iGrafx Process Central 2011 Administrator Guide

iGrafx Process Central Introduction 1iGrafx® Process Central is a companion tool for most iGrafx® client applications (e.g.iGrafx FlowCharter) that lets you store documents in a central location to enable teambased,collaborative process improvement efforts.iGrafx® Process Central consists of three main components available on the ProcessCentral CD:• Process Central Server Administrator is the database management component ofiGrafx® Process Central that helps you manage and maintain iGrafx ProcessCentral. You install the Server Administrator component on any computer that youwould like to administer databases.• Web Central is a web server plug-in that lets users browse and view Process Centralrepositories using a web browser. Accessing Web Central to view Process Central datais easy. No client-side installation is needed.• Mail Central is a plug-in service that auto-generates and delivers e-mail notificationsof conditions such as voting to-do to users of a database. The Mail Central servicerequires server-side installation only. Mail Central must be installed to enable ProcessCentral scheduled cycle features.These components are installed on the database server or one or more computers that havenetwork access to the database server.Process Central relies on either Microsoft® SQL Server or Oracle® for data storage. Someversions of Process Central ship with a Microsoft SQL Server CD and Runtime-RestrictedUse license. For information about servers, see SQL and Oracle Servers on page 15.Process Central offers security features that protect your iGrafx repositories fromunauthorized access. In the event that user rights and permissions have made the databaseinaccessible, you can create a superuser account using your database enterprise managementtool. The superuser account is recognized by the name igxsuperuser. If you need to createiGrafx Process Central Introduction 5

The Microsoft SQL Server installer uses a wizard to prompt you through the installationsteps. For setup to continue, you must click the Yes button to accept the license agreementwhen requested.To install SQL Server 2008:1 Start the iGrafx Process Central installation wizard, and click Microsoft SQL ServerSetup.2 Follow the prompts on each page.3 Insert the Microsoft SQL Server 2008 DVD.4 Follow the prompts in the Microsoft SQL Server Setup wizard. Note the followingiGrafx Process Central requirements (other configuration options can use the defaultsettings or be configured as desired):• On the Server Configuration page, Service Accounts tab, specify the AccountName, Password, and Startup Type for SQL Server Database Engine and SQLFull-text Filter Daemon (if you wish to use full text search on your repositories).The logon Account Name and Password can use built-in system accounts, a localaccount, local group, domain group, or domain user accounts for SQL Serverservices. It is recommended to use the lowest possible user rights.Set the SQL Server Database Engine Startup Type to Automatic and set the SQLFull-text Filter Daemon Startup Type to Manual.For more information, see the SQL Server Configuration - Service Accounts topicin the SQL Server 2008 Books Online.• On the Database Engine Configuration page, Account Provisioning tab, chooseMixed Mode. This allows the Microsoft SQL Server Management Studio to defineadditional repository logins and provides flexibility to define iGrafx ProcessCentral approval and access rights as well as the ability to delete or back updatabases.• On the Feature Selection page, select Database Engine Services, Full-Text Search,Management Tools - Complete, and SQL Server Books Online.SQL Server logins are useful for Web Central Virtual Connections that do not require signin but are restricted to viewing only approved documents. For more information, see Add aVirtual Connection on page 48.12 iGrafx Process Central 2011 Administrator Guide

Administrative Point InstallationsAn administrative point installation copies the Process Central product files to a centrallocation for access by machines on a network. You can create administrative pointinstallations for the Process Central Client, Server Administrator, and Web Centralcomponents.Issue the command on the target machine for each of the following installations.InstallationCommandProcess Central Client clsetup.exe /aProcess Central ServerAdministratorsvsetup.exe /aProcess Central Web Central wcsetup.exe /aFor more information on MSI and command line switches, visit www.microsoft.com toobtain full MSI documentation.For more information on administrative point installations, see the iGrafx Installation Guide onthe root of the iGrafx installation CD.iGrafx Process Central MaintenanceYou can use the Microsoft Add/Remove Software feature to modify, repair or removecomponents of iGrafx® Process Central. Each of the three iGrafx components and SQLServer are maintained separately.To repair or remove any iGrafx Process Central component, click the appropriate optionbutton, click Next, and follow the instructions provided by the Installation wizard.iGrafx Process Central Introduction 13

SQL and Oracle Servers 2Process Central supports SQL and Oracle® servers. You can install SQL Server 2008 fromthe Process Central installation wizard or use your own installation.After you install a database server, you can create login accounts and set up userauthentication for use throughout Process Central. For information about the ProcessCentral client, see the Process Central topics in the iGrafx Help system.A user that is deleted from the Active Directory or SQL Server still appears in any historicallists. Any documents that are checked out when the user is deleted still show as checked outto that user. A superuser may undo the checkout or check in a document that is checked outto a deleted user.Some information about using Process Central with an Oracle database is provided here. Forinformation on installing, configuring, and maintaining an Oracle database, see yourdatabase server software documentation.SQL ServerSQL Server is the database engine that serves as the central repository for your iGrafx®documents. Depending on which Process Central application package you purchased, youmay or may not have received a Microsoft® SQL Server 2008 DVD from iGrafx. See thesystem requirements page for versions of SQL that iGrafx supports.iGrafx Process Central supports Snapshot and Transactional replication models under thefollowing constraints: subscribers are read only, and subscribers get all updates from onepublisher. Merge replication is not supported.iGrafx supports SQL Server 2008 supplied by iGrafx, but does not provide technical supportfor SQL Server products purchased from Microsoft.SQL and Oracle Servers 15

Create Microsoft SQL Server Login AccountsUsing SQL Server, you can have additional accounts accessing your repositories. You maychoose to use both Windows and SQL authentication logins.• Windows Authentication–The best login method for users who are part of atrusted domain. Their name and password are already established on yournetwork.• SQL Server Authentication–The login method for users who are not part of atrusted domain.1 Start SQL Server Management Studio.2 In the Object Explorer, expand Security.3 Right-click Logins and choose New Login.4 Choose a method for access to repositories and follow the steps to complete the loginaccount setup:16 iGrafx Process Central 2011 Administrator Guide

Windows Authentication1 In the Login - New dialog box, clickthe Windows authentication option,then click the Search button.2 In the Select User or Group dialogbox, enter the name of the user orgroup you want to add and click theCheck Names button. If the objectname does not appear, make sure thelocation is set correctly.3 Grant login access as described inGrant Access to Repositories below.4 Click OK.SQL Server Authentication1 In the Login - New dialog box, type alogin name.2 Click the SQL Server authenticationoption.3 Type a password.4 Grant login access as described inGrant Access to Repositories below.5 Click OK.iGrafx prompts for a login name andpassword when the user attempts toopen a repository.Grant Access to RepositoriesAfter you create logins and grant user access, you can grant existing login access to any newor existing repository. The Process Central Server Administrator creates a SQL Serverdatabase for each repository created.1 In SQL Server Management Studio, expand the Security and Logins folders.2 Right-click the security login you want to grant access to and choose Properties.3 In the Login Properties dialog box, click User Mapping in the Select a page section.4 Select the check box in the Map column for the ProcessCentralAdmin database andevery repository to which you want to grant login access.5 Click OK.For each iGrafx Process Central repository, all users by default have the public role thatprovides access to anyone with a login for Process Central. Specific privileges to files andfolders are granted to users by Administrators within the iGrafx Process Central clientapplication. No special SQL Server settings are required.For more information on usingSQL Management Studio, see the documentation provided with SQL Server.SQL and Oracle Servers 17

OracleConnecting to Oracle®-based repositories involves many choices, such as the software youneed to install on your machine for each option to work correctly. All of the connectionoptions require the Oracle SQL*Net client software. This is the underlying mechanismOracle uses for network connectivity.Machines that access Process Central repositories through iGrafx client applications needOracle drivers installed. iGrafx does not provide or install the Oracle drivers.The ODBC option requires an Oracle ODBC driver. Microsoft and Oracle both supplyODBC drivers to go with SQL*Net software. The Oracle ODBC drivers are recommendedover the Microsoft ones, which have become somewhat outdated.The remaining two options require installation of the Oracle OLE DB drivers. Using theOLE DB drivers offers several benefits:Performance–The OLE DB drivers are said to be more efficient than the ODBC drivers.Ease of Use–With the OLE DB connectivity options, you do not have to configure a DSN,or even an Oracle TNS name separately.If you have problems connecting to Oracle-based repositories, talk to your network orOracle administrator.Oracle and Process CentralBefore using the Server Administrator to access an Oracle® database, there are severalthings you should know for it to work properly with Process Central.StandardThe Process Central installer does not install the Oracle client-side drivers. If you want touse Oracle databases, you need to install the Oracle OLE DB Provider (recommended) orOracle ODBC drivers on all machines that are connecting to Oracle-based repositories.Oracle OLE DB allows connecting to a named database on a specific server or to an OracleTNS name. If using the Oracle ODBC drivers, you must connect through an ODBC DSN.18 iGrafx Process Central 2011 Administrator Guide

