Global system settings
This section concerns advanced system setup for InterformNG2.
In order to setup the global system settings, you first need to sign in as described here.
Environment
Admin change password
With this setting you can decide if tenant admins are allowed to change the password of other users, that has access to the tenant in question.
External notifications
As default the Allow XML entities is disabled to ensure the best security of InterformNG2. It is highly recommended to verify with your local Interform support before allowing XML external entities.
This option is normally enabled, but if disabled, then all file access workflow components are disabled. This is a requirement for cloud solutions to ensure totally separated tenants.
Restricts where file workflow components may read and write.
When enabled, add the approved root directories below. A file path is allowed only if it resolves inside one of them, and a write needs a root marked writable. Leave the list empty to confine each tenant to its own resource folders. Protected locations (encryption keys, settings, the profiles folder) stay blocked either way.
Enables the workflow component "Execute native O/S command" that runs shell scripts and operating-system commands on the server.
This is a remote-code-execution-class capability and should stay disabled unless you really need it. It is always disabled when direct file access is off.
Allowing all outbound connections enables all workflow components that perform outbound network communication, including printing.
Flipping this switch to disabled, gives the option for more fine-grained control over which of these workflow components are available. It is highly recommended to only enable the functionality that is actually required by workflows. When a group is disabled, it prevents use of both the workflow components and the related connection test option in settings.
This option is disabled as default. You need to enable this, if you want to execute scripts in InterformNG2. Currently this is linked with the workflow component, Run a script. Before enabling scripting support, be aware of the following security implications:
The JavaScript load function can be used to load JavaScript files from the file system. On a multi-tenant setup that uses the file system for resources, this will allow a tenant to load and execute JavaScript files that are stored in another tenant's resource folder.
JavaScript is a general programming language with infinite possibility. InterformNG2 sets some boundaries for what is possible in the scripts, but creative people may still be able to exploit loopholes.
- If you enable either of these actions, then you allow InterformNG2 to execute either select and/or updates with SQL and even allow to call stored procedures in the databases. Please verify with your system administrator before changing these settings, as custom SQL statements to a database can cause security issues and concerns. The option 'Allow database updates' also allows InterformNG2 to run SQL Delete.
Load balancer certificate
If a load balancer in front of this system handles TLS termination, enter the
certificate expiry date here to receive expiry warnings on the dashboard.
Log file retention
By default, the system log files inside {InterFormNG2_HOME}\profiles\default\logs are never deleted, and it is expected that the admin deletes old log files when necessary. However, if you enable the option "delete old system log files," you can set the length of time the log files should be kept before they are deleted from the system.
IBM i Connection
This section is only shown if either InterformNG2 is installed on an IBM i (iSeries or AS400), or if you have added this option to the configuration file: enable.as400.functionality=true, as covered in the section Connecting to AS400 from another platform.
System name
The IP-address or hostname of the IBM i to connect to. You can use localhost like above, if you want to refer the machine on which InterformNG2 is installed.
The user profile that you want InterformNG2 to use for contacting the IBM i machine. *CURRENT refers to the user profile. You should consider setting up this user profile so that the password does not expire. You can do that by setting this parameter on the user profile: Password expiration interval (PWDEXPITV) to *NOMAX.
The password to use for the user profile above.
State the default codepage to use for the connection. This should normally be the same as setup in the system value, QCHRID (DSPSYSVAL QCHRID).
Choose the tenants you want to give access to the IBM i environment. This has been introduced in version 4.4.0, where multiple IBM i connections are supported.
Allowed tenants
- If you leave this blank, then all tenant will have access to the IBM i. If you select the drop down list of tenants, then you can choose to only allow certain tenants to have access to the IBM i.
- From version 4.4.0 you can use multiple IBM i connections, but for customers, that have upgraded from a previous version this option can help to handle the change. From the drop down list you can select the tenant(s) for which this IBM i connection should be the default.
Enables/disables an encrypted connection to the IBM i.
This is an icon for testing the connection to the IBM i.
This option is default disabled:
When the option is disabled then all passwords in the configuration of a tenant will be encrypted in an export. The encryption match the current machine, so the encryption prevents the passwords to be used on another machine. If you however do want the export(s) to included unencrypted passwords (so that the passwords can be used on another machine), then you need to enable this option first.