1 ATIPXpress PAL Deployment Introduction

The purpose of this document is to provide instructions for creating the ATIPXpress Public Access Link (PAL) database and installing the ATIPXpress PAL application.  

ATIPXpress PAL facilitates the submission of Freedom of Information Act (ATIP) requests over the internet and allows information to be published to the Electronic Reading Room. ATIPXpress PAL supports SQL Databases.  

Notes: This document does not provide instructions for installing windows server or Microsoft

.net. Please consult your software vendor for further details concerning these installations.

A single server can be used to install ATIPXpress PAL and all its components, however it is highly recommended to configure separate servers for the ATIPXpress application, database, and repository due to the processing demands of the CPU.

1.1 Standard ATIPXpress and PAL Deployment Architecture

The PAL application URL will be accessible by the public for submitting ATIP requests to your agency. However, the web server and database server must remain secure. The standard deployment includes the following configuration:

• The PAL Database, PAL Application, and PAL File Server are installed in the External network (DMZ).

• The ATIPXpress Application, ATIPXpress Database, and all applicable services are installed in the local intranet.

• The Database Port and HTTPS port are enabled to allow the PAL modules to communicate with ATIPXpress.

The figure below shows the standard AX PAL deployment architecture:

2 PAL Installation Prerequisites

2.1 ATIPXpress PAL Deployment System Requirements

Before proceeding with the installation, it is necessary to do the following:

• Install Microsoft SQL Server 2017/2019 on the database server.

• Configure the SMTP Server to relay email to the email server while using ATIPXpress PAL.

  The SMTP server must be configured to relay e-mail messages to other domains.

• Before installing the ATIPXpress PAL database, make sure SQL Server collation is configured for case-insensitive.

• Confirm that the application server is set to the same time zone as the organization. This ensures that incoming PAL requests are correctly dated.

The installation package must be deployed from the application server, which must meet the requirements outlined below:

2.2 ATIPXpress PAL Database Account Requirements

There are three accounts which must provisioned to configure the application, database, and repository servers. The table below outlines the type of accounts, their purpose, and their requirements.

2.3 Install SQL Server Module

Follow the steps below to install the SQL Server Module on the application server:

1. Navigate to the following link: https://www.powershellgallery.com/packages/Sqlserver/21.1.18256

2. Under Installation Options, select Manual Download:

3. Click Download the raw nupk file. The SQLserver .nupkg file downloads.

4. Locate the downloaded "SQLserver” file, then right click it and select Properties.

5. On the General tab, select Unblock, then click Apply.

6. Next, edit the “SQLserver” file extension from .nupkg to .zip.

7. Extract the .zip package in the downloaded location. After the folder is extracted, remove “sqlserver.” from the folder name:

8. Navigate to C:\ProgramFiles\WindowsPowerShell\Modules and create a folder called SqlServer.  

9. Copy the renamed .zip folder from the downloaded location to the SqlServer folder created in the previous step (C:\ProgramFiles\WindowsPowerShell\Modules\SqlServer)

2.4 Enabling Windows Search Service

Windows Search Service allows users to perform search operations on the server. This service is required to perform content searches on documents located in the PAL Reading Room.

Notes:

Administrators are not be able to install windows search services if the indexing service is installed on the server. They must uninstall the indexing service then install the windows search service.

This service must be enabled on the application server.

Follow the steps below to enable Windows Search Service:

1. Click Start > Server Manager. The Server Manager application appears.

2. Click Add roles and features. The Add Roles and Features Wizard pop up window appears.

3. Click Next. The Select installation type window appears.

4. Select Role-based or Feature-based installation using the radio buttons.

5. Click Next. The Select Destination Server pop up window appears.

6. Select a server or a virtual hard disk using the radio buttons.

7. Click Next. The Select server roles pop up window appears.

8. Click Features from the left-hand menu, then select Windows Search Service.

9. Click Next. The Confirm installation selections pop up window appears.

10. Click Install to start the installation process. The Installation progress pop up window appears:

11. The installation process begins. This may take a few moments. After the installation completes a confirmation window appears.

12. Click Close to exit the Add Roles Wizard.

2.5 Enable TIFF files in Windows Search Service

TIFF is a file format for storing images. TIFF files are not enabled for search by default; therefore, you must enable the Windows TIFF IFilter feature in order to search TIFF files.

