crystal enterprise 8.5 - administrator's guide.pdf

7/21/2019 Crystal Enterprise 8.5 - Administrator's guide.pdf

http://slidepdf.com/reader/full/crystal-enterprise-85-administrators-guidepdf 1/359

Crystal Enterprise™ 8.5Administrator’s Guide

Crystal Decisions, Inc.895 Emerson St.

Palo AltoCalifornia, USA 94301



Copyright © 2002 Crystal Decisions, Inc., 895 Emerson St., Palo Alto, California,USA 94301. All rights reserved.

Issue 1.

No part of this documentation may be stored in a retrieval system, transmitted orreproduced in any way, except in accordance with the terms of the applicablesoftware license agreement. This documentation contains proprietary informationof Crystal Decisions, Inc., and/or its suppliers.

Trademark Acknowledgements

© 2002 Crystal Decisions, Inc. All rights reserved. Crystal Decisions, Crystal,Crystal Reports, Crystal Enterprise, Seagate Info, Seagate Software, Seagate, andthe Seagate and Crystal logos are trademarks or registered trademarks of CrystalDecisions, Inc. and/or Seagate Technology, Inc. All other trademarks referencedare the property of their respective owner.



Crystal Enterprise Administrator’s Guide i

Contents

Chapter 1: Welcome to Crystal Enterprise

What is Crystal Enterprise? ............................................................... 2

Who should use this guide? ............................................................... 2

About this guide ................................................................................ 2

Chapter contents ................................................................................................... 2

Product registration .......................................................................... 5

Crystal Care technical support .......................................................... 6

Document conventions ..................................................................... 6

Chapter 2: Administering Crystal Enterprise

Administration overview ................................................................... 8

Working with the Crystal Management Console ............................... 8

Logging on to the Crystal Management Console .................................................... 9

Navigating within the Crystal Management Console .............................................. 9

Setting console preferences ................................................................................. 10

Logging off of the Crystal Management Console .................................................. 11

Working with the Crystal Configuration Manager .......................... 11

Accessing the CCM for Windows ........................................................................ 11

Accessing the CCM for UNIX .............................................................................. 12

Making initial security settings ........................................................ 13

Setting the Administrator password ...................................................................... 13

Disabling the Sign Up feature .............................................................................. 13

Disabling the Guest account ............................................................................... 14

Modifying the default security levels ................................................................... 14



ii Crystal Enterprise Administrator ’ s Guide

Chapter 3: Crystal Enterprise Security Concepts

Security overview ........................................................................... 16

How Crystal Enterprise authenticates and authorizes ..................... 16

Primary authentication ........................................................................................ 17

Secondary authentication and authorization ........................................................ 18

Security management components ................................................. 19

Web Component Server ...................................................................................... 19

Automated Process Scheduler ............................................................................. 20

Security plug-ins .................................................................................................. 20

Processing extensions .......................................................................................... 24

Active trust relationship .................................................................. 25Logon tokens ....................................................................................................... 25

Ticket mechanism for distributed security ............................................................ 26

Sessions and session tracking .......................................................... 27

WCS session tracking .......................................................................................... 28

APS session tracking ............................................................................................ 28

Environment protection .................................................................. 28

Web browser to web server ................................................................................. 29Web server to Crystal Enterprise .......................................................................... 29

Auditing web activity ...................................................................... 29

Protection against malicious logon attempts ................................... 30

Password restrictions ........................................................................................... 30

Logon restrictions ................................................................................................ 30

User restrictions .................................................................................................. 31

Guest account restrictions ................................................................................... 31

Chapter 4: Managing User Accounts and Groups

What is account management? .......................................................34

Crystal Enterprise default users and groups .................................... 34



Crystal Enterprise Administrator ’ s Guide iii

Default users ....................................................................................................... 34

Default groups .................................................................................................... 35

Default Windows NT group ................................................................................ 36

Available authentication types ........................................................ 36Managing Enterprise and general accounts ..................................... 37

Creating a user account ....................................................................................... 37

Modifying a user account .................................................................................... 39

Deleting a user account ...................................................................................... 39

Changing password settings ................................................................................ 40

Creating a group ................................................................................................. 41

Modifying a group ............................................................................................... 42

Viewing group members ..................................................................................... 42

Deleting a group ................................................................................................. 43

Disabling the Sign Up feature .............................................................................. 43

Disabling the Guest account ............................................................................... 43

Managing NT accounts ................................................................... 44

Working with NT accounts ................................................................................. 44

Mapping NT accounts ......................................................................................... 44

Unmapping NT users and groups ........................................................................ 47Viewing mapped NT users and groups in Crystal Enterprise ................................ 48

Using account aliases for NT ............................................................................... 49

Troubleshooting NT accounts ............................................................................. 51

Setting up NT Single Sign On .............................................................................. 52

Managing LDAP accounts ............................................................... 54

Working with LDAP accounts ............................................................................. 54

Configuring LDAP authentication and mapping LDAP accounts .......................... 54

Unmapping LDAP users and groups .................................................................... 57

Viewing mapped LDAP users and groups in Crystal Enterprise ............................ 58

Changing connection parameters and member groups ........................................ 58

Managing multiple LDAP hosts ........................................................................... 58



iv Crystal Enterprise Administrator ’ s Guide

Using account aliases for LDAP ........................................................................... 59

Troubleshooting LDAP accounts ......................................................................... 61

Chapter 5: Managing Folder ObjectsFolders overview ............................................................................. 64

Creating and deleting folders .......................................................... 64

Creating a new folder .......................................................................................... 64

Creating a new subfolder at any level .................................................................. 65

Deleting folders ................................................................................................... 66

Copying and moving folders ........................................................... 66

Adding a report to a new folder ......................................................67Specifying folder rights ................................................................... 68

Setting limits for folders, users, and groups .................................... 70

Managing User Folders ................................................................... 71

Chapter 6: Publishing Objects to Crystal Enterprise

Publishing overview ........................................................................ 74

Publishing options ............................................................................................... 74Publishing with the Crystal Publishing Wizard ................................ 75

Adding objects/folders ......................................................................................... 76

Adding multiple objects ...................................................................................... 76

Selecting the APS ................................................................................................ 77

Duplicating the folder structure ........................................................................... 78

Creating and selecting a folder on the APS .......................................................... 78

Moving objects between folders .......................................................................... 79

Changing scheduling options .............................................................................. 79

Changing default values ...................................................................................... 80

Changing object properties .................................................................................. 80

Entering database logon information ................................................................... 81



Crystal Enterprise Administrator ’ s Guide v

Setting parameters ............................................................................................... 81

Setting the schedule format ................................................................................. 82

Finalizing the objects to be added ....................................................................... 82

Publishing with the Crystal Management Console .......................... 82Saving objects directly to the APS ................................................... 84

Chapter 7: Importing Objects to Crystal Enterprise

Crystal Import Wizard overview ..................................................... 86

Importing information from Crystal Enterprise ..................................................... 86

Importing information from Seagate Info ............................................................. 88

Importing with the Crystal Import Wizard ...................................... 89Specifying the source and destination environments ............................................ 90

Selecting information to import ........................................................................... 91

Chapter 8: Controlling Users’ Access to Objects

Object rights overview .................................................................... 96

Viewing object rights settings ......................................................... 96

Setting common access levels ......................................................... 98

Setting advanced object rights ...................................................... 100

Base rights and available rights .......................................................................... 102

Using inheritance to your advantage ............................................ 103

Group and folder inheritance ............................................................................ 103

Enabling and disabling inheritance with access levels ....................................... 104

Inheritance with advanced rights ....................................................................... 105

Customizing a ‘top-down’ inheritance model ............................... 108

Creating groups for the tutorials ......................................................................... 109

Setting up an open system of decreasing rights .................................................. 112

Setting up a closed system of increasing rights ................................................... 131



vi Crystal Enterprise Administrator ’ s Guide

Chapter 9: Managing Report Objects and Instances

Report objects and instances overview ......................................... 138

What are report objects and instances? .............................................................. 138

Report object management ........................................................... 139

Publishing a new report object .......................................................................... 139

Copying, moving, or creating a shortcut for a report .......................................... 141

Applying processing extensions to reports ......................................................... 142

Deleting a report object ..................................................................................... 145

Searching for a report ........................................................................................ 146

Managing a report object and its instances ................................... 146

Changing properties of a report and specifying servers for scheduling ............... 147Managing the history of report instances ........................................................... 149

Changing database information ......................................................................... 150

Updating parameters ......................................................................................... 151

Using filters ....................................................................................................... 152

Scheduling a report instance ............................................................................. 153

Scheduling a report with events ......................................................................... 163

Selecting a destination ....................................................................................... 166

Choosing a format ............................................................................................. 173

Setting instance limits for a report object ........................................................... 174

Setting object rights for users and groups ........................................................... 176

Chapter 10: Managing Events

Managing events overview ............................................................ 180

File-based events ........................................................................... 181

Schedule-based events .................................................................. 182Custom events ............................................................................... 184



Crystal Enterprise Administrator ’ s Guide vii

Chapter 11: Crystal Enterprise Architecture

Architecture overview and diagram .............................................. 186

Client tier ...................................................................................... 187

ePortfolio .......................................................................................................... 187

Crystal Management Console ............................................................................ 188

Crystal Configuration Manager .......................................................................... 188

Crystal Publishing Wizard ................................................................................. 188

Crystal Import Wizard ....................................................................................... 188

Crystal Web Wizard .......................................................................................... 189

Intelligence tier ............................................................................. 189

Web Component Server .................................................................................... 189Web Connectors ............................................................................................... 190

Automated Process Scheduler ........................................................................... 190

File Repository Servers ...................................................................................... 191

Event Server ...................................................................................................... 191

Cache Server ..................................................................................................... 192

Processing tier ............................................................................... 192

Job Server .......................................................................................................... 192

Page Server ....................................................................................................... 192

Data tier ........................................................................................ 193

Information Flow .......................................................................... 193

What happens when you view a report? ............................................................ 193

What happens when you schedule a report? ..................................................... 194

Chapter 12: Managing and Configuring Servers

Server management overview ....................................................... 196Viewing current metrics ................................................................ 196

Viewing current server metrics .......................................................................... 197

Viewing system metrics ..................................................................................... 199



viii Crystal Enterprise Administrator ’ s Guide

Viewing and changing the current status of servers ...................... 199

Starting, stopping, and restarting servers ............................................................ 200

Enabling and disabling servers ........................................................................... 201

Printing, copying, and refreshing server status ................................................... 203Configuring the intelligence tier ................................................... 204

Clustering Automated Process Schedulers ......................................................... 204

Copying APS data from one database to another ............................................... 208

Deleting and recreating the APS database ......................................................... 213

Selecting a new or existing APS database .......................................................... 213

Setting root directories and idle times of the File Repository Servers ................. 215

Modifying Cache Server performance settings ................................................... 216

Modifying the polling time of the Event Server .................................................. 218

Modifying logging behavior of the Web Component Server ............................... 218

Modifying report viewing and viewer options .................................................... 219

Configuring the processing tier ..................................................... 221

Modifying Page Server performance settings ...................................................... 221

Modifying the number of jobs per Job Server ..................................................... 222

Setting default scheduling destinations for Job Servers ....................................... 223

Configuring Windows processing servers for your data source .......................... 227Configuring UNIX processing servers for your data source ................................ 229

Logging server activity .................................................................. 234

Advanced server configuration options ......................................... 235

Changing the default server port numbers ......................................................... 235

Configuring Crystal Enterprise on a multihomed machine ................................. 238

Adding and removing Windows server dependencies ....................................... 239

Changing the server startup type ........................................................................ 240

Chapter 13: Scaling Your System

Scalability overview ...................................................................... 242

Choosing between live and saved data .......................................... 242



x Crystal Enterprise Administrator ’ s Guide

Chapter 16: Licensing Information

Licensing overview ........................................................................ 270

Accessing license information ........................................................................... 271

Adding a license key ......................................................................................... 272

Viewing current account activity ....................................................................... 272

Appendix A: Object Rights and Access Levels

Object rights ................................................................................. 274

Access levels ................................................................................. 275

Default rights on the root folder ................................................... 277

Appendix B: UNIX Tools

UNIX tools overview ..................................................................... 280

Script utilities ................................................................................ 280

ccm.sh .............................................................................................................. 280

apsdbsetup.sh .................................................................................................... 283

serverconfig.sh .................................................................................................. 283

sockssetup.sh .................................................................................................... 284

uninstall.sh ........................................................................................................ 285

Script templates ............................................................................ 285

startservers ........................................................................................................ 285

stopservers ........................................................................................................ 285

silentinstall.sh .................................................................................................... 286

Scripts used by Crystal Enterprise ................................................. 286

env.sh ............................................................................................................... 286

initlaunch.sh ..................................................................................................... 286patchlevel.sh ..................................................................................................... 286

postinstall.sh ..................................................................................................... 287

crystalrestart.sh .................................................................................................. 287

setup.sh ............................................................................................................. 287



Crystal Enterprise Administrator ’ s Guide xi

Appendix C: Server Command Lines

Command lines overview .............................................................. 290

Standard options for all servers ..................................................... 290

Automated Process Scheduler ....................................................... 292

Web Component Server ................................................................ 292

Page Server and Cache Server ....................................................... 293

Job Server ..................................................................................... 294

Input and Output File Repository Servers ..................................... 295

Event Server .................................................................................. 295

Appendix D: Troubleshooting path mappings

Path mapping overview ................................................................. 298

Web server virtual directory mappings ......................................... 298

The /crystal virtual directory .............................................................................. 299

The /viewer virtual directory .............................................................................. 299

Web server application mappings ................................................. 300

Configuring application mappings on Windows ................................................ 300Configuring application mappings on UNIX ...................................................... 302

Web Connector virtual path mappings ......................................... 304

Configuring virtual path mappings on Windows ................................................ 305

Configuring virtual path mappings on UNIX ...................................................... 307

Appendix E: General Troubleshooting

Troubleshooting overview ............................................................. 310

Documentation resources ............................................................. 311

Web accessibility issues ................................................................ 311

Using an IIS web site other than the default ....................................................... 311

UNIX Web Connector cannot access WCS on Windows ................................... 312



xii Crystal Enterprise Administrator ’ s Guide

Communication error when accessing the CMC ................................................ 312

Unable to connect to APS when logging on to the CMC .................................... 312

Windows NT authentication cannot log you on ................................................ 313

Reporting viewing and processing issues ....................................... 313Troubleshooting reports and looping database logon prompts ........................... 314

Troubleshooting reports with Crystal Reports ..................................................... 316

Error detected by database driver ...................................................................... 318

Server resources must be available on local drives ............................................ 319

Supporting Crystal Reports 8 web distribution ................................................... 320

Page Server error when viewing a report ........................................................... 320

ePortfolio considerations .............................................................. 321

Supporting ePortfolio users in multiple time zones ............................................ 321

Setting default report destinations ...................................................................... 321

Setting preferences and report viewers for ePortfolio users ................................ 321

ePortfolio and Windows NT Single Sign On ...................................................... 322

Configuring your web farm for load balancing ............................. 322

Glossary ..........................................................................325

Index ..............................................................................335



What is Crystal Enterprise?

2 Crystal Enterprise Administrator ’ s Guide

What is Crystal Enterprise?Crystal Enterprise is a flexible, scalable, and reliable solution for deliveringpowerful, interactive reports to end users via any web application—intranet,extranet, Internet or corporate portal. Whether it is used for distributing weeklysales reports, providing customers with personalized service offerings, orintegrating critical information into corporate portals, Crystal Enterprise deliverstangible benefits that extend across and beyond the organization. As an integratedsuite for reporting, analysis, and information delivery, Crystal Enterprise providesa solution for increasing end-user productivity and reducing administrative efforts.

Who should use this guide?This guide is intended for system administrators who are responsible forconfiguring, managing, and maintaining a Crystal Enterprise installation.

Familiarity with your operating system and your network environment iscertainly beneficial, as is a general understanding of web server management andscripting technologies. However, in catering to all levels of administrativeexperience, this guide aims to provide sufficient background and conceptualinformation to clarify all administrative tasks and features.

For more information about theproduct,consultthe Crystal Enterprise Getting StartedGuide, the Crystal Enterprise Installation Guide, the Crystal Enterprise ePortfolio User’sGuide, and the Crystal Enterprise Web Developer’s Guide. Online versions of theseguides are included in the docdirectory of yourproduct distribution. Once you installCrystal Enterprise, they are also accessible from the Crystal Enterprise Launchpad.

About this guideThis guide provides you with information and procedures covering a wide rangeof administrative tasks. Procedures are provided for common tasks. Conceptualinformation and technical details are provided for all advanced topics.

Chapter contents

The following list provides a short description of each of the remaining chapters inthis guide.

Chapter 2: Administering Crystal EnterpriseThis chapter provides a general description of system administration as it relatesto Crystal Enterprise. It then introduces the administration tools that allow you tomanage and configure Crystal Enterprise, and it shows how to make somecommon changes to the system’s default security settings.



1: Welcome to Crystal Enterprise

Crystal Enterprise Administrator ’ s Guide 3

Chapter 3: Crystal Enterprise Security Concepts

This chapter details the ways in which Crystal Enterprise addresses enterprisesecurity concerns, thereby providing administrators and system architects withanswers to typical questions regarding security.

Chapter 4: Managing User Accounts and Groups

This chapter describes the tasks related to account management for users andgroups. It includes instructions that describe how to add, modify, and removeaccounts within Crystal Enterprise. It also details how to use and integrate NT andLDAP authentication with Crystal Enterprise.

Chapter 5: Managing Folder Objects

This chapter describes basic folder administration tasks and shows how to addfolders and how to change settings, such as object rights and limits, for newfolders.

Chapter 6: Publishing Objects to Crystal Enterprise

This chapter focuses on the publishing process: it introduces the CrystalPublishing Wizard and tells you how you can use it to add Crystal reports andother objects to ePortfolio or to your custom web desktop; it also describesalternative ways of adding objects to the Crystal Enterprise environment.

Chapter 7: Importing Objects to Crystal Enterprise

The Crystal Import Wizard allows you to import information from other SeagateInfo or Crystal Enterprise systems into your new Crystal Enterprise system. Thischapter provides a general overview of the Crystal Import Wizard along with a

series of procedures that lead you through the process of importing information.

Chapter 8: Controlling Users’ Access to Objects

This chapter describes the ways in which object rights enable you to secure thecontent that you publish to Crystal Enterprise. Predefined access levels, advancedrights, and inherited rights are all discussed in detail. Examples and proceduresare provided in the form of tutorials.

Chapter 9: Managing Report Objects and Instances

This chapter describes the management of report objects and instances using theCrystal Management Console. It includes information on scheduling and choosingthe settings for a report object, such as the format, the intended destination, therights settings, and so on.

Chapter 10: Managing Events

This chapter provides information on creating and managing events. It describesfile-based events, custom events, and schedule-based events.



1: Welcome to Crystal Enterprise



This appendix lists the command-line options that control the behavior of eachCrystal Enterprise server.


This appendix describes the ways in which virtual directories, applicationmappings, and virtual paths must be set up between your web server, the WebConnector, and the Web Component Server in order for Crystal Enterprise to workcorrectly.


This appendix provides general troubleshooting steps and solutions to somespecific configuration problems. For up-to-date answers to commonly askedquestions, registered customers can freely download additional technicaldocuments or knowledge base articles from Crystal Care technical support.

Glossary

This section defines some common Crystal Enterprise terminology.

Product registrationThere are several ways you can register your product:

• Fill out the Product Registration form on the Crystal Decisions, Inc. web site at:http://www.crystaldecisions.com/register/

• Print the Product Registration form and fax it to the registration fax numberclosest to you. Crystal Decisions will then fax you a registration number that

can be entered into the product the next time you use it.Registration fax numbers

USA/Canada +1 (604) 681-5147United Kingdom +44 (0) 20 8231 0601Australia +6 2 9955 7682Germany +49 (0) 69 9509 6182Hong Kong +852 2893 2727Singapore +65 777 8786

Registration is required to access online or telephone technical support. Inaddition, registering the product ensures that you are kept up-to-date with

product advancements.



Crystal Care technical support


Crystal Care technical supportTo find out about the technical support programs available for Crystal Enterprise:

• Consult the enclosed Crystal Care information card.

• Go to our support web site at:http://support.crystaldecisions.com/crystalcare/

• Contact your regional office. For details, go to:http://www.crystaldecisions.com/contact/offices.asp

Document conventionsThis guide uses the following conventions:

• Commands and buttons

For easy recognition within procedures, User Interface (UI) features appear in bold type. For example: On the File menu, click New.

• Keyboard shortcuts

Delete means the Delete key, or the Del key on your numeric keypad. Entermeans the Enter, Return, or CR key, depending on which of these keys appearson your keyboard.

• Key combinations

CTRL+KEY, SHIFT+KEY, and ALT+KEY are examples of key combinations.Hold down the first key in the combination and, at the same time, press thesecond key in the combination (designated above as KEY). For example:CTRL+C means hold the Control key down and press the letter C on yourkeyboard (CTRL+C is the Windows Copy command).

• Key terms are italicized when first defined.

• Monospaced font indicates data that you enter using your keyboard. Forexample: In the Formula Editor, type If Sales > 1000 Then crRed

• Monospaced, italicized font indicates variable data that you must replace withdata appropriate to your current settings, environment, or task. For example,in the following URL, you would replace webserverhttp://webserver/crystal/enterprise/




Administering Crystal Enterprise 2

This chapter provides a general description of systemadministration as it relates to Crystal Enterprise. It thenintroduces the administration tools that allow you tomanage and configure Crystal Enterprise, and it showshow to make some common changes to the system’s defaultsecurity settings.



Administration overview


Administration overviewThe regular administrative tasks associated with Crystal Enterprise can be roughlydivided into three major categories: user management, content management, andserver management. The remainder of this guide provides technical and proceduralinformation corresponding to each of these management categories. This chapter briefly introduces new Crystal Enterprise administrators to some of the availablemanagement tools. It also shows you how to make initial security settings, such assetting the password for the system’s default Administrator account.

You will typically use the following applications to manage Crystal Enterprise:

• Crystal Management Console (CMC)

This web application is the most powerful administrative tool provided formanaging a Crystal Enterprise system. It offers you a single interface throughwhich you can perform almost every task related to user management, contentmanagement, and server management.

For an introduction to the CMC, see “Working with the Crystal ManagementConsole” on page 8.

• Crystal Configuration Manager (CCM)

This server administration tool is provided in two forms. In a Windowsenvironment, the CCM allows you to manage local and remote serversthrough itsGraphical User Interface (GUI) or from a command line. In a UNIX environment,the CCM shell script (ccm.sh) allows you to manage servers from a command line.

For an introduction to the CCM, see “Working with the Crystal ConfigurationManager” on page 11.

• Crystal Publishing Wizard

This application allowsyouto publish your reporting content to Crystal Enterprise

quickly. It also allows you to specify a number of options on each report that youpublish. Although this application runs only on Windows,youcanuse it to publishreports to Crystal Enterprise servers that are running on Windows or on UNIX.

For more information on publishing content to Crystal Enterprise, see“Publishing overview” on page 74.

Working with the Crystal Management ConsoleYou will use the Crystal Management Console (CMC) extensively to manage yourCrystal Enterprise system. This tool allows you to perform user management tasks

such as setting up authentication and adding users and groups. And it allows youto publish, organize, and set security levels for all of your Crystal Enterprisecontent. Additionally, the CMC enables you to manage servers and create servergroups. Because the CMC is a web-based application, you can perform all of theseadministrative tasks remotely.

Any user with valid credentials to Crystal Enterprise can log on to the CMC andset his or her preferences. However, users who are not members of the



2: Administering Crystal Enterprise


Administrators group cannot perform any of the available management tasksunless they have been granted rights to do so. For complete details about objectrights, see “Controlling Users’ Access to Objects” on page 95.

Logging on to the Crystal Management ConsoleThere are two ways to access the CMC: type the name of the machine you areaccessing directly into your browser, or select Crystal Launchpad from theprogram group on the Windows Start menu.

To log on to the CMC

1 Go to the following page:

http://webserver/crystal/enterprise/admin/

Replace webserver with the name of the web server machine that has the WebConnector component installed. If you changed this default virtual directory on

the web server, you will need to type your URL accordingly.Tip: On Windows, you canclick Start > Programs > Crystal Enterprise> CrystalLaunchpad, and then click the Crystal Management Console link.

2 When the Log On page appears, select Enterprise in the Authentication Typelist.

Windows NT and LDAP authentication also appear in the list; however, youmust map your third-party user accounts and groups to Crystal Enterprise before you can use these types of authentication.

3 Type your User Name and Password.

For this example, type Administratoras the User Name. This default Enterprise

account does not have a password until you create one. For details, see “Settingthe Administrator password” on page 13.

If you’re using LDAP or Windows NT authentication, you may log on using anaccount that has been mapped to the Crystal Enterprise Administrators group.

4 Click Log On.

The CMC Home page appears.

Navigating within the Crystal Management Console

Because the CMC is a web-based application, you can navigate through its areasand pages in a number of ways:

• Click the links on the Home page to go to specific “management areas.”

• Select the same “management areas” from the drop-down list in the upper-leftcorner of the console. Click Go if your browser doesn’t take you directly to thenew page.

• Click hyperlinks and icons that let you to jump to other areas.



Working with the Crystal Configuration Manager


To connect to servers on a remote machine

1 Once you have started the CCM, you can connect to a remote machine inseveral ways:

• In the Computer Name field, type the name of the machine you want to

connect to; then press Enter.• In the Computer Name field, select a remote machine from the list.

• On the toolbar, click Browse. Select the appropriate computer; then click OK.

2 If prompted, log on to the remote machine with an account holdingadministrative rights.

Note: You may need to type your user name as domain\username.

The CCM lists the servers associated with this machine.

Accessing the CCM for UNIX

Run the CCM on your UNIX server to manage Crystal Enterprise servercomponents that are running on that machine. You can run the CCM remotelythrough a telnet session or locally through a terminal window. To run the CCM,you must have execute permissions on the ccm.sh script and on its parent crystaldirectory.

To run the CCM

1 Go to the crystal directory that was created by the Crystal Enterpriseinstallation:

cd INSTALL_ROOT /crystal

2 Run ccm.sh with command-line options to manage one or more servers.

For instance, the following set of commands starts the Crystal Enterpriseservers and enables each server on its default port:

./ccm.sh -start all

./ccm.sh -enable all

Note: The main options for the CCM are covered in more detail in “UNIXTools” on page 279.

To view additional help on ccm.sh

The ccm.sh script also provides a detailed description of its command-line options.To see the command-line help, issue the following command:

./ccm.sh -help | more



2: Administering Crystal Enterprise


Making initial security settingsThis section focuses on some of the key security settings that you may want tomake immediately, before publishing content and providing users with access toCrystal Enterprise. The list of “Related topics” shows where you can findadditional procedures and information related to security.

Related topics

• For a technical overview of security within Crystal Enterprise, see “CrystalEnterprise Security Concepts” on page 15.

• For procedures on setting up authentication, see “Available authenticationtypes” on page 36.

• For details about object rights, see “Controlling Users’ Access to Objects” onpage 95.

Setting the Administrator passwordAs part of the installation, Crystal Enterprise creates an Administrator account anda Guest account that do not have passwords. Log on to the Crystal ManagementConsole (CMC) with the Administrator account and use the following procedureto create a secure password for the Administrator account.

Note: Do not create a password for the Guest account if you plan to use theanonymous Single Sign On or the Sign Up features available in ePortfolio.

To change the Administrator password

1 Go to the Users management area of the CMC.

2 Click the link for the Administrator account.

3 In the Enterprise Password Settings area, enter and confirm the newpassword.

4 If it is selected, clear the “User must change password at next logon” check box.

5 Click Update.

Disabling the Sign Up feature

When users connect to ePortfolio without specifying a user name and password,the system logs them on automatically under the Guest account. By default, each

user then has the ability to sign up and create a new account on the system. Youhave the option to change this default behavior and to prevent guest users fromcreating their own accounts.



Making initial security settings


To disable the Sign Up feature

1 Go to the Authorization management area of the CMC.

2 Click the Enterprise tab.

3 In the “Guest Account Restrictions” area, clear the “Guest users can createtheir own Enterprise accounts” check box.

4 Click Update.

Disabling the Guest account

By disabling the Guest account, you ensure that no one can log on to CrystalEnterprise with this account. In doing so, you also disable the anonymous SingleSign On functionality of ePortfolio, so users will be unable to access ePortfoliowithout providing a valid user name and password.

To disable the Guest account 1 Go to the Users management area of the CMC.

2 In the Account Name column, click Guest.

3 On the Properties tab, select the Account is disabled check box.

4 Click Update.

5 If you are prompted for confirmation, click OK.

Modifying the default security levels

This procedure shows where you can modify the default object rights that users aregranted to the top-level Crystal Enterprise folder.

Initially, the Everyone group is granted Schedule access to the top-level folder,and the Administrators group is granted Full Control. You can change thesedefault security levels to suit your needs. For a full description of object rights andinheritance patterns, see “Object rights overview” on page 96.

To modify top-level security settings

1 Go to the Settings management area of the CMC.

2 Click the Rights tab.

3 As required, change the entry in the Access Level list for each user or groupthat is displayed.

4 Click Update.

5 Click Add/Remove to grant different levels of security to additional users orgroups.




Crystal Enterprise Security Concepts 3

This chapter details the ways in which Crystal Enterpriseaddresses enterprise security concerns, thereby providingadministrators and system architects with answers totypical questions regarding security.



Security overview


Security overviewThe Crystal Enterprise architecture addresses the many security concerns thataffect today’s businesses and organizations. The current release supports featuressuch as distributed security, Single Sign On (SSO), resource access security,granular object rights, and third-party Windows NT and LDAP authentication inorder to protect against unauthorized access. To allow for further customization of security, Crystal Enterprise supports dynamically loaded processing extensions.And, for monitoring and auditing purposes, Crystal Enterprise allows you to logvarious web statistics, thus enabling you to detect potential security concerns.

Because Crystal Enterprise provides the framework for an increasing number of components fromthe Enterprise family of Crystal products, this chapter details thesecurity features and related functionality to show how the framework itself enforces and maintains security. As such, this chapter does not provide explicitprocedural details; instead, it focuses on conceptual information and provideslinks to key procedures.

Related topics

• For key procedures that show how to modify the default accounts, passwords,and other security settings, see “Making initial security settings” on page 13.

• For procedures that show how to set up authentication, users, and groups, see“Managing User Accounts and Groups” on page 33.

• For procedures that show how to set object rights for your Crystal Enterprisecontent, see “Controlling Users’ Access to Objects” on page 95.

How Crystal Enterprise authenticates and authorizesAuthentication is the process of verifying the identity of a user who attempts toaccess the system, and authorization is the process of verifying that the user has been granted sufficient rights to perform the requested action upon the specifiedobject. This section describes the authentication and authorization processes inorder to provide a general idea of how system security works within CrystalEnterprise. Each of the components and key terms is discussed in greater detaillater in this chapter.

Because Crystal Enterprise is fully customizable, the authentication andauthorization processes may vary from system to system. This section usesePortfolio as a model and describes its default behavior. If you are developing your

own Crystal Enterprise end-user or administrative applications using the CrystalEnterprise Software Development Kit (SDK), you can customize the system’s behavior to meet your needs. For complete details, see the Crystal Enterprise WebDeveloper's Guide.

For procedures that show how to set up the different authentication types, see“Available authentication types” on page 36.



3: Crystal Enterprise Security Concepts


Primary authentication

Primary authentication occurs when a user first attempts to access the system. Theuser provides a user name and password and specifies an authentication type. Theauthentication type may be Enterprise, Windows NT, or LDAP authentication,

depending upon which type(s) you have enabled and set up in the Authorizationmanagement area of the Crystal Management Console (CMC). The user’s web browser sends the information by HTTP to your web server, which routes theinformation through the Web Connector to the Web Component Server (WCS).

Note: All communication between the user’s web browser and the WCS issimilarly routed through the web server and the Web Connector. For clarity, theweb server and the Web Connector are explicitly discussed only when necessary.

The WCSpasses the user’s information to logon.csp and runs the script. Internally,this script communicates with the SDK and, ultimately, the appropriate securityplug-in authenticates the user against the user database.

For instance, if the user specifies Enterprise Authentication, the SDK ensures thatthe Crystal Enterprise security plug-in performs the authentication. The plug-incomponent verifies the user name and password against the system database andnotifies the Automated Process Scheduler (APS) of the results. Alternatively, if theuser specifies Windows NT or LDAP Authentication, the SDK uses thecorresponding security plug-in to authenticate the user. The plug-in verifies theuser name and password against the external user database and notifies the APSof the results.

If the security plug-in reports a successful match of credentials, the APS grants theuser an active identity on the system and the system performs several actions:

• The APS stores the user’s information in memory in an APS session variable.

While active, this session consumes one user license on the system.

• The APS generates and encodes a logon token and sends it to the WCS.

• The WCS stores the user’s information in memory in a WCS session variable.While active, this session stores information that allows Crystal Enterprise torespond to the user’s requests.

Note: If you are familiar with the SDK, you should note that the WCS hereinstantiates the InfoStore object and stores it in the WCS session variable.

• The WCS sends the logon token to the user’s web browser, and the web browser caches the token in a cookie. Until the logon token expires, itsencoded information serves as the user’s valid ticket for the system.

Each of these steps contributes to the distributed security of Crystal Enterprise, because each step consists of storing information that is used for secondaryidentification and authorization purposes. This is the model used in ePortfolio.However, if you are developing your own client application and you prefer not tostore session state on the WCS, you can design your application such that it avoidsusing WCS session variables.



How Crystal Enterprise authenticates and authorizes


Note:

• The third-party Windows NT and LDAP security plug-ins work only once youhave mapped users and groups from the external user database to CrystalEnterprise. For details, see “Available authentication types” on page 36.

• In a Single Sign On situation, users’ credentials are retrieved by other meansand authenticated against the user database automatically. Hence, users arenot prompted for their credentials.

Secondary authentication and authorization

Secondary authentication is the process of double-checking the identity of eachuser who attempts to view, run, schedule, or otherwise act upon an object that ismanaged by Crystal Enterprise. Authorization is the process of verifying that theuser has been granted sufficient rights to perform the requested action upon thespecified object.

When a user attempts to access an object on the system, the web browser sends therequest by HTTP to the WCS. Before fulfilling the user’s request, the WCSperforms a series of security-related steps.

First, the WCS ensures that the user has a valid logon token:

• If there is a valid logon token, the WCS proceeds to its next task.

• If there is no valid logon token, the primary authentication process is repeated.

For more information about logon tokens, see “Logon tokens” on page 25.

Second, the WCS checks internally for an active WCS session that matches theuser’s logon token:

• If the corresponding WCS session variable remains in memory, the WCS

proceeds to its next task.• If the WCS session variable has timed out, the user is logged back on with thelogon token. The SDK authenticates the user against the appropriate userdatabase, and the APS and the WCS recreate the required session variables. Inthis case, Crystal Enterprise does not have to prompt the user for credentials, because the encoded logon token contains the required information.

Third, the WCS ensures that the appropriate server component actually processesthe user’s request:

• If the WCS can process the request itself, it queries the APS database for therights associated with the object that the user requested.

For instance, if the user requests a list of reports in a specific folder, the WCS

queries the APS database for a list of the reports that the user is authorized tosee. The WCS then dynamically lists the reports in an HTML page, and sendsthe page to the user’s browser.





• If a different server component must process the request, the WCS sends therequest and the user’s logon token to the appropriate server component. Thatserver component then queries the APS database for the rights associated withthe object that the user requested.

For instance, if the user attempts to refresh a report’s data, the WCS passes therequest along to the Page Server. The Page Server passes the logon token to theAPS to ensure that the user is authorized to refresh the report.

For details about how the APS calculates a user’s effective rights to an object,see “Calculating a user’s effective rights” on page 106.

This secondary authentication and authorization process begins similarly to initialidentification; here, however, the authentication algorithm followed by the WCSmaintains system security in the fewest number of steps, thereby providing themost efficient response to the user’s initial request.

Note: If the user does not have the right to perform the requested action, the WCSdisplays an appropriate message. For details about setting object rights, see

“Controlling Users’ Access to Objects” on page 95.

Security management componentsSystem security within Crystal Enterprise is distributed across most components, but it is managed primarily by the WCS, the APS, and the security plug-ins. Thesecomponents work together to authenticate and to authorize users who accessCrystal Enterprise, its folders, and its other objects.

This section discusses the key components as they relate to system security.Because they are responsible for additional tasks, several of the components

discussed in this section are described in additional detail in “Crystal EnterpriseArchitecture” on page 185.

Web Component Server

The WCSis the gateway between the web server/Web Connector machine and theremaining Crystal Enterprise components. As such, the WCS receives all HTTPrequests that are sent to Crystal Enterprise from users’ web browsers.

The WCS ensures that each user has a valid logon token for the system. If the logontoken is missing, or if it has expired, the WCS initiates the primary authenticationprocess. For details, see “Primary authentication” on page 17.

The WCS is also responsible for maintaining the user’s session state in the WCSsession variable. This session variable contains information that Crystal Enterpriseuses when fulfilling user’s requests. For details, see “Sessions and sessiontracking” on page 27.



Security management components


Automated Process Scheduler

In relation to system security, the APS performs a number of important tasks. Themajority of these tasks rely upon the database that the APS uses to keep track of Crystal Enterprise system data. This data includes security information, such as

user accounts, group memberships, and object rights that define user and groupprivileges.

When you first set up your system, the APS allows you to create user accounts andgroups within Crystal Enterprise. And, with its third-party security plug-ins, theAPS allows you to reuse existing user accounts and groups that are stored in athird-party system (a Windows NT user database or an LDAP directory server).The APS supports third-party authentication, so users can log on to CrystalEnterprise with their current Windows NT or LDAP credentials.

When users log on, the APS coordinates the authentication process with itssecurity plug-ins; the APS then grants the user a logon token and an active session

on the system. The APS also responds to authorization requests made by the restof the system. When a user requests a list of reports in a particular folder, the APSauthorizes the request only when it has verified that the user’s account or groupmembership provides sufficient privileges.

For details about the APS and how it calculates a user’s effective rights to an object,see “Calculating a user’s effective rights” on page 106.

For more information about the APS and the APS database, see “AutomatedProcess Scheduler” on page 190.

Security plug-ins

Security plug-ins expand and customize the ways in which Crystal Enterpriseauthenticates users. Crystal Enterprise currently ships with the system defaultCrystal Enterprise security plug-in and with the Windows NT and LDAP securityplug-ins. Each security plug-in offers several key benefits.

Security plug-ins facilitate account creation and management by allowing you tomap user accounts and groups from third-party systems into Crystal Enterprise.You can map third-party user accounts or groups to existing Crystal Enterpriseuser accounts or groups, or you can create new Enterprise user accounts or groupsthat corresponds to each mapped entry in the external system.

The security plug-ins dynamically maintain third-party user and group listings.

So, once you map a Windows NT or LDAP group into Crystal Enterprise, all userswho belong to that group can log on to Crystal Enterprise. When you makesubsequent changes to the third-party group membership, you need not update orrefresh the listing in Crystal Enterprise. For instance, if you map a Windows NTgroup to Crystal Enterprise, and then you add a new NT user to the NT group, thesecurity plug-in dynamically creates an alias for that new user when he or she firstlogs on to Crystal Enterprise with valid NT credentials.





Moreover, security plug-ins enable you to assign rights to users and groups in aconsistent manner, because the mapped users and groups are treated as if theywere Enterprise accounts. For example, you might map some user accounts orgroups from Windows NT, and some from an LDAP directory server. Then, whenyou need to assign rights or create new, custom groups within Crystal Enterprise,you make all of your settings in the CMC.

Each security plug-in acts as an authentication provider that verifies user credentialsagainst the appropriate user database. When users log on to Crystal Enterprise,they choose from the available authentication types that you have enabled and setup in the Authorization management area of the CMC: Enterprise (the systemdefault), Windows NT, or LDAP.

Note: The Windows NT security plug-in cannot authenticate users if the CrystalEnterprise server components are running on UNIX.

Crystal Enterprise security plug-in

The Crystal Enterprise security plug-in (secEnterprise.dll) is installed andenabled by default when you install Crystal Enterprise on Windows or on UNIX.This plug-in allows you to create and maintain user accounts and groups withinCrystal Enterprise; it also enables the system to verify all logon requests thatspecify Enterprise Authentication. In this case, user names and passwords areauthenticated against the Crystal Enterprise user list, and users are allowed ordisallowed access to the system based solely on that information. For details onsetting up Enterprise users and groups, see “Managing Enterprise and generalaccounts” on page 37.

Default accounts

When you first install Crystal Enterprise, this plug-in sets up two defaultEnterprise accounts: Administrator and Guest. Neither account has a defaultpassword. For details on setting these passwords, “Making initial securitysettings” on page 13.

Single Sign On

The Crystal Enterprise authentication provider supports anonymous Single SignOn for the Guest account. Thus, when users connect to ePortfolio withoutspecifying a user name and password, the system logs them on automaticallyunder the Guest account. If you assign a secure password to the Guest account, orif you disable the Guest account entirely, you disable this default behavior. For

details, see “Disabling the Guest account” on page 14.

Sign Up

By default, users who are logged on under the Guest account also have the abilityto sign up and create their own, new accounts on the system. To disable this default behavior, see “Disabling the Sign Up feature” on page 13.



Security management components


Windows NT security plug-in

The Windows NT security plug-in (secWindowsNT.dll) allows you to map useraccounts and groups from your Windows NT user database to Crystal Enterprise;it also enables the system to verify all logon requests that specify Windows NT

Authentication. Users are authenticated against the Windows NT user database before the APS grants them an active Crystal Enterprise session. This plug-in iscompatible with NT 4 or Windows 2000 Active Directory user databases. Forinformation on mapping Windows NT users and groups to Crystal Enterprise, see“Managing NT accounts” on page 44.

Once you have mapped your NT users and groups, all of the Crystal Enterpriseclient tools support NT authentication, except for the Crystal Import Wizard. Youcan also create your own applications that support NT authentication. For moreinformation, see the Crystal Enterprise Web Developer’s Guide.

Note: The Windows NT security plug-in cannot authenticate users if the CrystalEnterprise server components are running on UNIX.

Default account

If you install Crystal Enterprise on Windows NT/2000 as an Administrator of thelocal machine, then this plug-in is enabled by default. A new NT group (calledCrystal NT Users) is created on the local machine, and your NT user account isadded to the group. The Crystal NT Users group is then mapped to CrystalEnterprise. The result is that you can log on to Crystal Enterprise with your usualNT user credentials.

Single Sign On

The Windows NT security plug-in supports Single Sign On, thereby allowing

authenticated NT users to log on to Crystal Enterprise without explicitly enteringtheir credentials. The Single Sign On requirements depend upon the way in whichusers access Crystal Enterprise. In both scenarios, the security plug-in’sauthentication provider verifies the credentials against the Windows NT userdatabase before the APS grants the user an active Crystal Enterprise session:

• To obtain NT Single Sign On functionality from a thick-client application (suchas the Crystal Publishing Wizard), the user must be running a Windowsoperating system, and the application must use the Crystal Enterprise SDK.

In this scenario, the Windows NT security plug-in queries the operating systemfor the current user’s credentials.

• To obtain Single Sign On functionality over the Web, the system must use

Microsoft components only. Specifically, the user must be running InternetExplorer on a Windows operating system, and the web server must be runningInternet Information Server (IIS).

In this scenario, Internet Explorer and IIS engage in Windows NT Challenge/Response authentication before IIS forwards the user’s credentials to CrystalEnterprise.





Note: IIS performs the Challenge/Response authentication for every web pageviewed. This can result in severe performance degradation.

For details on configuring IIS for Single Sign On, “Setting up NT Single SignOn” on page 52.

Note: ePortfolio provides its own form of “anonymous Single Sign On,” whichuses Enterprise authentication, as opposed to Windows NT authentication.Design your own web applications accordingly (or modify ePortfolio) if you wantto use NT Single Sign On. For information on NT Single Sign On, see “Setting upNT Single Sign On” on page 52.

LDAP security plug-in

The LDAP security plug-in (secLDAP.dll) allows you to map user accounts andgroups from your LDAP directory server to Crystal Enterprise; it also enables thesystem to verify all logon requests that specify LDAP Authentication. Users areauthenticated against the LDAP directory server before the APS grants them an

active Crystal Enterprise session. User lists and group memberships aredynamically maintained by Crystal Enterprise.

LDAP authentication for Crystal Enterprise is similar to NT authentication in thatyou can map groups and set up authentication, authorization, and alias creation.In addition, you can do the following:

• Implement LDAP authentication when Crystal Enterprise is running onWindows or on UNIX.

• Assign LDAP aliases to existing users if the user names match the Enterpriseuser names.

• Create new Enterprise accounts for existing LDAP users.

• Map users and groups to the LDAP directory service (either manually orautomatically).

• Specify multiple host names and their ports.

For information on mapping your LDAP users and groups to Crystal Enterprise,see “Managing LDAP accounts” on page 54.

Once you have mapped your LDAP users and groups, all of the Crystal Enterpriseclient tools support LDAP authentication, except for the Crystal Import Wizard.You can also create your own applications that support LDAP authentication. Formore information, see the Crystal Enterprise Web Developer’s Guide.

More about LDAP

Lightweight Directory Access Protocol(LDAP),a common, application-independentdirectory, enables users to share information among various applications. Based onan open standard, LDAP provides a means for accessing and updating informationin a directory.



Active trust relationship


Ticket mechanism for distributed security

Enterprise systems dedicated to serving a large number of users typically requiresome form of distributed security. An enterprise system may require distributedsecurity, for instance, to support features such as load balancing, stateless

environments, or transfer of trust (the ability to allow another component to act on behalf of the user).

Crystal Enterprise addresses distributed security by implementing a ticketmechanism (one that is similar to the Kerberos ticket mechanism). The APS grantstickets that authorize components to perform actions on behalf of a particular user.In Crystal Enterprise, the ticket is referred to as the logon token.

