Chapter 1 Introduction to PAE Administration

Netscape Application Server: Process Automation Edition (PAE) is a business process management system that runs on Netscape Application Server with a graphical design interface for defining forms and their routing, two administrative interfaces for configuring, and maintaining the PAE components, and an end-user interface for creating work requests, handling work items, and performing searches.

• Overview

• Directories in PAE
• Netscape Application Servers
• PAE Applications
• Security in PAE
• Process Administrator
• Directory Server Terms and Attributes

• Process Engine: The software internal to PAE.
• Process Administrator: An application accessible through your web browser that is used for managing clusters and applications in PAE.
• Process Business Manager: An application accessible through your web browser that is used for managing processes and statistics for PAE.
• Process Builder: The Java application for building PAE applications.
• Process Express: The HTML-based interface for end users who are accessing PAE applications.

• a corporate user LDAP directory service
• a configuration LDAP directory service that stores the application definitions
• a relational database for user data, such as the products available from Oracle and Sybase
• one or more Netscape Application Servers
• a Netscape Enterprise Server
• a mail server for notifications

• installing and configuring the software
• creating a cluster
• managing clusters and applications

• to store PAE configuration information, such as process definitions
• to provide a list of the users and groups within a corporation who can be assigned to activities

• the directory that PAE uses for authenticating users and groups
• the access control rules (ACLs) for PAE-specific configuration styles
• your cluster's corporate directory
• make sure your sample applications have valid users

To change the directory that PAE uses for authenticating users and groups, perform the following steps:

1. Go to the Server Administration page for your Netscape Enterprise Server. You access this page by going to the server:port defined for your 3.x SuiteSpot Administration Server. This URL is in the form yourServer:3.x Admin port.
2. Click the Global Settings button.
3. If not already chosen, click the LDAP Directory Server radio button to obtain directory service from an LDAP Directory Server.
4. Enter the correct information for your new corporate user directory:

• hostname (defaults to your local machine)
• port (defaults to 389)
• Base DN (defaults to ou=People, o=mcom.com)
• Bind DN and Bind DN Password are only required if you want to be able to add users or groups to the new directory.
5. Click Save Changes.
6. Restart the 3.x SuiteSpot Administration Server and all its servers.

1. Go to the Server Administration page for your Enterprise Server.
2. Click the button for your Enterprise Server instance to go to its Server Manager pages.
3. Click the Configuration Styles button.
4. Click the Edit Style link.
5. Select Basic Auth from the drop-down list and click the "Edit this style" button.
6. Click the Restrict Access link. This displays the Access Control List Management page.
7. In the middle of the page, under "B. Pick an existing ACL," select Basic Auth and click the Edit Access Control button. This displays the Access Control user interface.
8. Click "anyone" in the first line. A second pane appears in the lower part of the page.
9. Click the "Authenticated people only" radio button in the lower pane.
10. Click the "All in the authentication database" radio button.
11. Make sure that the authentication method selected is Default.
12. Under Authentication Database at the bottom of the pane, select the new corporate directory from the drop-down list and click its radio button.
13. Click Update in this frame to update the ACL rules.
14. Click Submit in the top frame to set the change.
15. Click OK to save your changes.
16. Click Save and Apply to apply your changes to the server.
17. .Repeat Steps 5-14 for the two other PAE styles: Admin IT Auth and Admin Data Auth.

• Make an existing cluster point at the new corporate directory.
• Create a new cluster that uses the new corporate directory.

1. In Process Administrator, use the Change Cluster Information page to update the cluster with the new corporate user directory URL. See "Changing Cluster Information" in Chapter 3, "Clusters" for instructions.
2. Making sure you have access to the right directory from Process Builder. There are two ways of doing this:

• If you have a cluster available during the design phase, you don't need to include the new corporate user directory's URL in the preferences.ini file. Instead, make sure your application uses the cluster's corporate directory. To do this, open the application's main properties inspector and set the Corporate Directory to be based on the cluster.
• If you are designing an application without access to a cluster during the design phase, you need to add the new LDAP URL to the preferences.ini file. In this case, make sure your application uses a specific corporate directory. To do this, open the application's main properties inspector and pick the Corporate Directory you want to use. Note that if you deploy to a cluster that uses the same directory, the assignments work as designed.

