceed. [License Agreement] Ensure that you read the license agreement, then click Yes to accept it or No to terminate the installation. [Setup Type] Select whether you want a standard installation, or a network client installation. Standard - this will install the full program and should be selected for new installations or upgrades. Network Client - this will create a shortcut for an existing installation. This shortcut can then be distributed between users who will then have access to the Nimbus Control Client over the network. See the Installation Planning Guide for more information on deploying Nimbus Control. [Choose Destination Folder] The location in which the Client is installed will default to <Installation directory>\control. To change location, in the Destination Folder panel click Browse to select a location in which to install the Client. To change the location of the process repository, deselect Use default sub-folder for Process Repository and click Browse in the Existing Process Repository panel to specify a location to install the process repository in. Click Next to proceed. [Select Program Manager Group] Select the Program Manager group that the Client will be added to. Either select an existing group or accept/rename the default name to create a new

21 Installing the Client 21 group. Click Next to proceed. 8. [Start Installation] Click Next to install the Client. Folder permission rights Administrators and process authors will require Read and Modify access to the process repository and any associated data folders. End users require Read access only. If you are planning to share the process repository then you must share a higher level folder and not the actual process repository folder, otherwise users may not be able to access folders on the same level as the process repository, such as process repositoryattach and process repositorycred. What Next... Run the Client for the first time Administrator Account When you run the Nimbus Control author client for the first time you will be prompted to create an administrator account. Note: If you plan to use LDAP then use the same account as the administrator account that will be created in the Nimbus Control Admin LDAP group, otherwise this account will be deleted when synchronizing with LDAP. License Code In order to create additional user accounts in Nimbus Control you must enter the license code. From the Help menu choose Registration. If you do not have a license code then please contact Nimbus Support. Secure the process repository Securing the process repository will prevent users from editing or deleting any of the file structure of the process repository through, for example, Windows Explorer. See Security\Securing a Process Repository for more information. Distribute the Client executable shortcut If you are providing access to the Client over the network then you must create a copy of the executable shortcut and then distribute it to the users that require access to the Client. To create a network executable shortcut, follow the steps above but select Network Client in Step 5 [Setup Type]. If the Client is to be installed locally, i.e. on each users' PC, then this is not required. Install the Web Server The Web Server provides end-user access to the information held within the process repository and defined external locations, including maps, documents, etc. See Installation\Installing the Web Server for information on installing the Web Server. Enable Single Sign-on Single-sign On allows users to automatically log into the Client and Web Server without having to provide their credentials once they are logged into their organization's network. See Installation\Configuring Authentication for more information.

22 22 Chapter 2 Installation Create User Accounts and User Groups If you are not synchronizing your users and user groups via LDAP you must manually create them. See User Administration in the Administration section of the Client Help for more information. Related topics Importing resources Importing roles User Management

23 Installing the Client Installing the Web Server This topic describes how to install the Nimbus Control Web Server. For more information on the Web Server, including software and hardware requirements and sizing, see the Installation Planning Guide that is included in the Documents folder on the installation CD. Summary Set up IIS Install the Web Server Modify DCOM permissions Modify Nimbus Control Host.exe COM+ object Modify folder and file access rights Allow the Web Server ISAPI extension Configure IIS Migrating Web Server Settings This section describes installing a new Web Server with default configuration settings. If you have an existing version of the Web Server installed and you want to keep the configuration settings, you can install the Web Server and migrate the settings in a single operation. See Migrating Web Server settings for information on how to do this. Prerequisites The Installation Planning Guide has been read. 120MB of disk space. The Nimbus Control Author Client is installed and has been run against the process repository at least once. The process repository is in a location that is accessible to the Web Server. A Nimbus Control domain service account has been created. This account is used to run all Nimbus Control services and requires access to the various Nimbus Control folders. The account does not require administration rights and the password should be set to 'never expire'. Further information on creating a Nimbus Control domain service account is available in the Installation Planning Guide (included on the CD and with the media image). Installing the Web Server as a SharePoint solution If you integrating the Web Server into a SharePoint solution, please read the SharePoint prerequisites before installing the Web Server. See Integrating Nimbus Control with SharePoint for more information. Setting up IIS The Web Server requires IIS and ISAPI extensions (unless you are setting up a remote connection, for example when integrating the Web Server with a remote SharePoint installation). IIS and ISAPI extensions are not installed on Windows Server 2003 or Windows Server 2008 by default and therefore must first be installed. Windows Server 2003 (IIS6)

24 24 Chapter 2 Installation 1. From the Add Remove Programs dialog in Control Panel, click Add or Remove Windows Components. 2. Click Application Server to select it and click Next. This will install IIS6, including ISAPI Extensions. Windows Server 2008/2008 R2 (IIS7/7.5) 1. On the Start menu, point to Administrative Tools, then click Server Manager. 2. In Roles Summary click Add Roles. 3. In the Add Roles Wizard, click Next, and then click to select the Web Server (IIS) check box in the Roles list. Click Add Required Features when prompted, and then click Next. 4. Click Next, and then click to select the IIS Management Console and ISAPI Extensions in the Roles services list. 5. Click Next, and then click Install. Note: The account under which the IIS process runs must have full access to all areas of the process repository. Installing the Web Server 1. Do one of the following: If using physical media, insert the CD and click Enterprise Server Installation. OR If using an electronic image, run Setup.exe and click Enterprise Server Installation. Note: If you are installing on a machine that is not a server you will receive a warning message. The Web Server can be installed on a non-server machine, however you will not receive the benefits that a server has to offer, such as being able to support multiple connections simultaneously. 2. [Welcome] If no other Windows applications are running, click Next. Otherwise, terminate the installation in order to exit the applications, then re-run the setup. 3. [Choose Destination Folder] The location in which the Web Server is installed will default to the location of the Client installation. To change location, in the Destination Folder panel click Browse to select a location in which to install the Web Server. To change the location of the process repository at this stage, deselect Use default sub-folder for Process Repository and click Browse in the Existing Process Repository panel to locate the process repository. Note: The path of the process repository can be changed at any time by editing the Web Server configuration file (see Web Server Configuration for more information). Click Next to proceed. 4. [IIS Configuration Options] The Web Server must be mapped to an IIS virtual directory to allow users to access it through their browsers. Web Server Site - choose the site to install the Web Server to. If selecting a different Web site from the default, you must ensure that the site is correctly configured. Virtual directory name - specify the virtual directory name. This is the name that users will see in the browsers as the path of the application and the name that appears in IIS Manager. SharePoint Integration If you are integrating the Web Server into a SharePoint installation, the Nimbus Control Web Server must be installed into either a new IIS site with a specified host name (for example

25 Installing the Web Server 25 'Nimbus Control'), or installed into the default SharePoint-80 site. Please note that the SharePoint-80 site is not supported for SharePoint bit deployments. If the Web Server is being integrated into a SharePoint installation via the Nimbus remoting solution then IIS is not required, in which case you may wish to disable Configure Nimbus Control for use via Internet Information Server. In this situation the Web Server can only be accessed via the remoting solution. See Integrating Nimbus Control into SharePoint for more information on installing the Web Server into a SharePoint installation. 5. [Setup Program Manager Group] Select the Program Manager group that the Web Server will be added to; either select an existing group or accept/rename the default name. Click Next to proceed. 6. [Start Installation] Click Next to install the Web Server. Configuring DCOM security DCOM permissions must be configured to allow the various components of the Web Server to communicate. The Network Service account requires Local Access permission rights and Local Launch and Local Activation permission rights for both IIS 6 and IIS7/7.5. Note: If you are implementing Single-sign On (Integrated Windows Authentication) you can use either the Network Service or IWAM account to provide default Launch, Activation and Access rights. If LDAP is being used then you must provide the six default LDAP groups with this access. Modifying the Nimbus Control Host.exe COM+ identity The identity of the Control Host.exe container, which runs the Web Server, needs to be set to the Nimbus Control domain service account. 1. Run Component Services.

26 26 Chapter 2 Installation 2. Expand Computers>>My Computer>>DCOM Config. 3. Right-click control ES Web Server Host and choose Properties. 4. Click the Identity tab. 5. Select This user, then enter the Nimbus Control domain service account details. Modifying access to the Web Server folders and files The access rights of all folders and files within C:\Nimbus Control\Web Server\Main needs to be set to allow Read access for all Nimbus Control users. If management of users via LDAP synchronization is used it is recommended that the Nimbus Control LDAP groups are used to provide this access. Read/write access to the following folders must also be enabled for the Nimbus Control domain service account, which the Host.exe process runs under:...\nimbus Control\Process Repository\...\Nimbus Control\Process Repository\Temp...\Nimbus Control\Web Server\Reload Allowing the Web Server ISAPI extension Unless ISAPI extensions are enabled by default, you must add and allow the Nimbus Control ISAPI extension to the list of allowed executable extensions in IIS. Note: The CtrlWebISAPI.dll is found in...\web Server\Main.

27 Installing the Web Server 27 IIS 6 In IIS Manager, under Web Service Extensions, add CtrlWebISAPI.dll and set it to Allowed. IIS7/7.5 In IIS Manager, click the name of the server. In Features View, double-click ISAPI and CGI Restrictions. In the Actions pane, click Add. In the ISAPI or CGI path text box, enter the path of the CtrlWebISAPI.dll, or click Browse to select it. Check Allow extension path to execute and click OK. Configuring IIS In Windows Server 2003 and Windows Server 2008, IIS manages virtual directories in application pools. Each pool has its own properties that can be configured and single pools can host multiple virtual directories. When Nimbus Control is installed it looks for an application pool called Nimbus Control Pool. If it does not exist then it is created as part of the installation process. The Nimbus Control virtual directory is created in the same way and is assigned to the Nimbus Control application pool. Note: The Network Service account must have anonymous access to the Nimbus Control application pool (in Windows Server 2008 R2 the application pool identity must be changed to Network Service). The installation also requires two changes to the IIS configuration. WebDAV is disabled as part of the installation process. If enabled, the Front Page Server extensions must be disabled manually. For more information, refer to the Web Server Installation Planning section in the Nimbus Control Installation Planning Guide (included on the installation CD).

28 28 Chapter 2 Installation How to configure access to the Web Server when the process repository resides on a different server When installing the Web Server, the local machine's IIS IUSR account is set to be used for anonymous access by default. This account does not have access to files on other machines, therefore when the process repository is on a different server, the Nimbus Control domain service account must be used instead. Ensure that Enable anonymous access is enabled for the web site that is hosting the Nimbus Control virtual directory and specify the Nimbus Control domain service account details. Note: If you are implementing Single-sign On/Integrated Windows Authentication then you must disable Enable anonymous access and enable Integrated Windows authentication. See Configuring Authentication for more information on enabling Single-sign On.

29 Installing the Web Server 29 Nimbus Control App If you intend for users to access video files through the Nimbus Control Player iphone Edition app (downloadable from the Apple App Store and available for the ipad, iphone and ipod) then you must ensure that the relevant MIME types are configured on the server (for example.mp4,.mov,. m4v, etc). MIME types need to be configured either on a per-site basis, or server-wide. What Next... Enable Single-sign On To allow users to log in to the Web Server automatically, i.e. without having to provide their credentials once they are logged in to the network, Windows Integrated Authentication must be enabled. See Configuring Authentication for more information. Integrate the Web Server with SharePoint The Web Server can be integrated with SharePoint in order to provide Nimbus Control functionality in a SharePoint environment. See Integrating Nimbus Control with SharePoint for more information. Configure the Web Server There are many configuration options which define how the Web Server works. These parameters are defined in the Web Server configuration file. See Configuring the Web Server for more information.

30 30 Chapter 2 Installation Schedule the synchronization of the Web Server A number of tasks need to be updated regularly to ensure that users are accessing up-to-date information. See Synchronizing the Web Server for more information. Customize the Web Server There are a number of ways in which to customize the look and feel of the Web Server. See Customizing the Web Server for more information. Related topics Integrating Nimbus Control with SharePoint Configuring Authentication Upgrading a Web Server

31 Installing the Web Server Configuring Authentication Nimbus Control supports Integrated Windows Authentication (IWA) and Netegrity SiteMinder to provide Single-sign On (SSO). This allows users to automatically log in to Nimbus Control without having to provide any credentials once they are logged on to the network via their PC. Lightweight Directory Access Protocol (LDAP) integration is also supported. Whilst not required by IWA, LDAP ensures user names and passwords match in both the directory service and in Nimbus Control Configuring LDAP Integration Nimbus Control can use Lightweight Directory Access Protocol (LDAP) to integrate with a central directory service database in order to manage user accounts and user groups, with passwords being authenticated against the directory service. Prerequisites The LDAP Synchronization Service is installed. This is part of the Action Server (see Installing the Action Server for more information). Seven user groups are predefined in the directory services environment (see Nimbus Control Default System User Groups below for more information). Nimbus Control Default User Groups There are seven default user groups within Nimbus Control and the corresponding groups must be defined in the directory services environment. These default groups can have any name, provided that the distinguished names of the groups are configured correctly in the LDAP configuration file to match up with the directory services. These groups will define who has access to the Nimbus Control environment, and what their licensed role is. Main Groups All Nimbus Control users must exist in one of the following four main system user groups: Administrators (provides users with administrative functions and access to all areas of Nimbus Control). Authors (provides users with the ability to create, edit and manage process content in a process repository). End Users (provides users with access to the Web interface only, users cannot create or edit process content). Module Groups End users can be put into one or more module groups to grant them additional capabilities. End User with Change Module (allows users to assist in change management, including authorizations, reviews, promotions, etc). End User with Action Module (allows users to access action management functionality, including viewing actions, undertaking actions, creating and editing actions). End User with Mobile Module (allows users to download storyboards and attachments to their mobile devices).

32 32 Chapter 2 Installation Notes: End Users assigned to one of the End User module groups (above) must also exist in the End User group, otherwise they will not have access to Nimbus Control. End Users can be assigned to more than one module group. Example If Jo Bloggs is an End User who requires change management and action capabilities, she should be assigned to the End User, End User with Change Module and End User with Action Module user groups. How does LDAP Integration in Nimbus Control work? Users must be allocated to one of the four main Nimbus Control default system user groups, which must also be defined in the directory services environment. At defined intervals, the LDAP Synchronization Utility synchronizes the internal list of users and user groups that are maintained by Nimbus Control with the directory services groups. When synchronizing, only the maximum number of users that are licensed for will be synchronized, so if there are more users than licenses then some users will not be synchronized. A notification will be sent to a nominated user account (as set in the LDAP configuration file) in this event. User authentication is performed by the directory services server. Users can also be optionally assigned to additional directory services user groups and have this assignment reflected inside Nimbus Control. In this case, the user groups must also be defined in Nimbus Control and set to be managed by LDAP through the Author Client (see Enabling and Disabling LDAP Management for Specific Users and User Groups below for more information). Nimbus Control is capable of synchronizing with multiple LDAP servers, allowing users to be drawn from multiple domains (for more information see Synchronizing with Multiple LDAP Servers below). Important Notes about Security Access to the LDAP configuration file All Nimbus Control Author Client users, and the Nimbus Control domain service account that the Web Server host.exe process runs under, must have 'read' access to the LDAP configuration file. It is important, however, to set operating system file permissions on the LDAP configuration file in order to prevent non-administrative users from modifying or deleting the file, which could allow access to any user account without the need for a password. Secure Lightweight Directory Access Protocol (SLDAP) Nimbus Control supports SLDAP. This is achieved by enabling the 'UseSecureChannel' parameter in the LDAP configuration file, and it is also automatically turned on when the port number specified in the LDAP configuration file is set to 636 (the default port used for secure LDAP). Each machine where the Author Client is installed must have the certificate to verify it as a trusted source; the application looks for the certificate in the standard certificate store, which can be managed by the MMC certificate snap-in. It is recommended that SLDAP is used when connecting to a directory server environment other than Active Directory, since domain passwords will not be encrypted if ordinary LDAP is used. Note that Active Directory uses normal Windows authentication protocols. HyperText Transfer Protocol Secure (HTTPS) When using LDAP integration, HTTPS should be used as users' domain passwords are passed over the network to the Web Server in a readable format, therefore posing a significant security

33 Configuring Authentication 33 threat. Enabling and configuring LDAP synchronization 1. Open LDAPconfig.ini (...\Nimbus Control\Process Repository\LDAP) in a text editor, such as Notepad. In the [MainSection] section set UseLDAP=1. 2. Modify any of the optional configuration parameters, as required. Note: Some of the parameters will not be present in the configuration file until LDAP synchronization has been run for the first time. MainSection UseLDAP UseSimpleBind Admin PortNumber Server Enable or disable LDAP synchronization. 0 = Disabled (default) 1 = Enabled Enable or disable Simple Bind. For Active Directory it must be disabled (default), for other LDAP server setups it must be enabled. 0 = Disabled (default) 1 = Enabled The address of the person who receives a notification when generated by the LDAP service. The port number used to communicate with the LDAP server (default is 389). The name or IP address of the LDAP server. Note: To define multiple LDAP servers, see Synchronizing with Multiple LDAP Servers below for more information. Main User Groups - all users must belong to one of these groups AdminsDN The Distinguished Name of the Nimbus Control Administrators group (default is Nimbus Control Admin). AuthorsDN The Distinguished Name of the Nimbus Control Process Authors group (default is Nimbus Control Author). EndUsersDN The Distinguished Name of the Nimbus Control End Users group. Module Groups - end users can belong to one or more module groups in order to grant users additional functionality. Note: Users must still exist in the EndUsersDN group ChangeModuleUsersDN The Distinguished Name of the Nimbus Control End User Change Module group. ActionModuleUsersDN The Distinguished Name of the Nimbus Control End User Action Module group. MobileModuleUsersDN The Distinguished Name of the Nimbus Control End User Mobile Module group. LoggingLevel The level of information that is written to the LDAP log file. 0 = None 1 = Low (default and recommended) 2 = Medium 3 = High

34 34 Chapter 2 Installation StartTime RepeatMins ReportDuplicates DupUserTypeOrder DecodeAsUTF8 CallDelayMSecs ThreadPriority UseFullDN 4 = Full The start time that the LDAP service will run for the first time. The time between LDAP synchronization runs (in minutes). Default is 1440, i.e. one day. Turn on/off duplicate user logging. If turned on then a log entry is recorded if a user with the same name exists in more than one of the three main LDAP groups (Administrators, Authors or End Users). 0 = Disabled 1 = Enabled (default) Specify the order of preference for the effective user account type if a user is duplicated across more than one of the main system user groups (Administrators, Authors, End Users and Connect Users). 1 = Administrator 2 = Author 3 = End User The default is: DupUserTypeOrder= 3,2,1 (this means, for example, that a user in both the Administrators and Authors user groups has the permissions of an author by default, since the Author account type precedes the Administrator account type). The order can be changed, as required. Enable or disable UTF-8 decoding (for LDAP v3 servers). See Further Information below for details. 0 = Disabled (default) 1 = Enabled Specify an optional delay (in msecs) after each call to the LDAP server during synchronization. See Further Information below for details. 0 = Disabled (default) = Delay to use (in msecs) Prioritize the synchronization thread in order to reduce CPU load during long synchronizations. 0 = Idle 1 = Lowest 2 = Below Normal 3 = Normal (default) 4 = Above Normal 5 = Highest 6 = Critical Enable or disable sending the full DN for authentication. This is required for NDS and OpenLDAP but is not required for Active Directory. 0 = Disabled (default) 1 = Enabled

35 Configuring Authentication System Report Resume RunOnStart SyncByAccountName IncludeInitials EncryptionType UserName Password 35 This parameter is written following the first synchronization. The 'Sent As' address used by the LDAP service for outgoing s (it is useful to use a real address so that bounced s are not received by users). The addresses of the people who will receive completion reports generated by the LDAP service. Multiple addresses must be separated by semi-colons. This parameter is written following the first synchronization. Select for synchronization to wait until the next start time to run or to run at the next scheduled interval. 0 = Wait for start time 1 = Run on start This parameter is written following the first synchronization. Specify whether to run the synchronization immediately each time the service is started or to wait for the Start Time. 0 = Wait for start time (default) 1 = Run on start This parameter is written following the first synchronization. Specify to synchronize by the LDAP DN field or the Account Name field. See Further Information below for details. 0 = Synchronize by DN field (default) 1 = Synchronize by Account Name This parameter is written following the first synchronization. Enable Users' Initial field to be included when synchronizing. For example, First name=john, Last name=von Trap. This parameter is written following the first synchronization. Specify the level of password encryption. 0 = Password to be decrypted by any PC 1 = Password can only be decrypted by the PC that performed the original encryption 2 = Password can only be decrypted by the PC that performed the original encryption and by the same user This parameter is written following the first synchronization. The user name required to authenticate with the LDAP server. For an Active Directory server this can be a user name or domain name and user name in the form Domain\User Name, for example NIMBUS_UK \JoSmith. For non-active Directory LDAP servers this usually needs to be the full user DN of the user account used for authentication. This parameter is written following the first synchronization. The password set by the client and is a base 64 encoded encrypted password. The level of encryption used is set by the EncryptionType setting.

