FOIAXpress PAL Deployment Manual

FOIAXpress PAL Deployment Introduction

The purpose of this document is to provide instructions for creating the FOIAXpress Public Access Link (PAL) database and installing the FOIAXpress PAL application.

FOIAXpress PAL facilitates the submission of Freedom of Information Act (FOIA) requests over the internet and allows information to be published to the Electronic Reading Room. FOIAXpress PAL supports SQL Databases.

NOTES: This document does not provide instructions for installing windows server or Microsoft .net. Please consult your software vendor for further details concerning these installations.

A single server can be used to install FOIAXpress PAL and all its components, however it is highly recommended to configure separate servers for the FOIAXpress application, database, and repository due to the processing demands of the CPU.

Standard FOIAXpress and PAL Deployment Architecture

The PAL application URL will be accessible by the public for submitting FOIA requests to your agency. However, the web server and database server must remain secure. Installation option 1 includes the following configuration:

• The PAL Database, PAL Application, and PAL File Server are installed in the External network (DMZ)

• The FOIAXpress Application, FOIAXpress Database, and all applicable services are installed in the local intranet

• The Database Port and HTTPS port are enabled to allow the PAL modules to communicate with FOIAXpress

The figure below shows the standard FOIAXpress PAL installation.

NOTE: The diagram below reflects the available FOIAXpress integrations and may not reflect your specific environment.

PAL Installation Prerequisites

ATIPXpress 11.x Deployment Architecture

PAL Installation Prerequisites

FOIAXpress-PAL Deployment System Requirements

Before proceeding with the installation, it is necessary to do the following:

• Install Microsoft SQL Server 2017/2019 on the database server

• Configure the SMTP Server to relay email to the email server while using FOIAXpress PAL. The SMTP server must be configured to relay e-mail messages to other domains

• Before installing the FOIAXpress PAL database, make sure SQL Server collation is configured for case-insensitive

• Confirm that the application server is set to the same time zone as the organization. This ensures that incoming PAL requests are correctly dated

The installation package must be deployed from the application server, which must meet the requirements outlined below:

FOIAXpress PAL Database Account Requirements

There are three accounts which must provisioned to configure the application, database, and repository servers. The table below outlines the type of accounts, their purpose, and their requirements.

Install SQL Server Module

Follow the steps below to install the SQL Server Module on the application server:

1. Navigate to the following link: https://www.powershellgallery.com/packages/Sqlserver/21.1.18256

2. Under Installation Options, select Manual Download:

1. Click Download the raw nupk file. The SQLserver .nupkg file downloads.

2. Locate the downloaded "SQLserver” file, then right click it and select Properties.

3. On the General tab, select Unblock, then click Apply.

4. Next, edit the “SQLserver” file extension from .nupkg to .zip.

5. Extract the .zip package in the downloaded location. After the folder is extracted, remove

“sqlserver.” from the folder name:

6. Navigate to C:\ProgramFiles\WindowsPowerShell\Modules and create a folder called

SqlServer.

7. Copy the renamed .zip folder from the downloaded location to the SqlServer folder created in the previous step (C:\ProgramFiles\WindowsPowerShell\Modules\SqlServer)

Enabling Windows Search Service

Windows Search Service allows users to perform search operations on the server. This service is required to perform content searches on documents located in the PAL Reading Room.

NOTES: Administrators are not be able to install windows search services if the indexing service is installed on the server. They must uninstall the indexing service then install the windows search service.

This service must be enabled on the application server.

Follow the steps below to enable Windows Search Service:

1. Click Start > Server Manager. The Server Manager application appears

2. Click Add roles and features. The Add Roles and Features Wizard pop up window appears

3. Click Next. The Select installation type window appears

4. Select Role-based or Feature-based installation using the radio buttons

5. Click Next. The Select Destination Server pop up window appears

6. Select a server or a virtual hard disk using the radio buttons

7. Click Next. The Select server roles pop up window appears

8. Click Features from the left-hand menu, then select Windows Search Service

9. Click Next. The Confirm installation selections pop up window appears

10. Click Install to start the installation process. The Installation progress pop up window appears

11. The installation process begins. This may take a few moments. After the installation completes a confirmation window appears

12. Click Close to exit the Add Roles Wizard.

Enable TIFF files in Windows Search Service

TIFF is a file format for storing images. TIFF files are not enabled for search by default; therefore, you must enable the Windows TIFF IFilter feature in order to search TIFF files.