1. Click Start > Server Manager. The Server Manager application launches, as shown below.

2. Click Add roles and features. The Add Roles and Features Wizard pop up window appears.

3. Click Next.  

   
    

4. Select Role-based or feature-based installation.

5. Click Next.  

6. Select from the available options.  

7. Click Next.

8. Select Features.

9. Select Windows TIFF IFilter.

10. Click Next.  

11. Click Install.  

12. The installation process continues. This may take a few minutes. On conclusion, an installation confirmation appears:  

13. Click Close to exit the Add Roles Wizard.

2.6 Enable PDF in Windows Search Service

PDF files are not enabled for search by default; you must install the Adobe PDF IFilter feature to search PDF files. Follow the steps below to enable PDF in Windows Search Service.

1. Download and install Adobe PDF IFilter 9 from the following link:

ftp://ftp.adobe.com/pub/adobe/acrobat/win/9.x/.

2. Restart the Windows Search Service after installing Adobe PDF IFilter 9/11:

   1. Click Start > Administrative Tools > Services. The Services application launches.

   2. Scroll down and select Windows Search.

3. Click Action > Restart. The Service Control pop up window appears.

4. Select File > Exit to close the Services application.

5. Click Start > Control Panel > Indexing Options. The Indexing Options pop up window appears.

6. Click Modify to add the Reading Room root folder.

7. Add the electronic reading room root path to the included locations (e.g. C:\PALRepo\AFXWERR\):

8. Click Advanced. The Advanced Options pop up window appears.

9. Click the Rebuild button located in the Troubleshooting section. The Rebuild Index pop up window appears.

10. Click OK. The Indexing Options window changes to display the rebuild progress. This may take several minutes to complete. Once the rebuild is completed, the Indexing Options window will indicate the total number of items rebuilt.

11. Click Close to exit the Indexing Options feature.

12. Close the Control Panel window.

3 Download the Installation Package

The FOIAXpress installation package contains the files needed to install ATIPXpress PAL. Contact casepoint support at support@casepoint.com for your installation package.

After downloading the package, follow the steps below to unzip the file:

1. Locate the downloaded .zip file, then right click it and select Properties.

2. On the General tab, select Unblock, then click Apply.

3. Next, unzip the contents of the folder. The contents of the package appear as shown in the following example:

3.1 Verify the Integrity of the Installation Package

Steps to verify the integrity of the installation package.

1. Open Windows Powershell ISE.

2. Use the command below to verify the integrity of installation package:

Test-FileCatalog -CatalogFilePath "<<catalog file path(with extension of .cat) from downloaded artifact>>" -Path "<< folder that should be validated against the catalog file >>"

3. It will show as valid, as shown in the following example:  

3.2 About the Installation Package

There are two primary files you’ll interact with during installation:

1. Inputs.json: Drives the installation of the FOIAXpress system components. The file is in a standard json format and needs to remain a valid json file for successful installation.

2. Install.ps1: The executable file you will run to deploy the installation package with the parameters configured in the Inputs.json file.

4 Inputs.Json Settings for New Installations

4.1 About the Inputs.json File

The Inputs.json file located in the root directory of the extracted deployment package zip file drives the installation of the different components of the ATIPXpress PAL system. The file is in a standard json format and needs to remain a valid json file post updates prior to the installation.  

The settings are grouped into sections, each addressing settings which may or may not require configuration, depending on your specific installation. The following subsections in this chapter describe each section of the Inputs.json file.  

The parent node is the ‘inputs’ section. This section appears as follows:

Each section has parameters you can adjust to configure your installation. An example section is shown below, with an explanation for how it works:

Each (1) Section (“InstallType” in this example) includes various (2) Settings (“New” in this example) to configure.  

For each (A) Setting (“Upgrade” here), you can edit the (B) text in quotations (“N” here to indicate “No”) to configure the settings for your installation. This might include adding a file path, user name, password, or simply a “Y” or “N” depending on the field you are configuring.

The first section under the parent node is the Install Type. See the following section for details on configuring your install type, with the remaining sections following in the order they appear in the Inputs file.

4.2 Install Type

Use the “InstallType” section to determine if this is a new installation, or an upgrade for an existing system:

4.3 Install Components

The “Components” section allows you to determine which components to include with this installation. To include a component with your installation, be sure to assign the component a “Y” value on the corresponding line.

4.4 Application and Scheduler

The “APPANDSCHEDULER” section has settings related to the ATIPXpress PAL application and scheduler installations. A value must be set for all values in this section to successfully install the application:

Note: any files paths specified must have two backslashes where a path in windows explorer requires a single backslash.  

4.5 Database Settings

The “DB” section contains the settings for installing or upgrading your ATIPXpress PAL database. In case of a new installation, an agent account will be created.