36 36 Chapter 2 Installation This parameter is written following the first synchronization. Anonymous Enable or disable anonymous access to the LDAP server. The UserName and Password parameters above are used for authentication. 0 = Authenticated access (the UserName and Password parameters, as described above, as used to authenticate with the LDAP server) 1 = Unauthenticated access (default) This parameter is written following the first synchronization. IncDisabledUsers Include or exclude users marked as Disabled in Active Directory when synchronizing with LDAP. If included, disabled users will appear as unassigned in Nimbus Control. If excluded then disabled users will not appear in Nimbus Control. 0 = Exclude disabled users (default) 1 = Include disabled users This parameter is written following the first synchronization. UseSecureChannel Enable or disable secure LDAP authentication (note that setting the port number to 636 will also enable secure LDAP). 0 = Disabled (default) 1 = Enabled This parameter is written following the first synchronization. IgnoreServerCertificateErr Ignore certificate errors (expired, incorrect domain, etc) during LDAP ors calls. Note that UseSecureChannel must also be set to '1'. (This parameter is written following the first synchronization). 0 = Don't ignore (default) 1 = Ignore AttrMapSection - these parameters are users' details that are integrated by LDAP UserName FirstName LastName Name MemberName MobileName WorkPhone StreetName CityName StateName ZipCode Country The unique name field that users are known by in the directory service, i.e. the name that the user logs in with. The first name field for users. The last name field for users. The address field for users. The attribute used by a group to define the members within it (by default in most LDAP implementations this is 'member'). The mobile telephone number field for users. The work telephone number field for users. The street field for users. The city field for users. The state field for users. The zip/postal code field for users. The country field for users.

37 Configuring Authentication Description ReportsTo DTx 37 The description field for users. The account name of the user's line manager. Note: This field is required to escalate users' To-do items. Data table field names associated with user accounts. For example: DT1=site-group-id DT2=unit-id DT3=division-id...etc Further Information The following provides more information on some of the LDAP configuration parameters, as described above. DecodeasUTF-8 Certain LDAP v3 servers can use UTF-8 encoding when supplying data that has non-ascii characters in it and return this information in UTF-8 encoded UNICODE, therefore requiring conversion to ANSI characters using the current code page. Setting this value to '1' will enable UTF8 decoding of all applicable received data. If Activity Directory is in use, however, this value must be '0', i.e. disabled, as this converts non-ascii text to ANSI before returning it, potentially causing misinterpretation of certain characters. SyncByAccountName When synchronizing with the LDAP server you can choose to synchronize by users' DN field or their Account Name field. If set to '0', which is the default, then the LDAP DN field is used. If set to '1', the Account Name field is used, which prevents users from being deleted and recreated with a new user ID number in the synchronization process if their distinguished names change. CallDelayMSecs When synchronizing with the LDAP server you can specify a delay after each call, in milliseconds. It works by calling the Windows Sleep API call which enables Windows to process other work. The maximum value is 1000 (1 second) but it is recommended that the value is set between 10 and 20 to reduce CPU load, then increased if necessary. If no value is specified then it is disabled by default. Enabling and Disabling LDAP Management for Specific Users and User Groups By default, if LDAP is enabled then user accounts will be automatically managed by LDAP. User groups are not managed by LDAP unless specifically flagged. To enable or disable LDAP user management: In the User Accounts dialog in the Desktop Client, right-click the user and choose Properties. Select or deselect the This account is not to be managed via LDAP. To enable or disable LDAP user group management: To enable LDAP management for a user group, in the User Accounts dialog in the Desktop Client, right-click the user group and select This group is managed via LDAP. Enter the distinguised name (DN) for the user group (this must match the corresponding directory server group name). To disable LDAP management, deselect This group is managed via LDAP (note that if LDAP is

38 38 Chapter 2 Installation enabled you cannot disable LDAP management for the main user group roles). Note: LDAP group members that are not found will be skipped and will not be included as part of the synchronized group. To set the Ignore LDAP Flag (Admin Utility): The Admin Utility allows you to enable or disable the Ignore LDAP flag for specific user groups. This is useful if you want some groups to use a separate Control username and password to log in to Control and some groups to be managed by LDAP. Note: LDAP group members that are not found will be skipped and not included as part of the synchronized group. Run the Admin Utility (AdminUtil.exe, found in the Utilities folder on the CD) and from the Tools menu choose Toggle Ignore LDAP. Select to set the Ignore LDAP flag to On or Off, then select the checkboxes of your user groups and click Apply. Authenticated LDAP Access Most LDAP servers are set up to allow unauthenticated access. In most cases, access to the LDAP environment will not require authenticated access. However, certain sites require that any access to query the LDAP environment will require a known user. The Action Server can be configured to require authenticated access. This is achieved through the Author Client by allowing the user name and password to be stored in the LDAP configuration file. The password is stored encrypted and can be encrypted to three different levels - standard, local to the machine or local to the machine and user. The default, and recommended choice, is standard, which allows decryption on any machine. 1. In the Client, from the Administration menu choose Application Credentials and then Action Server LDAP service. 2. Select Authenticated. 3. From the Encryption Type drop-down list choose the type of encryption required. Standard allows decryption on any PC (recommended) Current PC allows decryption only on the PC that originally performed the encryption Current PC and current user allows decryption only by the PC that originally performed the encryption and when the same user is logged in. 4. Click OK. The following parameters are written to the LDAP configuration file (LDAPConfig.ini): Server x UserName Password Encryption Type This needs to be set to the name required to authenticate with the LDAP server. For an Active Directory server this can be a user name or domain name and user name in the form Domain\User Name, for example NIMBUS_UK\JoSmith. For non-active Directory LDAP servers this usually needs to be the full user DN of the user account used for authentication. This is set by the client and is a base 64 encoded encrypted password. The level of encryption used is set by the EncryptionType setting. This determines the level of password encryption. 0 = The password can be decrypted by any PC 1 = The password can only be decrypted by the PC that performed the original encryption 2 = The password can only be decrypted by the PC that performed the original encryption and when logged in as the same user

39 Configuring Authentication Anonymous 39 Set this for anonymous access (anonymous access is assumed by default). 0 = Non-anonymous access 1 = Anonymous access Synchronizing with Multiple LDAP Servers Nimbus Control is capable of synchronizing with multiple LDAP servers, i.e. to allow for multiple domains. To define additional LDAP servers, add a new section for each additional server to the end of the LDAPconfig.ini called [Serverx], where x is the additional server number. For each additional server you can also define another set of [AttrMapSectionx] and [AttrValuesx] if required, where x is the number of the additional server. For example, for [Server1] you would have [AttrMapSection1] and [AttrValues1]. Note: It is only necessary to define the parameters for additional LDAP servers if they are different from the parameters defined for the main LDAP server. The parameter settings for the main server will be referenced for any parameters that are not defined. [Server1] Server=LDAPServer1 PortNumber=636 [AttrMapSection1]... [Server2] Server=LDAPServer2 PortNumber=8765 [AttrMapSection2]...

40 Chapter 2 Installation 40 LDAP Logging See Logging LDAP Synchronization for more information. Clearing Users' Distinguished Names The Admin Utility allows you to clear all users' distinguished names (DNs) from the current process repository (i.e. the Control Action Server). This could be useful, for example, if you are restructuring the Active Server. This option should be used with extreme caution. The Admin Utility is found in the Utilities folder on the CD. Run AdminUtil.exe and from the Tools menu choose Clear All User DN's. What Next... Test the LDAP Synchronization Following the configuration of LDAP synchronization you can test the synchronization between the Directory Service list of users and the Nimbus Control list. This is achieved through the LDAP Utility - see Testing an LDAP synchronization for more information.

41 Configuring Authentication Configuring SSO via Windows Authentication (IWA) The Nimbus Control Web Server supports Integrated Windows Authentication (IWA), allowing users to access Nimbus Control without having to provide additional user credentials once they are logged in to their PCs. The server platforms supported for use with Nimbus Control all provide Windows authentication (Single-sign On), assuming a suitable Microsoft domain architecture is in use. Notes: Integration with any directory service other than Microsoft's Active Directory may work but is not supported by Nimbus. Internet Explorer 5 and 5.5 are not supported for IWA. If support for viewers that do not exist in the domain is also required, another copy of the Web Server can be installed and assigned to a different virtual directory, but pointing to the same process repository. This installation can be configured to use the anonymous mode of interaction for viewers and non-domain users. Prerequisites The user account names in Nimbus Control must be identical to the user names on the domain (LDAP synchronization is recommended - see Enabling and Configuring LDAP Synchronization for more details). The Web Server has been installed and correctly configured: DCOM security is configured. The Control host.exe COM+ object identity has been defined. Access rights to the Web Server folders and files have been defined. For more information on installing and configuring the Web Server, see Installing the Web Server. If the Web Server is running on Windows Server 2008 or later, the Authentication role must be installed. In Server Manager, use the Add Roles Wizard to add the Windows Authentication role. See IIS7 Component Not Installed for more information. Enabling IWA in Windows Server Run IIS Manager or IIS Virtual Directory Management Utility. Right-click the virtual directory used by Nimbus Control and choose Properties. Click the Directory Security tab to select it. In the Authentication and access control panel click Edit. Deselect Enable anonymous access and select Integrated Windows authentication. Open config.ini (...\Nimbus Control\Web Server\Config) in a text editor, such as Notepad. In the [Authentication] section set the following two parameters: UseIntegrated=1 IntegAuthType=0 7. Modify any of the other configuration parameters as required (see Configuring Authentication Parameters below for more details). 8. Save and exit config.ini. Enabling IWA in Windows Server 2008/2008 R2 1. Run IIS Manager and select the Nimbus Control application.

42 42 Chapter 2 Installation 2. In the IIS section select Authentication. 3. Enable Windows Authentication and disable Anonymous Authentication. 4. Open config.ini (...\Nimbus Control\Web Server\Config) in a text editor, such as Notepad. In the [Authentication] section set the following two parameters: UseIntegrated=1 IntegAuthType=0 5. Modify any of the other configuration parameters as required (see Configuring Authentication Parameters below for more details). 6. Save and exit config.ini. Configuring Authentication Parameters Authentication UseIntegrated RequiredDomain Enable/disable integrated authentication (set this to '1', i.e. enabled) (Optional) Specify the domain name that must be matched in addition to the user login name. Any domain matches if not specified. CaseSensitive Specify case sensitivity when matching the domain name (user name matching is always case sensitive) 0=Case insensitive 1=Case sensitive (default) IntegAuthType Specify the type of authentication used (set this to '0', i.e. Integrated Windows Authentication) ISAPI Authentication AlwaysUseIISAuthIn Specify whether to use IIS' authentication variables even when the IIS version fo does not support Unicode authentication details. 0=Disable (default) 1=Enable

43 Configuring Authentication Configuring SSO via Netegrity SiteMinder Authentication Nimbus Control supports sites that are managed by Netegrity SiteMinder to manage Single-sign On and access to URLs. The integration is based on the use of HTTP header variables that are set by the Netegrity SiteMinder agent with the authenticated username stored within it. Prerequisites The user account names in Nimbus Control must be identical to the user names on the domain (LDAP synchronization is recommended - see User Management\Configuring LDAP synchronization for more details). The Web Server has been installed and correctly configured with respect to DCOM security, the identity of the Control host.exe COM+ object has been defined and access rights to the Web Server folders and files has been specified. See Installation\Installation Procedures\ Installing the Web Server for more information. Configuring the Web Server to integrate with Netegrity SiteMinder Run IIS Manager or IIS Virtual Directory Management Utility. Right-click the Control virtual directory and choose Properties. Click the Directory Security tab to select it. In the Authentication and access control panel click Edit. Select Anonymous access (if not already selected). Click OK. Open the Web Server configuration file - config.ini (...\Nimbus Control\Web Server\Config) - in a text editor, such as Notepad. 8. In the [Authentication] section set UseIntegrated and IntegAuthType to '1', i.e. UseInegrated=1 IntegAuthType=1 9. In the [Authentication] section modify any of the following optional parameters: Authentication RequiredDomain Specify the domain name that must be matched in addition to the user login name. Any domain matches if not specified. CaseSensitive Specify case sensitivity when matching the domain name (user name matching is always case insensitive). 0 = Case insensitive 1 = Case sensitive (default) IntegAutoLogonOn Enable or disable automatic logon only, i.e. users cannot log out and ly access the Log On page. 0 = Disabled (default) 1 = Enabled IntegFailureURL Specify a URL to display when an unknown user account attempts to log in. If unspecified a built-in page is displayed. 10.In the [SiteMinderAuthentication] section modify any of the following optional parameters: SiteMinderAuthentication

44 44 Chapter 2 Installation HeaderFieldName Specify the header field to obtain the authenticated user name from. Assumed to be HTTP_SMUSER if not specified. PrimaryEncoding Specify the primary encoding part of the SiteMinder HTTPHeaderEncodingSpec setting. 0 = No encoding (default) 1 = UTF-8 encoding SecondaryEncodin Specify the secondary encoding part of the SiteMinder g HTTPHeaderEncodingSpec. 0 = No encoding (default) 1 = RFC-2047 encoding

45 Configuring Authentication Integrating Nimbus Control with SharePoint Nimbus Control can be integrated into Microsoft SharePoint, allowing users to access process information, such as processes, documents, To dos, storyboards, scorecards, etc, through a SharePoint interface. There are two deployment methods for integrating Nimbus Control into SharePoint: Local Integration Local integrations allow the Nimbus Control Web Server to be installed on the same server as SharePoint. Remote Integration Nimbus provides a remoting solution that allows the Nimbus Control to be installed on a different server to SharePoint. Remoting allows one or more SharePoint servers to connect to a single Nimbus Control Web Server, and multiple remote Nimbus Control Web Servers can connect to a single process repository. Remoting also allows the Web Server to be installed on a server that does not have IIS installed. SharePoint Farms The Nimbus Control Web Server can also be run within a SharePoint farm using the Nimbus remoting solution. The remoting configuration changes to the SharePoint web.config file must be applied on every SharePoint Front-end Web Server. The Nimbus Control Web Server must be configured for remoting. Control.wsp only needs to be deployed on the machine in which the SharePoint Central Administration site is installed, i.e. it is not necessary to manually deploy the file on every machine within the farm. Network Load Balancing There are issues when using load balancing between a remoted SharePoint server and multiple back-end Nimbus Control web servers. For more information please refer to Deployment/Complex Deployment in the Installation Planning Guide. In this chapter: Integrating Nimbus Control with SharePoint Upgrading an existing Nimbus Control SharePoint integration Adding Nimbus Control Web Parts to non-control SharePoint sites Integrating Nimbus Control with a SharePoint document library Note: This guide assumes the user is adept with SharePoint and the administration of SharePoint sites.

46 46 Chapter 2 Installation Configuring a SharePoint Integration This topic describes how to configure the integration of the Nimbus Control Web Server with SharePoint, either locally or as a remote integration. Prerequisites Software requirements: Windows Server 2003 or 2008 with Windows SharePoint Server or Microsoft Office SharePoint Server. Nimbus supports both SharePoint 2007 and SharePoint In Windows Server 2008, the IIS 6 Metabase Compatibility role must be installed (in Server Manager, use the Add Role Services Wizard to add the IIS Metabase Compatibility role). The Nimbus Control Web Server must be installed into either a new IIS site with a specified host name (for example, NimbusControl), or installed into the default SharePoint-80 site. Note: Installing the Web Server into the SharePoint-80 site is not supported for SharePoint bit deployments, therefore a new site must be used in this case. Note: The IIS site is selected in the IIS Configuration Options when installing the Nimbus Control Web Server. Note that the Web Server can be installed on a server without IIS by deselecting Configure Nimbus Control for use via Internet Information Server. In this situation the Web Server can only be accessed using the remoting solution. If IIS is installed then a single Web Server installation can be used to serve both a remoted SharePoint integration and the Classic Web Server. The Nimbus Control Author Client is installed and has been run against the process repository at least once. (Remoting only).net 3.0 runtime (recommended.net 3.0 Service Pack 1 or greater) is installed on the server that hosts the Web Server. Additional requirements: If you are using Windows Integrated Authentication, it is advisable to ensure that authentication is working correctly via the Classic Web Server before configuring the SharePoint integration. Note: Nimbus Control does not need any specific authentication mode set in its configuration file as SharePoint requests are authenticated separately. (Remoting only) It is important to ensure that the user account that the remoting host service is running under, as specified in the service properties, has launch permission rights over the Control server COM object. The same user account also requires default COM access rights so that the Control server COM object can communicate back to the service. See Installing the Web Server for DCOM information.

47 Integrating Nimbus Control with SharePoint 47 What if the Nimbus Control Web Server has already been installed as a standard web site? You can configure the integration of the Nimbus Control Web Server into SharePoint if the Classic Web Server has already been installed. Please note that these steps apply only if you are configuring a local integration. For remote integrations there are no precursor steps. To configure a local integration 1. Install Windows SharePoint Services (if it has not already been installed). Note: The default Nimbus Control web site service will be stopped following the installation of WSS. 2. Follow the steps according to which server you are using: Windows Server 2003 In IIS Manager, create a new virtual directory within the IIS site (for example, in the SharePoint - 80 site). The web site content directory is the Main folder in the Web Server folder (default location is C:\Nimbus Control\Web Server\Main). The access permissions of the virtual directory must be set to Read and Execute. Windows Server 2008 In IIS Manager, add a new Application. The physical path needs to point to the Main folder in the Web server folder and the application pool needs to be set to Control Pool. Configuring SharePoint to work with the Nimbus Control Web Server Note: If you are configuring the integration of the Nimbus Control Web Server into a SharePoint farm then the following updates to the SharePoint configuration file must be applied to every SharePoint front-end Web Server. 1. Open SharePoint Web.config changes.txt (SharePoint folder on the CD) and web.config (... \Inetpub\wwwroot\wss\VirtualDirectories\80). 2. Copy the following Nimbus section group element from the SharePoint Web.config.changes. txt file and paste in the web.config file. This should be nested within the <configsections> tags, as shown in Fig.1. You do not need to copy the <configsections> tags as they already exist in the SharePoint configuration (web.config) file. <sectiongroup name="nimbus"> <section name="general" type="nimbus.web.comm...> <section name="credentials" type="nimbus.web.comm...> </sectiongroup> 3. Copy the following Nimbus configuration element from the SharePoint Web.config.changes.txt file and paste in the web.config file. This should be nested within the <configuration> tags. See Fig.2. <nimbus> <general> <main defaultsiteurl="" serverconnectionmethod...> etc </nimbus> 4. Copy the following system servicemodel element from the SharePoint Web.config.changes.txt file and paste in the web.config file. This should be nested within the <configuration> tags. See Fig.3.