1. In Process Administrator, create a new cluster using the new directory. For more information, see "Creating a Cluster" in Chapter 3, "Clusters."
2. In Process Builder, redeploy your existing applications to the new cluster.

• Change the user assignments to point to users in the new directory.
• Add the required users to the new directory.

1. Select a user or group in the application tree.
2. Open its properties inspector.
3. Pick a new user ID for the assignment.

1. Launch Netscape Console.
2. On the authentication dialog box, enter this information:

1. administrative user name
2. administrative password
3. administration URL for the new directory server's Administration Server, including the port number
3. Click on User and Groups tab.
4. Pick New User or New Group from the drop-down list in lower right corner and click Create.
5. Enter new user or group info and click OK when done.

• Join your local Netscape Application Server to an existing cluster.
• Remove your local Netscape Application Server from a cluster.

http://yourServer/Administrator.apm

Process Administrator uses a tabbed HTML-based interface that provides access to management functions in these areas:

• Cluster management
• Applications

Create or Join a Cluster. The first time you access the Cluster Management tab after installing PAE or the first time you access it from Netscape Application Server machine that is not already part of a cluster, the Create or Join a Cluster page is displayed.

Create Cluster. Used to create a new cluster.

Join Cluster. Used to join this application server to an existing cluster.

Cluster Management. Used to manage the cluster that this application server belongs to.

Change Cluster Information. Used to change information about an existing cluster.

Delete Cluster. Used to delete a cluster.

Unjoin Cluster. Remove this server from the cluster.

Distinguished Name (DN). A series of comma-delimited attributes that uniquely identify the directory entry location within the directory tree. This could be a person, a group, an organization, or any other object for which you want to maintain information in a directory. In the case of PAE, information about a cluster is maintained in a directory.

Base DN. The entry at which to start directory searches, sometimes referred to as the search base. This base is often the root entry, that is, the search starts at the top of the directory tree.

Bind DN. The DN used to access the directory. Directory Server authentication is referred to as binding to the directory. Which DN you use as the Bind DN determines the level of directory access permitted. This is often the root DN, who has complete access to the directory, and so the Bind DN is sometimes referred to as the unrestricted user. The default Bind DN for Netscape Directory Servers is cn=Directory Manager.

Directory Suffix. A distinguished name (DN) suffix for your local directory. All incoming LDAP queries must contain this suffix, which is equivalent to the root entry of your Directory Server structure. This provides the highest level of identification for a specific directory. For example, o=airius.com. Everything contained within a directory is underneath this entry. If you know the directory suffix or root entry for a directory, you know which directory it is.

Root Entry. The first entry in a directory tree, that is the top of the tree. This is often, but not always the Base DN. The root entry corresponds to the directory suffix. If you know the root entry or directory suffix for a directory, you know which directory it is.

• c (country)
• o (organization)
• ou (organizational unit)
• cn (common name)
• uid (user ID)

Figure 1.2    A sample corporate user directory structure

• o=airius.com (tree root level)
• cn=My Cluster (specific cluster branch)

• o=airius.com (the same tree root level)
• cn=Your Cluster (a different branch of the Directory Server tree)

cn=My Cluster, o=airius.com

Figure 1.3    A sample directory containing a cluster

ldap://yourDirServer:port/Base DN

For example:

ldap://netscape.mcom.com:389/o=mcom.com

The Cluster URL
If you require user authentication, as you do for the cluster entry, use this format:

ldap://Bind DN:Bind Password@yourDirServer:port/cluster DN

For example:

ldap://cn=Directory Manager:netscape@netscape.airius.com:389/cn=HR Cluster, o=mcom.com