Installing Oracle ProviderInstall both the OLE DB provider/ODBC Driver, and the Oracle Network Services. (Oraclesometimes provides these within the same installer, but you need to install both.)REBOOT AFTER INSTALLING. The Oracle installer should modify your PATHenvironment variable to include the Oracle \bin directory, but many tools do not pick up thenew Path entry without rebooting.Web CentralClient connections to your web central server do NOT need any drivers installed. However,you need to install the Oracle OLE DB provider or ODBC driver on the Web Central serveritself. It is especially important to reboot your server machine after installing the OLE DBprovider.DatabasesFor Database Character Sets, it is recommended to create your database with the “UTF8”Unicode character set for international portability. The Administration tool alerts you if thedatabase was created with a different character set.For connection to databases, Process Central can connect to a database identified by anOracle TNS name (consult your Oracle documentation for information), or can connect(using TCP/IP) to a named database on a specific server (and port). The default port forOracle installations is 1521. If you need to connect with a network protocol other thanTCP/IP, you will need to use TNS names. If using ODBC drivers, you can connect only withan ODBC Data Source Name (DSN).Advanced InformationOracle does not have a datatype allowing very long strings as well as querying using SQL’sLIKE keyword which Process Central queries use internally. Instead, string customproperties are stored as a VARCHAR2(4000) field, limiting them to 4000 bytes in length. Ifyou need a property to store more, and you do not need to query on the custom property,you can (using Oracle tools) modify Process Central’s Property table to include a column oftype CLOB. Process Central recognizes the column as a string property, but any queriesagainst it results in a “datatype mismatch” error or similar.SQL and Oracle Servers 19

20 iGrafx Process Central 2011 Administrator Guide

iGrafx Process Central Server Administrator 3The Process Central Server Administrator helps you configure and maintain Process Centralrepositories.iGrafx Process Central Server Administrator 21

With the Server Administrator you can:• Create a repository administration database.• Create and register repositories on a server.• Remove repositories from a server.• Add custom properties to repositories.• Upgrade older repositories to the current version of iGrafx.• Import user names from a directory service.• Modify the display of user names throughout iGrafx.Log In to the Process Central Server AdministratorA database administrator (DBA) must have login account access to the database instance tocreate an Administration Database.To start the Process Central Server Administrator, on the Start menu, point to Programs,point to iGrafx, and choose Process Central Server Administrator.Log In with a SQL Server1 Click the Log In - SQL Server tab.2 Type in a server name in the Server text box, or select a server name from the dropdownlist.3 Select Windows or SQL authentication. If you select SQL authentication, type yourname in the Name field, and type your password in the Password field.4 Click OK.Log In with OracleOracle connections always use Oracle IDs, not Windows® authentication.1 Click the Log In - Oracle tab.2 Click one of the following options:• Use ODBC DSN–See the documentation that comes with your Oracle ODBCdrivers for information about setting up a DSN.22 iGrafx Process Central 2011 Administrator Guide

• Specify Server and Database- This option is enabled if your machine has OracleOLE DB drivers installed. After you specify a server and database, type your namein the User Name field, and your password in the Password field. Process Centralwill then attempt to connect to the specified server using TCP/IP. You can alsospecify/change the TCP/IP port. The default port for Oracle database installationsis 1521.• Use Oracle TNS name- This option is enabled if your machine has Oracle OLEDB drivers installed. TNS names connect you to Oracle databases on thenetwork, and are usually set up by your Oracle administrator or by using toolslike Oracle’s SQL*Net Easy Configuration.3 Enter a User Name and Password.4 Click OK.How to Use Oracle ScriptsIf you do not want to use the Process Central Server Administrator to create theAdministration Database and repositories, you may generate SQL scripts that you can useseparately to create the necessary database objects for iGrafx Process Central to work. Pleasenote that you must have Database Administrator (DBA) type privileges in order tosuccessfully run the SQL scripts.1 Click the Get Oracle Scripts tab.2 Select a task, such as Create a Process Central Repository. If you are adding a customproperty, enter a Name and Type to identify the property.3 In the Repository Name text box, enter the name of the repository affected, and thenclick the Get Script button.4 In the Save As dialog box, specify the name and saved location of the file. You can editthe script to specify customized commands in addition to the task execution specifiedby iGrafx.The Administration DatabaseEach server that runs Process Central must have a special administration database thatmaintains the status and properties of each repository on the server. You use the ServerAdministrator tool to create and maintain the administration database.iGrafx Process Central Server Administrator 23

Create the Administration Database1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click Create AdministrationDatabase. The Server Administrator creates a new administration database.Delete the Administration DatabaseYou should only delete the database if you believe it has been corrupted.1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click Administration Database.3 Click the Delete Administration Database button.Manage RepositoriesWith the Server Administrator, you can create new repositories, remove existingrepositories, and add custom properties.When you create a repository, it is automatically registered by Oracle or SQL Server as aProcess Central current version repository. If you delete and recreate your AdministrationDatabase, you must re-register your repositories.24 iGrafx Process Central 2011 Administrator Guide

Create a New RepositoryIf you create a repository on an Oracle database, see Repositories on Oracle Databases on page25 below.1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click the Repositories page.3 Click the Create New button.4 In the New Repository dialog box, type the new repository name and a briefdescription.5 Click the Custom Properties button if you want to add a custom property.Custom properties are attributes that you can define for a repository. For information onsetting and using custom properties, refer to the Process Central topics in the iGrafxHelp system.6 In the Repository Properties dialog box, click the Add button.7 In the Add Property dialog box, type the property name and choose a property type.8 Click OK to close each dialog box. The Server Administrator creates the new repository.This may take several minutes. The new repository name appears in the Repositorieslist.Repositories on Oracle DatabasesWhen you create repositories on Oracle databases, observe the following:• See information and requirements in this documentation before you start.• See the iGrafx website for the versions of Oracle that iGrafx supports.• Ensure you have the proper OLE DB Provider Drivers. The Oracle client is highlyrecommended for each client machine that accesses Process Central through iGrafx.• iGrafx client applications (e.g. iGrafx FlowCharter) only support Oracle IDs, notWindows authentication, so Active Directory and LDAP are not used.• The Oracle Administrator is fully responsible for how to create a user and give properaccess. The SQL scripts, generated by iGrafx, for creating the repositories andadministration database may assume that a role named Public is granted theappropriate access to the iGrafx database objects. If you decide not to create a rolenamed Public (for example, instead use one named “igxuser”), you need to ensure thatiGrafx Process Central Server Administrator 25

any user created is granted the appropriate access to the database. Use SELECT,INSERT, UPDATE and DELETE as appropriate.• Place the proper information in the Users Table in Process Central to allow users tohave their names (not login IDs) appear in the dialog boxes and used in Mail Central.Use the Process Central Server Administrator Tool or SQL scripts created by an OracleAdministrator. The Users Table requires the Oracle ID, associated human name forthe ID, and the email address of that ID. The Users Table is a look-up table for iGrafxto provide friendly names and email addresses. It does not control IDs, and hasnothing to do with gaining access to iGrafx databases.Remove an Existing Repository1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click Repositories.3 In the Repositories list, click a repository name.4 Click the Delete button.Add Custom Properties To An Existing RepositoryCustom properties allow users to tag files stored in Process Central with additionalinformation like “Project Name”, “Revision ID”, and so on.1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click Repositories.3 In the Repositories list, click a repository name.4 Click the Add Properties button.5 In the Repository Properties dialog box, click the Add button.6 In the Add Properties dialog box, type the property name and choose a property type.7 Click OK to close each dialog box.Register a Repository1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click Repositories.3 In the Repositories list, click the name of the repository you want to register, and clickthe Register button.26 iGrafx Process Central 2011 Administrator Guide