48 48 Chapter 2 Installation <system.servicemodel> <bindings> <netnamepipebinding> </client> </system.servicemodel> 5. In the web.config file, set the following parameters depending on what type of integration you are configuring: Parameter Local Integration Remote Integration defaultsiteurl N/A URL of the Nimbus Control SharePoint site. For example: serverconnectio nmethod COM WCF comserver serverconfigfile Path of the Nimbus Control Web N/A Server configuration file. For example: C:\Nimbus Control\Web Server\Config\config.ini wcfserver clientidentitytyp e N/A The user account used to make calls to the remote Control Web Server. There are two options: (1) SpecifiedUser (recommended). If selected you must set the wcfclientidentity username credentials (see below). (2) Process. This will use the account under which the SharePoint ASP.NET runs under (not the logged in user). wcfserver endpointname N/A The end point name used when connecting remotely. To specify a remote connection via a TCP connection, set this to NimbusTcpEndpoint. wcfclientidentity username domain password N/A If SpecifiedUser was selected as the Client Identity Type (above) you must define the identity credentials (user name, domain and password). Note: Since these credentials are in a separate section to the general settings you can encrypt them without affecting the general settings. For more information see the following links: How to encrypt configuration sections in

49 Integrating Nimbus Control with SharePoint 49 ASP.NET using DPAPI How to encrypt configuration sections in ASP.NET using RSA For an example of the 'nimbus.credentials' section see See Fig. 4. endpoint address N/A Set this to the applicable protocol, server and port for each endpoint. There are two endpoints specified. For remoting, the TCP binding will be required and so the NimbusTcpEndpoint item must be updated. It is important to ensure the port matches the value specified in the NimbusServerHost. exe.config file (default location is C:\Nimbus Control\Web Server\Remoting Server). See Fig. 5. Note: Please do not edit the 'maxpoolconnections', 'maxconnectionwait' or 'connectionwaitcheckmsecs' default values unless explicitly instructed to by Nimbus Support. Incorrect values can cause errors or intermittent failures. These parameters should only be changed if you are experiencing problems and only when advised by Nimbus Support. 6. (Local Integrations Only) In IIS Manager, create a new virtual directory called nimbus_control in the IIS site where the Web Server is installed under (for example, in the SharePoint-80 site), within the _layouts virtual directory. Point it at the Web Server 'Main' installation folder and provide Read access. Installing the Nimbus Control SharePoint solution Note: If you are configuring a remote integration with SharePoint then these steps apply only to the Central Administration Site on the SharePoint server. 7. Open a command-prompt window and navigate to one of the following directories: SharePoint 2007:...\Program Files\Common Files\Microsoft Shared\web server extensions\12 \BIN SharePoint 2010:...\Program Files\Common Files\Microsoft Shared\web server extensions\14 \BIN 8. Run the following command: STSADM.exe -o addsolution -filename <path to NimbusControl.wsp> For example: STSADM.exe -o addsolution -filename C:\Control\NimbusControl.wsp Note: The NimbusControl.wsp file can be found in the SharePoint folder on the Nimbus Control Installation CD. Deploying the Nimbus Control site 9. Depending on what version of SharePoint you are using, access the following SharePoint page: SharePoint Central Administration >> Operations tab >> Global Configuration

50 Chapter 2 Installation 50 section >> Solution Management. SharePoint Central Administration >> System Settings >> Manage Farm Solutions. Note: You must add the SharePoint Central Administration Web site to the list of local intranet sites in order to be able to deploy the Nimbus Control site. 10.Click NimbusControl.wsp, then click Deploy Solution and choose to deploy to the same web application ( See Fig Recycle the SharePoint Central Administration Pool. Creating a Nimbus Control site in SharePoint 12.In the SharePoint Central Administration console select the Application Management tab. 13.Under SharePoint Site Management click Create site collection. See Fig.7. If you are integrating the Nimbus Control Web Server locally then you have finished. Otherwise, to complete a remote integration please follow the additional steps below. Finalizing the configuration of the Nimbus Control Web Server for remoting This method describes the configuration of the Nimbus Control Web Server to enable remoting, once the SharePoint configuration described above is complete. 1. Run NimbusServerHost.exe. NimbusServerHost.exe is found in...\nimbus Control\Web Server\Remoting Server. A shortcut is also added to the Nimbus Control Program Group in the Start Menu. The application can be run as either a Windows service or manually, i.e. interactively. The interactive mode is designed for initial configuration testing. To install the application to run as a service you must have administrative rights. Note that only one instance can be run on a single server. For Windows Vista and Windows Server 2008 you must elevate your administrative rights. To do this, right-click NimbusServerHost.exe, or right-click the shortcut, and select Run as administrator. 2. Click Install service. 3. Open NimbusServerHost.exe.config (...\Nimbus Control\Web Server\Remoting Server) in a text editor and define the following values: Parameter Description <add key="caller. UserName" value="" / > The user account used to connect and make requests to the Control Web Server from the SharePoint server. Note: If a user is not specified then any user is permitted to connect to the remoting service to make requests. <add key="caller. Domain=" value="" / > The domain of the user account specified above. <add The location and port of the remoting host service. baseaddress="net. tcp://localhost:52000/ controlweb" /> Notes:

51 Integrating Nimbus Control with SharePoint 51 A TCP/IP request can be denied access by the server itself before the request is sent to the NimbusServerHost.exe process, therefore ensure that the user account is known and that it has the applicable rights to the server that is hosting the Control Web Server. The WebServer.CLSID value is a unique identifier that is set during the installation of the Web Server and should not be changed unless manual changes to this value are made elsewhere. 4. Start the remoting service in Windows Services. What Next... Grant Access to Users Users must be provided with access to use the site. From the Site Settings page (accessed from Site Actions), authenticated users should be added by default, unless specific user access is required, in which case the appropriate users should be granted permission. The minimum access requirement for the site is 'Team Site Visitor' (read only). Related Images Fig. 1. Fig. 2.

52 52 Chapter 2 Installation Fig. 3.

53 Integrating Nimbus Control with SharePoint 53 DPAPI <nimbus> <credentials configprotectionprovider="dataprotectionconfigurationprovider"> <EncryptedData> <CipherData> <CipherValue> AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAMqrxJKRmxkGBamO56i/6ngQAAAACAAAAAAADZgAAqAAAABAAAAAgJC1QthpcY3d/dujEXQu+AAAA AASAAACgAAAAEAAAACTF8TKQl6zW39WVPtCJrxvoAAAAbbwIsiqnfNwy+iYP96M5Sa4R4TivVv7sblP/TJ6cpIPYjZfXJfbN+jDkaSuMvjYF7hFIsLngB 4Xn/94WSPiiNhHC5pskguotH23DuzmjBaZo6LoK5EYuRY/B6Cy9PwM9JpAPaKVmxRDXuRgSYVh1fX/bKgRkj26LfXluKejf4eGxChEj2oBH/TakRxHU QRgz487jUP+Yb+TqyG/6Piy8+UWTJFF10QJJSTgbfBfswnG5KHXPZTnkDLVN+DpIshLjXIQM0eKl95wNuw8e87k854dgohPfJEWJLgCUKxQJkPi/PR MvtTJanhQAAADXhzzASs/FL/BwChKOWDLlTc4fmg==</CipherValue> </CipherData> </EncryptedData> </credentials> </nimbus> RSA <nimbus> <credentials configprotectionprovider="rsaprotectedconfigurationprovider"> <EncryptedData Type=" xmlns=" <EncryptionMethod Algorithm=" /> <KeyInfo xmlns=" <EncryptedKey xmlns=" <EncryptionMethod Algorithm=" /> <KeyInfo xmlns=" <KeyName>Rsa Key</KeyName> </KeyInfo> <CipherData> <CipherValue> PQBY4HFpkps+FY1C8+EsRZtH//8HnCdbOm5VD/ypBjpg7djg+vnAuzmKqOhIkbN4kx1s6fykmXBXPJ4HC7WGHYqvlg3XK1G4mKylPY3CLHVzGh0A X0GQ0+AsoxZj3k3aCnp+N6sTmhpA3SQQ66NWc16HGm7R+Y/zTlk740p2mMU=</CipherValue> </CipherData> </EncryptedKey> </KeyInfo> <CipherData> <CipherValue> iyzgy3vukelvm/8xgaq8nqkdynlkjl6cyv/sfeuqo9guoho96w1xvdszfzb2v/go7mkyfgi5xltdmiheuaoenwouvs9rvguc8alrn9ey8idjerrsib0z 67FRGmBDNNqW9vMVZFDj94DZbF6T8VgQQ1BqgTr/xPnsQ0GJ/VqrHKo=</CipherValue> Fig. 4. Example Nimbus Credentials

54 54 Chapter 2 Installation Fig. 5. Endpoint address Fig. 6.

55 Integrating Nimbus Control with SharePoint 55 Fig. 7.

56 56 Chapter 2 Installation Upgrading a SharePoint Integration This topic describes how to upgrade an existing Nimbus Control SharePoint integration. Prerequisites Nimbus Control Service Pack 1 (or higher) with the Web Server integrated into a SharePoint instance. See SharePoint Integration for more information. Windows Integrated Authentication must be enabled for Nimbus Control version SP1, however from version SP2 this is not required as SharePoint authentication requests are handled separately. (Remoting only) The latest Nimbus Control remoting host service has been installed and configured. Upgrading a Nimbus Control SharePoint integration If you are upgrading a remote SharePoint integration proceed from Step (Local only) Open web.config in a text editor, such as Notepad, and update the "comserver serverconfigfile" value with the path of the Web Server configuration file from the new installation (for example, C:\Nimbus Control\Web Server\Config\config.ini). web.config:...\inetpub\wwwroot\wss\virtualdirectories\80 2. (Local only) In IIS Manager, open the properties for the _layouts/nimbus_control virtual directory for the IIS site that the Web Server is installed under and update the Local path of the Web Server (if required). 3. From a command prompt, navigate to: SharePoint 2007:...\Program Files\Common Files\Microsoft Shared\web server extensions\12 \BIN SharePoint 2010:...\Program Files\Common Files\Microsoft Shared\web server extensions\14 \BIN Run the following command: STSADM.exe -o upgradesolution -name Control.wsp -filename NimbusControl.wsp -immediate -allowgacdeployment For example: STSADM.exe -o upgradesolution -name NimbusControl.wsp -filename "C:\Nimbus Control\NimbusControl.wsp" -immediate -allowgacdeployment Note: The NimbusControl.wsp file can be found in the SharePoint directory on the Nimbus Control installation CD. Note: If the Windows SharePoint Services Administration service is not running, an error message will prompt you to run the following command: STSADM.exe o execadmsvcjobs 4. Recycle the SharePoint Central Administration Pool. Important Note Upon completion of the upgrade you must create a new Nimbus Control site collection, otherwise some of the new pages may not work. It is also recommended that you remove the old site collection.

57 Integrating Nimbus Control with SharePoint Adding Control Web Parts to other SharePoint sites Nimbus provides a number of Control Web Parts which can be imported into any SharePoint site (including sites not linked to Nimbus Control) in order to provide users with access to specific Nimbus Control functionality. The Web Parts available are: Favorites - ListOfFavorites.webpart To Dos - ToDos.webpart My Searches - MyTopics.webpart My Searches Results - MyTopicsResult.webpart Diagram Search Results - SearchDiagramsResult.webpart Document Search - Documents.webpart Recently Viewed Items - ListOfRecentlyViewed.webpart Action List - ListOfActions.webpart Importing and activating the Nimbus Control Web Parts If a Nimbus Control SharePoint solution has not been deployed on a particular server, you must first import and activate the Nimbus Control Web Parts in order to use them in other SharePoint sites. After installing the Nimbus Control Web Server, the various Web Parts can be imported from the following location: SharePoint 2007:...\Program Files\Common Files\Microsoft Shared\web server extensions\12 \TEMPLATE\FEATURES\NimbusControlWebParts SharePoint 2010:...\Program Files\Common Files\Microsoft Shared\web server extensions\14 \TEMPLATE\FEATURES\NimbusControlWebParts You must also activate the Web Parts in the site that you want to use them in: 1. Click Site Actions and choose Site Settings. 2. Under Site Collection Administration click Site collection features. 3. Click Activate for the Nimbus Control Web Parts option. The Control Web Parts are now ready to be added to the site. Nimbus Control Web Parts Nimbus Control Web Parts retrieve data directly from a Nimbus Control installation, either from a local installation using COM or from a remote installation using WCF. This requires that COM or WCF has been correctly configured on the local SharePoint server (see Configuring a SharePoint Integration for more information). Control Web Parts must also be linked to the main Control site in order for any hyperlinks to work. This can be achieved by either setting the default site URL in the SharePoint server's web.config file (see Specifying a default Nimbus Control site URL below for more information) or by configuring each Web Part independently. To configure Web Parts independently, deselect This is a Nimbus Control site under the Miscellaneous properties and enter the URL for the main Control site (for example,

58 58 Chapter 2 Installation Specifying a default Nimbus Control site URL If you don't want to specify the Control site URL for each Web Part you can set a default site URL in the SharePoint configuration file. Any Nimbus Control Web Parts that do not have a URL set will assume the default URL. 1. Open SharePoint Web.config changes.txt and web.config. SharePoint Web.config.changes.txt: The SharePoint folder on the Installation CD. SharePoint Configuration File (web.config):...\inetpub\wwwroot\wss\virtualdirectories\80 2. Copy the following Nimbus section group element from the SharePoint Web.config.changes. txt file and paste in the web.config file. <sectiongroup name="nimbus"> <section name="general" type="nimbus.web.comm...> <section name="credentials" type="nimbus.web.comm...> </sectiongroup> This should be nested within the <configsections> tags (see Fig.1.). You do not need to copy the <configsections> tags as they already exist in the SharePoint configuration (web.config) file. 3. Copy the following Nimbus configuration element from the SharePoint Web.config.changes.txt file and paste in the web.config file. <nimbus> <general> <main defaultsiteurl="" serverconnectionmethod...> etc </nimbus> This should be nested within the <configuration> tags (Fig.2.). 4. In the web.config file, specify the main defaultsiteurl parameter in the <nimbus> configuration parameters, for example: main defaultsiteurl="

59 Integrating Nimbus Control with SharePoint 59 Favorites Web Part The Favorites Web Part can be configured to display or hide certain elements. In the Miscellaneous properties, select or deselect any of the checkboxes, as required. 1. Click Site Actions and then Edit Page. 2. On the Favorites Web Part click edit. 3. Expand Miscellaneous and select or deselect any of the elements. 4. Click OK. Including Nimbus Control searches in the SharePoint Enterprise Search page The SharePoint Enterprise Search facility can be configured to search for processes, storyboards and documents, based on users' associated keywords or free text. Note: This applies to Microsoft Office SharePoint Server (MOSS) only as the Enterprise Search page is not available in Windows SharePoint Services (WSS). 1. Import the Nimbus Control My Searches and the Nimbus Control My Processes Search Web Parts into the SharePoint site (see To add Nimbus Control Web Parts into non-control sites above). Nimbus Control Processes Search displays a list of process diagrams based on a free text search. Nimbus Control My Searches displays a list of storyboards, documents and process diagrams based on a user's My Topics keyword search. 2. Navigate to the Enterprise Search page for the SharePoint site and conduct a search. Note: This step is required to access the Search Results page in the Enterprise Search, therefore it is not important what results are returned. 3. Click Site Actions and then Edit Page. 4. Click Add a Web Part in the Bottom Zone. 5. In the Suggested Web Parts to Bottom Zone, select Nimbus Control My Searches and Nimbus Control My Processes Search, then click Add. 6. Click Edit on the respective Web Parts that you have just added. 7. In the properties of the Web Part, expand Miscellaneous and select what content to display when users conduct a search. See Fig Deselect This is a Nimbus Control site, then specify the site above (for example ( Nimbus Control). 9. Click OK.

60 60 Chapter 2 Installation Adding a process search tab to the Enterprise Search page You can add a tab to the Enterprise Search page that provides users with the ability to run free text searches for processes only. Note: This applies to Microsoft Office SharePoint Server (MOSS) only as the Enterprise Search page is not available in Windows SharePoint Services (WSS). Creating the Process Search Pages First you will create the Search and Search Results pages. 1. Open the Search Center site in a browser, click the Site Actions menu, then click Create Page. Search page: Enter a title (for example, Processes). Enter a URL name for the page in the URL Name field (for example, Processes). Select (Welcome Page) Search Page as the page layout. Click Create to create the page. 2. Repeat Step 1 to create the Processes Search Results page. In the URL Name field enter a different URL name (for example, ProcessResults). For the layout, select (Welcome Page) Search Results Page. Configuring the Process Search Pages Now you will configure the pages that you have created. 3. Navigate to the page that you created in Step 1. For example: 4. Click the Site Actions menu, then click Edit Page 5. Click edit on the Search Box Web Part, then choose Modify Shared Web Part. 6. In the Search Box Web Part properties, expand Miscellaneous and in the Target search results page URL field enter the page URL that you created in Step 2. For example, ProcessResults.aspx. 7. Under Miscellaneous, deselect Display advanced search link. Click OK to finish. This will remove the Advanced Search facility from the Search options, as Nimbus Control Web Parts are not compatible with advanced searching. 8. Navigate to the page that you created in Step 2, click the Site Actions menu, then click Edit Page. For example:

61 Integrating Nimbus Control with SharePoint Repeat steps 4-6 to modify the Search Box Web Part. Use the same target search results page URL as you did for Step Remove all other Web Parts except the Search Box Web Part. 11.In the Bottom Zone click Add Web Part. Select Nimbus Control Processes Search, then click Add. 12.On the Nimbus Control Processes Search Web Part click edit, then Modify Shared Web Part. 13.In the Nimbus Control Processes Search Web Part properties, expand Miscellaneous and deselect This is a Nimbus Control site. In the field above this option, specify the URL of the Nimbus Control site. For example: control 14.Expand Appearance and from the Chrome Type drop-down list choose None. This will hide the title of the Web Part to users. 15.(Optional) Under Miscellaneous you can select Show details. This option will display returned results in greater detail. 16.Click OK to apply the changes to the Web Part, then click Publish to update the page. Creating the Tabs for the Process Search Pages Finally, you will create a new tab in the Search Center and Search Results pages. 17.In your browser, navigate to the Windows SharePoint Services list for the SearchCenter tab control: For example: 18.In the List toolbar click New item. Enter a tab name. In the Page field enter the page you created in Step 1 (for example, Processes.aspx). Click OK to create the new tab. 19.Repeat Step 18 to create a new tab in the Search Results page: For example: Note: In the Page field, enter the results page created in Step 2 (for example, ProcessResults.aspx).

62 62 Chapter 2 Installation Topic Images Fig.1. web.config Fig.2. web.config Fig.3. Web Part Properties

63 Integrating Nimbus Control with SharePoint Integrating with a SharePoint document library Nimbus Control can be integrated with a SharePoint Document Library in a specified Microsoft SharePoint environment. This allows users to register SharePoint document links in Nimbus Control, and to add documents directly into SharePoint through the Nimbus Control Document Registry. SharePoint document links are stored in:...process RepositoryATTACH\SharePoint Links\Draft...Process RepositoryATTACH\SharePoint Links\Master Integrating with a SharePoint document library Run AdminUtil.exe (found in the Utilities folder on the installation CD). Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the Configure menu choose Microsoft SharePoint Document Library. Select Enable SharePoint document library integration. Automatically store new documents in the default document library will automatically upload documents into the default SharePoint document library when a document is registered in the Nimbus Control Document Registry. 6. Click Add to add a SharePoint document site library. 7. In the SharePoint Connection Details panel, enter the following details: Site Name is the name of the site that hosts the document libraries that you want to link to. Site URL is the URL of the SharePoint site that holds the site library. User Name is the user name for an account that has administrative access rights to the SharePoint site. Password is the password for the user name specified above. Default site will automatically upload documents to this site when a document is registered in the Nimbus Control Document Registry (when the Automatically store new documents in the default document library option is enabled). 8. Click Refresh to display the list of available SharePoint document libraries. 9. Select one or more available libraries. Note: You must have a default library specified. To set a specific library as the default library, click the library to select it and click Set as Default. This will automatically upload documents into this library when a document is registered in the Nimbus Control Document Registry (when the Automatically store new documents in the default document library option is enabled). 10.Click OK. Note: To change the default site, i.e. the SharePoint site that is used to automatically upload documents to, double-click the site and in the SharePoint Connection Details panel select Default site.

64 Chapter 2 Installation Installing the Action Server This topic describes how to install the Nimbus Control Action Server. For more information on the Action Server, including software and hardware requirements and sizing, see the Installation Planning Guide that is included in the Documents folder on the installation CD. Please read the prerequisites and take the necessary actions before proceeding with the installation. Prerequisites 5MB of disk space The Nimbus Control Client is installed and the process repository is in a location that is accessible to the Action Server. It is important that you have read the Installation Planning Guide (included on the CD). Installing the Action Server 1. Do one of the following: Insert the CD and click Action Server Installation If the CD installation does not automatically start, from the CD run Setup.exe from the ActionServer folder. [Welcome] If no other Windows applications are running, click Next. Otherwise, terminate the installation in order to exit the applications, then re-run the setup. [Choose Destination Folder] The location in which the Action Server is installed will default to the location of the Client installation. To change location, in the Destination Folder panel click Browse to select a folder in which to install the Action Server in. To change the location of the process repository, deselect Use default sub-folder for Process Repository and click Browse in the Existing Process Repository panel to locate the process repository. Click Next to proceed. [Choose Services for Installation] Select the Action Server services that you want to install. Click Next to proceed. Depending upon which services you are installing, as selected in the previous step, you may be required to enter specific details with respect to certain services. [ Service Configuration] Outgoing mail SMTP server - this is the name, or IP address, of the SMTP server. Non Delivery Report Recipient - this is the address that non-delivered reports are sent to. [Lock Service Configuration] Start Lock Time - this is the time that the process repository is locked to allow you to back it up. Stop Lock Time - this is the time that the process repository is unlocked. [LDAP Synchronisation Service Configuration] Administrator's Address - this is the address that is notified if any problems with the LDAP synchronization occur. Address to user as from address for system s - this is the address

65 Installing the Action Server 65 that is used to send system s from. LDAP Server Name - this is the name, or IP address, of the LDAP server. First run time - this is the time that the first synchronization is run. Repeat Interval - this is the time between synchronizations (by default this is 1440, i.e. 24 hours). Click Next to install the selected Action Server services, then click Finish when prompted. Configuring DCOM In order for the Office Integration Service to be able to launch and access Excel, the DCOM access and launch rights must be configured to allow launch and access rights for the MS Excel COM object for the user account nominated to run the service. Windows Server 2003 onwards 1. Run the Component Services (from the Start Menu Run command prompt run dcomcnfg ). 2. Expand Console Root>Computers>My Computer>DCOM Config. 3. Right-click Microsoft Excel Application and choose Properties. 4. Click the Security tab to select it. 5. In the Launch and Activation Permissions panel click Customize, then click Edit. 6. Add the user account nominated to run the service and allow Local Launch rights. 7. Repeat steps 5-6 for Access Permissions, allowing Local Access rights. What Next... Configure the Action Server There are a number of configuration settings that can be defined for the respective Action Server services. See Configuring\Action Server Configuration\Configuring the Action Server for more information. LDAP Service Setup The LDAP service must be run as a known domain account to allow it to access the LDAP server and authenticate. Related topics Configuring LDAP Integration Configuring SMTP

66 Chapter 2 Installation Installing the Business Intelligence Server This topic describes how to install the Nimbus Control Business Intelligence (BI) Server. For more information on the Business Intelligence Server, including software and hardware requirements and sizing, see the Installation Planning Guide that is included in the Documents folder on the installation CD. Please read the prerequisites and take the necessary actions before proceeding with the installation. Prerequisites 3MB of disk space The Nimbus Control Client is installed and the process repository is in a location that is accessible to the Business Intelligence Server. It is important that you have read the Installation Planning Guide (included on the CD). Installing the Business Intelligence Server 1. Do one of the following: Insert the CD and click Business Intelligence Server Installation If the CD installation does not automatically start, from the CD run Setup.exe from the BI Server folder. [Welcome] If no other Windows applications are running, click Next. Otherwise, terminate the installation in order to exit the applications, then re-run the setup. [Choose Destination Folder] The location in which the BI Server is installed will default to the location of the Client installation. To change location, in the Destination Folder panel click Browse to select a folder in which to install the BI Server in. To change the location of the process repository, deselect Use default sub-folder for Process Repository and click Browse in the Existing Process Repository panel to locate the process repository. Click Next to proceed. [Start Installation] Click Next to install the BI Server. [Installation Complete] Click Finish to exit the installation. What Next... Configure the Business Intelligence Server There are a number of configuration settings that can be defined for the Business Intelligence Server. See Configuration\Business Intelligence Server Configuration\Configuring the Business Intelligence Server for more information. Synchronize the Business Intelligence Server The Business Intelligence Server can be scheduled to run as a Windows Scheduled Task in order to update metric data in Nimbus Control. See Configuration\Business Intelligence Server Configuration\Syncronizing the Business Intelligence Server for more information.

