System Registry Settings

Get extended information about platform version, repository session, resources used by BI server when executing the GetSystemInfo web service operation with the specified fields processInfo and cpuInfo. The operation is also affected by the presence of moniker in the metabase field and value of the allowMetabaseNotFound field that returns an error if there is no repository connection.

Available values of the GetSystemInfoExtended parameter:

• 0. Default value. Executing the request may return only brief information:

• If the metabase moniker is not specified, empty response is returned.

• If the metabase moniker is specified, information about repository session is returned.

• If the allowMetabaseNotFound flag is set, and if there is no connection by the specified moniker, the error and information about repository session are not returned.

• 1. Get extended information:

• If the metabase moniker is not specified, platform version information and/or information about BI server resources is returned according to the sent processInfo and cpuInfo fields.

• If the metabase moniker is specified, the system also returns information about repository session along with platform version and/or BI server resources.

• If the allowMetabaseNotFound flag is set, and if there is no connection by the specified moniker, the error is not returned, and information about platform version and/or BI server resources is returned.

The GetSystemInfoExtended parameter also affects how the service version is displayed in the About window in the web application. If the value is 0, service version is not displayed, if the value is 1, service version is displayed.

Indicates whether the use can work in the development environment.

Available values:

• 0. Working in the development environment is forbidden.

• 1. Default value. It is allowed to change units/web forms in the development environment.

Indicates whether WebSocket work via the IPv6 protocol is disabled.

In Foresight Analytics Platform, WebSocket is used to provide the work of web forms and the Business Process Management extension. By default, the work is executed via the IPv6 protocol.

Available values:

• False. Default value. WebSocket uses the IPv6 protocol.

• True. WebSocket does not use the IPv6 protocol, IPv4 is used.

It locks access to opened object instances.

Available values:

• 0. Default value. The object is write locked.

• 1. The object is read and write locked, and simultaneous reading from the object is possible with several threads.

It locks the entire session on processing requests. When the lock is enabled, requests to all objects within the session are executed one by one, otherwise they are executed concurrently, or individual locks are used (RWLockSlim).

Available values:

• 0. Default value. Lock is disabled.

• 1. Lock is enabled.

It locks access to opened dashboard instances. When the lock is enabled, read/write requests are executed one by one, otherwise they are executed concurrently. The lock is also enabled for nested objects accessed using the dashboard moniker.

Available values:

• 0. Default value. Lock is disabled.

• 1. Lock is enabled.

Period of inactivity (no requests), after which a session with repository is closed. The time is set in seconds, the allowed range - [60, 127800]. If the parameter is set to -1, the timeout two weeks is set. Default value: 1800 seconds.

Object state save and restore mode at state server. It is used with the StateServer settings group.

Available values:

• Never or 0. Default value. Do not save and do not load object states.

• Yes or 1. Save on change, load on absence in the session. The ObjectStateSaveInterval parameter is also taken into account.

• Ever. Save on change, load always.

The time interval after the last saving of object state, after which, if the object is changed, the new state will be saved.

The parameter is relevant if the Statable parameter is set to Yes. The interval is set in seconds, the allowed range - [5, 300].

If the ObjectStateSaveInterval parameter is not set, is empty, or less or equal to 0, the interval is not taken into account, and the object state is saved after each object change.

If the ObjectStateSaveInterval parameter is set, in case of object change, the system checks if the specified time interval is over after the last saving of the state:

• If the time interval is not over, the state is not saved.

• If the time interval is over, the new state of the object is saved.

Generate consecutive session and object monikers.

Available values:

• 0. Default value. Generate monikers via GUID.

• Yes or 1. Generate consecutive monikers (for example, S1!M).

Additional check of correspondence between the client who opened the session and identifier of the session at each BI server query. It prevents XSS attacks.

Available values:

• 0. The check is not executed. It is used if connection between the client and the BI server is set up via HTTP protocol or the client does not support work with cookie files.

• 1. Default value. The check is executed. To provide correct check, make sure that there is a configured connection between the client and the BI server via HTTPS protocol, and the client must support work with cookie files.

For details about web application work via the HTTPS protocol see the Setting Up Web Application Work via HTTPS section.

It sets a limit for the number of export results stored on the server with each object (for express reports and regular reports).
The default value is 0, but the number of saved results is not limited.