4 In the Register Repositories dialog box, select the check boxes next to each database toregister as a repository.5 Click OK. The repository name appears in the Open Repository dialog box the nexttime you choose to open a repository in Process Central.Enable a Repository for Full Text SearchIf a repository is enabled for full text search, a user can search for text in both iGrafx andnon-iGrafx files. By default, full text search is enabled to the extent supported by Oracle orSQL Server.Searches in large databases may result in slower searches depending on server performanceand database setup.1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click Repositories.3 In the Repositories list, click the name of the repository you want to enable for full textsearch and click the Full Text button.4 In the Full Text dialog box, click the Enable button.5 Click the Close button.Oracle Database 10g and 11g and SQL Server 2005, and 2008 must have full text indexinginstalled before external search can be enabled in iGrafx.External file search capability requires iFilters for SQL Server versions and filters for OracleText. iFilters for Office 2010 and Visio are available in the 2010 Filter Pack from Microsoft.PDF filters for SQL are available from Adobe. Additional iFilters may be available fordownload from third-party vendor websites.Users can see a list of file types searched in Process Central when they click the searchoptions icon in the iGrafx client application and click the Details button in the Search dialogbox. If additional file types are required, install additional filters on the server.To disable full text search:SQL Server administrators–Do not install SQL Full Text engine.Oracle administrators–Do not install Oracle Text.iGrafx Process Central Server Administrator 27

Analyze a RepositoryDuring a fix, you may lose some data. Make sure you backup your files before attempting tofix a repository.1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click Repositories.3 In the Repositories list, click a repository name.4 Click the Analyze button. If the integrity of the repository you are analyzing is good,then the test completes successfully. If not, the Analyze dialog box opens so you can fixthe problems.5 In the Analyze dialog box, click the Fix button.Upgrade a RepositoryWhen you install an upgrade or major release, you must upgrade your repository asdescribed in the procedure below. You can access Process Central repositories created witholder versions of the Server Administrator tool, but until the Process Central database isupgraded, the client application (for example, FlowCharter) does not have access to any ofthe new functionality available in the newer database format and connections to the newerdatabase will be rejected.Make sure you have the latest version of the iGrafx client application installed with theProcess Central client feature on the machine performing the upgrade. If you run thedatabase upgrade and do not have these applications installed, some features available in thenewer Process Central databases are not available for a given iGrafx document. If youperform an upgrade without the proper applications installed, you can check out and checkin files to recover the upgrade operation.28 iGrafx Process Central 2011 Administrator Guide

If you worked with iGrafx to implement custom security measures on the repository to beupgraded then contact iGrafx Customer Support for instruction to ensure those securitymeasures remain in effect after upgrading.1 Start the Server Administrator and log in using the same account as the user whocreated the database (the database owner or DBO). This will avoid potential problemswith the upgrade.2 In the Process Central Server Administrator dialog box, click Repositories.3 In the Repositories list, click a repository name.4 Click the Upgrade button.5 Click the Close button.Move a RepositoryIf you move Process Central to a machine running a different SQL or Oracle server, takeprecautions to avoid downtime and broken links.• Be sure to check in all repository items before making the move to the new server.• Ensure that all client connections are closed before the move. They can reopenconnections using the new server after the move is complete.• Add all databases, including the administration database, to avoid having to reregisterthe servers.Also note that:• If you are using Web Central, you must create new virtual connections so that webpages point to the correct server.• You may be able to avoid having to remove the old users and replace them with usersin the new database by creating the user structure before attaching to the databases.Sometimes SQL will not consider the users to be the same even though they have thesame name.• If the new server is not in the same domain, you must set up all the owners again. Forexample, DOMAIN1\USER does not automatically set up as DOMAIN2\USER afteryou connect to the new server.iGrafx Process Central Server Administrator 29

Manage UsersThe Process Central Server Administrator can use Microsoft Active Directory (LDAP)technology to help manage any number of users of repositories and databases. The Userspage of the Process Central Server Administrator dialog box displays a table of users that areeither from various directory services or have been entered into the database manually.The Process Central client and Mail Central use display names, if available, to display indialog boxes and tables such as the Log dialog box and User Group dialog box, and otherrepository-related locations. Process Central Server Administrator uses a user’s logininformation to key into the Users table and find the display name. If no match is found,Process Central uses the login name. The user’s e-mail address is used with Mail Central.Using the Process Central Server Administrator dialog box, you can add, delete, and modifyuser names. You can also import names from a directory service such as Microsoft ActiveDirectory to populate the users database.Add and Modify User InformationWhen you add or remove names from a table of users, you are modifying the database inwhich the user information resides. You can use either of these methods to add users to thetable of users:• Enter individual user information manually into the table.• Import names from a directory service.You may choose to modify user names to make automatically assigned account names moreuser-friendly. For example, a Windows account with a name like AID3124 can be changedto the individual user’s name, such as Bob Smith.You must have administrator permissions to add users to the Users table.Enter Names Manually1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click Users.3 Scroll to the bottom of the table, click the empty User Name cell, and enter a username This can be a SQL login account. You can use the Tab key or the Enter key tomove between cells.30 iGrafx Process Central 2011 Administrator Guide

4 Enter a display name. You may also choose to enter an e-mail address or an account ofthe form DOMAIN\USERNAME.5 Click the Close button when you are finished.Import Names From a Directory ServiceIf you have a large number of names to add from a directory service such as ActiveDirectory, you can click the Import From Directory Service button to import them all atonce.1 Start the Process Central Server Administrator and log in.2 In the Process Central Server Administrator dialog box, click Users.3 Click the Import Names From Directory Service button. The LDAP dialog box opens.4 Use the default settings or customize the domain components, and filters, and depth.5 Click OK. The names from the specified domain are added to the table.6 Click the Close button.iGrafx Process Central Server Administrator 31

Change User InformationYou can create user aliases within a user database by changing the display name of a user.You can also easily change the user’s e-mail address in the database. The value in the Username column must match a user’s name for Process Central Client and Mail Central to beable to use the Display Name and Email Address data. User names are Windows logins ofthe form DOMAIN\USERNAME or SQL logins.Manage the Local Repository FolderRemote or local users of Process Central can set their local repository folder location for astandard installation and make changes to registry keys to optimize functionality of aTerminal Services installation that allows remote check-in and check-out of Process Centralfiles.Standard InstallationProcess Central has a default location for storing local repository information. You canchange the default in the Process Central client application from the iGrafx clientapplication (for example, FlowCharter).1 On the ProcessCentral menu, choose Options.2 Click the Browse button and navigate to another folder location.3 Click OK to dismiss the dialog boxes.Terminal Services InstallationTerminal Services, such as Roaming Profiles on Citrix, allow you to check in and check outfiles from Process Central using a remote machine. You can customize the way TerminalServices allows access to Process Central by changing a registry key as described below. Thishelps you better control file version check-in when you check in files that you checked outwhile logged on to a different machine.32 iGrafx Process Central 2011 Administrator Guide

The key HKEY_CURRENT_USER\Software\iGrafx\Flowcharter\8.2\Repository can have aDWORD value (REG_DWORD) or a STRING value (REG_SZ) namedTerminalServicesCode with the following values:No Key present inregistryNumeric Value of 1Numeric Value of anyother NumberString ValueUses the machine name of the computer logged on toTerminal Services at check-out time as the value to checkagainst when checking back in. If the machines are different(Roaming Profile), the check fails and the user cannot check inthe file. This is the default state of an installation on Citrix orany other type of Terminal Services environment.Process Central uses numeric value of 1 to determine whetheryou are using Terminal Services. If you are, it assigns a stringvalue at check-out time. Then when you check in files, checkinworks from another machine as expected.Disables the check at check-in time. This allows ProcessCentral to work in a Terminal Services environment withRoaming Profiles, but removes the built-in safeties thatattempt to make sure no one checks in something fromanother user.Uses the string as the name for the machine name for thegiven user. This provides maximum flexibility for making surethe check passes and that the check-in is valid, but alsorequires the most maintenance.iGrafx Process Central Server Administrator 33

34 iGrafx Process Central 2011 Administrator Guide

Digital Signatures in Process Central 4When you review, approve, or endorse an item in a Process Central repository, you caninclude a digital signature to verify that:• you and no one else performed the action (the signature cannot be forged)• the item has not been tampered with since it was signedDigital signatures in iGrafx Process Central are designed to meet the requirements of theUnited States Department of Health and Human Services, Food and Drug Administration21 CFR Part 11 Electronic Records; Electronic Signatures; Final Rule.This documentation discusses the setup and administration of digital signatures in iGrafxProcess Central. See the Digital Signature topic under Process Central Procedures andReference in the iGrafx Help system for more information, including steps to customize andrequire digital signatures.How Digital Signatures WorkDigital signatures rely on asymmetric-key cryptography, often known as public-keycryptography. In public-key cryptography, every user is issued two related keys. A key is avery large number. One of the two keys is the public key, and one is the private key. Youshare your public key with everybody you want to communicate with, but you keep yourprivate key secret. Even though the two keys are related, knowing someone’s public keydoesn’t let you figure out what their private key is.If you encrypt (encode) something with your private key, it can only be decrypted (decoded)with your public key. If you successfully decrypt something with someone’s public key, thatstrongly indicates that it was encrypted with their private key.These properties allow powerful digital signatures. When you digitally sign a document,you encrypt a copy of the document with your private key and add the encrypted resultDigital Signatures in Process Central 35