1. Click Start > Server Manager. The Server Manager application launches, as shown below

2. Click Add roles and features. The Add Roles and Features Wizard pop up window appears

3. Click Next

4. Select Role-based or feature-based installation

5. Click Next

6. Select from the available options

7. Click Next

8. Select Features

9. Select Windows TIFF IFilter

10. Click Next.

11. Click Install

12. The installation process continues. This may take a few minutes. On conclusion, an installation confirmation appears:

13. Click Close to exit the Add Roles Wizard

Enable PDF in Windows Search Service

PDF files are not enabled for search by default; you must install the Adobe PDF IFilter feature to search PDF files. Follow the steps below to enable PDF in Windows Search Service.

1. Download and install Adobe PDF IFilter 9 from the following link: ftp://ftp.adobe.com/pub/adobe/acrobat/win/9.x/

2. Restart the Windows Search Service after installing Adobe PDF IFilter 9/11

   1. Click Start > Administrative Tools > Services. The Services application launches

   2. Scroll down and select Windows Search

3. Click Action > Restart. The Service Control pop up window appears

4. Select File > Exit to close the Services application

5. Click Start > Control Panel > Indexing Options. The Indexing Options pop up window appears

6. Click Modify to add the Reading Room root folder

7. Add the electronic reading room root path to the included locations (e.g. C:\PALRepo\AFXWERR\):

8. Click Advanced. The Advanced Options pop up window appears

9. Click the Rebuild button located in the Troubleshooting section. The Rebuild Index pop up window appears

10. Click OK. The Indexing Options window changes to display the rebuild progress. This may take several minutes to complete. Once the rebuild is completed, the Indexing Options window will indicate the total number of items rebuilt

11. Click Close to exit the Indexing Options feature

12. Close the Control Panel window

Download the Installation Package

The FOIAXpress installation package contains the files needed to install FOIAXpress PAL. Contact Casepoint support at support@Casepointtech.com for your installation package.

After downloading the package, follow the steps below to unzip the file:

1. Locate the downloaded .zip file, then right click it and select Properties

2. On the General tab, select Unblock, then click Apply

3. Next, unzip the contents of the folder. The contents of the package appear as shown in the following example

Verify the Integrity of the Installation Package

Steps to verify the integrity of the installation package.

1. Open Windows Powershell ISE

2. Use the command below to verify the integrity of installation package

Test-FileCatalog -CatalogFilePath "<<catalog file path(with extension of .cat) from downloaded artifact>>" -Path "<< folder that should be validated against the catalog file >>"

3. It will show as valid, as shown in the following example

About the Installation Package

There are two primary files you’ll interact with during installation:

PAL Installation Prerequisites

1. Inputs.json: Drives the installation of the FOIAXpress system components. The file is in a standard json format and needs to remain a valid json file for successful installation

2. Install.ps1: The executable file you will run to deploy the installation package with the parameters configured in the Inputs.json file

Inputs.Json Settings for New Installations

About the Inputs.json File

The Inputs.json file located in the root directory of the extracted deployment package zip file drives the installation of the different components of the FOIAXpress PAL system. The file is in a standard json format and needs to remain a valid json file post updates prior to the installation.

The settings are grouped into sections, each addressing settings which may or may not require configuration, depending on your specific installation. The following subsections in this chapter describe each section of the Inputs.json file.

The parent node is the ‘inputs’ section. This section appears as follows:

Each section has parameters you can adjust to configure your installation. An example section is shown below, with an explanation for how it works:

Each (1) Section (“InstallType” in this example) includes various (2) Settings (“New” in this

example) to configure.

For each (A) Setting (“Upgrade” here), you can edit the (B) text in quotations (“N” here to indicate “No”) to configure the settings for your installation. This might include adding a file path, user name, password, or simply a “Y” or “N” depending on the field you are configuring.

The first section under the parent node is the Install Type. See the following section for details on configuring your install type, with the remaining sections following in the order they appear in the Inputs file.

Install Type

Use the “InstallType” section to determine if this is a new installation, or an upgrade for an

existing system:

Install Components

The “Components” section allows you to determine which components to include with this installation. To include a component with your installation, be sure to assign the component a “Y” value on the corresponding line.:

Application and Scheduler

The “APPANDSCHEDULER” section has settings related to the FOIAXpress PAL application and scheduler installations. A value must be set for all values in this section to successfully install the application:

NOTE: Any files paths specified must have two backslashes where a path in windows explorer requires a single backslash.