67 Installing the Business Intelligence Server 67 Related topics Updating Excel Macros Creating SQL Queries Scheduling and Updating SQL Queries Integrating with SAP BW and SAP NetWeaver BI Integrating with Microsoft Office Business Scorecard Manager Integrating with Cognos Metrics Manager 2.10 Installing the Nimbus Control Performance Monitor This topic describes how to install the Nimbus Control Performance Monitor. 64-bit Versions of Windows Server To use the Nimbus Control Performance Monitor in a 64-bit version of Windows Server (including Windows Server 2003, Windows Server 2008 and Windows Server 2008 R2), you must run the 32-bit version of the Windows Performance Monitor. To do this, run the following command: mmc.exe /32 perfmon.msc Prerequisites 10MB of disk space The machine is running Windows 2000 Server, Windows Server 2003 or Windows Server Note: Windows 2000 Server is not supported from onwards. Installing Nimbus Control Performance Monitor 1. Run Setup.exe from the Performance Monitor folder on the Installation CD. 2. [Welcome] If no other Windows applications are running, click Next. Otherwise, terminate the installation in order to exit the applications, then re-run the setup. 3. [Choose Destination Folder] The location in which the Performance Monitor is installed will default to the location of the Client installation. To change location, in the Destination Folder panel click Browse to select a folder in which to install the Performance Monitor in. Click Next to proceed. 4. Click Finish to exit the installation. Related topics Monitoring Web Server Performance Configuring Web Server Logging 2.11 Uninstalling Nimbus Control Each product must be uninstalled separately through the Add/Remove Programs in Windows Control panel.

68 Chapter 3 Security Nimbus Control Administration Guide

69 Securing a Process Repository Securing a Process Repository Since Nimbus Control requires users to have read, write and modify NTFS privileges against the Process Repository folder, this poses a potential security loophole in that it allows users to modify any of the Nimbus Control system files through normal file system capabilities (for example, through Windows Explorer). To prevent users from doing this, Nimbus recommends that you secure your process repository. Nimbus Control switches back to users' identities when performing external file operations, such as packaging, attaching files, registering files in the Document Registry, etc. Note: For Windows Vista, Windows Server 2008 and later versions of Windows that support User Account Control, UAC must be enabled. UAC is enabled by default but may have been disabled. See for more information. Before securing a process repository it is advisable to contact Nimbus Support. Prerequisites Nimbus Control has been installed and a user account that has NTFS read/write access to the process repository must exist. This account must also be able to run the Nimbus Control author client. Securing a process repository 1. Run RepoCred.exe (found in the Utilities folder on the CD). 2. Select the process repository that you want to secure and click OK. 3. In the Security Settings for Process Repository dialog select This account and specify the credentials of a single Windows user account for Control to run under when accessing the process repository. The account should not be an administrator account. Note: A new folder will be created at the same level as the process repository called Process Repositorycred (for example, C:\Nimbus Control\Process Repositorycred). Within this folder is a file called cred.ini which contains the credentials required to access the process repository (including the password which is strongly encrypted). 4. Set the NTFS access rights on the Process Repositorycred folder to Read only for all users of the Nimbus Control author client. 5. Set the NTFS access rights on the Process Repository folder to Access Denied for all user accounts except the nominated user account specified in step 3. It is also advisable to grant access to the system administrator(s). Note: To return to an unsecured process repository, run RepoCred.exe and select Logged on user. This option uses the identity of the Windows user who launches Control to access the process repository. You must then also ensure that all users who require access to run Control have read/write access to the process repository.

70 Chapter 4 Configuration Nimbus Control Administration Guide

71 Web Server Configuration Web Server Configuration Configuring the Web Server There are a number of options that can be defined for the Web Server and this topic provides a summary of the available options. Some of these options are covered in more detail in other related topics. Configuring the Web Server 1. Open config.ini (...\Nimbus Control\Web Server\Config) in a text editor, such as Notepad. The following configuration options can be defined: Installation IGUID WebServer DefaultMap DefaultPageURL Please do not change this value. Specify the full path of the default map for visitors only, for example Map1Folder\Map1. The map must be a master version and accessible to viewers. Specify a starting page for users. This option allows a relative or absolute URL to be defined that will automatically take users to a a specific page after they have logged in to the Web Server. For example, you could automatically navigate users to the Documents page, the Scorecards page or the Storyboards page upon logging in. Note: This option is not applicable if a map is specified for the DefaultMAP option (above), or if Single-sign On is enabled. Relative paths will have the Web Server's base URL and CtrlWebISAPI. dll appended to the start of the text before launching the user into the URL, so for example if you specify WebReports it will have <server>/<virtual directory>/ctrlwebisapi.dll/ appended to the beginning. Important - URLs need to be correctly encoded, i.e. all parts need correct HTTP escaping and non-ascii characters in the query parameters need UTF-8 encoding (which is then HTTP escaped with the whole query parameter). Examples directory>/ctrlwebisapi.dll/? id=webstoryboards directory>/ctrlwebisapi.dll/? id=webscorecards directory>/ctrlwebisapi.dll/? id=webdocs directory>/ctrlwebisapi.dll/? id=webreports Setting the Documents page

72 72 Chapter 4 Configuration There are a number of optional parameters that can be specified when setting the default page URL to the Documents page. Note: Query parameters must be prefixed with &. FiltDocNum={numeric value} allows you to filter by a specific document number FiltTitle={text value} allows you to filter by document title FiltMultiDown1={numeric value - unique item ID} allows an item from the first category drop-down to be filtered FiltMultiDown2={numeric value - unique item ID} allows an item from the second category drop-down to be filtered... FiltMultiDown7={numeric value - unique item ID} allows an item from the seventh category drop-down to be filtered Note: Multiple values can be specified for each drop-down item. The unique ID can be found in the Drop Down List dialog for a given dropdown list - if the ID field is not visible, from the View menu choose Column Customizing and drag the ID field on to the existing group of field headers. See Defining category drop downs under Document Registry Administration in the Nimbus Control Client Help for more information. PageSize={numeric value} allows you to set the number of items to display on the page FiltAuthStatus={numeric value} allows the authorization status to be filtered 0=All Authorized 1=Own UnAuthorized 2=All UnAuthorized 3=Authorized & Own 4=All Files (default if not specified) 5=All Pending & Authorized Note: A blank value may cause an error. FiltWithdrawn={true or false} includes or excludes withdrawn documents in the filtered search Note: False is the default if not specified. A blank value may cause an error. Example: id=webdocs.a ctupdatefilter&filtdocnum=&filttitle=&pagesize=15&filtmultiddown 3=23&FiltMultiDDown3=21&FiltMultiDDown2=19&FiltMultiDDown2=64 &FiltAuthStatus=4 The example URL above will search on documents with ID 23 or 21 in the third drop-down list and items with 19 or 64 in the second dropdown list.

73 Web Server Configuration 73 CLSID Unique identifier for the web server installation. Important: Do not change this value. SessionTimeout Specify the number of minutes before a user's session times out. Default=20, min=5, max=120 Note: For values greater than 20 you must also set the application pool session timeout through IIS to match the value set here. MyPageOverrideURL Override the Home page URL, for example personal_home.aspx ServerHTMLCheckInterv The interval, in seconds, between checks for changes to server-side al HTML files. -1 = Never re-check for changes (default) 0 = Check every time file is needed = Number of seconds before a recheck is made tibbr WorkspaceHeight Specify the maximum height of the tibbr Wall gadget in users' My Workspaces. Note: Default is 600 pixels. MySearches Discussion Specify the height of the tibbr Subject Messages gadget displayed in the Height Keyword page. Note: Default is 450 pixels. HTTP ChunklfSupported Enable or disable chunked HTTP responses for supported browsers. 0 = Disable 1 = Enable (default) DataFolder Path LockMode Cache Enabled Path This is the path of the process repository that the Web Server accesses. Note: The default location is <Installation directory>\nimbus Control \Process Repository. You will only need to change this parameter if multiple Process Repositories exist. Specify the lock mode that the Web Server utilizes when the process repository is backed up. If set to 0 the standard lock service installed with the Action Server will be used. If set to 1, the Volume Shadow Copy Service will be used in conjunction with the Backup Utility. Note: The Backup Utility can only be used in Windows Server 2003 and Windows Server See Backing Up a Process Repository for more information. 0 = Lock Service (default) 1 = Volume Shadow Copy Service Enable or disable the image cache (recommended to be enabled). Enabling image caching provides users with quicker access to diagrams in the Web Server. 0 = Disable 1 = Enable (default) This is the location of the image cache, as setup during the Web Server installation.

74 74 Chapter 4 Configuration Diagram DefaultScale DefaultZoomToFit ShowDraftBanner DefaultFormat Margin LeftMargin TopMargin RightMargin BottomMargin MaxWidth MaxHeight IntImageMargin IntImageLeftMargin IntImageTopMargin IntImageRightMargin IntImageBottomMargin IntImageMaxWidth IntImageMaxHeight Specify the default display size of diagrams: 0 = Reset Zoom Mode 1 = 680x480 2 = 800x600 3 = 1024x768 (default) 4 = 1152x864 5 = 1280x = 1600x1200 Enable or disable the option to allow users to Zoom to Fit. 0 = Disable (default) 1 = Enable Display or hide the draft banner on draft diagrams. Note: The Show draft banner when in draft copy option must be enabled for specific maps in the Author Client. 0 = Disable (default) 1 = Enable The format for the generation of diagrams and internal image attachments. Note: GIF images are restricted to 256 colors. png (default) gif Enable or disable diagram margins. 0 = Disable (default) 1 = Enable Specify the left margin of diagrams (in px). Specify the top margin of diagrams (in px). Specify the right margin of diagrams (in px). Specify the bottom margin of diagrams (in px). Specify the maximum width of diagrams in Reset Zoom mode (in px). Specify the maximum height of diagrams in Reset Zoom mode (in px). Specify the margins of internal images in diagrams. Specify the left margin of internal images (in px). Specify the top margin of internal images (in px). Specify the right margin of internal images (in px). Specify the bottom margin of internal images (in px). Specify the maximum width of internal images (px) in Reset Zoom mode. Specify the maximum height of internal images (px) in Reset Zoom mode. Features

75 Web Server Configuration 75 Enable or disable access to documents. Documents 0 = Disable 1 = Enable (default) Memos Enable or disable access to memos. 0 = Disable 1 = Enable (default) ChangeReq Enable or disable access to change requests. 0 = Disable 1 = Enable (default) Logs Enable or disable access to logs. 0 = Disable 1 = Enable (default) AbbrRef Enable or disable access to abbreviations and references. 0 = Disable (default) 1 = Enable DataTableEdit Enable or disable data table editing. 0 = Disable 1 = Enable (default) MySearches Enable or disable access to My Searches (SharePoint only). 0 = Disable 1 = Enable (default) MyRoles Enable or disable access to My Roles. Note: A user group permission (Web My Roles), specified in the Author Client, is used to display or hide My Roles for specific user groups. If the MyRoles option is disabled, the user group permission will override this option and provide access to user groups who have been defined access to My Roles. 0 = Disable 1 = Enable (default) MySearchesMoreOption Enable or disable access to My Searches More Options searching, s allowing users to search against additional user group categories (SharePoint only). 0 = Disable 1 = Enable (default) SplitCollabAndLogsView Show or hide the diagram when users view associated memos, actions, change requests, reviews and logs (SharePoint only) 0 = Hide diagram 1 = Display diagram (default) StoryboardStepsList Display storyboard steps in the same window or a separate window (with the diagram IDs visible). 0 = Show in same window (default)

76 76 Chapter 4 Configuration 1 = Show in separate window QuickLinks Display or hide the Quick Links (Home, Maps, Docs, To-Dos - under the menu). 0 = Hide 1 = Display (default) ShowGraphLinks Link metric/measure graph icons with the BI Server graph. 0 = Link to diagrams 1 = Link to graphs (default) ForgotPasswordLink Allow users to reset their own passwords on the Login page. Note: This feature does not work if user accounts are managed via LDAP. 0 = Disable 1 = Enable (default) ActColOnStmtLinkPage Display the Activity column in the Statement Details page. 0 = Disable 1 = Enable (default) Acknowledgements IncDropDown1... IncDropDown7 Display a document's drop-down fields in users' acknowledgement To-Do lists. 0 = Disable (default) 1 = Enable Search PageSize Specify the maximum number of items that are displayed on each page in the Search page. Storage TempPath FileUploadPath Storyboard AvailableModes The location of the Web Server temporary folder (created in the installation process). Specify the location to store file attachments uploaded by users in the web. Specify whether to default the display of storyboards as Diagram or Text. Note: Users can switch between modes when viewing a storyboard. Diagram displays the storyboard as a diagram. Text displays the storyboard as text. Excel PollingMinutes Host Port Authentication Specify how often metric values are checked and refreshed (default is set to check metric values every 10 mins - min. is 1 min, max. is 600 mins) Specify the name, or IP address, of the machine running the Office Integration Service. By default this is localhost. The port number of the machine running the Office Integration Service. By default this is More info...

77 Web Server Configuration UseIntegrated RequiredDomain CaseSensitive IntegAuthType IntegAutoLogonOnly IntegFailureURL 77 Enable or disable integrated authentication. 0 = Disable (default) 1 = Enable Specify the domain name that must be matched in addition to the user login name. Any domain matches if not specified. Specify case sensitivity when matching the domain name (user name matching is always case insensitive). 0 = Case insensitive 1 = Case sensitive (default) Specify the type of authentication used. 0 = Windows Integrated Authentication (default) 1 = Netegrity SiteMinder 2 = SSO2 Ticket Authentication Enable or disable automatic logon only, i.e. users cannot log out and access the Log On page. 0 = Disable (default) 1 = Enable Specify a URL to display when an unknown user account attempts to log in. If unspecified a built-in page is displayed. IsapiAuthentication AlwaysUseIISAuthInfo Specify whether to use IIS' authentication variables even when the IIS version does not support Unicode authentication details. 0 = Disable (default) 1 = Enable More info... SiteMinderAuthentication Specify the header field to obtain the authenticated user name from. HeaderFieldName Assumed to be HTTP_SMUSER if not specified. PrimaryEncoding Specify the primary encoding part of the SiteMinder HTTPHeaderEncodingSpec setting. 0 = No encoding 1 = UTF-8 encoding (default) SecondaryEncoding Specify the secondary encoding part of the SiteMinder HTTPHeaderEncodingSpec. 0 = No encoding (default) 1 = RFC-2047 encoding SSO2TicketAuthentication CallMethod Specify the call method to verify the SSO2 ticket. Note: If using the Web service, the WebServiceURL parameter must also be specified below. If using SSO2TicketCom, the SSO2TicketCom COM library must be correctly installed. 0 = Use the Web service to verify ticket (default) 1 = Use SSO2TicketCom COM library to verify ticket

78 Chapter 4 Configuration 78 WebServiceUrl CookieName Specify the URL for the CenterForSSO2Ticket Web service. For example, name}/centerforsso2ticket.asmx. Specify the name of the cookie to use as the SSO2 ticket for authentication. If unspecified the cookie name will be MYSAPSSO2. QueueSize WaitForLock More info... Enable or disable Web Server logging. 0 = Disable 1 = Enable (default) Enable or disable Unicode Web logging. 0 = Disable 1 = Enable (default) Specify the time (in milliseconds) that information is cached before being written to disk. Specify the maximum size of the queue. Specify the time (in milliseconds) to wait for a file lock to write to disk. PathMapping SourcePathn DestPathn Specify the mapped drive path to be substituted by the Web Server. Specify the UNC path to use instead of the mapped drive path. WebLogging Enabled IsUnicode OutputInterval Localisations Locale Definition Localisations-Help Locale Specify the localization files available to the Web Server (see the Classic Web Server Branding document, included on the CD, for more information on localizing the Web Server). Specify any help file localizations available to the Web Server. Documents LocalisedDDownTitles ShowFullPath Specify whether to use either the document drop-down titles as specified in the client, or the localized titles in a specific localization file. 0 = Use author client drop-down titles (default) 1 = Use localized drop-down titles Display or hide the file path of documents when users view the details of documents in the Document Registry. 0 = Hide the file path of documents 1 = Display the file path of documents (default) DocumentList Specify how document searches are displayed. You can add, remove and reorder the columns displayed and define how searches are sorted. The following document fields exist, with specific field IDs: Field ID Field Creator Creation Date Author Comment

79 Web Server Configuration 79 Document Number Language Owner Preparation Date Withdrawn User Reference Master Title Master Version Issue Date Review Date Draft Title Draft Version Draft Status Release Due Document Number Full Dropdown Code 1 Dropdown Code 2 Dropdown Code 3 Dropdown Code 4 Dropdown Code 5 Dropdown Code 6 Dropdown Code 7 Dropdown Name 1 Dropdown Name 2 Dropdown Name 3 Dropdown Name 4 Dropdown Name 5 Dropdown Name 6 Dropdown Name Displaying Fields To display a particular field, use the following format: FieldxxxTag=www FieldxxxWidth=yyy FieldxxxAlign=zzz where xxx is the position of the column of the field www is the field ID (from the list above) yyy is the width in HTML style (e.g. 20% or 20) zzz is the alignment (0=Left, 1=Center, 2=Right). For example, if you want to add a column to display the draft title of documents, you would include the following lines: Field9Tag=15 Field9Width=10% Field9Align=0 Sorting Fields

80 80 Chapter 4 Configuration To display a particular field, use the following format: SortxxxTag=www SortxxxAscend=yyy where xxx is the sorting order of the field www is the field ID (from the list above) yyy is the sort direction, 0=descending, 1=ascending (default if not specified) For example, if you want to display the master titles of documents, sorted in an ascending direction when users conduct a search, you would include the following lines: Sort1Tag=11 Sort1Ascend=1 Formatting Drop-down Fields To specify the number of characters to display for the drop-down labels and items, use the following format: FilterxxxLabChrs=www FilterxxxItemChrs=www where xxx is the drop-down filter number www is the maximum number of characters to display The example below will display up to 15 characters for the label of drop-down filter 1 and 20 characters for the items associated with drop-down 1. Filter1LabChrs=15 Filter1ItemsChrs=20 TalkFreely The Web Server supports integration with TalkFreely. Any web links that are made to TalkFreely will have the the user ID, user name and document title parameters automatically appended to the link. For example: becomes name>. &q000601=<document title>&q000607=<author>&q000606=<owner> ControlServer The URL of the server hosting the Web Server, e.g. name>.com TalkFreelyUrl The TalkFreely URL, e.g. ActionList Specify how actions are displayed following a search. You can add, remove and reorder the columns displayed and define how searches are sorted. The following action fields exist: Field ID Field Action Group ID 1 Subject Text 2 Category Name 3

81 Web Server Configuration Status Name Priority Name Owner Name Start Date Due Date Assignees Created Finish Date Throughput Time Has Attachments (image) Attachments (yes/no) Host Type Name Host Title DT0 DT1 DTn Displaying Fields To display a particular field, use the following format: FieldxxxTag=www FieldxxxWidth=yyy FieldxxxAlign=zzz where xxx is the position of the column of the field www is the field ID (from the list above) yyy is the width in HTML style (e.g. 20% or 20) zzz is the alignment (0=Left, 1=Center, 2=Right). For example, if you want to add a column to display the due date, you would include the following lines: Field8Tag=15 Field8Width=10% Field8Align=0 Sorting Fields To display a particular field, use the following format: SortxxxTag=www SortxxxAscend=yyy where xxx is the sorting order of the field www is the field ID (from the list above) yyy is the sort direction, 0=descending, 1=ascending (default if not specified) For example, if you want to display the action group IDs, sorted in an ascending direction when users conduct a search, you would include the following lines: Sort1Tag=1 Sort1Ascend=1

82 82 Chapter 4 Configuration Data Table Fields You can specify whether to display or hide data table fields: HideAdditionalData=0 will display data table fields HideAdditionalData=1 will hide data table fields Further Information The following provides more information on some of the Web Server configuration parameters, as described above. Default Starting Page This option allows a relative or absolute URL to be defined that will automatically take users to a a specific page after they have logged in to the Web Server. For example, you could automatically navigate users to the Documents page, the Scorecards page or the Storyboards page. Note: This option is not applicable if a map is specified for the DefaultMAP option, or if Singlesign On is enabled. Relative paths will have the Web Server's base URL and CtrlWebISAPI.dll appended to the start of the text before launching the user into the URL, so for example if you specify WebReports it will have directory>/ctrlwebisapi.dll/ appended to the beginning. Important - URLs need to be correctly encoded, i.e. all parts need correct HTTP escaping and non-ascii characters in the query parameters need UTF-8 encoding (which is then HTTP escaped with the whole query parameter). Examples directory>/ctrlwebisapi.dll/? id=webstoryboards directory>/ctrlwebisapi.dll/? id=webscorecards directory>/ctrlwebisapi.dll/? id=webdocs directory>/ctrlwebisapi.dll/? id=webreports Documents Page There are a number of optional parameters that can be specified when setting the default page URL to the Documents page. In the [Web Server] section modify the DefaultPageURL parameter. Note: Query parameters must be prefixed with &. FiltDocNum={numeric value} allows you to filter by a specific document number FiltTitle={text value} allows you to filter by document title FiltMultiDown1={numeric value - unique item ID} allows an item from the first category dropdown to be filtered FiltMultiDown2={numeric value - unique item ID} allows an item from the second category drop-down to be filtered... FiltMultiDown7={numeric value - unique item ID} allows an item from the seventh category drop-down to be filtered

83 Web Server Configuration 83 Note: Multiple values can be specified for each drop-down item. The unique ID can be found in the Drop Down List dialog for a given drop-down list - if the ID field is not visible, from the View menu choose Column Customizing and drag the ID field on to the existing group of field headers. See Defining category drop downs under Document Registry Administration in the Nimbus Control Client Help for more information. PageSize={numeric value} allows you to set the number of items to display on the page FiltAuthStatus={numeric value} allows the authorization status to be filtered 0=All Authorized 1=Own UnAuthorized 2=All UnAuthorized 3=Authorized & Own 4=All Files (default if not specified) 5=All Pending & Authorized Note: A blank value may cause an error. FiltWithdrawn={true or false} includes or excludes withdrawn documents in the filtered search Note: False is the default if not specified. A blank value may cause an error. Example id=webdocs.actupdatefilter&filt DocNum=&FiltTitle=&PageSize=15&FiltMultiDDown3=23&FiltMultiDDown3=21&FiltMultiD Down2=19&FiltMultiDDown2=64&FiltAuthStatus=4 The example URL above will search on documents with ID 23 or 21 in the third drop-down list and items with 19 or 64 in the second drop-down list. Home page URL You can override the Home page URL so that when users access their Home page it will take them to a different URL. For example, In the [Web Server] section modify the MyPageOverrideURL parameter.