(your signature) onto the original. Actually, to prevent the signature from getting too long,a smaller, unique fingerprint for the document (called a hash of the document) is encryptedinstead.If someone wants to check your signature, they decrypt the signature using your public key.This should give them the hash of the document at the time it was signed. They alsocompute the hash of the document as it is now. The two hashes should match. If they don’t,either the original wasn’t signed with your private key (for example, someone may beattempting to forge your signature), or the document’s data has been tampered with since itwas signed.Public Key DistributionSomeone may still be able to forge a digital signature. For example, suppose that Alicewants to forge Joe’s signature, so she creates her own public/private key pair, then somehowtricks you into believing that Joe’s public key is the one she just created. Maybe she sends anemail that appears to be from Joe, then falsely informs you of what Joe’s key is. If Joe putshis key on a website, maybe she hacks into the server and switches the data.You could only be sure the private key is authentic if you saw Joe in person and wrote downhis public key yourself when he told you what it is, which is impractical because the keys arevery long, cryptic values. You could never be sure you really have Joe’s private key.This is the problem addressed by Certificates.CertificatesA certificate is like a digital identification card. In fact, some companies, like Verisign®,refer to certificates as digital IDs. A certificate is a document that says “Joe Smith’s publickey is XXXXX.”Alice, who had the means to forge a digital signature (see Public Key Distribution), cannotas easily forge a certificate. You can trust a certificate because it is digitally signed.36 iGrafx Process Central 2011 Administrator Guide

Certificates are created and signed by entities knows as Certificate Authorities (CAs). Youcan trust a certificate if you:• Know the issuing CA’s public key. If your CA is a well known CA, like Verisign orThawte, Microsoft Windows comes with the CA’s public key pre-installed.• Trust the CA to use sufficiently rigorous identification methods when it issuescertificates. You can generally expect that a major CA has rigorous identificationmethods to protect its reputation as a trustworthy entity. If the issuing CA were nottrustworthy, Alice could apply to the CA and get a certificate with anyone’s name onit.It’s also possible for a company to set up their own CA to issue certificates to its employees.Often, the certificate for such a CA would be issued by one of the big-name root CAs toestablish trust.Certificates Used to Sign Documents in Process CentralSome certificates also include the private-key part of a key pair. You should not share thiskind of certificate with anyone.You must have a certificate that includes the private-key part of a key pair installed todigitally sign anything with iGrafx Process Central. When you sign, the private key is usedto produce the signature. Then, both the signature and the certificate–without the privatekey–are stored in the repository. When someone verifies the signature, the validity of thesignature and the trust status of the signing certificate are both checked.Certificates in Microsoft WindowsWindows has built-in certificate management facilities. In general, you do not need to usethe more complex certificate management mechanisms, but it is good to know some basics.The concept of Certificate Stores is core to understanding how to work with certificates inWindows. A Certificate Store is a collection of certificates installed on your machine. Twoimportant Certificate Stores are the Trust Root Certificates store and the Personal store.• The Trusted Root Certificates store contains the certificates of the root CertificateAuthorities (CAs) that you trust. Windows comes pre-installed with the certificates ofmany large CAs already in this store.Root certificates are self-signed, which doesn’t provide much assurance of certificateDigital Signatures in Process Central 37

authenticity. Instead, you are relying on the difficulty people would have modifyingall the world’s pre-installed certificates.• The Personal store contains the certificates you have imported that are for your ownuse. This is where you keep the certificates that identify you. These certificates ofteninclude private keys so you can use them for signing (or encrypting) data.Use Internet Explorer to see and manage your certificate stores. In Windows XP, you canalso use the more sophisticated Certificates MMC snap-in.1 In the Internet Explorer, choose Internet Options from the Tools menu or drop-down list.2 In the Internet Options dialog box, click the Content tab and then click the Certificatesbutton. A dialog like this appears:You can inspect certificates you have in various certificate stores from here.You don’t need to use this dialog box to import a certificate into the system. Certificateswith private keys included are distributed as *.pfx files. Double-click a *.pfx file to start theWindows Certificate Import Wizard.38 iGrafx Process Central 2011 Administrator Guide

Customized Digital SignaturesAnyone with appropriate user rights can specify that signatures are required on reviews,approvals, and endorsements and customize the statement that signers agree to. Forinformation, see the Digital Signature topic under Process Central Procedures and Referencein the iGrafx Help system.Frequently Asked QuestionsWhy do I need to have a certificate to digitally sign something in iGrafx Process Central?Certificates link people and their public keys together and help prevent someone else fromforging your signature with a public key they created.Why doesn’t the Signature dialog box show my Login name?The only thing that can be verified is that a signature was signed with a given certificate.The name of the person the certificate was issued to is the only thing that can be trusted.I’ve installed a certificate, so why doesn’t it show up when I try to sign something in iGrafx Process Central?To sign something in Process Central, you must have a certificate that meets the followingcriteria:• Private key• Trusted• Not expiredWhen I verify something I signed, it’s OK, but when someone else verifies my signature, it says that thecertificate isn’t trusted. What’s going on?The other person probably doesn’t have the same trusted root certificates (or intermediatecertificates) installed.Digital Signatures in Process Central 39

How is Certificate Revocation List checking implemented, and what protocol is supported (http, LDAP, or both)?iGrafx relies on the Windows CryptAPI and Certificate management infrastructure toimplement Certificate Revocation List checking. See Microsoft documentation forinformation about which protocols these support.40 iGrafx Process Central 2011 Administrator Guide

iGrafx Web Central 5Web Central is a web server plug-in that lets you browse and view Process Centralrepositories using a web browser.Using Web Central to view Process Central data is easy. No client-side installation is needed.Open a browser like Internet Explorer or Firefox (see Web Central Installation on page 11 foradditional requirements and recommendations) and bring up the start page on the server –a URL as simple as:http://yourserver/webcentralFrom there, you can view the contents of any of the available repositories. After you drilldown to view a diagram, you get a Java®-based experience, complete with zoom, scroll,and search functionality.None of this requires any publishing steps. Whatever data is checked in to a repository isinstantly available for viewing on the web.You can link to any item in a repository from your own web pages. You can link to a simplepage containing just a diagram, or to a frameset complete with a correctly expanded tableof-contentstree. And because each link uses a unique identifier, your links will not break,even if the items are renamed or moved.Web Central avoids lengthy download times and confusing security warnings by using onlyJava applets. That means clients can access the pages from any operating system on anytype of machine with a web browser and Java support.iGrafx Web Central 41

How It WorksThe heart of Web Central is igxview.dll (igxview64.dll on 64 bit Web Central). This is an ISAPIExtension DLL – a plug-in for IIS. IIS is the Internet Information Server, Microsoft's web server.Web Central acts as a middleman, it receives requests for Process Central data, gets thatdata from Process Central, then returns the data in a format suitable for the web.TerminologyThese terms may appear in discussions of Process Central and Web Central.RepositoryA repository is a single Process Central database.Repository ConnectionWhen an iGrafx client application (e.g. FlowCharter) or Web Central gets information froma repository, it communicates through a Repository Connection. For licensing andperformance reasons, repository servers have a limit on the number of connections theyallow at any one time. An iGrafx client application holds onto a Repository Connectionwhenever the repository is open. Web Central works a bit differently, as explained in thenext section.42 iGrafx Process Central 2011 Administrator Guide

