WebFOCUS Infrastructure and Security

The following are release considerations and product changes for WebFOCUS security:

• As of WebFOCUS Release 8.2 Version 01M, links to Technical Content resources, including the WebFOCUS Release 8.2 Version 01 Application and Enterprise Editions Information Center, have been updated to secure URLs, beginning with https. Earlier links to these sites will be automatically redirected to the new https sites. You may be prompted with a message, depending on the browser you use and the security you have configured on your machine.
• In WebFOCUS Release 8.2 Version 01M, the Synchronize User Information check box, found on the External page of the Security tab in the Administration Console, includes two new options that are activated when this check box is selected.

  These options enable administrators to identify the authentication provider or the authorization provider as the source of information for automatic updates made to the Description and EMail Address fields whenever a user signs in.

• In WebFOCUS Release 8.2, Name variables assigned to a server application directory must use lowercase characters exclusively. Therefore, when creating a model domain for a custom resource template, the value assigned to the Name field must be typed only in lowercase characters. For example, the value %%name%% is permitted, but the value %%NAME%% or %%Name%% should not be used. Similarly, any updates to the name variable in the scenario.xml file, stored in the custom resource template folder, must use lowercase characters exclusively.

  Name values assigned to domains and groups can use uppercase, lowercase, and mixed-case letters. However, name values created for application folders on the Reporting Server must use lowercase letters exclusively. If you export a template with a Name field that contains mixed case characters, the application directory name is converted to lowercase characters, and an unexpected additional variable is produced. To prevent this outcome, ensure that all values assigned to the Name field of a custom resource template use lowercase letters exclusively.

• In WebFOCUS Release 8.2, display entries in the License Information dialog box, found in the Administration Console by clicking License from the menu bar and then clicking WebFOCUS client, were changed to accommodate changes to the license key implementation. These changes affect the User Licenses section of the dialog box, and the Product Component Section.

  User License Types

  In WebFOCUS Release 8.2, the user type groups listed in this section have been changed as follows:

  • Total Users (TU). Identifies the total number of users in the repository. This total includes users created during and after product installation.
  • Portal Users (PU). Continues to identify the number of users with portal access privileges. Because users with InfoAssist+ privileges must also be granted portal privileges, the number of portal users will never be less than the number of InfoAssist users. In the 8.2.01 Enterprise Edition and Application Edition, this category also includes the number of users who maintain ReportCaster-only privileges or Library-only privileges.
  • InfoAssist+ Users (IA). Identifies the number of users with InfoAssist privileges. This count includes users with InfoAssist or InfoAssist+ privileges because an InfoAssist+ license includes the InfoAssist and Data Visualization product components.

  Product Components List Updates

  In WebFOCUS Release 8.2, changes to entries in the Product Components list reflect changes in component names and configuration that took place in Release 8.2, including the following changes:

  • Legacy Dashboard is discontinued as of Release 8.2. Instead, InfoAssist Basic supports customers upgrading to Release 8.2 with an existing Legacy Dashboard license and a WF Portal license.
  • InfoAssist+ combines InfoAssist and Data Discovery. The former products, InfoAssist and InfoAssist Basic, continue to be available in Release 8.2. However, these products appear in the product component list only if they are included in the license key.
  • Personal InfoAssist is discontinued as of Release 8.2.
  • WebServices replaces WebServices Enablement as of Release 8.2.
• In WebFOCUS Release 8.2, the user type groups listed in the License Analysis Dialog Box have been changed as follows:
  • Total Users (TU)
  • Portal Users (PU)
  • InfoAssist+ Users (IA)

  For detailed definitions of these user types, see the previous note.