84 84 Chapter 4 Configuration Configuring MIME mappings MIME (Multipurpose Internet Mail Extensions) can be configured. You can define the MIME handling of file extensions and change the icon associated with a file extension when it is displayed in the Web Server. You can also specify to download a particular file type when users access a file, or open it using the application associated with that file extension. Configuring MIME mappings 1. Open mimemap.cfg (...Nimbus Control\Web Server\Config) in a text editor, such as Notepad, and make any edits to the file extensions as required. Note: The fields are tab-delimited. The fifth (comma-delimited) column determines whether a particular file type will open when users access it (this is the default value, 0, and is used if not specified), or downloaded (if set to 1'). Icons are stored in <Installation directory>\web Server \Main\images Configuring Web Server Logging Web Server logging can be enabled to debug any issues that may arise with the configuration of the Web Server. There are two log files, one for the ISAPI extension, the other for the Web Server application, and both use the Log4D component. If enabled, any errors and warnings will be logged in the respective log file. Note: ISAPI and Web Server logging is usually only necessary when requested by Nimbus Support in order to resolve any issues that you may have with a Web Server. Enabling ISAPI logging 1. Open isapilog.cfg (...\Nimbus Control\Web Server\Config) in a text editor, such as Notepad. To enable ISAPI logging you must comment out the second line, i.e.: #log4d.disable=info The log file will be created in the Web Server Logs directory (default location is...\nimbus Control\Web Server\Logs). Enabling Web Server logging 1. Open websvrlog.cfg (...\Nimbus Control\Web Server\Config) in a text editor, such as Notepad. To enable Web Server logging you must comment out the second line, i.e.: #log4d.disable=info The log file will be created in the Web Server Logs directory (default location is...\nimbus Control\Web Server\Logs) Configuring Page Hit Logging Page hit logging will record a log of all pages accessed in the Web Server for each day. A new line will be created for each entry and the log can be viewed by a text editor or in Excel, since the format is tab delimited. Web logging is enabled in the Web Server configuration file. Configuring page hit logging

85 Web Server Configuration Open config.ini (...Nimbus Control\Web Server\Config) in a text editor, such as Notepad. In the [WebLogging] section modify the following parameters: Enabled - Set this value to Enabled=1. IsUnicode - Choose between Unicode=1 or Ansi=0. OutputInterval - Specify how often a log is made, in milliseconds (default = 1000). QueueSize - Specify the maximum number of log records to keep (default = 1000). WaitForLock - Specify the duration that the Web Server should wait for exclusive access to the log file, in milliseconds (default = 5000). 2. Save and close config.ini. Log Files Generated log files - yyyymmdd.log - are stored in...\nimbus Control\Process Repository\System \Logs\Web. The structure of a log file includes Date, Time, User name, First name, Last name, Web Server machine name, Client IP address and page name. If the page is context-based the following information is also included: Diagram Folder structure, Map name, Map type, Diagram name and Diagram level. Map Folder structure, Map name and Map type (the map types are empty, i.e. master, "Draft" or "Scenario": <Scenario name>". Document Document number Configuring Web Hit Logging The Web Log Utility provides a method for logging web page hits and either storing them in a specified database or saving the data as a metric-related Excel or CVS data file. This task can be run as a Windows scheduled task. Note: Page Hit Logging must be enabled; this is enabled by default. See Page Hit Logging for more information. Saving Web statistic as an Excel or CSV file Run WebLogsUtility.exe (...Nimbus Control\Client\Utilities). Click the Web Statistics to Excel or CSV tab to select it. Click Browse to locate the process repository that you want to export web statistics from. In the Date Range panel, select a date range of the results that you want to export. For example, you may want to export statistic for the last 3 weeks. Custom Date Range allows you to specify a range of dates. 5. Select the page hit statistics that you want to export in the Common Export Options tab. Total page hits for each day, week or month will display the total number of web server pages accessed. Total page hits by map for each day, week or month will display the total number of web server pages accessed for each map. Total page hits by user group for each day, week or month will display the total number of pages accessed by each user group. Include Metrics Sheet (Excel only) will create a separate metrics data sheet for the selected web statistics.

86 86 Chapter 4 Configuration There are also a number of options to include total page hits for diagrams, documents and storyboards, and the total number of user logins. These can be accessed by selecting the respective tabs - By Diagram, By Storyboard, By Document and Total Logins. Saving Settings You can save the settings you have defined by clicking Save settings to WSE file. This file is used when creating a Windows scheduled task and running the operation from the command line. 6. Click Export to file.

87 Web Server Configuration 87 Exporting Web statistics to a database The Web Log Utility allows you to export statistics to an existing database, such as MS SQL Server, Microsoft Access and MySQL. If you do not have a database then this utility also allows a new ODBC database to be created with associated table structures. See To create a ODBC database below for more information. 1. Run WebLogsUtility.exe (...Nimbus Control\Client\Utilities). 2. Click Browse to locate the process repository that you want to export web statistics from. 3. Click Build Connection String. There are four tabs; click Help on the respective tab for further information. Provider Select the relevant OLE DB provider. Connection Select the data source and enter a user name and password (if required). Advanced Select the data source and enter a user name and password (if required). Blank password enables the specified provider to return a blank password in the connection string. Allow saving password allows the password to be saved with the connection string. If saved, the password is returned and saved unmasked and unencrypted. All Edit any initialization values for the data type Click OK. In the Table Name text box enter the name of the table that stores the web statistics. Click Get Fields to populate the field mapping drop-down lists. Choose the associated field mappings from the respective drop-down lists. Steps 8-11 allow you to include user group information in the export, assuming appropriate tables exist in the database. If you do not want to include user group information then proceed to Step Select Include User Group details. 9. In the User Group Names Table and User Group Members Table text boxes enter names for the user group and user group tables, respectively. 10.In the Group ID (on the left) and Group Name field mapping text boxes enter corresponding field mapping names for the new user group table. 11.In the Group ID (on the right) and User ID field mapping text boxes enter corresponding field mapping names for the new user member table. Saving Settings You can save the settings you have defined by clicking Save settings to WLD file. This file is used when creating a Windows scheduled task and running the operation from the command line. 12.Click OK.

88 88 Chapter 4 Configuration Creating ODBC databases When exporting web statistics to a database, a ODBC database is required. If you do not have a database then you can create a new ODBC database with associated table structures with the Web Log Utility. 1. Run WebLogsUtility.exe (...Nimbus Control\Client\Utilities). 2. Click Browse to locate the process repository that you want to export web statistics from. 3. Click Build Connection String. Click Help on the relevant tab. See Building Connection Strings above for more information. 4. Click OK. 5. In the Table Name text box enter the name of the table to store the web statistics. 6. Choose the associated field mappings from the respective drop-down lists. Steps 7-11 allow you to create two new tables to store user group information in. If you do not want to include user group information then proceed to Step Select Include User Group details. 8. In the User Group Names Table and User Group Members Table text boxes enter names for the user group and user group tables, respectively. 9. In the Group ID (on the left) and Group Name field mapping text boxes enter corresponding field mapping names for the new user group table. 10.In the Group ID (on the right) and User ID field mapping text boxes enter corresponding field mapping names for the new user member table. 11.Click Create New Table(s). 12.Click OK. Running the Web Log Utility from the command line The Web Log Utility can be run from the command line, or as a Scheduled Windows Task, in order to export web statistics to either a database or to file (Excel or CSV). A settings file must be referenced, which is created using the Web Log Utility. WLD settings files define exporting to a database and WSE settings files define exporting to an Excel or CSV file. For more information on creating settings files see the relevant section above. When exporting web statistics to a database, a ODBC database is required. If you do not have a database then you can create a new ODBC database with associated table structures using the Web Log Utility. 1. Use the following command lines: Excel or CSV output <Location of Web Log Utility>.exe\ "<Location of Settings File>.wse" Database output <Location of Web Log Utility>.exe\ "<Location of Settings File>.wld" For example "C:\Nimbus Control\Client\Utilities\WebLogsUtility.exe "C:\Control\Client\WebLog WSE.wse" Logging When the Web Log Utility is run from the command line, a log file is created in a folder in the same directory as the utility called Logs. Separate log files are created for each month.

89 Web Server Configuration Action Server Configuration Configuring the Action Server There are a number of configuration parameters that control the behaviour of the Action Server. For information on Action Server errors that appear in the log files see Troubleshooting the Action Server. Configuring the Action Server 1. Open config.ini (...\Nimbus Control\Action Server) in a text editor, such as Notepad. Modify the following parameters: System LoggingLevel TempPath The level of logging that is written to the log files The location of the Temp folder (set during installation) 2. Save and exit Config.ini. The following topics provide more information on the remaining Action Server configuration options: Lock Service Configure the start and stop times of the process repository lock to allow for the manual backing up of data. See Third-party Backup Utilities for more information. LDAP Configure Single-sign On via LDAP synchronization. See Configuring LDAP synchronization for more information. SMTP Configure notification settings. See Configuring SMTP for more information. Office Integration Server Configure the integration between Nimbus Control and Excel for metric-based data and Excelbased scorecards. See the Nimbus Control Office Integration Server PDF in the Documents folder on the CD for more information. Related topics Managing Nimbus Control Services

90 90 Chapter 4 Configuration Configuring SMTP The Action Server's service can manage system s. HTML s are generated and sent to a designated SMTP server at times specified in the polling period. By default, access to the SMTP server is unauthenticated; you can allow authenticated access if required. For information on Action Server errors that appear in the log files see Troubleshooting the Action Server. Setting authenticated SMTP access 1. In the Client, from the Administration menu choose Application Credentials, then Action Server Service. 2. Browse to the location of the Action Server and click OK. 3. Select Authenticated. 4. From the Encryption Type drop-down list choose the type of encryption required. Standard allows decryption on any PC (recommended) Current PC allows decryption only on the PC that originally performed the encryption Current PC and current user allows decryption only by the PC that originally performed the encryption and when the same user is logged in. 5. Enter the User name and password of the user account that has access to the server. 6. Click OK. Setting options 1. Open config.ini (...\Nimbus Control\Action Server) in a text editor, such as Notepad. Modify any of the following parameters, as required: PollingPeriod SystemType The frequency that the queue is checked, in seconds The system that is supported (currently only SMTP is supported) The path of the process repository. This is the location that the queue Path resides NDRRecipient The address that non-delivery reports are sent to SystemSender The address that sent s will appear from SystemSubject The text that appears in the subject field of system-generated s The Nimbus Control Service will attempt to verify addresses against the mail server before sending messages (note: this option is not VerifyNames supported on most servers, in which case you may need to disable this option). 0 = Disable (default), 1 = Enable The number of delivery attempts before an is deleted Note: Once an fails to be sent after x number of times it is deleted and MaxRetries an entry is added to the log. A delivery failure attempt requires successful connection to a SMTP service, meaning that the retry counts are incremented when there is a network outage. If the value is set to 0 it will retry indefinitely. Send all s to recipients in a single . If disabled, s are sent separately, with the notification titles used as the subject of the s. Combine s 0 = Disable, 1 = Enable (default) MaxSMTPTime The maximum time (in msecs) that the service will remain connected to the SMTP server in a single session. 0 = Disable, 1 - x = Max connection time (in msecs) MessagesPerHour The maximum number of s that will be sent per hour. Note that the

91 Action Server Configuration 91 number of s sent per session is dependent on the polling period value (for example if the PollingPeriod is set to 600, i.e. s are sent every 10mins, and the MessagesPerHour is set to 1000, then a maximum of 167 s will be sent in each session). 0 = Disable, 1 - x = Number of messages to send (per hour) SMTP Host Port Verify UserName Password EncryptionType Anonymous The name or IP address of the SMTP server The listening port of the SMTP server (usually 25) Enable or disable the Verify command 0 = Disable, 1 = Enable (default) The user name required to authenticate with the SMTP server using the AUTH LOGIN functionality This is set by the Client and is a base 54 encoded encrypted password Specify the level of password encryption 0 = Password can be decrypted by any PC 1 = Password can be decrypted only by the PC that performed the original encryption 2 = Password can be decrypted only by the PC and original user that performed the original encryption Anonymous access to the server can be enabled 0 = Not anonymous, 1 = Anonymous (default) Related topics Troubleshooting the Action Server Configuring SMTP Logging The Service creates a log every time it is run. It is possible to set the logging level to provide more or less detail. For information on Action Server errors that appear in the log files see Troubleshooting the Action Server. Enabling SMTP logging 1. Open config.ini (...\Nimbus Control\Action Server) in a text editor, such as Notepad. 2. Set the LevelLogging parameter to one of the following: None Startup, Shutdown 0 Low Startup, Shutdown. An entry for every polling period (no entries if an 1 action did not occur at a polling period) Note: Recommended setting when in production. Medium Startup, Shutdown. An entry for every polling period 2 High Startup, Shutdown. An entry for every polling period. An entry for every 3 that is sent, including the address, message contents and the related item. Note: Generated log files - yyyymmddx.log - are stored in...\nimbus Control\Action Server\Logs\

92 92 Chapter 4 Configuration Configuring LDAP Synchronization For information on configuring LDAP synchronization, refer to the Configuring LDAP integration topic in the Installation section Testing LDAP Synchronization Following the configuration of LDAP integration, it is recommended to test the synchronization between the Directory Service list of users and the Nimbus Control list. The LDAP Configuration Tool provides the ability to test an LDAP synchronization, as well as allowing you to create a new LDAP configuration file. When LDAP synchronization is tested, the results of the synchronization will be displayed but no data will be written. Note: Increasing the logging level in the LDAP configuration file will provide more details results Testing LDAP synchronization 1. Run LDAPUtility.exe (found in the Utilities folder on the installation CD). 2. Click Load Config and select the LDAPConfig.ini. Note: The default location of LDAPConfig.ini is...\nimbus Control\Process Repository\LDAP 3. Change any parameters in the configuration file, as required. 4. Click Test Sync. If the test fails you will receive the following message: <Data><Time>Connect to LDAP server <Server>:<Port> failed. Check the connection settings in the LDAPConfig.ini file Testing LDAP authentication 1. Click in the User Name and Password text boxes and enter a user name and password that has current access to the directory service. 2. Click Authenticate. Defining a new LDAP configuration file 1. Click New Config. 2. Browse to a location to save the configuration file to, then click OK. to load the configuration parameters. 3. Click at the end of the parameters that you want to define and define the values. 4. Click Save Config. Scheduling Testing a LDAP synchronization can be run from the command line, or as a Windows Scheduled Task. Run the following command: <Path of LDAP Utility> <Path to process repository> For example: "C:\Nimbus Control\Client\Utilities\LDAPUtility.exe" "C:\Nimbus Control\Process Repository"

93 Action Server Configuration Configuring LDAP Synchronization Logging On start-up the LDAP Service creates a log file, which will report on any issues with the synchronization. For information on Action Server errors that appear in the log files see Troubleshooting the Action Server. Enabling LDAP Synchronization logging 1. Open LDAPConfig.ini (...\Nimbus Control\Process Repository\LDAP) in a text editor, such as Notepad. 2. In the [MainSection] enter the desired logging level for the LoggingLevel parameter. None Startup, Shutdown 0 Low Startup, Shutdown, Synchronization times 1 Medium Startup, Shutdown, Synchronization times, Added users, Removed users 2 High Startup, Shutdown, Synchronization times, All users added to each group, 3 All users removed from each group, Duplicate users, Updates to user preferences Full Startup, Shutdown, All users added to each group, All users removed 4 from each group, Properties retrieved for each user, Duplicate users, Updates to user preferences Note: It is recommended to set the logging to low when in production. The log file - LDAP.log is stored in...\nimbus Control\Action Server\Logs\LDAP.

94 Chapter 4 Configuration Business Intelligence Server Configuration Configuring the Business Intelligence Server There are a number of configuration options that can be defined for the Business Intelligence Server. Configuring the Business Intelligence Server 1. Open BiSvc.ini (...\Nimbus Control\BI Server) in a text editor, such as Notepad. Modify any of the parameters, as required. DATAFOLDER Path The path of the process repository (this can be a UNC path name) OPTIONS RecordLimit The maximum number of records that will be stored for each measure RetryPeriod The number of minutes between each retry after a failure to send an SMS message RetryAttempts The number of retry attempts before aborting notification TEXT Up The text that is sent via and SMS when a value breaches a threshold value and is ascending. The text can include three substitution parameters: Title (title of the measure) Value (current value of the measure that breached the threshold) Notes (any additional notes) To insert these values include the '<' and '>' characters. For example, Up = Measure <TITLE> has increased to <VALUE>. <NOTES>. Down The text that is sent via and SMS when a value breaches a threshold and is descending. For example, Down = Measure <TITLE> has decreased to <VALUE>. <NOTES>. Url The diagram URL. For example, Url = Go to the diagram <URL>. EXCEL Host The machine that the Office Integration server is located on (machine name or IP address) Port The listening port number of the Office Integration Server PollingMinutes How often the metric value is checked (default is set to check metric values every 60 mins - min. is 10 mins, max. is mins) Subject The text that appears in the subject setting of an From The person that you want sent s to appear from. For example, Control Administrator.

95 Business Intelligence Server Configuration 95 SMS Where Short Message Service (SMS) is required, may be active at any one time. Contact Nimbus Support if you need to specify multiple SMS service providers.a SMS service provider is required to send the text messages. More than one service providers can be specified but only one Comment out the service provider parameters (the name of the service provider and then ClsID. Name The name of the service provider (by default Clickatell is specified) ClsID This value should not be changed IniFileName The location of the service provider specification data (it can be this file) CLICKATELL By default, Nimbus provides a service provider module for Clickatell. Note: A Clickatell account is required, which can be obtained from Clickatell. API_ID The Clickatell ID (provided by Clickatell) User The Clickatell username Password The Clickatell password UseGet Set this value to '0' UseSSL Default is on, '1'. Set this to '0' to turn SSL off Testing the Business Intelligence Server The Business Intelligence Server can be tested to ensure it is running correctly. Testing the Business Intelligence Server 1. Create a new map with an activity box containing an Excel metric link. 2. Authorize and promote the map. Note: Only authorized (master) maps are checked by the Business Intelligence Server. 3. Set the properties of the map so that it is included in the Web Search and when processing Excel metric link notifications (if necessary). 4. Run the SSync.exe (from the Nimbus Control program group on the Start menu). 5. Log in to the Web Server and view the master version of the map you created in Step Click on the metric link and view the graph. Note: It may take a while for the results to be viewable, depending on what the polling period is set to. This is 60 minutes by default but this value may have changed in the BiSvc.ini file. See Configuring the Business Intelligence Serverfor more information Synchronizing the Business Intelligence Server Metric data is managed by the Business Intelligence Server, which requires a definition file. This definition file is created by running the System Synchronization Utility that is installed with the Web Server. Updating metric data in Nimbus Control can be scheduled as a Windows Scheduled Task. Note: The System Synchronization Utility is also used to synchronize the Web Server, for example to update flow line links, recurring reviews, the Search database, etc. See Synchronizing the Web Server for more information.

