Reference: Server Node Properties
The Server Node properties defined in the Basic pane are explained below.
Basic
- Node Name
-
The name cannot be the same as any other node name, and it cannot contain more than forty-eight (48) characters. When the client accesses this server, it will use this name.
- Node Description
-
Optional. The description of the node that appears in the Configuration pane. If this is omitted, the node name will be used.
- Host
-
The Host name or IP address of the Host Server.
- TCP/IP Port
-
The Port number for the TCP listener. The default port is 8120.
- HTTP(S) Port
-
The Port number for the HTTP listener. This is typically one port after the TCP/IP port.
The default HTTP port is 8121.
- Security
-
The security options for the Server connection.
- Prompt for Credentials. The Client makes an explicit connection to the Server with the user ID and password specified in the Web Security tab. This is the default value.
- HTTP Basic. The user ID and
password are extracted from the authorization header. These credentials
are then used to make an explicit connection to the Server.
You should only select this option when your web tier is performing
Basic Authentication.
Note: You can verify that the authorization header is available by selecting HTTP Request Info in the Diagnostics tab.
- Kerberos. The Client passes a Kerberos ticket for the user to the Server, along with the user ID and group memberships assigned to that user. This option enables an end-to-end single sign on solution from the desktop to the Client, from the Client to the Server, and from the Server to supported relational DBMS systems. To use Kerberos authentication, the Server must run in security OPSYS mode.
- SAP Ticket. The Client passes the user MYSAPSSO cookie, which is created on SAP Enterprise Portal, to the Server. The Server then validates the cookie using the SAP security API. This option enables single sign on from the Client to a Server configured with the Data Adapter for SAP for environments using Open Portal Services in SAP Enterprise Portal.
- Service Account. Allows you to specify
a user ID and password to be used for all connections to the Server.
The service account credentials are encrypted and stored in the SECURITY keyword of the odin.cfg file. When defined, the service account overrides any other credentials that may be presented for this Server node, and all users connect to the Server using the same credentials. This approach does not make it possible to identify which user is running a given request on the Server in Managed Reporting deployments, and therefore is not recommended for them.
- Trusted. Allows non-authentication requests to connect
to the Server as trusted. After a user is authenticated
through a pre-authentication mechanism or a Sign in page,
all subsequent requests to the Server are trusted.
To use this option, the Server Security Provider must also be configured to allow trusted connections, and controls should be placed on the Server to ensure that it rejects connections from unauthorized clients. For example, you should employ the Server RESTRICT_TO_IP setting or configure a network firewall so that only your specified clients can connect to the Server.
When you create a new Client Configuration, the Trusted option is selected, by default, and the Pass TIBCO WebFOCUS User ID and their Groups and Custom options appear below it. When you accept the default option, Pass TIBCO WebFOCUS User ID and their Groups, the Client passes the ID and group memberships assigned to the user to WebFOCUS Server. When you select the Custom option, the display refreshes to show the User ID and the User's Groups check boxes allowing you to customize the user information passed to the server. The options TIBCO WebFOCUS script variable and HTTP Header Field appear under both check boxes, as shown in the following image.
Under the User ID check box, the TIBCO WebFOCUS script variable option displays the IBIMR_user parameter, by default. Under the User's Groups check box, the TIBCO WebFOCUS script variable option displays the IBIMR_memberof parameter, by default. You can type over the default values in the TIBCO WebFOCUS script variable options, and type your own values in the HTTP Header Field options.
Note: When configuring the Client to make trusted connections to the Server, you must also enable the Server to accept trusted connections.
Advanced
The Server Node properties from the Advanced pane are explained below.
- Service Name
-
Contains a description for the Server node. This description displays to end users.
- Use HTTPS
-
Enables encrypted communication between the Client and the Server HTTP listener. The default value is off (check box cleared).
This option must be selected if the Server HTTP listener is configured to use SSL. If you are using a self-signed certificate to enable HTTPS communication with a Server, the certificate must be configured in the Java environment where the Client is installed. This enables HTTPS communication between the Server and the Administration Console.
- TLS
-
Enables data encryption when transmitting data over the internet to ensure data privacy. The default value is off (check box cleared).