• In WebFOCUS Release 8.2 Version 01M, templates that specify WebFOCUS Client message information and user interfaces, such as the Deferred Reporting interface, were removed from the single file, ENtemplates.xml, and separated into individual files. These files are located in the prod directory, found in drive:\ibi\WebFOCUS82\client\wfc\etc\prod. To create a customized version of a standard template, customers can take a copy of a standard template file from the prod directory, place the copy in the custom directory, found in drive:\ibi\WebFOCUS82\client\wfc\etc\custom, and adjust the standard template to their requirements. When invoking a template, the WebFOCUS Client first checks the custom directory and uses the customized template file if it is located there. If no customized template file is present, the Client uses the standard template file in the prod directory.
• The maximum number of characters in the WF Repository Summary field on the Properties dialog box has been increased from 512 to 2048 characters.
• In Release 8.2, the new Log Files page replaces the Traces folder and the individual log file pages that appeared under it. Therefore, entries for all log files now appear on the Log Files page. In the Administration Console, the new Log Files page appears on the new Diagnostics tab under the Diagnostic folder. The list of log files on that page now identifies the name of the log file, the name of the logger, the URL that contributes events to the log file, and the log level, that is, the level of detail captured in records of events. Administrators can adjust the log level for any log file except the audit log file to capture the level of detail required for troubleshooting support.

  The Zip All button that appeared in WebFOCUS 8.1 on the All Clients, Client Coordinator, MR Deferred Ticket Cleanup Utility, and WFServlet pages now appears on the Log File page. This button captures copies of all log files and the system event records they contain in a zip file format. When you click this button, the log files capture records of events from the start of the current day until the time the zip file is created.

• The License Information dialog box limits its display of product components to those made available in Release 8.2. Therefore, the product component display for license keys configured from an earlier version of WebFOCUS 8 no longer includes entries for Legacy Dashboard and Personal InfoAssist. InfoAssist Basic is included only if the license key includes Legacy Tools.
• As of Release 8.2, the Client License Key Expiration Warning display period was reduced from 30 to 14 days prior to expiration date. By default, a warning message for the client license key expiration date begins to appear fourteen (14) days before the actual expiration date. The warning message displays the expiration date and the number of days remaining until that date. It appears only to administrators during sign on, and it is written to the event.log file located in the logs directory of the WebFOCUS Client installation.
• In WebFOCUS Release 8.2 Version 01M, the following deprecated settings no longer appear on the Configuration tab, Client Settings page of the Administration Console:
  • Expire Reports
  • Cache_Control
  • Automatic Signon

  The Expire Reports, Cache_Control, and Automatic Signon settings were hidden because there is no need to update the default values assigned to them.

• Web Services Traces Relocated. In WebFOCUS Release 8.2, the Web Services page, previously found in the Diagnostics Section of the Configuration Tab, under the Traces folder, has been discontinued. To view traces of URL calls that used to appear on that page, open the Session Monitor or Session Viewer instead. Traces captured during your selected session are available in those locations for your review.
• The tcnative-1.dll for Tomcat is disabled due to reported problems with ipv6 support.
• In Kerberos authentication, Kerberos appends the Windows domain of the user to the user ID passed to WebFOCUS, in the format user ID@domain.com. WebFOCUS Release 8.0 leaves the domain information intact when completing the sign-in process. By default, WebFOCUS Release 8.2 strips the domain from the value, leaving just the user ID. The user ID is then used to complete the sign-in process. For more information, see the Authentication and Authorization chapter in the WebFOCUS Security and Administration manual.
• In WebFOCUS Release 8.2, Roles in the Security Center dialog box have been updated as follows:
  • DomainDeveloper. Added the Portal Page Designer privilege (opPageDesigner) to the Advanced Reporting folder and the Create Portal (opCreatePortal) privilege to the Application Development folder. The Create Portal privilege applies only to new portals that are created under a domain in Release 8.2. The DomainDeveloper role does not support the privilege to create portals in earlier releases.
  • DomainGroupAdmin. Moved the Create Portal privilege (opCreatePortal) from the Group Administration folder to the Application Development folder, and cleared that privilege to remove the privilege to create portals from the role of the Group Administrator.

  These changes move the privilege to create portals within a domain from the Group Administrators to the Developers, and add the privilege to design portal pages within a domain to Developers. You may need to adjust role assignments after the upgrade to ensure that all users within a domain continue to maintain their full range of privileges.