This logon token is most commonly used over the Web. When a user is firstauthenticated by Crystal Enterprise, he or she receives a logon token from the APS.The user’s web browser caches this logon token. When the user makes a newrequest, other Crystal Enterprise components can read the logon token from the

user’s web browser.This use of the logon token provides the distributed security that is required forload balancing to be implemented in conjunction with effective fault-protection.For instance, suppose that you are running one web server and two WebComponent Servers, and each of the three components is running on a separatemachine. The Web Connector is installed on the web server, so as to direct allCrystal Enterprise requests to the Web Component Servers. By default, the WebConnector balances all Crystal Enterprise traffic across the two Web ComponentServers: when a user first connects to Crystal Enterprise, the Web Connectorpassesthe logon request to whichever Web Component Server has the most resourcesavailable. If the log on is successful, the user is granted a logon token and an active

identity on the system.The user’s active identity is stored as a session variable on the Web ComponentServer that processed the request; consequently, the user’s active identity is notimmediately accessible by the other Web Component Server. For this reason, theWeb Connector uses the user’s logon token to route all of the user’s requests to theWeb Component Server that is storing the user’s session. By doing so, the WebConnector maintains security while providing optimal performance: the user’sidentity is verified, but the system does not have to repeatedly prompt the user forhis or her credentials; in addition, the user is prevented from unnecessarilyconsuming resources on both Web Component Servers.

If the Web Component Server that is storing the user’s active session is taken

offline, the logon token again serves a critical purpose. If one Web ComponentServer ceases to respond to a user’s requests, ePortfolio and the CMC are designedsuch that the Web Connector is instructed to redirect the request to the remainingWeb Component Server. The client application logs the user on with the validlogon token, and the remaining Web Component Server is able to authenticate theuser and create a new, active session without prompting the user for his or her





credentials. The remaining Web Component Server can then authorize and carryout the user’s request. In this way, the logon token enables the system’s load- balancing and fault-tolerance mechanisms to maintain a secure environmentwithout affecting the user’s experience.

In this scenario, when the original Web Component Server is brought back online,the Web Connector automatically resumes its load-balancing responsibilities byrouting each subsequent request to the least used Web Component Server.

Note: Crystal Enterprise supports implementations of the Secure Sockets Layer(SSL) protocol that rely upon affinity or “sticky connections.” However, in thesescenarios, the Web Connector may be prevented from automatically load balancing across WCS machines.

Sessions and session trackingIn general, a session is a client-server connection that enables the exchange of information between the two computers. A session’s state is a set of data thatdescribes the session’s attributes, its configuration, or its content. When youestablish a client-server connection over the Web, the nature of HTTP limits theduration of each session to a single page of information; thus, your web browserretains the state of each session in memory only for as long as any single Web pageis displayed. As soon as you move from one web page to another, the state of thefirst session is discarded and replaced with the state of the next session.Consequently, Web sites and Web applications must somehow store the state of one session if they need to reuse its information in another.

Crystal Enterprise uses two common methods to store session state: cookies andsession variables. A cookie is a small text file that stores session state on the clientside: the user’s web browser caches the cookie for later use. The Crystal Enterpriselogon token is an example of this method. A session variable is a portion of memorythat stores session state on the server side. When Crystal Enterprise grants a useran active identity on the system, information such as the user’s authentication typeis stored in a session variable. So long as the session is maintained, the systemneither has to prompt the user for the information a second time nor has to repeatany task that is necessary for the completion of the next request.

Ideally, the system should preserve the session variable while the user is active onthe system. And, to ensure security and to minimize resource usage, the systemshould destroy the session variable as soon as the user has finished working on thesystem. However, because the interaction between a web browser and a webserver can be stateless, it can be difficult to know when users leave the system, if they do not log off explicitly. To address this issue, Crystal Enterprise implementssession tracking.



Environment protection


WCS session tracking

The WCS implements session tracking similarly to most web servers. The server-side script pages (Crystal Server Pages) programmatically save variables to theWCS session. By default, the WCS retains the session until the user explicitly logs

off, or until 20 minutes after the user’s last request (whichever occurs first).

Note:

• If you are familiar with the SDK, you should note that a WCS session is aninstance of an InfoStore object.

• The WCS session timeout can be programmatically configured in the server-side .csp pages to timeout earlier if the default of 20 minutes is not desired.

APS session tracking

The APS implements a simple tracking algorithm. When a user logs on, he or sheis granted an APS session, which the APS preserves until the user logs off, or untilthe WCS session variable is released.

The WCS session is designed to notify the APS on a recurring basis that it is stillactive, so the APS session is retained so long as the WCS session exists. If the WCSsession fails to communicate with the APS for a ten-minute time period, the APSdestroys the APS session. This handles scenarios where client-side componentsshut down irregularly.

Note: If you are familiar with the SDK, you should note that an APS session is aninstance of an EnterpriseSession object.

Environment protectionEnvironment protection refers to the security of the overall environment in whichclient and server components communicate. Although the Internet and web-basedsystems are increasingly popular due to their flexibility and range of functionality,they operate in an environment that can be difficult to secure. When you deployCrystal Enterprise, environment protection is divided into two areas of communication:

• Web browser to web server

• Web server to Crystal Enterprise





Web browser to web server

When sensitive data is transmitted between the web browser and the web server,some degree of security is usually required. Relevant security measures usuallyinvolve two general tasks:

• Ensuring that the communication of data is secure.

• Ensuring that only valid users retrieve information from the web server.

These tasks are typically handled by web servers through various securitymechanisms, including the Secure Sockets Layer (SSL) protocol, Windows NTChallenge/Response authentication, and other such mechanisms.

You must secure communication between the web browser and the web serverindependently of Crystal Enterprise. For details on securing client connections,refer to your web server documentation.

Web server to Crystal Enterprise

Firewalls are commonly used to secure the area of communication between theweb server and the rest of the corporate intranet (including Crystal Enterprise).Crystal Enterprise supports firewalls that use IP filtering, static network addresstranslation (NAT), or SOCKS proxy servers, and it supports a multitude of configurations. Supported environments can involve multiple firewalls, webservers, or Web Component Servers.

For complete details on Crystal Enterprise and firewall interaction, see “Workingwith Firewalls” on page 259.

Auditing web activityCrystalEnterprise provides insight into your system by recording web activity andallowing you to inspect and to monitor the details. The WCS allows you to selectthe web attributes—such as time, date, IP address, port number, and so on—thatyou want to record. The auditing data is logged to disk and stored in comma-delimited text files, so you can easily report off the data or import it into otherapplications. For more information, see “Modifying logging behavior of the WebComponent Server” on page 218.



Protection against malicious logon attempts


Protection against malicious logon attemptsNo matter how secure a system is, there is often at least one location that isvulnerable to attack: the location where users connect to the system. It is nearlyimpossible to protect this location completely, because the process of simplyguessing a valid user name and password remains a viable way to attempt to“crack” the system.

Crystal Enterprise implements several techniques to reduce the probability of amalicious user achieving access to the system. The various restrictions listed belowapply only to Enterprise accounts—that is, the restrictions do not apply to accountsthat you have mapped to an external user database (Windows NT or LDAP).Generally, however, your external system will enable you to place similarrestrictions on the external accounts.

Password restrictions

Password restrictions ensure that Enterprise users create passwords that arerelatively complex. You can enable the following options:

• Enforce mixed-case passwords

This option ensures that passwords contain at least two of the followingcharacter classes: upper case letters, lower case letters, numbers, or punctuation.

• Must contain at least N characters

By enforcing a minimum complexity for passwords, you decrease a malicioususer’s chances of simply guessing a valid user’s password.

Logon restrictions

Logon restrictions serve primarily to prevent dictionary attacks (a methodwhereby a malicious user obtains a valid user name and attempts to learn thecorresponding password by trying every word in a dictionary). With the speed of modern hardware, malicious programs can guess millions of passwords perminute. To prevent dictionary attacks, Crystal Enterprise has an internalmechanism that enforces a time delay (0.5–1.0 second) between logon attempts. Inaddition, Crystal Enterprise provides several customizable options that you canuse to reduce the risk of a dictionary attack:

• Disable accounts after N failed attempts to log on

• Reset failed logon count after N minute(s)

• Re-enable account after N minute(s)





User restrictions

User restrictions ensure that Enterprise users create new passwords on a regular basis. You can enable the following options:

• Must change password every N day(s)

• Cannot reuse the N most recent password(s)

• Must wait N minute(s) to change password

These options are useful in a number of ways. Firstly, any malicious userattempting a dictionary attack will have to recommence every time passwordschange. And, because password changes are based on each user’s first logon time,the malicious user cannot easily determine when any particular password willchange. Additionally, even if a malicious user does guess or otherwise obtainanother user’s credentials, they are valid only for a limited time.

Guest account restrictions

By default, users who are logged on under the Guest account also have the abilityto sign up and create their own, new accounts on the system. The Guest accountrestrictions allow you to disable this default behavior. For details, see “Disablingthe Sign Up feature” on page 13.

The Crystal Enterprise authentication provider supports anonymous Single SignOn for the Guest account. Thus, when users connect to ePortfolio withoutspecifying a user name and password, the system logs them on automaticallyunder the Guest account. If you assign a secure password to the Guest account, orif you disable the Guest account entirely, you disable this default behavior. Fordetails, see “Disabling the Guest account” on page 14.



What is account management?


What is account management?Account management can be thought of as all of the tasks related to creating,mapping, changing, and organizing user and group information. The Users andGroups management areas of the Crystal Management Console (CMC) provideyou with a central place to perform all of these tasks.

In the Users area, you can specify everything required for a user to access CrystalEnterprise. To create user accounts, specify the following:

• account name (required)

• full name

• description

• password settings

• connection type

• group membership

In the Groups area, you can create groups that give a number of people access tothe report or folder. This enables you to make changes in one place instead of modifying each user account individually. To create groups, specify the following:

• group name (required)

• description

• users who belong to the group

• subgroups that belong to the group

• group membership

After the user accounts and groups have been created, you can add report objectsand specify rights to them. When the users log on, they can view the reports usingePortfolio or their custom web application. For more information on objects and

rights, see “Object rights overview” on page 96.

Crystal Enterprise default users and groupsThis section lists and describes the different types of default users and groups thatare found within Crystal Enterprise. Users are members of a group or groups—their rights are determined by which group or groups they are associated with(and also by their user rights).

Default users

There are two default users included with Crystal Enterprise: Administrator andGuest. These users and any new users (created or mapped users) are members of a group or groups. For procedures on managing users, see “Managing Enterpriseand general accounts” on page 37.



4: Managing User Accounts and Groups


Administrator

The Administrator user belongs to the Administrators and Everyone groups. Thisuser is able to perform all of the tasks in all of the Crystal Enterprise applications(for example, the Crystal Management Console, Crystal Configuration Manager,

Crystal Publishing Wizard, and ePortfolio). By default, the administrator is notassigned a password. To assign a password, see “Setting the Administratorpassword” on page 13.

Guest

The Guest user is a member of the Everyone group. This user can view reports thatare found within the Report Samples folder. Generally, the Guest user accessesreports through ePortfolio. This account is enabled by default. To disable thisdefault setting, see “Disabling the Guest account” on page 43.

Note: If users in multiple time zones use the Guest account, see “SupportingePortfolio users in multiple time zones” on page 321.

Default groupsThere are three default groups created in Crystal Enterprise: Administrators,Everyone, and New Sign-Up Accounts. In addition to organizing users andsimplifying administration, groups enable you to determine the functionality auser has access to. For procedures on managing groups, see “Managing Enterpriseand general accounts” on page 37.

Administrators

Users who belong to the Administrators group are able to perform all tasks in all

of the Crystal Enterprise applications (Crystal Management Console, CrystalConfiguration Manager, Crystal Publishing Wizard, and ePortfolio).

Note: To use the Crystal Configuration Manager, you may be required to haveadditional rights on the local machine. For more information, see “Working withthe Crystal Configuration Manager” on page 11.

Everyone

Each user is a member of the Everyone group by default. Users are able to accessall of the Crystal Enterprise applications. By default, the Everyone group allowsaccess to all the reports that are found in the Report Samples folder.

New Sign-Up AccountsUsers who belong to the New Sign-up Accounts group have created their ownaccounts through the sign-up feature in ePortfolio. See “Disabling the Sign Upfeature” on page 43 if you would like to disable this sign-up feature in ePortfolio.

By default, members of this group are able to view reports specified by theadministrator and perform report and folder tasks. The purpose of this group is to



Available authentication types


enable automatic tracking of users who have signed themselves up through thesign-up feature in ePortfolio.

Note: Members of the New Sign-Up Accounts group also belong to the Everyonegroup. If you restrict access to the New Sign-Up accounts group, ensure that the

change is also made for the Everyone group. You can also restrict access byspecifying the Advanced rights for the New Sign-Up Accounts group. For moreinformation on rights, see “Setting advanced object rights” on page 100.

Default Windows NT groupWhen you install Crystal Enterprise on Windows NT/2000, by default, CrystalEnterprise creates a Crystal NT Users group—this group is also added to WindowsNT/2000.

Crystal NT Users

When NT authentication is enabled, Crystal NT Users can use their NT accounts to

log on to Crystal Enterprise. By default, members of this group are able to viewfolders and reports.

Available authentication typesBefore setting up user accounts and groups within Crystal Enterprise, decidewhich of the three authentication types you want to use:

• Enterprise authentication

Use the system default Enterprise Authentication if you prefer to create distinctaccounts and groups for use with Crystal Enterprise, or if you have notalready setup a hierarchy of users and groups in a Windows NT user database or an LDAP

directory server. See “Managing Enterprise and general accounts” on page 37.• Windows NT authentication

If you are working in a Windows NT environment (Windows NT/2000), youcan use existing NT user accounts and groups in Crystal Enterprise. When youmap NT accounts to Crystal Enterprise, users are able to log on to ePortfoliowith their NT user name and password. This eliminates the need to recreateindividual user and group accounts within Crystal Enterprise. For moreinformation, see “Managing NT accounts” on page 44.

• LDAP authentication

If you set up an LDAP directory server, you can use existing LDAP useraccounts and groups in Crystal Enterprise. When you map LDAP accounts to

Crystal Enterprise, users are able to access ePortfolio with their LDAP username and password. This eliminates the need to recreate individual user andgroup accounts within Crystal Enterprise. For more information, see“Managing LDAP accounts” on page 54.

Note: You can use Enterprise Authentication in conjunction with either NT orLDAP authentication, or both.





Managing Enterprise and general accountsSince Enterprise authentication is the default authentication method for CrystalEnterprise, it is automatically enabled when you first install Crystal Enterprise.When you add and manage users and groups, Crystal Enterprise maintains theuser and group information within its database.

This section focuses on the following account management tasks:

• “Creating a user account” on page 37

• “Modifying a user account” on page 39

• “Deleting a user account” on page 39

• “Changing password settings” on page 40

• “Creating a group” on page 41

• “Modifying a group” on page 42

• “Viewing group members” on page 42

• “Deleting a group” on page 43

• “Disabling the Sign Up feature” on page 43

• “Disabling the Guest account” on page 43

Note: In many cases, these procedures also apply to NT and LDAP accountmanagement. For specific information on NT authentication, see “Managing NTaccounts” on page 44. For specific information on LDAP authentication, see“Managing LDAP accounts” on page 54.

Creating a user account

When you create a new user, you specify the user’s properties and select the groupor groups for the user.

To create a user account

Creating a user account is made up of two processes: defining the propertyinformation, and adding the user to a group or groups.

Defining the property information


2 Click New User.

3 On the Properties tab, type the account name, full name, and descriptioninformation.

Use the description area to include extra information about the user or account.



Managing Enterprise and general accounts


4 Specify the password information and settings. Options include:

• Password

Enter the password and confirm. This is the initial password that youassign to the user. The maximum password length is 64 characters.

• Password never expiresSelect the check box.

• User must change password at next logon

This check box is selected by default. If you do not want to force users tochange the password the first time they log on, clear the check box.

• User cannot change password

Select the check box.

5 Select the connection type.

• Concurrent User

Choose Concurrent user if this user belongs to a license agreement that

states the number of users allowed to be connected at one time.• Named User

Choose Named user if this user belongs to a license agreement thatassociates a specific user with a license. Named user licenses are useful forpeople who require access to Crystal Enterprise regardless of the number of other people who are currently connected.

6 Click OK.

Adding the user to groups

1 Click the Member of tab to specify the group or groups the user should belong to.

Note: By default, all Crystal Enterprise users of the system are part of theEveryone group.

2 Click the Member of button to view the available groups.

3 In the Available groups area, select the group(s) that the new user should be amember of.

Use SHIFT+click or CTRL+click to select multiple groups.

4 Click the > arrow to add the group(s); click the < arrow to remove the group(s).

5 Click OK.

The“Member of” tab appears and liststhe groups in which the user is a member.





Modifying a user account

Use this procedure to modify a user’s properties or group membership.

Note: The user will be affected if he or she is logged on when you are making the

change.

To modify a user account


2 Under Account Name, click the link to the user whose properties you want tochange.

3 Make the required changes, as necessary, in the available fields.

In addition to all of the options that were available when you initially createdthe account, you now can disable the account by selecting the “Account isdisabled” check box. You can also assign aliases—for more information, see

“Using account aliases for NT” on page 49 and “Using account aliases forLDAP” on page 59.

4 Click Update.

Deleting a user account

Use this procedure to delete a user’s account. The user might receive an error if they are logged on when their account is deleted.

To delete a user account

Use the delete function to remove the account permanently. If you think the user

might require access to the account again in the future, select the “Account isdisabled” check box in the Properties page of the selected user. For proceduralinformation, see “Modifying a user account” on page 39.


2 Select the check box associated with the user you want to delete.

3 Click Delete.

The delete confirmation dialog box appears.

4 Click OK.

The user account is deleted.

Note: If your implementation supports the sign-up feature, users who have hadtheir accounts deleted are able to create a new account for themselves inePortfolio.





Creating a group

Groups are collections of users who share the same account privileges. Forinstance, you may create groups that are based on department, role, or location.Groups enable you to make changes in one place (a group) instead of modifying

each user account individually. Also, you can assign object rights to a group orgroups. For information on object rights, see “Report object management” onpage 139.

After creating a new group, you can add users, add subgroups, or specify groupmembership so that the new group is actually a subgroup. Because subgroupsprovide you with additional levels of organization, they are useful when you setobject rights to control users’ access to your Crystal Enterprise content.

To create a new group

1 Go to the Groups management area of the CMC.

2 Click New Group.

3 On the Properties tab, enter the group name and description.

4 Click OK.

Adding users

1 Click the Users tab.

2 Click Add/Remove Users.

3 Select the users to add to the group; then click the > arrow.

Tip:

• To select multiple users, use the SHIFT+click or CTRL+click combination.• To search for a specific user, use the Look For field.

• If there are many users on your system, click the Previous and Next buttonsto navigate through the list of users.

4 Click OK.

The Users tab appears.

It lists all of the users who belong to this group.

Adding subgroups

1 Click the Subgroups tab.

2 Click Add/Remove Subgroups.

3 Select the groups that should be members of this new group; then click the >

arrow.

4 Click OK.



Managing Enterprise and general accounts


Specifying group membership

1 Click the Member of tab.

2 Click the Member of button.

3 Select the parent groups that this new group will be a member of; then clickthe > arrow.

Any rights associated with the parent group will be inherited by the new groupyou have created.

4 Click OK.

Modifying a group

You can modify a group by making changes to any of the settings.

Note: The users who belong to the group will be affected by the modification if they are logged on when you are making changes.

To modify a group


2 Under the Group Name column, click the link to the group whoseconfiguration you want to change.

3 Make the necessary changes in one of the four tabs:

• Properties

• Users

• Subgroups

• Member of 4 Depending on which tab you have selected, click OK or Update after you have

made your changes.

Viewing group members

You can use this procedure to view the users who belong to a specific group.

To view group members


2 Under Group Name, click the desired group.

3 Click Users.

4 Click Refresh.

It may take a few minutes for your list to refresh if you have a large number of users in the group or if your group is mapped to an NT user database or LDAPuser directory.





Deleting a group

You can delete a group when that group is no longer required.

Note: The users who belong to the group will be affected by the change if they are

logged on when the group is deleted.

To delete a group


2 Select the check box associated with the group you want to delete.

3 Click Delete.

The delete confirmation dialog box appears.

4 Click OK.

Disabling the Sign Up featureWhen users connect to ePortfolio without specifying a user name and password, thesystem logs them on automatically under theGuest account.By default, each userthencan sign up and create a new account on the system. You have the option to changethis default behavior and to prevent guest users from creating their own accounts.

To disable the Sign Up feature


2 Click the Enterprise tab.

3 In the “Guest Account Restrictions” area, clear the “Guest” users can create

their own Enterprise accounts check box.4 Click Update.

Disabling the Guest account

By disabling the Guest account, you ensure that no one can log on to CrystalEnterprise with this account. By disabling the Guest account, you also disable theanonymous Single Sign On functionality of ePortfolio, so users will be unable toaccess ePortfolio without providing a valid user name and password.

To disable the Guest account


2 In the Account Name column, click Guest.

3 On the Properties tab, select the Account is disabled check box.

4 Click Update.

5 If you are prompted for confirmation, click OK.





3 From the User menu, click Properties.

4 Click Add.

5 Select the group(s) and/or user(s); then click Add.

6 Click OK to add the group(s) and/or user(s).7 Click OK to complete the process.

Tip: Users will now be able tolog on toePortfolio using their NT account if theyuse the following format:

\\NTDomainName\NTusername or

\\NTMachineName\LocalUserName

Users do not have to specify the NT Domain Name if it is specified in the“Default NT Domain” field on the Windows NT tab.

To map NT users and groups using Windows 2000

1 From the Windows Administrative Tools program group, click ComputerManagement.

2 Under System Tools, select Local Users and Groups.

3 Click the Groups folder.

4 Select the Crystal NT Users and from the Action menu, select Properties.

5 Click Add.

6 Select the group(s) and/or user(s); then click Add.

7 Click OK to add the group(s) and/or user(s).

8 Click OK or Apply (and then Close) to complete the process.

Tip: Users will now be able tolog on toePortfolio using their NT account if theyuse the following format:

\\NTDomainName\NTusername or

\\NTMachineName\LocalUserName

Users do not have to specify the NT Domain Name if it is specified in the“Default NT Domain” field on the Windows NT tab.

To map NT users and groups using Crystal Enterprise

Before starting this procedure, ensure you have the NT domain and groupinformation.


2 Click the Windows NT tab.



Managing NT accounts


To unmap NT users and groups using Crystal Enterprise



3 In the Mapped NT Member Groups area, select the NT group you would liketo remove.

4 Click Delete.

5 Click Update.

The user or group will not be able to access Crystal Enterprise.

Tip: To deny NT Authentication for all groups, clear the “NT Authentication isenabled” check box and click Update.

Note: The only exceptions to this occur when a user has an alias to an Enterpriseaccount, or if your implementation allows users to create their own accountsthrough the sign-up feature. To restrict access, disable or delete the user’sEnterprise account and disable the ability for guests to add users anonymously. Formore information, see “Managing Enterprise and general accounts” on page 37.

Viewing mapped NT users and groups in Crystal EnterpriseThere are two methods to view mapped users and groups in Crystal Enterprise.The method you use depends on the way the groups and users have been mapped.

To view users and groups that have been added using Windows NT/ 2000 or Crystal Enterprise


2 If you added users and groups through Windows NT/2000, then click CrystalNT Users.

If youadded users and groups through the CMC, then selectthe appropriate group.

3 Click the Users tab.

4 Click OK to the message which states that accessing the user list may takeseveral seconds.

5 Click Refresh User List.

6 Click OK.

To view users and groups that have been added using Crystal Enterprise



The “Mapped NT Member Groups” area displays the groups that have beenmapped to Crystal Enterprise.

Note: You can view the groups and users by selecting the appropriate groupfrom the Groups management area and then clicking the Users tab.





Using account aliases for NT

If a user has multiple accounts in Crystal Enterprise, you can link them using theassign alias feature. This is useful when you are aware of a user who has an NTaccount mapped to Enterprise and an Enterprise account. By using an alias, the

user is able to use either an NT user name and password or an Enterprise username and password to log on. Thus, an alias enables a user to log on via more thanone authentication type.

You can also reassign an alias in Crystal Enterprise. For example, when you mapyour NT accounts to Crystal Enterprise, if an alias is auto-mapped incorrectly, youcan use the Reassign Alias feature to update the mapped account information. Thisoccurs when the NT user name is different from the Enterprise account user name;that is, if a user has the name “Test User 1” in NT and the name “1234 User Test” inCrystal Enterprise, the auto-mapping feature (when you map your NT account toCrystal Enterprise) will not assign “Test User 1” the “1234 User Test” alias. Thisscenario only occurs when you choose the “Assign each added NT alias to an

account with the same name” option when you map your NT accounts to CrystalEnterprise.

This section describes how to assign an NT alias, reassign an NT alias, and viewalias information.

To assign an NT alias


2 Select the user you want to create an alias for.

3 Click the Assign Alias button.

4 Select the appropriate NT alias or aliases.

5 Click the > arrow.

Tip:

• To select multiple users, use the SHIFT+click or CTRL+click combination.

• To search for a specific user, use the Look For field.


6 Click OK.

Note: If the user you choose from the Available aliases list has only oneassigned alias, you will receive a message asking you to confirm that you wish

to continue. By continuing, the user’s account will be deleted.The Properties tab appears with thenew alias listed. By default, NT, LDAP, andEnterprise authentication methods are available.





To reassign an NT alias


2 Select the user whose alias you would like to change.

3 Click the Reassign Alias button.Note: If there is only one alias for the user, you will receive a message askingyou to confirm that you wish to continue.

4 Click either Assign the Alias to a new user or select an existing user.

Note:

• If you choose to assign the alias to a different user, and the original userhad only one NT alias and does not have an Enterprise alias, the user’soriginal favorites folder will be deleted. As a result, the user will not be ableto access any reports that used to be in the original favorites folder.

• When you assign an alias, you are moving an alias to the current user;when you reassign an alias, you are moving the alias away from thecurrent user.

Tip:




5 Click OK.

To view alias information

1 In the Account Management area, click Users.

2 Select the user whose alias information you would like to view.

The bottom portion of the properties page contains the alias information. A usercan have any combination of Crystal Enterprise aliases, NT aliases, or LDAPaliases. A Crystal Enterprise alias is generated when a new account is created.An NT alias is created when users are mapped from NT to Crystal Enterprise.Users will have both a Crystal Enterprise alias and an NT alias when their NTaccounts have been assigned to a Crystal Enterprise user.





Troubleshooting NT accounts

Creating a new NT user account

• If you create a new NT user account, and the account does not belong to a

group account that is mapped to Crystal Enterprise, add it to CrystalEnterprise. For more information, see “Mapping NT accounts” on page 44.

• If you create a new NT user account, and the account belongs to a groupaccount that is mapped to Crystal Enterprise, refresh the user list. For moreinformation, see “Viewing mapped NT users and groups in CrystalEnterprise” on page 48.

Creating a new NT group account

• If you create a new NT group account, and the group account does not belongto a group account that is mapped to Crystal Enterprise, add it to CrystalEnterprise. For more information, see “Mapping NT accounts” on page 44.

• If you create a new NT group account, and the account belongs to a groupaccount that is mapped to Crystal Enterprise, refresh the group list. For moreinformation, see “Viewing mapped NT users and groups in CrystalEnterprise” on page 48.

Disabling an NT user account

• If you disable an NT user account, and that NT user account is mapped toCrystal Enterprise, the user will not be able to log on to Crystal Enterprise,except via Enterprise authentication.

Disabling an NT group account• If you disable an NT group account, and that NT group account is mapped to

Crystal Enterprise, the users who belong to that group will not be able to logon to Crystal Enterprise, except via Enterprise authentication.





Setting up NT Single Sign On

You can configure Crystal Enterprise to allow users to use various CrystalEnterprise applications without being prompted to log on. Users need only to entertheir NT user name and password information once at the beginning of the NT

session. For instance, if you have set up NT Single Sign On, when you launch theCMC, NT authentication occurs in the background. You are not required to enterany additional information.

Note: This feature is available if you are using a Microsoft Internet InformationServer (IIS) web server and users are using Internet Explorer as their web browser. See the Platforms.txt file included with your product distribution for acomplete list of version requirements.

ePortfolio provides its own form of “anonymous Single Sign On,” which usesEnterprise authentication, as opposed to Windows NT authentication. Designyour own web applications accordingly (or modify ePortfolio) if you want to use

NT Single Sign On. By default, when a user launches ePortfolio, he or she will beautomatically logged on using the Guest account (Enterprise authentication). Youcan disable this feature—for more information, see “Disabling the Sign Upfeature” on page 43. However, even when you disable the Sign Up feature,ePortfolio is designed to display a logon page. With Single Sign On enabled, theuser can select Windows NT from the Authentication list and click Log On withoutentering his or her user name or password. In the Crystal Enterprise Web Developer’sGuide, refer to lesson 2 of the tutorial for an example on creating a web applicationthat uses Single Sign On.

Setting up NT Single Sign On involves two processes:

• Configuring the IIS web server

Using the documentation included with your IIS server, change the access andauthentication settings for the Enterprise virtual directory. Disable the settingsfor allowing “Anonymous access” and “Basic authentication” options. Ensurethat the setting for Windows NT Challenge/Response (also referred to asIntegrated Windows authentication) is enabled.

Note: Crystal Enterprise does not support the Kerberos protocol.

• Configuring the Web Component Server

Use the Crystal Configuration Manager (CCM) to configure the WebComponent Server.





To configure the Web Component Server using the CCM

1 From the Crystal Enterprise program group, click Crystal ConfigurationManager.

Note: To use the CCM, you must have NT administrator rights on the local

machine. If you are managing servers on a remote machine, you must alsohave NT administrator rights on the machine you are connecting to.Depending on the configuration of your network, you might be prompted toenter a user name and password.

2 Select the Crystal Web Component Server; then click the Stop button.

3 Either double-click the Crystal Web Component Server or right-click theCrystal Web Component Server and select Properties.

4 Click the Configuration tab.

5 Select the Use Windows NT Integrated security (NT Challenge/Response)check box.

6 Click OK.

7 Restart the Web Component Server by selecting the Crystal Web Component

Server and then clicking the Start button.



Managing LDAP accounts


Managing LDAP accountsSince Enterprise authentication is the default authentication method for CrystalEnterprise, it is automatically enabled when you first install Crystal Enterprise.When you add and manageusers and groups, CrystalEnterprise maintains the userand group information within its database. To use LDAP authentication, you needto first ensure that you have your respective LDAP directory set up. For moreinformation about LDAP, refer to your LDAPdocumentation. Formore informationon the LDAP security plug-in, see “LDAP security plug-in” on page 23.

Note: When you install Crystal Enterprise, the LDAP authentication plug-in isinstalled automatically, but not enabled by default.

Working with LDAP accounts

This section describes tasks related to LDAP accounts in Crystal Enterprise. Inparticular, it includes information on:

• “Configuring LDAP authentication and mapping LDAP accounts” on page 54

• “Unmapping LDAP users and groups” on page 57

• “Viewing mapped LDAP users and groups in Crystal Enterprise” on page 58

• “Changing connection parameters and member groups” on page 58

• “Managing multiple LDAP hosts” on page 58

• “Using account aliases for LDAP” on page 59

• “Troubleshooting LDAP accounts” on page 61

Configuring LDAP authentication and mapping LDAP accounts

To simplify administration, Crystal Enterprise supports LDAP authentication foruser and group accounts. Before users can use their LDAP user name andpassword to log on to ePortfolio, you need to map their LDAP account to CrystalEnterprise. When you map an LDAP account, you can choose to create a newCrystal Enterprise account or link to an existing Crystal Enterprise account.

Before setting up and enabling LDAP authentication, ensure that you have yourLDAP directory set up. For more information, refer to your LDAP documentation.

To set up LDAP authentication using Crystal Enterprise


2 Click the LDAP tab.





5 In the “LDAP Hosts” area, type your LDAP host and port information in theAdd LDAP host (hostname:port) field (for example, “myserver:123”); thenclick Add.

You can add more than one LDAP host of the same server type by repeating this

step. If you want toremove a host, highlight the host name and click Delete. Formore information on multiple hosts, refer to “Managing multiple LDAP hosts”on page 58.

6 In the “LDAP Server Administration Credentials” area, enter thedistinguished name in the Distinguished Name field and the appropriatepassword in the Password field.

If your LDAP Server allows querying and comparing for anonymous users,leave this area blank—Crystal Enterprise servers and clients will bind to theprimary host via anonymous logon.

7 Enter another distinguished name and password in the “LDAP ReferralCredentials” area if all of the following apply:

• The primary host has been configured to refer to another directory serverthat handles queries for entries under a specified base.

• The host being referred to has been configured to not allow querying andcomparing for anonymous users.

• A group from the host being referred to will be mapped to CrystalEnterprise.

Although groups can be mapped from multiple hosts, only one set of referralcredentials can be set.

8 Enter the number of referral hops in the Maximum Referral Hops field.

If this field is set to zero, no referrals will be followed.

9 In the Base LDAP Distinguished Name field, type the distinguished name(for example, o=SomeBase).

Note: If you are setting up LDAP authentication for the first time, before youadd any groups, you must click Update before you can continue to the nextstep. This updates Crystal Enterprise with the LDAP host and base name.

10 In the “Mapped LDAP Member Groups” area, specify your LDAP group(either by common name or distinguished name) in the Add LDAP group (by

cn or dn) field; click Add.

You can add more than one LDAP group by repeating this step. To remove agroup, highlight the LDAP group and click Delete.





Using account aliases for LDAP

If a user has multiple accounts in Crystal Enterprise, you can link them using theassign alias feature. This is useful when you are aware of a user who has an LDAPaccount mapped to Enterprise and an Enterprise account. The user is able to use

either an LDAP user name and password or an Enterprise user name andpassword to log on. Thus, an alias enables a user to log on via more than oneauthentication type.

You can also reassign an alias in Crystal Enterprise. For example, when you mapyour LDAP accounts to Crystal Enterprise, if an alias is auto-mapped incorrectly,you can use the Reassign Alias feature to update the mapped account information.This occurs when the LDAP user name is different from the Enterprise accountuser name; that is, if a user has the name “Test User 1” in LDAP and the name“1234 User Test” in Crystal Enterprise, the auto-mapping feature (when you mapyour LDAP account to Crystal Enterprise) will not assign “Test User 1” the “1234User Test” alias. This scenario only occurs when you choose the “Assign each

added LDAP alias to an account with the same name” option when you map yourLDAP accounts to Crystal Enterprise.

This section describes how to assign an LDAP alias, reassign an LDAP alias, andview alias information.

To assign an LDAP alias


2 Select the user you want to create an alias for.

3 Click Assign Alias.

4 Select the appropriate LDAP alias or aliases.

5 Click the > arrow.

Tip:




6 Click OK.

Note: If the user you choose from the Available aliases list has only oneassigned alias, you will receive a message asking you to confirm that you wish

to continue. By continuing, the user’s account will be deleted.The Properties tab appears with the new alias listed. By default, LDAP, NT, andEnterprise authentication methods are available.



Folders overview


Folders overviewFoldersprovide you withthe ability to organize and facilitate content administration.They are useful when there are a number of reports that a department or arearequires frequent access to, because you can set object rights and limits once, at thefolder level, rather than setting them for each report or object within the folder.

By default, new objects that you add to a folder inherit the object rights that arespecified for the folder.

Creating and deleting foldersThere are several ways to create new folders in Crystal Enterprise. In the CrystalManagement Console (CMC), go to the Folders management area to create newfolders and to add subfolders to the existing hierarchy of folder objects.

Tip: When you publish local directories and subdirectories of reports with theCrystal Publishing Wizard, you can duplicate your local directory structure on theCrystal Enterprise system. This method provides you with an efficient way of creating multiple folders and subfolders at the same time. For details, see“Publishing with the Crystal Publishing Wizard” on page 75.

Creating a new folder

This procedure shows how to create a new folder at the top of your folderhierarchy. Folders created in this way are, in effect, subfolders of the top-level (orroot) Crystal Enterprise folder.

1 Go to the Folders management area of the CMC.2 Click New Folder.

3 On the Properties tab, type the name and description of the new folder.

This example creates a new Marketing folder:



5: Managing Folder Objects


4 Click OK.

The new folder is added to the system, and its Properties tab is refreshed. Youcan now use the Reports, Subfolders, Limits, and Rights tabs to add objects andto change settings for this folder.

Creating a new subfolder at any level

1 Go to the Folders management area of the CMC.

The initial level of folders is displayed.

2 In the Title column, click the link to the folder where you want to add asubfolder.

3 Click the Subfolders tab.

Tip: You can browse through existing subfolders to add a new folder elsewherein the folder hierarchy. When you have found the right parent folder, go to itsSubfolders tab.

The Subfolders tab appears.

4 Click New Folder.

5 On the Properties tab, type the name and description of the new folder.

6 Click OK.





4 Select the action to perform:

• Copy to: Makes a copy of the folder.

• Move to: Moves the folder.

5 Select the Destination folder from the list.

Tip: If there are many folders on your system, use the “Look for” field to search,or click Previous, Next, and Show Subfolders to browse the folder hierarchy.

6 Click OK.

The folder you selected is copied or moved, as requested, to the new destination.

Adding a report to a new folder

You can add reports individually to any folder in a number of ways. Follow thisprocedure to add a report to a new folder that you have just created. For completeinformation on publishing reports and other objects, see “Publishing overview” onpage 74.

To add a report to a new folder

1 Once you’ve created the new folder, click its Reports tab.





To specify rights for a new folder

1 Once you’ve created the new folder, click its Rights tab.

2 Click Add/Remove to add groups or users to this folder.

The Add/Remove page appears.

3 In the Select Operation list, select Add/Remove Groups, Add Users, orRemove Users.

The page is refreshed and displays options that depend upon whether you areworking with users or with groups. The example above shows the options thatare available when you are working with groups.

4 Select the user/group whose rights you want to specify and click the arrows tospecify whether the user/group does or does not have access to this folder.

Tip: If you have many users and groups on your system, use the “Look for”field to search for a particular account.

5 Click OK.

You are returned to the Rights tab.

6 Change the Access Level for each user or group, as required.

Note: For complete details on the predefined access levels and advancedrights, see “Object rights overview” on page 96.

7 Click Update.





In this example, two settings have been combined to keep a maximum of 50instances of any object in the folder, and to keep a maximum of 25 instances that belong to any member of the Administrators group.

Managing User FoldersCrystal Enterprise creates a folder for each user on the system. These folders areorganized within the CMC as User Folders. By default, there are User Folders forthe Administrator and Guest accounts. When you log on to the CMC and view thelist of User Folders, you will see only those folders to which you have View access(or greater).

Within ePortfolio, these folders are referred to as the Favorites folders. When auser logs on to ePortfolio, he or she is redirected immediately to his or herFavorites folder. (Users can change this default behavior my modifying theirPreferences in ePortfolio.)

To view the User Folders


2 Click the User Folders link.

3 If it is not already displayed, click the Subfolders tab.

A list of subfolders appears. Each subfolder corresponds to a user account onthe system. Unless you have View access (or greater) to a subfolder, it will notappear in the list.




Publishing Objects to Crystal Enterprise 6

This chapter focuses on the publishing process: itintroduces the Crystal Publishing Wizard and tells youhow you can use it to add Crystal reports and other objectsto ePortfolio or to your custom web desktop; it alsodescribes alternative ways of adding objects to the CrystalEnterprise environment.



Publishing overview


Publishing overviewPublishing is the process of adding objects such as Crystal reports to the CrystalEnterprise environment and making them available to authorized users. Theobjects that you publish may be individual reports created with Crystal Reports,analytical applications designed with Crystal Analysis, other objects that you’vecreated using Crystal Enterprise plug-in components, or directories containingmultiple objects.

When you publish an object to Crystal Enterprise,an entry is made in the AutomatedProcess Scheduler (APS) database. The File Repository Server stores the new object below the \Enterprise\FileStore\Input\data\ directory. When a user schedules aninstance of any object, Crystal Enterprise checks the APS database for the location of the object file; the appropriate server component then retrieves and processes theobject file from the File Repository. The processed instance is stored by the FileRepository Server below the \Enterprise\FileStore\Output\data\ directory.

You can publish objects to Crystal Enterprise in three ways:• Use the Crystal Publishing Wizard when you:

• Have access to the locally installed application.

• Are adding multiple objects or an entire directory.

For details, see “Publishing with the Crystal Publishing Wizard” on page 75.

• Use the Crystal Management Console (CMC) when you are:

• Publishing a single object.

• Taking care of other administrative tasks.

• Performing tasks remotely.

For details, see “Publishing with the Crystal Management Console” on page 82.

• Save directly to your Enterprise folders when you are:• Designing reports with Crystal Reports.

• Creating other objects with Crystal Enterprise plug-in components such asCrystal Analysis.

For details, see “Saving objects directly to the APS” on page 84.

Note: Crystal Enterprise supports reports created in versions 6 through 8.5 of Crystal Reports. Reports will appear in version 8 format when they are launchedfrom Crystal Enterprise.

Publishing options

During the publishing process, you specify how often the data in the report isupdated. You can choose to force usersto see specific instances based on a schedulethat you determine (recurring), or you can choose to let users set the schedulethemselves (on demand).



6: Publishing Objects to Crystal Enterprise


Moving objects between folders

1 Move objects to the desired folders by selecting each object and then clickingMove Up or Move Down.

You can also add and delete folders by selecting a parent folder and clicking theNew Folder or Delete Folder buttons. You can drag-and-drop objects to placethem where you want. And you can right-click objects to rename them.

By default, objects are displayed using their titles. You can display the objects’local file names by clicking the “Show file names” button.

2 Click Next when you are finished.The Schedule Interval dialog box appears.

Changing scheduling options

The data in reports added to ePortfolio or your custom web desktop can berefreshed at intervals you select.

1 Select one of three intervals:

• Run once only

Selecting the “Run once only” option provides two more sets of options:

• when finished this wizard

This option runs the report once when you’ve finished publishing it. Thereport is not refreshed again until you reschedule it.

• at the specified date and time

This option runs the report once at a date and time you specify. The reportis not refreshed again until you reschedule it.



Publishing with the Crystal Publishing Wizard


• Let users update the object

This option does not schedule the report. Instead, it leaves the task of scheduling up to the user.

• Run on a recurring schedule

Once you have selected this option, click the Set Recurrence button to setthe scheduling options.

The “Pick a recurrence schedule” dialog box appears.

The options in this dialog box allow you to choose when and how often thereport runs. Select the appropriate options and click the OK button.

2 Click Next after the schedule has been set.

The Change Default Values dialog box appears.

Changing default values

You can choose to publish objects without changing any of the default properties,

or you can go through the remaining screens and make changes.

Note: If you use the default values, your object may not schedule properly if thedatabase logon information is not correct, or if the parameter values are invalid.

If you want to publish objects without making modifications:

1 Select Publish reports without modifying properties.

2 Click Next through the wizard’s remaining dialog boxes.

If you want to review or modify objects before publishing:

1 Select Review or modify report properties.

2 Click Next.The Review Report Properties dialog box appears.

Changing object properties

1 Select the object you want to modify.

2 Enter a new title or description.

3 Select the Generate thumbnail image check box if you want users of ePortfolio to see a thumbnail of the object before they open it.

Tip: The“Generate thumbnail image” check box is available only if the report was

saved appropriately. To display thumbnails for a report, you must save the reportwith data and select the “Save preview picture” check box in Crystal Reports. Tolocatethis check box in CrystalReports 8.x, open a report and click Summary Infoon the File menu. The “Save Data with Report” option is also on the File menu.

4 Click Next.

The Database Logon Information dialog box appears if it is needed.





Entering database logon information

Some objects use data sources that require logon information. If objects you areadding are of this type, follow these steps.

1 Double-click the object, or click + to the left of the object to expose the database.

2 Select the database and change the logon information in the appropriate fields.

If the database does not require a user name or password, leave the fields blank.

Note: Enter user name and password information carefully. If it is enteredincorrectly, the object cannot retrieve data from the database.

3 Select the Apply this information to all reports check box if you have anumber of objects requiring logon to the same database.

4 Once you have completed the logon information for each object using adifferent database, click Next.

The Set Report Parameters dialog box appears if it is needed.

Setting parameters

Some objects contain parameters for data selection. Before such an object can bescheduled, you must set the parameters in order to determine the default prompts.

1 Select the object whose prompts you want to change.The object’s prompts and default values appear in a list on the right-hand sideof the screen.

2 Click Edit Prompt to change the value of a prompt.

Depending on the type of parameter you have chosen, different dialog boxesappear.



Publishing with the Crystal Management Console


3 If you want to set the prompts to contain a null value (where possible), thenclick Set Prompts to NULL.

4 Click Next after you have finished editing the prompts for each object.

Setting the schedule formatYou can choose a schedule format for each report that you publish. For some of theformats, you can customize the schedule format options.

1 Select the object whose schedule format you want to change.

2 Select a format from the list (Crystal Report, Excel, Word, and so on).

Where applicable, customize the schedule format options. For example, if youselect Paginated Text, enter the number of lines per page.

3 Click Next.

The final dialog box appears.

Finalizing the objects to be added

1 After ensuring all the objects have been added to the list, click Next.

The objects are added to the APS, scheduled, and run as specified. When theprocessing is done, you arereturned to the finalscreen of the Crystal PublishingWizard.

2 To view the details for an object, select it from the list.

3 Click Finish to close the wizard.

Publishing with the Crystal Management ConsoleIf you have administrative rights to Crystal Enterprise, you can publish objectsover the Web from within the CMC.

To add an object with the CMC

1 Go to the Objects management area of the CMC.

2 Click New Report.





The New Report page appears.

3 In the File name field, type the full path to the report.

If you do not know the path, click Browse to perform a search.

4 If you do not want the user to see a thumbnail preview of the report inePortfolio, clear the “Generate thumbnail for the report” check box.

Tip: To display thumbnails for a report, you must save the report with data andselect the “Save preview picture” check box in Crystal Reports. To locate this

check box in Crystal Reports 8.x, open a report and click Summary Info on theFile menu. The “Save Data with Report” option is also on the File menu.

5 Ensure that the correct folder name appears in the Destination field.

Tip: To expand a folder, select it and click Show Subfolders.

6 Click OK.

When the object has been added to the system, the CMC displays the Propertiesscreen. If necessary, you can now modify the object’s properties, such as its titleand description, the database logon information, scheduling information, userrights, and so on.



Saving objects directly to the APS


Saving objects directly to the APSIf you have installed one of the Crystal designer components, such as CrystalReports or Crystal Analysis, you can use the Save As command to add objects toCrystal Enterprise from within the designer itself.

For instance, after designing a report in Crystal Reports, click Save As on the Filemenu. In the Save As dialog box, click Enterprise Folders; then, when prompted,log on to the Crystal Enterprise Automated Process Scheduler (APS). Specify thefolder where you want to save the report and click Save.