4.6 Configuration Settings

Settings to configure the PAL Administration user details as well as the basic Organization details.

5 Inputs.json Settings for PAL Upgrade

This section discusses the inputs.json settings used when upgrading an existing AX PAL environment. For information on using the inputs.json file, see the About the Inputs.json File section of this manual.

Note: Some fields that would be required for a new installation should be left as-is for an upgrade. It is important to not edit or remove these fields as this could compromise the integrity of the inputs.json file. These are described where appropriate in the following sections.

5.1 Install Type

Use the “InstallType” section to determine if this is a new installation, or an upgrade for an existing system:

5.2 Install Components

The “Components” section allows you to determine which components to include with this upgrade. To include a component with your upgrade, be sure to assign the component a “Y” value on the corresponding line:

5.3 Application and Scheduler

The “APPANDSCHEDULER” section only requires input in the InstallLocation and BackupLocation fields.  

Note: All fields not listed above can remain as-is during an upgrade.

5.4 Database Settings

The “DB” section contains the settings for installing or upgrading your ATIPXpress database. In case of a new installation, an agent account will be created.

Note: You do not need to edit the AgentAccount fields during an upgrade, these can remain as-is.

5.5 Configuration Settings

Settings to configure the PAL Administration user details as well as the basic Organization details.

Note: These fields can remain as-is during the upgrade.

6 Install PAL

Before you are ready to run the Install.ps1 file, review the steps below to verify you’ve completed all the steps to this point:

• Make sure you have connectivity to the servers where the software is being installed.

• Complete the procedures described in the PAL Installation Prerequisites section.

• Download, verify, and extract the ATIPXpress PAL Installation package.

• Configure the Inputs.json file for your installation.

Once the above prerequisites are complete, follow the steps below to deploy the ATIPXpress PAL Installation package.

1. Open Windows Powershell ISE.

2. Use PowerShell to navigate to the location where you extracted the installation package:

3. Type .\install.ps1 for either install or upgrade.

4. If the inputs.json file is in same location as the extracted installation files, simply click enter to execute the installation. Alternatively, if you have file in different location provide this file location, then execute the script.

7 Sync Service (PAL)

This section provides instructions to configure the ATIPXpress Sync Service (PAL) and permissions. This section is relevant only if PAL is installed on your Web server.

7.1 Public Module Database Server and Database Information

Notes:

Prior to configuring ATIPXpress Sync Service, ensure that the PAL Database has been created.

The Download Document location is with respect to the ATIPXpress Sync Service only if you are using database configuration for your Sync Service. The configured user of the ATIPXpress Sync Service should have Full Control Security permissions on the Download Document location.

The Download Document folder should be manually created on the local or remote system. Ensure that the ATIPXpress PAL application and the Download Document folder path (local or UNC) is accessible by the IIS user on the system where the ATIPXpress PAL application is installed. The path for the Download Document folder should be accessible by creating the virtual directory (DOWNLOADDOCUMENTS) on the ATIPXpress PAL application server.

The Electronic Reading Room folder should be manually created on the local or remote system. Ensure that before the IIS user accesses the ATIPXpress PAL application, the Electronic Reading Room folder path (local or UNC) is accessible to the system on which the ATIPXpress PAL application is installed. The path for the Electronic Reading Room folder should be accessible by creating the virtual directory (ELECTRONICREADINGROOMDOCUMENTS) on the ATIPXpress PAL application server.

To configure ATIPXpress Sync Service, perform the following steps:

1. Select Start > All Programs > AINS ATIPXpress.

2. Right-click ATIPXpress Sync Configuration and select Run as administrator.

3. The Sync Service Configuration window will appear with the fields described in the table below based on the database server type (MS SQL Server) you configured earlier. Enter the required information and click Configure. The screen below uses MS SQL Server.

7.2 Using the WebService to Connect to PAL

Using the WebService to connect to PAL does not require database access. However, you must configure the WebService in IIS to have a successful connection.

Note: The below steps should be taken on the server where PAL is configured.

1. Click Start > Administrative Tools > Internet Information Services (IIS) Manager.

2. Expand Start Page > Sites > PALConfig and select the WebServices folder.

3. Double-click Authentication in the middle pane and enable Windows Authentication.

4. Click the WebServices folder on the Connections pane to return to the WebServices Home screen.

5. Right-click the PALConfig node and select Edit Bindings.

6. Add the HTTP Secure Socket Layer port assignment. Click Add. The Add Site Binding window appears.

1. Select https from the Type dropdown menu.

2. 1. Select the SSL Certificate provided in the drop-down list. For example, WMSvcTW-AINSDOCSAX.