Maximum total size of loaded binary objects within the session. The size is indicated in bytes by default. If B, K or M Latin character is specified after the value, the value size is set in bytes, kilobytes, or megabytes respectively. The default value is 0, and the loaded volume is not limited.

It sets a limit to the number of repository database connections.

Available values:

• 0. Default value. Do not reuse connection, always create a new one.

• <0. Reuse without limit to the number (add a new connection if there are no free connections).

• >0. Reuse with the limit to the number of connections specified in the parameter.

NOTE. The PoolMaxConnections parameter is outdated, it is left for compatibility with previous versions of Prognoz Platform. Use the MaxConnections parameter in the registry key [HKLM\SOFTWARE\Foresight\Foresight Analytics Platform\10.0\PP\BIS\System\Pool].

Processing mode of the GetStatus operation that is used in the web application to check connection status.

Available values:

• 0. Default value. Sending request prolongs the repository session.

• 1. Sending request does not prolong the repository session. If there are not other requests, the session will be interrupted after the timeout is over that is set in the TimeoutSec parameter.

The parameters that affect operation of BI server application pool:

• MaxConnections. Maximum number of pool connections. Available values:

• -1. Connection pool is enabled.

• 0. Connection pool is disabled.

• Value is greater than zero. Connection pool is enabled, the maximum number of connections is set (by default it is limited to 50 connections).

• Strategy. Algorithm for discarding connections from the pool when it is required to free space for a new connection. Available values:

• LRU. Algorithm of discarding the least recently used connections (LRU algorithm).

• Balance or Default. Discarding based on the ratio number of opened repositories/number of opened database connections.

• UserMaxConnections. Maximum number of connections created with the same credentials. The default value is 0, and the number of connections is unlimited.

• RetryCount. The number of attempts of connection business check. Available value - [1, 1600], by default, there are 160 attempts.

• RetryInterval. Interval between attempts in milliseconds. Available value - [10, 4000], by default, it is 400 milliseconds.

Additional subsections that contain parameters for specific repositories can also be created in the Pool subsection. A created additional subsection must have a unique name. It can be used to create the following parameters:

• Db. Connection parameters for the user in the following format: {user_name}:{repository_identifier}@{database_server};

• UserMaxConnections. Maximum number of connections with the specified repository using the specified account.

NOTE. Connection pool parameters are applied, if the MaxConnections parameter value is greater than zero.

Parameters of connection to state server.

• Type. State server type. Available values:

• MemCached.

• Redis.

• Radix.

• Tarantool.

To set up state server, make sure to set one of the values depending on the application.

• Host. IP address or DNS name of the state server. Default value: localhost.

• Port. Number of the port that will be used for connection. When the value is -1, the default port is used: 11211 for MemCached and 6379 for Redis/Radix/Tarantool.

• ExpireTime. Records storing time in seconds on state server. If the parameter is not set or is equal to 0, records are stored infinitely. It is used for Redis/Radix/Tarantool.

To set up authentication on state server, create the Credentials subsection and set the Crs and Crsa parameters. In the parameters specify user credentials to connect to state server in encrypted form. Encrypted values of the parameters can be obtained using the PP.Util utility and the /encrypt_creds parameter.

This subsection stores private key of the security certificate. Parameters of this registry subsection are created at the runtime of PP.Util utility.

• Alg. Encryption algorithm.

• Data. Encrypted private key of the security certificate.

• Id. Security certificate identifier.

• Key. Security certificate GUID.

IMPORTANT. Parameters of this subsection must not be edited manually.

Parameters of objects for statistics collection. In this subsection the user needs to create additional subsections with names matching repository identifier. A parameter can be created in each additional subsection:

• StatKeys. Keys of individual repository objects listed via comma, which will be used to collect information for performance counters.

Work parameters via the OAuth 2.0 or OpenID Connect protocol for user authentication on external servers that support this protocol.

When authentication is executed via external services, a connection between the client and the BI server must be set up via the HTTPS protocol. The state parameter is checked by default to protect from potential CSRF attacks on getting authorization code. If connection between the client and the BI server is set up via HTTP protocol, create the StateCheckOff parameter and set it to 1 to disable the check.

To set up interaction with external services inside the OAuth section, create subsections with OAuth/OpenID Connect authentication server names. Each subsection has its own specific parameters. The following parameters of OAuth/OpenID Connect authentication servers are available:

External authentication service parameters that will be used for user authorization in the repository with the ExtService type via JWT token or HTTP headers.

In this section one should create subsections with names of external authentication services. Determine the following parameters in each subsection:

• Type. External service type. The following values are allowed:

• JWT. The service that returns JWT token with information about the user.

• HttpHeaders. The service that adds HTTP headers with information about the user for the BI server.

• AuthUrl. URL of external service authentication page. If the parameter is specified, clicking the Login and Exit buttons opens the external service's authentication page. If the AuthUrl parameter is not specified, after clicking the Login button and successful user authentication the object navigator or the repository object opens. Clicking the Exit button opens the web application authorization page.

• JwtHeader. Header name that will contain JWT token with user information. It is relevant only if Type = JWT. If the parameter is set, the JWT token will be obtained from the header with the specified name. If the parameter is not set, the JWT token will be obtained from the Authorization header. In this case the token in the Bearer format is expected.

• UserIdAttr. Attribute name or path to the attribute in JWT token or header name that will contain unique user identifier. For example, the attribute name given_name or the path /path/to/given_name.

• UserNameAttr. Attribute name or path to the attribute in JWT token or header name that will contain displayed user name. For example, the attribute name "name" or the path /path/to/name.

• UserRolesAttr. Attribute name or path to the attribute in JWT token or header name that will contain the list of groups of users and will add the user temporarily to the obtained groups. If the UserRolesAttr parameter is not specified, the temporary user is added to the USERS built-in group.

IMPORTANT. The list of user groups must not contain the ADMINISTRATORS built-in group.

• SignaturePublicKey. The parameter is specified only if Type=JWT. The public key that will be used to check token signature. A signature is created based on the RS256 algorithm. The key is set in the PEM format encoded in BASE64.

• CertificateHash. The parameter is specified only if Type=HttpHeaders. Certificate's digital fingerprint of the proxy server that establishes BI server connection and appends queries with HTTP headers. Trust between the BI server and the proxy server is established by comparing certificate's digital fingerprint specified in the parameter and certificate's digital fingerprint obtained from the proxy server during establishing mTLS connection with the BI server.

Optional parameters:

• UPN. Attribute name or path to the attribute in JWT token or header name that will contain user name in the UPN format. For example, the attribute name "upn" or the path /path/to/upn.

• Email. Attribute name or path to the attribute in JWT token or header name that will contain user email. For example, the attribute name "mail" or the path /path/to/mail.

To set session values of global variables, after the repository connection is successfully established, one can create the AdditionalAttributes section in external service settings description. Name of each child element of this subsection should match with attribute name in JWT token or header name, which value will be set in global variable. The child element can contain the IdVariable parameter, in which one specifies identifier of repository global variable. If the IdVariable parameter is not specified, the system searches for the global variable with the identifier equal to attribute name in upper case.

Parameters of work with the list of repositories. Allowed string parameter:

• AccessMode. Indicates whether the Settings button is displayed in the login dialog box and a list of repositories can be created. Available values:

• 0. Default value. The button is not displayed, the existing list of repositories and connection parameters are read-only.

• 1. The button is displayed, creating a list of repositories and changing connection parameters is fully available.

Parameters for working with development environment objects.

• Disallow. Indicates whether Fore macros are denied using the ForeExec. If the value is 1, macros are denied, execution of the ForeExec  operation is checked on BI server side. If the value is 0, or the parameter is missing, execution is checked by the web application with the value of the foreExec parameter in the PP.xml file.

Web form work parameters.

• Port. BI server port, via which web forms work according to the WebSocket protocol. The 9091 port is used by default.

The subsection which stores service user credentials:

• Realm. Credentials scope. As a key value, the identifier of the Database object is displayed, which work involves the specified credentials.

• Crs/Crsa. Encrypted service user credentials.

Add the parameter for the remote BI server and intermediate BI servers in the chain:

• CubeServiceAllowProxy. The ability to send queries to a remote BI server. Available values:

• 0. Queries to remote BI server are denied. Default value.

• 1. Queries to remote BI server are allowed. If during query execution, a cyclic query by URL is found, the corresponding message is displayed.

• 2. Queries to remote BI server are allowed. If during query execution a cyclic query by URL is found, the query is executed on the BI server.

The subsection, in which end points to remote servers are specified. For each point create a subsection with a unique name, add a parameter for each subsection:

• address. Actual address of a remote BI server.

The subsection contains repository settings. To set up, inside Mbs create a subsection with a unique name, that is, repository identifier. The parameter can also be specified inside the created subsection:

• endpoint. A unique name of the access point specified in the Epts section. The specified end point will be used to address cached data on creating repository cubes and on saving changed data to cubes. If an empty string is specified as the name, the current BI server is addressed. The specified access point is used for all default repository cubes unless another access point is specified for specific cubes in the Cubes subsection.

Additional subsections with settings can also be created for repository inside each subsection:

• Cubes. The subsection contains settings for specific repository cubes, which are used to address remote BI servers. To set up, create a subsection with a unique name, in which add the following parameters:

• Keys. Cube or cube shortcut keys via comma, without spaces.

• endpoint. A unique name of the access point specified in the Epts subsection.

NOTE. If repository objects use the shortcut that refers to the cube, shortcut data will be obtained via an access point specified for the cube. If the shortcut has its own access point that is different from the cube's access point, this access point will be used during the use of shortcut.

For example:

[HKLM\SOFTWARE\Foresight\Foresight Analytics Platform\10.0\Service\Mbs\WAREHOUSE\Cubes\InMemSettings]

Where:

• WAREHOUSE. Repository identifier.

• Cubes. Subsection for setting up specific repository cubes.

• InMemSettings. Subsection for specifying cube keys and unique name of access point.

• UpdCache. The subsection contains settings that determine from where cube cache update starts. To set up, add the following parameter:

• endpoint. A unique name of the access point specified in the Epts subsection.

If the UpdCache subsection is created, the BI server, to which the specified access point corresponds, will be used to execute cache update task in scheduled tasks container.

Cube data caching work mode.

Available values:

• file. File cache data caching.

• global. Default value. Global cache data caching.

If the CacheType parameter is not contained in the registry, the UseInMem parameter is checked:

• If the UseInMem parameter is contained in the registry, file cache or global cache is used depending on the specified value.

• If the UseInMem parameter is not contained in the registry, default global cache is used.

Indicates whether InMemory MOLAP mechanism is used to cache cube data in file cache.

Available values:

• true. File cache data caching.

• false. Default value. Global cache data caching.

IMPORTANT. The UseInMem paameter is outdated and is used for compatibility with previous versions. To determine a data caching mode, use the CacheType parameter. If the UseInMem and CacheType parameters are set at the same time, the value of the CacheType parameter has a higher priority.

Activation of syslog server connection for forwarding security event messages.

The REG_DWORD parameter. Available values:

• 0. Default value. The connection is not used.

• 1. The connection is used.

IP address of syslog server.

String parameter. The IPv4 protocol is available only. The default value: 127.0.0 1.

Port of syslog server for incoming connections.

The REG_DWORD parameter. Default value: 202. It is set in hexadecimal notation system.

In settings.xml the value is set in the decimal notation system - 514.

Protocol used for forwarding.

The REG_DWORD parameter. Available values:

• 0. Default value. The UDP protocol.

• 1. The TCP protocol.

Save checksum calculation result of the lpsolve55.dll library for Windows OS or the liblpsolve55.so library for Linux OS.

String type parameter. As a parameter value, set full path to the file with checksum calculation result.

The parameter should be added on local computers of all users.

For details about integration with LPSolve, see the Connecting External Modules to Foresight Analytics Platform section.

Additional debug info in calculations.

The REG_DWORD parameter. Available values:

• 0. Default value. Additional debug info is not displayed.

• 1. Full information about the selection, based on which calculation is executed. The selection is created taking into account filtering and parameter values. The matrix with attribute values is displayed for selected dimension elements.

If data filtering is enabled, full information about is added with the information about calculation mode depending on whether data filtering sources contain a calculation block destination cube. If no, multithreaded calculation will be applied.

• 2. Full information about selection will be added with the matrix with changed values obtained after calculation.

• 3. Full information about selection and the matrix with changed values are added with the information about data aggregation: selection, by which aggregation is executed, aggregation calculation time, aggregation result.

IMPORTANT. The parameter does not affect algorithm calculation speed on executing collection and output of additional debug info.

The parameter should be added on local computers of all users.

For details about getting debug info on calculations see the How to View Debug Information on Calculations? section.

Changing the maximum number of threads, by which parallel iteration calculation will be executed, on calculation of calculation blocks and/or control blocks. The maximum of 8 threads is used by default on multithreaded calculation.

The REG_DWORD parameter. If the specified parameter value is less than the number of processor cores, the number of threads specified in the parameter will be used. If the specified parameter value is greater than the number of processor cores, the number of threads equal to the number of cores will be used.

NOTE. When specifying the parameter take into account the architecture of Intel processor 2019 or later. When calculating iterations, the doubled number of streams is used relative to the specified parameter value.

The parameter should be added on local computers of all users.

For details about multithreaded calculation see the How to Execute Multithreaded Calculation? section.

Additional debug info during the work with data cubes.

The REG_DWORD parameter. Available values:

• 0. Default value. Additional debug info is not displayed.

• 1. Information about data cell coordinates and access permissions to them. Displayed access permissions:

• Read. Read-only permissions.

• Write. Write-only permissions.

• ReadWrite. Write and read permissions.

Additional debug info only for data cubes containing segments.

The REG_DWORD parameter. Available values:

• 0. Default value. Additional debug info is not displayed.

• 1. Information about data cell coordinates and access permissions to them. Displayed access permissions:

• Read. Read-only permissions.

• Write. Write-only permissions.

• ReadWrite. Write and read permissions.

Indicates whether garbage collector messages should be logged.

The REG_DWORD parameter. Available values:

• 1. Display the objects left in memory in the development environment during partial garbage collection, system downtime, or during full cleaning.

• 2. Display the objects left in memory in the development environment during garbage collection.

• 4. Default value. During repository logout display the objects left in 

memory after garbage collection.

Indicates whether recursive queries are used on getting repository object dependencies. It is relevant if a repository is created based on PostgreSQL DBMS. The parameter is ignored for other DBMS.

Available values:

• 0 or False. Default value. Recursive queries are not used.

• 1 or True. Recursive queries are used to get object dependencies and dependencies of dependent objects and their children.

The subsection that is used to determine password hashing algorithm settings used for built-in authorization in password authentication. Hash is generated based on the combination of the GOST P 34.11-2012 and Argon2 algorithms.

Use parameters:

• TimeCost. Calculation time cost. Default value - 4.

• MemoryCost. Calculation memory cost. The value is specified in KiB, the default value - 9216.

• Parallelism. The number of parallel streams. The default value - 1.

• SaltSize. Generated salt length. Salt is a unique randomly generated string that is added to each password in the process of hashing. The default value - 8 bytes.

• Pepper. Pepper is a random character set that will be used as an addition to salt to provide additional security level. The default value - "".

NOTE. When pepper value changes, it is required to reset all user passwords.

The subsection that is used to determine password hashing algorithm settings used for built-in authorization in password authentication. When hashing passwords history, the system uses the same algorithm that is used to hash user passwords and that is specified above in the description of the Hash subsection. The list of set parameters and their purpose correspond with the parameters that are set in the Hash subsection. Values of the Pepper parameters in subsections must differ.

The subsection that determines settings limiting execution of various operations. The settings are used to limit the burden on productions systems in case of possible attacks.

Use parameters:

• SubjectsAllowedNum. Limiting the number of security subjects in search results. The allowed value in the [0, 2147483647] range, the default value – 5.

• MaxAttemptsForDelay. The maximum number of search requests, after which delay is activated. The allowed value in the [0, 4294967295] range, the default value – 3.

• ProtectorDelaySec. Initial delay value in seconds (increases linearly). The allowed value in the [0, 4294967295] range, the default value – 5.

• DelayResetPeriodSec. The time period in seconds, after which the attempts counter is reset, and delay is deactivated until MaxAttemptsForDelay is reached. The allowed value in the [0, 4294967295] range, the default value – 10.

• MaxAttemptsForError. The maximum number of request attempts, after which the error message is displayed. The allowed value in the [0, 4294967295] range, the default value – 0.

It determines whether the dimension can be moved to table filtering dimensions. It is available for regular reports express reports, dashboards and information panels, for which the IPivot.DimFilterRestrictionsEnabled property is not set.

Available values:

• 0. Moving of controlled or parametric dimensions to filter is allowed.

• 1. Default value. Moving of controlled or parametric dimensions to filter is denied.