Importing Objects to Crystal Enterprise 7

The Crystal Import Wizard allows you to importinformation from other Seagate Info or Crystal Enterprisesystems into your new Crystal Enterprise system. Thischapter provides a general overview of the Crystal ImportWizard along with a series of procedures that lead youthrough the process of importing information.



7: Importing Objects to Crystal Enterprise


User licensing can affect the behavior of the Crystal Import Wizard. If the sourceenvironment uses Concurrent licensing, the wizard imports all users as ConcurrentUsers. However, if the source environment uses Named User licensing, the wizardfirst checks the number of Named User license keys in the destination environment.If there are enough Named User licenses in the destination environment,the wizardimports all users as Named Users. If there are not enough Named User licenses inthe destination environment, the wizard imports all users as Concurrent Users. Formore information about licensing, see “Licensing overview” on page 270.

Folders

Folders are imported, whether or not they exist already in the destinationenvironment. However, so as not to overwrite existing folders, the Crystal ImportWizard appends a number to the end of any duplicated folder names to indicatethe number of copies. For example, if you import a folder called Sales Reportswhen a folder called Sales Reports already exists, then the imported folder isadded to Crystal Enterprise with the name Sales Reports(2).

Report objects

The Crystal Import Wizard can import Crystal report objects only if they are basedon native drivers, ODBC data sources, or OLAP data sources. You have the choiceto import the report instances for each report object, and the scheduling patternsthat you have set up in the source environment are imported automatically.

Supported reports are always imported with their parent folders, whether or notthey exist already in the destination environment. However, so as not to overwriteexisting folders, the Crystal Import Wizard appends a number to the end of anyduplicated folder names to indicate the number of copies.

Rights

When you importfolders and reports from one Crystal Enterprise system to another,the associated object rights are imported for every user or group who is imported atthe same time. If the user or group is not imported at the same time, the object rightsare discarded. For instance, suppose that you import a report that explicitly grantsView On Demand rights to the Everyone group in the sourceenvironment—but youdo not import the Everyone group. In this case, the newly imported report in thedestination environment will not grant the same explicit rights to the Everyonegroup. Instead, the report inherits any rights that have been set on its parent folder.

If you do import the appropriate user or group, and it already exists by name inthe destination environment, then the corresponding object rights are importedand applied to the existing user or group. For instance, modifying the exampleabove, suppose that you import the report and the Everyone group. In this case, theCrystal Import Wizard imports the object rights along with the report. So thenewly imported report in the destination environment will explicitly grant theView On Demand right to the Everyone group.



Crystal Import Wizard overview


Events and server groups

When you use the Crystal Import Wizard to import information from anotherCrystal Enterprise 8.5 system, you have the additional option to import events andserver groups from the source environment.

Importing information from Seagate Info

The following sections describe what happens to objects that have been importedfrom Seagate Info to Crystal Enterprise. Generally, if the Seagate Info object is of atype that is supported within Crystal Enterprise, and if the Seagate Info object willnot overwrite an object that is already in the Crystal Enterprise system, then theCrystal Import Wizard imports the object.

Note: Users who are accessing your Seagate Info implementation when you areimporting objects to Crystal Enterprise might experience a delay.

Users and groupsThe Crystal Import Wizard imports users and groups and their hierarchicalrelationships as they exist in Seagate Info. A user or group is added to CrystalEnterprise only if it does not exist already by name.

If you import a group that already exists in Crystal Enterprise, the list of groupmembers is updated with additional users who were members of the Seagate Infogroup. These additional users are added to Crystal Enterprise if their accounts donot exist already.

User licensing can affect the behavior of the Crystal Import Wizard. If the sourceenvironment uses Concurrent licensing, the wizard imports all users as

Concurrent Users. However, if the source environment uses Named Userlicensing, the wizard first checks the number of Named User license keys in thedestination environment. If there are enough Named User licenses in thedestination environment, the wizard imports all users as Named Users. If there arenot enough Named User licenses in the destination environment, the wizardimports all users as Concurrent Users. For more information about licensing, see“Licensing overview” on page 270.

Folders

Folders are imported, whether or not they exist already in Crystal Enterprise.However, so as not to overwrite existing folders, the Crystal Import Wizard

appends a number to the end of any duplicated folder names to indicate thenumber of copies. For example, if you import a folder called Sales Reports, whena folder called Sales Reports already exists in Crystal Enterprise, then the importedfolder is added to Crystal Enterprise with the name Sales Reports(2).





Report objects

The Crystal Import Wizard can import Crystal report objects only if they are basedon native drivers, ODBC data sources, or OLAP data sources.

Supported reports are always imported with their parent folders, whether or notthey exist already in the destination environment. However, so as not to overwriteexisting folders, the Crystal Import Wizard appends a number to the end of anyduplicated folder names to indicate the number of copies.

Rights

Crystal Enterprise enforces security through object rights, which differ from theuser rights used within Seagate Info. Consequently, the Crystal Import Wizarddoes not import any of the folder security that is set up within the Seagate Infoenvironment.

If you transfer reports from Seagate Info to Crystal Enterprise, the rights associated

with the report are not transferred, only the ownership. If the owner of a report isthe Administrators group, the Administrators group will have Full Control accessto it. If the owner of the reportis not an administrator, the report will be transferredand the View On Demand access mode will be associated with the report.

Other objects

The Crystal Import Wizard cannot import Seagate Info objects that are notsupported by Crystal Enterprise. Such objects include report packages, queryobjects, Info cubes, Open OLAP cubes, Holos Applications, Crystal reports basedon query files, and Crystal reports based on Info Views.

The Crystal Import Wizard does not import existing instances or existing scheduleinformation from Seagate Info systems. Any scheduled jobs, such as recurringinstances, will need to be rescheduled in Crystal Enterprise.

Importing with the Crystal Import WizardThe Crystal Import Wizard is made up of a series of screens that guide you throughthe process of importing user accounts, groups, folders, and reports. The screensthat appear depend upon the types of information that you choose to import.

When you import information, you first connect to the Automated ProcessScheduler (APS) of your existing installation (the source environment) and specify

the APS of your new Crystal Enterprise system (the destination environment). Youthen select the information that you want to import, and the Crystal Import Wizardcopies the requested information from the source to the destination.

Before starting this procedure, ensure you have the Administrator accountcredentials for both the source and the destination environment.





6 Click Next.

The “Specify destination environment” dialog box appears.

7 In the APS Name field, type the name of the destination environment’s CrystalAPS.

8 Type the User Name and Password of an Enterprise account that provides youwith administrative rights to the Crystal Enterprise system; then click Next.

The “Choose objects to import” dialog box appears. Proceed to “Selectinginformation to import” on page 91.

Selecting information to import

This procedure shows how to select the users, groups, folders, and reports that youwant to import. If you have not already started the Crystal Import Wizard, see“Specifying the source and destination environments” on page 90.

1 In the “Choose objects to import” dialog box, select the check box (or boxes)corresponding to the information you want to import:

• Import users and user groups

• Import folders and objects

Tip: If the source environment is Crystal Enterprise 8.5, you can also import

events and server groups.2 Click Next.

3 If you chose to import users and user groups, the “Select Users and Groups”dialog box appears. In the Groups list, select the groups that you want toimport. In the Subgroups and Users list, select specific members of any group.Then click Next.





5 When the “Information collection complete” dialog box appears, click Finishto begin importing the information.

The Import Progress dialog box displays status information and creates anImport Summary while the Crystal Import Wizard completes its tasks.

6 If the Import Summary shows that some information was not importedsuccessfully, click View Detail Log for a description of the problem.Otherwise, click Done.

Note: The information that appears in the Detail Log is also written to a textfile called ImportWiz.log, which you will find in the directory from which theCrystal Import Wizard was run. By default, this directory is:

C:\Program Files\Crystal Decisions\Enterprise\win32_x86\



Importing with the Crystal Import Wizard





Controlling Users’ Access to Objects 8

This chapter describes the ways in which object rightsenable you to secure the content that you publish to CrystalEnterprise. Predefined access levels, advanced rights, andinherited rights are all discussed in detail. Examples andprocedures are provided in the form of tutorials.



Object rights overview


Object rights overviewObject rights are the base units for controlling users’ access to folders, reports, andother objects within Crystal Enterprise. When granted, each right provides a useror group with permission to perform a particular action on an object. For anyobject, you can set security levels that affect individual users or entire groups.

To set object rights within the Crystal Management Console (CMC), you first locatethe object, and then you specify the rights for different users and groups. Eachobject right can be Explicitly Granted, Explicitly Denied, or Not Specified. TheCrystal Enterprise object security model is designed such that, if a right is left “notspecified,” the right is denied by default. Additionally, if contradictory settingsresult in a right being both granted and denied to a user or group, the right isdenied by default. This “denial based” design assists in ensuring that users andgroups do not automatically acquire rights that are not explicitly granted.

To facilitate administration and maintenance, Crystal Enterprise includes a set of

predefined access levels that allow you to set common security levels quickly. Eachaccess level grants a set of rights that combine to allow users to accomplishcommon tasks (such as view reports, schedule reports, and so on). It isrecommended that you use the predefined access levels whenever possible, because they can greatly reduce the complexity of your object security model. Formore information, see “Setting common access levels” on page 98.

Whether or not you use access levels, you can also take advantage of theinheritance patterns recognized by Crystal Enterprise: users can inherit rights asthe result of group membership; subgroups can inherit rights from parent groups;and both users and groups can inherit rights from parent folders. When you needto disable inheritance or to customize security levels for particular objects, users,

or groups, the Advanced Rights pages allow you to choose from the complete setof available object rights. Most importantly, the advanced object rights allow youto explicitly deny any user or group the right to perform a particular task.

Tip: For detailed tutorials that walk you through sample implementations of objectrights, see “Customizing a ‘top-down’ inheritance model” on page 108.

Viewing object rights settingsUse the CMC to view the object rights that a user or group has to any folder, report,or other Crystal Enterprise object. This section shows how to locate the rights for

any object and briefly explains the information displayed on the Rights tab.You can locate any given object in several ways. Go to the Folders managementarea in the CMC to browse your folder hierarchy for an object, or go to the Objectsmanagement area in the CMC to view a list of all the objects on the system.



8: Controlling Users’ Access to Objects


Click the link that corresponds to the folder or other object whose rights you wantto see, then click the object’s Rights tab. A page similar to the following appears:

This example shows the rights for the Report Samples folder. The Name columnlists all users and groups who have been given rights to the object. The Objectcolumn shows whether the entry is a User or a Group. In this case, users have not been specified individually; instead, users have been divided into two groups—

Everyone and Administrators—which have been granted rights to the folderobject. Click Add/Remove to add or remove a user or group to this object.

The Access Level column shows how each user’s or group’s rights are determined.In this example, both groups possess Inherited Rights. You can change the rightsfor either group by selecting a predefined access level (or by selecting Advanced)from the list in the Access Level column. When you change an entry in the AccessLevel column, click Update to effect your changes. For more information, see“Setting common access levels” on page 98.

The Net Access column displays the net effect of whatever is selected in the AccessLevel column. That is, the Net Access column shows the effective rights that eachuser or group has to the object. The Net Access column is particularly useful when

you are working with inheritance. In this example, the Everyone group inheritsrights from a parent folder—one that is not displayed on this screen. The NetAccess column shows that the rights inherited from the parent folder areequivalent to the View On Demand access level.

Tip: If you want to view the individual object rights that make up a user’s (orgroup’s) Net Access, click the corresponding Access Level list and select Advanced.The Advanced Rights page displays the user’s full array of object rights that have been specified explicitly and/or inherited. Click Cancel to exit without makingchanges. For more information, see “Setting advanced object rights” on page 100.

For detailed tutorials that walk you through sample implementations of object

rights, see “Customizing a ‘top-down’ inheritance model” on page 108.



Setting common access levels


Setting common access levelsAn access level is essentially a predefined set of object rights. Crystal Enterpriseprovides a set of access levels that allow you to set common object security levelsquickly. The available access levels are No Access, View, Schedule, View OnDemand, and Full Control. Access levels are based on a model of increasing rights: beginning with No Access and ending with Full Control, each access level buildsupon the rights granted by the previous level. For example, the Schedule accesslevel includes and adds to the rights that are granted by the View access level. Fora complete listing of the object rights that make up each access level, see “Accesslevels” on page 275.

Tip: By default, users or groups who have rights to a folder will inherit the samerights for any object that you subsequently publish to that folder. Consequently,the best strategy is to set the appropriate rights for users and groups at the folderlevel first. Then publish objects to that folder.

Although access levels grant predefined sets of object rights, they do not explicitlydeny any object rights. Instead, each access level grants some rights and leaves theother rights “not specified.” The system then denies the “not specified” rights bydefault. This is important, because it allows users to inherit the greatest rightswhen they belong to multiple groups:

• When you assign an access level to a group, each user in the group will have atleast that level of access to the object. If the user is a member of multiple groups,then he or she inherits the combination of each group’s rights. Thus, when a useris a member of multiple groups, he or she inherits the greatest possible rights.

• When you assign an access level directly to a user, you ensure that the user hasonly that level of access to the object. In other words, you prevent the user

from inheriting rights that he or she may have otherwise acquired by virtue of group membership.

This list provides a brief description of each access level:

• No Access

The user or group is not able to access the object or folder. ePortfolio, the CrystalPublishing Wizard, and the CMC enforce this right by ensuring that the objectis not visible to the user.

• View

If this access level is set at the folder level, the user or group is able to view thefolder, the objects contained within the folder, and all generated instances of each object. If this access level is set at the object level, the user can view the

object, the history of the object, and all generated instances of the object. Theuser cannot, however, schedule the object or refresh it against its data source.

• Schedule

The user or group is able to view the object or folder and its contents, and togenerate instances by scheduling the object to run against the specified datasource once or on a recurring basis. The user or group can view, delete, and





pause the scheduling of instances that they own. They can also schedule todifferent formats and destinations, set parameters and database logoninformation, pick servers to process jobs, add contents to the folder, and copythe object or folder.

• View On Demand

In addition to the rights provided by the Schedule access level, the user gainsthe right to refresh data “on demand” against the data source.

• Full Control

This access level grants all of the available advanced rights. It is the only accesslevel that allows users to delete objects (folders, objects, and instances). Thisaccess level also allows users to modify all of the object’s properties, includingthe object rights that are set on the folder or object.

Basically, this access level is designed to provide a user or group withadministrative control over one or more folders or objects. Users can then logon to the CMC and add, edit, and remove content as required, without being

members of the actual Administrators group.• Advanced

This access level does not include a predefined set of object rights. Instead, itallows you to customize a user’s or group’s access to an object by selecting fromthe completerange of available object rights. For more information, see “Settingadvanced object rights” on page 100.

For a detailed listing of the object rights that make up each access level, see “ObjectRights and Access Levels” on page 273.

Note: In the Crystal Enterprise Web Developer’s Guide, access levels are referred toas roles.

To set an access level for a user or group

1 Go to the Objects or Folders management area of the CMC.

2 Locate the object whose rights you want to modify.

3 Click the link to the object, and then click its Rights tab.

4 In the Name column, locate the user or group whose rights you want tospecify.

If the user or group is not listed, click Add/Remove. Add the appropriate useror group and click OK. You are returned to the object’s Rights tab.

5 In the Access Level column, select the access level (No Access, View, Schedule,

View On Demand, or Full Control) that is appropriate for the user or group.

6 Click Update.

Tip: For detailed tutorials that walk you through sample implementations of objectrights, see “Customizing a ‘top-down’ inheritance model” on page 108.



Setting advanced object rights


Setting advanced object rightsTo provide you with full control over object security, the CMC allows you to makeAdvanced object rights settings for any user or group. These Advanced settingsenable you to choose from a complete set of granular object rights. The result is anincreased flexibility as you define security levels for objects that you havepublished to Crystal Enterprise.

Use advanced rights, for instance, if you need to customize a user’s or group’srights to a particular object or set of objects, or if you want to customize the defaultinheritance patterns. Most importantly, use advanced rights to explicitly deny auser or group any right that should not be permitted to change when, in the future,you make changes to group memberships or folder security levels.

Tip: By default, users or groups who have rights to a folder will inherit the samerights for any object that you subsequently publish to that folder. Consequently,the best strategy is to set the appropriate rights for users and groups at the folder

level first. Then publish objects to that folder.Note: Because of the relative priorities assigned by Crystal Enterprise to grantedand denied rights, you must disable inheritance entirely when you need toexplicitly grant a right that has been denied elsewhere to the user or group. Forcomplete details, see “Priorities affecting advanced inheritance settings” onpage 108.

To view or set advanced rights




4 In the Name column, locate the user or group whose rights you want tospecify.


5 The next step depends upon the entry that already appears in the Access Levellist for this user or group:

• If the Access Level is not already set to Advanced, click the list and selectAdvanced.

• If the Access Level is already set to Advanced, click the Advanced link in

the Net Access column.The available object rights are displayed in the Advanced Rights page. Thisexample shows advanced rights being applied to the Guest user for anEmployee Profile report.





On the Advanced Rights pages, you will find that all of the available rights aredisplayed for every object on the system. For example, the rights displayed for afolder object seem to correspond exactly to the rights displayed for a report object,even though object-specific rights such as “Refresh the report’s data” do not applyto folder objects.

Available rights are displayed for every object on the system for purposes of inheritance, so that you can set object security at the folder level (rather thanrepeating the same settings for every object in the folder). Although certain object-specific rights do not strictly apply to the folder object itself, these rights may applyto objects that inherit rights from the folder. In other words, the “Refresh the report’sdata” right is displayed for the folder object so that you can grant a user the right torefresh the data in all reports for which the user inherits rights from this folder.

Note: This is only one type of object inheritance. For more information, see“Group and folder inheritance” on page 103.

Using inheritance to your advantageIn regards to object rights, Crystal Enterprise recognizes two types of inheritance:group inheritance and folder inheritance. By taking advantage of the ways inwhich object rights are inherited, you can reduce the amount of time it takes tosecure the content that you have published to Crystal Enterprise. Additionally,you can set up Crystal Enterprise such that you can integrate new users and newcontent quickly and easily.

To facilitate administration, it is recommended that you enable and disableinheritance with access levels whenever possible(instead of with advanced rights).Additionally, it is recommended that you make your initial settings at the top-levelCrystal Enterprise folder and disable inheritance only when necessary. Fordetailed tutorials that walk you through sample implementations of object rights,see “Customizing a ‘top-down’ inheritance model” on page 108.

Tip: By default, users or groups who have rights to a folder will inherit the samerights for any object that you subsequently publish to that folder. Consequently,the best strategy is to set the appropriate rights for users and groups at the folderlevel first. Then publish objects to that folder.

Group and folder inheritance

Group inheritance allows usersto inherit rights as the result of group membership.Group inheritance proves especially powerful when you organize all of your usersinto groups that coincide with your organization’s current security conventions.For example, if you create a user called Sample User, and add it to an existinggroup called Sales, then Sample User will automatically inherit the appropriaterights for each of the reports and folders that the Sales group has been added to.



Using inheritance to your advantage


When group inheritance is enabled for a user who belongs to more than one group,the rights of both groups are considered when the system checks credentials. Theuser is denied any right that is explicitly denied in any group, and the user isdenied any right that remains completely “not specified”; thus, the user is grantedonly those rights that are granted in one or more groups (explicitly or throughaccess levels) and never explicitly denied.

Folder inheritance allows users to inherit any rights that they have been granted onan object’s parent folder. Folder inheritance proves especially powerful when youorganize Crystal Enterprise content into a folder hierarchy that reflects yourorganization’s current security conventions. For example, suppose that you create afolder called SalesReports, and you provide your Sales group with View On Demandaccess to this folder. By default, every user that has rights to the Sales Reports folderwill inherit the same rights to the reports that you subsequently publish to this folder.Consequently, the Sales group will have View On Demand access to all of the reports,and you need only set the object rights once, at the folder level.

Note: If you need to disable or modify inheritance patterns for a particular folderor object within your folder hierarchy, you can do so with access levels or withadvanced rights.

Enabling and disabling inheritance with access levels

With access levels, you can enable or disable group inheritance, folder inheritance,or both. You can alternatively enable one or both types of inheritance withAdvanced rights settings. For details, see “Inheritance with advanced rights” onpage 105.

To enable inheritance with an access level




4 In the Name column, locate the user or group whose rights you want to specify.


5 In the Access Level column, select Inherited Rights for the user or group.

6 Click Update.

The Net Access column now displays the effective rights that the user or grouphas inherited for this object.

Note: If the entry displayed in the Net Access column is Advanced, ensure that both types of inheritance are enabled in the parent folder’s advanced rightssettings. For details, see “Setting advanced object rights” on page 100.



Using inheritance to your advantage


Calculating a user’s effective rights

When a user attempts to perform an action on a Crystal Enterprise object, the APSdetermines the user’s rights to that object. If the user possessessufficient rights, theAPS permits the user to perform the requested action.

Although the calculationsperformed by the APS can become quite complex, there areseveral ways to keep your object security model clear,consistent,and easy to maintain.For complete details on setting up a system that makes sense for your CrystalEnterprise system, see “Customizing a ‘top-down’ inheritance model” on page 108.

To calculate the user’s effective rights, the APS follows a complex algorithm. Thissequence of steps, and its various possible outcomes, is provided foradministrators and/or system architects who prefer to know exactly how the APScalculates the rights a user has to any object. The algorithm is described here andthen illustrated in a different way using pseudocode:

1 The APS checks the rights that have been directly granted or denied to the

user’s account. The APS immediately denies any right that is explicitly denied.Tip: If an individual user’s account has not been assigned any rights to theobject, then group inheritance is enabled by default. As the result, you can makeall your object rights settings at the group level to save administrative effort.

2 If folder inheritance is enabled for the user, the APS determines the rights thatthe user has to the object’s parent folder. The APS determines these rights byascending the inheritance tree to the level at which the inherited rights beginto take effect. The APS denies any right that is explicitly denied (even if theright had already been explicitly granted).

3 If group inheritance is enabled for the user, the APS determines the rightsspecified on the object for each of the groups that the user belongs to. The APSdenies any right that is explicitly denied in any group (even if the right hadalready been explicitly granted).

4 If group inheritance is enabled for the user, and folder inheritance is enabledfor a group that the user belongs to, then the APS determines the rights thatthe group has to the parent folder. The APS denies any right that is explicitlydenied in any group (even if the right had already been explicitly granted).

5 The APS completes the algorithm by denying any rights that remain “NotSpecified.”

As the result, when both types of inheritance are enabled, the APS grants the useronly those rights that are explicitly granted in one or more locations and neverexplicitly denied.

When you disable both types of inheritance for a user, you reduce this algorithmto two steps (1 and 5). Thus, the APS grants the user only those rights that he or shehas been explicitly granted. This provides you with the least complicated way of ensuring that a user has only those rights that you have explicitly granted to himor her for a particular object.





When you disable folder inheritance for a user, you reduce this algorithm to threesteps (1, 3, and 5). When you disable group inheritance for a user, you reduce thisalgorithm to three different steps (1, 2, and5). In both cases, the APS grants the useronly those rights that are explicitly granted in one or more locations and neverexplicitly denied.

This pseudocode is provided as another way to illustrate and describe thealgorithm that the APS follows in order to determine whether a user is authorizedto perform an action on a particular object:

IF {

(User granted right to object = True)

OR [

(Inherit Parent Folder Rights = True) AND (User granted right to

parent folder = True)

]

OR [

(Inherit Group Rights = True) AND (Group granted right to object =

True)

]

OR [

(Inherit Group Rights = True) AND (Group granted right to parent

folder = True)

]

}

AND {

(User denied right to object = False)

AND [

(Inherit Parent Folder Rights = False)

OR ((Inherit Parent Folder Rights = True) AND (User denied right to

parent folder = False))

]

AND [(Inherit Group Rights = False)

OR ((Inherit Group Rights = True) AND (Group denied right to object

= False))

]

AND [

(Inherit Group Rights = False)

OR ((Inherit Group Rights = True) AND (Group denied right to parent

folder = False))

]

}

THEN {

User action authorized = True

}ELSE {

User action authorized = False

}





You can use your ownEnterprise, NT, or LDAP groups when following along withthese tutorials, or you can create new groups that correspond to those used in thetutorial. For details on setting up these groups and subgroups, see “Creatinggroups for the tutorials” on page 109.

In each tutorial, you will specify the object rights that particular groups have tocertain folders on the system. By making all of your security settings at the groupand folder levels, you reduce the administrative efforts now and later. Afterfinishing each tutorial, you may decide to add users to each group and to publishobjects to each folder. If you do so, each user will inherit the appropriate rights forevery folder and object on the system.

Creating groups for the tutorials

The object security tutorials make use of eight Enterprise groups. The four primarygroups are named Administrators, Everyone, Sales, and Marketing. The Salesgroup has four additional subgroups: Sales USA, Sales Japan, Sales Managers, andSales Report Designers. The Administrators and Everyone groups are created bydefault when you install Crystal Enterprise, so these two procedures show onlyhow to create the remaining groups for the tutorials.

Note: For the shorter tutorial entitled “Setting up a closed system of increasingrights”, you need only create the Sales group and its Sales USA, Sales Japan, andSales Managers subgroups.

To create the Sales and Marketing groups

1 Go to Groups management area of the CMC.

2 Click New Group.

The new group’s Properties tab appears.

3 In the Group Name field, type Marketing



Customizing a ‘ top-down’ inheritance model


4 In the Description field, type This group contains all users who work inMarketing.

5 Click OK.

The Marketing group is added to the system and the page is refreshed.

Tip: Click the Users tab if you want to add your own users to this group.

6 Repeat steps 1 to 5 to create another group called Sales. Use this descriptionfor the group: This group contains all users who work in Sales (worldwide).

To create the Sales subgroups


2 Click New Group.

3 In the Group Name field, type Sales USA

4 In the Description field, type This group contains all users who work inSales in the USA.

5 Click OK.

The Sales USA group is added to the system and the page is refreshed.

Tip: Click the Users tab if you want to add your own users to this group.





6 Click the Member of tab; then click the Member of button.

The Modify Member of page appears.

7 In the Available groups list, select Sales; then click the > arrow.

The Sales group is added to the “Sales USA is a member of” list, as displayed

here:

8 Click OK.

You are returned to the “Member of” tab. The Sales USA group is now amember (or subgroup) of the Sales group.

9 Repeat steps 1 to 8 to create the remaining Sales subgroups for the tutorials.Use the following values for the Group Name and Description fields:

Group Name Description

Sales Japan This group contains all users who work in Sales in Japan.

Sales Managers This group contains all users who manage a Sales team.

Sales ReportDesigners

This group contains all users who design and publishreports for the Sales teams.





If you now return to the Groups management area of the CMC, all of the newgroups are displayed as follows:

You are now ready to proceed to either of the object security tutorials:

• “Setting up an open system of decreasing rights”.

• “Setting up a closed system of increasing rights” on page 131.

Setting up an open system of decreasing rights

This tutorial shows how to create an open security model, wherein groups of usersare first granted rights to all objects on the system by default. As you add foldersand subfolders to the system, you decrease the rights of users and groups, asrequired, in order to secure particular Crystal Enterprise content.

In thisscenario,you are creating folders for several groups within your organization.You have some reports that you want to add to the system immediately. Becausesome groups plan to add their own reports later, you also need to give some usersthe ability to add subfolders and to publish reports. These are your securityrequirements for each folder:

• Everyone must be able to view the majority of your reports.

• Administrators require Full Control access to all folders and objects on the system.• Sales Managers are allowed to refresh most reports against the database to

view the most recent data.

• The Marketing group needs Full Control access to its own set of folders that noother user can access (other than Administrators).





• The Sales groups need a hierarchy of folders containing worldwide reports,regional reports, and management reports:

• All Sales staff can view worldwide reports.

• Sales staff can also view reports for their own regions. If the staff member is

also a Manager, he or she can view and refresh reports from all regions.• Sales Managers require Full Control access to the management reports.

• Sales Report Designers require custom administrative privileges to all Salesfolders.

For a shorter, less detailed tutorial, see “Setting up a closed system of increasingrights” on page 131.

Changing default rights on the top-level folder

The first step is to set object rights on the top-level Crystal Enterprise folder. Thisfolder serves as the root for all other folders and objects that you add to the system.Each subfolder, report, or other object that you add to this top-level folder will by

default inherit rights from this folder. So, by setting rights here first, you minimizethe need to repeatedly customize object rights throughout your folder hierarchy.

With this procedure, you set security on the top-level folder in order to meet yourfirst three security requirements:

• Everyone must be able to view the majority of your reports.

• Administrators require Full Control access to all folders and objects on the system.

• Sales Managers are allowed to refresh most reports against the database toview the most recent data.

To change the rights on the top-level folder

1 Go to the Settings management area of the CMC.


By default, the Everyone and the Administrators groups are granted access tothis folder. You now need to reduce the rights of the Everyone group and toincrease the rights of the Sales Managers.





Now, your system meets your first three security requirements. The Everyone,Administrators, and Sales Managers groups will initially inherit these rights for anyfolders, subfolders, or reports that you subsequently publish to Crystal Enterprise.You might, for instance, create folders for all of your generally accessible inventoryreports, customer list reports, purchasing order reports, and so on.

Now that you have created an open basis for your object security model, you willproceed to restricting access to certain folders within the system.

Decreasing rights to a private folder

Another security requirement for this tutorial is that the Marketing group needsFull Control access to their own set of folders that no other user can access. Toaccomplish this, you will create a private folder called Marketing Only and ensurethat only the appropriate group of users has access to its contents.

To decrease rights to a private folder

1 Go to the Folders management area of the CMC.2 Click New Folder.

3 On the Properties tab, in the Folder Name field, type Marketing Only

4 In the Description field, type This folder is accessible only to Marketing.

5 Click OK.






Managers Only folders will be created as additional subfolders. The actualreport files are arranged in the appropriate folders.

14 Click Next.

15 Proceed through the rest of the Crystal Publishing Wizard and make anydesired changes to your reports.

Tip: If you are publishing sample reports for the purpose of this tutorial, clickNext to accept all the default values. For more information on the rest of theCrystal Publishing Wizard, see “Publishing with the Crystal PublishingWizard” on page 75.

When the Crystal Publishing Wizard has added the reports and folders to thesystem, it displays a summary:





16 Click Finish to close the Crystal Publishing Wizard.

You are now ready to set each Sales group’s object rights for the new set of Salesfolders.

Setting the base rights on the Sales foldersNow that you have used the Crystal Publishing Wizard to add reports and createthe appropriate folders and subfolders, you are ready to set the object rights foreach level of reporting content.

The security requirements are as follows:

• All Sales staff can view worldwide reports.

• Sales staff can also view reports for their own regions. If the staff member isalso a Manager, he or she can view and refresh reports from all regions.

• Sales Managers require Full Control access to the management reports.

• Sales Report Designers require custom administrative privileges to all Sales

folders.

To set the base rights on the Worldwide Sales folder


2 Click the link to the Worldwide Sales folder.

3 On the folder’s Rights tab, click Add/Remove.

4 In the Select Operation list, click Add/Remove Groups.

5 In the Available groups list, select Sales and Sales Report Designers.

Tip: Use CTRL+click to select multiple groups.

6 Click the > arrow; then click OK.





You are returned to the Rights tab.

7 In the Access Level column, select the following rights for each group:

• Administrators: Inherited Rights

• Everyone: No Access

• Sales: View

• Sales Managers: Inherited Rights

• Sales Report Designers: This group requires additional rights to publishcontent to this folder. You will use advanced rights to make these changesin the next procedure. For now, leave the Access Level list with the defaultsettings.

8 Click Update.

The Net Access column is updated to show your new security settings.

You now need to grant the Sales Report Designers group a set of advanced rights,so group members can administer all the Sales folders.





Creating a group of folder administrators

This section of the tutorial shows how to provide a particular group of users witha customized level of administrative control over a set of folders. In general, youcan accomplish this with the Full Control access level. This example, however, uses

advanced rights to grant the Sales Report Designers group a particular set of administrative privileges to all Sales folders.

To create a group of Sales folder administrators

1 If you are not already there, go to the Rights tab of the Worldwide Sales folder.

2 In the Access Level list for the Sales Report Designers group, select Advanced.

The Advanced Rights page appears.

You will use this page to grant group members a high level of control over thefolder and its contents. However, you will not let any group member deleteobjects that have been added to a Sales folder.

3 To ensure that you completely break all inheritance patterns, clear these twocheck boxes:

• Respect current security by inheriting rights from parent groups

• Respect current security by inheriting rights from parent folders

4 Click Apply.Now that you have disabled all rights inheritance, the advanced rights that youspecify will be the only rights that group members have to the folder.





5 In the Explicitly Denied column, select the following rights:

• Modify the rights users have to objects

• Delete objects

Tip: You may choose to explicitly deny additional rights to suit your needs. For

instance, to prevent these folder administrators from copying confidentialreports to public folders, you could deny the “Copy objects to another folder”right. Or, if you prefer to retain all administrative control over report-processingservers, you could deny the “Define server groups to process jobs” right.

6 In the Explicitly Granted column, select all remaining rights.

Given the rights suggested here, the Advanced Rights page looks like this:

7 Click OK.

You are returned to the Rights tab for the Worldwide Sales folder. The Net

Access column now shows that the Sales Report Designers group hasAdvanced rights to this folder.





Tip: Click the Advanced link in the Net Access column when you need to review ormodify a set of advanced rights that have already been applied to a user or group.

Now that you have set object rights on the uppermost Sales folder, you willproceed to decrease rights as you descend the folder hierarchy.

Decreasing rights to the Sales subfolders

Recall that the security requirements for the regional sales reports are as follows:

• Sales staff can view reports for their own region and can refresh these reportsagainst the database to view the most recent data.

• If the staff member is also a Manager, he or she can view and refresh reportsfrom all regions.

You will use the various Sales groups to decrease rights appropriately for eachRegional Sales folder.

To decrease rights to the regional Sales folders

1 Go to the Regional Sales - JP folder and click its Rights tab.

2 Click Add/Remove.






4 In the Available groups list, select Sales Japan.


You are returned to the Rights tab of the Regional Sales - JP folder.

6 In the Access Level column, select the following rights for each group:

• Administrators: Inherited Rights

• Everyone: Inherited Rights

• Sales: No Access

• Sales Japan: View On Demand

• Sales Managers: Inherited Rights

• Sales Report Designers: Inherited Rights

7 Click Update.

The Net Access column shows your new security settings.





Setting up a closed system of increasing rights

This tutorial shows how to set up the basis for a closed security model, whereingroups of users are first denied rights to all objects on the system by default. Asyou add folders and subfolders to the system, you increase the rights of users and

groups, as required, so they can access their Crystal Enterprise content.

In this scenario, you are creating folders for several groups within yourorganization. These are your security requirements for each folder:

• The majority of your reports should be inaccessible to most users.

• Administrators require Full Control access to all folders and objects on thesystem.

• The Sales groups need a hierarchy of folders containing management reportsand regional reports:

• Only the Sales Managers can view the management reports and all regionalreports.

• Sales staff can only view reports for their own region.For a lengthier, more detailed tutorial, see “Setting up an open system of decreasing rights” on page 112.

Restricting access from the top-level folder

The first step is to set object rights on the top-level Crystal Enterprise folder. Thisfolder serves as the root for all other folders and objects that you add to the system.Each subfolder, report, or other objectthat you add to this top-level folder will inheritrights from this folder by default. So, by setting rights here first, you minimize theneed to repeatedly customize object rights throughout your folder hierarchy.

With this procedure, you set security on the top-level folder in order to meet yourfirst two security requirements:

• The majority of your reports should be inaccessible to most users.

• Administrators require Full Control access to all folders and objects on thesystem.

Note: This procedure gives the Everyone group No Access to all publishedcontent. This is how you set the basis for a closed security model. Do not useadvanced rights to explicitly deny rights to the Everyone group (or any othergroup) at the top-level folder of your Crystal Enterprise system, because once aright has been explicitly denied, you have to break all inheritance patterns inorder to grant the same right further down the folder hierarchy.





Increasing access by descending the folder hierarchy

The remaining security requirements for this tutorial are related to the Sales groupand its subgroups. They require a hierarchy of folders containing managementreports and regional reports. Because this tutorial sets up a system of increasing

rights, the most secure content will be stored at the top of the directory tree.With these procedures, you create the folder hierarchy and set access levels inorder to meet the remaining security requirements:

• Only the Sales Managers can view the management reports and all regionalreports.

• Sales staff can only view reports for their own region.

To provide minimal access to the management reports


2 Click New Folder.

3 On the Properties tab, in the Folder Name field, type Management Reports

4 Click OK.

The new folder is created and the page is refreshed.

5 On the Rights tab, click Add/Remove.


7 In the Available Groups list, select Sales Managers.






You are returned to the Rights tab of the Management Reports folder.

9 Click the Access Level list for the Sales Managers group, and select View.

10 Click Update.

The Rights tab now shows that the Sales Managers group has View access tothis folder and to any objects that you subsequently publish to it. As required,the Everyone and Administrators groups have inherited the rights that you seton the top-level Crystal Enterprise folder.

Now you need only create folders for the regional reports and grant access to theappropriate regional Sales groups.

To provide selective access to the regional reports

1 If you are not already there, go to the Management Reports folder.

2 On the Subfolders tab, click New Folder.

3 On the Properties tab, in the Folder Name field, type Regional Reports - JP

4 Click OK.

The new folder is created and the page is refreshed.

5 On the Rights tab, click Add/Remove.


7 In the Available Groups list, select Sales Japan.


You are returned to the Rights tab of the Management Reports folder.

9 In the Access Level list for the Sales Japan group, select View.





10 Click Update.

The Rights tab now shows that the Sales Japan group has View access to thisfolder and to any objects that you subsequently publish to it. TheAdministrators, Everyone, and Sales Managers groups automatically inherit

the appropriate rights for this folder.

11 Repeat this procedure to create a subfolder called Regional Reports - USA andto provide the Sales USA group with View access to the folder.

When you finish, the Rights tab of the Regional Reports - USA folder shows thatyou have set the rights as required for this tutorial.

You have now reached the end of this tutorial.



Report objects and instances overview


Report objects and instances overviewThis chapter explains how to manage report objects and schedule report instancesthrough the Crystal Management Console (CMC).

This chapter contains two parts:• Report object management

This section describes managing report objects at the general level. It describesgeneral object management concepts that apply to all objects, such as moving,copying, deleting objects, and so on.

For details, see “Report object management” on page 139.

• Managing a report object and its instances

This section outlines the steps involved for managing a selected report objectand its instances. This section provides information on scheduling a report,selecting the output format and destination, setting the object rights, and so on.There is also information on scheduling a report with events in this section.

For details, see “Managing a report object and its instances” on page 146.

Note: When you update a report object from the CMC, your changes affect userswho schedule and view reports through Crystal Enterprise; for instance, if youchange the parameter settings for a report object, when users schedule and viewreports through a web-based client such as ePortfolio or a custom web application,the parameter information will be changed for them as well. As such, if you don’twant to change the settings of a report object and its instances permanently, thenschedule reports through ePortfolio or a custom web application. For informationon ePortfolio, see the Crystal Enterprise ePortfolio User’s Guide.

What are report objects and instances?A report object is an object that is created using a Crystal designer component(such as Crystal Reports or Crystal Analysis). Report objects contain reportinformation (such as database fields). When you schedule a report, CrystalEnterprise generates an instance or instances of the object. A report object can bemade available to everyone or to individuals in selected user groups.

Note: When you publish a report object to Crystal Enterprise, only the structure of the report (the template information) is saved; that is, the published report objectcontains no saved data.

Crystal Enterprise creates report instances from report objects—that is, an instance

is created when a report object is processed by the Job Server. Essentially, aninstance is a report object that contains report data that is retrieved from one ormore databases. Each instance contains data that is current at the time the report,query, or program is processed.



Report object management


Tip: You may want to create a shortcut if you want to give someone access to areport object without giving them access to the entire folder that the reportobject is located in. After you create the shortcut, users who have access to thefolder where the shortcut is located can now be able to access this report objectand its instances. For more information on folder rights, see “Specifying folderrights” on page 68.

5 Select the appropriate destination folder; then click OK.

Tip:

• To expand a folder, select it and click Show Subfolders.

• To search for a specific folder, use the Look For field.

• If there are many folders on your system, click the Previous and Next buttons to navigate through the list of folders.

Applying processing extensions to reports

Crystal Enterprise supports the use of customized processing extensions. Aprocessing extension is a dynamically loaded library of code that applies your business logic to particular Crystal Enterprise view or schedule requests beforethey are processed by the system. This section shows how to register yourprocessing extension with Crystal Enterprise, and how to apply an availableprocessing extension to a particular report object.

For general information about processing extensions and how you can use them tocustomize report processing and security, see “Processing extensions” on page 24.For information on writing your own processing extensions with the ProcessingExtension API, see the reference section of the Crystal Enterprise Web Developer’sGuide.

Note: On Windows systems, dynamically loaded libraries are referred to asdynamic-link libraries (.dll file extension). On UNIX systems, dynamically loadedlibraries are often referred to as shared libraries (.so file extension). You mustinclude the .dll or .so file extension when you name your processing extensions.Also, file names cannot include the \ or / characters.

Registering processing extensions with the system

Before you can apply your processing extensions to particular objects, you mustmake your library of code available to each machine that will process the relevantschedule or view requests. The Crystal Enterprise installation creates a defaultdirectory for your processing extensions on each Job Server and Page Server. It isrecommended that you copy your processing extensions to the default directoryon each server. On Windows, the default directory is C:\Program Files\CrystalDecisions\WCS\ProcessExt; on UNIX, it is the crystal/processext directory.

Tip: It is possible to share a processing extension file. For details, see “Sharingprocessing extensions between multiple servers” on page 145.



Report object management


Selecting a processing extension for a report


2 Click the link to the report object that you want to apply your processingextension to.

3 Click the object’s Filters tab.

4 Select your processing extension in the Available Processing Extensions list.

Note: Your processing extensions appear in this list only after you haveregistered them with the system.

5 Click Add.

Tip: You may apply more than one processing extension to a report object.

Repeat steps 4 and 5 for each processing extension; then use the up and downarrows to specify the order in which the processing extensions should be used.

6 Click Update.

Your processing extension is now enabled for this report object.



9: Managing Report Objects and Instances


Sharing processing extensions between multiple serversIf you want to put all processing extensions in a single location, you can overridethe default processing extensions directory for each Job Server and Page Server.First, copy your processing extensions to a shared directory on a network drive

that is accessible to all of the Job Servers and Page Servers. Map (or mount) thenetwork drive from each Job Server and Page Server machine.

Note: Mapped drives on Windows are valid only until you reboot the machine.For details, see “Server resources must be available on local drives” on page 319.

If you are running servers on both Windows and on UNIX, you must copy a .dlland an .so version of every processing extension into the shared directory. Inaddition, the shared network drive must be visible to Windows and to UNIXmachines (through Samba or some other file-sharing system).

Finally, change each server’s command line to modify the default processingextensions directory. Do this by adding “-report_ProcessExtPath <absolute

path>” to the command line. Replace <absolute path> with the path to the new

folder, using whichever path convention is appropriate for the operating systemthat the server is running on (for example,M:\code\extensions, /home/shared/code/extensions, and so on).

The procedure for making this modification depends upon your operating system:

• On Windows, use the CCM to stop the Job Server/Page Server. Then open theserver’s Properties to modify the command line. Start the server again whenyou have finished.

• On UNIX, run ccm.sh to the Job Server/Page Server. Then edit ccm.config tomodify the server’s command line. Start the server again when you havefinished. For reference, see “ccm.sh” on page 280.

Deleting a report objectYou can delete either a single report object or multiple report objects. You can alsodelete a folder (by selecting a folder and clicking Delete in the Folders managementarea), which results in all of the objects and instances that are stored in the folderto be deleted as well. As well, you also have the option of deleting report instances,rather than the report object. For more information, see “Managing the history of report instances” on page 149.

Note: When you delete a report object, all of its existing instances and scheduledinstances will be deleted.

To delete a report 1 Go to the Objects management area of the CMC.

The Objects page appears.

2 Select the check boxes associated with the report object.

3 Click Delete.

4 Click OK.



Managing a report object and its instances


Searching for a report

The search feature enables you to search for specific text within report objects.

To search for a report or reports


2 Click Search.

3 Select your search criteria in the Field Name list and Matching method list.

4 Complete the Text to search for field; then click Search.

Managing a report object and its instancesTo change the settings of a report object and its instances, in the Crystal ManagementConsole (CMC), go to the Objects management area and then select a report byclicking its link, which is located in the Object Title column. Once you have selectedyour report, click theappropriate tab to change thereport objectand instancessettings.

Tip: You can also manage a report by going to the Folders management area in theCMC, selecting a folder (and any subfolders) by clicking the appropriate link(s),and selecting the report object that is located under the Report Title column.

This section details the following procedures:

• “Changing properties of a report and specifying servers for scheduling” onpage 147

• “Managing the history of report instances” on page 149

• “Changing database information” on page 150

• “Updating parameters” on page 151

• “Using filters” on page 152

• “Scheduling a report instance” on page 153

• “Selecting a destination” on page 166

• “Choosing a format” on page 173

• “Setting instance limits for a report object” on page 174

• “Setting object rights for users and groups” on page 176





Changing database information

You can set the default database logon information on the Database page for areport. The Database page displays the data source or data sources for your reportobject and its instances. You can change the logon name and password of the

database and choose to prompt the user for a new logon name and password whenhe or she views a report instance.

To change database settings

1 In the Objects management area of the CMC, select a report object by clickingits link.

2 Click the Database tab.

The Database tab appears.

3 In Data Source(s) list , select the data source.

4 Update the Logon Name and Password fields as necessary.

5 Select the Prompt the user for new value(s) when viewing check box if youwant users to be prompted for a password when they refresh a report afterviewing it once.

Note: This option has no effect on a scheduled instance. Also, CrystalEnterprise only prompts users when they first refresh a report; that is, if theyrefresh the report a second time, they will not be prompted.

6 Click Update.





3 Update or add new selection formulas.

• Record Selection Formula

Use the Record Selection Formula to create or edit a record selectionformula or formulas that limit the records used when you or a user

schedules a report.• Group Selection Formula

Use the Group Selection Formulas to create or edit a group selectionformula or formulas that limit the groups used when you or a userschedules a report.

4 In the processing extensions area, where appropriate, select a processingextension from the Available Processing Extensions list and then click Add.