96 96 Chapter 4 Configuration Scheduling Business Intelligence Server synchronization Synchronizing the Business Intelligence Server can be run from the command line, or it can be automatically scheduled using Windows Task Scheduler. The System Synchronization Utility can be found in...\nimbus Control\Web Server\Utilities. Run the following command: <path>/ssync.exe <path of ini file> [<path of log file>] -measure For example: C:\Control\Web Server\Utilities\ssync.exe C:\Nimbus Control\Web Server\Utilities \SSyncResults.log] -measure Note: If no path is defined then the utility will search for the configuration file in the local folder. If no path to the log file is defined then it will use the local folder. It is advised that a Windows Scheduled Task is created, using the command above. If set to run as a scheduled task, the System Synchronization Utility must not be running when a process repository backup is in progress, as this can lead to inconsistent and corrupt data in the backup Configuring Business Intelligence Server Logging Logging of the Business Intelligence Server, via the Log4D component, is configured through the BiSvcLog.cfg file. Note: Business Intelligence Server logging is usually only necessary when requested by Nimbus Support in order to resolve any issues that you may have with the Business Intelligence Server. Enabling Business Intelligence Server logging 1. Open BiSvcLog.cfg (...\Nimbus Control\BI Server) in a text editor, such as Notepad. To enable logging you must comment out the second line, i.e.: #log4d.disable=info 2. Save and exit BiSvcLog.cfg. Note: Generated log files - bisvr.log, bisms.log and bi .log - are stored in...\nimbus Control\BI Server\Logs

97 Chapter 5 User Management Nimbus Control Administration Guide

98 Chapter 5 User Management Creating Users and User Groups Users and user groups are created in the Client; from the Tools menu choose Users and then User Accounts. For help on creating and modifying users and user groups see User Administration under Administration in the Nimbus Control Client Help (accessed from the Help menu in the Client, or for context-sensitive help, click the Help button on the dialog that you want help for). User and User Group Creation Nimbus Control users must exist in a user group. Three core user groups exist - Administrators, Authors and End Users, each group having different system permission and access rights set. You can also create additional groups with their own set of permission rights; however, a user must exist in one of the core user groups: Administrators These users create and maintain user accounts and have access to all features within the Author Client and Web Server. Process Authors These users create, edit and manage process content. They have access to both the Author Client and Web Server. End Users These users can contribute to content development, including reviews, authorizations, change requests, memos, content sign-offs, etc. These users cannot create or edit content. Further access rights are governed by which modules specific an end user has assigned to them. To create a user or user group, from the Tools menu in the Author Client choose Users and then User Accounts. To create a user, from the Member menu choose New User. To create a user group, from the Group menu choose New Group. User Group Permissions Nimbus Control comprises of a number of areas of features and functionality and each area can be controlled for each user group. This is useful, for example, if you do not want one type of user group to access an area of functionality until they have had training. Note: User group permissions work in conjunction with users' settings, meaning that the user must have a particular option enabled in their user settings and within the user group's settings to be able to use that functionality. By default, the <Everyone> group incorporates all Nimbus Control users and this allows global access rights and permissions to be set. You can then assign access rights and permissions for specific user groups, thereby allowing you to control user access by user group. To change the permission of a group, from the Tools menu choose Users, then User Accounts. Right-click the group and choose Group Properties. User Account System Options There are a number of system configuration options that affect user accounts, such as the

99 Creating Users and User Groups 99 registration of new user accounts, the incorrect password retry limit, automatic log on when account names match the network log on names, etc. These should be defined before creating user accounts and in accordance with an organizations internal policies. The system options are accessed in the Author Client. From the Administration menu choose System Options. Click the Users tab to view the system options relating to user accounts. 5.2 Importing Resources Resources dictate who, or what, is responsible for completing a particular activity in a process. Central Library Resources can be imported, merged and updated from a file (note that local resources cannot be imported). There are two options for updating a Central Resource Library, the first will replace all central resources and delete any resources that are not in the data file. The second method will update existing resources but it will not delete existing resources that are not specified in the data file. Resource File Format The format of the resource file is CSV and the following format is required: Resource name,[resource cost],[field 1],[Field 2],[Display Name],[Group Name] For example Printer,2,HP (Color),First Floor,HP Color Printer (First Floor),Printers Notes: 1. The only field that is mandatory is the Resource name field. 2. A new line must exist for each resource. 3. If the group does not already exist in Nimbus Control then the group name will be ignored. 4. Resources can be imported, merged or updated in multiple groups. A new line must exist for each group. Importing resources into the Central Resource library 1. Run ImportUtil.exe (found in the Utilities folder on the Installation CD). 2. Click Browse to select the process repository that you want to import, merge and/or update resources in. 3. From the User Name drop-down list choose the administrator account to run the Import Utility, enter the password and click Next. 4. Select Resources, then click Next. 5. Select one of the following rules: Update and merge resources from file will update all resources in the Central Resource Library. Any Central Library resources not in the data file will remain in the library. Replace all existing resources from file will replace all resources in the Central Resource Library. Any Central Library resources not in the data file will be deleted. 6. Click Browse to select the data file. 7. Click Start to import the data.

100 Chapter 5 User Management Importing User Roles Roles provide the ability to align people with what they do in a process and to make their involvement visible. Users' roles in Nimbus Control can be imported from file. Role File Format The format of the role file is CSV and the following format is required: User name,role Notes: 1. A new line must exist for each role. 2. If the role or user does not exist in the system then the role will be ignored. 3. Multiple roles can be assigned to single users. Importing user roles 1. Run ImportUtil.exe (found in the Utilities folder on the Installation CD). 2. Click Browse to select the process repository that you want to import, merge and/or update user roles in. 3. From the User Name drop-down list choose the administrator account to run the Import Utility, enter the password and click Next. 4. Select User Roles, then click Next. 5. Click Browse to select the data file. 6. Click Start to import the data.

101 Chapter 6 Administration Nimbus Control Administration Guide

102 Chapter 6 Administration Importing and Exporting Data Exporting Diagrams as XML A scope of diagrams can be exported as XML and a number of options can be specified. This process can be automatically scripted and set up as a Windows scheduled task. Exporting diagrams automatically 1. Run the following command, either from the command line or as a Windows Scheduled Task: <Path to Ctrl.exe> <Path to process repository> <Path to script (.csf) file> For example: C:\Nimbus Control\Client\Ctrl.exe "E:\Nimbus Control\Process Repository" "C:\Exported Maps\XMLExport.csf" Script (.csf) Files A Nimbus Control script file defines the parameters to automate the export of diagrams in XML format. To create a script file, create a new text file with a.csf extension. Include, as a minimum, the following line: XML_EXPORT "<map path>" "<destination folder>" The following optional parameters can be included: Parameter Standard Simplified LeafOnly Audit Scope: <scope number> Diag <diagram GUID> Level: <level of diagram> SeparateFiles Description Standard XML export (see below) Simplified XML export (see below) Leaf diagrams only (see below) Record export in diagram's history audit log Scope of export (see below) GUID of starting diagram (see below) Level of starting diagram (see below) Creates a single XML file per diagram (Simplified export only) Standard Standard XML export creates a single file and includes all diagrams (within the specified scope), drill downs, activities, resources, attachments (including data tables), costing information, activity inputs/outputs, commentary text, flow-line links, free text, change logs, authorizers, acknowledgers, history and audit logs, acknowledgement logs, subscribers, memos and change requests. Simplified Simplified XML export creates a single file and includes all diagrams (within the specified scope), diagram URLs, the parent folder structure, user access rights (default and specific), drill downs, activities, notes, activity inputs/outputs, commentary text, attachments (including data tables), statement links and statement data. Note: The Simplified XML export includes the respective Nimbus Control Web Server URLs for the following attachment types - diagram links, internal WP documents, internal images, storyboard links, file/document Registry links and scorecards. These URLs are useful, for example, when integrating with external search systems if you want to include process content in search indexes. Data table information is also included in the exported XML,

103 Importing and Exporting Data 103 including all field values. Leaf Only Leaf Only XML export creates a single file that includes all diagrams except diagrams that have drill downs. Scope The scope parameter can be: 0 = Current Process Map 1 = Current Diagram and Lower Levels 2 = Current Diagram Note: If 1 or 2 is selected, you must define the starting diagram by specifying either the <Diag> or <Level> parameter. For example: /Diag:3CA5EFDFF00840A5A EC77BBF /Level:1.2.4 Example Command An example command (including optional parameters): XML_EXPORT "Map1" "C:\Exported Maps" /Simplified /Scope:1 / Diag:3CA5EFDFF00840A5A EC77BBF /Text /Draft /Memos /Changes An example command for a map in a folder: XML_EXPORT "Virtual_Folder1\Virtual_Folder2\Map1" "C:\Exported Maps" / Simplified /Scope:1 /Diag:3CA5EFDFF00840A5A EC77BBF /Text /Draft / Memos /Changes Logging Any problems with the export will be logged in a log file. The log file uses the same name as the script file and is created in the same location Exporting Data to a Database The data that is held within a process repository can be exported to a nominated database, such as SQL Server, using the Data Export Utility. The utility can be run as a scheduled task or it can be run manually. It is advised that the utility is run overnight, or when few users are logged into the system. For further information and instructions on exporting data from a process repository to a nominated database, please refer to the Exporting to a SQL Database PDF in the Documents folder on the Installation CD.

104 104 Chapter 6 Administration Importing Data Tables Data tables can be updated, replaced and merged from file. The format of the data table file is CSV and the following format is required: [Data table],[data field],[field type],[comment] For example: Data table 1,Department,A,, Notes: 1. A new line must exist for each value. 2. Field type is defined by a single letter and can be any of the following: A (alphanumeric), I (integer), F (decimal), D (date), T (time), B (true/false), Y (yes/no) and O (on or off) Updating data tables 1. Run ImportUtil.exe (found in the Utilities folder on the CD). 2. Click Browse to select the process repository that you want to import, merge and/or update items in. 3. From the User Name drop-down list choose the administrator account to run the Import Utility, enter the password and click Next. 4. Select Data Tables, then click Next. 5. Select one of the following rules: Update data tables from file will update existing data tables with the data tables from file Replace all existing data tables from file will replace existing data tables with the data tables from file Merge data tables from file will merge existing data tables with the data tables from file 6. Click Browse to select the data file. 7. Click Start to import the data.

105 Importing and Exporting Data Backing Up Data It is advised to backup the process repository regularly, at a frequency in accordance with your organization's data retention policies. Backing up should include the associated file system and any linked data that resides outside of the process repository file system (such as file and document links). Backing up a process repository and associated data can be achieved either using the Nimbus Backup Utility, or a third-party backup utility. One of these approaches must be chosen and implemented or a consistent backup of the data may not be available when required. Important The process repository should not be backed up whilst on-line, i.e. all connections from the Author Client and Web Server must be disconnected for the duration of the backup. Scheduled tasks or other processes which affect the data (for example SSync.exe, LDAP Sync, Reports, etc) should not be set to run during this period as any changes may result in an inconsistent and unusable backup. Linked data (such as file and document links) should also not be modified during this time. The Nimbus Backup Utility This is the recommended method if you are using Windows Server 2003 or later. Nimbus provides a utility called the Backup Utility which utilizes Microsoft's Volume Shadow Copy Service (or Shadow Copy). Shadow Copy technology is included in Microsoft Windows and it allows snapshots of data to be taken at regular intervals, to any local, removable or network drive. Snapshots are essentially read-only copies of a volume of data, taken at a specific point in time. By creating a snapshot, Nimbus Control's Backup Utility will then create a backup of the snapshot data, avoiding issues with file locks and file editing interfering with the process. The benefit of this method is that system availability downtime of data is minimized for end users. How does it work? The Nimbus Backup Utility locks the process repository upon initiation. After a set time the Web Server is then also locked (the default is 15mins but this can be changed in the Backup Utility configuration file). After 15 seconds, the utility will request a shadow copy snapshot of all folders set to be backed up. Upon completion of the snapshot, both the process repository and Web Server locks will be released. The backup that is created will be in the form of either a folder, with a time and date stamp and a copy of all specified virtual folders, or a single zipped file, saved to a selected location. Upon completion of the backup the snapshot will then be deleted by Shadow Copy. What about linked data? If any linked data is held on the same drive as the process repository file system then the Nimbus Backup Utility can be configured to include these folders when backing up (see Backing Up Using The Nimbus Backup Utility for more information). The File and Document Links report (available in the Diagram report category in the Author Client) provides information on the locations of all linked data. Any linked files that reside on different drives must be backed up separately.

106 106 Chapter 6 Administration Third-party Backup Utilities Shadow Copy is not available in Windows 2000 Server, or you may have your own third-party backup utility. A Lock Service is provided as part of the Action Server installation and this must be used with any third-party backup utility in order to ensure that the process repository copy is internally consistent and valid. How does it work? The Lock Service locks down a process repository and prevents end users from modifying any of the files. The start and stop times for the lock service are defined in the Action Server's configuration file. During the lockdown of the process repository, a stable backup of the process repository file system can be taken, therefore the period over which the lock service runs should be set to the duration of the backup process. What about linked data? Any linked files that reside outside of the process repository file structure should also be backed up at the same time. The File and Document Links report (available in the Diagram report category in the Author Client) provides information on the locations of all linked data. These locations should then be included as part of the third-party backup configuration Nimbus Backup Utility The following method describes how to back up a process repository and associated folders using the Nimbus Backup Utility and Volume Shadow Copy Service (Shadow Copy). Note that Shadow Copy is only available in Windows Server 2003 and later. Setting the Lock Mode The first thing you must do, if it has not already been set, is to set the lock mode in the Web Server configuration file. 1. Open the Web server configuration file in a text editor, such as Notepad (default location is C: \Nimbus Control\Web Server\Config\config.ini). 2. In the [DataFolder] section, set the LockMode parameter to '1'. 3. Save and exit config.ini. Configuring the Backup Utility There are a number of configuration settings for the Backup Utility which should be reviewed and configured if required before running the Backup Utility for the first time. Note that in a multi-server configuration, the Nimbus Control Backup Utility must be set to run on the server which hosts the process repository. 1. Copy CtrlBackupUtil.exe and BackupConfig.ini (from the Utilities folder on the CD) to a local or network drive. 2. Open and edit BackupConfig.ini, as required, then save it. Path Store LocationN UseZip The path of the process repository, specified by drive letter (not UNC). The location to save the backup to. The path of additional folders to back up (must be on same drive as process repository). Compresses the backup folder into a single zip file upon completion of the

107 Backing Up Data 107 backup process. 0 = Disable (default) 1 = Enable The maximum number of backups to store at any given time. When this threshold is exceeded, the oldest backup will be deleted. MaxBackups 0 = Unlimited (default = 7) The waiting period between applying the client lock and initiating the LockPeriod backup, in minutes. Note: A minimum of 5mins is recommended to allow any long operations to complete. The addresses that are used for notification if a backup fails. Note: SendWarningsTo This requires that the Action Server is installed and running. Multiple addresses must be separated by semi-colons. FixedTargetFolder Specify whether to use the same folder for backups, i.e. 'Nimbus Control Backup', or create a new folder with the date and time appended. Note: Folders are created automatically. If the same folder is used for backups then any existing folders will be renamed to Nimbus Control Backup n, where n is the next available number. 0 = Date and Time as folder name (default) 1 = 'Nimbus Control Backup' as folder name ExternalApp Specify an external application or script to run after the data is moved to the backup location but before it is compressed (if UseZip is enabled). Note: If running a script you must first specify the host for the script, e.g. "wscript C:\script.js". You can also specify the target backup folder to be provided to the external application or script by adding the "<TARGET_FOLDER>" parameter, e.g. C:\script.js "<TARGET_FOLDER>". Note: The target folder will be automatically replaced with the correct path when the external application or script is run. See Diagnostic Checking below for more information. 0 = Disable (default) 1 = Enable LongReturnVal Specify whether to log the exit code of the external application. Note: Any non-zero values are treated as errors and an notification (if configured) will be sent. 0 = Ignore exit code (default) 1 = Log exit code TimeOutMins Specify the time, in minutes, to wait for the external application to complete. If the application times out then the data will not be compressed, and an notification (if configured) will be sent (default=0, unlimited). RetryPeriodSecs Specify the amount of time to wait after a snapshot has been rejected (due to another snapshot being in progress) until the operation is retried. RetryLimit Specify the total amount of times to retry the operation.

108 108 Chapter 6 Administration Scheduling the Backup Utility After configuring the Backup Utility you can create a scheduled task to run the Backup Utility at set times using Windows Task Scheduler. Use the following command to create a batch file: <Path of CtrlBackupUtil.exe> <Path of BackupConfig.ini> For example: "C:\Nimbus Control\CtrlBackupUtil.exe" "C:\Nimbus Control\BackupConfig.ini" Diagnostic Checking It is possible to launch a diagnostic application, batch file or script on the backed-up data after a snapshot of the data has been taken and before it is compressed for storage. This is configured in the [ExternalApp] section in the configuration file. For example, you could run the map diagnostic check in the Admin Utility - see Checking Maps for more information Third-party Backup utilities The following method describes how to lock the process repository using the Lock Service in order to allow you to back up the process repository and associated files. Important If the Lock Service is not used when backing up your data, files could be modified during the backup process which could result in a backup that is not internally consistent and therefore invalid. For the same reason, scheduled tasks (such as SSync, LDAP synchronization, Reports, etc) should not be scheduled to run during the backup period. Setting the Lock Mode Ensure that the LockMode parameter is set to '0' in the Web Server's configuration file. 1. Open the Web server configuration file in a text editor, such as Notepad (default location is C: \Nimbus Control\Web Server\Config\config.ini). 2. In the [DataFolder] section, set the LockMode parameter to '0'. 3. Save and exit config.ini. Specifying the start and stop times of the Lock Service The start and stop times for when to lock and release the process repository must be defined. 1. Open Config.ini. (found in C:\Nimbus Control\Action Server) in a text editor, such as Notepad. 2. In the [LockTable] section modify the StartLock and StopLock parameters: LockTable StartLock StopLock The time at which to lock the process repository. The time at which to unlock the process repository. Note: If the times are the same then a lock will not be applied. 3. Save and exit Config.ini. Scheduling your third-party backup utility Once the start and stop times of the Lock Service have been set, you can schedule your backup utility to run between the lock period. It is important to leave 5 minutes after the process repository

109 Backing Up Data 109 has been locked before starting the backup process as this allows time for any processes that are already running to be completed.

110 Chapter 6 Administration Metric Configuration Updating Excel Macros The Excel Macro Launcher utility allows you to run Excel macros. This can be run manually or as a scheduled Windows task. Manually updating Excel macros 1. Run ExcelMacroLauncher.exe (...\Nimbus Control\Client\Utilities). 2. Click Browse and select the Excel file that you want to launch. 3. In the Macro text box enter the name of the macro that you want to launch. Save will save the spreadsheet after running the macro. 4. Click Run. Scheduling the Excel Macro Launcher The Excel Macro Launcher can be scheduled to run, either from the command line or as a Windows scheduled task. Use the following command: <Path to ExcelMacroLauncher.exe> <File> <Save> <CLEARRO> For example: "E:\Nimbus Control\Client\Utilities\ExcelMacroLauncher.exe" "E:\Excel1.xls" Macro1 Save CLEARRO Note: The Save parameter is optional; if included, the spreadsheet will be saved after the macro has been executed. The CLEARRO parameter will remove the read-only flag (if present) on the file before running the macro; the read-only flag is set if a user with read-only access runs the scorecard in the Author Client. Logging A log file is created when the utility is run; these logs are written to a Logs folder from the location in which the utility was run from. Any errors will be recorded in the log file Creating SQL Queries One method for retrieving data from an Excel spreadsheet is to go directly to a specific Excel file, sheet or cell in order to obtain the KPI value. However, an alternative option uses SQL queries to retrieve the data and this offers the following advantages: There are no performance overheads by continually communicating with Excel. If the KPI is moved to another cell then the link is maintained. If the Excel file is moved then you only need to update the SQL query as opposed to updating every metric link. To retrieve Excel data using SQL queries you need to define some data ranges within the spreadsheet(s).