Virtual ConnectionYou configure Web Central to know about specific repositories. The information for eachrepository it knows about is called a Virtual Connection – virtual because no connection tothe repository is actually made until a client request requires it. Once the client request iscompleted, the Repository Connection is released.When multiple client requests are being processed, a Virtual Connection may have morethan one Repository Connection associated with it.The total number of simultaneous real connections a virtual connection can make isconfigurable. Any client requests made once the limit is reached have to wait until anotherreal connection is released. By default, the Max Connections is set at 10. We recommendsetting the Max to 20 or higher to accommodate the potential for a large number of clientrequests.If you are using SQL Server 2008 provided with Process Central then you are licensed for anunlimited number of connections. If you are using your own SQL Server or Oracle, monitorhow many connections you can allow.Another part of the Virtual Connection information is the authentication information: whataccount the viewer should use when accessing the Repository. Typically, you either set up aSQL or Windows account with read-only rights to the repository, or request that the userenter their own SQL or Windows user name and password.Virtual DirectoryVirtual Directory is the term IIS uses to refer to a web-accessible folder. The location of thefolder on the local drive does not need to correspond in any way to its virtual location on theweb site.Run and Test the Web Central InstallationBefore installing Web Central on some operating systems, it’s necessary to install someoptional IIS features.iGrafx Web Central 43

Install IIS FeaturesBefore installing Web Central on Windows Vista, Windows 7or Windows Server 2008,additional IIS 7 features must be installed that are not installed by default.To install the necessary features on Windows Vista or Windows 7:1 In the Control Panel, choose Programs and Features.2 In the left panel, click Turn Windows features on or off.3 Expand Internet Information Services.4 Check these Web Management Tools:• IIS Metabase and IIS 6 Configuration Compatibility• IIS Management Console5 Check these World Wide Web Services:• ASP• ISAPI Extensions6 In addition, for Windows 7, check these common HTTP features:• Default Document• HTTP Redirection• Static Content7 If you are following the steps described by Configuring Web Central to use seamlessIntegrated Windows Authentication (Pass-through web server credentials) on page 55then expand Security and check Windows Authentication.To install the necessary features on Windows Server 2008:1 In the Server Manager tool object tree, expand Roles, then expand Web Server.2 Check these Application Development features:• ASP• ISAPI Extensions3 Check these Management Tools:• IIS Management Console• IIS 6 Management Compatibility.44 iGrafx Process Central 2011 Administrator Guide

4 If you are following the steps described by Configuring Web Central to use seamlessIntegrated Windows Authentication (Pass-through web server credentials) on page 55then under Security, check Windows Authentication.IIS 6 Management Compatibility, IIS 6 Metabase and IIS 6 Compatibility are required toconfigure IIS. ASP is required by the Web Central administration pages. ISAPI Extensionsare required by Web Central content pages.iGrafx Web Central 45

Run the Web Central InstallerWeb Central is installed using the Process Central installation wizard.When you run the installer, you'll be asked where you want to place the program. Thedefault location is c:\Program Files\iGrafx\WebCentral.The installer sets up several folders that you may need to know about. Assuming you installto the default location, the directory structure is as follows:The Web Central Directory StructureThe root folder contains igxview.dll (igxview64.dll on 64 bit Web Central). The installercreates an IIS Virtual Directory named webcentral, targeting this folder.The adminroot folder contains Active Server Page (ASP) files that allow local or remoteconfiguration of Web Central via a browser. The installer creates an IIS Virtual Directorynamed webcentral-admin, targeting this folder with main.asp as the default document. Thisvirtual directory is configured by default to use Integrated Windows Authenticating andreject anonymous connections. (See Run the Configuration Pages on page 48)The files folder contains support files that are returned directly to a browser (Java archivesand bitmaps). The installer creates an IIS Virtual directory named webcentral-files.The installer creates the Virtual Directories under an existing IIS web site bound to port 80(the default HTTP port.) If you don’t have a web site bound to port 80, then the installerdoes not create the Virtual Directories. If you have multiple sites bound to port 80, theinstaller could create the Virtual Directories on the wrong site.The config folder contains configuration information and template files for Web Central.These files are not returned directly to the user. Do not set up a Virtual Directory for thisfolder as it might expose potentially sensitive information such as SQL passwords.46 iGrafx Process Central 2011 Administrator Guide

Test the InstallationYou can now test whether igxview.dll (igxview64.dll on 64 bit Web Central) is properlyinstalled.On the Windows Start menu, point to Programs, then iGrafx, and click Web Central MainPage.orStart a browser and type the following URL:http://server-name/webcentralIf you are running the web browser on the same machine as the server, you can use thespecial loopback server address 127.0.01 as the server name.When you access igxview.dll like this without any additional parameters, it returns anAbout page to the browser. You should see a page that gives copyright information and saysthat no Virtual Connections have been established.To test that IIS and your network settings are all working as expected, try accessing thesame page from another machine.iGrafx Web Central 47

Run the Configuration Pages1 On Windows Vista, Windows 7, or Windows Server 2008, click the Start icon, point toAll Programs, then iGrafx, right-click Web Central Administration and choose Run asadministrator.orOn older operating systems, click the Start button, point to All Programs, then iGrafx,and click Web Central AdministrationThe installer sets up the webcentral-admin Virtual Directory to use Windowsauthentication. You must use a browser that supports NTLM authentication, such asInternet Explorer 7 or greater. When you access the page, you enter the same Username, Password, and optional Domain you use to log onto the server machine. Do notaccess the administration pages over the internet or other unsecure networks unless youalso set up SSL encryption for the administration pages virtual directory using the IISconfiguration tools.2 A message stating that there are no repositories currently accessible from the WebCentral Server opens.3 Click New to add a new Virtual Connection.Add a Virtual Connection1 In the main administration page, click New.2 The fields you see are described below:FieldConnection NameDescriptionThe name you choose appears in the client browser as thename of the repository.Server InformationServer TypeServer NameLets you select the appropriate server type.The name of the Process Central server machine. Thismachine must be accessible from the machine running WebCentral.48 iGrafx Process Central 2011 Administrator Guide

FieldRepository NameMax ConnectionsAuthenticationDescriptionThe name of the Repository Database on the server. Use thename you specified when creating the repository with theProcess Central Server Administrator.The number of simultaneous repository connections that theVirtual Connection allows.Select the Authentication Mode.If you select User sign-in, clients accessing this VirtualConnection are first prompted for a SQL Username andPassword. This mode also supports Windows authenticationfor Microsoft SQL Server.If you select Use the following SQL or NT account, then youalso need to enter a SQL or NT Username and password. Allclients are connected to the Virtual Connection with theusername and password you specify.If you select Pass-through web server credentials, then webbrowsers are not presented any login screens or dialogs andthe IIS server attempts to connect to the repository databaseusing whatever Windows account is active as the web page isserviced. This mode is only useful when you follow the stepsdescribed by Configuring Web Central to use seamlessIntegrated Windows Authentication (Pass-through web servercredentials) on page 55.Connection SetupShow only approveddocumentsEnable ConnectionSwitchingEnable extended SAPlayoutIf selected, only approved items are shown to webcentralclients.If selected, this will allow the user to access the list of allvirtual connections that have been setup and connect to anythat they have authorization for.If selected, some folders will display objects in views optimizedfor repositories with SAP content. In addition, SAPterminology will be used where applicable.iGrafx Web Central 49

FieldDescriptionAppearanceHome PageStyleDisplay RepositoryNavigation TreeDo not display Itemtype sub-headings inrelationship listsDo not show fileextensions for iGrafxdocuments andexternal filesThis optional field defines a home page for the VirtualConnection. When using the Virtual Connection, clicking theHome Page icon will navigate the user to this page. Todetermine the ID:• Create a Virtual Connection without a Home page.• Use the Virtual Connection to browse to the page thatyou want to be the Home Page.• If the Navigation tree is visible, click the Maximizeicon.• Retrieve the number at the end of the URL displayed inthe Address bar. For example, if the URL ishttp://127.0.0.1/webcentral/OurRepository?objid=23then the ID is 23.• Edit the Virtual Connection and enter the ID in theHome Page field.Applies a style sheet, which dictates the look and feel of thevirtual connection. Available style sheets must start with“style_” and be located in the config\Default directory such asC:\Program Files\iGrafx\WebCentral\config\Default. Theactual location varies, depending on where Web Central isinstalled.Enables a table-of-contents style tree to be displayed for theuser to navigate the repository with. Displaying the table-ofcontentscreates a view that uses Framesets.Setting this switch reduces the amount of space needed todisplay repository item relationships to other items.For example, “Word.doc” is displayed as “Word”.50 iGrafx Process Central 2011 Administrator Guide