5 Click Update.

Scheduling a report instance

When you schedule a report, Crystal Enterprise generates a report instance whichcontains the relevant information from the database (or databases) at the time thereport is run. Your report instance uses all of the settings that you have set in theCMC for the report object. The following sections provide information onscheduling reports in various ways, such as scheduling a daily or monthly report.

Note:

• Your end users, when using Crystal Enterprise to schedule and run reports,should use a web-based client such as ePortfolio or a custom web application.ePortfolio is designed primarily for report scheduling and viewing (whereasthe CMC enables you to manage and administer report properties and settings

in addition to scheduling and viewing reports).• For many of the scheduling options, you can choose to schedule a reportinstance with events. For information on events, see “Scheduling a report withevents” on page 163.

Scheduling on demand

When you select the schedule “On Demand” option, a report instance runs onlywhen users schedule a report through their web application (ePortfolio or acustom web application). For more information on ePortfolio, see the CrystalEnterprise ePortfolio User’s Guide.

To set a report to be scheduled on demand 1 In the Objects management area of the CMC, select a report object by clicking

its link.

2 Click the Schedule tab.

The Schedule tab appears.





3 Select the On Demand option.

4 Complete the following fields:

• Number of retries allowed

This number indicates the number of times a job server will attempt to processa report if the first attempt is not successful. By default, the number is zero.

• Retry interval in seconds

Crystal Enterprise will wait for the specified number of seconds to pass before attempting to process a report again (if the first attempt failed). Thedefault setting is 1800 seconds.

5 Click Update.

Scheduling a report to run once

This option enables you to schedule a report to run once, whether it is runimmediately, or at a specific time. You can also schedule a report with events. Fordetailed information on applying events, see “Scheduling a report with events” onpage 163.

To schedule a report to run once




3 Select the Once option.





• Every X hour(s), N minute(s)

For this option, the report will be run every X hour(s) and N minute(s), andwill start on the day and time that you enter in the Start Date area. You canalso select an optional end date for the report in the End Date area. To select adate, you can either enter a date in the date field, or click the Popup Calendar button to select a date from the calendar that appears in a separate window.To specify the hour and minute values, enter numeric values in the “Where Xis” field and the “Where N is” field. By default, X equals 1 and N equals 0.

• Every X hour(s), N minute(s), with events

Choose this option to use the event or events that you have already defined.For this option, the report will be run every X hour(s) and N minute(s), andwill start on the day and time that you enter in the Start Date area. You canalso select an optional end date for the report in the End Date area. To select adate, you can either enter a date in the date field, or click the Popup Calendar button to select a date from the calendar that appears in a separate window.To specify the hour and minute values, enter numeric values in the “Where X

is” field and the “Where N is” field. By default, X equals 1 and N equals 0.

• Every X day(s)

For this option, the report will be run every X day(s) and will start from thestart date and time that you enter in the Start Date area. You can also selectan optional end date for the report in the End Date area. To select a date,you can either enter a date in the date field, or click the Popup Calendar button to select a date from the calendar that appears in a separate window.To specify the day value, enter a numeric value in the “Where X is” field.By default, X has a value of 1.

• Every X day(s), with events

Choose this option to use the event or events that you have already defined.For this option, the report will be run every X day(s) and will start from thestart date and time that you enter in the Start Date area. You can also selectan optional end date for the report in the End Date area. To select a date,you can either enter a date in the date field, or click the Popup Calendar button to select a date from the calendar that appears in a separate window.To specify the day value, enter a numeric value in the “Where X is” field. Bydefault, X has a value of 1.

5 Regardless of which option you select from the Run list, complete thefollowing fields:









4 In the Run list, select from the following:

• Every week on

When you select this option, the report will be run once a week, on the daythat you select from the days of the week check boxes. You also specify a

start date in the Start Date area and an optional end date for the report inthe End Date area. To select a date, you can either enter a date in the datefield, or click the Popup Calendar button to select a date from the calendarthat appears in a separate window.

• Weekly, with events

Choose this option to use the event or events that you have alreadydefined. When you select this option, the report will be run once a week(along with events), on the day that you select from the days of the weekcheck boxes. You also specify a start date in the Start Date area and anoptional end date for the report in the End Date area. To select a date, youcan either enter a date in the date field, or click the Popup Calendar buttonto select a date from the calendar that appears in a separate window.






6 Click Schedule to schedule the report; click Update to update the scheduleinformation.

Scheduling a monthly report

You can schedule a report so that it runs on a monthly basis, on a certain day of themonth or specified day of the week, on every set number of months, on the firstMonday of the month, or on the last day of the month. You can also schedule areport with events. For detailed information on applying events, see “Schedulinga report with events” on page 163.





• On the first Monday of the month

When you select this option, a report will be run on the first Monday of every month. You specify a start date in the Start Date area and an optionalend date for the report in the End Date area. To select a date, you can eitherenter a date in the date field, or click the Popup Calendar button to select adate from the calendar that appears in a separate window.

• On the first Monday of the month, with events

Choose this option to use the event or events that you have alreadydefined. When you select this option, a report will be run on the firstMonday of every month. You specify a start date in the Start Date area andan optional end date for the report in the End Date area. To select a date,you can either enter a date in the date field, or click the Popup Calendar button to select a date from the calendar that appears in a separate window.

• On the last day of the month

When you select this option, a report will be run on the last day of every

month. You specify a start date in the Start Date area and an optional enddate for the report in the End Date area. To select a date, you can eitherenter a date in the date field, or click the Popup Calendar button to select adate from the calendar that appears in a separate window.

• On the last day of the month, with events

Choose this option to use the event or events that you have alreadydefined. When you select this option, a report will be run on the last day of every month. You specify a start date in the Start Date area and an optionalend date for the report in the End Date area. To select a date, you can eitherenter a date in the date field, or click the Popup Calendar button to select adate from the calendar that appears in a separate window.











Scheduling a report with events

When you schedule a report with events, the report will be run only when theadditional condition (that is, the event) occurs. You can tell a report to wait for any,or all of the three event types: file-based, custom-based, and schedule-based. If you

want a scheduled report to trigger an event, you must choose a schedule-based event.

Note: A file-based event is triggered upon the existence of a specified file. Acustom-based event is triggered manually. A schedule-based event is triggered byanother report being run.

When you schedule a report that waits for a specified event, the report will runonly when the event is triggered, and only when the rest of the schedule conditionsare met. If the event is triggered before the start date of the report, the report willnot run. If you have specified an end date for this report, and if the event is nottriggered before the end date occurs, the report will not run, as not all of theconditions will have been met. Also, if you schedule a weekly or monthly report,

the report will have a specified time frame in which the report can be processed.The event must be triggered within this specified time for the report to run. Forexample, if you schedule a weekly report that runs every Monday, the event must be triggered within the 24-hour period on Monday; if the event is triggered outsideof the 24-hour period, then the report will not run.

You can also schedule a report which triggers a schedule-based event uponcompletion of the report being run. When the report is run, Crystal Enterprise willtrigger the specified event. For a schedule-based event, if the event is based on thereport instance being run successfully, the event won’t be triggered if the reportinstance fails (and vice versa). If you select the Both option, then the schedule-basedevent will be triggered once the report is run, regardless of whether the report

instance hasbeen successfully generated or not. For a sample scenario on when youwould use a schedule-based event, see “Schedule-based events” on page 182.

When you schedule a report through the Objects management area, you canspecify in the Run list in the Schedule page whether you want to schedule a reportwith events or not. For detailed information on scheduling reports without events,see “Scheduling a report instance” on page 153.

To schedule a report with events, first ensure that you have created an event in theEvents management area. When you schedule a report, select any Run optionwhich includes the phrase, “with events.” For more information on creating events(and sample scenarios for each type of event), see “Managing events overview” onpage 180.





To select an event or events to wait for




3 Select and complete the schedule parameters for your report (schedulingoption, Start Date, End Date, and so on).

4 In the Run list, select a run option that contains the words, “with events.”

5 In the Available Events area, select from the list of events and click Add.

For example, the report above is set to wait for a Custom-based event to occur before the report is processed.






To trigger a schedule-based event or events upon completion




3 Select and complete the schedule parameters for your report (schedulingoption, Start Date, End Date, and so on).

4 In the Run list, select a run option that contains the words, “with events.”

5 In the Available Schedule Events area, select from the list of events and clickAdd.

Forexample, the report above is set to trigger a Schedule-based event only if thereport is successfully processed.

Note: You can only select schedule-based events in this list.

6 Click Schedule to schedule the report; click Update to update the schedule

information.





Selecting a destination

Using Crystal Enterprise, you can specify the output destination of a scheduledreport. By default, when you schedule a report, the report instances will be savedon the File Repository Server (FRS). The option to choose a destination provides

you with the flexibility to deliver reports across your enterprise solution indifferent and applicable ways. For example, you are able to schedule reports thatwill be sent via email to other users. You can also schedule reports that, upongeneration, will be printed.

When users schedule objects to specific destinations (other than the default FRSlocation), Crystal Enterprise generates a unique name for each output file. Togenerate a file name, users can use a combination of ID, name or title of the object,owner information, or the date and time information.

The following destination support locations are available:

• “Default destination support” on page 166

• “Unmanaged disk destination support” on page 167• “FTP support” on page 168

• “Email (SMTP) support” on page 170

• “Printer support” on page 172

Note: You can change your destination settings either in the Crystal ManagementConsole (CMC) or in ePortfolio. When you specify the destination settings throughthe CMC, these settings are also reflected in the default scheduling settings forePortfolio; that is, if a user selects the Default destination setting in ePortfolio, thereport will be delivered to the specified destination (set by the CMC).

Default destination support

By default, scheduled reports are saved to the File Repository Server (FRS). If youwant to save report instances to the FRS, select this option.

To set your destination to default


2 Click the Destination tab.

The Destination tab appears.

3 Select Default from the Destination list.

4 Click Update.





Unmanaged disk destination support

You can specify the location where a report instance will be saved when it isscheduled by you or another user.

Note:

• The location must be a local or mapped directory on the processing server, orthe location must be a Universal Naming Convention (UNC) path.

• The processing server must have sufficient rights to the specified location.

• You must have this destination feature enabled in the Job Server in order to useunmanaged disk destination support. For more information on the Job Server,see “Setting default scheduling destinations for Job Servers” on page 223.

To set your destination to unmanaged disk


2 Click the Destination tab.The Destination tab appears.

3 Select Unmanaged Disk from the Destination list.





3 Select FTP from the Destination list.

4 Select either Use the Crystal Job Server’s defaults or Set the values to be used

at schedule time here.

If you select the first option, Crystal Enterprise will schedule a report using the Job Server’s default settings. You can change these settings in the Serversmanagement area. For more information see “Setting default schedulingdestinations for Job Servers” on page 223.

If you select the second option, you can set the FTP and file name properties:

• Host

Enter the FTP host information.

• Port

Enter the FTP port number (the default is 21).

• FTP User Name

Specify a user who has the necessary rights to upload a report to the FTPserver.





If you select the second option, you can specify the email settings and the filename properties:

• From

Enter a return address.

• ToEnter an address or addresses that you wish to send the report to.

• Cc

Enter an address or addresses that you wish to send a carbon copy of thereport to.

• Subject

Complete the subject field.

• Message

Type a short message, if required.

• Default File Name (randomly generated)

Select this option if you want Crystal Enterprise to generate a random filename.

• Specified File Name

Select this option if you want to enter a file name—you can also add avariable to the file name. To add a variable, choose a placeholder for avariable property from the list and click Add.

5 Click Update.

Printer support

You can specify printers that are referenced from within Crystal Enterprise as yourreport destination. Enter the name of your printer (and the path) when you specify

the destination for your report. By selecting the Printer destination, CrystalEnterprise prints your report after it is processed.

Note: If you select Printer as your destination, the report must be scheduled usingthe Crystal Reports format. For information on formats, see “Choosing a format”on page 173.

To assign a printer name1 In the Objects management area of the CMC, select a report object by clicking

its link.

2 Click the Destination tab.

The Destination tab appears.





(including any objects found within the subfolders). For information on settingfolder limits, see “Setting limits for folders, users, and groups” on page 70.

Note: When you set the limits at the report object level, the report object willoverride the limits set for the folder; that is, the report object will not inherit the

limits of the folder.

To set limits for report instances


2 Click the folder’s Limits tab.

The Limits tab appears.

3 Make your settings according to the types of limits you want to set for yourreport instances. The options are as follows:

• Delete excess instances when there are more than N instances of an object

To limit the number of instances per object, select this check box. Then typethe maximum number of instances that you want to remain on the system.(The default value is 100.)

• Delete excess instances for the following users/groups

To limit the number of instances for users or groups, click Add/Remove inthis area. Select from the available users and groups and click OK. Thentype the maximum number of instances in the Instance Limit column. (Thedefault value is 100.)

• Delete instances after N days for the following users/groups

To limit the number of days that instances are saved for users or groups,click Add/Remove in this area. Select from the available users and groups

and click OK. Then type the maximum age of instances in the MaximumDays column. (The default value is 100.)

4 Click Update.





4 Select an option in the Select Operation list.

5 Select the group(s) or user(s) you would like to add or remove.

6 Click the > arrow to add the group(s) or user(s); click the < arrow to removethe group(s) or user(s).

Tip:

• To search for a specific user or group, use the Look For field.

• If there are many users or groups on your system, click the Previous andNext buttons to navigate through the list of folders.

7 Click OK.

To change a group or user ’ s report rights


2 Click the Rights tab.The Rights tab appears.

3 Change the access level for a group or user by selecting a right from theappropriate list in the Access Level column; then click Update.

If you select Advanced from the list, you grant or deny granular rights from theAdvanced Rights page. If this page doesn’t appear automatically after you clickUpdate, click the Advanced link (in the Net Access column). For moreinformation, see “Setting advanced object rights” on page 100.




Managing Events 10

This chapter provides information on creating andmanaging events. It describes file-based events, customevents, and schedule-based events.



Managing events overview


Managing events overviewEvent-based scheduling provides you with additional control over schedulingreports: you can set up events so that reports are processed only after a specifiedevent occurs. Working with events consists of two steps: creating an event andscheduling a report with events. That is, once you create an event, you can select itas a dependency when you schedule a report. The scheduled job is then processedonly when the event occurs. This chapter shows how to create events in the Eventsmanagement area of the Crystal Management Console (CMC).

You can create three kinds of events:

• File events

When you define a file-based event, you specify a filename that the EventServer should monitor for a particular file. When the file appears, the EventServer triggers the event. For instance, you might want to make some reportsdependent upon the regular file output of other programs or scripts.

For details, see “File-based events” on page 181.• Schedule events

When you define a schedule-based event, you select a report whose existingrecurrence schedule will serve as the trigger for your event. In this way,schedule-based events allow you to set up contingencies or conditions betweenscheduled reports. For instance, you might want certain large reports to runsequentially, or you might want a particular sales summary report to run onlywhen a detailed sales report is run successfully.

For details, see “Schedule-based events” on page 182.

• Custom events

When you create a custom event, you create a shortcut for triggering an event

manually. Basically, your custom event occurs only when you or anotheradministrator clicks the corresponding “Trigger this event” button in the CMC.

For details, see “Custom events” on page 184.

When working with events, keep in mind that an object’s recurrence schedule stilldetermines how frequently the report runs. For instance, a daily report that isdependent upon a file-based event will run, at most, once a day (so long as the filethat you specify appears every day). In addition, the event must occur within thetime frame established when you actually schedule the event-based report.

Note: For information on scheduling an event-based report in the Objectsmanagement area of the CMC, see “Scheduling a report with events” on page 163.



10: Managing Events


File-based eventsFile-based events wait for a particular file (the trigger) to appear before the eventoccurs. Before scheduling a report that waits for a file-based event to occur, youmust first create the file-based event in the Events management area of the CMC.Then you can schedule the report and select this event. For more information onscheduling a report with events, see “Scheduling a report with events” on page 163.

File-based eventsare monitored by the Event Server. When the file that you specifyappears, the Event Server triggers the event. The Automated Process Scheduler(APS) then releases any schedule requests that are dependent on the event.

For instance, suppose that you want your daily reports to run after your databaseanalysis program has finished and written its automatic log file. To do this, youspecify the log file in your file-based event, and then schedule your daily reportswith this event as a dependency. When the log file appears, the event is triggeredand the reports are processed.

Note: If the file already exists prior to the creation of the event, the event is nottriggered. In this case, the event is triggered only when the file is removed andthen recreated. If you want an event to be triggered multiple times, you mustremove and recreate the file each time.

To create a file-based event

1 Go to the Events management area of the CMC.

2 Click New Event.

The New Event page appears.



Schedule-based events


3 In the Type list, select File.

4 Type a name for the event in the Event Name field.

5 Complete the Description field.

6 In the Server list, select the Event Server that will monitor the specified file.7 Type a filename in the Filename field.

Note: Type the absolute path to the file that the Event Server should look for(for example, C:\folder\filename, or /home/folder/filename). The drive anddirectory that you specify must be visible to the Event Server. Ideally, thedirectory should be on a local drive.

8 Click OK.

Schedule-based eventsSchedule-based events are dependent upon scheduled reports. That is, a schedule- based event is triggered when a particular report has been processed. When youcreate this type of event, it can be based on the success or failure of a scheduledreport, or it can be based simply on the completion of the job.

Most importantly, you must associate your schedule-based event with at least twoscheduled reports. The first report serves as the trigger for the event: when thereport is processed, the event occurs. The second report is dependent upon theevent: when the event occurs, this second report runs. For more information onscheduling reports with events, see “Scheduling a report with events” on page 163.

For instance, suppose that you want reports A and B to run only after report C hasrun. To do this, you create a schedule-based event in the Events management area.You specify the “Success” option for the event, which means that the event istriggered only when report C runs successfully. Then, you schedule reports A andB with events, and select your new schedule-based event as the dependency.Schedule report C with events, and set report C to trigger the schedule-based eventupon successful completion. Now, when report C runs successfully, the schedule- based event is triggered, and reports A and B are subsequently processed.



10: Managing Events


To create a schedule-based event


2 Click New Event.

The New Event page appears.

3 In the Type list, select Schedule.


5 Complete the Description field.6 In the “Event based on” area, select from three options:

• Success

The event is triggered only upon successful completion of a specified report.

• Failure

The event is triggered only upon non-successful completion of a specifiedreport.

• Success or Failure

The event is triggered upon completion of a specified report, regardless of whether that report was processed successfully or not.

7 Click OK.



Custom events


Custom eventsA custom event occurs only when you explicitly click its “Trigger this event” button. As with all other events, a report based on a custom event runs only whenthe event is triggered within the time frame established by the report’s scheduleparameters. Custom events are useful because they allow you to set up a shortcutthat, when clicked, triggers any dependent schedule requests.

Tip: When developing your own web applications, you can trigger Custom eventsfrom within your own code, as required. For details, see the Crystal Enterprise WebDeveloper’s Guide.

For instance, you may have a scenario where you want to schedule a number of reports, but you want to run them after you have updated information in yourdatabase. To do this, create a new custom event, and schedule the reports with thatevent. When you update the data in the database and you need to run the reports,return to the event in the CMC and trigger it manually. Crystal Enterprise then

runs the reports. For more information on event-based scheduling, see“Scheduling a report with events” on page 163.

Note: You can trigger a custom event multiple times. For example, you mightschedule two sets of event-based reports to run daily—one set runs in the morning,and one set runs in the afternoon. When you first trigger the related custom event inthe morning, one set of reports is run; when you trigger the event again in theafternoon, the remaining set of reports is run. If you neglect to trigger the event inthe morning and trigger it only in the afternoon, both sets of reports run at that time.

To create a custom event


2 Click New Event.

3 In the Type list, select Custom.


5 Complete the Description field.

6 Click OK.

Note: Before you trigger this custom event, schedule a report that is dependentupon this event.

To trigger a custom event


2 In the Event Name column, select a custom event by clicking its link.

3 Click Trigger this event.

A message appears: “This event has been triggered.”




Crystal Enterprise Architecture 11

This chapter provides an overview of the Crystal Enterprisearchitecture, describes the different components, andidentifies how they work together to distribute reports overthe web.



Architecture overview and diagram


Architecture overview and diagramCrystalEnterprise is a multi-tier system. Although the components are responsiblefor different tasks, they can be logically grouped based on the type of work theyperform. If you are new to Crystal Enterprise, use this chapter to gain familiaritywith the Crystal Enterprise framework, its components, and the general tasks thateach component performs.

In Crystal Enterprise, there are four tiers: the client tier, the intelligence tier, theprocessing tier, and the data tier. To provide flexibility, the components that makeup each of these tiers can be installed on one machine, or spread across many.

The following diagram illustrates how each of the components fits within themulti-tier system. Other Crystal products, such as Crystal Analysis and SmartReporting Technology, plug in to the Crystal Enterprise framework in variousways. This chapter describes the framework itself. Consult each product’sinstallation or administration guides for details about how it integrates with the

Crystal Enterprise framework.

The “servers” are services that run on Windows machines and daemons that runon UNIX machines. These services can be “vertically scaled” to take full advantageof the hardware that they are running on, and they can be “horizontally scaled” to



11: Crystal Enterprise Architecture


take advantage of multiple computers over a network environment. This meansthat the services can all run on the same machine, or they can run on separatemachines. The same service can also run in multiple instances on a single machine.

For example, you can run the Web Connector and the Web Component Server on

one machine, while you run the Job Server on a separate machine. This is called“horizontal scaling.” If the Job Server is running on a multi-processor computer, thenyou may choose to run multiple Job Servers on it.This is called “vertical scaling.” Theimportant thing to understand is that, even though these are called servers, they areactually services and daemons that do not need to run on separate computers.

The remainder of this chapter describes each tier, the key Crystal Enterprisecomponents, and their primary responsibilities.

Tip: When you are familiar with the architecture and want to customize yoursystem configuration, see “Managing and Configuring Servers” on page 195 and“Scaling Your System” on page 241.

Client tierThe client tier is the only part of the Crystal Enterprise system that administratorsand end users interact with directly. This tier is made up of the applications thatenable people to administer, publish, and view reports and other objects.

ePortfolio

ePortfolio is the web-based interface that end users access to view, schedule, andkeep track of published reports. Each Crystal Enterprise request that a user makesin ePortfolio is directed by the web server to the Web Connector, which thenforwards the request to the Web Component Server.

ePortfolio also serves as a demonstration of the ways in which you can use theCrystal Enterprise Software Development Kit (SDK) to create a custom web desktopfor end users. For more information about the SDK, see the Crystal Enterprise WebDeveloper’s Guide. You can access the guide by clicking its link on the CrystalEnterprise Launchpad.

Note: Crystal Enterprise supports reports created in versions 6 through 8.5 of Crystal Reports. Reports created using version 6 and 7 of Crystal Reports appearin version 8 format when they are launched from ePortfolio.



Client tier


Crystal Management Console

The Crystal Management Console (CMC) allows you to perform user managementtasks such as setting up authentication and adding users and groups. It also allowsyou to publish, organize, and set security levels for all of your Crystal Enterprise

content. Additionally, the CMC enables you to manage servers and create servergroups. Because the CMC is a web-based application, you can perform all of theseadministrative tasks remotely. For more information, see “Working with theCrystal Management Console” on page 8.

The CMC also serves as a demonstration of the ways in which you can use the newadministrative objects and libraries in the Crystal Enterprise SDK to create customweb applications for administering Crystal Enterprise. For more informationabout the SDK, see the Crystal Enterprise Web Developer’s Guide. You can access theguide by clicking its link on the Crystal Enterprise Launchpad.

Crystal Configuration ManagerThe Crystal Configuration Manager (CCM) is a server-management tool that allowsyou to configure each of your Crystal Enterpriseserver components. This tool allowsyou to start, stop, enable, and disable servers, and it allows you to view and toconfigure advanced server settings such as default port numbers, APS database andclustering details, SOCKS server connections, and more. In addition, the CCMallows you to add or remove servers from your Crystal Enterprise system. For moreinformation, see “Working with the Crystal Configuration Manager” on page 11.

Crystal Publishing Wizard

The Crystal Publishing Wizard is a locally installed Windows application thatenables both administrators and end users to add reports to Crystal Enterprise. Byassigning object rights to Crystal Enterprise folders, you control who can publishreports and where they can publish them to. For more information, see“Publishing overview” on page 74 and “Object rights overview” on page 96.

The Crystal Publishing Wizard publishes reports from a Windows machine toCrystal Enterprise servers running on Windows or on UNIX.

Crystal Import Wizard

The Crystal Import Wizard is a locally installed Windows application that guides

administrators through the process of importing users, groups, reports, andfolders from an existing Seagate Info or Crystal Enterprise implementation toCrystal Enterprise. For more information, see “Crystal Import Wizard overview”on page 86.

The Crystal Import Wizard runs on Windows, but you can use it to importinformation into a new CrystalEnterprise system running on Windows or on UNIX.





Crystal Web Wizard

This Windows application is designed to assist new developers in building andinstalling web applications. The wizard lets you create a custom web applicationor install a sample project. You can use this wizard as a stand-alone application or

as a Microsoft FrontPage web creation tool. For details, seethe wizard’s online helpand the Crystal Enterprise Web Developer’s Guide.

Intelligence tierThe intelligence tier manages the Crystal Enterprise system. It maintains all of thesecurity information, sends requests to the appropriate servers, and stores reportinstances.


The Web Component Server (WCS) is the gateway between the Web Connector onthe web server and the rest of the components in Crystal Enterprise. The WCS isresponsible for processing requests from your browser, including Crystal ServerPages (.csp files), which are used to customize your access to Crystal Enterprise.As a result, this server also acts as an application server. For further informationon CSP, see “Using CSP Scripting” in the Crystal Enterprise Web Developer’s Guide.

Note: In addition to processing CSP requests, the WCS also handles other types of requests. These include requests from the CMC and the handling of prompts and

database logon requests. When users view reports in HTML format, the WCS isresponsible for converting the report pages (.epf files) to HTML format.

If you are running multiple Cache Servers, the WCS automatically load-balancesreporting requests across the available servers.



Intelligence tier


Web Connectors

To communicate with the different types of web servers, the WCS uses a WebConnector. Crystal Enterprise includes different Web Connectors for differentoperating systems and web servers.

If you are running multiple WCS machines, the Web Connector automatically balances the load across the available servers. Each subsequent Crystal Enterpriserequest is sent to the “least used” WCS. For details about fault-tolerance as itrelates to security, see “Ticket mechanism for distributed security” on page 26.

For details on installing and configuring Web connectors, see the Crystal EnterpriseInstallation Guide. For additional troubleshooting steps, see “Troubleshooting pathmappings” on page 297.


The Automated Process Scheduler (APS) is responsible for maintaining a databaseof information about your Crystal Enterprise system; the other components cantherefore access that data as required. The data stored by the APS includesinformation about users and groups, security levels, Crystal Enterprise content,and servers. This data allows the APS to perform its three main tasks:

• Maintaining security

By maintaining a database of users and their associated object rights, the APSenforces who has access to Crystal Enterprise and the types of tasks they areable to perform. This also includes enforcing and maintaining the licensingpolicy of your Crystal Enterprise system.

• Managing objects

The APS keeps track of the location of reports and maintains the folderhierarchy. By communicating with the Job Server, the APS is able to ensure thatscheduled jobs run at the appropriate times.

• Managing servers

By staying in frequent contact with each of the servers in the system, the APS isable to maintain a list of server status. The WCS accesses this list, for instance,to identify which Cache Server is free to use for a report viewing request.

Typically, you provide the APS with database connectivity and credentials whenyou install Crystal Enterprise, so the APS can create its own database using yourorganization’s preferred database server. For details about setting up the APSdatabase, see the Crystal Enterprise Installation Guide. See the Platforms.txt file

included with your product distribution for a complete list of tested databasesoftware and version requirements.

Note:

• It is strongly recommended that you back up the APS database frequently. The backup procedure depends upon your database software. If you are unsure of the procedure, consult with your database administrator.





• The APS database should not be accessed directly. System information shouldonly be retrieved using the API calls that are provided in the Crystal EnterpriseSoftware Development Kit (SDK). See the Crystal Enterprise Web Developer’sGuide for details.

On Windows, the Setup program can install and configure its own Microsoft DataEngine (MSDE) database if necessary. APS clustering is automatically supported by the default MSDE database. MSDE is a client/server data engine that provideslocal data storage and is compatible with Microsoft SQL Server. If you alreadyhave the MSDE or SQL Server installed, the installation program uses it to createthe APS database. You can migrate your default APS database to a supporteddatabase server later.

For details about configuring the APS, its database, and APS clusters, see“Configuring the intelligence tier” on page 204.

File Repository Servers

There is one Input and one OutputFile Repository Server in every Crystal Enterpriseimplementation. The Input File Repository Server contains all of the report objectsthat have been published to the system by administrators or end users (using theCrystal Publishing Wizard, the Crystal Management Console, the Crystal ImportWizard, or a Crystal designer component such as Crystal Reports). The Output FileRepository Server contains all of the report instances generated by the Job Server(s).

Tip: If you use the Crystal Enterprise SDK, you can also publish reports fromwithin your own code.

The File Repository Servers are responsible for listing files on the server, queryingfor the size of a file, querying for the size of the entire file repository, adding files

to the repository, and removing files from the repository.

Note: The Input and Output File Repository Servers cannot share the samedirectories. This is because one of the File Repository Servers could then deletefiles and directories belonging to the other.

Event Server

The Event Server manages file-based events. When you set up a file-based eventwithin Crystal Enterprise, the Event Server monitors the directory that youspecified. When the appropriate file appears in the monitored directory, the EventServer triggers your file-based event: that is, the Event Server notifies the APS that

the file-based event has occurred. The APS then starts any jobs that are dependentupon your file-based event.

After notifying the APS of the event, the Event Server resets itself and againmonitors the directory for the appropriate file. When the file is newly created in themonitored directory, the Event Server again triggers your file-based event.



Processing tier


Cache Server

The Cache Server is responsible for handling all viewing requests from the WCS.The Cache Server checks whether or not it can fulfill the request with a cachedreport page. If it cannot, it passes the request along to the Page Server. The Page

Server runs the report and returns the results to the Cache Server. The CacheServer then caches the information and returns the data to the WCS. By storingreport pages in a cache, Crystal Enterprise avoids accessing the database each andevery time a report is requested.

If you are running multiple Page Servers for a single Cache Server, the CacheServer automatically balances the processing load across Page Servers. For moreinformation, see “Modifying Cache Server performance settings” on page 216.

Processing tier

The processing tier accesses the data and generates the reports. It is the only tierthat interacts directly with the databases that contain the report data.

Note: If you install Crystal Analysis, your OLAP data is accessed from the WCS in

the intelligence tier.

Job Server

The Job Server processes scheduled reports, as requested by the APS, andgenerates report instances (instances are versions of a report object that containsaved data). To generate a report instance, the Job Server communicates with thedatabase to retrieve the current data.

Page Server

The Page Server’s primary responsibility is to receive page requests from the

Cache Server and to generate Encapsulated Page Format (EPF) pages. The PageServer then returns the EPF pages to the Cache Server. The EPF pages containformatting information that defines the layout of the report. The data for the reportis saved with the report or retrieved on demand from the database.





Data tierThe data tier is made up of the databases that contain the data used in the reports.Crystal Enterprise supports a wide range of corporate databases.

See the Platforms.txt file included with your product distribution for a completelist of tested database software and version requirements.

Information FlowThis section describes the interaction of the server components in order todemonstrate how report-processing is performed. This section covers twodifferent scenarios:

• “What happens when you view a report?” on page 193

• “What happens when you schedule a report?” on page 194

What happens when you view a report?

When a user requests to view a report using ePortfolio, the request is passed from

the web server to the Web Connector. The Web Connector handles all CrystalEnterprise requests that are made to the web server. The Web Connector thenpasses the request to the Web Component Server (WCS), which communicateswith the rest of Crystal Enterprise. Since the request was to view a report, the WCSpasses the request to the Cache Server.

The Cache Server checks to see if it has the requested pages cached. The cachedpages are stored as Encapsulated Page Format (.epf) files. If a cached version of the.epf file is available, the Cache Server checks with the Automated ProcessScheduler (APS) to see if the user has rights to view the report. Ifthe user is grantedthe right to view the report, the Cache Server sends the .epf file to the WCS.

If a cached version of the .epf file is unavailable, the Cache Server requests new .epf files from the Page Server. The Page Server retrieves the report from the Input FileRepository Server, first checking with the APS to see if the user has rights to viewthe report.

Note: If the user is granted View rights to the report object, then the Page Serverwill only ever generate pages of the latest report instance. That is, the Page Serverwill not retrieve the latest data from the database. If, however, the user is granted



Information Flow


View On Demand rights to the report object, then the Page Server will refresh thereport against the database.

If the user has sufficient rights, the Page Server generates the .epf pages andforwards them to the Cache Server. The Cache Server then caches the .epf files and

sends them to the WCS.Once the WCS receives the cached or generated .epf files from the Cache Server, itforwards the pagesthrough the WebConnectorto the user’s webbrowser.(If the useris using the DHTML Viewer, the WCS first converts the .epf file to an HTML page.)

What happens when you schedule a report?

When you schedule a report, you instruct Crystal Enterprise to process a reportobject at a particular point in time, or on a recurring schedule. For example, if youhave a report based off of your web server logs, you can schedule the report to runevery night on a recurring basis.

Tip: Crystal Enterprise also allows you to schedule jobs that are dependent uponother events. For details, see “Managing events overview” on page 180.

When a user schedules a report using ePortfolio, the request is passed from theweb server to the Web Connector. The Web Connector handles all CrystalEnterprise requests that are made to the web server. The Web Connector thenpasses the request to the Web Component Server (WCS), which communicateswith the rest of Crystal Enterprise. Since the request was to schedule a report, theWCS then passes the request to the Automated Process Scheduler (APS).

When the APS gets the request, it checks to see if the user has sufficient rights toschedule the report. If the user has sufficient rights, the APS schedules the report

to run at the specified time(s). When the time occurs, the APS passes the job to the Job Server. The Job Server retrieves the report from the Input File RepositoryServer and runs the report against the database, thereby creating an instance of thereport. The Job Server then saves the report instance to the Output File RepositoryServer, and tells the APS that it has completed the job successfully.

Tip: For details about multiple time zones, see “Supporting ePortfolio users inmultiple time zones” on page 321.



Server management overview


Server management overviewCrystal Enterprise includes two key administrative tools that allow you to viewand to modify a variety of server settings. These two tools are the CrystalManagement Console and the Crystal Configuration Manager:

• Crystal Management Console (CMC)

The CMC is the web-based administration tool that allows you to view and tomodify server settings while Crystal Enterprise is running. For instance, youwill use the CMC when you need to change the status of a server, change serversettings, access server metrics, or create server groups. Because the CMC is aweb-based interface, you are able to configure your Crystal Enterprise serversremotely over the Internet or through your corporate intranet.

• Crystal Configuration Manager (CCM)

The CCM is a program that allows you to view and to modify server settingswhile Crystal Enterprise is offline. It also allows you to accomplish tasks that

require you to take Crystal Enterprise offline. For instance, you use the CCM tostop the Web Component Server (WCS) or the Automated Process Scheduler(APS), to start Crystal Enterprise after you have stopped the system completely,and to change the default server port numbers. This tool also allows you toconfigure Crystal Enterprise remotely over your corporate network.

You can accomplish some configuration tasks with both tools, while other tasksmust be performed with a specific tool. This chapter takes a task-orientedapproach to server management by first explaining the server settings that areavailable to you, and then by showing how to accomplish each task withwhichever tool(s) are appropriate.

Related topics

• For an overview of the multi-tier architecture and the Crystal Enterprise servercomponents, see “Crystal Enterprise Architecture” on page 185.

• For information about creating groups of servers, see “Server group overview”on page 254.

• With the Crystal Enterprise Software Development Kit (SDK), you can nowaccess and modify server metrics and settings from your own webapplications. For details, see the Crystal Enterprise Web Developer’s Guide.

Viewing current metrics

The CMC allows you to view server metrics over the Web. These metrics includegeneral information about each machine, along with details that are specific to thetype of server. The CMC also allows you to view system metrics, which includeinformation about your productversion, your APS, and your current system activity.

Tip: For an example of how to use server metrics in your own web applications,see the “View Server Metrics” sample on the Crystal Enterprise Launchpad.



12: Managing and Configuring Servers


Viewing current server metrics

The Servers management area of the CMC displays server metrics that providestatistics and information about each Crystal Enterprise server. The generalinformation displayed for each server includes information about the machine that

the server is running on—its name, operating system, total hard disk space, free harddisk space, total RAM, number of CPUs, and local time. The general informationalso includes the time the server started and the version number of the server.

This example shows the metrics for a Job Server that is runningon a machine calledPBROWNSEYB.

For some servers, the Metrics tab includes additional server-specific information:

• Input and Output File Repository Servers

The Metrics tab of each File Repository Server lists the root directory of the filesthat the server maintains, indicates the maximum idle time, and displays thenumber of active files and active client connections. It also lists the totalavailable hard disk space, as well as the number of bytes sent and received.

Each File Repository Server also has an Active Files tab, which lists thefilename, the number of readers, and the number of writers for each active file.

• Web Component ServerThe Metrics tab of the Web Component Server (WCS) includes statistical dataabout the requests that it handles. It lists the total number of requests, thecurrent number of requests, the total number of bytes sent, the average bytesper request, the total time taken, and the average time taken per request. Thisinformation is useful in determining how efficiently the WCS is handling therequests that are sent to it.



Viewing current metrics


• Cache Server

The Metrics tab of the Cache Server displays the maximum number of processing threads, the maximum cache size, the minutes before an idle job isclosed, the minutes between refreshes from the database, whether or not thedatabase is accessed whenever a viewer’s file (object) is refreshed, the locationof the cache files, the total threads running, the number of requests served, thenumber of bytes transferred, the cache hit rate, the number of currentconnections, and the number of requests that are queued.

The Metrics tab also provides a table that lists the Page Servers that the Cacheserver has connections to, along with the number of connections made to eachPage Server.

• Event Server

The Metrics tab of the Event Server contains statistics on the files that the serveris monitoring. This tab includes a table showing the file name, the number of clients using the event, and the last time the event occurred.

• Page ServerThe Metrics tab of the Page Server contains information on how the server isrunning. It lists the maximum number of simultaneous processing threads, thelocation of temporary files, the number of minutes before an idle job is closed,the number of current connections, the number of requests queued, the currentnumber of processing threads running, the total number of requests served,and the total bytes transferred.

• Job Server

The Metrics tab of the Job Server lists the current number of jobs that are beingprocessed, the total number of requests received, the total number of failed jobcreations, the processing mode, and the location of its temporary files.

• APSThe Metrics tab of the APS lists only the general information about the machineit is running on. The Properties tab, however, shows a list of users who haveactive sessions on the system. Click any user’s link to view the associatedaccount details.

To view server metrics

1 Go to the Servers management area of the CMC.

2 Click the link to the server whose metrics you want to view.

3 Click the Metrics tab.





To start, stop, or restart a Windows server with the CCM

1 Start the CCM.

2 Select the server that you want to start, stop, or restart.

3 On the toolbar, click the appropriate button.

You may be prompted for network credentials that allow you to start and stopservices running on the remote machine.

The CCM performs the action and refreshes the list of servers.

To start, stop, or restart a UNIX server with the CCM

Use the ccm.sh script. For reference, see “ccm.sh” on page 280.

Enabling and disabling servers

When you disable a Crystal Enterprise server, you prevent it from receiving and

responding to new Crystal Enterprise requests, but you do not actually stop theserver process. This is especially useful when you want to allow a server to finishprocessing all of its current requests before you stop it completely.

For example, you may want to stop a Job Server before rebooting the machine it isrunningon. However, you want to allowthe server to fulfill any outstandingreportrequests that are in its queue. First, you disable the Job Server so it cannot acceptany additional requests. Then, once it has finished processing current requests, youcan safely stop the server.

Note: The APS must be running in order for you to enable and/or disable otherservers.

To enable and disable servers over the Web


The icon associated with each server identifies its status. In this example, theEvent Server is disabled (but not stopped), and the remaining servers arerunning and enabled.

Toolbar Icon Action

Start the selected server.

Stop the selected server.

Restart the selected server.



Viewing and changing the current status of servers


2 Select the check box for the server whose status you want to change.

3 Depending upon the action you need to perform, click Enable or Disable.

To enable or disable a Windows server with the CCM

1 Start the CCM.

2 On the toolbar, click Enable/Disable.

3 When prompted, log on to your APS with the credentials that provide youwith administrative privileges to Crystal Enterprise.

4 Click Connect.

The Enable/Disable Servers dialog box appears.

This dialog box lists all of the Crystal Enterprise servers that are registered withyour APS. By default, servers running on remote machines are displayed asMACHINE.servertype. So, in this example, LCONNORS02.eventserver is an EventServer running on a remote machine called LCONNORS02. The server namedInput

is the Input File Repository Server running on the local machine. In thisexample, all of the listed servers are currently enabled.





5 To disable a server, clear the check box in the Server Name column.

This example disables all servers running on LCONNORS02.

6 Click OK to effect your changes and return to the CCM.

To enable or disable a UNIX server with the CCM

Use the ccm.sh script. For reference, see “ccm.sh” on page 280.

Printing, copying, and refreshing server status

When using the CCM on Windows, you can print and copy the properties of aserver, and refresh the list of servers.

To print the status of a server

1 Start the CCM.2 Select the server(s).

3 Click Print.

The Print dialog box appears.

4 Click OK.

A brief listing of the server’s properties is printed, including the Display Name,Version, Command Line, Status, and so on.

To copy the status of a server

To email the status of a server, you can copy the details from the CCM to your

email application.

1 Start the CCM.

2 Select the server(s).

3 Click Copy.

4 Paste the information into your email message.



Configuring the intelligence tier


To refresh the list of servers• To ensure you are looking at the latest information, click Refresh.

Note: Disabled servers may not appear in this list. Click Enable/Disable to view alist of servers and ensure that each is enabled.

Configuring the intelligence tierThis section includestechnical information and procedures that show how you canmodify settings for the Crystal Enterprise servers that make up the intelligencetier. If you are already familiar with the Crystal Enterprise architecture, you willrecognize this graphic representation of the intelligence tier.

The majority of the settings discussed here allow you to integrate Crystal Enterprise

more effectively with your current hardware,software,and network configurations.Consequently, the settings that you choose will depend largely upon your ownrequirements.

Note: This section does not show how to configure your web server with the WebConnector, nor does it show how to set up effective communication between theWeb Connector and the Web Component Server. These tasks are typicallyperformed when you install Crystal Enterprise. For details, see the CrystalEnterprise Installation Guide. For further troubleshooting, see “Working withFirewalls” on page 259 and “Path mapping overview” on page 298.

Clustering Automated Process Schedulers

If you have a large or mission-critical implementation of Crystal Enterprise, youwill probably want to run several APS machines together in an APS cluster. AnAPS cluster consists of two or more APS servers working together to maintain thesystem database. If a machine that is running one APS fails, a machine withanother APS will continue to service Crystal Enterprise requests. This “failover”





support helps to ensure that Crystal Enterprise users can still access informationwhen there is equipment failure.

This section shows how to add a new APS cluster member to a production systemthat is already up and running. When you add a new APS to an existing cluster,

you instruct the new APS to connect to the existing APS database and to share theprocessing workload with any existing APS machines. For information about yourcurrent APS and APS cluster, go to the Settings management area of the CMC andclick the Cluster tab.

Before clustering APS machines, note the following clustering requirements:

• Run each APS cluster member on the same operating system.

• Configure each machine similarly:

• Install the same operating system service packs and patches.

• Install the same version of Crystal Enterprise (including patches, if applicable).

• Ensure that each APS connects to the APS database in the same manner:whether you use native or ODBC drivers, ensure that the drivers are thesame on each machine.

• Check that each APS uses the same database user account and password toconnect to the APS database.

• Run each APS service/daemon under the same account. (On Windows, thedefault is the “LocalSystem” account.)

• Install each and every APS cluster member on the same subnet.

• If the database server is multihomed, add one of its valid IP addresses to thehosts file on each APS machine. This ensures that each cluster membercommunicates with the database on the same IP address, without relying upona WINS server for name to IP resolution.

Tip: By default, an APS cluster name reflects the name of the first APS that youinstall, but the cluster name is prefixed by the @ symbol. For instance, if yourexisting APS is called CRYSTALAPS, then the default cluster name is @CRYSTALAPS. Tomodify the default name, see “Changing the name of an APS cluster” on page 208 .

There are two ways to add a new APS cluster member. Follow the appropriateprocedure, depending upon whether or not you have already installed a second APS:

• “Installing a new APS and adding it to a cluster” on page 206

See this section if you have not already installed the new APS on its own machine.

• “Adding an installed APS to a cluster” on page 206

Follow this procedure if you have already installed a second, independent APS

on its own machine. While testing various server configurations, for instance,you might have set up an independent Crystal Enterprise system with its ownAPS. Follow this procedure when you want to incorporate this independentAPS into your production system.

Note: Back up your current APS database before making any changes. If necessary, contact your database administrator.





Installing a new APS and adding it to a cluster

When you install a new APS, you can quickly cluster it with your existing APS.

Run the Crystal Enterprise installation and setup program on the machine whereyou want to install the new APS cluster member. The setup program allows you toperform an Expand installation. During the Expand installation, you specify theexisting APS whose system you want to expand, and you select the componentsthat want to install on the local machine. In this case, specify the name of the APSthat is running your existing system, and choose to install a new APS on the localmachine. Then provide the Setup programwith the information it needs to connectto your existing APS database. When the Setup program installs the new APS onthe local machine, it automatically adds the server to your existing APS cluster.

For complete information on running the Setup program and performing theExpand installation, see the Crystal Enterprise Installation Guide.

Adding an installed APS to a clusterIn these steps, the independent APS refers to the one that you want to add to acluster. You will add the independent APS to your production APS cluster. Byadding an independent APS to a cluster, you disconnect the independent APSfrom its own database and instruct it to share the system database that belongs toyour production APS.

Before starting this procedure, ensure that you have a database user account withCreate, Delete, and Update rights to the database storing the Crystal Enterprisetables. Ensure also that you can connect to the database from the machine that isrunning the independent APS (through your database client software or throughODBC, according to your configuration).

Note: Back up your current APS database before beginning this procedure. If necessary, contact your database administrator.

To add an installed APS to a cluster on Windows

1 Use the CCM to stop the independent Crystal APS.

2 With the APS selected, click Specify APS Datasource on the toolbar.

The APS Database Setup dialog box appears.