111 Metric Configuration 111 Defining Excel Data Ranges SQL queries can reference data ranges in Excel spreadsheets. The advantage of ranged cells is that even if they are moved, for example a new column is added to the spreadsheet, the range is maintained. 1. In the Excel spreadsheet select the cell, range of cells or non-adjacent selections that you want to name. Note: There must be a cell that will be used as the field name. In the example below the cell that contains 'KPI' will be used as the field name. 2. Click in the Name box and enter a name for the data range. In the following example the data range has been named KPIRange. These ranges can then be referenced when creating SQL links in the AdminUtil. Creating SQL queries Run AdminUtil.exe (found in...\nimbus Control\Client). Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the Configure menu choose SQL Query Manager. From the Connection menu choose New. Enter a title, and description if required, then click Build. From the list of OLE DB Providers click Microsoft OLE DB Provider for ODBC Drivers, then click Next. On the Connection tab, from the Use data source name choose Excel Files, then enter the path to the Excel file in the Enter the initial catalog to use field. On the All tab, modify any of the initialization properties, if required. On the Connection tab click Test Settings, then click OK upon successful test. On the Data Connection window click OK. From the Query menu choose New. Enter a title for the SQL query, and a description if required. From the Connection Configuration drop-down list choose the data connection that you have just created, then click Next. In the SQL Statement tab enter the following SQL: Select * from <Range Name> Note: Substitute <Range Name> with the data range name in the Excel spreadsheet for the data that you want to retrieve. See Defining Excel Data Ranges, above, for more information. 16. Click the Test Results tab to ensure that the SQL query works. 17. Click Finish.

112 112 Chapter 6 Administration 18. From the Query menu choose Get Data Now to populate the SQL staging table with the respective data. Using SQL Queries Following the creation of a SQL query, Process Authors will be able to use it as a data source when creating metric links on activities and flow lines, and to retrieve activity costing data (volume and duration). See the Nimbus Control Client Help for more information Scheduling and Updating SQL Queries Nimbus Control stores values that have been retrieved from SQL queries in a cache/staging table, which can be updated by scheduling the SQL2CtrlUpdate utility to run on a regular basis. The frequency that the utility is scheduled to run will depend on how often the KPIs are updated, but for most scenarios overnight scheduling is sufficient. Specific KPIs that require updating more frequently can be achieved by updating an ID List file and creating a separate scheduled task. ID Lists are created using the Admin Utility. Creating an ID List File Run AdminUtil.exe (found in...\nimbus Control\Client). Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the Configure menu choose SQL Query Manager. Select the SQL queries that you want to add to the ID List file. Note: Hold Ctrl to select multiple SQL queries. 6. Right-click a selected query and choose Create ID List. 7. Enter a name for the ID List file and save it to an appropriate location. Scheduling data retrieval from SQL queries The SQL Query Update utility can be scheduled to run either from the command line or as a Windows scheduled task: <Path to SQL2CtrlUpdate.exe <process repository> [<ID List File>] For example: "E:\Nimbus Control\Client\Utilities\SQL2CtrlUpdate.exe" "E:\Nimbus Control\Process Repository" "E:\SQL Queries\SQLQueryList1.idl" Note: The ID List file parameter is optional. If an ID List file is not specified then all stored SQL queries will be updated. Logging A log file - SQL2CtrlUpdate.log - is written to whenever the utility is run. The log file is saved in the same directory as where the utility is run from.

113 Metric Configuration Integrating with SAP BW and SAP NetWeaver BI Certified for SAP NetWeaver Nimbus Control can be configured to integrate with SAP BW and SAP NetWeaver BI. Process Authors can then link to SAP metric data in the Nimbus Control client and provide access to end users from flow lines and activities. SAP reports can also be launched when users access SAP metric links; these reports must be defined in the Admin Utility. Note: If you are integrating with SAP NetWeaver BI, or if your server is not using the default web service parameters, you must define the advanced connection settings. See Advanced Configuration Settings below for more information. Configuring the integration with SAP BW or SAP NetWeaver BI Run AdminUtil.exe (found in...\nimbus Control\Client). Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the Configure menu choose SAP BW Integration. Select Enable integration with SAP BW. Click the Servers tab to select it. Click Add. In the Title text box enter a user-friendly title for the server connection. In the Base URL text box enter the URL and username/password credentials to allow connection to the server. Note: The base URL is usually the IP address of the server and the port for accessing SAP BW web services. Advanced Configuration Settings You may need to modify the server connection settings if you are integrating with SAP NetWeaver BI, or if your server is not set up to use the default web service parameters. Click the Advanced tab and modify any settings, as appropriate. Note: When the result is returned from SAP BW or SAP NetWeaver BI, the data is returned as XML. However, the data values can be returned with different tag names, which can be specified in the XML Results Tag Name field. 10.Click OK. Creating SQL queries to retrieve metric data In the SAP BW Integration dialog click the SAP BW Metrics tab to select it. Click Add. Click in the Title and Description text boxes and enter a title and description (optional). Choose the SAP server from the SAP BW Server drop-down list. Click Next. In the SQL Statement tab enter the SQL query that will return the metric data from the SAP BW or SAP NetWeaver BI server.

114 114 Chapter 6 Administration For example: SELECT [Measures].MEMBERS ON AXIS(0), NON EMPTY [0CALMONTH].[LEVEL01].MEMBERS ON AXIS(1)FROM [BSCUKIT/ZDEF_KPI_EITI_TBL] Note: This query will need to be written by a SAP BW or SAP NetWeaver BI analyst who has a good understanding of the cube data within your system. 7. Click the Test Results tab to view the data that is retrieved by the query. Note: Nimbus Control will use the first field from the first record as the value for the metric link, therefore the query may need to be modified to return the data that you want. 8. Click Finish. The SQL query will now be available to Process Authors when creating SAP BW metric links. Creating a SAP BW report link In the SAP BW Integration dialog click the SAP BW Reports tab to select it. Click Add. Click in the Title box and enter a title for the report. Choose the SAP server from the SAP BW Server drop-down list. Click in the SAP BW Report Code text box and enter the report code that you want to use. Click in the Description text box and enter a description (optional). Click OK. The SAP report will now be available as a launch target to process authors when creating SAP BW metric links in the Client. Scheduling data retrieval from SAP BW/NetWeaver BI Nimbus Control holds metric data and scorecards that are retrieved from a SAP BW or SAP NetWeaver BI database in a cache/staging table. It is recommended that this table is updated regularly. This can be achieved by either running it as a batch file from the command line, or automatically scheduling it using Windows Task Scheduler. Use the following command: <Path to SAPBW2CtrlUpdate.exe> <process repository> For example: "E:\Nimbus Control\Client\Utilities\SAPBW2CtrlUpdate.exe" "E:\Nimbus Control\Process Repository" Related topics Integrating with SAP NetWeaver (to enable launching of SAP transaction links) Registering with SAP Solution Manager

115 Metric Configuration Integrating with Microsoft Office Business Scorecard Manager Nimbus Control can integrate with Microsoft Office Business Scorecard Manager in order to retrieve metric data. Configuring the integration with Microsoft Office Business Scorecard Manager Run AdminUtil.exe (found in...\nimbus Control\Client). Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the Configure menu choose Microsoft Office Business Scorecard Manager Integration. Select Enable integration with Microsoft Office Business Scorecard Manager. Click the Servers tab to select it. Click Add. In the Server Connection Name field enter a name for the connection. Click the Business Scorecard Server tab and in the Microsoft Office Business Scorecard Server Connection Details panel enter the respective connection details for connecting to the Microsoft Office Business Scorecard server. Scorecard Service URL is the URL of the Microsoft Office Business Scorecard Manager web service. For example: 10.Click the Windows SharePoint Services Server tab and enter the respective details for connecting to the Windows SharePoint Services server. 11.Click OK Integrating with Cognos Metrics Manager Nimbus Control can integrate with Cognos Metrics Manager (CMM) in order to retrieve metric data. Metric data from a CMM database can then be associated with activities and flow lines as metric links in the Client. Configuring the integration with Cognos Metrics Manager Run AdminUtil.exe (found in...\nimbus Control\Client). Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the Configure menu choose Cognos Integration. Select Enable integration with Cognos Metrics Manager. Click the Settings tab to select it. In the Cognos Metrics Manager Page URL field enter the base page URL for the Cognos Metrics Manager. For example: 8. Click Build. 9. In the Provider tab select the database provider of the Cognos Metrics Manager database.

116 116 Chapter 6 Administration Note: This is usually Microsoft OLE DB Provider for SQL Server or Microsoft OLE DB Provider for Oracle. 10.Click Next. 11.In the Connection tab specify the data source connection details. Note: It is recommended that you select Allow saving password if this option is enabled. Click Test Connection to ensure that you can successfully connect to the data source. 12.Click the Advanced and All tabs and specify any additional settings, as required. 13.Click OK. Scheduling data retrieval from Cognos Metrics Manager Nimbus Control holds metric data and scorecards that are retrieved from a Cognos Metrics Manager database in a cache/staging table. Updating the data from Cognos Metrics Manager can be run from the command line, or it can be automatically scheduled using Windows Task Scheduler. Use the following command: <Path to Cognos2CtrlUpdate.exe> <process repository> For example: "E:\Nimbus Control\Client\Utilities\Cognos2CtrlUpdate.exe" "E:\Nimbus Control\Process Repository" Manually updating data from Cognos Metrics Manager The Cognos Metrics Manager cache/staging table can also be manually updated as and when required. 1. Following the definition of the Cognos Metrics Manager connection, click the Metrics Data tab in the CMM Connection Configuration dialog to select it. Note: Follow steps 1-4 (above) to open the CMM Connection Configuration dialog. 2. Click Get Data Now. Note: The data that is retrieved will be displayed in the dialog. This may take a short period of time, depending upon the connection. 3. Click OK.

117 Metric Configuration Integrating with Microsoft Office PerformancePoint Nimbus Control can integrate with Microsoft Office PerformancePoint in order to retrieve metric data. Metric data from a Microsoft Office PerformancePoint database can then be associated with activities and flow lines as metric links in the Client. Note: Microsoft Office PerformancePoint 2007 Service Pack 1 is required. Configuring the integration with Microsoft Office PerformancePoint Run AdminUtil.exe. Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the Configure menu choose Microsoft Office PerformancePont Integration. Select Enable integration with Microsoft Office PerformancePoint Click the Servers tab to select it. Click Add. In the Server Connection Name field enter a name for the connection. In the PerformancePoint Server panel, enter the details required to connect to the Microsoft PerformancePoint web services. Note: Scorecard Service URL is the URL of the Microsoft PerformancePoint web service. For example: 10.Click the Windows SharePoint Services Server tab to select it. 11.In the Server URL field enter the base URL of the server. 12.Click OK. 13.Run IIS Manager and expand the following nodes: 14.Copy and paste NpDynamicView.aspx from the PerformancePoint folder on the Installation CD to the sub-folder in the Microsoft.Performance.Scorecards.WebParts folder. 15.Close IIS Manager. Scheduling data retrieval from Microsoft Office PerformancePoint

118 118 Chapter 6 Administration Nimbus Control holds metric data and scorecards that are retrieved from a Microsoft Office PerformancePoint database in a cache/staging table. Updating data from Microsoft Office PerformancePoint can be run from the command line, or it can be automatically scheduled using Windows Task Scheduler. Use the following command: <Path to PerformancePoint2Ctrl.exe> <process repository> For example: "E:\Nimbus Control\Client\Utilities\PerformancePoint2Ctrl.exe" "E:\Nimbus Control \Process Repository" Manually updating data from Microsoft Office PerformancePoint The Microsoft Office PerformancePoint cache/staging table can be updated manually as and when required. 1. Following the definition of the Microsoft Office PerformancePoint connection, click the Data tab in the Microsoft Office PerformancePoint 2007 Integration dialog to select it. Note: Follow steps 1-5 above to open the Microsoft PerformancePoint 2007 Integration dialog. 2. Click Get KPIs, Scorecards and Indicators Now. Note: After a few moments the data will appear. 3. Click OK.

119 Metric Configuration Integrating with Third-party Applications Integrating with SAP NetWeaver Certified for SAP NetWeaver Nimbus Control supports the integration with a SAP GUI environment and one or more SAP webbased environments. If both environments are enabled, SAP transaction links can be configured to allow users to choose which environment to launch the SAP transaction in (see the Client help for more information on creating SAP transaction links). User preferences also dictate if a specific user can launch in one or both of the environments. Note: SAP transaction launching is not supported if there is a mismatch of the librfc32 library between a SAP server and SAP client environments, and when the librfc32 is v or older. Configuring the integration with SAP NetWeaver Run AdminUtil.exe (found in...\nimbus Control\Client). Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the Configure menu choose SAP NetWeaver Integration. Select one or both of the following options: Integrate with SAP web interface This will open a SAP transaction link in a web browser when users access a transaction link from either the Author Client or Web Server. Integrate with SAP using transaction launcher This will launch SAP transaction links in a SAP GUI system from either the Client and Web Server. When users access a transaction link the Launch SAP Transaction dialog is displayed, allowing users to create a session using credentials permitted to launch a remote function call within the SAP system (IFC permissions). Launching into a SAP GUI system will require an Active X component to be installed when users access a transaction link for the first time from the Web Server. If the user chooses to install the component, a ctrlsaplauncher.cab file will be copied to the user's machine. Future versions of Nimbus Control may require users to accept an updated ActiveX component. The following ActiveX security measures ensure a safe ActiveX component: Session Expiration - each session is set to expire after 10 minutes and logging out of a Nimbus Control Web Server session will force all sessions to expire. Site Lock - only trusted zones and intranet sites are allowed to run the ActiveX component. Buffer Overflow - checks that the buffer overflow technique is not being exploited. Launching Restrictions - requires the user to run the ActiveX component, thereby preventing malicious scripts from running. Domain Based Sessions - sessions are not interchangeable between domains, i.e. a session created on the local domain cannot be used to gain access from a different domain.

120 120 Chapter 6 Administration Note: The Microsoft Java Virtual Machine (MSJVM) may cause problems when installing the Active X component for the first time, for example the user may be directed to a web page displaying an error, or the web page may simply close. To resolve this problem the Microsoft Java Virtual Machine must be uninstalled. For instructions on how to remove the MSJVM, search the internet for 'Removing MSJVM'. 6. If you have selected to integrate with the SAP web interface, click the Base URLs tab and click Add to enter one or more base URLs to connect to. For example, 7. Click OK. Related topics Integrating with SAP BW and SAP NetWeaver BI (to retrieve measures/metric data) Registering with SAP Solution Manager Integrating with a Novell File Server Nimbus Control provides support for accessing resources on a Novell file server. The Nimbus Control applications that support the ability to access Novell file servers include: Executable/DLL ActSvc.exe (4 services) AdminUtil.exe CtrlOffSvr.exe BiSvc.exe WebSvr.dll SSynch.exe Cognos3CtrlUpdate.exe SQL2CtrlUpdate.exe SAPBQ2CtrlUpdate.exe ExcelMacroLauncher.exe LDAPUtility.exe Maestro2CtrlUpdate.exe WebLogsUtility.exe Location...\Nimbus Control\Action Server...\Nimbus Control\Client...\Nimbus Control\Action Server...\Nimbus Control\BI Server...\Nimbus Control\Web Server\App...\Nimbus Control\Web Server\Utilities...\Nimbus Control\Client\Utilities...\Nimbus Control\Client\Utilities...\Nimbus Control\Client\Utilities...\Nimbus Control\Client\Utilities Utilities folder on the CD...\Nimbus Control\Client\Utilities...\Nimbus Control\Client\Utilities Note: If using the LDAP Utility, LDAPUtility.exe must be copied from the Utilities folder on the installation CD into the Client\Utilities folder. Configuring the integration with a Novell file server 1. Run NovellConfig.exe (found in the...utilities\novell folder on the CD). 2. Select the location of an existing Novell configuration file (Novell.ini) or select a location to create a new one in. The Novell.ini configuration file should exist in one of two locations: In the same folder as Ctrl.exe (for example <Installation directory>\control\client) In a new folder called Common in the root directory of the Nimbus Control installation (for example...\control\common). By placing the configuration file in the root directory of the Nimbus Control installation, a single file can be used for multi-application Nimbus Control installations (for example Ctrl.exe,

121 Integrating with Third-party Applications 121 AdminUtil.exe, SQL2CtrlUpdate.exe, etc). Note: The file local to the executable always takes precedence if files are present at both locations, thereby giving the capability to override the shared file if required. If a configuration file already exists then the information will be overwritten. 3. Select Enable Logon to NDS and file servers and define the connectivity details to the Novell file server: General Tab Password encryption Standard allows decryption by any PC Specific to current PC allows decryption only by the PC that originally performed the encryption Specific to current PC and user allows decryption only by the PC that originally performed the encryption and when the same user is logged in User name is the account required to log in to the Novell file server Password is the password of the user name required to log in to the Novell file server Tree is the NetWare Directory Services (NDS) tree to log in to Context is the NetWare Directory Services (NDS) context to log in to (for example, CS.FNB. CS.NCSU) Additional File Servers allows you to specify additional file servers to connect to, for example ndsone.acme. Advanced Tab Define any logging required: Level determines the level of logging Log date and time logs the date and time of each event in the log file Log to debug output logs events to the Windows debug output 4. Click OK. Manually editing the configuration file You can manually edit or create a Novell.ini file. The following parameters exist: General LogDateTime LogToDebugOutput LoggingLevel Logs the date and time of each event in the log file. 1 = Enable date and time logging (default) 2 = Disable date and time logging Logs events to the Windows debug output. 1 = Enable date and time logging (default) 2 = Disable date and time logging Set this parameter to LogToDebugOutput=1 to enable logging to the Windows debug output, or LogToDebugOutput=0 to disable it (default if not specified). Determines the level of logging. Set this parameter to LoggingLevel=1 to enable logging, or LoggingLevel=0 to disable logging (default if not specified). LoginInfo

122 122 Chapter 6 Administration UserName Password TreeName UserContext Encryption Anonymous The user account required to log in to the Novell file server. The user account password required to log in to the Novell file server. The NetWare Directory Services (NDS) tree to log in to. The NetWare Directory Services (NDS) context to log in to (for example, CS.FNB.CS.NCSU). The type of encryption to use. Set this parameter to Encryption=0 to allow decryption by any PC (default if not specified), Encryption=1 to allow decryption only by the PC that originally performed the encryption or Encryption=2 to allow decryption only by the PC that originally performed the encryption and when the same user is logged in. Allows anonymous access to the Novell File Server. Set this parameter to Anonymous=1 to allow anonymous access (default if not specified) or Anonymous=0 to disable anonymous access. FileServers Specify any additional Novell file servers to connect to. Multiple file servers can be specified but if no servers are specified then no connections will be made, although log-in will still be completed. Specify a file server to connect to. For example, <Name of File Server> FileServer1=ndsone.acme. <Name of File Server2> For example, FileServer2=ndsthree.acme Integrating with Generic Portals Launching Storyboards based on Keywords Storyboards can be launched via the Web Server, based on specific keywords, using the following URL: id=webstoryboard. openbykeyword&k=example%20keyword Notes: The first storyboard that meets the keyword criteria will launch when the URL is used. The following HTML character codes are permitted in the URL: %20 = SPACE %22 = " %27 = ' To launch a storyboard with ALL tagged keywords in the URL, ensure that you include quotes (") around the keywords. For example, to launch a storyboard that has both 'Request' AND 'Leave' keywords tagged: id=webstoryboard. openbykeyword&k="request%20leave" If quotes are not applied then the first storyboard tagged with either 'Request' OR 'Leave' will be launched. Correct URL syntax:

123 Integrating with Third-party Applications id=webstoryboard.openbykeyword&k=example% 20Keyword - launches the first storyboard that includes any of the specified keywords. id=webstoryboard.openbykeyword&k="example% 20Keyword" - launches the first storyboard that includes all specified keywords. Incorrect URL syntax: id=webstoryboard.openbykeyword&k=%22example% 20Keyword%22 id=webstoryboard.openbykeyword&k=%27example% 20Keyword% Registering with SAP Solution Manager Data can be transferred between SAP Solution Manager and Nimbus Control. For this to be achieved, you must register Nimbus Control with SAP Solution Manager. Registering Nimbus Control with SAP Solution Manager Run AdminUtil.exe (found in...\nimbus Control\Client). Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the Configure menu choose Register into SAP Solution Manager. Enter the respective connection details. Click Browse to select the SAP XML file used for transferring data between SAP Solution Manager and Nimbus Control. 6. Click Register. Related topics Integrating with SAP BW and SAP NetWeaver BI (to retrieve measures/metric data) Integrating with SAP NetWeaver (to enable launching of SAP transaction links) Integrating with OpenText Document Management A web service is available via the Nimbus Control Web Server that allows documents stored in OpenText Document Management to be formally acknowledged through the Nimbus Control Document Registry. This feature is supported in OpenText Document Management v9.7.1 onwards Integrating with tibbr Nimbus Control can be integrated with the social networking tool tibbr (available from Tibco). Integrating tibbr with Nimbus Control allows authors to create tibbr subjects based on storyboard titles and keywords. Web users will have access to their tibbr Wall through their My Workspace and can search for tibbr discussions through My Searches. Notes: (1) There is a user group permission that allows authors to create tibbr subjects from storyboard titles and keywords (this is found under tibbr in a user group's permissions). (2) The tibbr section on users' My Workspaces is hidden by default for all user groups. To display the tibbr section you must configure users' Home pages. (3) You can modify the size of the tibbr gadgets in

124 124 Chapter 6 Administration the Web Server and assign a custom Home page tab to the tibbr section header. For more information see Configuring the Web Server. To integrate Nimbus Control with tibbr 1. In the Author Client, open the system options and click tibbr in the left-hand pane. 2. In the tibbr Domain panel, enter the domain for the tibbr installation (including the transfer protocol, such as 'http' or 'https'). 3. Click Change Credentials and specify the domain service account details. This is the account that is used to create the subjects in tibbr. 4. To enable the integration of storyboards with tibbr subjects, select Enable tibbr integration between storyboard titles and tibbr subjects. (Optional) You can specify a parent subject title for storyboard discussions in the field below. Whenever a storyboard discussion is created it will be created under this parent subject. Note: You must also manually create the parent subject in tibbr. 5. To enable the integration of keywords with tibbr subjects, select Enable tibbr integration between keywords and tibbr subjects. (Optional) You can specify a parent subject title for keyword discussions in the field below. Whenever a keyword discussion is created it will be created under this parent subject. Note: You must also manually create the parent subject in tibbr. 6. Click OK.