FieldNavigation BarShow the parent itemname(s) as tooltip(s) toreduce lengthSearch BarLogoDescriptionIn repositories with multiple layers of hierarchy, thenavigation bar can become long enough to reduce the spaceavailable for content display. Use this setting to shorten thenavigation bar:Show Full Path: the Navigation Bar displays every layer ofhierarchy for selected repository items.Show Parent Only: the Navigation Bar displays only theparent name for selected repository items.In the Navigation Bar, display the parent item with an iconinstead of a text name. Placing the cursor over the icondisplays the name of the parent item.Configure how the Search Bar is displayed:Search box and options: always display the Search Bar anddisplay a list of search options when the cursor is in the SearchBar.Search box: always display the Search Bar. The search optionsare only displayed if the Search button (icon) is clicked.Search button: the Search Bar is not displayed until the Searchbutton (icon) is clicked. The Search Bar is then displayed inthe Search window.Inserts a logo at the top left of the browser page. Availablelogo files must start with “logo_” and be located at theindicated directory. PNG, GIF and JPG formats aresupported, but transparent PNGs are recommended.iGrafx Web Central 51

FieldDescriptionDiagram OptionsDefault ZoomHeader/FooterSingle Link BehaviorSets the default zoom level for diagrams to load at. Availabledefault levels are 100% and Fit All (fits the entire diagram inthe available viewing space).Choose to display diagram headers and footers.This setting determines the behavior of single links withindiagrams.Show menu: shows a menu for any links in a diagram.Show menu for file/web link: shows a menu for links to a URLor a non-iGrafx file. Links to iGrafx documents are followeddirectly upon clicking on the linked shape.Follow link: opens all single links directly when clicked.When a diagram has multiple links on the same object, amenu will always be displayed to allow the user to choosewhich link to follow.Repository DisplayDisplayed ItemsUncheck types of repository items that should not bedisplayed in folder views. The “Processes and Activities”switch refers to enterprise items -- not process maps or processdiagrams.Items not displayed in folders might still be viewabledepending on how the Relationships and Search settings (seebelow) are configured.52 iGrafx Process Central 2011 Administrator Guide

FieldRelationshipsDescriptionConfigure how links to hidden items function:Display hidden items in relationships: links to hidden itemscan be navigated and hidden items displayed.Only display the names of hidden items in relationships (nolink): links to hidden items are displayed as text that can’t benavigated.Do not display relationships with hidden items: no text orlinks to hidden items are displayed.SearchCheck this option if hidden items should not be found bysearches.Viewable Repository PropertiesSelected ItemSelect sets of repository properties that will be displayed infolder content lists and on the detailed pages for eachrepository object.General: a set of common properties including the ownername.Cycle Management: a set of properties showing documentstatus.Project Status: in the iGrafx client applications (for example,FlowCharter), these properties are set by right-clicking arepository object in the Process Central window, choosingProperties and then choosing the Status tab.Other and/or Custom: to display specified repositoryproperties, enter the property names in the field separated bybrackets as shown on the admin page. Custom repositoryproperties are created with the Process Central ServerAdministrator tool.iGrafx Web Central 53

FieldList itemsDescriptionRefers to lists of sub-objects that are displayed when selectingthe parent object just above them in a hierarchy. For example,the contents of a folder. These lists can show the selectedproperties to appear in a table.Any combination of Owner, Approved Date, Approval Dateand Modified Date can be displayed in list tables.Other and/ or Custom: For instructions, see the above SelectedItem field description.AdvancedUse these settings to reduce the amount of informationdisplayed on web pages.Hide Connection, Location and Search options in Diagramview: do not display supporting information and the searchbar with diagrams.Hide Diagram/Shape Properties in Diagram view: do notdisplay the Properties menu when a shape or diagram is rightclicked.Test ConnectionIf you select this box, a test connection is made to therepository when you click OK. You must first create an SQLaccount and give it rights to this repository before testing theconnection.When you click OK, your information is validated and (if requested) a test connection ismade to the repository you specified. If the connection succeeds, the virtual connection isadded to the main list and you return to the main page.There are some important additional considerations regarding the authentication method:• Security - If you choose User sign-in and access Web Central across the internet, orany other unsecure network, you must set up the webcentral pages to use SSLencryption (HTTPS protocol). Otherwise, the names and passwords are free for the54 iGrafx Process Central 2011 Administrator Guide

taking for any eavesdroppers on the network traffic. This is an independent operationyour IIS administrator should be capable of configuring.• Process Central Rights - If you choose Use the following account, then all usersaccessing the virtual connection have the same set of rights for the documents in therepository. (These rights include the permission to view individual documents, or theright to see non-approved versions of documents.) If you want to control such rightson a user-by-user basis, choose User sign-in or Pass-through web server credentials.• Annotations - Web Central allows annotating diagrams over the Web. If the virtualconnection is set to Use the following account, all of the annotations added throughWeb Central are tagged as having the same author: the name of the one account. Toensure annotation authorship is properly tracked, choose User sign-in or Pass-throughweb server credentials.• Windows accounts- If accessing a SQL Server database, users can enter Windowsaccounts if you use User sign-in.Configuring Web Central to use seamless Integrated Windows Authentication (Pass-through web servercredentials)With seamless Integrated Windows authentication, web browsers are not presented anylogin screens or dialogs. They immediately connect as whatever user is logged into theworkstation.Server configuration:• The repository database must be on a SQL Server database. The database shouldbe set up with Windows User or Group log-ins.• The SQL Server database and IIS must be installed on the same server machine.• IIS must be installed with the Windows Authentication feature. For details, seeInstall IIS Features on page 44.• Select the Webcentral virtual directory in IIS and double-click Authentication. SetIntegrated Windows Authentication to Enable. Set Anonymous access and otherauthenticated access methods to Disable.• Configure the Web Central Virtual Connection to use Pass-through web servercredentials.iGrafx Web Central 55

Client configuration:• Internet Explorer is the only supported browser for seamless Integrated WindowsAuthentication. Make sure that “Enable Integrated Windows Authentication” ischosen in the Advanced tab of Internet Explorer's Options dialog. This is thedefault setting.• Important: By default, Internet Explorer only does seamless Integrated Windowsauthentication when the web site being accessed is in the “Local intranet” or“Trusted sites” Web content zone. Make sure clients accessing Web Central havethe IIS server placed (automatically or other) in one of those zones. Note whentesting that the local loopback IP address, 121.0.0.1, is not by default in either ofthese more trusted zones.• If other browsers are used or Internet Explorer's security settings don't permit theseamless sign-in, then the browser will display a username/password dialog.Entering a windows user name (preceded by a domain name and a backslash) andpassword should work, but that defeats the purpose of Integrated WindowsAuthentication.56 iGrafx Process Central 2011 Administrator Guide

Edit a Virtual ConnectionYou can change the information about a virtual connection at any time. Click the Modifybutton for the connection you want to edit. In the editing screen, change the values youwant, and click OK.You may wish to create multiple Virtual Connections to the same repository. For example,one Virtual Connection can be authenticated via Use the Following account where theaccount allows only read-only access to approved respiratory objects. By using this VirtualConnection URL, a wide range of users could view approved documents without requiringsign in.An alternative Virtual Connection to the same repository can be authenticated via Usersign-in to allow accounts with the appropriate rights the ability to annotate and viewapproved and unapproved documents. When using this alternative Virtual Connection URLto access the repository, these users are required to sign-in.Delete a Virtual ConnectionClick Remove for the connection you want to delete, and click OK when asked to confirmyour decision.Avoid deleting or renaming a virtual connection if it will break existing links.iGrafx Web Central 57

Configure IISThe installer creates IIS Virtual Directories with good default settings for the root andadminroot folders. Use the IIS management tools to check and modify IIS settings asdescribed below.The Web Central-admin Virtual DirectoryThis Virtual Directory is accessed by administrators to configure Web Central settings:It is important to set up the Directory Security for this Virtual Directory carefully for thesereasons: First, you want to grant access to the configuration tools only to selected users ormachines. Second, carelessness here could allow unencrypted sensitive information,including the user-names and passwords for SQL accounts, to be transmitted across theopen Internet. Two main options are available:• Grant access to the virtual directories only to the local machine (or to specificmachines on your local LAN.) This simple option restricts access to just themachines you specify and can (depending on your LAN and firewall set-up) keepinformation from being transmitted over the Internet.• Do not allow anonymous access to the Virtual Directory. Use Windowsauthentication combined with Secure communications (you need a ServerCertificate for this) to safely pass all information through encrypted channels only.See the IIS documentation for information about how to set up a VirtualDirectory in this manner.Another important factor to consider is that the administration pages must have writeaccess to the Web Central configuration file. This file, igxview-config.xml, is placed in theconfig installation directory. If you use Allow Anonymous Access to the administrationpages, you will have to grant the Windows Account used for anonymous access the rights towrite this file. This could create something of a security hole on your system, and is notrecommended.It is better to use Windows authentication for the administration pages, and access themusing an account that has the necessary rights.58 iGrafx Process Central 2011 Administrator Guide