3 Click Select a Data Source; then click OK.

4 In the Select Database Driver dialog box, specify whether you want to connectto the production APS database through ODBC, or through one of the nativedrivers.

5 Click OK.

6 The remaining steps depend upon the connection type you selected:

• If you selected ODBC, the Windows “Select Data Source” dialog boxappears. Select the ODBC data source that corresponds to your productionAPS database; then click OK. If prompted, provide your database

credentials and click OK. The CCM connects to the database server andadds the new APS to the cluster.

• If you selected a native driver, you are prompted for your database ServerName, your Login ID, and your Password. Once you provide thisinformation, the CCM connects to the database server and adds the newAPS to the cluster.

The SvcMgr dialog box notifies you when the APS database setup is complete.

7 Click OK.

8 Start the Crystal APS.

To add an installed APS to a cluster on UNIX

Use the apsdbsetup.sh script. For reference, see “apsdbsetup.sh” on page 283.





To copy APS data from a different APS database (version 8.0 or 8.5 of CrystalEnterprise) into your current APS database, follow the procedure that correspondsto your operating system and to the version of Crystal Enterprise whose data youwant to copy. In this scenario, your current APS database is the destination databasewhose tables are deleted before they are replaced with the copied data:

• “Copying data from a Crystal Enterprise 8.5 APS on Windows”

• “Copying data from a Crystal Enterprise 8 APS on Windows” on page 211

• “Copying data from a Crystal Enterprise 8.5 APS on UNIX” on page 212

To copy the current APS database from one database server to another, follow theprocedure that corresponds to your operating system. This is also the procedure tofollow if you want to move the default APS database (on Windows) from theMicrosoft Database Engine (MSDE) to a dedicated database server, such asMicrosoft SQL Server or Oracle. In this scenario, your current APS database is thesource environment. Its contents are copied to the destination database, which isthen established as the active database for the APS:

• “Copying data from a Crystal Enterprise 8.5 APS on Windows” on page 209• “Copying data from a Crystal Enterprise 8 APS on Windows” on page 211

Before starting these procedures, ensure that you have a database user accountwith Create, Delete, and Update rights to the database storing the CrystalEnterprise tables. Ensure also that you can connect to both databases—throughyour database client software or through ODBC, according to yourconfiguration—from the APS machine whose database you are replacing.

Note:

• When you copy data from one database to another, the destination database isinitialized before the new data is copied in. Thus, any existing contents of the

destination database are permanently deleted. (If the APS database is stored inOracle, all the Crystal Enterprise tables are deleted.)

• Back up both APS databases before beginning this procedure. If necessary,contact your database administrator.

• When you migrate an APS database, none of the objects on the system (reportobjects, report instances, folders, and so on) are actually moved. If you want toimport users, groups, folders, and reports from one system to another, see“Importing with the Crystal Import Wizard” on page 89.

Copying data from a Crystal Enterprise 8.5 APS on Windows

1 Use the CCM to stop the Crystal APS.






3 Click Copy data from another Data Source; then click OK.

The Specify Data Source dialog box appears.

4 Click Crystal Enterprise 8.5.

You must now specify the source APS database whose contents you want tocopy.

5 Click Specify.

6 In the Select Database Driver dialog box, specify whether you want to connectto the source APS database through ODBC, or through one of the nativedrivers.

7 Click OK.

8 The next steps depend upon the connection type you selected:

• If you selected ODBC, the Windows “Select Data Source” dialog boxappears. Select the ODBC data source that corresponds to the source APS

database; then click OK. If prompted, provide your database credentialsand click OK.

• If you selected a native driver, provide your database Server Name, yourLogin ID, and your Password; then click OK.

You are returned to the Specify Data Source dialog box. You must now specifythe destination APS database whose contents you want to replace with thecopied data.

Tip: If the correct destination database already appears in the “Copy to thefollowing data source” field, proceed to step 13.

9 Click Browse.

10 In the Select Database Driver dialog box, specify whether you want to connectto the destination APS database through ODBC, or through one of the nativedrivers.

11 Click OK.





12 The next steps depend upon the connection type you selected:

• If you selected ODBC, the Windows “Select Data Source” dialog boxappears. Select the ODBC data source that corresponds to the destinationAPS database; then click OK. If prompted, provide your database

credentials and click OK.• If you selected a native driver, provide your database Server Name, yourLogin ID, and your Password; then click OK.

You are returned to the Specify Data Source dialog box. You are now ready tocopy the APS data.

13 Click OK and, when prompted to confirm, click Yes.


14 Click OK.

15 Start the Crystal APS.

Copying data from a Crystal Enterprise 8 APS on WindowsNote: When you copy a version 8 APS database, the database and databaseschema are upgraded to version 8.5.



3 Click Copy data from another Data Source; then click OK.

The Specify Data Source dialog box appears.

4 Click Crystal Enterprise 8.

You must now specify the source APS database whose contents you want tocopy.

5 Click Specify.





Deleting and recreating the APS database

This procedure shows how to recreate (re-initialize) the current APS database. Byperforming this task, you destroy all data that is already present in the database.This procedure is useful, for instance, if you have installed Crystal Enterprise in a

development environment for designing and testing your own, custom webapplications. You can re-initialize the APS database in your developmentenvironment every time you need to clear the system of absolutely all its data.

Note:

• Back up your current APS database before beginning this procedure. If necessary, contact your database administrator.

• After recreating the APS database, you will have to enter your license keysagain. Log on to the CMC with the default Administrator account (which willhave been reset to have no password). Go to the Authorization managementarea and enter your information on the License Keys tab.

To recreate the APS database on Windows



3 In the APS Database Setup dialog box, click Recreate the current Data Source.

4 Click OK and, when prompted to confirm, click Yes.


5 Click OK.

You are returned to the CCM.

6 Start the Crystal APS.While it is starting, the APS writes required system data to the newly emptieddata source. You may need to click the Refresh button in the CCM to see thatthe APS has successfully started.

To recreate the APS database on UNIX

Use the apsdbsetup.sh script. For reference, see “apsdbsetup.sh” on page 283.

Selecting a new or existing APS database

Follow this procedure if you want to disconnect an APS from its current database

and connect it to an alternate database. When you complete these steps, none of thedata in the current database is copied into the alternate database. If the alternatedatabase is empty, the CCM initializes it by writing system data that is required byCrystal Enterprise. If the alternate database already contains Crystal Enterprisesystem data, the APS uses that data when it starts.





Generally, there are only a few times when you need to complete these steps:

• If you have changed the password for the current APS database, these stepsallow you to disconnect from, and then reconnect to, the current database.When prompted, you can provide the APS with the new password.

• If you want to select and initialize an empty database for Crystal Enterprise,these steps allow you to select that new data source.

• If you have restored an APS database from backup (using your standarddatabase administration tools and procedures) in a way that renders theoriginal database connection invalid, you will need to reconnect the APS to therestored database. (This might occur, for instance, if you restored the originalAPS database to a newly installed database server.)

Note: These steps are essentially the same as adding an APS to an existing cluster;in this case, however, there are no other APS machines already maintaining thedatabase. For complete details about APS clusters, see “Clustering AutomatedProcess Schedulers” on page 204.

To select a new or existing database for an APS on Windows



The APS Database Setup dialog box appears.

3 Click Select a Data Source; then click OK.

4 In the Select Database Driver dialog box, specify whether you want to connectto the new database through ODBC, or through one of the native drivers.

5 Click OK.





3 Make your changes on the Properties tab.

In this example, the Input File Repository Server is set to use D:\InputFRS\as itsroot directory. The server will remain idle for a maximum of 15 minutes.

4 Click either Apply or Update:

• Click Apply to submit changes and restart the server so that the changestake effect immediately.

• Click Update to save the changes. You must restart the server for thechanges to take effect.

Modifying Cache Server performance settings

The Properties tab of the Cache Server allows you to set the location of the cache

files, the maximum cache size, the maximum number of simultaneous processingthreads, the number of minutes before an idle job is closed, and the number of minutes between refreshes from the database.

The “Location of the Cache Files” setting specifies the absolute path to thedirectory on the Cache Server machine where the cached report pages (.epf files)are stored.

Note: The cache directory should be on a drive that is local to the server.

The “Maximum Cache Size Allowed” setting limits the amount of hard disk space(in KBytes) that is used to cache reports. When the Cache Server has to handle largenumbers of reports, or reports that are especially complex, a larger cache size isneeded. Generally, the larger you make the cache size, the better it is able to perform.

The “Maximum Simultaneous Processing Threads” setting limits the number of concurrent reporting requests that the Cache Server processes. The default value isacceptable for most, if not all, reporting scenarios. The ideal setting for yourreporting environment, however, is highly dependent upon your hardwareconfiguration, your database software, and your reporting requirements. Thus, itis difficult to discuss the recommended or optimum settings in a general way. It is





recommended that you contact your Crystal Decisions, Inc. sales representativeand request information about the Crystal Enterprise Sizing Guide. A CrystalServices consultant can then assess your reporting environment and assist you incustomizing these advanced configuration and performance settings.

The “Minutes Before an Idle Job is Closed” setting alters the length of time that theCache Server waits for further requests from an idle connection. Before you changethis setting, it is important to understand that setting a value too low can cause auser’s request to be closed prematurely, and setting a value that is too high cancause requests to be queued while the server waits for idle jobs to be closed.

The “Minutes Between Refreshes from Database” setting determines how longcached report pages are used before new data is requested from the database.Generally, the default value is acceptable: as with other performance settings, theoptimal value is largely dependent upon your reporting requirements.

To modify Cache Server performance settings


2 Click the link to the Cache Server whose settings you want to change.


In this example, the Cache Server retains most of the default settings, but the“Maximum Simultaneous Processing Threads” is decreased to 50.








Modifying the polling time of the Event Server

The Properties tab of the Event Server allows you to change the frequency withwhich the Event Server checks for file events. This “File Polling Interval” settingdeterminesthe number of seconds that the server waitsbetween polls. The minimum

value is 1 (one). It is important to note that, the lower the value, the more resourcesthe server requires.

Tip: On Windows, you can also change this setting in the CCM. Stop the EventServer and view its Properties. Then click the Configuration tab.

To modify the polling time


2 Click the link to the Event Server whose settings you want to change.


The value that you type must be 1 or greater.4 Click either Apply or Update:



Modifying logging behavior of the Web Component Server

The Properties tab of the Web Component Server (WCS) allows you to specify thelocation of its log files and the types of information that it logs for each Crystal

Enterprise web request.

The web attributes that you can audit include: Date, Time, IP address and port,Duration, Bytes transferred, Used cache, Method, URI, URI-stem, URI-query, andStatus. There are no performance penalties for logging this information. It isrecommended that you leave logging enabled.

To change the logging behavior of the WCS


2 Click the link to the WCS whose settings you want to change.






This example shows the Logging area of the Properties tab. Here, the log filesare saved to the default file location for a WCS that is running on Windows.




Modifying report viewing and viewer options

The Properties tab of the WCS allows you to modify report viewing settings thataffect all users on the system. You can change the default directory where the WCSstores its temporary image files. And you can customize the “look and feel“ of thedifferent viewer controls to suit users’ preferences or to suit your administrativerequirements.

Tip: On Windows, you can also change some of these settings inthe CCM. Stop theWCS and view its Properties. Then click the Configuration tab.

This table lists the properties that you can change for each of the viewer controls.

Viewer Property DHTML Viewer ActiveX Viewer Java Viewer

Drilldown for moredetail

Supported Supported Supported

Hide the Group Tree(if it is displayed)

Supported Supported Supported

Group Tree Not Supported Supported Supported

Refresh Report data Not Supported Supported Supported

Search the Report Not Supported Supported Supported

Export the Report Not Supported Supported Supported

Zoom Not Supported Supported Supported

Print the Report Not Supported Supported Supported





Tip: On the Properties tab, use the NT Single Sign On check box only when you arerunning more than one WCS. (If you are running a single WCS, use the CCMinstead.) This feature requires your web server to support NT Challenge/Response or Integrated Windows Authentication. For more information on NTSingle Sign On, see “Setting up NT Single Sign On” on page 52.

To modify report viewing and viewer settings


2 Click the link to the WCS whose settings you want to change.


This example shows the Report Viewing area of the Properties tab. Here, theWCS is using the default values.




Product logo(if applicable)

Not Supported Supported Supported

Report Navigationtoolbar Supported Not Supported Not Supported

Viewer Property DHTML Viewer ActiveX Viewer Java Viewer





Configuring the processing tierThis section includestechnical information and procedures that show how you canmodify settings for the Crystal Enterprise servers that make up the processing tier.The processing tier includes one or more Job Servers and one or more Page Servers.

The majority of the settings discussed here allow you to integrate CrystalEnterprise more effectively with your current hardware, software, and networkconfigurations. Consequently, the settings that you choose will depend largely

upon your own requirements.

Modifying Page Server performance settings

The Properties tab of the Page Server lets you set the location of temporary files,the maximum simultaneous processing threads, and the number of minutes beforean idle job is closed.

The “Location of Temp Files” setting specifies the absolute path to a directory onthe Page Server machine.This directory must have plenty of free hard disk space.If not enough disk space is available, job processing may be slower than usual, or job processing may fail.

The “Maximum Simultaneous Processing Threads” setting limits the number of concurrent reporting requests that any single Page Server processes. The defaultvalue is acceptable for most, if not all, reporting scenarios. The ideal setting foryour reporting environment, however, is highly dependent upon your hardwareconfiguration, your database software, and your reporting requirements. Thus, itis difficult to discuss the recommended or optimum settings in a general way. It isrecommended that you contact your Crystal Decisions, Inc. sales representativeand request information about the Crystal Enterprise Sizing Guide. A CrystalServices consultant can then assess your reporting environment and assist you incustomizing these advanced configuration and performance settings.

The “Minutes Before an Idle Job is Closed” setting alters the length of time that thePage Server waits for further requests from an idle connection. Before you changethis setting, it is important to understand that setting a value too low can cause auser’s request to be closed prematurely, and setting a value that is too high cancause requests to be queued while the server waits for idle jobs to be closed.



Configuring the processing tier


To modify Page Server performance settings


2 Click the link to the Page Server whose settings you want to change.

3 Make your changes on the Properties tab.In this example, the “Maximum Simultaneous Processing Threads” is increasedto 80.




Modifying the number of jobs per Job Server

By default, the Job Server runs jobs as independent processes rather than asthreads. This method allows for more efficient processing of large, complex reports.The “Maximum Jobs Allowed” setting limits the number of concurrentindependent processes (child processes) that the Job Server allows—that is, it limitsthe number of scheduled reports that the Job Server will process at any one time.You can tailor the maximum number of jobs to suit your reporting environment.

The default “Maximum Jobs Allowed” setting is acceptable for most, if not all,reporting scenarios. The ideal setting for your reporting environment, however, is

highly dependent upon your hardware configuration, your database software, andyour reporting requirements. Thus, it is difficult to discuss the recommended oroptimum settings in a general way. It is recommended that you contact yourCrystal Decisions, Inc. sales representative and request information about theCrystal Enterprise Sizing Guide. A Crystal Services consultant can then assess yourreporting environment and assist you in customizing these advancedconfiguration and performance settings.





To modify the number of jobs


2 Click the link to the Job Server whose settings you want to change.

3 Make your changes on the Properties tab.4 Click Update.

5 Return to the Servers management area of the CMC and restart the Job Server.

Setting default scheduling destinations for Job Servers

By default, when users schedule reports, the report instances are saved to theOutput File Repository Server. However, Crystal Enterprise also allows users tospecify other output destinations for scheduled reports. The supported outputdestinations are unmanaged disk, FTP, and email (Simple Mail Transfer Protocol,or SMTP). This section shows how to set up destination support on the Job Servers.

You must perform these tasks in order to enable the “schedule to destinations”features offered by Crystal Enterprise.

For complete information about scheduling reports to particular destinations, see“Selecting a destination” on page 166.

Setting the default disk destination



3 On the Destinations tab, click the Crystal Enterprise.DiskUnmanaged link.

4 On the Properties tab, set the default values to be used at schedule time:

• Destination Directory

Type the absolute path to the directory. The directory can be on a localdrive of the Job Server machine, or on any other machine that you canspecify with a UNC path.




Select this option if you want to specify a file name—you can also add a

variable to the file name. To add a variable, choose a placeholder for avariable property from the list and click Add. When each instance runs, thevariable is replaced with the appropriate information. For example, whenyou add the variable “Owner,” the file name of each report includes thereport owner’s name.

• User Name

Specify a user who has permission to write files to the destination directory.





• Password

Type the password for the user.

In this example, the destination directory is on a network drive that is accessibleto the Job Server machine through a UNC path. Each file name will be

randomly generated, and a user name and password have been specified togrant the Job Server permission to write files to the remote directory.

5 Click Update.

Setting the default FTP destination



3 On the Destinations tab, click the Crystal Enterprise.Ftp link.

4 On the Properties tab, set the default values to be used at schedule time:

• Host

Enter your FTP host information.

• Port

Enter the FTP port number (the standard FTP port is 21).

• FTP User Name

Specify a user who has the necessary rights to upload a report to the FTPserver.

• FTP Password

Enter the user’s password.





• Account

Enter the FTP account information, if required.

Account is part of the standard FTP protocol, but it is rarely implemented.Provide the appropriate account only if your FTP server requires it.

• Destination DirectoryEnter the FTP directory that you want the report to be saved to. A relativepath is interpreted relative to the root directory on the FTP server.





In this example, all of the required FTP information is provided. Reports

scheduled to this destination are randomly named and uploaded to theftp.crystaldecisions.com site.

5 Click Update.

Setting the default email (SMTP) destination



3 On the Destinations tab, click the Crystal Enterprise.Smtp link.





4 On the Properties tab, complete these required fields with the information thatcorresponds to your SMTP server:

• Domain Name

Enter the fully qualified domain of the SMTP server.

• Server NameEnter the name of the SMTP server.

• Port

Enter the port that the SMTP server is listening on. (This standard SMTPport is 25.)

• Authentication

Select Plain or Login if the Job Server must be authenticated using one of these methods in order to send email.

• SMTP User Name

Provide the Job Server with a user name that has permission to send emailand attachments through the SMTP server.

• SMTP Password

Provide the Job Server with the password for the SMTP server.

• From

Provide the return email address.

In this example, the SMTP server resides in the crystaldecisions.com domain.Its name is EMAIL_SERV and it is listening on the standard SMTP port. Plain textauthentication is being used, and an account called CrystalJobAccount has beencreated on the SMTP server for use by the Job Server.

5 Complete the optional email fields (To, Cc, Subject, and Message) if you wantto set default values for users who schedule reports to this SMTP destination.

Note: Users can override these defaults with their own values when they

schedule reports to this SMTP destination.

6 Select one of these required fields to specify file names:









7 Click Update.

Configuring Windows processing servers for your data source

When started on Windows, Job Servers and Page Servers by default log on to thelocal system as services with the Windows NT/2000 “LocalSystem” account. Thisaccount determines the permissions that each service is granted on the localmachine. This account does not grant the service any network permissions.

In the majority of cases, this account is irrelevant in relation to the server’s task of processing reports against your data source. (The database logon credentials arestored with the report object.) Thus, you can usually leave each server’s default

logon account unchanged or, if you prefer, you can change it to a Windows useraccount with the appropriate permissions.

However, there are certain cases when you must change the logon account used bythe Job Servers and Page Servers. These cases arise either because the server needsadditional network permissions to access the database, or because the databaseclient software is configured for a particular Windows user account. This table liststhe various database/driver combinations and shows when you must completeadditional configuration.

Tip: If your reports require ODBC connections, set up identical System Data SourceNames (DSNs) on each machine that is running a Job Server or a Page Server.Ensure that each of these DSNs matches the DSN that was used when the reportwas designed.

Database Driver Additional Configuration Required

Oracle™ NativeODBC (CROR8)OLE DB

None

Sybase™ NativeODBC (CRSYB)

None

LotusDomino®

Native None

Microsoft®SQL Server™

NativeODBC (CRSS)OLE DB

If you use SQL Server’s “Trusted Connection” setting, changeeach server’s log on account to a Windows user account thathas permissions within the database. (In this case, the databaselogon credentials stored with the report object should be blank.)

DB2™ Native None





Tip: Running a service under an Administrator account doesnot inadvertently grantadministrative privileges to another user, because userscannot impersonate services.

To change a processing server ’ s logon account 1 Use the CCM to stop the Job Server or Page Server.

2 Click Properties.

3 Clear the System Account check box.

DB2 ODBC (CRDB2) For on-demand viewing, configure the Page Server to closeidle jobs after one minute, thereby allowing other users toaccess the database. For details, see “Modifying Page Server

performance settings” on page 221.

Tip: IBM offersseveral client applicationsfor connecting to DB2.The recommended client is IBM DB2 Direct Connect, whoseODBC driverswere written for actual programmatic interactionwith products like Crystal Enterprise. See the Crystal CareKnowledge Base for discussions of this and other DB2 clients.

Informix® Native • Change the log on account for each Job Server/Page Serverto the account under which the Informix client was installed.

• Add the Informix bin directory to the System Path (forexample, C:\Informix\bin) environment variable.

Informix ODBC(CRINF9) • Change the log on account for each Job Server/Page Serverto the Windows user account under which the Informixclient was installed.

• For on-demand viewing, configure the Page Server to closeidle jobs after one minute, thereby allowing other users toaccess the database. For details, see “Modifying Page Serverperformance settings” on page 221.

MicrosoftExchange™

• Ensure that the Exchange profile is set up on the localmachine.

• Change the log on account of each Job Server/Page Serverto the Windows user account that has access to the mailbox

in which the report data is located.PC databases(Btrieve™,MicrosoftAccess™,Paradox™,XML)

Native, ODBC • If the database is installed on the server’s local machine, noadditional configuration is required.

• If the Job Server/Page Server must access the database overthe network, change the server’s log on account to aWindows domain user account that has the appropriatenetwork permissions. Ensure that the account has READaccess to the shared resource.

Database Driver Additional Configuration Required





4 Enter the Windows NT/2000 user name and password information.

When started, the server process will log on to the local machine with this useraccount. In addition, all reports processed by this server will be formatted usingthe printer settings associated with the user account that you enter.

5 Click Apply, and then click OK.

6 Start the server.

Note: Repeat this procedure for each Job Server and Page Server that needs toaccess the database.

Configuring UNIX processing servers for your data source

TheJob Server and Page Server support native and ODBC connections to a numberof reporting databases. This section discusses the environment variables, software,and configuration files that must be available to the servers in order for them toprocess reports successfully. Whether your reports use native or ODBC drivers,

ensure that the reporting environment configured on the server accurately reflectsthe reporting environment configured on the Windows machine that you usewhen designing reports with Crystal Reports.

See the Platforms.txt file included with your product distribution for a completelist of tested database software and version requirements.

Native drivers

If you design reports using native drivers, you must install the appropriate databaseclient software on each Job Server and/or Page Server machine that will process thereports. The server loads the clientsoftware at runtime in order to access the database

that is specified in the report. The server locates the client software by searching thelibrary path environment variable that corresponds to your operating system(LD_LIBRARY_PATH on Sun Solaris, LIBPATH on IBM AIX, and so on), so this variablemust be defined for the login environment of each Job Server and Page Server.

Depending on your database, additional environment variables may be requiredfor the Job Server and Page Server to use the client software. These include:

• Oracle

The ORACLE_HOME environment variable must define the top-level directory of the Oracle client installation.

• Sybase

The SYBASE environment variable must define the top-level directory of the

Sybase client installation. The SYBPLATFORM environment variable must definethe platform architecture.

• DB2

The DB2INSTANCE environment variable must define the DB2 instance that isused for database access. Use the DB2 instance initialization script to ensurethat the DB2 environment is correct.





ODBC environment variables

The environment variables related to ODBC reporting are: the library path thatcorresponds to your operating system (LD_LIBRARY_PATH on Sun Solaris, LIBPATHonIBM AIX, and so on), ODBC_HOME, and ODBCINI. The Crystal Enterprise installation

includes a file called env.csh that is sourced automatically every time you start theCrystal Enterprise servers with the CCM. Thus, the environment for the Job Serverand Page Server is set up automatically:

• The INSTALL_ROOT /crystal/enterprise/platform/odbc/lib directory of yourinstallation is added to the library path environment variable.

• The ODBC_HOME environment variable is set to the INSTALL_ROOT /crystal/enterprise/platform/odbc directory of your installation.

• The ODBCINI environment variable is defined as the path to the .odbc.ini filethat was created by the Crystal Enterprise installation.

Modify the environment variables in the env.csh script only if you havecustomized your configuration of ODBC. The main ODBC configuration file that

you need to modify is the system information file.

Working with the ODBC system information file

The system information file (.odbc.ini) is created in the HOME directory of the useraccount under which you installed Crystal Enterprise (typically the crystal useraccount). In this file, you define each of the ODBC data sources (DSNs) that the JobServer and Page Server need in order to process your reports. The CrystalEnterprise installation completes most of the required information—such as thelocation of the ODBC directory and the name and location of each installed ODBCdriver—and shows where you need to provide additional information.

Tip: A template of the system information file is installed to INSTALL_ROOT /crystal/defaultodbc.ini

The following example shows the contents of a system information file that definesa single ODBC DSN for servers running on UNIX. This DSN allows the Job Serverand Page Server to process reports based on a System DSN (on Windows) calledCRDB2:

[ODBC Data Sources]

CRDB2=MERANT 3.70 DB2 ODBC Driver

[CRDB2]

Driver=/opt/crystal/enterprise/platform/odbc/lib/crdb216.so

Description=MERANT 3.70 DB2 ODBC Driver

Database=myDB2serverLogonID=username

[ODBC]

Trace=0

TraceFile=odbctrace.out

TraceDll=/opt/crystal/enterprise/platform/odbc/lib/odbctrac.so

InstallDir=/opt/crystal/enterprise/platform/odbc





As shown in the example above, the system information file is structured in threemajor sections:

• The first section, denoted by [ODBC Data Sources], lists all the DSNs that aredefined later in the file. Each entry in this section is provided as dsn=driver,

and there must be one entry for every DSN that is defined in the file. The valueof dsn must correspond exactly to the name of the System DSN (on Windows)that the report was based off.

• The second section sequentially defines each DSN that is listed in the firstsection. The beginning of each definition is denoted by [dsn]. In the exampleabove, [CRDB2] marks the beginning of the single DSN that is defined in the file.

Each DSN is defined through a number of option=value pairs. The options thatyou must define depend upon the ODBC driver that you are using. These pairsessentially correspond to the Name=Data pairs that Windows stores for eachSystem DSN in the registry:

\\HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\odbc.ini\dsn

However, the options for a particular ODBC driver on UNIX may notcorrespond by name to the options available for a Windows version of the samedriver. For example, some Windows drivers store a UID value in the registry,and on UNIX you may need to specify this value with the LogonID option.

Note: For detailed documentation on each ODBC driver, see the MerantConnect ODBC Reference (odbcref.pdf). The PDF is installed below the crystal/enterprise/platform/odbc directory; it is also located in the docdirectory of your product distribution.

• The final section of the file, denoted by [ODBC], includes ODBC tracinginformation. You need not modify this section.

When the installation creates the system information file, it completes some fields

and sets up a number of default DSNs—one for each of the installed ODBC drivers.The standard options that are commonly required for each driver are included inthe file (Database=, LogonID=, and so on). Edit the file and provide thecorresponding values that are specific to your reporting environment.

This example shows the entire contents of a system information file created whenCrystal Enterprise was installed to the /usr/local directory.

[ODBC Data Sources]

CRDB2=MERANT 3.70 DB2 ODBC Driver

CRINF_CL=MERANT 3.70 Informix Dynamic Server ODBC Driver

CROR8=MERANT 3.70 Oracle8 ODBC Driver

CRSS=MERANT 3.70 SQL Server ODBC Driver

CRSYB=MERANT 3.70 Sybase ASE ODBC DriverCRTXT=MERANT 3.70 Text ODBC Driver

[CRDB2]

Driver=/usr/local/crystal/enterprise/platform/odbc/lib/crdb216.so

Description=MERANT 3.70 DB2 ODBC Driver

Database=

LogonID=





[CRINF_CL]

Driver=/usr/local/crystal/enterprise/platform/odbc/lib/crifcl16.so

Description=MERANT 3.70 Informix Dynamic Server ODBC Driver

ServerName=

HostName=

PortNumber=

Database=

LogonID=

[CROR8]

Driver=/usr/local/crystal/enterprise/platform/odbc/lib/cror816.so

Description=MERANT 3.70 Oracle8 ODBC Driver

ServerName=

ProcedureRetResults=1

LogonID=

[CRSS]

Driver=/usr/local/crystal/enterprise/platform/odbc/lib/crmsss16.so

Description=MERANT 3.70 SQL Server ODBC DriverAddress=

Database=

QuotedId=Yes

LogonID=

[CRSYB]

Driver=/usr/local/crystal/enterprise/platform/odbc/lib/crase16.so

Description=MERANT 3.70 Sybase ASE ODBC Driver

NetworkAddress=

Database=

LogonID=

[CRTXT]Driver=/usr/local/crystal/enterprise/platform/odbc/lib/crtxt16.so

Description=MERANT 3.70 Text ODBC Driver

Database=

[ODBC]

Trace=0

TraceFile=odbctrace.out

TraceDll=/usr/local/crystal/enterprise/platform/odbc/lib/odbctrac.so

InstallDir=/usr/local/crystal/enterprise/platform/odbc

Adding a DSN to the default ODBC system information file

When you need to add a new DSN to the installed system information file(.odbc.ini) file, first add the new DSN to the bottom of the [ODBC Data Sources]list. Then add the corresponding [dsn] definition just before the [ODBC] section.



Logging server activity


For example, suppose that you have a Crystal report that uses ODBC drivers toreport off your Oracle8 database. The report is based off a System DSN (onWindows) called SalesDB. To create the corresponding DSN, first append this lineto the [ODBC Data Sources] section of the system information file:

SalesDB=MERANT 3.70 Oracle8 ODBC DriverThen define the new DSN by adding the following lines just before the systeminformation file’s [ODBC] section:

[SalesDB]

Driver=/usr/local/crystal/enterprise/platform/odbc/lib/cror816.so

Description=MERANT 3.70 Oracle8 ODBC Driver

ServerName=MyServer

ProcedureRetResults=1

LogonID=MyUserName

Once you have added this information, the new DSN is available to the Job Serverand Page Server, so they can process reports that are based off the SalesDB SystemDSN (on Windows).

Logging server activityCrystal Enterprise allows you to log specific information about Crystal Enterpriseweb activity. For details on locating and customizing the web activity logs, see“Modifying logging behavior of the Web Component Server” on page 218.

In addition, each of the Crystal Enterprise servers is designed to log messages toyour operating system’s standard system log:

• On Windows NT/2000, Crystal Enterprise logs to the Event Log service. Youcan view the results with the Event Viewer (in the Application Log).

• On UNIX, Crystal Enterprise logs to the syslog daemon as a User application.Each server prepends its name and PID to any messages that it logs.

This example shows two messages logged to the syslog daemon on UNIX:





Each server also logs assert messages to the logging directory of your productinstallation. The programmatic information logged to these files is typically usefulonly to Crystal Decisions support staff for advanced debugging purposes. Thelocation of these log files depends upon your operating system:

• On Windows, the default logging directory is C:\Program Files\Crystal

Decisions\Logging

• On UNIX, the default logging directory INSTALL_ROOT /crystal/loggingdirectory of your installation.

The important point to note is that these log files are cleaned up automatically, sothere will never be more than approximately 1 MB of logged data per server. If youneed to reduce the size of these log files for a particular server, or if you want toeliminate the log files entirely, stop the server and add the following command tothe server’s command line:

-maxlogfilesize <# of bytes>

Replace <# of bytes> with 0 (zero) to eliminate the log files. The procedure formaking this modification depends upon your operating system:

• On Windows, use the CCM to stop the server. Then open the server’s Propertiesto modify the command line. Start the server again when you have finished.

• On UNIX, run ccm.sh to stop the server. Then edit ccm.config to modify theserver’s command line. Start the server again when you have finished. Forreference, see “ccm.sh” on page 280.

Advanced server configuration optionsThis section includes additional configuration tasks that you may want to perform,

depending upon your reporting environment.

Changing the default server port numbers

During installation, the APS and the WCS are set up to use default port numbers.The default APS port number is 6400, and the default WCS port number is 6401.These ports fall within the range of ports reserved by Crystal Decisions, Inc. (6400to 6410). Thus, Crystal Enterprise communication on these ports should notconflict with third-party applications that you have in place. (Although unlikely, itis possible that your custom applications use these ports. If so, you can change thedefault APS and WCS ports.)

When started and enabled, each of the other Crystal Enterprise servers dynamically binds to an available port (higher than 1024), registers with this port on the APS,and then listens for Crystal Enterprise requests. If necessary, you can instruct eachserver component to listen on a specific port (rather than dynamically selecting anyavailable port).



Advanced server configuration options


On Windows, you view and modify server command lines with the CCM. TheCommand field appears on each server’s Properties tab. On UNIX, you view andmodify server command lines (also referred to as launch strings) in the ccm.configfile, which is installed in the crystal directory.

This table summarizes the command-line options as they relate to port usage forspecific server types.

Before modifying any port numbers, consider the following:

• If you change the default APS port number, you must change the -ns option inevery other server’s command line, to ensure that each server connects to theappropriate port of the APS. (The -nsoption stands for “nameserver.” TheAPS functions as the nameserver in Crystal Enterprise, because it maintains alist that includes the host name and port number of each server that is started,enabled, and thus available to accept Crystal Enterprise requests.)

• If you change the default WCS port number, you must make correspondingchanges to the mapping that allows the Web Connector to communicate withthe WCS. For information about configuring your Web Connector and any of your web server configuration files, see “Path mapping overview” onpage 298.

• If the machine is multihomed, you can restrict Crystal Enterprise to one of theavailable particular network addresses. For details, see “Configuring CrystalEnterprise on a multihomed machine” on page 238.

• On Windows, the CCM displays default port numbers on each server’sConfiguration tab. This displayed port corresponds to the -port option. Forserver’s other than the APS and the WCS, this default port is not actually inuse (each server registers its -requestPort number with the APS instead).

Option APS WCS Other Servers

-port Specifies the primaryCrystal Enterpriseport on which the APSlistens for requestsfrom all other servers.The default is 6400.

Specifies the port on whichthe WCS listens for webrequests from the WebConnector. The default is6401.

Used only in multihomedenvironments or for certainNAT firewall environments.In both cases, specify -portinterface:portnumber (andnot just -port number).

-requestPort Specifies the

secondary port thatthe APS uses foridentifying otherservers and forregistering with itself and/or a cluster.Selected dynamicallyif unspecified.

Specifies the port on which

the WCS listens for repliesfrom the APS and the otherservers. The WCS registersthis port with the APS.Selected dynamically if unspecified.

Specifies the port on which

the server listens for CrystalEnterprise requests. Theserver registers this port withthe APS. Selecteddynamically if unspecified.

-ns n/a Specifies the APS that theWCS will register with.

Specifies the APS that theWCS will register with.





To change the default APS port

1 Use the CCM to stop all the Crystal Enterprise servers.

2 Add (or modify) the following option in the APS command line:

-port numberReplace number with the port that you want the APS to listen on. (The defaultport is 6400.)

3 Add (or modify) the following option in the command line of all of theremaining non-APS Crystal Enterprise servers:

-ns hostname:number

Replace hostname with the host name of the machine that is running the APS.The host name must resolve to a valid IP address within your network. Replacenumber with the port that the APS is listening on.

4 Start and enable all the Crystal Enterprise servers.

The APS begins listening on the port specified by number, and the non-APSservers broadcast to that port when attempting to register with the APS.

To change the default WCS port

1 Use the CCM to stop all the Crystal Enterprise servers.

2 Add (or modify) the following option in the WCS command line:

-port number

Replace number with the port that you want the WCS to listen on. (The defaultport is 6401.)

3 Reconfigure the Web Connector so that it forwards Crystal Enterprise requeststo the WCS host on the new port specified by number.

For details, see “Path mapping overview” on page 298.

To change the port a server registers with the APS

1 Use the CCM to stop the server.

2 Add (or modify) the following option in the server’s command line:

-requestPort number

Replace number with the port that you want the server to listen on.

3 Start and enable the server.

The server binds to the new port specified by number. It then registers with the APSand begins listening for Crystal Enterprise requests on the new port.

By default, each server registers itself with the APS by IP address, rather than byname. This typically provides the most reliable behavior. If you need each server toregister with the APS by fully qualified domain name instead, use the -requestPort





option in conjunction with -port interface:port (where interface is the server’sfully qualified domain name). Having the servers register by name can be useful if a NAT firewall resides between the server and the APS. For more information, see“Configuring for Network Address Translation” on page 263.

You may also need to specify -port interface:port when Crystal Enterprise isrunning on a multihomed machine.

Configuring Crystal Enterprise on a multihomed machine

A multihomed machine is one that has multiple network addresses. You mayaccomplish this with multiple network interfaces, each with one or more IPaddresses, or with a single network interface that has been assigned multiple IPaddresses. In either case, Crystal Enterprise responds to requests made to allavailable addresses by default. However, you can configure Crystal Enterprise toservice only one of the available network addresses.

The number of servers that you must configure depends upon how restrictive youneed to be, and whether or not the available network addresses are all resolved bythe same Domain Name Service (DNS) in your network. The surest way to restrictCrystal Enterprise communication to one of the available network addresses is toconfigure each of the server components that is installed on the multihomedmachine. For this purpose, each of the servers supports interface as a commandline parameter.

Tip: This section shows how to restrict all servers to the same network address, butit is possible to bind individual servers to different addresses. For instance, you mightwant to bind the File Repository Servers to a private address that is notroutable fromusers’ machines. Advanced configurations such as this require your DNS

configuration to route communications effectively between all the Crystal Enterpriseserver components. In this example, the DNS must route communications from theother Crystal Enterprise servers to the private address of the File Repository Servers.

Restricting the APS and the WCS to a network address

The APS and the WCS require their own ports, so add the following option to bothof their command lines:

-port interface:port

If the machinehas multiple network interfaces,interface can be the fullyqualifieddomain name or the IP address of the interface that you want the server to bind to.

If the machine has a single network interface, interface must be the IP addressthat you want the server to bind to.

Note: To retain the default port numbers, replace port with 6400 for the APS, andwith 6401 for the WCS. If you change the default port numbers, you will need tomake additional configuration changes. For details, see “Changing the defaultserver port numbers” on page 235.





Restricting the remaining servers to the same network address

The remaining Crystal Enterprise servers select their ports dynamically by default,so you need only add the following option to their command lines:

-port interface

Replace interface with the same value that you specified for the APS and theWCS. Ensure that each server’s -nsparameter points to the APS, and that the DNSresolves the value to the appropriate network address.

Adding and removing Windows server dependencies

When installed on Windows, each server in Crystal Enterprise is dependent on atleast three services: the Event Log, NT LM Security Support Provider, and RemoteProcedure Call (RPC) services. If you are having problems with a server, check toensure that all three services appear on the server’s Dependency tab.

To add and remove server dependencies1 Use the CCM to stop the server whose dependencies you want to modify.

2 With the server selected, click Properties on the toolbar.

3 Click the Dependency tab.

As shown here, at least three services should be listed: Event Log, NT LMSecurity Support Provider, and Remote Procedure Call (RPC).





4 To add a dependency to the list, click Add.

The Add Dependency dialog box provides you with a list of all availabledependencies. Select the dependency or dependencies, as required, and thenclick Add.

5 To remove a dependency from the list, select it and click Remove.

6 Click OK.

7 Restart the server.

Changing the server startup type

When installed on Windows, each server is configured to start automatically. Aswith other Windows services, there are three startup types:

• Automatic starts the server each time the machine is started.

• Manual requires you to start the server before it will run.

• Disabled requires you to change the startup type to automatic or manual before it can run.

To change the server startup type on Windows

1 Start the CCM.

2 Stop the server whose startup type you want to modify.

3 With the server selected, click Properties on the toolbar.

4 Click the Startup Type list and select Automatic, Disabled, or Manual.

5 Click OK.

6 Restart the server.

To change the server startup type on UNIX

On UNIX, this requires root privileges. See “initlaunch.sh” on page 286.




Scaling Your System 13

This chapter details the common ways in which you should begin to scale, or expand, your Crystal Enterprise system.The chapter also provides general scalability considerations,and shows how to add server components to yourinstallation.



Scalability overview


Scalability overviewThe Crystal Enterprise architecture is scalable in that it allows for a multitude of server configurations, ranging from stand-alone, single-machine environments, tolarge-scale deployments supporting global organizations. The flexibility offered by the product’s architecture allows you to set up a system that suits your currentreporting requirements, without limiting the possibilities for future growth andexpansion.

This chapter details common scalability scenarios for administrators who want toexpand beyond a stand-alone installation of Crystal Enterprise. These threescenarios have received the most testing, and are recommended for the majority of deployments. For details, see “Common configurations” on page 243.

It must be emphasized, however, that the optimal configuration for yourdeployment will vary depending upon your hardware configuration, yourdatabase software, and your reporting requirements. It is recommended that you

contact your Crystal Decisions sales representative and request information aboutthe Crystal Enterprise Sizing Guide. A Crystal Services consultant can then assessyour reporting environment and assist in determining the configuration that will best integrate with your current environment.

Note: If you customize or expand your system beyond these commonconfigurations without first contacting Crystal Services, your deployment maynot be officially supported.

This chapter also provides the related procedures for adding and deleting serversfrom your Crystal Enterprise installation. Follow these steps when you need to addserver components to a machine that is already running Crystal Enterprise.

Tip: If you are adding new hardware to Crystal Enterprise by installing servercomponents on additional machines, run the Crystal Enterprise installation andsetup program. The setup program allows you to perform an Expand installation.During the Expand installation, you specify the existing APS whose system youwant to expand, and you select the components that want to install on the localmachine. For details, see the Crystal Enterprise Installation Guide.

Choosing between live and saved dataWhen reporting over the Web, the choice to use live or saved data is one of themost important decisions you’ll make. Whichever choice you make, however,

Crystal Enterprise displays the first page as quickly as possible, so you can seeyour report while the rest of the data is being processed.



13: Scaling Your System


Live dataOn-demand reporting gives users real-time access to live data, straight from thedatabase server. Use live data to keep users up-to-date on constantly changing data,so they can access information that’s accurate to the second. For instance, if the

managers of a large distribution center need to keep track of inventory shipped on acontinual basis, then live reporting is the way to give them the information they need.

Before providing live data for all your reports, however, consider whether or notyou want all of your users hitting the database server on a continual basis. If thedata isn’t rapidly or constantly changing, then all those requests to the database dolittle more than increase network traffic and consume server resources. In suchcases, you may prefer to schedule reports on a recurrent basis so that users canalways view recent data (report instances) without hitting the database server.

For more information about optimizing the performance of reports that are viewedon demand, see the “Designing Optimized Web Reports” section in the CrystalReports User’s Guide (version 8.5 and later).

Tip: Users require View On Demand access to refresh reports against the database.

Saved dataReport instances are useful for dealing with data that isn’t continually updated.When users navigate through report instances, and drill down for details oncolumns or charts, they don’t access the database server directly; instead, theyaccess the saved data. Consequently, reports with saved data not only minimizedata transfer over the network, but also lighten the database server’s workload.

You can schedule these reports within Crystal Enterprise so thatthey automaticallyrefresh from the database on a predetermined basis. For example, if your salesdatabase is only updated once a day, or once a week, then you can run the reporton a similar schedule. Sales representatives then always have access to current salesdata, but they aren’t hitting the database every time they open a report.

Tip: Users require only View access to display report instances.

Common configurationsThis section details the common ways in which you should begin to scale, orexpand, your Crystal Enterprise system. The scenarios described are those thathave been most thoroughly tested by Crystal Decisions, Inc. As a baseline, this

section assumes that you have not yet distributed the Crystal Enterprise serversacross multiple machines; however, this section does assume familiarity with theCrystal Enterprise architecture, installation, and server configuration. Forpreliminary installation information, see the Crystal Enterprise Installation Guide.

Tip: If you are deploying multi-processor machines, you may also want to run oneor more Crystal Enterprise servers in multiple instances on that machine. Fordetails, see “Adding a server” on page 249.



Common configurations


One-machine setup

This basic configuration separates the Crystal Enterprise servers from the rest of your reporting environment and from your web server. This grants the CrystalEnterprise servers their own set of processing resources, which they do not have to

share with database and web server processes. These are the general steps tosetting up this configuration:

• Install all of the Crystal Enterprise servers on a single, dedicated machine.

• Install and configure the Web Connector on your web server machine.

• Run the APS database on your database server.

If you are still using the MSDE APS database on Windows, migrate the APSdatabase to a supported database server. See the Platforms.txt file includedwith your product distribution for a list of supported database servers.

Three-machine setup

This second configuration divides the Crystal Enterprise processing load in alogical manner, based on the types of work performed by each server. In this way,you prevent the servercomponents from having to compete with each other for thesame hardware and processing resources. In addition, this scenario prepares yoursystem for further expansion to provide redundancy.

Note: It is recommended that you use three multi-processor machines (dual-CPUor better), with at least 2 GB RAM installed on each machine.

These are the general steps to setting up this configuration:

• Install the APS and the Event Server on one machine.

Tip: Here, the Event Server is installed on the same machine as the APS. In

general, however, the Event Server should be installed on the machine whereyour monitored, file-based events occur.

• Install the WCS and the Cache Server on the second machine.

• Install the Page Server, the Job Server, and the Input and Output FileRepository Servers on the third machine.

Six-machine setup

This third configuration mirrors the three-machine setup. You maintain the logical breakdown of processing based on the types of work performed by each server, but you increase the number of available machines and servers for redundancy

and fault-tolerance. Forinstance, if a serverstops responding, or if you need to takeone or two machines offline completely, you need not interrupt Crystal Enterpriserequests in order to service the system.

This tested configuration is designed to meet the reporting requirements of 85% of all deployment scenarios. If you have further requirements or more advancedconfiguration needs, contact your Crystal Decisions sales representative foradditional assistance.





Note: It is recommended that you use six multi-processor machines (dual-CPU or better), with at least 2 GB RAM installed on each machine.

• Install the three-machine setup first. Verify that Crystal Enterprise isfunctioning correctly.

• Install a second APS/Event Server pair on the fourth machine. This machinemust be on the same subnet as the APS that you have already installed.

Cluster the two APS services, so they share the task of maintaining the APSdatabase. Ensure that each APS accesses the APS database in exactly the samemanner (the same database client software, the same database user name andpassword, and so on).

