PP.Util

PP.Util is a console application within Foresight Analytics Platform that executes various auxiliary operations during BI server setup. The application is included in Foresight Analytics Platform and is located:

To start the application in Linux OS, use the PP.Util_start.sh script. The application can be started only by one of the selected actions. The required action is selected by specifying an appropriate set of parameters.

The PP.Util utility must be started under the same user who controls BI server work:

In Windows OS, on installing BI server on default IIS web server, the application pool will be started under the Network Service account.

Description of Parameter Sets

To view the console help for available parameter sets in Linux OS, start the PP.Util_start.sh utility without parameters. Optional parameters will be specified in square brackets. When specifying a parameter set in application syntax do not use square brackets.

Parameters:

/create_audit_user metabase_id login password audit_login audit_password [db_login [db_password]]

Save credentials of service user of security subsystem on the database server.

metabase_id. Repository identifier. Mandatory parameter.

NOTE. The repository with the specified identifier should be in the repositories list. If a custom schema is specified in repository connection settings, service user credentials will be created for it.

login. Owner name for the ADMIN schema for repository connection. Mandatory parameter.
password. Owner password for the ADMIN schema for repository connection. Mandatory parameter.
audit_login. Name of created service user. Mandatory parameter.

NOTE. The P4AUDIT service user name is reserved by the system and cannot be used.

audit_password. Password of created service user. Mandatory parameter.
db_login. Name of the database who has privileges to create DBMS users. Optional parameter. If user name is not specified, it will be asked in interactive mode.
db_password. Name of the database user who has privileges to create DBMS users. Optional parameter. If the password is not specified, it will be requested in interactive mode.

After executing the operations, service user credentials are created on the database server.

The example:

/create_audit_user REPOSITORY_ID USER_NAME USER_PASSWORD SERVICE_USER_NAME SERVICE_USER_PASSWORD

Parameters:

/save_audit_creds [/ALG enc_alg] [/SCOPE scope] [realm|/DC] login [password]

Save credentials of service user of security subsystem on the current user computer.

enc_alg. Encryption algorithm, which is used to encrypt user credentials:

gos. Default value. Encryption with the GOST 28147-89 algorithm is used.
pro. Encryption with Data Protection API (DPAPI) in Windows is used. This encryption type is unavailable in Linux OS.
sim. Credentials are saved unencrypted.

IMPORTANT. To ensure security during production operation of Foresight Analytics Platform, use the gos or pro value.

Optional parameter. If the parameter is not set, the default value is used.

scope. Method for saving credentials:

hkcu. Only for me. Credentials will be stored in the registry key of the current user - [HKEY_CURRENT_USER\SOFTWARE\Foresight\Foresight Analytics Platform\10.0\Audit\Credentials\Item0] - and are available only for the current computer user.

hklm. Anyone who uses this computer. Credentials will be stored in the local computer registry - [HKEY_LOCAL_MACHINE\SOFTWARE\Foresight\Foresight Analytics Platform\10.0\Audit\Credentials\Item0] - and are available for anyone who uses this computer.

file. Default value. To the settings.xml file.

In Windows OS, credentials will be stored in the settings.xml file located at %PROGRAMDATA%\Foresight\Foresight Analytics Platform.

NOTE. The ProgramData folder is hidden in the operating system by default.

If the file exists in the specified folders, it will be overwritten. If there is not such a file, it will be created.

Optional parameter, it is used only in Windows OS. If the parameter is not set, the default value is used.

In Linux OS, credentials can be stored only in the settings.xml file located at: /opt/foresight/fp10.x-biserver/etc.

realm|/DC. Credentials scope of the service user. Select one of the methods:

realm. If the list of repositories contains more than one repository, and service user credentials should differ for each of them, set an identifier of the SERVER_DATABASE|TYPE type for the database server specified in specific repository connection settings, where:

SERVER_DATABASE. IP address or alias of the registered database server.

NOTE. When setting up repository connection on each client computer or on the computer with installed BI server, IP address or server alias must match with the server specified in the SERVER_DATABASE parameter.

TYPE. Type of driver in use. Available values: POSTGRES, MSSQL, ORCL.

For example: "127.0.0.1|POSTGRES".

NOTE. To avoid syntax errors, enclose the value in quotation marks.

/DC. If the list of repositories contains one or more repositories, but service user credentials should be equal for all repositories, use this parameter without specifying additional settings.

Mandatory parameter.

login. Name of existing service user. Mandatory parameter, it is case sensitive.
password. Password of existing service user. Optional parameter, it is case sensitive. If the password is not specified, it will be requested in interactive mode.

NOTE. The /save_audit_creds parameter can be contracted to /sac.

For details see the Creating a Service User section.

For example:

In Linux OS:

/save_audit_creds /DC SERVICE_USER_NAME SERVICE_USER_PASSWORD

In Windows OS:

/save_audit_creds /SCOPE hkcu "10.30.210.10|POSTGRES" SERVICE_USER_NAME SERVICE_USER_PASSWORD

Parameters:

/save_creds [/ALG enc_alg] metabase_id [/DC|/GC] login [password]

Saving credentials in repository connection settings. Credentials are saved in the encrypted form in the registry subsection, where repository connection settings are stored.

enc_alg. Encryption algorithm that is used to encrypt credentials:

gos. Default value. Encryption with the GOST 28147-89 algorithm is used.
pro. Encryption with Data Protection API (DPAPI) in Windows OS is used. This encryption type is unavailable in Linux OS.
sim. Credentials are saved unencrypted.

IMPORTANT. To ensure security during production operation of Foresight. Analytics Platform, use the gos or pro value.