Configuring Web Central on Windows Server 2003, Windows Server 2008, Windows Vista, or Windows 7For machines running IIS on these operating systems, the Log On Locally security policymust be granted to Windows accounts and groups that use Web Central.Perform these steps to allow access to Web Central under these operating systems without aWindows administrator account.1 In the Control Panel, choose Administrative Tools.2 In Windows Server, click Domain Controller Security Policy.In Windows Vista or Windows 7, click Local Security Policy3 Click or expand Local Policies.4 Click User Rights Assignment.5 Assign the Windows account or group that needs to use Web Central Allow Log OnLocally security policy.This setting can take some time to take effect. You can run the Windows program calledgpupdate.exe that immediately applies any pending changes. To run gpupdate.exe:1 From the Start menu, choose Run.2 Enter “gpupdate” in the Run dialog box and click OK.Configuring Web Central with IIS7 on Windows Vista, Windows 7, or Windows Server 2008To run Web Central on IIS 7, you must enable the igxview.dll (igxview64.dll on 64 bitoperating systems) extension to execute.1 In the IIS Management Console, select the server on the left, and in the “features view”on the right, double-click “ISAPI and CGI restrictions”.2 Click the “Add…” button on the far right, and in the dialog that comes up, click thebrowse button and browse to igxview.dll (igxview64.dll on 64 bit operating systems).The default install location is C:\Program Files\iGrafx\WebCentral\Root.3 Enter a description (for example, “Web Central”), and check the box labeled “Allowextension path to execute”.Integrate with the WebWeb Central does not have to live in isolation, accessible only from the table-of-contentspages.iGrafx Web Central 59

Link to Process Central Items From Other PagesThe nice thing about linking to a repository item in Web Central is that your link will notbreak – even if you rename or move the repository item. This is not only true for managedlinks within Process Central, it also remains true when you author your own web pages andadd your own links to the Process Central items.This works because the URLs you use refer to objects by their repository IDs; unique IDsthat never change.What You Can Link ToYou can link to a page just showing the data you want to target (a single diagram being themost common example), or you can link to a page that shows the data and also includes thetable-of-contents and other navigation tools. In the latter case, the table-of-contentsretrieves the targeted item selected, as you would expect.Determine the URL to Use for the LinkUsing a web browser, browse to the item you want to link to. Depending on the type ofnavigation you are using and the data you want displayed for the link, choose one of theoptions below:• If you are using the tree navigation and you want the link to contain all theframes, click Click and choose the Synchronize Table-of-Contents button locatedjust above the table of contents frame. This reloads the entire frameset with anURL targeting the specific item.• If you want to link only to the data that is displayed in the center frame, first clickthe Maximize View button. The URL will reset to refer only to the data that isdisplayed in the browser in the Maximized View mode.• If you are not navigating using the table-of-contents tree, the URL reflectswhatever is displayed in the browser window.Now you can copy the URL displayed in the browser's navigation bar and paste it into yourHTML authoring tool.60 iGrafx Process Central 2011 Administrator Guide

Link to Other Pages from Process Central ItemsWeb links from shapes within your diagrams in the repository continue to work correctlyfrom Web Central.Troubleshoot Web CentraliGrafx Knowledge BaseFor the most recent troubleshooting articles, see the iGrafx Knowledge Base.Cannot Access Administration PagesProblem: When I try to open http://127.0.0.1/webcentral-admin in a web browser, I get a404 Not found error.Solution: See the topic 404 Not Found solution.Problem: When I try to open http://127.0.0.1/webcentral-admin in a web browser, itprompts me for a User name and password, but once I enter them it denies me access.Solution: The admin pages have been set up to use Windows authentication. You have touse a username (and optionally, a domain) for an account on the server machine.404 Not FoundProblem: When I try to open http://127.0.0.1/webcentral in a web browser, I get a 404 NotFound Error.Solution: Use the IIS management tools to determine if the webcentral Virtual Directorywas successfully created off of the root of your default Web Site. If not, you may need torerun the installer or contact iGrafx for technical support.Check to make sure that the Web Site in question is running on port 80. It may be thatanother Web Site is using this default port number. If so, you can change the port numbers,or access Web Central at an URL specifying the correct port: something like http://127.0.0.1:81/webcentral (In this example, the port number is 81).iGrafx Web Central 61

Server Tries to Return igxview.dll ItselfProblem: Whenever I try to access igxview.dll (igxview64.dll on 64 bit Web Central)through a web browser, it just shows me a bunch of garbled data or tries to save the DLLsomewhere.Solution: Make sure you have enabled execute permissions for executables for the virtualdirectory containing igxview.dll.62 iGrafx Process Central 2011 Administrator Guide

Q & AWhat if I get an error message saying that Web Central cannot connect to Oracle?First, make sure that you are using the latest version of Oracle ODBC driver. If you get theerror message “ORA-12705 invalid or unknown NLS parameter value specified,” check theNLS settings for Oracle. It could be caused by one of two situations:1 An attempt was made to issue an ALTER SESSION statement with an invalid NLSparameter or value. Check the syntax of the ALTER SESSION statement and the NLSparameter, correct the syntax, and retry the statement.2 The NLS_LANG environment variable contains an invalid language, territory, orcharacter set. Check the syntax of the NLS parameter, correct the syntax, and retry thestatement. Also make sure that correct values are specified in the NLS_LANGenvironment variable.What are the security risks with Web Central?The primary risks involve intruders gaining access to SQL Usernames and passwords. Howthese risks surface – and what preventative measures to take – depend on whether you setup your Virtual Connections to use User sign-in or Use the following account.• With User Sign-In - Every time a user enters a name and password for authenticationto a virtual connection, that information is sent between the browser and the server. Ifthe network isn't secure, eavesdroppers could learn the names and passwords.Therefore, if you choose User sign-in and access your server over the internet (or haveany other reason to believe that the network isn't secure), it is recommended in thestrongest terms that you encrypt the traffic to and from your Web Central pages. Usethe IIS management tools to configure the webcentral virtual directory to use SSLEncryption. To do this, you must obtain and install a Server Certificate for your webserver. Please see the IIS documentation for more information about how to do this.There is a security benefit to having virtual connections use User sign-in or Passthroughweb server credentials. No usernames or passwords are stored on themachine running the server.• With Use the following account - In this case, the username and passwords for theSQL accounts are stored in a configuration file on the machine running the server. Ifsomeone gained access to the machine, they could find out those passwords. Tominimize the impact of this risk, use SQL accounts with read-only access to specificiGrafx Web Central 63

epositories. Learning the password to such an account gives an attacker very littlebeyond what they could get by simply accessing the repository through the viewer.These same names and passwords are transmitted between the server and the clientwhen creating or editing a virtual connection using the administration pages. If youdo this over a non-secure network, use SSL encryption for the virtual directorycontaining these pages. There is a security benefit to having virtual connections Usethe following account. When clients access the Web Central pages through a browser,no username or password information is transmitted at all.How can I access Web Central from a remote location? Do I have to be connected to the Internet to use thisviewer?Due to the way Web Central works, you must have a live TCP/IP connection between theclient browser and the server.When can I change the configuration information?You can change the configuration information at any time, whether the server is running ornot. If the server is running, changes take place immediately. Frequent changes on a busyserver may lead to a performance degradation, since the server delays all requests while it isin the process of reloading the configuration data.64 iGrafx Process Central 2011 Administrator Guide

iGrafx Mail Central 6Mail Central facilitates team communication and coordination of work by sendingautomatic email notifications to users of any database and repository you choose. In iGrafx,Mail Central can automatically send all approvers an email notification that they havevoting to do the moment a document is nominated for approval.The Mail Central service runs in the background, polling databases for pending mail. Youchoose how often it looks for mail, on which Process Central repositories it looks for mail,and what SMTP server to use in your company to send the mail.Mail Central must be installed to enable Process Central scheduled cycle features.Install Mail Central using the iGrafx Process Central installation wizard on the ProcessCentral CD or download. When you install Mail Central, the service logs on using the localsystem account.Mail Central can be integrated with Exchange, Lotus, or other messaging servers.Set Up Mail Central for Email Events in Process CentralTo set up Mail Central for iGrafx Process Central users:• Set server properties–Specify the email address and display name for all automaticemail messages sent to users, select an SMTP host, and specify how often to check formail.• Connect to databases–Enable the Mail Central service on a database.You must have a valid username and password or have a Windows account with the Run AsService policy enabled to connect to a Process Central database as a specific user.Because Mail Central uses a web service to find the appropriate SMTP address to use for anygiven email address, the service must be able to connect to the Internet.iGrafx Mail Central 65