Tip: Here, the Event Server is installed on the same machine as the APS. Ingeneral, however, the Event Server should be installed on the machine whereyour monitored, file-based events occur.

• Install a second WCS/Cache Server pair on the fifth machine.

Modify your Web Connector configuration to ensure that the Web Connector

communicates with the two distinct WCS hosts.• Install a second Page Server/Job Server on the remaining machine.

Ensure that all Page Servers and Job Servers can access your reporting databasein exactly the same manner. Install and configure any required database clientsoftware similarly on each machine, along with any ODBC DSNs that arerequired for your reports.

General scalability considerationsThis section provides information about system scalability and the CrystalEnterprise servers that are responsible for particular aspects of your system. Each

subsection focuses on one aspect of your system’s capacity, discusses the relevantcomponents, and provides a number of ways in which you might modify yourconfiguration accordingly.

Before modifying these aspects of your system, it is strongly recommended thatyou contact your Crystal Decisions sales representative and request informationabout the Crystal Enterprise Sizing Guide. A Crystal Services consultant can thenassess your reporting environment and assist in determining the configurationthat will best integrate with your current environment.

Increasing overall system capacity

As the number of report objects and users on your system increases, you canincrease the overall system capacity by clustering two (or more) AutomatedProcess Schedulers (APS). You can install multiple APS services/daemons on thesame machine. However, to provide server redundancy and fault-tolerance, youshould ideally install each cluster member on its own machine.



General scalability considerations


APS clusters can improve overall system performance because every CrystalEnterprise request results, at some point, in a server component querying the APSfor information that is stored in the APS database. When you cluster two APSmachines, you instruct the new APS to share in the task of maintaining andquerying the APS database.

For more information, see “Clustering Automated Process Schedulers” onpage 204.

Increasing scheduled reporting capacity

All Crystal reports that are scheduled are eventually processed by a Job Server.You can expand Crystal Enterprise by running individual Job Servers on multiplemachines, or by running multiple Job Servers on a single multi-processor machine.

If the majority of your reports are scheduled to run on a regular basis, there areseveral strategies you can adopt to maximize your system’s processing capacity:

• Install the Job Server in close proximity to (but not on the same machine as) thedatabase server against which the reports run. Ensure also that the FileRepository Servers are readily accessible to all Job Servers (so they can readreport objects from the Input FRS and write report instances to the Output FRSquickly). Depending upon your network configuration, these strategies mayimprove the Job Server’s processing speeds, because there is less distance fordata to travel over your corporate network.

• Verify the efficiency of your reports. When designing reports in CrystalReports, there are a number of ways in which you can improve theperformance of the report itself, by modifying record selection formulas, usingthe database server’s resources to group data, incorporating parameter fields,

and so on. For more information, see the “Designing Optimized Web Reports”section in the Crystal Reports User’s Guide (version 8.5 and later).

• Use event-based scheduling to create dependencies between large or complexreports. For instance, if you run several very complex reports on a regular,nightly basis, you can use Schedule events to ensure that the reports areprocessed sequentially. This is a useful way of minimizing the processing loadthat your database server is subject to at any given point in time.

• If some reports are much larger or more complex than others, considerdistributing the processing load through the use of server groups. Forinstance, you might create two server groups, each containing one or more JobServers. Then, when you schedule recurrent reports, you can specify that it beprocessed by a particular server group to ensure that especially large reportsare distributed evenly across resources.

• Increase the hardware resources that are available to a Job Server. If the JobServer is currently running on a machine along with other Crystal Enterprisecomponents, consider moving the Job Server to a dedicated machine. If thenew machine has multiple CPUs, you can install multiple Job Servers on thesame machine (typically no more than one service/daemon per CPU).





Increasing on-demand viewing capacity

When you provide many users with View On Demand access to reports, you alloweach user to view live report data by refreshing reports against your databaseserver. The Page Server retrieves the data and performs the report processing, and

the Cache Server stores recently viewed report pages for possible reuse.

If your reporting requirements demand that users have continual access to thelatest data, you can increase capacity in the following ways:

• Increase the maximum allowed size of the cache. For details, see “ModifyingCache Server performance settings” on page 216.

• Verify the efficiency of your reports. When designing reports in CrystalReports, there are a number of ways in which you can improve theperformance of the report itself, by modifying record selection formulas, usingthe database server’s resources to group data, incorporating parameter fields,and so on. For more information, see the “Designing Optimized Web Reports”section in the Crystal Reports User’s Guide (version 8.5 and later).

• Increase the number of Page Servers that service requests on behalf of anysingle Cache Server. You can install additional Page Servers on multiplemachines, or you can run multiple Page Servers on a single multi-processormachine (typically no more than one service/daemon per CPU).

• Increase the number of Page Servers and Cache Servers on the system, andthen distribute the processing load through the use of server groups. Forinstance, you might create two server groups, each containing one or moreCache Server/Page Server pairs. You can then specify individual reports thatshould always be processed by a particular server group.

Enhancing custom web applicationsIf you are developing your own custom desktops or administrative tools with theCrystal Enterprise Software Development Kit (SDK), be sure to review the newlyexposed librariesand APIs. You can now,for instance, incorporate complete securityand scheduling options into your own web applications. You can also modify serversettings from within your own code in order to further integrate Crystal Enterprisewith your existing intranet tools and overall reporting environment.

To improve the scalability of your system, consider distributing administrativeefforts by developing web applications for delegated content administration. Youcan grant select users the ability to manage particular Crystal Enterprise folders,content, users, and groups on behalf of their team, department, or regional office.

In addition, be sure to check the Crystal Enterprise Web Developer’s Guide forperformance tips and other scalability considerations. The query optimizationsection in particular provides some preliminary steps to ensuring that customapplications make efficient use of the query language. Access the Crystal EnterpriseWeb Developer’s Guide online from the Crystal Enterprise Launchpad.



General scalability considerations


Improving web response speeds

Because all user interaction with Crystal Enterprise occurs over the Web, you mayneed to investigate a number of areas to determine exactly where you can improveweb response speeds. These are some common aspects of your deployment that

you should consider before deciding how to expand Crystal Enterprise:• Assess your web server’s ability to serve the number of users who connect

regularly to Crystal Enterprise. Use the administrative tools provided withyour web server software (or with your operating system) to determine howwell your web server performs. If the web server is indeed limiting webresponse speeds, consider increasing the web server’s hardware and/orsetting up a “web farm” (multiple web servers responding to web requests to asingle IP address). To configure Crystal Enterprise for use in a web farmenvironment, see the Crystal Enterprise Installation Guide.

• If web response speeds are slowed only by report viewing activities, see“Choosing between live and saved data” on page 242 and “Increasing on-

demand viewing capacity” on page 247.• Take into account the number of users who regularly access your system. If

you are running a large deployment, ensure that you have set up an APScluster. For details, see “Increasing overall system capacity” on page 245.

If you find that a single Web Component Server (WCS) inadequately services thenumber of scripting requests made by users who access your system on a regular basis, consider the following options:

• Increase the hardware resources that are available to the Web ComponentServer (WCS). If the WCS is currently running on the web server, or on a singlemachine with other Crystal Enterprise components, consider moving the WCSto a dedicated machine. If the new machine has multiple CPUs, you can install

multiple WCS services/daemons on the same machine (typically no more thanone per CPU).

• Set up two (or more) WCS machines to take advantage of the dynamic load balancing that is built into the Web Connector components. The WebConnector distributes the processing load evenly across WCS hosts: each newCrystal Enterprise session is sent to the least used WCS. This also provides youwith the benefits of being able to take one WCS machine offline for service,without bringing down the entire system.

Note: If you are running Apache as your web server, you must instruct Apache toreinitialize its child worker processes after you add or remove WCSHOSTS to theWeb Connector configuration files. You can generally do this with one of thefollowing commands:

kill -HUP `cat <absolute path to httpd.pid file>`

kill -USR1 `cat <absolute path to httpd.pid file>`

Consult the Apache documentation for more information.





Adding and deleting serversThis section shows how to add and delete servers from a machine that is alreadyrunning Crystal Enterprise components.

Tip: If you are adding new hardware to Crystal Enterprise by installing servercomponents on new, additional machines, run the Crystal Enterprise installationand setup program from your product distribution. The setup program allows youto perform an Expand installation. During the Expand installation, you specify theexisting APS whose system you want to expand, and you select the componentsthat you want to install on the local machine. For details, see the Crystal EnterpriseInstallation Guide.

Adding a server

These steps add a server (service or daemon) to the local machine. You can runmultiple instances of the same Crystal Enterprise server on the same machine(except for the File Repository Servers).

To add a Windows server

Note: To complete this procedure, you must log on as an Administrator of thelocal machine.

1 Start the CCM on the Crystal Enterprise machine upon which you want toinstall a new server.

2 On the toolbar, click Add Server.

The Add Crystal Server Wizard displays its Welcome dialog box.

3 Click Next.The “Server Type and Display Name Configuration” dialog box appears.





Deleting a server

To delete a Windows server

1 Start the CCM on the Crystal Enterprise machine that you want to delete a

server from.

2 Stop the server that you want to delete from the system.

3 With the server selected, click Delete Server on the toolbar.

4 When prompted for confirmation, click Yes.

To delete a UNIX server

Use the serverconfig.sh script. For reference, see “serverconfig.sh” on page 283.



Adding and deleting servers





Managing Server Groups 14

This chapter shows how to create server groups andsubgroups. It also shows how to modify the groupmembership of an individual server.



Server group overview


Server group overviewServer groups provide a way of organizing your Crystal Enterprise servers tomake them easier to manage. That is, when you manage a group of servers, youneed only view a subset of all the servers on your system. You might, for example,group your servers together by region or by type.

If you group your servers by region, you can easily set up default processingsettings, recurrent schedules, and schedule destinations that are appropriate tousers who work in a particular regional office. You can associate a report with asingle server group, so the report is always processed by the same servers. Andyou can associate scheduled reports with a particular server group to ensure thatscheduled reports are sent to the correct printers, file servers, and so on. Thus,server groups prove especially useful when maintaining systems that spanmultiple locations and multiple time zones.

Once you have created your server groups, you can change the status, obtain

metrics, and configure your servers in the Server Groups management area—justas you would in the Servers management area. The only difference is that you seeonly the servers that you added to the server group. For details on configuringindividual servers, see “Server management overview” on page 196.

Creating a server groupTo create a server group, you need to specify the name and description of thegroup, and then add servers to the group.

To create a server group

1 Go to the Server Groups management area of the CMC.

2 Click New Server Group.

The New Server Group Properties tab appears.



14: Managing Server Groups


3 In the Server Group Name field, type a name for the new group of servers.

4 Use the Description field to include additional information about the group.

5 Click OK.

6 On the Servers tab, click Add/Remove Servers.7 Select the servers that you want to add to this group; then click the > arrow.

Tip: Use CTRL+click to select multiple servers.

This example adds the servers running on PBROWNSEYA to a server group calledNorthern Office Servers.

8 Click OK.

You are returned to the Servers tab, which now lists all the servers that you

added to the group. You can now change the status, view server metrics, andchange the properties of the servers in the group. For more information, see“Server management overview” on page 196.

Working with server subgroupsSubgroups of servers provide you with a way of further organizing your servers.A subgroup is just a server group that is a member of another server group.

For example, if you group servers by region and by country, then each regionalgroup becomes a subgroup of a country group. To organize servers in this way,first create a group for each region, and add the appropriate servers to eachregional group. Then, create a group for each country, and add each regionalgroup to the corresponding country group.

There are two ways to set up subgroups: you can modify the subgroups of a servergroup, or you can make one server group a member of another. The results are thesame, so use whichever method proves most convenient.



Working with server subgroups


To add subgroups to a server group


2 Click the group that you want to add subgroups to.

This group is the parent group.3 On the Subgroups tab, click Add/Remove Groups.

4 In the Available server groups list, select the server groups that you want toadd as subgroups; then click the > arrow.

5 Click OK.

You are returned to the Subgroups tab, which now lists all the server groupsthat you added to the parent group.

To make one server group a member of another


2 Click the group that you want to add to another group.

3 On the Member of tab, click the Member of button.

4 In the Available server groups list, select the server groups that shouldinclude your group as a member; then click the > arrow.

This example makes the Job Servers group a member subgroup of the NorthernOffice Servers group.

5 Click OK.

You are returned to the “Member of” tab, which now lists all the server groupsthat the initial group is now a member of.



14: Managing Server Groups


Modifying the group membership of a serverYou can modify a server’s group membership to quickly add the server to (orremove it from) any group or subgroup that you have already created on thesystem.

For example, suppose that you created server groups for a number of regions. Youmight want to use a single Web Component Server (WCS) for multiple regions.Instead of having to add the WCS individually to each regional server group, youcan click the server’s “Member of” link to add it to all three regions at once.

To modify a server ’ s group membership


2 Locate the server whose membership information you want to change.

3 In the Server Group column, click the server’s Member of link.

The “Member of” page lists any server groups that the server currently belongsto.

4 Click the Member of button.

The “Modify Member Of” page appears.

5 Move server groups from one list to another to specify which groups theserver is a member of.

6 Click OK.



Modifying the group membership of a server





Working with Firewalls 15

This chapter describes how Crystal Enterprise works withfirewall systems. After providing some backgroundinformation on the supported types of firewalls, thischapter explains how to configure firewalls and CrystalEnterprise to work together.



Firewalls overview


Firewalls overviewCrystal Enterprise works with firewall systems to provide reporting acrossintranets and the Internet without compromising network security. This chapterprovides general information about firewalls, packet filtering, Network AddressTranslation (NAT), and SOCKS proxy server firewalls. It then explains how toconfigure these firewalls and Crystal Enterprise to work together.

If you are already familiar with firewalls and the configuration used in yournetwork, proceed directly to “Configuring Crystal Enterprise to work withfirewalls” on page 263.

What is a firewall?

A firewall is a security system that protects oneor more computers from unauthorizednetwork access. A firewall restricts people to entering and leaving your network at acarefully controlled point. It also prevents attackers from getting close to your otherdefenses. Typically, a firewall protects a company’s intranet from being improperlyaccessed through the Internet. A firewall can enforce a security policy, log Internetactivity, andbe a focusforsecurity decisions. A firewall can’t protect against maliciousinsiders or connections that don’t go through it. A firewall also can’t set itself upcorrectly or protect against completely new threats. To help explain how firewallswork, somebasic networking terms—TCP/IP,packets, and ports—are described here.

If you are already familiar with these topics see “Configuring Crystal Enterprise towork with firewalls” on page 263.

TCP/IP and packets

TCP/IP (Transmission Control Protocol/Internet Protocol) is the communicationsprotocol used on the Internet. The units of data transmitted through a TCP/IPnetwork are called packets. Packets are typically too small to contain all the datathat is sent at any one time, so multiple packets are required, each containing aportion of the overall data. When data is sent by TCP/IP, the packets areconstructed such that a layer for each protocol is wrapped around each packet.

Typically, TCP/IP packets have the following layers:

• Application layer (for example, FTP, telnet, and HTTP).

• Transport layer (TCP or UDP).

• Internet layer (IP).

• Network Access layer (for example, ethernet and ATM).

At the application layer, the packet consists simply of the data to be transferred. Asthe packet moves through the layers, each layer adds a header to the packet,preserving the data from the previous level. These headers are used to determinethe packet’s destination and to ensure that it arrives intact. When the packetreaches its destination, the process is reversed: the layers are sequentially removeduntil the transferred data is available to the destination application.



15: Working with Firewalls


Ports

Ports are logical connection points that a computer uses to send and receivepackets. With TCP/IP, ports allow a client program to specify a particular serverprogram on a computer in a network. High-level applications that use TCP/IP

have ports with pre-assigned numbers. For instance, when you visit a typicalHTTP site over the Web, you communicate with the web server on port 80, whichis the pre-assigned port for HTTP communication.

Other application processes are given port numbers dynamically for eachconnection. When a service or daemon initially is started, it binds to its designatedport number. When any client program wants to use that server, it must alsorequest to bind to the designated port number. Valid port numbers range from 0to 65536, but ports 0 to 1024 are reserved for use by certain privileged services.

Firewall types

Firewalls primarily function using at least one of three methods: packet filtering,Network Address Translation (NAT), and proxy services. Crystal Enterpriseworks with these firewall types. Packet filtering rejects TCP/IP packets fromunauthorized hosts and rejects connection attempts to unauthorized services. NATtranslates the IP addresses of internal hosts to hide them from outside monitoring.NAT is also called IP masquerading. Proxy services make high-level applicationconnections on behalf of internal hosts to completely break the network layerconnection between internal and external hosts.

Packet filtering

Packet filtering deletes packets before they are delivered to the destination

computer. Packet filtering can delete packets based on the following:• The address the data is coming from.

• The address the data is going to.

• The session and application ports being used to transfer the data.

• The data contained within the packet.

Typically there are two types of packet filtering: stateful and stateless. Statefulpacket filters remember the state of connections at the network and session layers by recording the established session information that passes through the filtergateway. The filter then uses that information to discriminate valid return packetsfrom invalid connection attempts. Stateless packet filters do not retain informationabout connections in use; instead, they make determinations packet-by-packet based only on the information contained within the packet. Firewalls that employpacket filtering will work with Crystal Enterprise.



Firewalls overview


Network Address Translation

Network Address Translation (NAT) converts private IP addresses in a privatenetwork to globally unique, public IP addresses for use on the Internet. The mainpurpose of NAT is to hide internal hosts. As outgoing packets are routed through

the firewall, NAT hides internal hosts by converting their IP addresses to theaddress of the firewall. Once the translation is complete, the firewall sends the datapayload on to its original destination; thus, NAT makes it appear that all trafficfrom your site comes from one (or more) IP addresses.

The firewall maintains a translation table to keep track of the address conversionsthat it has performed. When an incoming response arrives at the firewall, thefirewall uses this translation table to determine which internal host should receivethe response. Because this type of firewall essentially sends and receives data on behalf of internal hosts, NAT can also be described as a simple proxy.

There are two basic types of NAT:

• Static translation (port forwarding) grants a specific internal host a fixed

translation that never changes. For example, if you run an email server inside afirewall, you can establish a static route through the firewall for that service.

• Dynamic translation (automatic, hide mode, or IP masquerade) shares a smallgroup of external IP addresses amongst a large group of internal clients for thepurpose of expanding the internal network address space. Because a translationentry does not exist until an internal client establishes a connection out throughthe firewall, external computers have no way to address an internal host that isprotected using a dynamically translated IP address.

Note: Some protocols do not function correctly when the port is changed.These protocols will not work through a dynamically translated connection.

Crystal Enterprise and static translation NAT can be configured so that they worktogether.

For configuration steps, see “Configuring for Network Address Translation” onpage 263.

SOCKS proxy servers

SOCKS is a networking protocol that enables computers on one side of a SOCKSserver to access computers on the other side of a SOCKS server without requiringa direct IP connection. A SOCKS server redirects connection requests fromcomputers on one side of it to computers on the other side of it. A SOCKS servertypically authenticates and authorizes requests, establishes a proxy connection,

and relays data between the internal and external networks. Crystal Enterprisesupports and works with SOCKS servers.

SOCKS servers work by listening for service requests from internal clients. Whenan internal request is made, the SOCKS server sends the requests to the externalnetwork as if the SOCKS server itself was the originating client. When the SOCKSserver receives a response from the external server, it returns that response to the





original client as if it were the originating external server. This effectively hides theidentity and the number of clients on the internal network from examination byanyone on the external network.

For configuration steps, see “Configuring for SOCKS servers” on page 265.

Configuring Crystal Enterprise to work with firewallsYou can configure Crystal Enterprise to work with different types of firewalls. Thissection explains how to configure Crystal Enterprise to work with differentfirewalls in different scenarios. This section assumes that the Web Connector andthe Web Component Server (WCS) reside on separate computers. (If they reside onthe same computer, their communication is uninterrupted by firewalls, and noadditional configuration is required.)

In most cases, clients access protected information through a web server runningin a Demilitarized Zone (DMZ). A DMZ is a network area that is neither part of theinternal network nor directly part of the Internet. Typically, the DMZ is set up between two firewalls: an outer firewall and an inner firewall.

The only Crystal Enterprise component that needs to provide direct service toexternal clients is the Web Connector, which must be installed on the web server.When a client makes a request to the Web Connector, the Web Connector makes aTCP/IP request to the WCS on a specific port (the default port is 6401). The mostlogical and secure way to position the web server and the Web Connector is toplace them in the DMZ. All the other Crystal Enterprise components can then beplaced on the internal network.

Configuring for packet filteringIf you are using packet filtering without NAT, then no special configuration isrequired within Crystal Enterprise. However, you must ensure that your firewallis not inadvertently filtering Crystal Enterprise packets.

You may need to modify your packet filtering rules to allow the Web Connector(on the web server machine) to send data to the port that the WCS is listening on.By default, this port is 6401. The Web Connector must also be able to receiveresponses from the WCS on the same port.

Configuring for Network Address Translation

If you use Network Address Translation (NAT) on the outer firewall only, then nospecial configuration is required for Crystal Enterprise to communicate properly.However, if NAT is employed on the inner firewall—between the Web Connectorand the Web Component Server (WCS)—you must configure the Web Connectorto communicate properly through the firewall. This Web Connector configurationis required because the internal IP address of the WCS may not be routable



Configuring Crystal Enterprise to work with firewalls


through the firewall. (The WCS requires no special configuration, because the WebConnector’s IP address is not hidden by the NAT firewall.)

Note: You can configure the Web Connector to communicate properly acrossNAT firewalls that use static IP translation; however, the Web Connector cannot

communicate across a firewall whose IP translation is dynamic.

To configure the Web Connector on Windows

1 Start the CCM.

2 Stop the Word Wide Web Publishing Service.

3 On the toolbar, click Configure web connector.

4 In the Web Component Servers area, click Add.

If your WCS Host Name is already listed, select it and click Edit.

5 In the WCS Host Name field, type one of the following:

• The name of the machine that is running the WCS. This machine must beroutable from the web server that is running the Web Connector.

• The external translated IP address of the machine that is running the WCS.This IP address must be fixed; that is, your firewall must use static IPtranslation to grant the WCS machine a fixed IP address.

6 If you have customized the WCS so that it listens on a port other than the default,type your new port number in the Port field. Otherwise, ensure that thedefault port number (6401) appears.

7 Click OK twice to return to the CCM.

8 Start the Word Wide Web Publishing Service.

To configure the Web Connector on UNIX

If your web server is running on UNIX, stop the web server and then set theWCSHOST or WCSHosts variable to one of the following:

• The name of the machine that is running the WCS. This machine must beroutable from the web server that is running the Web Connector.

• The external translated IP address of the machine that is running the WCS.This IP address must be fixed; that is, your firewall must use static IPtranslation to grant the WCS machine a fixed IP address.

The WCSHOST or WCSHosts variable is defined in the configuration file that

corresponds to your web server. For details abouteach configuration file, see “WebConnector virtual path mappings” on page 304.





Configuring for SOCKS servers

Crystal Enterprise provides direct support for SOCKS proxy server firewalls. Therequired configuration depends on the location of your SOCKS server. Your SOCKSserver(s) may separate the Web Connector from the Web Component Server (WCS)

and/or they may separate the WCS from the Automated Process Scheduler (APS).

This list describes when to use the procedures that are provided in the remainderof this section:

• Configuring the WCS for SOCKS servers

Complete these steps regardless of the location of your SOCKS server(s).

• Configuring the Web Connector for SOCKS servers

Complete these steps if one or more SOCKS servers separate the WebConnector from the WCS.

• Configuring the APS for SOCKS Servers

Complete these steps if one or more SOCKS servers separate the WCS from the

APS.

Crystal Enterprise requires that the APS and the remaining server componentsreside on the same subnet and that these components are not separated from oneanother by firewalls. The remaining server components automatically obtain theirSOCKS configuration from the APS, as required, so you don’t need to configurethem separately.

Configuring the WCS for SOCKS servers

Complete these steps if one or more SOCKS servers separate the WCS from theWeb Connector, from the APS, or from both. These steps provide the WCS with the

required information about each SOCKS server, in order, from the outermost to theinnermost.

The outermost SOCKS server is the one closest to the Web Connector. Theinnermost SOCKS server depends on whether or not a SOCKS server separates theWCS from the APS:

• If no SOCKS servers separate the WCS from the APS, then the innermostSOCKS server is the first SOCKS server that the WCS connects to whencommunicating with the Web Connector.

• If a SOCKS server separates the WCS and the APS, then the innermost SOCKSserver is the last SOCKS server the WCS communicates with before the APS.

To configure the WCS on Windows1 Start the CCM.

2 Stop the Web Component Server.

3 Select the Web Component Server and, on the toolbar, click Properties.

4 On the Configuration tab, click Specify SOCKS; then click Add.





5 In the SOCKS Proxy dialog box, type the Server Name or IP Address of yourSOCKS server.

6 In the Server Port field, type the number of the port that the SOCKS server islistening on.

7 Select the SOCKS version that you are running (Ver 4 or Ver 5).

If you are using version 5 and you would like to secure access to the server, selectthe authentication check box, and then enter your user name and password.

8 Click OK.

If you have more than one SOCKS server, repeat steps 4 to 8 for each additionalserver. Then click Up and Down to order the SOCKS servers from theoutermost (closest to the Web Connector) to the innermost (closest to the APS).

9 Click OK in all three dialog boxes to return to the CCM.

10 Start the Web Component Server.

To configure the WCS on UNIX

The UNIX version of Crystal Enterprise includes a utility that allows youto configurethe WCS to work with SOCKS servers. For details, see “sockssetup.sh” on page 284.

Configuring the Web Connector for SOCKS servers

Complete these steps if the Web Connector must communicate through a SOCKSserver when it sends information to the WCS.

To configure the Web Connector on Windows

1 Start the CCM.

2 Stop the World Wide Web Publishing Service.

3 On the toolbar, click Configure web connector.

4 In the Web Component Servers area, click Add.

If your WCS Host Name is already listed, select it and click Edit.

5 In the WCS Host Name field, type the name of the machine that is running theWCS.

6 If you have customized the WCS so that it listens on a port other than the default,type your new port number in the Port field. Otherwise, ensure that thedefault port number (6401) appears.

7 Click Specify SOCKS, then click Add.


9 In the Server Port field, type the number of the port that the SOCKS server islistening on.







11 Click OK.

If more than one SOCKS server separates the Web Connector from the WCS,repeat steps 7 to 11 for each SOCKS server. Then click Up and Down to orderthe SOCKS servers. The SOCKS server closest to the Web Connector mustappear at the top of the list, and the SOCKS server closest to the WCS must beat the bottom of the list.


13 Start the World Wide Web Publishing Service.

To configure the Web Connector on UNIX

If your web server is running on UNIX, you must stop the web server and then

modify the definition of the Crystal Enterprise WCSHOST or WCSHosts variable. Thisvariable is defined in the configuration file that corresponds to your web server.Depending on the web server and Web Connector you are using, the environmentvariable is typically defined in one of these files:

For more information about the configuration files for your web server, see “WebConnector virtual path mappings” on page 304.

The syntax that denotes the WCS through a SOCKS server can be considerablycomplex. This section shows a complete connection string and then describes itscomponent parts. The complete connection string for specifying the WCS througha SOCKS server is as follows:

socks://Version;User:Password@SOCKSServer:Port/WCSmachine:Port

This string consists of two main parts: the SOCKS connection information(Version;User:Password@SOCKSServer:Port) followed by the WCS destination

(WCSmachine:Port). The variable components in this string are as follows:• Version is the SOCKS version in use (4 or 5).

• User is a SOCKS user name of length < 256 characters.

• Password is the corresponding password of length < 256 characters.

• SOCKSServer:Port is the name or IP4 of the SOCKS server, along with its port.

• WCSmachine:Port is the name or IP4 of the WCS, along with its port.

Web Server Path

Apache with ASAPI crystal/enterprise/platform/wcs/conf/asapi.conf

iPlanet 6.x with NSAPI In the iPlanet magnus.conf file.

iPlanet 4.x with NSAPI In the iPlanet obj.conf file.

Any web server with CGI crystal/enterprise/platform/wcs/bin/wcscgi.cgi





For example, suppose that you are running SOCKS version 5 on a server calledsocksmachine. You need to provide the user name socksuser and the passwordsecret to connect to a WCS named sales1. The WCS is listening on its default port(6401). In this case, in the configuration file appropriate to your web server, youwould type the following definition for the WCSHOST or WCSHosts variable:

socks://5;socksuser:secret@socksmachine/sales1:6401

To specify a sequence of SOCKS servers, list them in the connection string bypreceding each additionalSOCKS server with the ampersand symbol (&), as follows:

socks://Version;User:Password@SOCKSServer1:Port&Version;User:Password@

SOCKSServer2:Port/WCSmachine:Port

Configuring the APS for SOCKS Servers

Complete these stepsif oneor more SOCKSserversseparate the WCS fromthe APS. Theremaining Crystal Enterprise servers automatically obtain their SOCKS configurationfrom the APS, as required, so you don’t need to configure them separately.

To configure the APS on Windows

1 Start the CCM.

2 Stop all of the Crystal servers, including the Crystal APS.

3 Select the APS and, on the toolbar, click Properties.

4 On the Connection tab, click Add.


6 In the Server Port field, type the number of the port that the SOCKS server is

listening on.



8 Click OK.

If you have more than one SOCKS server, repeat steps 4 to 8 for each additionalserver. Then click Up and Down to order the SOCKS servers from the outermost(closest to the Web Component Server) to the innermost (closest to the APS).


10 Start the Crystal Enterprise server components.

To configure the APS on UNIX

The UNIX version of Crystal Enterprise includes a utility that allows you toconfigure Crystal Enterprise servers to work with SOCKS servers. For details, see“sockssetup.sh” on page 284.




Licensing Information 16

This chapter describes how to view licensing informationand add license keys with the Crystal Management Console(CMC). It also shows how to view your current accountactivity.



Licensing overview


Licensing overviewCrystal Enterprise is a scalable product that provides you with the ability to addlicense keys as the demand for report information increases in your organization.You can purchase concurrent, named, and processor licenses.

Concurrent licenses specify the number of people who can connect to CrystalEnterprise at the same time. This type of licensing is very flexible because a smallconcurrent license can support a large user base. For example, a 100 userconcurrent license could support 250, 500, or 700 users dependingon the frequencywith which the system is accessed and the number and size of the reports.

Named user licenses are associated with specific users and allow people to accessthe system based on their user name and password. This provides named userswith access to the system regardless of how many other people are connected.You may want to purchase named user licenses for people in your organizationwho require access to Crystal Enterprise at all times. For example, you could

purchase a nameduser license for each of the 25 managers and a concurrent licensefor 175 general users.

Processor licenses are based on the number of processors that are running CrystalEnterprise. To determine the number of processor licenses you require, count thenumber of processors on any servers running any component of CrystalEnterprise(except the Web Connector).

Note: If you are upgrading from a trial version of the product, be sure to deletethe Evaluation key prior to adding any new license keys or activation codes.

For more information about licenses, sessions, and session handling see “CrystalEnterprise Security Concepts” on page 15.



16: Licensing Information


Accessing license information

The License Keys tab identifies the number of concurrent, named, and processorlicenses associated with each key.

1 Go to the Authorization management area of the CMC.The License Keys tab appears.

2 Select a license key.

The details associated with the keyappear in the Licensing Information area. Topurchase additional license keys:

• Contact your Crystal Decisions sales representative.

• Call 1-800-877-2340 (US/Canada) or 1-604-681-3435 (International).

• Email [email protected].




Object Rights and Access Levels A

This appendix maps the object rights that are available inthe Crystal Management Console (CMC) to the actualrights available through the Crystal Enterprise SDK; it alsolists the object rights that make up each of the predefinedaccess levels, and the default rights that are applied to thesystem root folder. This appendix is provided primarily for

reference purposes. For complete details on setting objectrights, see “Controlling Users’ Access to Objects” onpage 95.



Object rights


Object rightsThis table lists the object rights that are available within the Advanced Rights pageof the Crystal Management Console (CMC). Other Crystal Enterprise plug-incomponents may in future add their own, object-specific rights to this list. Thetable matches the descriptions used in the CMC with the programmatic name thatdevelopers use when assigning rights with the Crystal Enterprise SDK.

Description used in the CMC Name used in the SDK

Respect current security by inheritingrights from parent groups

AdvancedInheritGroups

Respect current security by inheritingrights from parent folders

AdvancedInheritFolders

Add objects to the folder ceRightAdd

View objects ceRightViewEdit objects ceRightEdit

Modify the rights users have to objects ceRightModifyRights

Schedule the document to run ceRightSchedule

Delete objects ceRightDelete

Define server groups to process jobs ceRightPickMachines

Delete instances ceRightDeleteInstance

Copy objects to another folder ceRightCopy

Schedule to destinations ceRightSetDestination

View document instances ceRightViewInstancePause and Resume documentinstances

ceRightPauseResumeSchedule

Print the report’s data ceReportRightPrintReport

Refresh the report’s data ceReportRightRefreshOnDemandReport

Export the report’s data ceReportRightPageServerExport

View objects that the user owns ceRightOwnerView

Edit objects that the user owns ceRightOwnerEdit

Modify the rights users have toobjects that the user owns

ceRightOwnerModifyRights

Delete objects that the user owns ceRightOwner

Delete instances that the user owns ceRightOwnerDeleteInstance

View document instances that theuser owns

ceRightOwnerViewInstance

Pause and resume instances that theuser owns

ceRightOwnerPauseResumeSchedule





Access levelsThis section lists the object rights that constitute each of the predefined accesslevels that are available through the Advanced Rights page of the CrystalManagement Console (CMC).

No Access

View

Schedule


Respect current security byinheriting rights from parent groups


Respect current security byinheriting rights from parent folders







View objects ceRightView

View document instances ceRightViewInstance








Schedule the document to run ceRightScheduleCopy objects to another folder ceRightCopy







Access levels


View On Demand

Full Control



Export the report’s data ceReportRightPageServerExportSchedule the report to a printer ceReportRightPrintReport















View document instances ceRightViewInstanceRefresh the report’s data ceReportRightRefreshOnDemandReport


Schedule the report to a printer ceReportRightPrintReport














Default rights on the root folderThe top-level Crystal Enterprise folder serves as the root for all other folders andobjects that you add to the system. This folder provides the following rights bydefault:

• The Everyone group is granted the Schedule access level.

• The Administrators group is granted the Full Control access level.

• The Guest user account is granted the ability to add a user account.

Edit objects ceRightEdit

Modify the rights users have to

objects

ceRightModifyRights


Delete objects ceRightDelete

Delete instances ceRightDeleteInstance




Pause and Resume documentinstances

ceRightPauseResumeSchedule

Schedule the report to a printer ceReportRightPrintReport

Refresh the report’s data ceReportRightRefreshOnDemandReport





Default rights on the root folder





UNIX Tools B

This appendix details each of the administrative tools andscripts that are included with the UNIX distribution of Crystal Enterprise. This appendix is provided primarily forreference purposes. Concepts and configuration proceduresare discussed in more detail throughout this guide.



UNIX tools overview


UNIX tools overviewThe UNIX distribution of Crystal Enterprise includes a number of scripts that,together, provide you with all the configuration options that are available in theWindows version of the Crystal Configuration Manager (CCM). There are anumber of other scripts that provide you with UNIX-specific options or serve astemplates for your own scripts. Also, there are several secondary scripts that areused by Crystal Enterprise. Each script is described here and the command-lineoptions are provided where applicable.

Script utilitiesThis section describes the administrative scripts that assist you in working withCrystal Enterprise on UNIX. The remainder of this guide discusses the concepts behind each of the tasks that you can perform with these scripts. This reference

section provides you the main command-line options and their arguments.

ccm.sh

The ccm.sh script is installed to the crystal directory of your installation. Thisscript provides you with a command-line version of the CCM. This section lists thecommand-line options and provides some examples.

Note:

• Arguments in square brackets [ ] are optional.

• Replace server with the complete name of the Crystal Enterprise servercomponent that you want to configure. By default, servers are named with a

hostname.servertype convention. If you are unsure of a server’s name, look inthe ccm.config file, locate the server’s launch string, and use the value thatappears after the -name option.

• Arguments denoted by other authentication information are provided inthe second table.

CCM Option Valid Arguments Description

-help n/a Display command-line help.

-start allor server Start each server as a process.

-stop allor server Stop each server by terminating its

Process ID.-restart allor server Stop each server by terminating its

Process ID; then each server is started.

-enable allor server [otherauthentication information]

Enable a started server so that it registerswith the system and starts listening on theappropriate port.





This table describes the options that make up the argument denoted by otherauthentication information.

-disable allor server [otherauthentication information]

Disable a server so that it stopsresponding to Crystal Enterprise requests but remains started as a process.

-display server <other authenticationinformation>

Reports the server’s current status(enabled or disabled). The APS must berunning before you can use this option.

-apsfriendlyname

-selectdb

-srcconn

-srcdbdriver

-copydb

-setcluster

-getcluster

-reinitialize

Run ccm.sh -help for completedetails.

These options are used primarily byapsdbsetup.sh. Although you can runthese commands directly from the CCM,it is recommended that you runapsdbsetup.sh instead. It provides a text- based interface to APS configuration. Fordetails, see “apsdbsetup.sh” on page 283.

-socksserver

-listall-wcssocks

-wcsfriendlyname

-getsocks

-wcssocks

-deletesocks

-moveup

-movedown

-create

-modify

-port

-version

-useauth

Run ccm.sh -help for completedetails.

These options are used primarily bysockssetup.sh. Although you can runthese commands directly from the CCM,it is recommended that you runsockssetup.sh instead. It provides a text- based interface to SOCKS serverconfiguration. For details, see“sockssetup.sh” on page 284.

CCM Option Valid Arguments Description

AuthenticationOption

Valid arguments Description

-aps apsname:port# Specify the APS that you want to log on to.If not specified, the CCM defaults to thelocal machine and the default port (6400).

-username username Specify an account that providesadministrative rights to Crystal

Enterprise. If not specified, the defaultAdministrator account is attempted.



Script utilities


The CCM reads the server launch strings and other configuration values from theccm.config file. For details, see “ccm.config” on page 282.

Examples

These two commands start and enable all the servers. The Automated ProcessScheduler (APS) is started on the local machine and the default port (6400):

ccm.sh -start all

ccm.sh -enable all

These two commands start and enable all the servers. The APS is started on port6701, rather than on the default port:

ccm.sh -start all

ccm.sh -enable all -aps MACHINE01:6701

These two commands start and enable all the servers with a specifiedadministrative account named SysAdmin:

ccm.sh -start all

ccm.sh -enable all -aps MACHINE01:6701 -username SysAdmin -password 35%bC5@5

-authentication LDAPThis single command logs on with a specified administrative account to disable a Job Server that is running on a second machine:

ccm.sh -disable MACHINE02.crystaldecisions.com.reportserver -aps

MACHINE01:6701 -username SysAdmin -password 35%bC5@5 -authentication secLDAP

ccm.config

This configuration file defines the server launch strings and other values that areused by the CCM when you run its commands. This file is maintained by the CCMitself, and by the other Crystal Enterprise script utilities. You typically edit this fileonly when you need to modify a server’s command line. For details, see

“Command lines overview” on page 290.

-password password Specify the corresponding password. If not specified, a blank password is

attempted.-authentication secEnterprise, secWindowsNT,

secLDAPSpecify the appropriate authenticationtype for the administrative account. If notspecified, secEnterprise is attempted.

AuthenticationOption

Valid arguments Description





apsdbsetup.sh

The apsdbsetup.sh script is installed to the crystal directory of your installation.The script provides a text-based program that enables you to configure the APSdatabase and APS clusters. You can add an APS to a cluster by selecting a new data

source for its APS database. You can also delete and recreate (re-initialize) an APSdatabase, copy data from another data source, or change the existing cluster name.

Note: Before running this script, back up your current APS database. Also be sureto see “Configuring the intelligence tier” on page 204 for additional informationabout APS clusters and configuring the APS database.

The script will prompt you for the name of your APS. By default, the APS name ishostname.aps. That is, the default name of an APS installed on a machine calledMACHINE01 is MACHINE01.aps. To check the name of your APS (or any other server),view the contents of ccm.configand look for the server’s launch string. Theserver’scurrent name appears after the -name option.

For information about each of these topics, see “Configuring the intelligence tier”on page 204.

serverconfig.sh

The serverconfig.sh script is installed to the crystal directory of your installation.This script provides a text-based program that enables you to view serverinformation and to add and delete servers from your installation. This script adds,deletes, modifies, and lists information from the ccm.config file.

To add/delete/modify/list UNIX servers

1 Go to the crystal directory of your installation.

2 Issue the following command:

./serverconfig.sh

The script prompts you with a list of options:

• 1 - Add a server

• 2 - Delete a server

• 3 - Modify a server

• 4 - List all servers in the config file

3 Type the number that corresponds to the action you want to perform.

4 If you are adding, deleting, or modifying a server, provide the script with anyadditional information that it requests.

Tip: The script will prompt you for the name of your APS. By default, the APSname is hostname.aps. That is, the default name of an APS installed on amachine called MACHINE01 is MACHINE01.aps. To check the name of your APS (orany other server), view the contents of ccm.config and look for the server’slaunch string. The server’s current name appears after the -name option.



Script utilities


5 Once you have added or modified a server, use the CCM to ensure that theserver is both started and enabled.

For more information about each of these topics, see “Scalability overview” onpage 242.

sockssetup.sh

The sockssetup.sh script is installed to the crystal directory of your installation.The script provides a text-based program that enables you to configure the WebComponent Server (WCS) and the Automated Process Scheduler (APS) when theymust communicate across one or more SOCKS proxy server firewalls. For technicalinformation about Crystal Enterprise and firewalls, see “Firewalls overview” onpage 260.

This script does not configure the Web Connector to communicate with the WCSthrough a SOCKS server. If a SOCKS server separates your web server from the

WCS, you must manually configure the Web Connector configuration file thatcorresponds to your web server. For more information, see “Configuring the WebConnector for SOCKS servers” on page 266.

To modify SOCKS configuration

1 Go to the crystal directory of your installation.

2 Issue the following command:

./sockssetup.sh

3 Type wcs to configure the communication between the WCS and the APS. Or,type servers to configure SOCKS information between the remaining servers.

The script may prompt you for the name or “friendly name” of the server. Bydefault, each server’s name is hostname.servertype. To check the name of aserver, view the contents of ccm.config and look for the server’s launch string.The server’s current name appears after the -name option.

4 Specify one of the available actions:

• Type show to display any SOCKS servers that have already been enteredwith this script. A blank list is displayed if no servers have been added.

• Type create to add a new SOCKS server to the list.

• Type modify to change one of the SOCKS servers in the list.

• Type delete to remove a SOCKS server from the list.

• Type moveup or movedown to modify the sequence of SOCKS servers.5 Proceed through the script and provide any additional information that it

requests:

• If you are creating a new entry in the list, you will typically need to providethe name or IP address of the SOCKS server, the port number it is listeningon, the version number of the SOCKS server (4 or 5), and any





authentication information that the Crystal Enterprise servers will requirein order to establish a connection with your SOCKS server.

• If you choose to delete, modify, or move an existing entry, you will beasked to specify the server “by index.” Type the number that correspondsto the SOCKS server you want to modify.

For details about SOCKS and the importance of the sequence of servers, see“Configuring for SOCKS servers” on page 265.

uninstall.sh

The uninstall.sh script is installed to the crystal directory of your installation.This script deletes all of the Crystal Enterprise files by running a long sequence of rm -f and rmdir commands. Before running this script, you must disable and stopall of the Crystal Enterprise servers. In addition, you should stop your web server, because the Web Connector modules and related files will be deleted.

Note: When you uninstall Crystal Enterprise, you must manually remove anychanges that you made to your web server’s configuration files when you set upCrystal Enterprise. Failure to remove these changes may result in web servererrors, because the uninstall.sh script deletes the Web Connector modules andconfiguration files that your web server loads when it starts. Thus, you shouldremove these entries manually before restarting the web server. If someone else inyour organization installed and set up Crystal Enterprise, see the Crystal EnterpriseInstallation Guide for details about the Web Connector entries for your web server.

Script templates

These scripts are provided primarily as templates upon which you can base yourown automation scripts.

startservers

The startservers script is installed to the crystal directory of your installation.This script can be used as a template for your own scripts: it is provided as anexample to show how you could set up your own script that starts the CrystalEnterprise servers by running a series of CCM commands. For details on writingCCM commands for your servers, see “ccm.sh” on page 280.

stopserversThe stopservers script is installed to the crystaldirectory of your installation. Thisscript can be used as a template for your own scripts: it is provided as an exampleto show how you could set up your own script that stops the Crystal Enterpriseservers by running a series of CCM commands. For details on writing CCMcommands for your servers, see “ccm.sh” on page 280.



Scripts used by Crystal Enterprise


silentinstall.sh

The silentinstall.sh script is installed to the crystaldirectory of your installation.Once you have set up Crystal Enterprise on one machine, you can use this templateto create your own scripts that install Crystal Enterprise automatically on other

machines. Essentially, once you have edited the silentinstall.sh templateaccordingly, it defines the required environment variables, runs the installationand setup scripts, and sets up Crystal Enterprise according to your specifications,without requiring any further input.

Scripts used by Crystal EnterpriseThese secondary scripts are often run in the background when you run the mainCrystal Enterprise script utilities. You need not run these scripts yourself.

env.shThe env.sh script is installed to the crystal directory of your installation. Thisscript sets up the Crystal Enterprise environment variables that are required bysome of the other scripts. You need not runthis script, because the other scripts runit as required.

initlaunch.sh

The initlaunch.sh script is installed to the crystal directory of your installation.This script copies the run control scripts to your rc#directories for automatedstartup. This script is run automatically by the setup.sh script, when you run the

system installation.

Note: You must have root privileges to run this script.

patchlevel.sh

The patchlevel.sh is installed to thecrystal/enterprise/generic directory of yourinstallation. This script reports on the patch level of your UNIX distribution. Thisscript is intended primarily for use by Crystal Decisions, Inc. support staff.

