Novell Filr 1.1 Administration Guide

The Novell Filr 1.1 Administration Guide provides the following information for administering your administration information for Filr 1.1.

Section I, Changing Appliance Configuration Options

Section II, Setting Up the Filr Site before Users Log In

Section III, Maintaining the Filr Site

Section IV, Interoperability

Section V, Site Security

Section A.0, Troubleshooting the Filr System

Section B.0, Documentation Updates

Audience

This guide is intended for Novell Filr administrators.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation included with this product. Please use the comment on this topic link at the bottom of each page of the online documentation.

Documentation Updates

For the most recent version of the Novell Filr 1.1 Administration Guide and other documentation, visit the Novell Filr 1.1 Documentation website.

Additional Documentation

You can find more information in the Novell Filr documentation, which is accessible from the Novell Filr 1.1 Documentation website.

I Changing Appliance Configuration Options

Section 1.0, Configuring and Maintaining the Filr Appliance

Section 2.0, Configuring and Maintaining the Novell Appliance

1.0 Configuring and Maintaining the Filr Appliance

Before you perform any of the procedures in this section, you must do the initial configuration of the Filr appliance, as described in Configuring a Small Deployment for the First Time or Configuring a Large Deployment for the First Time, in the Novell Filr 1.1 Installation and Configuration Guide.

If you chose a small deployment, all vital configuration options to get the Filr system up and running were chosen for you during the initial configuration. You can change those options as discussed in this section.

If you chose a large deployment, most configuration options were chosen for you. You chose other configuration options during the initial configuration. You can change those options as discussed in this section. However, configuration options that are specific to the MySQL database appliance and the search index appliance must be reconfigured as described in Configuring and Maintaining the Search Index Appliance and Configuring and Maintaining the MySQL Database Appliance, in the Novell Filr 1.1 Installation and Configuration Guide.

Section 1.1, Changing Configuration Options for the Filr Appliance describes how to modify configuration options for the Filr appliance. Other sections in this chapter provide additional information for each configuration option.

Section 1.1, Changing Configuration Options for the Filr Appliance

Section 1.2, Network Configuration

Section 1.3, Net Folder Configuration

Section 1.4, Database Configuration

Section 1.5, Changing Your Search Index Configuration

Section 1.6, Language

Section 1.7, Changing Clustering Configuration Settings

Section 1.8, Changing Reverse Proxy Configuration Settings

Section 1.9, Changing Outbound Email Configuration Settings

Section 1.10, Changing Configuration Settings for Requests and Connections

Section 1.11, Changing the JVM Configuration Settings

Section 1.12, Changing WebDAV Authentication Configuration Settings

Section 1.13, Enabling Logging

Section 1.14, Viewing and Updating the Filr License

1.1 Changing Configuration Options for the Filr Appliance

Ensure that you have deployed the Novell Filr Appliance, as described in Configuring a Small Deployment for the First Time or Configuring a Large Deployment for the First Time, in the Novell Filr 1.1 Installation and Configuration Guide.

Navigate to the following URL:

https://ip_address:9443

Replace ip_address with the IP address of your Filr appliance.

Sign in to the Filr appliance using the root user and the default password that you specified during the appliance installation.

The Novell Filr Appliance landing page is displayed.

Click the Filr Server Configuration icon.

The Configuration page is displayed.

In the Configuration column on the left side of the page, select the setting that you want to configure.

The following configuration options are available. Click each option below for detailed information.

Network (Section 1.2, Network Configuration)

Net Folders (Section 1.3, Net Folder Configuration)

Database (Section 1.4, Database Configuration)

Search Appliance (Section 1.5, Changing Your Search Index Configuration)

Default Locale (Section 1.6, Language)

Clustering (Section 1.7, Changing Clustering Configuration Settings)

Reverse Proxy (Section 1.8.3, Changing Reverse Proxy Configuration Settings)

Outbound Email (Section 1.9.2, Changing Outbound Email Configuration Settings)

Requests and Connections (Section 1.10, Changing Configuration Settings for Requests and Connections)

JVM Settings (Section 1.11, Changing the JVM Configuration Settings)

WebDAV Authentication (Section 1.12.2, Changing the WebDAV Authentication Configuration Settings)

Logging (Section 1.13, Enabling Logging)

License (Section 1.14, Viewing and Updating the Filr License)

Make any configuration changes, then click OK.

Click Reconfigure Filr Server for your changes to take effect.

NOTE:This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

1.2 Network Configuration

Section 1.2.1, Changing the Network Configuration Settings

Section 1.2.2, Port Numbers

1.2.1 Changing the Network Configuration Settings

The default port that is configured when you install the Filr appliance is 8443. After the initial configuration of the Filr appliance (as described in Configuring a Small Deployment for the First Time or Configuring a Large Deployment for the First Time, in the Novell Filr 1.1 Installation and Configuration Guide), you can make any necessary network changes.

To modify network configuration options:

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration options:

Port Redirection: Select this option to have Filr automatically redirect from ports 80 or 443 (which are the standard ports for Web browsers) to ports 8080 and 8443 (which are the default ports that Filr listens on). Enabling port redirection in this way allows users to specify the Filr site URL without including the port number. If port redirection is not enabled, users must include the port number in the site URL when accessing the Filr site.

IMPORTANT:When port redirection is enabled, ensure that the reverse proxy ports are set to 80 for the HTTP port and to 443 for the secure HTTP port. If they are not, URLs that are sent with Filr email notifications will continue to have the default port (8443) in them.

For information about how to change the reverse proxy ports, see Section 1.8, Changing Reverse Proxy Configuration Settings.

HTTP Port: The default HTTP port is 8080. As a best practice, do not change this from the default port.

Select Enabled if you want to enable the HTTP port. By default, only the Secure HTTP port is enabled.