Optional parameter. If the parameter is not set, the default value is used.

metabase_id. Repository identifier. Mandatory parameter.
/DC|/GC. Purpose of credentials. Select one of the options:

/DC. Credentials for default repository connection.
/GC. Credentials for guest connection to repository.

Optional parameter. If the parameter is not set, user credentials are used that are specified in the login and password parameters.

NOTE. The parameter should not be used on saving credentials of the schema owner if the use of built-in authorization is supposed to be used.

login. User name for repository connection. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.

NOTE. The /save_creds parameter can be contracted to /sc.

The example:

/save_creds REPOSITORY_ID /DC USER_NAME USER_PASSWORD

Parameters:

/encrypt_creds login [password]

Encryption of user name and password with the GOST 28147-89 algorithm and output of obtained values in the console. The command results in the attributes: Crs and Crsa. These attributes with encrypted credentials can be used in the settings.xml file or in the registry on setting up connection to directory service of LDAP server and on setting up authentication on state server.

login. User name. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.

NOTE. The /encrypt_creds parameter can be contracted to /ec.

The example:

/encrypt_creds USER_NAME USER_PASSWORD

Parameters:

/save_cert cert_file metabase_id login [password]

Saving security certificate in the repository system table to authenticate user by certificate.

cert_file. Absolute or relative path to file with security certificate. Mandatory parameter.
metabase_id. Repository identifier. Mandatory parameter.
login. User name for repository connection. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.

NOTE. The /save_creds parameter can be contracted to /sc.

The example:

/save_cert /tmp/server.cer REPOSITORY_ID USER_NAME USER_PASSWORD

Parameters:

/save_private_key key_file cert_id [enc_alg]

Saving private key in the registry to use it on connecting by the security certificate.

key_file. Absolute or relative path to file with private key. Mandatory parameter.
cert_id. Identifier of security certificate in the repository. Mandatory parameter. This identifier will be obtained after executing the /save_cert command.
enc_alg. Encryption algorithm, which will be used to encrypt the private key file before saving in the registry:

gos. Default value. Encryption with the GOST 28147-89 algorithm is used.
pro. Encryption with Data Protection API (DPAPI) in Windows OS is used. This encryption algorithm is unavailable in Linux OS.
sim. Private key data is saved unencrypted.

IMPORTANT. To ensure security during production operation of Foresight. Analytics Platform, use the gos or pro value.

Optional parameter. If the parameter is not set, the default value is used.

The example:

/save_private_key /tmp/server.key SERVER gos

Parameters:

/create_svclog_tables database_id metabase_id login [password [db_login [db_password]]]

Creating repository system tables to store operation execution log. Tables are created both physically (on DBMS server) and in the repository (repository objects - Table).

database_id. Identifier of the Database object, to which created table repositories will be set up. Mandatory parameter.
metabase_id. Identifier of the repository, in which tables will be created. Mandatory parameter.
login. User name for repository connection. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.
db_login. User name for authorization on connecting to the database specified in the database_id parameter. Optional parameter. If the user name is not specified, it will be asked in interactive mode.
db_password. User password for authorization on connecting to the database specified in the database_id parameter. Optional parameter. If the password is not specified, it will be requested in interactive mode.

NOTE. The db_login, db_password credentials are specified if it is determined by settings of the appropriate repository database.

The example:

/create_svclog_tables OBJ_DB REPOSITORY_ID USER_NAME USER_PASSWORD DB_USER_NAME DB_USER_PASSWORD

Parameters:

/clear_svclog_tables metabase_id login [password [db_login [db_password]]]

Clearing repository system tables with operation execution logs.

metabase_id. Repository identifier. Mandatory parameter.
login. User name for repository connection. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.
db_login. User name for authorization on connecting to the database specified in the database_id parameter. Optional parameter. If the user name is not specified, it will be asked in interactive mode.
db_password. User password for authorization on connecting to the database specified in the database_id parameter. Optional parameter. If the password is not specified, it will be requested in interactive mode.

NOTE. The db_login, db_password credentials are specified if it is determined by settings of the appropriate repository database.

The example:

/clear_svclog_tables REPOSITORY_ID USER_NAME USER_PASSWORD DB_USER_NAME DB_USER_PASSWORD

Parameters:

/iisdiag [/C] metabase_id login [password]

Checking of typical problems on installing BI server at IIS.

/C. Do not check settings determined in IIS, check only the settings, which are executed by the installer on installing BI server.

Optional parameter. If the parameter is not set, the settings specified in IIS and BI server settings are checked.

metabase_id. Repository identifier. Mandatory parameter.

login. User name for repository connection. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.

The example:

/iisdiag /C REPOSITORY_ID USER_NAME USER_PASSWORD

NOTE. If PP.Util was used to save credentials, and after it the operating system user password, under which BI server works, was changed, all credentials must be resaved.

If the following data sets are used: create_audit_user, save_cert, create_svclog_tables, clear_svclog_tables, the AnalyticsPlatform feature is requested. In Linux OS specify the LSFORCEHOST or LSHOST system variable using one of the methods:

sudo LSFORCEHOST=<license server name or NO-NET> /opt/foresight/fp10.x-biserver/bin/PP.Util_start.sh /create_audit_user REPOSITORY_ID USER_NAME USER_PASSWORD SERVICE_USER_NAME SERVICE_USER_PASSWORD

sudo -E /opt/foresight/fp10.x-biserver/bin/PP.Util_start.sh /create_audit_user REPOSITORY_ID USER_NAME USER_PASSWORD SERVICE_USER_NAME SERVICE_USER_PASSWORD