Option Valid Arguments Description

list n/a List all the installed patches.query patch # Query the operating system for the presence of

a particular patch by numeric ID.

check textfile Check that all the patches listed in textfileare installed on your operating system.





postinstall.sh

The postinstall.sh script is installed to the crystal directory of your installation.This script runs automatically at the end of the installation script and launches thesetup.sh script. You need not run this script yourself.

crystalrestart.sh

This script is run internally by the CCM when it starts the Crystal Enterprise servercomponents. If a server process ends abruptly without returning its normal exitcode, this script automatically restarts a new server process in its place. Do not runthis script yourself.

setup.sh

The setup.sh script is installed to the crystal directory of your installation. This

script provides a text-based program that allows you to set up your CrystalEnterprise installation. This script is run automatically when you install CrystalEnterprise. It prompts you for the information that is required in order to set upCrystal Enterprise for the first time.

For complete details on responding to the setup script when you install CrystalEnterprise, see the Crystal Enterprise Installation Guide.



Scripts used by Crystal Enterprise





Server Command Lines C

This appendix lists the command-line options that controlthe behavior of each Crystal Enterprise server.



Command lines overview


Command lines overviewWhen you start or configure a server through the Crystal Management Console(CMC) or the Crystal Configuration Manager (CCM), the server is started (orrestarted) with a default command line that includes a typical set of options andvalues. In the majority of cases, you need not modify the default command linesdirectly. Moreover, you can manipulate the most common settings through thevarious server configuration screens in the CMC and the CCM. For reference, thisappendix provides a full listing of the command-line options supported by eachserver. You can modify each server’s command line directly if you need to furthercustomize the behavior of Crystal Enterprise.

Throughout this appendix, values provided in square brackets [ ] are optional.

To view or modify a server ’ s command line

The procedure for viewing or modifying a server’s command line depends upon

your operating system:• On Windows, use the CCM to stop the server. Then open the server’s Properties

to modify the command line. Start the server again when you have finished.

• On UNIX, run ccm.sh to stop the server. Then edit ccm.config to modify theserver’s command line. Start the server again when you have finished.

Note: On UNIX, each server’s command line is actually passed as an argumentto the crystalrestart.sh script. This script launches the server and monitors itin case an automatic restart is required. See the ccm.config file and“crystalrestart.sh” on page 287.

Standard options for all serversThese command-line options apply to all of the Crystal Enterprise servers, unlessotherwise indicated. See the remainder of this appendix for options specific to eachtype of server.

Option Valid Arguments Behavior

-name string Specify the friendly name of the server. The server registersthis name with the APS, and the name is displayed in theCMC and the CCM. The default friendly name ishostname.servertype

Note: Do not modify -name for Input or Output FileRepository Servers.

-ns apsname[:port] Specify the APS that the server should register with. Addport if the APS is not listening on the default (6400). Thisoption does not apply to the APS itself.





UNIX signal handling

On UNIX, the Crystal Enterprise daemons handle the following signals:

• SIGTERM results in a graceful server shutdown (exit code = 0).

• SIGSEGV, SIGBUS, SIGSYS, SIGFPE, and SIGILL result in a rapid shutdown (exitcode = 1).

-requestPort port Specify the port that the server listens on. The serverregisters this port with the APS. If unspecified, the serverchooses any free port > 1024.

Note: Before changing, see “Changing the default server portnumbers” on page 235.

-port [interface:]port Bind server to the specified port, or to the specified networkinterface and port. Useful on multihomed machines.

Note:

• Before changing, see “Configuring Crystal Enterprise on amultihomed machine” on page 238.

• Use -psport to differentiate a Page Server from a CacheServer. For details, see “Page Server and Cache Server” onpage 293.

-maxlogfilesize bytes Replace bytes with 0 (zero) to eliminate log files. The defaultvalue is 512 KB. For details, see “Logging server activity” onpage 234.

-restart Windows only. Server restarts if it exits with an unusual exitcode. For UNIX, see “crystalrestart.sh” on page 287.

-fg UNIX only. Run the daemon in the foreground. Whenpassing the server’s command line to the crystalrestart.shscript, you must use this option (see ccm.config). If you runthe server’s command line directly, do not use this option, because the foreground process blocks the shell until theserver exits.






Automated Process SchedulerThis section provides the command-line options that are specific to the APS.

The default path to the server on Windows is:

C:\Program Files\Crystal Decisions\Enterprise\win32_x86\CrystalAPS.exe

The default path to the server on UNIX is:

INSTALL_ROOT /crystal/enterprise/platform/crystalapsd

Web Component ServerThis section provides the command-line options that are specific to the WCS.


C:\Program Files\Crystal Decisions\WCS\WebCompServer.exe


INSTALL_ROOT /crystal/enterprise/platform/wcs/bin/crystalwcsd


-threads number Use a thread pool of the specified size. The default is onethread per request.

-reinitializedb Cause the APS to delete the system database and recreate itwith only the default system objects.

-addkey licensekey Add the specified license key to the APS system database.-quit Force the APS to quit after processing the -reinitializedb and

-addkey options.

-connect Specify the database connection string for the APS database. If this option is present, the new value is written to the APSconfiguration file. It need only be specified on the first APSstartup, or when you change the database subsystem.


-defaultSessionTimeout minutes Specify the default session timeout, in minutes. If unspecified, sessions time out after 20 minutes of inactivity.





Page Server and Cache ServerThe Page Server and the Cache Server are controlled in much the same way fromthe command line. The command-line options determine whether the server startsas a Page Server, a Cache Server, or both. Options that apply only to one servertype are noted below.

The default paths to the servers on Windows are:

C:\Program Files\Crystal Decisions\WCS\cacheserver.exe

C:\Program Files\Crystal Decisions\WCS\pageserver.exe

The default paths to the servers on UNIX are:

INSTALL_ROOT /crystal/enterprise/platform/crystalcachesd

INSTALL_ROOT /crystal/enterprise/platform/crystalpagesd


-cache Enable Cache Server functionality.-cs hostname:port If -cache is not specified, use this option to specify the Cache

Server that the Page Server should communicate with.

-dir absolutepath Specify the cache directory for a Cache Server and the tempdirectory for the Page Server. The directories created areabsolutepath/cache and absolutepath/temp

-deleteCache Delete the cache directory every time the server starts andstops.

-psdir absolutepath Specify the temp directory for the Page Server. This optionoverrides -dir.

-size kilobytes Specify the maximum size of the cache in KB. The default is100 MB.

-refresh minutes Share cached pages for the specified number of minutes.

-maxthreads number Set the maximum number of Print Engine and/or CacheServer worker threads. The default value of 0 (zero) meansunlimited.

-maxidletime minutes Specify the number of minutes after which an idle session iscleaned up. The default is five minutes.



Job Server


Job ServerThis section provides the command-line options that are specific to the Job Server.


C:\Program Files\Crystal Decisions\WCS\JobServer.exe


INSTALL_ROOT /crystal/enterprise/platform/crystaljobsd


-dir absolutepath Specify the data directory for the Job Server.

-lib processinglibrary Specify the processing library to load(procreport).

-objectType progID The progID of the processing library

(CrystalEnterprise.report).-maxJobs number Set the maximum number of concurrent jobs

that the server will handle. The default isfive.

-requestJSChildPorts lowerbound-upperbound

Specify the range of ports that child processesshould use in a firewall environment. Forexample, 6800-6805 limits child processes tosix ports.





Input and Output File Repository ServersThis section provides the command-line options that are specific to the Input andOutput File Repository Servers.

The default paths to the servers on Windows are:C:\Program Files\Crystal Decisions\Enterprise\win32_x86\inputfileserver.exe

C:\Program Files\Crystal Decisions\Enterprise\win32_x86\outputfileserver.exe

The default path to the program that provides both servers on UNIX is:

INSTALL_ROOT /crystal/enterprise/platform/crystalfilesd

Note: Do not modify -name for Input or Output File Repository Servers.

Event ServerThis section provides the command-line options that are specific to the Event Server.


C:\Program Files\Crystal Decisions\Enterprise\win32_x86\EventServer.exe


INSTALL_ROOT /crystal/enterprise/platform/crystaleventsd


-rootDir absolutepath Set the root directory for the various subfolders and files thatare managed by the server. File paths used to refer to files inthe File Repository Server are interpreted relative to this rootdirectory.

-maxidle minutes Specify the number of minutes after which an idle session iscleaned up.


-poll seconds Specify the frequency (in seconds) with which the serverchecks for File events.

-cleanup minutes Specify the frequency (in minutes) with which the servercleans up listener proxies.



Event Server





Troubleshooting path mappings D

This chapter describes the ways in which virtualdirectories, application mappings, and virtual paths must be set up between your web server, the Web Connector, andthe Web Component Server in order for Crystal Enterpriseto work correctly.



Path mapping overview


Path mapping overviewWhen you integrate Crystal Enterprise with your existing web environment,mapping occurs at several levels:

• First, the virtual directory on the web server is mapped to the CrystalEnterprise “web content” directory on the web server machine. This mappingensures that the web server can locate all of the HTML and image filesrequired by any Crystal Enterprise request.

For details, see “Web server virtual directory mappings” on page 298.

• Second, Crystal Enterprise file types are mapped to the Web Connector, so theweb server knows that those files require additional server-side processing.This application mapping ensures that the web server handles the relevantCrystal Enterprise file types differently to HTML and image files.

For details, see “Web server application mappings” on page 300.

• Third, a virtual path mapping is made in the Web Connector. This mapping

ensures that the Web Component Server (WCS) is able to locate its own localcopies of all relevant Crystal Enterprise files.

Note: On Windows, this third mapping is typically required only when the WebConnector and the Web Component Server are installed on separate machines.

For details, see “Web Connector virtual path mappings” on page 304.

These mappings are usually configured appropriately when you first set upCrystal Enterprise. The initial installation and configuration steps are provided inthe Crystal Enterprise Installation Guide. This chapter provides additional details tohelp you customize, modify, or troubleshoot your installation.

Note: If a firewall separates your web server from the WCS or from other CrystalEnterprise components, you will need to make additional changes to your

configuration. For details, see “Working with Firewalls” on page 259.

Web server virtual directory mappingsYou create virtual directories on the web server in order to map URLs to actualdirectories on the web server machine. When you set up a virtual directory on yourweb server, you provide a name for the virtual directory along with the actualdirectory path of the corresponding HTML files, images, and so on. You typicallydefine virtual directories with your web server’s administration tools and/orconfiguration files.

For Crystal Enterprise to function correctly, two virtual directories must be createdon the web server:

• The /crystal virtual directory

• The /viewer virtual directory

Note: For some UNIX web servers, Crystal Enterprise includes the appropriateweb server directives in its default configuration files and templates. Forcomplete details, see the Crystal Enterprise Installation Guide.





The /crystal virtual directory

The /crystal virtual directory must be mapped to the Crystal Enterprise webcontent directory on the web server machine. So, when a user requests a CrystalEnterprise web page, the HTML file and any associated images can be served up

from the actual directory on the web server machine.

On a Windows web server, the default web content directory path is C:\ProgramFiles\Crystal Decisions\Web Content; on a UNIX web server, it is INSTALL_ROOT /crystal/webcontent.

To check the /crystal virtual directory configuration• Type the entire Crystal Enterprise Launchpad URL in your browser:

http://webserver/crystal/enterprise/launchpad/language/default.htm

Replace webserver with the name of your web server machine, and replacelanguage with the information appropriate to your version of Crystal

Enterprise: use en for English, fr for French, de for German, and ja for Japanese.If you cannot access this page, ensure that the /crystal virtual directory isconfigured correctly on your web server. For additional details on creating orediting virtual directories, see your web server documentation.

The /viewer virtual directory

The /viewer virtual directory must be mapped to the Crystal Enterprise viewersdirectory on the web server machine. So, when a user requests a report fromCrystal Enterprise, a Report Viewer (if required) can be served up from the actualdirectory on the web server machine.

On a Windows web server, the default viewers directory path is C:\ProgramFiles\Crystal Decisions\viewers; on a UNIX web server, it is INSTALL_ROOT /crystal/viewers.

To check the /viewer virtual directory configuration

1 Go to the Crystal Enterprise Launchpad at:

http://webserver/crystal/enterprise/launchpad/language/default.htm

Replace webserver with the name of your web server machine, and replacelanguage with the information appropriate to your version of CrystalEnterprise: use en for English, fr for French, de for German, and ja for Japanese.

2 Click the Crystal Offline Viewer link.You should be prompted to download the cvwsetup.exe file, which is located inthe viewers directory of your Crystal Enterprise installation. If the web servercannot find this file, you may need to check the configuration of the /viewervirtual directory. For additional details on creating or editing virtualdirectories, see your web server documentation.



Web server application mappings


Web server application mappingsApplication mappings instruct your web server to pass certain file types to aparticular program or module before returning any HTML to the user’s browser.In this way, application mappings ensure that server-side scripts and other specialfiles are processed correctly.

Crystal Enterprise relies upon four application mappings—one for each CrystalEnterprise file type. Through these application mappings, you instruct the webserver to pass all .csp, .rpt, .cwr, and .cri requests to the Web Connector. The WebConnector then forwards the request to the Web Component Server, whichcommunicates with the rest of Crystal Enterprise (as required) and generates theresultant HTML page.

Configuring application mappings on Windows

If you use Microsoft Internet Information Services or iPlanet Enterprise Server asyour web server, the Crystal Enterprise setup program typically configures theapplication mappings for your web server during the installation.

If you need to modify or to manually configure the application mappings, youmust associate the Crystal Enterprise file types (.csp, .rpt, .cwr, and .cri) with theWeb Connector that is provided for your web server:

• wcsisapi.dll (for Internet Information Services)

• wcsnsapi.dll (for iPlanet Enterprise Server)

• wcsdsapi.dll (for Lotus Domino 5.x)

• wcscgi.cgi (provides a wrapper to wcscgi.exe for CGI-compatible web servers).

After a default installation, the Web Connectors are located in the C:\ProgramFiles\Crystal Decisions\WCS directory on your web server machine.

The exact procedure for adding application mappings under Windows dependson your operating system (NT or 2000) and your web server. Consult your webserver documentation for more details. This example shows how you would addthe appropriate application mappings to Internet Information Services 5.0 runningon Windows 2000.

To add application mappings to IIS 5.0 on Windows 2000

1 On the Start menu, point to Administrative Tools and, on the submenu, clickInternet Services Manager.

2 Select Default Web Site (or the web site you are using), and on the Actionmenu, click Properties.





3 In the Properties dialog box, click the Home Directory tab.

4 In the Application Settings area, click Configuration.

The Application Configuration dialog box appears.



Web server application mappings


5 On the App Mappings tab, look in the Extension list for the .rpt, .csp, .cwr,and .cri entries. These entries are typically created by the Crystal Enterprisesetup program.

6 If the entries are not there, or if you need to modify an existing entry, click Add

or Edit.The Add/Edit Application Extension Mapping dialog box appears.

7 In the Executable field, type the absolute path to the ISAPI Web Connector.The default path is:

C:\Program Files\Crystal Decisions\WCS\wcsisapi.dll

8 In the Extension field, type .csp

9 Select All Verbs.

10 Select the Script engine check box.

11 Clear the Check that file exists check box.

12 Click OK.

13 Repeat steps 6 to 12 for .rpt, .cwr, and .cri files.

14 Return to the Internet Services Manager and restart your web server.

Configuring application mappings on UNIX

The configuration entries that affect application mappings depend upon both thetype of web server and the type of Web Connector that you are using.

Click the appropriate link to jump to that section:

• “Apache (ASAPI Web Connector)” on page 303

• “iPlanet Enterprise Server (NSAPI Web Connector)” on page 303

• “Any web server with the CGI Web Connector” on page 303





Apache (ASAPI Web Connector)

If you areusing Apache with the ASAPI Web Connector, the application mappingsare made with the AddHandler directive.

Ensure that the following line appears in the asapi.conf file (so long as you usedthe Include command in your httpd.conf file to reference the Crystal Enterpriseasapi.conf file, as outlined in the Crystal Enterprise Installation Guide):

AddHandler wcs_connector_handler cri cwr rpt csp

This line instructs Apache to pass all requests for Crystal Enterprise file types tothe ASAPI Web Connector.

iPlanet Enterprise Server (NSAPI Web Connector)

If you are using iPlanet Enterprise Server 4.1 or 6.x with the NSAPI WebConnector, the application mappings are made with the req_handler function.

Ensure that the following lines appear in the <Object name="default">

section of the iPlanet obj.conf file, after any existing Service lines:

Service fn="req_handler" method="(GET|POST)" type="magnus-internal/rpt"

Service fn="req_handler" method="(GET|POST)" type="magnus-internal/csp"

Service fn="req_handler" method="(GET|POST)" type="magnus-internal/cri"

Service fn="req_handler" method="(GET|POST)" type="magnus-internal/cwr"

Also ensure that the following lines appear in the iPlanet mime.types file:

type=magnus-internal/rpt exts=rpt

type=magnus-internal/csp exts=csp

type=magnus-internal/cri exts=cri

type=magnus-internal/cwr exts=cwr

Together, these configuration entries serve to define the Crystal Enterprise filetypes and to allow the NSAPI Web Connector to handle requests for such files.

Any web server with the CGI Web Connector

Depending upon your web server, you typically configure CGI applicationmappings in one of two ways: either you specify a particular directory (the cgi-bin)as one that contains all scripts that are executable by the CGI interpreter, or youspecify certain file types that are always executable by the CGI interpreter,regardless of the directory in which they are located. The default web applicationsprovided with Crystal Enterprise—ePortfolio and the Crystal ManagementConsole (CMC)—require the latter method.

Consult your web server documentation to see how to specify certain file types as being globally executable by a particular interpreter; then associate all .csp, .rpt,.cwr, and .cri files with the wcscgi.cgi script. (As far as the web server is concerned,the wcscgi.cgi script is the interpreter. However, this script really serves as awrapper that sets additional environment variables before passing the scriptingrequest along to wcscgi.bin, which is the actual CGI Web Connector binary.)



Web Connector virtual path mappings


Note: ePortfolio and the CMC do not contain all .csp, .rpt, .cwr, and .cri files to asingle cgi-bin directory. Therefore, these default applications will not functionproperly if your web server requires you to specify executable files by directory.In such cases, however, you can still deploy your own web applications thatreference .csp scripts from the cgi-bin, so long as you map the Crystal Enterprisefile types in the cgi-bin to the wcscgi.cgi script.

Web Connector virtual path mappingsCrystal Enterprise may require a third level of path mapping that establishes avirtual path between the Web Connector and the Web Component Server (WCS).Rather than passing entire files back and forth across the network, CrystalEnterprise increases overall efficiency and response time by duplicating its “webcontent” directory structure on both the web server and the WCS machines. Forinstance, when a user requests an HTML page that refers to ./logon.csp, the WebConnector does not send the logon.csp file across the network. Instead, the WebConnector instructs the WCS to evaluate its own local copy of the logon.csp file.The path to the logon.csp file on the web server may not match the absolute pathto the corresponding logon.csp file on the WCS; therefore, the Web Connector usesa virtual path mapping in order to translate a path on the web server to an absolutepath on the WCS.

The WCS must be able to locate its own local copy of each .csp file that it is askedto process. Thus, you must define a virtual path mapping for .csp files. If you wantto make unmanaged Crystal reports available on your web site, you must alsodefine a virtual path mapping for .rpt files.

Depending upon your web environment, you configure this virtual path mapping

in the Web Connector or in your web server’s configuration files. On Windows,this virtual path mapping is typically required only when the Web Connector andthe Web Component Server are installed on separate machines.

Note:

• The WCS also responds to .cwr and .cri requests, but it generates these filesitself, so it does not have to find its own local copy first. In other words, the.cwr and .cri file types file types are handled by application mappings alone.

• If a firewall separates your web server from the WCS or from other CrystalEnterprise components, you will need to make additional changes to yourconfiguration. For details, see “Working with Firewalls” on page 259.

To check the Web Connector virtual path mappings• Type the following URL in your browser:

http://webserver/crystal/enterprise/eportfolio/default.htm

If you are successfully redirected to ePortfolio or its logon page, then the pathmapping between the Web Connector and the WCS is configured to process.csp files properly.





If the redirection is unsuccessful, you should check not only the virtual pathmappings, but also the configuration of the virtual directory and of theapplication mappings on your web server.

Configuring virtual path mappings on WindowsIf Crystal Enterprise is running on Windows, you can use the CrystalConfiguration Manager (CCM) to configure the virtual path mappingsfor the WebConnector.

To create a virtual path

1 From the Crystal Enterprise program group, click Crystal Configuration

Manager.

2 In the CCM, click Configure web connector.

The Web Connector Configuration dialog box appears.

3 In the Web Component Servers area, ensure that the WCS Host Name and Portnumber correspond to your system configuration.

In the example above, the WCS is runningon a machine named PBROWNSEYA,

and it is listening on the default port (6401).





4 In the Path Mapping area, click Add.

The Path Mapping dialog box appears.

5 In the Virtual Path field, type /crystal

This entry must match the name of your web server’s virtual directory that ismapped to the Crystal Enterprise web content directory on the web server. Bydefault, this virtual directory is named /crystal.

6 In the Extension field, type .csp

This entry flags .csp files as exceptions, so the web server does not attempt tosend the file directly to the user’s browser.

7 In the Actual Path field, type the absolute path of the Crystal Enterprise webcontent directory on the Web Component Server.

This entry must specify the physical drive path on the Web Component Server, because this denotes the directory where the WCS will look for any .csp files

that it must process.On Windows, the default web content directory path is C:\ProgramFiles\Crystal Decisions\Web Content.

Note: If the Actual Path contains spaces, enclose the string in double-quotes.

8 Click OK.

Now, before it forwards .csp requests to the WCS, the Web Connector translatesthe path to the .csp file so that the WCS can locate the corresponding .csp file onits local drive.

9 If you want to make unmanaged Crystal reports available on your web site,repeat steps 4 to 8 for .rpt files.

10 Click OK and restart your web server and all associated services.

Note: The CCM does not allow you to specify multiple actual paths for onevirtual directory. Consequently, when you are running more than one WCSmachine, the actual path to your .csp files (and any other Crystal Enterprise filetypes) must be identical on each WCS machine.





Configuring virtual path mappings on UNIX

The configuration entries that affect your virtual path mappings depend upon both the type of web server and the type of Web Connector that you are using.

Click the appropriate link to jump to that section:• Apache (ASAPI Web Connector)

• iPlanet Enterprise Server (NSAPI Web Connector)

• Any web server with the CGI Web Connector

Apache (ASAPI Web Connector)

If you are using Apache with the ASAPI Web Connector, the virtual path mappingis made in the asapi.conf file (so long as you used the Include command in yourhttpd.conf file to reference the Crystal Enterpriseasapi.conf file, as outlined in theCrystal Enterprise Installation Guide).

The relevant lines are as follows:• WCSHosts WCSLIST

This line defines the Web Component Server(s) that the ASAPI module mustcommunicate with. WCSLIST is a list of one or more WCS hosts, specified asmachinename:portnumber (separate multiple entries with semicolons).

• AddPathMap /crystal csp "WCS_INSTALL_ROOT /webcontent"

This line defines how the ASAPI module translates file paths for each CrystalServer Page (.csp file). Any .csp request made to http://webserver/crystalmust be mapped relative to the webcontent directory on the WCS. The virtualdirectory on the web server is specified first (/crystal); the file extension isspecified second (csp); and the absolute path ofthe Crystal Enterprise web contentdirectory on the Web Component Server is specified last (WCS_INSTALL_ROOT /

webcontent).

iPlanet Enterprise Server (NSAPI Web Connector)

If you are using iPlanet Enterprise Server 6.x with the NSAPI Connector, thevirtual path mapping is made in the Init line of the iPlanetmagnus.conf file. Ensurethat the following line appears in the magnus.conf file:

Init fn="req_init" WCSHosts="WCSLIST " ClientPool="5"ConnectorTimeout="600000" WCSPathMap="/crystal;.csp;WCS_INSTALL_ROOT /webcontent,/crystal;.cri;WCS_INSTALL_ROOT /webcontent,/crystal;.rpt;WCS_INSTALL_ROOT /webcontent,/crystal;.cwr;WCS_INSTALL_ROOT /

webcontent"Note: If you are using iPlanet Enterprise Server 4.1 with the NSAPI WebConnector, this same Init line is located in the iPlanet obj.conf file.





This Init line provides the NSAPI Web Connector module with the instructionsnecessary for mapping paths correctly. The relevant portions can be broken downas follows:

• WCSHosts="WCSLIST "

This line defines the Web Component Server(s) that the NSAPI module mustcommunicate with. WCSLIST is a list of one or more WCS hosts, specified asmachinename:portnumber (separate multiple entries with semicolons).

• WCSPathMap="/crystal;.csp;WCS_INSTALL_ROOT /webcontent,..."

The WCSPathMap command maps paths from the web serverto the WCS based onfile type. The portion quoted here defines how the NSAPI module translates filepaths for each Crystal Server Page (.csp file). Any .csp request made to http://webserver/crystal must be mapped relative to the webcontent directory on theWCS. The virtual directory on the web server is specified first (/crystal); thefile extension is specified second (.csp); and the absolute path of the CrystalEnterprise web content directory on the Web Component Server is specified last(WCS_INSTALL_ROOT /webcontent).

Note: The entries for each mapped file type are separated by commas, but allentries are contained within double-quotes.

Any web server with the CGI Web Connector

If you are using the CGI Web Connector, the virtual path mapping is made in thewcscgi.cgi script, regardless of the type of web server you are running.

First, ensure that the following line appears in the wcscgi.cgi script:

WCSHOST1=machinename:portnumber; export WCSHOST1;

This line sets the WCSHOST1 environment variable, which specifies the host machine

that is running the Web Component Server (WCS). Replace machinename with thefully qualified domain name (or IP address) of the machine that is running theWCS. Replace portnumber with the port that the WCS is listening on (by default,this is port 6401). You may specify additional WCS machines by defining similarenvironment variables with names WCSHOST2, WCSHOST3, and so on.

Second, ensure that the following line appears in the wcscgi.cgi script:

WCSPATHMAP1="/crystal;csp;WCS_INSTALL_ROOT /webcontent"; export WCSPATHMAP1

This line defines how the CGI Web Connector handles a request for a CrystalServer Page (.csp files). Any .csp request made to http://webserver/crystal must be mapped relative to the webcontent directory on the WCS. The virtual directoryon the web server is specified first (/crystal); the file extension is specified second(csp); and the absolute path of the Crystal Enterprise web contentdirectory on the WebComponent Server is specified last (WCS_INSTALL_ROOT /webcontent).

To map different paths or different file extensions, add a new environmentvariable with the prefix “WCSPATHMAP”. For instance, to make unmanaged Crystalreports available on your web site, you would add a line similar to this:

WCSPATHMAP2="/crystal;rpt;WCS_INSTALL_ROOT /webcontent"; export WCSPATHMAP2




General Troubleshooting E

This appendix provides general troubleshooting steps andsolutions to some specific configuration problems. For up-to-date answers to commonly asked questions, registeredcustomers can freely download additional technicaldocuments or knowledge base articles from:

http://support.crystaldecisions.com

For more information on Product Registration and CrystalCare technical support, see “Crystal Care technicalsupport” on page 6.



Troubleshooting overview


Troubleshooting overviewCrystal Enterprise is designed to integrate with a multitude of different operatingsystems, web servers, network and firewall configurations, database servers, andreporting environments. Thus, any troubleshooting that you may need to undertakewill likely reflect the particularities of your deployment environment. Thisappendix includes general troubleshooting steps along with solutions to somespecific configuration issues.

In general, consider the following key points when troubleshooting:

• Ensure that client and server machines are running supported operatingsystems, database servers, database clients, and appropriate server software.For details, consult the Platforms.txt file, included with your productdistribution.

• Verify that the problem is reproducible, and take note of the exact steps thatcause the problem to recur.

On Windows NT/2000, use the sample reports and sample data included withthe product to confirm whether or not the same problem exists.

• Determine whether the problem is isolated to one machine or is occurring onmultiple machines. For instance, if a report fails to run on one processingserver (Job Server or Page Server), see if it runs on another processing server.

If the problem is isolated to one machine, pay close attention to anyconfiguration differences in the two machines, including operating systemversions, patch levels, and general network integration.

• If the problem relates to connectivity or functionality over the Web, check thatCrystal Enterprise is integrated properly with your web environment. Fordetails, see “Troubleshooting path mappings” on page 297 and “Web

accessibility issues” on page 311.• If the problem relates to report viewing or report processing, verify your

database connectivity and functionality from each of the affected machines.Use Crystal Reports to verify that the report can be viewed properly. If the Jobor Page Servers are running on Windows, open the report in Crystal Reportson the server machine and check that you can refresh the report against thedatabase. For details, see “Reporting viewing and processing issues” onpage 313.

• Look for solutions in the documentation included with your product. Fordetails, see “Documentation resources” on page 311.

• Check out the Crystal Care technical support web site for white papers, files

and updates, user forums, and Knowledge Base articles:http://support.crystaldecisions.com





Documentation resourcesThe Crystal Enterprise Release Notes are provided in two formats (release.pdfand release.htm) in the root directory of your product distribution, as is thePlatforms.txt file. These documents list supported third-party software alongwith any known issues or implementation-specific configuration details.

Crystal Enterprise also includes four manuals:

• Crystal Enterprise ePortfolio User’s Guide (printed copy, HTML, CHM, and PDF)

• Crystal Enterprise Getting Started Guide (printed copy, HTML, CHM, and PDF)

• Crystal Enterprise Administrator’s Guide (printed copy, HTML, CHM, and PDF)

• Crystal Enterprise Installation Guide (HTML, CHM, and PDF)

CHM and PDF files are located in the doc directory of your product distribution.Online HTML Help versions are installed with the Web Connector and the WebComponent Server. Access the HTML versions from the Crystal EnterpriseLaunchpad, or look in the appropriate directory on your Web Connector or WebComponent Server machine:

• On Windows, the files are installed by default below the C:\ProgramFiles\Crystal Decisions\Web Content\Enterprise\Help\ directory of yourinstallation.

• On UNIX, the files are installed below the INSTALL_ROOT /crystal/webcontent/enterprise/help/ directory of your installation.

Additional Compiled HTML Help (CHM) files are provided with the followingclient tools:

• Crystal Configuration Manager

• Crystal Publishing Wizard

• Crystal Import Wizard• Crystal Offline Viewer

Press F1 or click Help to launch the online help from within these applications.

Web accessibility issues

Using an IIS web site other than the default

On Windows, the Crystal Enterprise installation creates a viewer virtual directoryand a crystal virtual directory on the Internet Information Server (IIS) “Default

Web Site.” If you are using a web site other than the default, you must copy theviewer and crystal virtual directory configuration from the default web site to theweb site you are using. Crystal Enterprise also sets up several applicationmappings on the default site. These can be viewed and copied from the defaultweb site to the web site you are using. Restart the web server once you have madethese changes. For more information, see “Path mapping overview” on page 298.



Web accessibility issues


UNIX Web Connector cannot access WCS on Windows

If you install any of the Web Connectors on a UNIX web server, and install the WebComponentServer (WCS) on Windows NT/2000, then youmust ensure that the WCSis not configured to use Windows NT Integrated security (NT Challenge/Response).

Until you disable this security, you can access the Crystal Enterprise Launchpad, butyou cannot access the Crystal Management Console (CMC) or ePortfolio.

Note: Ensure also that you can ping the WCS machine by name from the UNIXweb server.

To disable Windows NT Integrated security

1 Start the Crystal Configuration Manager (CCM) on the WCS machine.

2 Stop the Crystal WCS, and then double-click it to view its Properties.

3 On the Configuration tab, clear the Use Windows NT Integrated Security(NT Challenge/Response) check box; then click OK.

4 Start the Crystal WCS.

If you still cannot access ePortfolio or the CMC, check the mappings between theweb server, the Web Connector, and the WCS. For details, see “Path mappingoverview” on page 298.

Communication error when accessing the CMC

One of the more common errors encountered over the Web results in the followingerror message being displayed in the browser:

Communication Error

Communication failed with all configured Web Component Servers because theyare disabled or not currently running. If this problem continues, please

contact the system administrator.

This error indicates that the WCS is offline or that the Web Connector is notconfigured correctly. First, use the CCM to start the WCS and then enable it. (If theWCS was already startedand enabled, usethe CCM to restart it.) If restarting the WCSdoes not correct the situation, check the mappings between the web server, the WebConnector, and the WCS. For details, see “Path mapping overview” on page 298.

Unable to connect to APS when logging on to the CMC

If you attempt to log on to the CMC while the Automated Process Scheduler (APS)is not running, the following error message appears:

Unable to connect to APS (<servername>) to retrieve cluster members. Logon

can not continue.

Use the CCM to start the APS. (If the APS was already started, use the CCM torestart it.)





Windows NT authentication cannot log you onWhen you attempt to log on to the Crystal Management Console (CMC) or toePortfolio, the following error occurs:

NT Authentication could not log you on. Please make sure your logon

information is correct. If your account is in any domain other than "DOMAINNAME" you must enter your user name as DomainName\UserName.

This error may occur for various reasons. Investigate these common solutions:

• Ensure that the specified authentication type corresponds to the user nameand password provided on the log on page. To log on with a Windows NTuser name, verify that the authentication type is set to Windows NTAuthentication and not Enterprise.

• Netscape users must provide a valid Windows NT user name in the form of Domain\User.

• Microsoft Internet Explorer users must provide a valid Windows NT username. It must be in the form of Domain\User if the user account does not reside

in the default domain of the APS.• If Windows NT Integrated security (NT Challenge/Response) is enabled in

Internet Information Services (IIS) and in the Web Component Server (WCS),then users must use Microsoft Internet Explorer. In addition, users must log onto the client machine with a valid NT domain user account before logging onto Crystal Enterprise. Users must log on to Crystal Enterprise with a validWindows NT user name. It must be in the form of Domain\User if the useraccount does not reside in the default domain of the APS.

• The web server and all Crystal Enterprise components must be running onWindows NT/2000 for Windows NT authentication to work.

Reporting viewing and processing issuesWhen troubleshooting reports, it is especially useful to determine whether theproblem is isolated to one machine or is occurring on multiple machines. Forinstance, if a report fails to run on one processing server (Job Server or PageServer), see if it runs on another processing server.

If the problem is isolated to one machine, pay close attention to any configurationdifferences in the two machines, including operating system versions, patch levels,and general network integration.

In particular, check the database client configurations, the drivers and versions,and the accounts under which the processingservers are running. If the reports are

based off ODBC data sources, compare the ODBC driver versions, the DSNconfigurations, and the versions of the MDAC layer.

If you follow these steps and the problem persists, contact Crystal Care technicalsupport. Before you call, take note of the database client and version you arerunning, the database server version that you are connecting to, and the drivername and version that you are using to connect. For details, see “Crystal Caretechnical support” on page 6.



Reporting viewing and processing issues


Troubleshooting reports and looping database logon prompts

A common issue when viewing reports over the Web is a persistent database logonprompt that is displayed repeatedly by the user’s browser. Regardless of thecredentials provided by the user, the report will not display. This problem is

typically caused by the configuration of the Page Server. This section provides aseries of troubleshooting steps that should resolve this problem and others that arespecific to reports and database connectivity.

Tip: This section applies to reports that you have published to Crystal Enterprise.If you are troubleshooting .rpt files that are directly accessible through your webserver (unmanaged reports), see “Supporting Crystal Reports 8 web distribution”on page 320.

To troubleshoot reports and looping database logon prompts

1 Verify the report with Crystal Reports.

Use Crystal Reports to verify the report. If you have the Crystal ReportsDesigner installed on the Page Server or Job Server machine, test databaseconnectivity by opening the report in Crystal Reports on the server. For details,see “Troubleshooting reports with Crystal Reports” on page 316.

2 Change the server’s logon account.

Crystal Enterprise servers require access to various local and/or remoteresources and to the database server. Experience shows that running the PageServer, Job Server, and Web Component Server (WCS) under a DomainAdministrator account allows them to access the components necessary toconnect successfully to data sources. To change a server’s logon account, see“Configuring Windows processing servers for your data source” on page 227.

Tip: Running a background application under an Administrator account doesnot inadvertently grant administrative privileges to another user, because userscannot impersonate services.

3 Verify the server’s access to ODBC Data Source Names (DSNs).

Base reports off System DSNs (and not File or User DSNs), and set up eachSystem DSN identically on every Job Server and Page Server machine that willprocess the report.

If the report is based off an ODBC data source, the processing server must havepermission to access the corresponding DSN configuration. This information isstored in the Windows registry. The Job Server and Page Server require FullControl or Special Access to the ODBC registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI

Consult your Windows documentation for information about working with theregistry. Additional configuration may be required, depending upon thedatabase that you are reporting off of. For details, see “Configuring Windowsprocessing servers for your data source” on page 227.





4 Determine the configuration of the database client software.

If you are not using ODBC, the database client software must be installed oneach machine that will process reports. On Windows, many database clientsstore their configuration in the registry below HKEY_LOCAL_MACHINE.

If your database client stores its configuration below HKEY_CURRENT_USER, theCrystal Enterprise services cannot use the database client software tocommunicate with the database. To work around this issue, you can run the JobServer and Page Server as foreground applications, thereby allowing them toutilize the database client. The-console command-line option allows you to runa server in the foreground.

5 Verify the NTFS permissions granted to the Job Server and Page Server.

Insufficient NTFS rights on the server may cause a number of problems to arisewhen you view reports over the Web. As in step 2, changing each server’s logonaccount to that of a Domain Administrator account should resolvesuch problems.

6 Check whether or not NT authentication is performed by the database.

If you report against a database that uses NT authentication for access control(Microsoft SQL Server, Sybase, and so on), the Job Server and Page Server mustrun under a Windows NT/2000 domain user account that has access to theappropriate database tables. (In this scenario, each server’s logon accountdetermines the level of access it is granted by the database. Crystal Enterprisedoes not pass the end-users NT tokens through to the database server.)

To retain the access control levels that are set up within the database, you caninstead change each ODBC DSN so that it implements SQL Server Logininstead of NT authentication.

7 Check the available environment variables.

Environment variables are used by the operating system to govern and managesystem files for particular users. On Windows, Crystal Enterprise servers aregenerally most affected by the TMPand TEMP environment variables. Because theservers are run as services, they cannot access the User Environment variablesthat are created by default. Therefore, it is recommended that you create SystemEnvironment variables if they do not already exist. Consult your Windowsdocumentation for details.

8 Reference remote data sources with UNC paths.

Ensure that servers have access to remote databases through UNC paths,instead of through mapped drives. For example, if you design a report off a PCdatabase that resides on a network drive, ensure that the report references its

data source with the appropriate UNC path. For details, see “Server resourcesmust be available on local drives” on page 319.

9 Ensure that you have enough database client licenses.

If all databaseclient licenses are in use, the Crystal Enterprise servers are unableto retrieve data from the database.





10 Check that database connections are closed in a timely fashion.

If a database connection is not closed quickly, the database may not serviceanother request until the connection has been closed. To decrease the “MinutesBefore an Idle Job is Closed” setting, see “Modifying Page Server performance

settings” on page 221.11 Use multi-threaded database drivers.

Multi-threaded database drivers allow the processing servers to connect to thedatabase without having to wait for the database to fulfill initial requests.ODBC connections are typically recommended because they providemultithreaded connections to the database. However, Crystal Reports nowincludes a number of thread-safe native and OLEDB drivers. A list of thesethread-safe drivers is available in the Crystal Reports 8.5 Release Notes.

12 Check for problems with particular data sources.

If your report is based on a Crystal Query file (.qry) a Crystal Dictionary (.dc5),or a Lotus Notes database, you may need to perform additional configuration.Download the latest instructions from the Crystal Care Knowledge Base.

IBM offers several client applications for connecting to DB2. The recommendedclient is IBM DB2 Direct Connect, whose ODBC drivers were written for actualprogrammatic interaction with products like Crystal Enterprise. See the CrystalCare Knowledge Base for discussions of this and other DB2 clients.

If you encounter problems with any other specific data sources, check theKnowledge Base for the latest information.

Troubleshooting reports with Crystal Reports

On Windows, you can install Crystal Reports on all Job Server or Page Server

machines in order to speed up the troubleshooting of reports and databaseconnectivity. In this way, you use Crystal Reports to simulate the steps that areperformed by the Crystal Enterprise processing servers when a scheduled reportis processed, or when a report is viewed on demand over the Web. By locating thestep where Crystal Reports is unable to open, refresh, or save the report, you may be able to locate the source of the problem.

To troubleshoot a report

1 Start Crystal Reports on the appropriate machine:

• If the report runs successfully on demand, but fails when scheduled, startCrystal Reports on the Job Server.

• If the report fails when viewed on demand, but runs successfully whenscheduled, start Crystal Reports on the Page Server.

• If the report fails when viewed on demand or scheduled, complete thesetroubleshooting steps on both the Job Server and the Page Server.





2 Open the report from the APS.

On the File menu, click Open. Click Enterprise Folders and log on to your APS.If you cannot open the report, verify network connectivity between the serveryou are working on, the APS, and the Input File Repository Server.

3 Test your database connection and authentication.On the Database menu, click Log On/Off Server. If you cannot log on to thedatabase server, check the configuration of the database client software andensure that the report contains a valid database user name and password.

4 If the report’s parameters or record selection need to be modified by CrystalEnterprise users when they schedule or view the report, change the parametervalues or record selection formula accordingly. If the values are invalid,Crystal Reports will report an error.

5 Verify that the tables used in the report match the tables in the database.

On the File menu, clear the “Save Data with Report” check box. On the

Database menu, click Verify Database. Correct any issues reported by CrystalReports, and then save the report.

6 Refresh the report and, if current data is not returned from the database, checkthese possible causes:

• If the report fails, ensure that the database credentials provide READ rightsto all tables in the report.

• If the database credentials are valid, the report’s SQL statement isevaluated at this time. Check the join information. Note any ODBC errorsthat are produced.

• If the SQL statement is valid, data begins to return to Crystal Reports. Asthis happens, the temporary files increase in size. Verify resource allocation

in case the machine is running out of memory or disk space.

7 Go to the last page of the report.

Crystal Reports will report any errors that it encounters within the report (suchas formulas, subreports, and other objects).

8 Export the report to Crystal Reports format (or any other desired format).

This step ensures that Crystal Reports is able to create temporary files that arerequired in order to complete the processing of a report.

9 If the report now refreshes successfully, save it back to the APS.

10 Close the report.

11 Close Crystal Reports.

12 Repeat the activity that caused the original report to fail: view the report ondemand over the Web, or schedule the report for processing.





Error detected by database driver

When the Job Server or Page Server receives an unknown message from thedatabase driver, an error message similar to the following appears:

Error Detected By Database DLL

This section provides some common troubleshooting steps for resolving this issue.Before completing these steps, verify your database connectivity and generalreporting configuration (as described in “Troubleshooting reports and loopingdatabase logon prompts” on page 314).

To troubleshoot database driver errors

1 Verify the database drivers for consistency.

Ensure that the database driver (ODBC or native) used when the report wasdesigned in Crystal Reports matches the database driver that is installed on the Job Server and Page Server.

If the Job Server or the Page Server is installed on UNIX, then the databasedriver will not match exactly (the UNIX version will be a .so file instead of a.dll). However, the Windows/UNIX versions of each driver should correspondin regards to version numbers or driver release.

2 Disable the report’s “Use Indexes or Server for Speed” option.

Open the report in Crystal Reports and, on the File menu, click Options. On theDatabase tab, clear the “Use Indexes or Server for Speed” option. Disabling thisoption may resolve database driver errors.

3 Ensure that the report’s SQL statement has not been edited manually.

Open the report in Crystal Reports and, on the Database menu, click Show SQL

Query. Copy the query into a text editor; then click Reset in the Show SQL Querydialog box.Compare theregenerated query with the version displayed in your texteditor. If the queries differ, save the report so it uses the regenerated SQL query.

Note: If you need to edit a report’s SQL statement, do so with a storedprocedure, rather than by editing it manually. If you have developed a webapplication that modifies the SQL statement through code, ensure that onlythe WHERE clause is changed.

4 Ensure that null values are not being passed to subreports.

If the report contains one or more subreports, open it in Crystal Reports and, onthe File menu, click Report Options. Select the “Convert NULL Field Value toDefault” check box.

5 If the report is based off on ODBC driver, enable tracing to obtain moreinformation about the error.

On Windows, ODBC tracing can be started through the ODBC Data SourceAdministrator. On UNIX, similar tracing can be enabled in the systeminformation file (.odbc.ini).





Once you enable tracing, run the report again from a browser to generate thetracing log. After you run the report, disable tracing and review the log file foradditional “Error” or “Busy” messages. Tracing may provide additional detailsthat allow you to troubleshoot the problem.

6 If the report is based off Informix 7.3, check the database driver.If a report that uses the Informix database driver (Windows version) causes adatabase driver error, modify the report to use the Crystal Reports “CRInformix” driver.

7 Verify the table definition of the database that the report is based off.

If your web application dynamically changes a report’s data source at runtime,ensure that the schema of each database matches the schema of the databasethat the report was originally designed for. Rather than running the samereport against diverse data sources, consider designing a separate report foreach database.

8 Verify the data type of parameter values passed through code.If your web application passes parameter values to a report, ensure that you arecasting the correct data type for the parameter value. It is always a good idea tocast values to ensure they are of the correct type. For specific details, see thefunction reference for your development language.

Server resources must be available on local drives

When the Crystal Enterprise servers are running on Windows, many can beconfigured to use specific directories to store files. For example, you can specify theroot directory for each File Repository Server, the temporary directories for theCache and Page Servers, or the directory from which the Job Servers loadprocessing extensions. In all cases, the directory that you specify must be on a localdrive (such as C:\InputFRS or C:\Cache). Do not use Universal Naming Convention(UNC) paths or mapped drives.

Although some Crystal Enterprise servers can recognize and use UNC paths, donot configure the servers to access network resources in this manner. Use localdrives instead, because UNC paths can limit performance due to limitations in theunderlying protocol.

Tip: If your report runs against a PC database that resides on a network drive, thenthe report itself must reference its data source through a UNC path. In this case,the service must run under a domain user account with network permissions. For

details, see “Configuring Windows processing servers for your data source” onpage 227.

Similarly, if you configure a server to use a mapped drive, the server may appearto function correctly. However, servers cannot access mapped resources when themachine is restarted. Drives are mapped according to your user profile when youlog on to Windows NT/2000, but, once a drive is mapped, it is available to the





entire operating system. So, when you log on and map a local or network drive, themapped drive is accessible to the LocalSystem account, and hence to the CrystalEnterprise servers running on the local machine. When you log off the localmachine, the servers may retain access to the mapped drive for some time(Windows will release the drive mapping if no application maintains a persistentconnection to the mapped resource). However, when you restart the local machine,the mapped drive is not restored until you log back on.