Database Settings

The “DB” section contains the settings for installing or upgrading your FOIAXpress PAL database. In case of a new installation, an agent account will be created.

Configuration Settings

Settings to configure the PAL Administration user details as well as the basic Organization details.

Inputs.json Settings for PAL Upgrade

This section discusses the inputs.json settings used when upgrading an existing FX PAL environment. For information on using the inputs.json file, see the About the Inputs.json File section of this manual.

NOTE: Some fields that would be required for a new installation should be left as-is for an upgrade. It is important to not edit or remove these fields as this could compromise the integrity of the inputs.json file. These are described where appropriate in the following sections.

Install Type

Use the “InstallType” section to determine if this is a new installation, or an upgrade for an existing system:

Install Components

The “Components” section allows you to determine which components to include with this upgrade. To include a component with your upgrade, be sure to assign the component a “Y” value on the corresponding line:

Application and Scheduler

The “APPANDSCHEDULER” section only requires input in the InstallLocation and BackupLocation fields.

NOTE: All fields not listed above can remain as-is during an upgrade.

Database Settings

The “DB” section contains the settings for installing or upgrading your FOIAXpress database.

In case of a new installation, an agent account will be created.

NOTE: You do not need to edit the AgentAccount fields during an upgrade, these can remain as-is.

Configuration Settings

Settings to configure the PAL Administration user details as well as the basic Organization details.

NOTE: These fields can remain as-is during the upgrade.

Install PAL

Before you are ready to run the Install.ps1 file, review the steps below to verify you’ve

completed all the steps to this point:

• Make sure you have connectivity to the servers where the software is being installed

• Complete the procedures described in the PAL Installation Prerequisites section

• Download, verify, and extract the FOIAXpress PAL Installation package

• Configure the Inputs.json file for your installation

Once the above prerequisites are complete, follow the steps below to deploy the FOIAXpress PAL Installation package.

1. Open Windows Powershell ISE

2. Use PowerShell to navigate to the location where you extracted the installation package:

3. Type .\install.ps1 for either install or upgrade

4. If the inputs.json file is in same location as the extracted installation files, simply click enter to execute the installation. Alternatively, if you have file in different location provide this file location, then execute the script

Sync Service (PAL)

This section provides instructions to configure the FOIAXpress Sync Service (PAL) and permissions. This section is relevant only if PAL is installed on your Web server.

Public Module Database Server and Database Information

Notes

• Prior to configuring FOIAXpress Sync Service, ensure that the PAL Database has been created.

• The Download Document location is with respect to the FOIAXpress Sync Service only if you are using database configuration for your Sync Service. The configured user of the FOIAXpress Sync Service should have Full Control Security permissions on the Download Document location.

• The Download Document folder should be manually created on the local or remote system. Ensure that the FOIAXpress PAL application and the Download Document folder path (local or UNC) is accessible by the IIS user on the system where the FOIAXpress PAL application is installed. The path for the Download Document folder should be accessible by creating the virtual directory (DOWNLOADDOCUMENTS) on the FOIAXpress PAL application server.

• The Electronic Reading Room folder should be manually created on the local or remote system. Ensure that before the IIS user accesses the FOIAXpress PAL application, the Electronic Reading Room folder path (local or UNC) is accessible to the system on which the FOIAXpress PAL application is installed. The path for the Electronic Reading Room folder should be accessible by creating the virtual directory (ELECTRONICREADINGROOMDOCUMENTS) on the FOIAXpress PAL application server.

To configure FOIAXpress Sync Service, perform the following steps:

1. Select Start > All Programs > AINS FOIAXpress

2. Right-click FOIAXpress Sync Configuration and select Run as administrator

3. The Sync Service Configuration window will appear with the fields described in the table below based on the database server type (MS SQL Server) you configured earlier. Enter the required information and click Configure. The screen below uses MS SQL Server

Using the WebService to Connect to PAL

Using the WebService to connect to PAL does not require database access. However, you must configure the WebService in IIS to have a successful connection.

NOTE: The below steps should be taken on the server where PAL is configured.