Users must have a valid email address defined in Process Central Server Administrator to useMail Central.Set Mail Central Service PropertiesBefore you set up Mail Central, be sure users are defined with valid email addresses inProcess Central Server Administrator.1 On the Start menu, point to Programs, point to iGrafx, then choose Mail CentralAdministrator.2 Right-click the instance name corresponding to your machine name.66 iGrafx Process Central 2011 Administrator Guide

3 From the menu, choose Edit Service Properties. The Server Properties dialog box appears.4 In the “From” E-mail Address For Mail Central field, enter the return email address.Mail recipients will reply to this email address.5 In the “From” Address Display Name field, enter the sender name you want to displayin the automatic email messages.6 Select an SMTP Host. Automatic SMTP Host Resolution is the preferred method forSMTP.7 Enter a value in the Check for Mail Every field to specify how often Mail Centralattempts to send mail.8 Click OK.Connect Mail Central to a DatabaseAfter you have specified the Mail Central server properties, locate the Database Connectionsfolder in the Mail Central Administrator to set up a Mail Central database registration. Youcan use Windows user credentials or SQL authentication to connect to a database.Connect Mail Central to a SQL Server-Based Repository1 Right-click the Database Connections folder and choose New Mail Central DatabaseRegistration from the menu. The Open Repository - Choose Server dialog box appears.2 Click the SQL Server tab.iGrafx Mail Central 67

3 Select the server name from the drop-down list, or enter the server name in the Servertext box.4 Enter your login name and password.5 Select SQL or Windows authentication. Some users find using an SQL account moreconvenient because of potentially complex rights and authentication issues.If you choose Windows authentication, you must include a domain name. For example:NTDOMAIN\JohnDoe. The service must have permission to log on as the individualnamed for this Windows authentication. For more information, see Use Windows UserCredentials with Database Connection on page 69.6 Click the Next button.7 Select a repository to connect to Mail Central.8 Click Open.9 Open the repository in iGrafx client application.10 In the repository window, select the repository and, on the ProcessCentral menu, pointto Repository and choose Properties.11 In the Repository Properties dialog box, ensure that the Send email notifications forProcess Central events check box is selected. This gives Mail Central the instruction toforward email to approvers.12 With the repository still selected in the repository window, on the ProcessCentral menu,point to Item and choose Rights.13 In the Rights dialog, select the Mail Central user account created earlier and specify aRole that has Modify or Administer permission. Check Apply the same changes to everyitem in this folder (and sub-folders) and click OK.Connect Mail Central to an Oracle-Based Repository1 Right-click the Database Connections folder and choose New Mail Central DatabaseRegistration from the menu. The Open Repository - Choose Server dialog box appears.2 Click the Oracle Server tab.3 In the Oracle tab, click one of the following options:• Use ODBC DSN (Open DataBase Connectivity Data Source Name)- See thedocumentation that comes with your Oracle ODBC drivers for information aboutsetting up a DSN.68 iGrafx Process Central 2011 Administrator Guide

• Specify Server and Database- This option is enabled if your machine has OracleOLE DB drivers installed. After you specify a server and database, type your namein the User Name field, and your password in the Password field. Process Centralwill then attempt to connect to the specified server using the TCP/IP server. Youcan also specify/change the TCP/IP port. The default port for Oracle databaseinstallations is 1521.• Use Oracle TNS name- This option is enabled if your machine has Oracle OLEDB drivers installed. TNS names connect you to Oracle databases on thenetwork, and are usually set up by your Oracle administrator or by using toolslike Oracle’s SQL*Net Easy Configuration.4 Click Next. choose a repository, then click Open.Oracle connections always use Oracle IDs, not Windows authentication.5 Open the repository in iGrafx client application.6 In the repository window, select the repository and, on the ProcessCentral menu, pointto Repository and choose Properties.7 In the Repository Properties dialog box, ensure that the Send email notifications forProcess Central events check box is selected. This gives Mail Central the instruction toforward email to approvers.8 With the repository still selected in the repository window, on the ProcessCentral menu,point to Item and choose Rights.9 In the Rights dialog, select the Mail Central user account created earlier and specify aRole that has Modify or Administer permission. Check Apply the same changes to everyitem in this folder (and sub-folders) and click OK.Use Windows User Credentials with Database ConnectionYou can use an individual Windows authentication for connecting Mail Central to thedatabase in the Open Repository - Choose Server dialog box. When you use a Windowsuser’s credentials with the service, the individual must have the log on as service policyenabled. To enable this policy:1 In the Windows Control Panel, choose Administrative Tools.2 Double-click Local Security Policy.3 Expand Local Policies and click User Rights Assignment. Log on as service provides thesecurity setting required.iGrafx Mail Central 69

Set Web Central Connection PathsEmail notifications may include links to repository documents. The links can be configuredto display documents in client applications (the default) or web browsers.Before performing these steps, Web Central must be installed and one or more VirtualConnections created to the repository to be configured.To enable Mail Central to specify browser links (and not client application links) for arepository:1 In the Mail Central Administrator, Database Connections folder, right-click a DatabaseConnection and choose Set Web Central Connection Paths.2 In the Review Connection section, Web Central Main Page URL field, specify thehttp://path to the “webcentral” page of the Web Central server hosting the repository.This path is equivalent to the path reached by performing the Start > All Programs >iGrafx > Web Central Main Page command (after installing Web Central).3 In the Review Connection section, Connection Name field, enter the Web CentralVirtual Connection name for the repository. The Virtual Connection name is defined bythe Web Central Administration tool.4 Repeat steps 2 and 3 for the Approval Connection and Endorsement Connectionsections. Normally, all connections are specified identically. For performance reasons,some customers may have separate Web Central installations for each connection type.Having separate fields for each connection type provides flexibility to install multipleWeb Central installations per repository.Scheduled CyclesiGrafx client application users can schedule Cycles to automatically start on a future date.For example, if today’s date is January 5, a Cycle can be scheduled to start on the first day ofevery subsequent month. In this example, the next Cycle starts immediately (depending onthe Check for mail every setting in the Mail Central Server Properties dialog) after midnightbetween the last day of the month and the first day of the next month.Similarly, any reminders to start a Cycle will be sent as early as possible on the date specifiedin the Setup Scheduling dialog in the iGrafx client application.70 iGrafx Process Central 2011 Administrator Guide

Troubleshoot Mail CentralMail Central problems, such as mail not received, are reported in the Event Viewer on themachine where Mail Central is installed.1 In the Windows Control Panel, choose Administrative Tools.2 Double-click Event Viewer.3 In Windows Vista, Windows 7, or Windows Server 2008, expand Windows Logs andclick Application. In older operating systems, click Application Log4 Double-click an event to view event properties.5 See the iGrafx Knowledge Base for more ideas on how to troubleshoot Mail Centralproblems.iGrafx Mail Central 71

72 iGrafx Process Central 2011 Administrator Guide

IndexAAdministration Databaseabout 23creating 24deleting 24authenticationSQL Server 16Windows 16Ccapabilities 69Ddatabase connection 65SQL or Oracle 67database owner 29Ee-mailautomatic 65notification 65email frequency 66e-mail setup 66Iinstallationcustom Web Central site 11Microsoft Small Business Server 2003 11Installation wizardabout 10Lloginscreating 16MMail Central 65Mail Central setup 65, 66MailCentral 25NNT user credentials 69OOLE DB Provider Drivers 25Oracle IDs 25PProcess Central administrative toolsinstalling only 10Process Central Server Administratorabout 21starting 22iGrafx Process Central 2011 Administrator Guide 73

RRepositoriesadding custom properties 26creating 25registering 26repositoriesgranting access to 16, 17repositoryadd custom properties to 26analyze 28create 25on Oracle 25register 26, 27remove 26upgrade 28what is a 42repository connectionwhat is a 42rolesused with a database in Oracle 25Vvirtual connectionwhat is a 43virtual directorywhat is a 43voting notification 65WWindows authentication 16Sserver properties 65service properties 66SMTP host 66SQL 2000about 15SQL replication models supported 15SQL scriptsused to create databases 25SQL Server authentication 16UUsers Table 2574 iGrafx Process Central 2011 Administrator Guide