Note: Changing a server’s log on account from the LocalSystem account to aWindows NT/2000 user account with network privileges will not resolve theproblem, because the servers do not actually log on to the network with thataccount. Instead, the servers perform “account impersonation.” This providesaccess to some profile-specific resources (such as printers and email profiles), butnot others (such as ODBC User Data Source Names and mapped drives).

Supporting Crystal Reports 8 web distribution

Crystal Enterprise continues to support the web distribution system you set upusing Crystal Reports 8:

• If you have installed Crystal Enterprise on one machine over your CrystalReports 8 implementation, no additional configuration is required. Yourexisting web pages will continue to work in the same way.

• If your Crystal Enterprise Page Server is on the same machine as your CrystalReports 8 implementation, but this a different machine from your web server,ensure that the path structure on all machines is identical. Changes to yourweb page may be required.

• If you have multiple Page Servers, the directory structure and reports need to be the same on each machine.

Note: When you uninstall Crystal Enterprise, all of the web functionality from both Crystal Reports and Crystal Enterprise will be removed. You will need toreinstall Crystal Reports 8 to regain use of Crystal Reports 8 web distribution.

Page Server error when viewing a report

When you attempt to run or preview a report, the following error message appears:

There are no Page Servers connected to the Cache Server or all the connected

Page Servers are disabled. Please try to reconnect later. [On Page Server :

<servername>.Cacheserver]

This error indicates that the Page Server is not started and enabled. Use the CCMto start the Page Server and then enable it. (If the Page Server was already startedand enabled, use the CCM to restart it.)





ePortfolio considerations

Supporting ePortfolio users in multiple time zones

Avoid granting Schedule access to the default Guest account if you deployePortfolio as the web desktop for users in different time zones. Instead, ensure thateach user who is allowed to schedule reports has a dedicated account on thesystem, and that each user's ePortfolio preferences include the appropriate time-zone setting. To view or modify the time-zone setting for any user account, use theePortfolio Preferences Manager, which is available as an Administrative Sampleon the Crystal Enterprise Launchpad. Dedicated accounts are recommended because the default Guest account does not allow users to modify accountpreferences that would affect other users. For more information about usingspecific time-zone properties in your custom web applications, see the CrystalEnterprise Web Developer's Guide.

Setting default report destinations

By default, a report's destination that is set in the CMC will be the selecteddestination when a report is scheduled in ePortfolio. A user can also selectalternate destinations in ePortfolio by updating the Destination option. Note thatthe destination set in ePortfolio applies only to the scheduled instance. Thus, whena user schedules another instance in ePortfolio, the destination that is set in theCMC will be selected, unless the user changes the Destination option. If the userselects the Default destination setting in ePortfolio, reports are processed on the Job Server and sent to the File Repository Server. The Default destination settingin ePortfolio is equivalent to the Default destination setting in the CMC.

Setting preferences and report viewers for ePortfolio users

The ePortfolio Preferences Manager enables you to set the default ePortfoliopreferences for each user on the system. If users have their own accounts on thesystem, they can modify their preferences when they log on to ePortfolio. If usersaccess ePortfolio anonymously—with the Guest account—you can use this tool toset preferences, including the default report viewer. Users cannot change theirpreferences when they are logged on under the Guest account.

The ePortfolio Preferences Manager is available as an Administrative Sample onthe Crystal Enterprise Launchpad.



Configuring your web farm for load balancing


ePortfolio and Windows NT Single Sign On

ePortfolio provides its own form of “anonymous Single Sign On,” which usesEnterprise authentication, as opposed to Windows NT authentication. Design yourown web applications accordingly (or modify ePortfolio) if you want to use NT

Single Sign On. By default, when a user launches ePortfolio, he or she will beautomatically logged on using the Guest account (Enterprise authentication).However, even when you disable the Sign Up feature, ePortfolio is designed todisplaya logon page. With Single Sign On enabled, the user can selectWindows NTfrom the Authentication list andclick Log On without entering his or her user nameor password. In the Crystal Enterprise Web Developer’s Guide, refer to lesson 2 of thetutorial for an example on creating a web application that uses Single Sign On.

For details on configuring IIS and Crystal Enterprise for Windows NT Single SignOn, see “Setting up NT Single Sign On” on page 52.

Configuring your web farm for load balancingA web farm is a group of two or more web servers working together to handle browser requests. To use your web farm in a Crystal Enterprise environment, theWeb Connectors that reside on each of the web servers need to be configured sothey are aware of the Web Component Servers they should communicate with.

Note: Crystal Enterprise supports web farms with and without affinity masks.

After the connectors have been configured, they can load-balance requests between the Web Component Servers. When a web server establishes a connectionwith a Web Component Server, it uses a round robin algorithm to identify the nextavailable Web Component Server. The only exceptions to this occur when a web

server uses a CGI web connector, or if a session state was created on a previousrequest to the Web Component Server. The CGI web connector uses a randomalgorithm instead of a round robin algorithm because the connector doesn’t haveknowledge of the last Web Component Server it communicated with. Requeststhat had a session set up previously, must return to the same Web ComponentServer each time to ensure that subsequent requests have access to the previouslyset session state.

Both of the following procedures need to be completed for each web server in yourCrystal Enterprise environment.





To specify the Web Component Server the web server should use

This procedure assumes that the Web Connector has been installed on each of theweb server machines. For more information on performing a custom installation,see the Crystal Enterprise Installation Guide.

1 Start the CCM.

2 Click Configure Web Connector.

3 Click Add in the Web Component Servers area.

4 Enter the IP address or host name where the Web Component Server youwould like to communicate with resides.

5 Enter the port number.

This is the Web Component Server port number.

6 Click OK.

The Web Component Server is added to the list.Note: Repeat this procedure for each Web Component Server the web servershould have access to.

To specify the virtual directory the Web Connector should use

1 Click Add in the Path Mapping area.

2 Enter the virtual path of the web server.

3 Enter .rpt and .csp as the extensions.

4 Enter the actual path of the Web Component Server.

5 Click OK.

Note:

• For more information on virtual directories and path mapping, see“Troubleshooting path mappings” on page 297.

• Crystal Enterprise dynamically maintains the list of available WCS machines, soyour web server should respond to your changes within a maximum of severalminutes (without restarting). However, if you are running Apache as your webserver, you must instruct Apache to reinitialize its child worker processes afteryou add or remove WCSHOSTS to the Web Connector configuration files. You cangenerally do this with one of the following commands:

kill -HUP `cat <absolute path to httpd.pid file>`

kill -USR1 `cat <absolute path to httpd.pid file>`

Consult the Apache documentation for more information.



Configuring your web farm for load balancing





Glossary

Active Server Pages

Active Server Pagesare web pages that run under Microsoft’s Internet InformationServer (IIS) version 3.0 and later. Active Server Pages combine HTML, VBScript or JScript, and ActiveX controls to create dynamic web pages that can be viewed frommost web browsers.

ActiveX Control

A Custom Control for Visual Basic 4.0 and above that incorporates Object Linkingand Embedding (OLE) technology. Formerly known as an OLE Control (OCX).

alias

An alias is an alternate name that is assigned to a user to enable him or her to logon to CrystalEnterprise. For example, a user may have both an Enterprise alias andan LDAP alias that he or she can access the system with.


The Automated Process Scheduler (APS) is responsible for maintaining a databaseof information about your Crystal Enterprise system; the other components cantherefore access that data as required. The data stored by the APS includesinformation about users and groups, security levels, Crystal Enterprise content,and servers. The APS maintains security and manages objects and servers.

Cache Server

The Cache Server is responsible for handling all viewing requests from the WebComponent Server (WCS). The Cache Server checks whether or not it can fulfill therequest with a cached report page. If it cannot, it passes the request along to the

Page Server. The Page Server runs the report and returns the results to the CacheServer. The Cache Server then caches the information and returns the data to theWCS. By storing report pages in a cache, Crystal Enterprise avoids accessing thedatabase each and every time a report is requested.




CCM

The Crystal Configuration Manager (CCM) is a server administration tool. It isprovided in two forms. In a Windows environment, the CCM allows you tomanage local and remote servers through its Graphical User Interface (GUI) or

from a command line. In a UNIX environment, the CCM shell script (ccm.sh)allows you to manage servers from a command line.

CMC

The Crystal Management Console (CMC) web application is the most powerfuladministrative tool provided for managing a Crystal Enterprise system. It offersyou a single interface through which you can perform almost every task related touser management, content management, and server management.

Crystal Analysis

Crystal Analysis is a design tool for creating OLAP applications that allow you toview and analyze data from different data sources. They can be distributed asdesktop applications, or published on the Web using Crystal Enterprise.

Crystal Import Wizard

The Crystal Import Wizard is a locally installed Windows application that allowsyou to migrate existing user accounts, groups, folders, and reports to your newCrystal Enterprise system. The Crystal Import Wizard runs on Windows, but youcan use it to import information to a new Crystal Enterprise system that is runningon Windows or on UNIX.

Crystal Publishing WizardThe Crystal Publishing Wizard is a locally installed, 32-bit Windows application.The wizard enables administrators and end users to publish Crystal report (.rpt)files to Crystal Enterprise.

Crystal Server Pages (CSP)

Crystal Server Pages (CSP), which are similar to Active Server Pages (ASP), areused to provide dynamic responses to users browsing Crystal Enterprise.ePortfolio, for instance, is written in CSP. CSP files contain a mixture of HTML codeand scripting code such as VBScript or JavaScript (also known as JScript or ECMA

Script). CSP pages are text files with a .csp extension, and they can be developedwith a text editor or an application such as Microsoft FrontPage or Microsoft VisualInterDev. For details, see the Crystal Enterprise Web Developer’s Guide.




Crystal Web Wizard

This Windows application is designed to assist new developers in building andinstalling web applications. The wizard lets you create a custom web applicationor install a sample project. You can use this wizard as a stand-alone application or

as a Microsoft FrontPage web creation tool.

custom event

A custom event is an event that is triggered manually by a user through the CMC,or triggered directly through CSP code. A scheduled report that is dependent on acustom event will run only when the event is triggered.

database

A database is a bank of related data. Each unit (record) of the database is typicallyorganized in a fixed format to make it easier to retrieve selected portions of the

data on demand. Each record is made up of one or more data fields, and each datafield can hold one piece of data (known as a value).

data source

A data source is a database, table, query, or stored procedure result set thatprovides the data for a report.

Dynamic Link Library (DLL)

A Dynamic Link Library (DLL) is a special kind of file that contains Windowsfunctions. DLLs are used by developers to extend the capabilities of Windows

applications. The library is activated whenever an application or another DLL callsa function in the library. DLLs link on the fly, at runtime, whenever an includedfunction is called. DLL functions are available on an as-needed basis to anyprogram that can call DLLs; they do not need to be linked to the program via thecompiler. The Crystal Report Engine can be called as a DLL by developers for usewith applications they are developing.

Enterprise authentication

Enterprise authentication is the default authentication method used by CrystalEnterprise. You can create distinct accounts and groups for use with CrystalEnterprise. Crystal Enterprise also supports NT authentication and LDAP

authentication.




ePortfolio

ePortfolio is a web-based interface that end users access to view, schedule, andkeep track of published reports. Each Crystal Enterprise request that a user makesin ePortfolio is directed by the web server to the Web Connector, which then

forwards the request to the Web Component Server.

event

An event is a preset trigger for scheduling and processing objects. Event-basedscheduling provides you with additional control over scheduling reports: you canset up events so that reports are processed only after a specified event occurs.Working with events consists of two steps: creating an event and scheduling areport with events. That is, once you create an event, you can select it as adependency when you schedule a report. The scheduled job is then processed onlywhen the event occurs. You can schedule a report with a file event, a custom event,and/or a schedule event.

Event Server

The Event Server manages file-based events. When you set up a file-based eventwithin Crystal Enterprise, the Event Server monitors the directory that youspecified. When the appropriate file appears in the monitored directory, the EventServer triggers your file-based event: that is, the Event Server notifies the APS thatthe file-based event has occurred. The APS then starts any jobs that are dependentupon your file-based event.

file event

A file-based event waits for a particular file (the trigger) to appear before the eventoccurs. Before scheduling a report that waits for a file-based event to occur, youmust first create the file-based event in the Events management area of the CMC.When you define a file-based event, you specify a filename that the Event Servershould monitor for a particular file. When the file appears, the Event Servertriggers the event.

File Repository Server

There is one Input and one Output File Repository Server in every CrystalEnterprise implementation. The Input File Repository Server contains all of thereport objects that have been published to the system by administrators or end

users (using the Crystal Publishing Wizard, the Crystal Management Console(CMC), the Crystal Import Wizard, or a Crystal designer component such asCrystal Reports). The Output File Repository Server contains all of the reportinstances generated by the Job Server(s). The File Repository Servers areresponsible for listing files on the server, querying for the size of a file, queryingfor the size of the entire file repository, addingfiles to the repository, andremovingfiles from the repository.




group

A group is a collection of userswho share the same account privileges. For instance,you can create groups that are based on department, role, or location. Groupsenable you to make changes in one place (a group) instead of modifying each user

account individually. Also, you can assign object rights to a group or groups.

instance

An instance is a copy or ‘version’ of an object that contains report data that isretrieved from one or more databases. Each instance contains data that is currentat the time the report, query, or program is processed. In Crystal Enterprise, youpublish objects to the system, and then schedule those objects to generate instanceson a recurring basis.

Input File Repository Server

See File Repository Server.

Job Server

The Job Server processes scheduled reports, as requested by the AutomatedProcess Scheduler, and generates report instances (instances are versions of areport object that contain saved data). To generate a report instance, the Job Servercommunicates with the database to retrieve the current data.

LDAP authentication

Lightweight Directory Access Protocol (LDAP) authentication enables you to useexisting LDAP user accounts and groups (on an LDAP directory server) in Crystal

Enterprise. When you map LDAP accounts to Crystal Enterprise, users are able toaccess ePortfolio and other Crystal Enterprise applications with their LDAP username and password. This eliminates the need to recreate individual user andgroup accounts within Crystal Enterprise.

logon token

A logon token is an encoded string that defines its own usage attributes andcontains a user’s session information. The logon token’s usage attributes arespecified when the logon token is generated. These attributes allow restrictions to be placed upon the logon token to reduce the chance of the logon token being used by malicious users.

mapping accounts

Mapping an account enables a user with an NT or LDAP account to access CrystalEnterprise. Typically, you map NT or LDAP user accounts to Crystal Enterprisethrough the CMC. When you mapan NT or LDAP account, you can choose to createa new Crystal Enterprise account or link to an existing Crystal Enterprise account.




NT authentication

NT authentication is a Windows-specific authentication method that enables youto use existing NT user accounts and groups in Crystal Enterprise. When you mapNT accounts to Crystal Enterprise, users are able to log on to ePortfolio and other

Crystal Enterprise applications with their NT user name and password. Thiseliminates the need to recreate individual user and group accounts within CrystalEnterprise.

NT Single Sign On

NT Single Sign On enables users to use various Crystal Enterprise applicationswithout being prompted to log on. Users need only to enter their NT user nameand password information once at the beginning of the NT session. Note thatePortfolio provides its own form of “anonymous Single Sign On,” which usesEnterprise authentication, as opposed to Windows NT authentication.

object

From an administrative perspective, objects in Crystal Enterprise are the foldersyou create on the system and the content you publish to the system. For example,a typical object is a report object which is stored in the Input File Repository Server.A report object is an .rpt file that you publish to the system and schedule in orderto create instances with report data.

ODBC

ODBC stands for Open Database Connectivity. It is an interface that givesapplications the ability to use SQL to retrieve data from data management systems.

Such an interface allows a developer to develop, compile, and ship applicationswithout targeting specific database management systems. Also calledinteroperability.

Output File Repository Server

See File Repository Server.

Page Server

The Page Server’s primary responsibility is to respond to on-demand page requestsfrom the Cache Server and to generate Encapsulated Page Format (EPF) pages. The

Page Server then returns the EPF pages to the Cache Server. The EPF pages containformatting information that defines the layout of the report. The data for the reportis saved with the report or retrieved on demand from the database.




parameter field

A parameter field is a special kind of field that prompts the user for a value. Youcan use parameter fields for report titles, record selection, sorting, and a variety of other uses. Using parameter fields enables you to create a single report that you

can modify quickly to fit a variety of needs.

processing extension

A processing extension is a dynamically loaded library of code that applies business logic to particular Crystal Enterprise view requests or schedule requests before they are processed by the system.

publishing

Publishing is the process of adding objects such as Crystal reports to the CrystalEnterprise environment and making them available to authorized users. The

objects that you publish may be individual reports created with Crystal Reports,analytical applications designed with Crystal Analysis, or other objects that you’vecreated using Crystal Enterprise plug-in components.

record

In a database, a record is a complete unit of related information, an electronic filefolder that holds all of the data on a given entity. Each record contains one or morefields that contain the specific pieces of data of interest. In a customer database, forexample, a record would store all of the data on a single customer. In an inventorydatabase, a record would store all of the data on a single inventory item. Data froman individual record is displayed or printed as a row of data on a columnar report.

report

A report is an organized presentation of data. As a management tool, a report isused to provide management with the insight it needs to run an organizationeffectively. In Crystal Enterprise, you publish objects to the system, and thenschedule those objects to generate instances on a recurring basis.

Report Application Server

The Report Application Server (RAS) is a Crystal Enterprise add-in componentthat provides users with report design capability over the Web. The Report

Application Server must be installed separately into an existing Crystal Enterpriseimplementation. Consult the documentation included with the Report ApplicationServer for more information.




Report Job Server

See Job Server.

report object

A report object is an object that is created using a Crystal designer component(such as Crystal Reports or Crystal Analysis). Report objects contain reportinformation (such as database fields). When you schedule a report, CrystalEnterprise generates an instance or instances of the object. When you publish areport object to Crystal Enterprise, only the structure of the report (the templateinformation) is saved; that is, the published report object contains no saved data.

schedule event

Schedule-based events are dependent upon scheduled reports. That is, a schedule- based event is triggered when a particular report has been processed. When you

create this type of event, it can be based on the success or failure of a scheduledreport, or it can be based simply on the completion of the job. A report that isdependent on a schedule-based event will run only when the schedule-basedevent is triggered.

selection formula

A selection formula is a formula that specifies the records, or groups of records,you want included in your report.

server-side processing

Server-side processing is a feature that allows you to set up reports that performthe majority of their processing on the database server. These reports push onlyrelevant details to your computer, thus saving you time and memory.

Sign Up feature

The Sign Up feature in ePortfolio enables users to sign up and create a new accounton Crystal Enterprise. You have the option to disable this feature to prevent guestusers from creating their own accounts.

Single Sign On

Single Sign On enables users to automatically log on to an application withoutentering a user name or password. In Crystal Enterprise, there are two forms of Single Sign On: NT Single Sign On, and ePortfolio’s Single Sign On feature. WithePortfolio’s Single Sign On feature, users are logged on automatically under theGuest account (Enterprise authentication).




Smart Reporting Technology

Smart Reporting Technology offers a flexible DHTML solution for web-basedreporting. See Report Application Server.

Software Development KitThe Crystal Enterprise Software Development Kit enables you to develop yourown custom desktops or administrative tools. For more information, access theCrystal Enterprise Web Developer’s Guide online from the Crystal EnterpriseLaunchpad.

subreport

A subreport is a report within a report. It has all of the characteristics of a reportwith one exception: it cannot itself include a subreport. Subreports can be free-standing or they can be linked to the data in the primary report. Using Crystal

Reports, you can insert as many subreports as you wish.


The Web Component Server (WCS) is the gateway between the Web Connector onthe web server and the rest of the components in Crystal Enterprise. The WCS isresponsible for processing requests from your browser, including Crystal ServerPages (.csp files), which are used to customize your access to Crystal Enterprise.As a result, this server also acts as an application server.

Web Connector

To communicate with the different types of web servers, the WCS uses a WebConnector. Crystal Enterprise includes different Web Connectors for differentoperating systems and web servers.




Index

AAccess Level column ........................................... 96access levels........................................................ 96

Advanced...............................................99, 100available in the CMC .................................. 275described ...................................................... 98enabling and disabling inheritance.............. 104Full Control................................................... 99inheritance.................................................. 103No Access..................................................... 98reference..................................................... 273

Schedule ....................................................... 98setting ........................................................... 98specifying on folders ..................................... 68tutorials....................................................... 108View ............................................................. 98View On Demand......................................... 99when copying/moving folders ....................... 66

access, restricting from the top-level folder ........ 131account management .......................................... 34active sessions, viewing..................................... 198active trust relationship........................................ 25ActiveX viewer, modifying options ....................219activity, viewing current metrics ........................ 196adding

APS cluster members................................... 204license keys................................................. 272servers......................................................... 249

AddPathMap directive....................................... 307administering

remote UNIX machines................................. 12remote Windows machines........................... 11

administration........................................................8configuration tools ...................................... 196delegated .................................................... 125over the Web .................................................. 8tools................................................................ 8

Administrator, setting password ........................... 13Administrators group, default rights ................... 277

Advanced access level......................................... 99advanced rights ................................................. 100

and inheritance ...........................................103priorities affecting................................... 107

denied by default ........................................ 108enabling and disabling inheritance.............. 105precedence ................................................. 108reference..................................................... 274

setting..........................................................100viewing........................................................100

Advanced Rights page........................................100reference......................................................274

affinity, and SSL....................................................26aliases

LDAP accounts ..............................................59NT accounts ..................................................49

Apacheapplication mappings on UNIX....................302reinitializing child processes........................248virtual paths on UNIX..................................307

application mappings.........................................300applications........................................................187

CCM............................................................188CMC............................................................188Crystal Import Wizard..................................188Crystal Publishing Wizard............................188ePortfolio.....................................................187

APS ..............................................................20, 190adding to a cluster .......................................206and authentication...................................17, 18and authorization...........................................18and distributed security..................................26and security...................................................20and security plug-ins......................................20as nameserver..............................................235base rights and available rights ....................102calculating effective rights............................106changing cluster name.................................208clustering.....................................................204configuring ..........................................213, 235

SOCKS....................................................268copying system database..............................208default port ..................................................235installing a new cluster member...................206metrics.................................................198, 199requirements for clustering...........................204unable to connect........................................312when enabling and disabling other servers.....201

APS database......................................................190changing password ......................................213configuring ..................................................208deleting........................................................213migrating .....................................................208recreating.....................................................213selecting ......................................................213




security management.....................................19servers ......................................... 186, 189, 192WCS ............................................................189

configuration, common scenarios.......................243configuring

APS clusters .........................................204, 208APS database .......................................208, 213Cache Server ...............................................216common scenarios.......................................243Event Server.................................................218File Repository Servers.................................215firewalls .......................................................263intelligence tier............................................204

Job Server .................................... 222, 223, 227Page Server..........................................221, 227processing tier .............................................221servers .........................................................196WCS .................................................... 218, 219web servers

application mappings..............................300virtual directories ....................................298virtual path mappings .............................304

connecting to remote Windows machines............11content, folders ....................................................64cookies

and session tracking.......................................27logon tokens ..................................................25

copying system data ...........................................208copying/moving folders ........................................66creating

folder administrators ....................................125folders ...........................................................64server groups ...............................................254server subgroups..........................................255subfolders ......................................................65

.cri files, application mappings...........................300Crystal Analysis, saving objects to APS.................84Crystal Configuration Manager. See CCMCrystal Enterprise SDK.............................. 16, 18, 24Crystal Enterprise security plug-in.........................21Crystal Enterprise Sizing Guide...........................242Crystal Import Wizard ..................................86, 188

selecting information .....................................91specifying source and destination ..................90

Crystal Launchpad, accessing.................................9Crystal Management Console. See CMCCrystal Publishing Wizard ....................................75

addingfolders.......................................................76multiple reports.........................................76reports ......................................................76

changingdefault values............................................80report properties . ......................................80

creating folder on APS ...................................78

database log on .............................................81duplicating folder structure............................78moving reports between folders.....................79scheduling reports .........................................79selecting

folder on APS ...........................................78the APS.....................................................77

setting report parameters . ..............................81Crystal Reports

saving objects to APS.....................................84troubleshooting reports................................316version 8 web distribution ...........................320

crystal virtual directory ......................................299Crystal Web Wizard...........................................189.csp files, application mappings .........................300custom events ............................................180, 184customizing

inheritance model .......................................108object rights.................................................100your configuration .......................................242

.cwr files, application mappings.........................300

Ddaemons, signal handling ..................................291data

allowing users to refresh ................................75cache files ...................................................216choosing live/saved .....................................242live ..............................................................243refreshing on a schedule................................75saved...........................................................243

data sourceson UNIX......................................................229

on Windows................................................227data tier .............................................................193databases

changing settings .........................................150configuring servers for .................................227copying APS data ........................................208initializing the APS ......................................213selecting for the APS....................................213troubleshooting

driver errors............................................318logon...................................................... 314

DB2 ...................................................................227default settings

authentication . ..............................................21

Enterprise accounts........................................21groups ...........................................................34Administrators ..........................................35Crystal NT Users.......................................36Everyone...................................................35New Sign-Up Accounts ............................35

modifying security.........................................14NT account ...................................................22




object rights.................................................273ports ............................................................235security plug-in..............................................21users..............................................................34

Administrator............................................35Guest........................................................35

deletingAPS database...............................................213folders ...........................................................66report objects . .............................................145servers .........................................................251

denied rights ......................................................108dependencies of servers on Windows ................239designer, saving objects to APS............................84destination environment, and importing...............90destinations........................................................166

default settings.............................................166disk, setting default......................................223email ...........................................................170FTP..............................................................168

Job Servers, setting default ...........................223printer . ........................................................172troubleshooting ...........................................321unmanaged disk ..........................................167

DHTML viewer, modifying options ....................219directories

publishing .....................................................75virtual..........................................................298

directory serversabout LDAP...................................................23security plug-in..............................................23

disablingGuest account ...............................................14inheritance ..................................................104servers .........................................................201Sign Up .........................................................13

documentation, additional .................................311drivers, troubleshooting errors............................318DSNs on UNIX ..................................................231dynamic-link libraries, as processing

extensions .......................................................24

Eeffective rights, calculating.................................106email destination .. .............................................170

setting defaults.............................................225enabling

inheritance ..................................................104servers .........................................................201

encoding logon tokens.........................................25environment variables, ODBC ...........................231env.sh ................................................................286ePortfolio ...........................................................187

authentication model.....................................16considerations .............................................321disabling Guest account ................................14

disabling Sign Up.......................................... 13primary authentication process .....................17setting users preferences.............................. 321Sign Up......................................................... 21Single Sign On .............................................. 21

errorsPage Server ................................................. 320troubleshooting ...........................................310

Event Log................................................... 234, 239Event Server....................................................... 191

configuring.................................................. 218metrics ........................................................ 198polling time................................................. 218

events ................................................................ 180custom ........................................................ 184file-based .................................................... 181importing from Crystal Enterprise .................. 88polling time................................................. 218schedule-based ........................................... 182scheduling ..................................................163

Everyone group, default rights............................277expanding..........................................................242

the system ...................................................241Explicitly Denied column ..................................100Explicitly Granted column .................................100extensions, processing .........................................24

Ffail over, Web Connector and WCS.....................26Favorites folders................................................... 71fax numbers, registration........................................ 5file events .................................................. 180, 181File Repository Servers....................................... 191

metrics ........................................................ 197setting maximum idle times......................... 215setting root directories................................. 215

firewalls....................................................... 29, 260configuring.................................................. 263

NAT ....................................................... 263Network Address Translation..................263SOCKS ................................................... 265

forcing servers to register by name .............. 237types of ....................................................... 261

NAT ....................................................... 262packet filtering .......................................261SOCKS ................................................... 262

folder inheritance . .............................................103folder rights .. ....................................................... 68folders ................................................................. 64

adding a report.............................................. 67changing top-level rights .............................113copying/moving ............................................66creating......................................................... 64default rights at top level .............................277default user folders........................................ 71delegated administration .............................125




deleting .........................................................66Favorites folder ..............................................71importing

from Crystal Enterprise ..............................87from Seagate Info ......................................88

moving ..........................................................66object rights...................................................96

access levels .............................................98advanced settings....................................100inheritance..............................................103setting access levels ..................................98viewing.....................................................96when copying/moving ..............................66

setting instance limits.....................................70specifying rights.............................................68

format, choosing ................................................173FTP destination...................................................168

setting defaults.............................................224Full Control access level. ......................................99

reference .....................................................276

Ggranted rights .....................................................108group inheritance ...............................................103group rights..........................................................96grouping servers.................................................254groups

creating .........................................................41for tutorials .............................................109

deleting .........................................................43importing


modifying ......................................................42object rightsaccess levels .............................................98advanced rights.......................................100inheritance..............................................103

of servers .....................................................254setting

instance limits on folders ..........................70object rights ............................................176

viewing members ..........................................42Guest account

default rights................................................277disabling.................................................. 14, 43disabling Sign Up ..........................................13

Hhelp

documentation resources.............................311product registration..........................................5technical support .............................................6

Holos applications, from Seagate Info ..................89HTTP..............................................................17, 27

Iidle times

Cache Server ...............................................216File Repository Servers.................................215Page Server..................................................221

importingCrystal Import Wizard . ..................................86from Crystal Enterprise...................................86from Seagate Info...........................................88selecting information .....................................91specifying source and destination ..................90

index, setting CMC preferences............................10Info cubes, from Seagate Info ...............................89Info Views, from Seagate Info...............................89information flow, between servers .....................193Informix .............................................................228inheritance.........................................................103

and advanced rights ............................100, 105base rights and available rights....................102

enabling and disabling ................................104priorities affecting........................................108tutorials .......................................................108

Inherited column ...............................................100initializing APS database....................................213initlaunch.sh ......................................................286Input File Repository Server ...............................191

metrics ........................................................197setting maximum idle time ..........................215setting root directory....................................215

instances ............................................................138from Seagate Info...........................................89importing from Crystal Enterprise...................87setting limits at the folder level ......................70

intelligence tier ..................................................189configuring ..................................................204

Internet Information Services (IIS)and NT Single Sign On ..................................22application mappings ..................................300default web site ...........................................311

iPlanet Enterprise ServerUNIX

application mappings on UNIX...............303virtual paths............................................307

Windowsapplication mappings .............................300virtual paths............................................305

J Java viewer, modifying options ..........................219 Job Server ..........................................................192

configuring ..........................................223, 227configuring on UNIX ...................................229maximum number of jobs............................222metrics ........................................................198report objects ..............................................147




Kkey combinations...................................................6keyboard shortcuts .................................................6

L

launchpad, accessing.............................................9LDAP ...................................................................23about.............................................................23authentication ...............................................36managing accounts........................................54

LDAP accounts ....................................................23aliases

reassigning................................................60using.........................................................59viewing.....................................................60

configuring ....................................................54groups

creating ....................................................61disabling...................................................61

managing ......................................................54mapping ........................................................54modifying

connection parameters .............................58member groups.........................................58

troubleshooting .............................................61unmapping ....................................................57users

creating ....................................................61disabling...................................................61

LDAP authentication plug-in ................................23LDAP groups

mapping ........................................................54unmapping ....................................................57

LDAP hosts, managing multiple ...........................58LDAP security plug-in ..........................................23LDAP users

mapping ........................................................54unmapping ....................................................57

license keys .......................................................270adding .........................................................272viewing account activity..............................272

licensing ............................................................270accessing information..................................271

Lightweight Directory Access Protocol. See LDAPlimits, setting at the folder level............................70live data.............................................................243load balancing

and distributed security .................................26APS clustering .............................................204web farm .....................................................322

Local System account ........................................227log on

authentication ...............................................16processing server accounts ..........................227protection against malicious attempts ............30with token .....................................................18

loggingserver activity.............................................. 234web activity .......................................... 29, 218

logon tokens ........................................................ 25and authentication ........................................ 17and authorization..........................................18and distributed security .................................26and secondary authentication .......................18and session tracking ......................................27

logon.csp............................................................. 17Lotus Domino.................................................... 227

Mmalicious logon attempts, protection against .......30management areas, defined ...................................9mapped drives................................................... 319mapped LDAP groups, viewing............................58mapped LDAP users, viewing ..............................58mapped NT groups, viewing................................ 48mapped NT users, viewing .................................. 48mapping

LDAP accounts ............................................. 54NT accounts.................................................. 44troubleshooting web server paths................297virtual paths ................................................304

mappingsapplication ..................................................300virtual directories ........................................298virtual paths ................................................304

menu styles, setting CMC preferences.................. 10metrics...............................................................196

system......................................................... 199viewing

account activity...................................... 272for servers.. ............................................. 197

Microsoft Access... ............................................. 228Microsoft Exchange ........................................... 228Microsoft SQL Server......................................... 227migrating ............................................................. 86

APS database .............................................. 208from Crystal Enterprise .................................. 86from Seagate Info .......................................... 88selecting information.....................................91specifying source and destination..................90

multihomed machines .......................................238My Password, setting CMC preferences ............... 10

Nnameserver, role of APS..................................... 235NAT. See Network Adress Translationnative drivers ..................................................... 227

on UNIX ..................................................... 229Net Access column.............................................. 96Network Address Translation..............261, 262, 263No Access level ................................................... 98

reference ..................................................... 275




Not Specified rights, and access levels .................98NT

authentication................................................36managing accounts........................................44Single Sign On...............................................52

NT accountsaliases

reassigning................................................50using.........................................................49viewing.....................................................50

configuring ....................................................44groups

creating.....................................................51disabling ...................................................51

managing.......................................................44mapping ........................................................44troubleshooting..............................................51unmapping ....................................................47users

creating.....................................................51disabling ...................................................51

NT authenticationand UNIX ......................................................22plug-in...........................................................22

NT groupsmapping ........................................................44unmapping ....................................................47

NT LM Security Support Provider .......................239NT Single Sign On

and Windows NT security plug-in .................22setting up.......................................................52

NT usersmapping ........................................................44unmapping ....................................................47

number of logons, logon tokens ...........................25number of minutes, logon tokens .........................25

Oobject rights .........................................................96

advanced setting..........................................100available in the CMC ...................................274base and available .......................................102calculating effective .....................................106importing


inheritance ..........................................103, 105predefined access levels ................................98reference .....................................................273setting............................................................98specifying for a folder ....................................68tutorials .......................................................108

decreasing rights .....................................112increasing rights......................................131

viewing..........................................................96when copying/moving folders........................66

objects ...............................................................138Advanced Rights page .................................100and access levels ...........................................98enabling and disabling inheritance ..............104importing

from Crystal Enterprise..............................87from Seagate Info......................................89

publishing .....................................................73multiple.................................................... 75options .....................................................74with CMC................................................. 82

Rights tab ......................................................96saving directly to APS....................................84viewing rights................................................96

objects per page, setting maximum ......................10ODBC

APS database...............................................206APS database connectivity...........................209drivers .........................................................227environment variables .................................231identical DSNs required ..............................227processing server accounts ..........................227reporting on UNIX.......................................230system information fi le ................................231

.odbc.ini . ...........................................................231one-machine setup ............................................244Open OLAP cubes, from Seagate Info ..................89options, publishing ..............................................74Oracle ...............................................................227Output File Repository Server ............................191

metrics ........................................................197setting maximum idle time ..........................215setting root directory....................................215

Ppacket filtering ...................................................261page index, setting CMC preferences ...................10Page Server ........................................................192

configuring ..........................................221, 227configuring on UNIX ...................................229metrics ........................................................198

pages, setting CMC preferences ...........................10Paradox .............................................................228passwords

changingfor APS database.....................................213settings .....................................................40

restrictions.....................................................30settingCMC preferences......................................10for Administrator account .........................13

patchlevel.sh......................................................286path mapping.....................................................298

troubleshooting ...........................................297PC databases......................................................228




performance .. ....................................................242APS clusters.................................................204Cache Server settings...................................216common scenarios ......................................243general considerations.................................245load balancing...............................................26Page Server settings .....................................221setting number of jobs per server .................222Windows NT Challenge/Responseauthentication..............................................22

permissions ..........................................................96plug-ins, security..................................................20polling time, setting for Event Server ..................218port numbers, changing .....................................235postinstall.sh ......................................................287predefined access levels.......................................98preferences

settingfor ePortfolio users..................................321in the CMC...............................................10

primary authentication.........................................17printer destination ..............................................172processing extensions ..................................24, 142

registering....................................................142selecting ......................................................144

processing servers, configuring ..........................229processing threads

Cache Server ...............................................216Page Server..................................................221

processing tier....................................................192configuring ..................................................221

product registration................................................5publishing............................................................74

and object rights..........................................118folders ...........................................................64from the designer...........................................84options ..........................................................74report objects . .............................................139reports and objects ........................................73with CMC......................................................82with Crystal Publishing Wizard......................75

Q.qry files.............................................................316query objects, from Seagate Info ..........................89

Rrefreshing cache files .........................................216registration .............................................................5re-initializing, APS database...............................213Remote Procedure Call ......................................239remote resources, troubleshooting .....................319remote servers

CCM for UNIX...............................................12CCM for Windows.........................................11CMC................................................................8

report instances .................................................138managing ............................................ 146, 149

history .................................................... 149scheduling ..................................................153setting limits................................................ 174viewing ....................................................... 149

report objects..................................................... 138copying....................................................... 141creating a shortcut....................................... 141database...................................................... 150deleting....................................................... 145destination ..................................................166filters........................................................... 152managing ............................................ 139, 146moving........................................................ 141parameters . ................................................. 151properties .................................................... 147publishing ...................................................139scheduling ..................................................153searching .................................................... 146setting

instance limits ........................................174rights ......................................................176

specifying Job Servers.................................. 147report packages from Seagate Info ....................... 89report thumbnails, adding with reports ................67report viewers, modifying options......................219reports ............................................................... 138

adding to a folder individually ......................67configuring servers for data sources.............227importing

from Crystal Enterprise ............................. 87from Seagate Info ..................................... 89

managing .................................................... 146modifying

number of jobs .......................................222viewing options...................................... 219

publishing ..................................................... 73multiple.................................................... 75options ..................................................... 74with CMC................................................. 82

saving directly to APS.................................... 84scheduling with events................................ 163troubleshooting ................................... 314, 316when scheduling.........................................194when viewing ............................................. 193

requirements, clustering..................................... 204restarting servers................................................ 200restart.sh ............................................................ 287restricting access from the top level ...................131restrictions

guest account................................................31logon ............................................................ 30password....................................................... 30user ............................................................... 31




rights ....................................................................96Advanced ......................................................99available......................................................102base.............................................................102Full Control ...................................................99importing


No Access .....................................................98Schedule........................................................98setting object rights......................................176specifying for a folder ....................................68tutorials .......................................................108View..............................................................98View On Demand .........................................99

rights. See also object rightsRights tab .............................................................96root directories, File Repository Servers ..............215root folders

default rights................................................277modifying security .........................................14

row-level security, processing extensions .............24.rpt files, application mappings...........................300

Ssaved data..........................................................243scalability...........................................................242

common scenarios.......................................243general considerations .................................245

scaling, the system .............................................241Schedule access level...........................................98

reference .....................................................275schedule events..........................................180, 182

schedulesfrom Seagate Info...........................................89importing from Crystal Enterprise...................87

schedulingdaily report ..................................................156events ..........................................................163information flow ..........................................194monthly report.............................................159on demand ..................................................153report instances ...........................................153run once ......................................................154setting default

destinations.............................................223disk destination.......................................223

FTP destination .......................................224SMTP destinations...................................225weekly report...............................................158

scripts for UNIX..................................................279Seagate Info, importing information......................88secEnterprise.dll ...................................................21secLDAP.dll .........................................................23secondary authentication .....................................18

Secure Sockets Layer (SSL) ...................................29and load balancing........................................26

securityactive trust relationship..................................25auditing web activity .....................................29authentication . ..............................................16authorization .................................................16closed model...............................................131components...................................................19distributed .....................................................26environment protection .................................28firewalls.........................................................29Guest account restrictions .............................31initial settings ................................................13logon restrictions ...........................................30modifying default levels.................................14object rights...................................................96

inheritance .............................................103tutorials ..................................................108

open model.................................................112password restrictions .....................................30plug-ins .........................................................20predefined access levels ................................98processing extensions....................................24protection against malicious logon attempts..... 30restrictions.....................................................31session tracking .............................................27user restrictions .............................................31web browser to web server............................29web servers ................................................... 28

security plug-ins...................................................20Enterprise authentication ...............................21LDAP authentication .....................................23Windows NT authentication..........................22

secWindows.dll ...................................................22selecting APS database.......................................213server dependencies, changing ..........................239server groups .....................................................254

creating .......................................................254importing from Crystal Enterprise...................88subgroups....................................................255

server start up type, changing.............................240serverconfig.sh...................................................283servers ........................................186, 189, 192, 196

accessing the CCM........................................11adding .........................................................249changing

startup type on Windows........................240status ......................................................199

configuring................... 204, 221, 235, 238, 240size of log files ........................................234with firewalls..........................................260

copying status..............................................203deleting .......................................................251dependencies on Windows .........................239disabling......................................................201




enabling ......................................................201grouping......................................................254information flow..........................................193intelligence tier.................................... 189, 204logging activity ............................................234managing ....................................................195modifying group membership......................257printing status ..............................................203processing tier ..................................... 192, 221refreshing list using the CCM.......................204registering by name .....................................237restarting .....................................................200starting ........................................................200stopping .. ....................................................200troubleshooting ...........................................319UNIX signal handling ..................................291viewing

metrics....................................................197status ......................................................199

session variables ..................................................27and authentication...................................17, 18and WCS .......................................................19

sessionstracking .........................................................27viewing active .............................................198

settingaccess levels..................................................98advanced object rights.................................100initial security levels ......................................13

settings, viewing account activity .......................272setup.sh .............................................................287shared libraries, as processing extensions.............24shortcuts, keyboard................................................6Sign Up

disabling.................................................. 13, 43Enterprise authentication ...............................21

signal handling ..................................................291silentinstall.sh ....................................................286Single Sign On

disabling Guest account ................................14Enterprise authentication ...............................21NT.................................................................52NT authentication..........................................22

six-machine setup ..............................................244SMTP destinations, setting defaults.....................225SOCKS............................................... 262, 265, 268sockssetup.sh .....................................................284source environment, specifying............................90starting

CCM for UNIX...............................................12CCM for Windows.........................................11servers .........................................................200

startservers .........................................................285startup types, configuring servers .......................240

statistics, auditing web activity............................. 29status, viewing and changing for servers ............199sticky connections, and SSL .................................26stopping servers................................................. 200stopservers......................................................... 285styles, setting CMC preferences............................ 10subfolders, creating.............................................. 65subgroups of servers ..........................................254support, technical ..................................................6Sybase ............................................................... 227syslog ................................................................ 234system database, migrating ................................208system information file (ODBC) .........................231system metrics ................................................... 199system security .................................................... 16

Ttechnical support................................................... 6temporary files, configuring Page Server ............221

third-party security plug-ins .................................20three-machine setup ..........................................244thumbnails, adding with reports...........................67tickets

for distributed security................................... 26logon tokens ................................................. 25

tiers ................................................................... 186client........................................................... 187data............................................................. 193intelligence ................................................. 189processing................................................... 192

time zone, setting CMC preferences.....................10time zones, supporting multiple.........................321toolbars, customizing for report viewers ............219

toolsadministration ................................................. 8Crystal Configuration Manager (CCM)........... 11Crystal Management Console (CMC)............... 8UNIX .......................................................... 280

top-level folder, modifying security...................... 14top-level, creating new folders.............................64tracking, sessions ................................................. 27transfer of trust..................................................... 26troubleshooting..................................................310

application mappings..................................300ePortfolio deployments ...............................321LDAP accounts ............................................. 61NT accounts.................................................. 51

path mappings ............................................ 297report viewing and processing.....................313virtual directories ........................................298web accessibility......................................... 311web servers ......................................... 298, 300

trust, active trust relationship ...............................25tutorials ............................................................. 108



UUNC paths .........................................................319uninstall.sh.........................................................285UNIX

administrative scripts ...................................279

and NT authentication ...................................22command reference .....................................279Crystal Configuration Manager ......................12syslog ..........................................................234tools . ...........................................................279

UNIX web serversapplication mappings ..................................302configuring virtual paths ..............................307

unmanaged disk destination ...............................167setting defaults.............................................223

unmappingLDAP accounts ..............................................57NT accounts ..................................................47

upgrading

Crystal Import Wizard....................................86from Crystal Enterprise ...................................86from Seagate Info...........................................88

user accounts .......................................................34creating .........................................................37deleting .........................................................39modifying ......................................................39

user databases, NT4 and Windows 2000 ActiveDirectory .........................................................22

user folders...........................................................71user rights.............................................................96users.....................................................................34

delegated administrators ..............................125importing


logging activity ............................................218object rights

access levels .............................................98advanced rights.......................................100effective rights.........................................106inheritance..............................................104

settinginstance limits on folders ..........................70object rights ............................................176

viewing active sessions ................................198utilities, UNIX reference .....................................279

VView access level .................................................98

reference .....................................................275View On Demand access level.............................99

reference .....................................................276viewer virtual directory ......................................299viewers

modifying settings........................................219setting CMC preferences ................................10

viewingactive users.. ................................................198advanced object rights.................................100APS cluster details .......................................199current account activity ...............................272current metrics ............................................196information flow..........................................193licensing information...................................271object rights...................................................96server metrics ..............................................197system metrics .............................................199

virtual directories ...............................................298crystal..........................................................299viewer .........................................................299

virtual path mappings ........................................304

WWCS ............................................................ 19, 189

and authentication.........................................17

and authorization ..........................................18and load balancing........................................26and logon tokens ...........................................19and multiple web servers.............................322and security...................................................19auditing web activity .....................................29configuring ..........................................218, 235configuring SOCKS......................................265default port..................................................235logging web activity ....................................218

WCS session variables .........................................27and authentication...................................17, 18tracking .........................................................28

WCSHOST variable, CGI Web Connector .........308

WCSHostsApache........................................................307NSAPI Web Connector ................................307

WCSPATHMAP variable, CGI Web Connector ....308WCSPathMap, NSAPI Web Connector...............307web activity, logging..........................................218Web Component Server

and security...................................................19metrics ........................................................197

Web Component Server. See WCSWeb Connectors ................................................190

and load balancing........................................26application mappings ..................................300CGI virtual paths .........................................308

configuringNAT .......................................................263SOCKS....................................................266

troubleshooting ...........................................298virtual path mappings..................................304

web distribution, Crystal Reports 8.....................320web farm, load balancing ..................................322

crystal enterprise 8.5 - administrator's guide.pdf

Documents