When selected, the Compression and Encryption options are hidden because TLS encrypts and compresses the data, by default.
- Compression
-
Enables data compression. By default, data compression is disabled.
- Encryption
-
Sets data encryption ability and the symmetric cryptography method used.
Select one of the following options from the drop-down list:
- 0. Off. This is the default value.
- AES. Advanced Encryption Standard. The AES selections
are in the format
CIPHER(x)(-MODE)
where:
- CIPHER
-
Is AES128, AES192, AES256.
- x
-
Is optional and defines an RSA key length of 1024 bits. When this is not specified, the RSA key is 512 bits.
- CBC
-
Is optional and defines the use of Cipher Block Chaining (CBC) mode. When the mode is not specified, Electronic Code Book (ECB) is used.
For example, AES256x-CBC is the AES256 cipher with a 1024-bit RSA key in CBC mode. AES128 is the AES128 cipher with a 512-bit RSA key in ECB mode.
- Connect Limit
-
Specifies the number of seconds that the Client will hold the pending connection. Other possible values are 0 (no wait) and -1 (infinite wait). The default value is -1.
- Maximum Wait
-
Specifies the time, in seconds, that the Client will wait before timeout. You can optionally specify different return times for the first row and other rows. A single number indicates that the return time is valid for any row. If two numbers are separated by a comma, the first number specifies the return time for the first row and the second number specifies the return time for the subsequent rows. The default value is -1, which indicates an infinite wait time.
- Security Object
-
For any security option, an administrator can specify one or more HTTP header names and/or cookie names as follows:
- Cookie. Specify each
HTTP cookie name separated by a comma (,). For example:
cookie_name1, cookie_name2
- Header. Specify each HTTP header name separated by a
comma (,). For example:
header_name1, header_name2
Note:
- HTTP cookie and header names must not contain commas (,) or colons (:). These are reserved delimiters.
- REMOTE_USER is a special type of HTTP header variable whose contents will not be sent to the Server. Therefore, it is not a valid HTTP header value. Instead, specify the WF_REMOTE_USER variable.
- Cookie. Specify each
HTTP cookie name separated by a comma (,). For example:
Basic Cluster Manager Configuration Properties
- Node Name
-
Is the host name or IP address of the server.
- Node Description
-
Optional. The description of the node that appears in the Configuration pane. If this is omitted, the node name will be used.
- Remote CLM Host
-
Is the Host name or IP address of the Cluster Manager on which a remote Cluster Manager (CLM) is listening. If more than one address is specified, one of the addresses will be randomly selected until a successful connection to the CLM happens. The number of IP addresses defined in this setting must be the same as the number of port numbers defined in Remote CLM Port. Separate multiple host names or IP addresses with a comma.
- Remote CLM Port
-
Is the UDP number of the Port on which the Cluster Manger server is listening. The default port is 8200. If more than one port number is specified, the number of port numbers must be the same as the number of IP addresses defined in Remote CLM Host. Separate multiple host names or IP addresses with a comma.
- Security
-
The security options for the Server cluster.
- Prompt for Credentials. The Client makes an explicit connection to the Cluster Manager with the user ID and password specified in the Web Security tab. This is the default value.
- HTTP Basic. The user ID and
password are extracted from the authorization header. These credentials
are then used to make an explicit connection to the Cluster Manager.
You should only select this option when your web tier is performing
Basic Authentication.
Note: You can verify that the authorization header is available in by selecting HTTP Request Info in the Diagnostics tab.
- Kerberos. The Client passes a Kerberos ticket for the user to the Cluster Manager, along with the user ID and group memberships assigned to that user. This option enables an end-to-end single sign on solution from the desktop to the Client, from the Client to the Cluster Manager, and from the Cluster Manager to supported relational DBMS systems. To use Kerberos authentication, the Cluster Manager must run in security OPSYS mode.
- SAP Ticket. The Client passes the user MYSAPSSO cookie, which is created on SAP Enterprise Portal, to the Cluster Manager. The Cluster Manager then validates the cookie using the SAP security API. This option enables single sign on from the Client to a Cluster Manager configured with the Data Adapter for SAP for environments using Open Portal Services in SAP Enterprise Portal.