1. Click Start > Administrative Tools > Internet Information Services (IIS) Manager

2. Expand Start Page > Sites > PALConfig and select the WebServices folder

3. Double-click Authentication in the middle pane and enable Windows Authentication

4. Click the WebServices folder on the Connections pane to return to the WebServices Home screen

5. Right-click the PALConfig node and select Edit Bindings

6. Add the HTTP Secure Socket Layer port assignment. Click Add. The Add Site Binding window appears

• 1. Select https from the Type dropdown menu

  2. Select the SSL Certificate provided in the drop-down list. For example, WMSvc-TW-AINSDOCSAX

• 3. Click OK to retain the settings or click Cancel to exit from the Site Bindings window

7. Add the SSL Certificate. If a certificate is not available in the SSL Certificate drop-down list:

• 1. Select the Start Page (name of the server)

  2. Click the Server Certificates option in the middle pane

• 1. Click Create Certificate Request in the Actions pane. For further instructions, go to http://technet.microsoft.com/en-us/library/cc732906.aspx

  2. Click Complete Certificate Request in the Actions pane. For further instructions, go to http://technet.microsoft.com/en-us/library/cc771816.aspx

8. Configure SSL Settings:

1. 1. Double-click SSL Settings

   2. Select the Require SSL checkbox

   3. Accept client certificates

   4. Click Apply in the Actions pane

9. Click the PALConfig node in the Connections pane to return to the home page

10. Click the Connect PAL Using WebService option on the FOIAXpress Sync Service Configuration window

NOTE: This should be done on the server where the FOIAXpress Sync Service is installed

11. Provide the PAL WebService URL in the URL field. For example: https://palserver/webservices/syncservice.svc.

NOTE: The palserver portion of the URL above needs to reflect your PAL server name.

12. Enter the Windows Login ID and Password for the PAL Server

12. Enter the required information, and click Configure

13. A confirmation message appears once the information is accepted. Click OK

FOIAXpress Failed Requests and Requesters

Within the FOIAXpress Sync. Service Configuration window, you can view the number of FOIAXpress failed requests and requesters, and Public Access Link failed requests and

requesters. Based on this information, you can take an appropriate action, such as retrying failed jobs. These fields are represented as links that will be enabled only when there are failed requesters and/or requests of FOIAXpress and/or PAL respectively. You must click the links on the bottom-left of the FOIAXpress Sync Service Configuration window in order to view the failed jobs.

1. After clicking the FOIAXpress Failed Requesters/Requests link the FOIAXpress Failed Requests window appears.

2. To retry the failed requests/requesters, select the checkbox for each job and click Retry.

Note: All failed jobs will be sent to the sync service.

3. To view the details of the failed jobs, select a job and click View or double-click the selected job

4. To export failed jobs to a log file, click Export Failed Jobs to Log

Public Access Link Failed Requests and Requesters

You must click the links on the bottom-right of the FOIAXpress Sync Service Configuration

window to view the failed jobs.

NOTE: The below screenshots show the Public Access Link Failed Requests screens, however, the Public Access Link Failed Requesters screens look very similar.

1. After clicking the Public Access Link Failed Requesters/Requests link, the Public Access Link Failed Requests window appears.

2. To retry the failed requests/requesters, select the checkbox for each job and click Retry. All failed jobs will be sent to the sync service

3. To view the details of the failed jobs, select an ID and click View or double-click the selected job

3. To export failed jobs to the log file, click Export Failed Jobs to Log

Required Privileges for FOIAXpress PAL Application Server

The following section lists the directories that are relevant to FOIAXpress PAL as well as the level of permissions that should be applied to these directories.

Required Permissions for Network Service User (ASP.NET Process Identity)

On a Web server running Microsoft Windows Server 2016/2019/2022 and Internet Information Services (IIS) 7.5/8/10, the ASP.NET process runs in the application pool for the Web application. FOIAXpress PAL setup will set the application pool identity as NETWORK SERVICE account by default.

The file and folder permissions listed in table below must have the ASP.NET Process Identity of FOIAXpress PAL Web application (Network Service User/configured impersonate user).

NOTE: If file repository folders (Download Documents and Electronic Reading Room document locations) are located on another server other than the FOIAXpress PAL application server, set the required security and sharing permissions for the FOIAXpress PAL application server account (network service user). Example: palserver$.

The File Repository folder located on the file server should have the Read and Write permissions for File Sharing and Full control for Security permissions. Please refer to the above screenshots to view the permissions.

FOIAXpress Sync Service Required Privileges

The following table shows which type of file and folder permissions the user must have to function properly.

Notes:

• The above specified Download Document Location and Electronic Reading Room Location should be the same as the location specified in the FOIAXpress Sync Service Configuration.

• The folders \AFXWDOFL and \AFXWERR are the FOIAXpress File Repository folders.

• The folder %SystemRoot% is the Microsoft Windows installation folder.