3. Click OK to retain the settings or click Cancel to exit from the Site Bindings window.

   7. Add the SSL Certificate. If a certificate is not available in the SSL Certificate drop-down list:

   1. a. Select the Start Page (name of the server).  

   2. b. Click the Server Certificates option in the middle pane.

3. Click Create Certificate Request in the Actions pane. For further instructions, go to http://technet.microsoft.com/en-us/library/cc732906.aspx.

4. Click Complete Certificate Request in the Actions pane. For further instructions, go to http://technet.microsoft.com/en-us/library/cc771816.aspx.

   8. Configure SSL Settings:

   1. a. Double-click SSL Settings.

   2. b. Select the Require SSL checkbox.

   3. c. Accept client certificates.

   4. d. Click Apply in the Actions pane.

   9. Click the PALConfig node in the Connections pane to return to the home page.

   10. Click the Connect PAL Using WebService option on the ATIPXpress Sync Service Configuration window.

Note: This should be done on the server where the ATIPXpress Sync Service is installed.

11. Provide the PAL WebService URL in the URL field. For example:

https://palserver/webservices/syncservice.svc.

Note: The palserver portion of the URL above needs to reflect your PAL server name.  

12. Enter the Windows Login ID and Password for the PAL Server.

13. Enter the required information, and click Configure.

14. A confirmation message appears once the information is accepted. Click OK.  

7.3 ATIPXpress Failed Requests and Requesters

Within the ATIPXpress Sync. Service Configuration window, you can view the number of ATIPXpress failed requests and requesters, and Public Access Link failed requests and requesters. Based on this information, you can take an appropriate action, such as retrying failed jobs. These fields are represented as links that will be enabled only when there are failed requesters and/or requests of ATIPXpress and/or PAL respectively. You must click the links on the bottom-left of the ATIPXpress Sync Service Configuration window in order to view the failed jobs.

1. After clicking the ATIPXpress Failed Requesters/Requests link the ATIPXpress Failed Requests window appears.

2. To retry the failed requests/requesters, select the checkbox for each job and click Retry.  

   Note: All failed jobs will be sent to the sync service.  

3. To view the details of the failed jobs, select a job and click View or double-click the selected job.

4. To export failed jobs to a log file, click Export Failed Jobs to Log.

7.4 Public Access Link Failed Requests and Requesters

You must click the links on the bottom-right of the ATIPXpress Sync Service Configuration window to view the failed jobs.

Note: The below screenshots show the Public Access Link Failed Requests screens, however, the Public Access Link Failed Requesters screens look very similar.

1. After clicking the Public Access Link Failed Requesters/Requests link, the Public Access Link Failed Requests window appears.

2. To retry the failed requests/requesters, select the checkbox for each job and click Retry. All failed jobs will be sent to the sync service.  

3. To view the details of the failed jobs, select an ID and click View or double-click the selected job.

4. To export failed jobs to the log file, click Export Failed Jobs to Log.

8 Required Privileges for ATIPXpress PAL Application Server

The following section lists the directories that are relevant to ATIPXpress PAL as well as the level of permissions that should be applied to these directories.

8.1 Required Permissions for Network Service User (ASP.NET Process Identity)

On a Web server running Microsoft Windows Server 2016/2019/2022 and Internet

Information Services (IIS) 7.5/8/10, the ASP.NET process runs in the application pool for the Web application. ATIPXpress PAL setup will set the application pool identity as NETWORK SERVICE account by default.

The file and folder permissions listed in table below must have the ASP.NET Process Identity of ATIPXpress PAL Web application (Network Service User/configured impersonate user).

Note: If file repository folders (Download Documents and Electronic Reading Room document locations) are located on another server other than the ATIPXpress PAL application server, set the required security and sharing permissions for the ATIPXpress PAL application server account (network service user). Example: palserver$.

The File Repository folder located on the file server should have the Read and Write permissions for File Sharing and Full control for Security permissions. Please refer to the above screenshots to view the permissions.  

8.2 ATIPXpress Sync Service Required Privileges

The following table shows which type of file and folder permissions the user must have to function properly.

Notes:

The above specified Download Document Location and Electronic Reading Room Location should be the same as the location specified in the ATIPXpress Sync Service Configuration.

The folders \AFXWDOFL and \AFXWERR are the ATIPXpress File Repository folders.

The folder %SystemRoot% is the Microsoft Windows installation folder.