125 Chapter 7 Maintenance Nimbus Control Administration Guide

126 Chapter 7 Maintenance Recovering Deleted Maps and Diagrams Maps and diagrams that are deleted through the Client are not completely removed from the process repository as the data is moved into a Deleted folder, where it can be retrieved if required. Note: Master and draft maps must be recovered separately. Diagrams that have been deleted by removing a drill-down from an activity will be restored as new maps. To reintegrate them back into a map you must then import them as a drill down. Recovering a deleted map or diagram 1. In the Nimbus Control Author Client, from the File menu choose Deletion Recovery Manager. 2. Select the maps and diagrams that you want to recover. Note: Hold Ctrl to select multiple maps and diagrams. 3. Click Recover and select a location to save them to. 7.2 Checking Performance Performance checking of a process repository will measure the speed of creating, reading and copying tables and mark the overall results against a benchmark. Note: If the performance is slow you can copy the results and them to Nimbus Help Desk. Checking the performance of a process repository Run AdminUtil.exe (found in...\nimbus Control\Client). Click Browse and select the process repository that you want to check, then click Next. Enter an administrator's username and password, then click Next. From the File menu choose Diagnostics, then Performance Check. Click Start. 7.3 Checking Maps The Admin Utility allows you to check the state of all maps within a process repository and any issues will be logged. Some issues can be automatically fixed in the process, assuming you have exclusive access to the process repository. Issues that cannot be automatically fixed can be reported to Nimbus Support in order to be resolved. The following diagnostic checks and fixes are made: Maps (Check) Required files exist in a.map folder for each map. (Check) The DBISAM tables can be opened for each map. (Check) The DBISAM tables are not corrupt. (Check) All maps exist in the Maps table (not included in Standard mode). (Fix) Missing maps are added to the Maps table. (Check) A user groups table exists in each Map folder and can be opened.

127 Checking Maps 127 (Check) A text table exists in each Map folder and can be opened. Diagrams (Check) Diagrams have entries in the Link table (not included in Standard mode). (Fix) Missing diagrams are added to the Link table. (Check) Missing drill downs. (Fix) Invalid levels are used as the missing drill downs if the title matches the object text, or the drill down arrows are removed (for free text and bitmap objects the drill down references are removed). Manually checking a process map Run AdminUtil.exe (found in...\nimbus Control\Client). Select the process repository that you are configuring. Choose an administrator account, enter the password and click Next. From the File menu choose Diagnostics, then Check Maps. Select to run a Standard Check or an Extended Check by selecting the relevant option. Standard Check will run all of the checks and fixes (as described above) except it will not check that each map exists in a Maps table and that all diagrams have entries in the Link table. Extended Check will run all checks and fixes. Ignore Deleted Items will ignore all maps and diagrams in the Deleted folder. Fix will fix any problems, if possible. Logging Generated diagnostic log files are stored in the following directory: <Process Repository>\System\Logs\Diagnostics Results will be appended to the log file if it already exists. If running from the command line, or from a batch file, you can create a new log file for every run by adding the /N parameter. The following log messages may be encountered: Log Message Description Manually Cancelled By User User manually selects Stop when running a diagnostic check File Missing One of the map files is missing, for example files pertaining to the diagram table, binary table, level table, keyword table, texts table, user groups table, etc Can't Open Table Application fails to open a table, for example a diagram table, binary table, level table, keyword table, texts table, user groups table, etc Drill Down Diagram Missing A child diagram for a drill down object, free text object or image object is missing in the diagram table for it's child (using the ChildGUID). Drill Down Points to Invalid Level Drill down, free text or bitmap image points to an invalid diagram level * Diagram not in Links Table A record for a diagram path and GUID is not present in the Central Links Table as part of its existing records. Can't Access Map A diagram table cannot be opened in the Maps folder. Map not in Central Maps Table A record is missing in the Central Maps table for a map and its relative folder as part of its existing records.

128 128 Chapter 7 Maintenance Diagnostic check started (Fix = True) The Fix option was selected when running the diagnostic check. Diagnostic check started (Fix = False) The Fix option was not selected when running the diagnostic check. Diagnostic check finished Diagnostic check complete. Unable to start - Process repository locked Process Repository cannot be accessed as it's locked, for example if it's currently in use or on a scheduled maintenance. Error: Can't create map tables for The following tables cannot be created for a map (when trying to create a map for an extracted invalid level) - Diagram, Binary, Level, Keyword, Texts, User Groups. Error: Can't create map A folder cannot be created for a map using the map path (when trying to create a map for an extracted invalid level). Error: Can't create new folder Any parts of a folder directory using the map path cannot be created (when trying to create a map for an extracted invalid level). Error loading diagram A special case which occurs when the application tries to load a diagram based on the GUID code string but fails to find the matching record in the Diagram Table, for example due to incorrectly formatted data. An exception is also raised. Error saving diagram Saving a diagram fails after a fix, such as 'replacing the file links' or 'fixing a drill down', has been applied to a diagram. Image not found in Binarys table GUID missing for an image as part of its existing records in the Binaries Table. Fix: Drill Down Fixed Using Invalid Level A drill down is fixed with an invalid level (from the Invalid Level List) where the title matches the object text. In this instance the GUID is changed to match the drill down (requires the Fix option to be selected). Fix: Drill Down Fixed By Removing A drill down is removed to resolve a diagram issue (requires the Fix Object option to be selected). Fix: Drill Down Fixed By Removing A reference from a Free Text object to it's child GUID is removed to Reference (free text object) resolve a diagram issue (requires the Fix option to be selected). Fix: Drill Down Fixed By Removing A reference from an Image object to it's child GUID is removed to Reference (image object) resolve a diagram issue. Fix: Link Table Record Added A diagram's GUID and path are added to the Central Links Table as part of a fix. Fix: Map Added to Maps Table A map record is added to the Central Maps Table if it was previously missing. Fix: Invalid Level Extracted A record is removed from the Diagrams Table and moved to a new table in a new map. Each extracted level gets its own new map. * Invalid diagram levels are usually the result of users copying and pasting whole maps, or sections of maps, rather than using drill downs (or the send to child functionality). Due to the complexity of the database tables, if the copy and paste operation is interrupted due to network problems or accessing the content over an unreliable wireless network, for example, then invalid

129 Checking Maps 129 levels may occur. Scheduling It is also possible to schedule the utility to run at defined intervals using the Windows Task Scheduler, or the utility can be run from the command line as a batch file: <path>\adminutil.exe "<path of process repository>" [/D] [/F] [/I] [/N] [/E] /D Check the process repository /F Fix any issues, if possible /N Create a new log file for every run (date and time stamped) /I Ignore deleted items /E Run in extended check mode For example: "C:\Nimbus Control\adminutil.exe" "<Installation directory>\nimbus Control\Process Repository" /D /F /N /I /E Notifications A list of addresses can be specified to notify selected users after the diagnostic check has been run. Any issues will be included in the body of the . In the Admin Utility, from the File menu choose Diagnostics and then List. Click Add to add a new address. Note: By default, the Nimbus Control Action Server is used to send out notifications after running a diagnostic check. However, you can specify a different SMTP server to use if required, and this is recommended if you are running diagnostic checks against an offline process repository (for example, a backed up process repository). To specify a different SMTP server, click the Server tab in the Diagnostic Check Configuration window and select Configure SMTP server separately. Enter the host and port of the SMTP server, then click Configure SMTP Credentials to specify the authentication details (if required). 7.4 Archiving Maps The Archiving Utility (CtrlArchives.exe) runs the following tasks: Compresses archived maps If the Store compressed static version of map archives system option is enabled, any map folders stored in the specified archive location will be compressed into archived packages (.arc). Archived packages are saved in the same location as the archived map folder. Removes old archived maps If the Automatically remove old archives system option is enabled, old archives are either permanently deleted or moved to a specified location, depending on what system options are set. Note: The options governing the behaviour of the Archiving Utility are found under Document Control/Archives in the system options. Manually archiving maps 1. From a command prompt run the following command: <CtrlArchives.exe> <process repository>

130 Chapter 7 Maintenance 130 For example: "C:\Nimbus Control\Client\Utilities\CtrlArchives.exe "C:\Nimbus Control\Process Repository Note: You can also change the output of the log file (by default it is stored in the same directory). For example: C:\Nimbus Control\Client\Utilities\CtrlArchives.exe "C:\Nimbus Control\Process Repository" "C:\Logs\Archive.log" Scheduling It is advisable to schedule the utility to run at regular intervals using Windows Task Scheduler. The command lines (above) should be used when creating the task. Logging All logs, including any issues with archiving, are stored in a log file. Unless otherwise specified, the log file is called ctrlarchives.log and is stored in the same directory as where the utility is run from. 7.5 Managing Database Tables There are a number of tables that hold Nimbus Control data. If you are experiencing problems with any of these data tables then there are a number of options available. Maintaining tables should be attempted by experienced users only. Please contact Nimbus Support before undertaking any actions. Managing data tables Run AdminUtil.exe (found in...\nimbus Control\Client). Click Browse and select the process repository that you want to check, then click Next. Enter an administrator's username and password, then click Next. From the Tables menu choose a table and then one of the available options. Table Maps Open Repair Create Rebuild Links Diagrams Binarys Levels Texts Document Registry Action Server Other System Tables: Action Attachments

131 Managing Database Tables Table BI Server Open Repair Create 131 Rebuild Data Table Attachments Delete Recovery Keyword Recurring Review Resource Scorecard Search Statement Storyboard User Library View the information within a table. Some tables can be edited, for example the Links Open table. Rebuild the indexes and fix corrupted headers, where possible. Repair options Repair should not be run on a table unless the data in a table is corrupted. the table to Nimbus Help Desk. Create an empty table if a table does not already exist. If you are creating a Maps Create table then you must rebuild it following its creation. Rebuild a table. Rebuild Extract (Diagrams table only) Remove all invalid diagrams from the table. A new folder called Invalid <map>_invalid_levels is created, allowing maps to be recovered if required. Levels

132 Chapter 7 Maintenance Synchronizing the Web Server The System Synchronization Utility updates the data that is presented to users through the Web Server. It should be run daily and can be run manually, from the command line or, ideally, as an automated Windows scheduled task. Note: The desktop client must have been run at least once before using this utility. The System Synchronization Utility is also used to synchronize the Business Intelligence Server to update metric data. See Synchronizing the Business Intelligence Server for information. If set to run as a scheduled task, the System Synchronization Utility must not be running when a process repository backup is in progress, as this can lead to inconsistent and corrupt data in the backup. Synchronizing the Web Server 1. Run SSync.exe (found in...\nimbus Control\Web Server\Utilities). Note: The System Synchronization Utility can also be run from the Start menu: Program Files >Nimbus Control >Utilities >Synchronisation Configuration File The System Synchronization Utility has an associated configuration file config.ini (found in... \Nimbus Control\Web Server\Utilities). The following parameters can be modified: DATA FOLDER Path The path of the process repository (this can be a UNC path name) TEXT ReminderAck ReminderAuth ReminderRev ReminderAct OverdueAck OverdueAuth OverdueRev OverdueAct This is the text that is sent to users in SMS notifications, which can be modified if required. For example, ReminderAck is the text sent to users to remind them of a pending acknowledgement request. OverdueAck is the text sent to users to inform them of an overdue acknowledgement request. SMS Where Short Message Service (SMS) is required, a SMS service provider is required to send the text messages. More than one service providers can be specified but only one may be active at any one time. Contact Nimbus Support if you need to specify multiple SMS service providers. Comment out the service provider parameters (the name of the service provider and then ClsID. Name The name of the service provider (by default Clickatell is specified) ClsID This value should not be changed IniFileName The location of the service provider specification data (it can be this file) LogFileName The path and name of the log file that is created (defaults to smssync.log if not specified). LogAppend Appends to the existing log if set to '1', otherwise it will overwrite the existing log if set to '0'.

133 Synchronizing the Web Server 133 CLICKATELL By default, Nimbus provides a service provider module for Clickatell. Note: A Clickatell account is required, which can be obtained from Clickatell. API_ID The Clickatell ID (provided by Clickatell) User The Clickatell username Password The Clickatell password From The name that will appear as the sender of SMS notifications UseGet Set this value to '0' UseSSL Default is on, '1'. Set this to '0' to turn SSL off. NOTIFICATION Notifications can be sent to one or more nominated addresses, via the Action Server, if any errors occur during any synchronization operations. Enabled Set this value to '1' to enable notifications. Specify the address(es) to send notifications to. Note: Multiple addresses must be separated by semi-colons. ServerIdentifier Specify a name to identify the Web Server with; this text will appear in any notification s that are sent out. Scheduling Web Server synchronization Synchronizing the Web Server can be run from the command line, or it can be automatically scheduled using Windows Task Scheduler. It is recommended to schedule this task daily. Run the following command: <path>/ssync.exe <path of ini file> [<path of log file>] -[optional parameters] Optional parameters: -search -measure -resources -links -regusage -reviews -mysearches -withdrawndocs -reminders -acktodos -mapsclean -linksclean Updates the search database Updates metrics (measures) Updates resources in the My Roles page Updates flow line linkage Updates Document Registry item usage database Updates recurring reviews Updates users' search database Withdraws acknowledgement requests for withdrawn documents Sends out reminder notifications for past due (overdue) To-do items Withdraws acknowledgement requests for users that are removed from any user groups that are assigned as acknowledgers Removes old maps from the Deleted folder (see note below) Removes redundant diagram links (see note below)

134 134 Chapter 7 Maintenance -recurringactions -archiveactions Triggers any pending recurring actions Automatically archives completed actions (see note below) For example: "...\Nimbus Control\Web Server\Utilities\SSync.exe" "...\Nimbus Control\Web Server\Utilities \config.ini" "...\Nimbus Control\Web Server\Utilities\SSyncResults.log" -search -resources regusage -reviews -withdrawndocs Note: If no optional parameters are specified then all tasks - except flow line links, Document Registry items, deleted links and deleted maps - will be updated. If a path to the log file is not defined then it will use the local folder. Note: The -mapsclean and -linksclean parameters are not run by default. These tasks should be scheduled separately to run on a weekly basis. Note that the maximum number of days to keep deleted maps is specified in the Maps system options within the Author Client. For the archiveactions parameter, the number of days before archiving completed actions is defined in the Action Settings (within the system configuration options in the Author Client). If this is set to '0' then completed actions will not be archived. Logging A log file is written to whenever the System Synchronization Utility is run: <Installation directory>\web Server\Utilities\SSyncResults.log In the Synchronization Configuration file, the level of logging can be defined (default location of configuration file is C:\Nimbus Control\Web Server\Utilities\config.ini). LoggingLevel 0 No logging 1 Low 2 Medium (logs all maps that are checked in the Search and My Searches index operation) 3 High (logs all maps and diagrams that are checked in the Search index operation and all maps checked in the My Searches index operation. It also logs the GUIDs of all diagrams for additional operations). 4 Max (includes all high-level logging, but also includes additional information, such as the logging of all entries that were deleted from the Document Registry item usage table via the -regusage operation and redundant diagram link entries that were removed via the -linksclean operation).

135 Synchronizing the Web Server Monitoring Web Server Performance The Nimbus Control Performance Monitor provides the ability to access some of the internal counters within the Web Server in order to monitor the behaviour of the application. The plug-in provides a new counter set called Nimbus Control and contains six counters (Active Sessions, Image Execution Time, Images/Sec, Page Execution Time, Pages/Sec and Queue Length). See Installation\Installing Nimbus Control Performance Monitor for more information. Related topics Configuring Web Server Logging 7.8 Restarting, Stopping and Starting the Web Server Changes to any localisation files and changes to some of the Web Server configuration settings file (e.g. changes to the Home page text and Tabs) will require a restart of the Web Server to update the changes. One method is to reset the Internet Information Services (IIS); however, resetting IIS will also reset any other web services that utilize IIS. A Web Server installation includes some Java scripts to restart, start and stop the Web Server. Restarting a Web Server can be undertaken while users are still logged on; any server requests submitted by users will be queued and, since it only takes a moment to restart the server, users will not really be affected. Restarting the Web Server Double-click restart.js in the Web Server installation that you want to restart. Stopping the Web Server Double-click stop.js in the Web Server installation that you want to restart. Starting the Web Server Double-click start.js in the Web Server installation that you want to restart. Note: The location of the javascript files is...\nimbus Control\Web Server\Reload.

136 Chapter 7 Maintenance Managing Nimbus Control Services The Nimbus Control Service Installer allows the Nimbus Control Action Server services to be managed. Managing Nimbus Control services 1. Run ServiceInstaller.exe (found in the Utilities folder on the CD). There are two tabs: Services By Folder This tab displays all Nimbus Control services for a specific installation. Click Browse to select a Nimbus Control folder (e.g. <C:\Nimbus Control). Note: If it is not a default installation, i.e. the Action Server is not installed in the Control folder, deselect Assume normal Control sub folders. Currently Installed Services This tab displays all services on the system. If you have multiple installations of Nimbus Control on a single machine, this information is useful when performing upgrades. Managing Services The following actions can be executed: Start and Stop services independently - Select the service and click either Start or Stop. Uninstall a service - Select the service and click Uninstall. Toggle the service startup between manual and automatic - Select the service and select either Automatic or Manual from the Select Start Options. Click Install/Update to update the selection. Add a suffix to services - Select the service(s) and in the Enter an identifier to be added to the service's names text box enter a suffix. Click Install/Update to update the selection. Select Service Type allows you to run each service as independent processes, or as a single process. Running all services as one process can help reduce the consumption of resources on servers hosting multiple author clients. Related topics Configuring the Action Server

137 Managing Nimbus Control Services Replacing File Link Paths File link paths, including Excel-based metric links, can be replaced in all maps within a process repository, regardless of diagram access rights and authorization statuses. This is useful, for example, if linked files are moved to a new location. Replacing the paths of file links should be attempted by experienced users only. Document links are not updated as part of the process; links to documents in the Document Registry can be updated in the Client. Replacing file link paths 1. Run AdminUtil.exe (found in...\nimbus Control\Client). 2. Click Browse and select the process repository that you want to replace file link paths in, then click Next. 3. Enter an administrator's username and password, then click Next. 4. From the Edit menu choose File Link Search and Replace. 5. In the Search On box enter the path that you want to replace. 6. In the Replace With box enter the path that you want to replace with. Include Metric Links will search and replace file paths for any Excel-based metric links. 7. Click OK Viewing Map Paths The physical paths of all maps in a process repository can be checked and the information can be exported to Excel format. Viewing map paths 1. Run AdminUtil.exe (found in...\nimbus Control\Client). 2. Click Browse and select the process repository that you want to replace file link paths in, then click Next. 3. Enter an administrator's username and password, then click Next. 4. From the Tools menu choose Map Paths Viewer. Note: To export the list of maps in the process repository to a file, from the File menu choose Export Grid As Shown To and then choose a file format Enabling Administrator Access to all Diagrams It is possible for Administrators to be denied access to a diagram when the default permission rights are set to Access Denied. You can grant access to administrators for all diagrams in the process repository by creating a.npdta file. Enabling administrator access to all diagrams 1. Create a file called AdminAll.npdta in the root of the process repository.

138 138 Chapter 7 Maintenance Note: This file can be created in Notepad. Ensure that the.txt extension is not added to the end of the file.

139 Chapter 8 Customization Nimbus Control Administration Guide

140 Chapter 8 Customization Customizing the Web Server There are two documents that will assist you in customizing the Web Server; one concerns the Classic Web Server and the other a SharePoint integration. Classic Web Server Branding The Nimbus Control browser interface can be customized, including modifying the general look and feel, changing the logo, customizing the look of storyboards, redefining the Home page text and adding and removing tabs. The Classic Web Server Branding PDF, that is included in the Documents folder on the CD, provides information on modifying the interface to give it a corporate look and feel. SharePoint Customization Guide The Nimbus Control site in a SharePoint interface integration can be customized. Most of the customization of a Nimbus Control site in SharePoint is configured within the SharePoint Administration environment. The SharePoint Customization Guide PDF, that is included in the Documents folder on the CD, provides information on modifying the Nimbus Control site to ensure a corporate look and feel.

141 Chapter 9 Troubleshooting Nimbus Control Administration Guide

142 142 Chapter 9 Troubleshooting The Nimbus Self Service Portal is the best place to find solutions to any issues that you may encounter. The portal allows you to view and search existing support cases and also raise new cases. To request access to the Nimbus Self Service Portal: The Nimbus Self Service Portal can be accessed at: