9.x Admin Pages Implementation NotesJoshua Morast, EMU

October 2017

Agenda

● Our Implementation Process

● Key lessons learned

● An idea or two

A bit about EMU● Founded in 1849

● FTE: 23k

● Faculty & Staff: 1500

Why Admin Pages?● Java NPAPI desupport● Oracle FMW 11.1.2.2 Premier Support

○ Ended 12/2016, one free year extended

Why Admin Pages at EMU?

● INB & Admin Pages can run in parallel● No form mods at EMU● Prereq ready

Prerequisites

CAS / SAML2 + UDCID

Proxy Auth for Jobsub

ESM

DB Upgrade 9.x

BANPROXY

Our Implementation Timeline● 2003 - Banner begins at EMU● Many, many late nights...

● 4/2016 - Banner + HAProxy● 5/2016 - First ESM Upgrade● 12/2016 - BEIS connected to IDM● 1/2017 - Banner + CAS goes live● 1/2017 - Banner XE Demo Environment● 5/2017 - Banner 9 Admin Pages & Proxy Jobsub goes live● 7/2017 - Admin Pages upgrade● 10/2017 - more Admin Pages upgrades & Banner INB goes away

Timeline

2017 Q1 2017 Q2 2017 Q3 2017 Q4

DEMO Environment Available

Implement XE Admin FormsXE Admin Forms Go-Live(Spring Upgrade)

Retire 8.x INB

Banner 8.x SSB

Prepare for XE Web Apps

Retire DEMO

Timeline

2017 Q1 2017 Q2 2017 Q3 2017 Q4

Banner 8.x SSB

DEMO Environment Available

Implement 9.x Admin Pages9.x Admin Pages Go-Live(Spring Upgrade)

Retire 8.x INB

Admin Pages Live

Banner XE Demo● Installed all “available” modules

(on one sorry clowncar VM)

● Not all apps ready for prime time

● Each app requires care and feeding

Admin Pages (and all modules)

Employee Self Service

Application Navigator

Finance ProcurementCommunication ManagementFaculty Grade EntryStudent AdvisingStudent Registration Self Service

Extensibility

Faculty Attendance Tracking Self ServiceStudent Self Service (Student Profile)

Student Attendance Tracking Self ServiceGeneral Self Service (Direct Deposit)

Proxy Jobsub Authentication● See ellucian article 34656 for details

Basic set of steps

● Create wallet & store banjsproxy credential● Setup special JSUB tnsnames.ora file● Grant user connect through banjsproxy

Should be able to login without password:

● export TNS_ADMIN=/apps/banner/banjsproxy● sqlplus [saisusr]/@JSUB

Environment Comparison

Banner Database

Oracle Fusion Middleware Tomcat

8.x Banner INB

8.x Banner Self Service

9.x Admin Forms

9.x SSB Web Apps

HAProxy

Java / Morphis

Groovy / Grails

Oracle Forms mod_plsql

Interesting tidbit...

frontend load_balancers bind *:80 bind *:443 ssl crt /location/raw.pem #force-tlsv12 redirect scheme https if !{ ssl_fc } mode http # Pretend campus IP range is 111.222.x.x and contractor at 52.1.193.111 acl campus_ip_range src 111.222.0.0/16 52.1.193.111 # Route admin pages acl url_admin_pages path_beg /applicationNavigator /BannerAdmin /bannerHelp http-request deny if url_admin_pages !campus_ip_range use_backend admin_nodes if url_admin_pages default_backend selfservice_nodes

backend admin_nodes … define admin pages server(s)

backend selfservice_nodes … define INB/SSB server(s)

HAProxy is an…

● Open Source

● SSL Terminating

● Load Balancing

● IP Filtering

● URL Routing

● Reverse proxy

Basic understanding of Admin PagesTechnical Components

INB

FMB

MMB

PLL

FMX

MMX

PLX

Admin Pages

release-Admin-Student-9.3.x.x.zip

release-Admin-General-9.3.x.x.zip

release-Admin-Alumni-9.3.x.x.zip

release-Admin-9.3.x.x.x.zip

release-Admin-HR-9.3.x.x.zip

release-Admin-PositionControl-9.3.x.x.zip

release-Admin-AccountsRec-9.3.x.x.zip

release-Admin-Finance-9.3.x.x.zip

bannerHelp.war

BannerAdmin.ws.war

BannerAdmin.war

Basic understanding of Admin Pages (cont)Technical Components

INB

FMB

MMB

PLL

FMX

MMX

PLX

Admin Pages

release-Admin-Student-9.3.x.x.zip

release-Admin-General-9.3.x.x.zip

release-Admin-Alumni-9.3.x.x.zip

release-Admin-9.3.x.x.x.zip

release-Admin-HR-9.3.x.x.zip

release-Admin-PositionControl-9.3.x.x.zip

release-Admin-AccountsRec-9.3.x.x.zip

release-Admin-Finance-9.3.x.x.zip

Application Navigatorrelease-applicationNavigator-2.x.x.x.zip applicationNavigator.war

bannerHelp.war

BannerAdmin.ws.war

BannerAdmin.war

New method of patching and deploymentBanner 9

Install admin common upgrade (if required)

Install module upgrade

Deploy admin common (not the module)

Restart tomcatUpdate config propertiesRestart tomcat

Test

Banner 8

● Install upgrade or patch● Migrate into code tree

Transfer to forms server

Compile FMB into FMX

Deploy FMX

Test

Impact on patching - SFASRPO exampleINB

● Delivered as one file, compile and deploy one file

Admin Pages

● patch is bundled with many other patches● may have to wait for bundle to be available● cannot implement single patch● May need to install new version of admin common● Need a new patching strategy

Admin Pages Installation Process● Install latest Admin Common● Install latest version of all 9.x licensed modules● Install Application Navigator● Deploy Admin Common

○ Customize config files

● Update GUAPAGE, point all ADMJF at AdminPages URL○ Pro tip, you can skip reclicking the integrated checkbox via:

■ Execute gukmenu.p_reresh_horizon_menu();

● Customize Application Navigator groovy config file● Deploy Application Navigator● Fun with troubleshooting

Easyish Install

● Fewer resources required than expected○ CPU/RAM requirements a bit overstated

■ INB/SSB - 8 vCPU 32G Ram■ Admin Pages - 8 vCPU - 12G Ram

● Easyish to setup and deploy ○ ...provided you already have ESM (Thanks Vicky!) and all other prereqs

Resource RequirementsProd Tomcat Server: 8 vCPU - 12G RAMTest Tomcat Server: 1vCPU - 2G RAM

● Installed Apps○ Application Navigator○ Extensibility○ Admin Pages

■ BannerAdmin■ BannerAdmin.ws■ bannerHelp

From Article 34051export JAVA_OPTS="-server -Xms2048m -Xmx6g -XX:MaxPermSize=640m"

From Article 34649<Connector port="8080" protocol="HTTP/1.1"

connectionTimeout="20000"

maxThreads="500" acceptorThreadCount="2"

redirectPort="8443" />

Admin Common Deployment● Deploy

○ Drops .war files on tomcat server

● Restart tomcat○ Extracts all files into webapp folder

● Update Config*○ perl -pi -e 's/replace/with/g' filename○ perl -pi -e "s/http:\/\/server.emich.edu:8080/https:\/\/bannerweb.emich.edu/" config.properties

● Restart tomcat○ Required for changes to config files to be used

*Required until ellucian moves more config elements to DB

Admin Pages config mods

Config File Item to Update Reason

config.xml APPNAV_HELP_URL Need to point to URL of load balancer

config.properties webapp.location Need to point to URL of load balancer

web.xml session_timeout Update global session timeout

Application Navigator config mods

Item to update Reason

authenticationProvider Enable CAS

grails.plugin.springsecurity.logout.afterLogoutUrl Specify CAS Logout

grails.plugin.springsecurity.cas.* Enable CAS

seamless.menuEndpoints Remove Self Service Menu

seamless.brandTitle Add branding at top of page

seamless.sessionTimeout Increase session timeout

External config filesFrom Application Navigator Install Guide

export JAVA_OPTS="-server -Xms2048m -Xmx6g -XX:MaxPermSize=640m -DBANNER_APP_CONFIG=/u01/sct/banner_configuration.groovy -DAPPLICATION_NAVIGATOR_CONFIG=/u01/sct/applicationNavigator_configuration.groovy"

Note: Per Article 35245 must update config files to specify CAS configuration

Clone automation● DB update

○ update gubmodu set gubmodu_url = ‘https://testserver.emich.edu’ where gubmodu_plat_code = ‘ADMJF’

● Tomcat server○ For admin pages

■ Copy BannerAdmin, BannerAdmin.ws, and bannerHelp directories to test systems webapp directory

■ Run config update script■ Restart tomcat

○ For Application Navigator & Extensibility■ Still must deploy via ESM (working on a script)■ If deploy unavailable, delete entry from GURWAPP

● (See article 38474)

Implementation pains● Transition not as easy for users

○ 41 resolved issues○ 32 open issues

■ 13 will close tonight■ 4 showstoppers still open

● Status updates for ellucian Change Requests○ Reviewed○ In process○ Complete (Available in Future Release)○ Complete (Delivered)

Example issue - SFASRPO

Change Request Timeline● 6/8 - Reviewed● 6/30 - In Process● 7/4 - Complete (Available in Future Release)● 8/31 - Complete (Delivered)

Obstacles to removing INB life supportFPAAGRD* List of Agreements LOV busted* Caused by odd EMU behavior

PXATAXS* Display issue - CR-000148034

SSARRES* Display issue - CR-000150203

TSATAXR * Introduced in AR 9.3.4 - CR-000151874

Showstopper - TSATAXR

Introduced in AR 9.3.4

The road from here● INB Retirement

○ Migrate SSB from Forms & Reports 11.1.2.2 to Weblogic 11.1.1.9 ○ Mod ESM to ignore forms compiles

● Automation○ Simplify Tomcat deployment with Docker

● Keep pushing for enhancements○ IDEA-51181 (from Columbus State University) - Store search results

■ https://tiny.emich.edu/IDEA51181

Remember

No one loved INB... until they met Banner 9.

Want people to love Banner 9? Ask if they’ve heard of Banner 10.

Questions?

Contact info:

● jmorast@emich.edu● xqin@emich.edu

This presentation

● https://tiny.emich.edu/bugmi2017jdm