- Service Account. Allows you to specify
a user ID and password to be used for all connections to the Cluster
Manager.
The service account credentials are encrypted and stored in the SECURITY keyword of the odin.cfg file. When defined, the service account overrides any other credentials that may be presented for this Cluster Manager node, and all users connect to the Cluster Manager using the same credentials. This approach does not make it possible to identify which user is running a given request on the Cluster Manager in Managed Reporting deployments, and therefore is not recommended for them.
- Trusted. Allows you to connect to the Cluster Manager
with only a user ID. This option is useful when no password is available
for the user. Controls should be placed on the Cluster Manager
to ensure that connections from unauthorized clients are rejected.
For example, you can employ the Cluster Manager RESTRICT_TO_IP setting
or configure a network firewall so that only a particular client
can connect to the Cluster Manager.
When you create a new Cluster Manager Configuration, the Trusted option is selected, by default, and the Pass TIBCO WebFOCUS User ID and their Groups, and Custom options appear below it.
When you accept the default option, Pass TIBCO WebFOCUS User ID and their Groups, the Client passes the ID and group memberships assigned to the user to the WebFOCUS Server. When you select the Custom option, additional settings appear and you can customize the user information sent from the Client to the WebFOCUS Server.
Note: When configuring the Client to make trusted connections to the Server, you must also enable the Cluster Manager to accept trusted connections.
Advanced Cluster Manager Configuration Properties
- Use HTTPS
-
Enables encrypted communication between the Client and the HTTP listener.
The default value is off.
This option must be selected if the Cluster Manager HTTP listener is configured to use SSL. If you are using a self-signed certificate to enable HTTPS communication with a Cluster Manager , the certificate must be configured in the Java environment where the WebFOCUS Client is installed. This enables HTTPS communication between the Cluster Manager and the Administration Console.
- Compression
-
Enables data compression. By default, data compression is disabled.
- Encryption
-
Sets data encryption ability and the symmetric cryptography method used.
Select one of the following options from the drop-down list:
- 0. Off. This is the default value.
- AES. Advanced Encryption Standard. The AES selections
are in the format
CIPHER(x)(-MODE)
where:
- CIPHER
-
Is AES128, AES192, AES256.
- x
-
Is optional and defines an RSA key length of 1024 bits. When this is not specified, the RSA key is 512 bits.
- CBC
-
Is optional and defines the use of Cipher Block Chaining (CBC) mode. When the mode is not specified, Electronic Code Book (ECB) is used.
For example, AES256x-CBC is the AES256 cipher with a 1024-bit RSA key in CBC mode. AES128 is the AES128 cipher with a 512-bit RSA key in ECB mode.
- IBCRYPT. User-defined IBCRYPT DLL is loaded.
- Connect Limit
-
Specifies the number of seconds that the Client will hold the pending connection. This is useful in a cluster deployment to avoid a lengthy delay of failover response. Other possible values are 0 (no wait) and -1 (infinite wait). The default value is -1.
- Maximum Wait
-
Specifies the time, in seconds, that the Client will wait before timeout. You can optionally specify different return times for the first row and other rows. A single number indicates the return time is valid for any row. If two numbers are separated by a comma, the first number specifies the return time for the first row and the second number specifies the return time for the subsequent rows. The default value is -1, which indicates an infinite wait time.
- Security Object
-
For any security option, an administrator can specify one or more HTTP header names or cookie names as follows:
- Cookie. Specify each HTTP cookie name separated by a
comma (,). For example:
cookie_name1, cookie_name2
- Header. Specify each HTTP header name separated by a
comma (,). For example:
header_name1, header_name2
Note:
- HTTP cookie and header names must not contain commas (,) or colons (:). These are reserved delimiters.
- REMOTE_USER is a special type of HTTP header variable whose contents will not be sent to the Server. Therefore, it is not a valid HTTP header value. Instead, specify the WF_REMOTE_USER variable.
- Cookie. Specify each HTTP cookie name separated by a
comma (,). For example:
that appears at the top of the Data pane of the Resources panel in the InfoAssist Application Window.