• In new installations of WebFOCUS Release 8.2 Version 01, the Developers group does not appear in the top level of the Groups hierarchy. Instead, Developer groups are created as sub-groups of individual domains. The top-level Developers group was removed from the Groups hierarchy to help administrators avoid assigning users to a Developers group that does not maintain a range of privileges that adequately supports their activities in the new release.
• In WebFOCUS Release 8.2 Version 01M, the X-Frame-Options Header check box, located in the Filters page of the Administration Console Configuration tab, was renamed Allow Embedding and moved to the Cross-Origin Settings dialog box. To continue to allow WebFOCUS content to be embedded in other applications, customers who previously cleared the X-Frame-Options Header check box must now select the new Allow Embedding check box. They can also optionally specify the URLs of one or more allowed web hosts in the new Allowed Origins field under the Allow Embedding check box, for improved security. To locate the new Cross-Origin Settings dialog box, open the Administration Console, and click the Security tab. Under the Security Zones folder, click the Authentication node for the Security Zone that supports embedded applications. To open the dialog box, click the Cross-Origin Settings link located in the Actions section of the Authentication page.
• In WebFOCUS Release 8.2 Version 01M, the New User dialog box contains the new Create button. This button allows administrators to create multiple new users without closing the New User dialog box.
• In WebFOCUS Release 8.2, the following changes were made to the Available Privileges list in the New Role dialog box, located in the Security Center Roles tab.

  The following privileges were added:

  • Distribute to File System (opDistributeFileSystem). Added to the Scheduling and Distribution section.
  • Manage ReportCaster Library Report Deletion (opRCExpLibraryDelete). Added to the Administration section.
  • Manage ReportCaster Log Purge (opRCPurgeJobLogs). Added to the Administration section.
  • Manage ReportCaster Watch List Subscription (opRCUnsubscribe). Added to the Administration section.

  The following privileges were renamed:

  • Development Traces (opDevTraces). Renamed to Session Traces and placed in alphabetical order in the Application Development section.
  • Edit Group Names (opRenameGroup). Renamed to Group Rename and placed in alphabetical order in the Group Administration section.

  The following privileges were relocated:

  • Create Portal (opCreatePortal). Moved from the Group Administration section to the Application Development section.

  Privileges in the Administration section were reorganized in alphabetical order, causing the following privileges to be relocated within that section:

  • System Tracing (opWFAdminTraces)
  • Toggle Repository View (opToggleTree)

  The following privilege now appears conditionally:

  • Run Procedures with OLAP (opOlap). Appears in the Basic Reporting Section only if the Enable OLAP check box, located on the Other page of the Administration Console Configuration tab, has been selected.
• When using the Google Chrome™ browser, the Close command on the Administration Console Menu bar does not close the Client Verification page, if that page opens in a window with multiple tabs after the WebFOCUS Client installation is complete. To close this page, click the Close button on the browser tab that displays it. This issue occurs only when the Client Verification page opens after an installation. It does not occur when you open the Client Verification page by clicking the Client Verification node in the Administration Console Diagnostics tab.
• WebFOCUS Release 8.2 Version 01M includes a new URL to run report requests:

  http://host:port/ibi_apps/run/ibfs/WFC/Repository/Domain/ReportName 

  where:

  host:port

  is the server name and port of the local installation of WebFOCUS.

  Domain

  is the name of the domain folder that contains the report.

  ReportName

  is the name of the report itself.

  This new URL does not replace the previously-developed URL to run reports:

  http://host:port/ibi_apps/rs/ibfs/WFC/Repository/Domain/ReportName

  The syntax in the new URL was updated to address bugs in single sign-on requests that were failing with the AuthenticationCredentialsNotFound exception. All application requests using the older syntax should be updated to use the new URL.

• The Custom Request Validation (IBI_REQUEST_VALIDATION) setting was removed from the Filters page of the Administration Console Configuration tab in WebFOCUS Release 8.2 Version 01M. For more information about this setting, please contact the Customer Support Team.