Select Force Secure Connection to force users to connect to Filr over a secure connection (HTTPS).

See Section 1.2.2, Port Numbers for more information about port numbers in Filr.

Secure HTTP Port: The default secure HTTP port for Filr is 8443. As a best practice, do not change this from the default.

See Section 1.2.2, Port Numbers for more information about port numbers in Filr.

Session Timeout: By default, if a user’s Novell Filr session is idle for four hours (240 minutes), Filr logs the idle user out. For increased convenience to Filr users, you can make the session timeout interval longer. For increased security for your Filr site, you can make the session timeout shorter.

Keystore File: Leave this field blank.

Click OK, then click Reconfigure Filr Server for your changes to take effect.

NOTE:This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

1.2.2 Port Numbers

Table 1-1 lists the ports that you need to take into consideration when setting up Filr. Figure 1-1 is a graphical representation of how some of the ports are used in a Filr deployment.

As a best practice, do not change any port numbers from the default ports.

Table 1-1 Filr Port Numbers

Port Numbers

Description

80, 443

Standard Web server ports

For more information, see HTTP Port:, Secure HTTP Port: and HTTP/HTTPS Ports When You Use NetIQ Access Manager with Filr.

8080, 8443

Default Tomcat ports for the Filr appliance

When you install Filr, Tomcat is installed along with the Filr software. Filr uses Tomcat as a stand-alone web server for delivering data to Filr users in their web browsers. For more information about Tomcat, see the Apache Tomcat Web site.

For more information, see HTTP Port:, Secure HTTP Port: and HTTP/HTTPS Ports When You Use NetIQ Access Manager with Filr.

9090, 9443

Jetty port for the appliance (Administrator Interface)

9080

Apache/HTTPD port

8005

Default shutdown port

For an explanation of the shutdown port, see Tomcat - Shutdown Port.

8009

Default AJP port

For an explanation of the Apache JServ Protocol port, see The AJP Connector.

22

SSH port for the appliance

111

rpcbind utility

1099

Java RMI port

4330

FAMT port

7380, 7443

Ganglia RRD-REST ports

8380, 8381

Default Jetty ports

8642, 8649, 8650, 8651, 8652

Ganglia web interface port

1199

Lucene RMI registry port

1188

Lucene server port

3306

MySQL outbound port

1433

Microsoft SQL server port

25, 465

SMTP and SMTPS outbound ports

524/tcp

Access OES server over NCP

137/tcp, 137/udp, 138/udp, 139/tcp, 445/tcp

Access servers over CIFS

11211

Used for memcached caching in an appliance cluster

636

Secure LDAP port

389

Non-secure LDAP port

Figure 1-1 Filr Port Usage

HTTP/HTTPS Ports When You Use NetIQ Access Manager with Filr

If you are fronting Filr with NetIQ Access Manager, ensure that you have configured the HTTP/HTTPS ports.

Configuring Filr in this way configures NetIQ Access Manager to access Filr over port 80, which is the standard port.

Port Configuration

Use the following port configuration when NetIQ Access Manager is fronting your Filr system on Linux:

HTTP Port: 80

Secure HTTP Port: 443

You need to make these configuration settings in the Reverse Proxy section. For more information, see Section 1.8, Changing Reverse Proxy Configuration Settings.

1.3 Net Folder Configuration

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration options:

The configuration options on this page affect only Full synchronizations. These settings do not affect Just-in-Time synchronizations. (For more information about the difference between Full and Just-in-Time synchronization, see Section 8.1.4, Planning the Synchronization Method.)

Allow Synchronization: Select this option to allow Full Synchronization for Net Folders on the appliance.

IMPORTANT:This setting must be selected for at least one Filr appliance in the cluster. If it is not, no full synchronizations can take place on the Filr system (either scheduled or manual synchronizations).

Max Simultaneous Syncs: Number of Net Folders that can be synchronized simultaneously. The default is 5.

Threads Per Sync: Number of threads that each synchronization can use. The default is 4.

For optimal performance, modify this value to be equal to the number of CPUs on the appliance, multiplied by 1.5. For example, if your appliance has 2 CPUs, change this value to 3.

The max value that you can set is the number of CPUs on the appliance multiplied by 3. For example, if your appliance has 2 CPUs, the max value is 6.

Click OK, then click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

For information about how to set up Net Folders for your Filr site, see Section 8.0, Setting Up Net Folders.

1.4 Database Configuration

Section 1.4.1, Understanding Database Configuration

Section 1.4.2, Changing Database Configuration Settings

Section 1.4.3, Database Type

Section 1.4.4, Database Location in a Small Deployment

Section 1.4.5, Database Credentials

1.4.1 Understanding Database Configuration

Novell Filr database disk space requirements are relatively modest. Files that are imported into Filr are saved in the Filr file repository.

The Filr database is primarily used for storing the following information:

Structural information about folders and files

Identification information about folders and files (for example, titles, descriptions, dates of creation/modification, and users associated with creation/modification)

User profile information (for example, full name, phone number, and email address)

1.4.2 Changing Database Configuration Settings

Changing the Database Configuration Settings for a Small Installation

Changing the Database Configuration Settings for a Large Installation

Changing the Database Configuration Settings for a Small Installation

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration options:

Database Type: Filr uses a MySQL database in a small installation. You cannot use another type of database.

Host Name or IP Address: Host name or IP address of the MySQL appliance if MySQL is not running on the Filr appliance. In a small installation, this is localhost.

Port: The JDBC URL also includes the port number on which Filr can communicate with the database server. The default port number for MySQL is 3306. Use this port number unless it is already in use by another process on the database server.

User Name: The user name for your MySQL database. For more information, see Section 1.4.5, Database Credentials.

User Password: The password for your MySQL database. For more information, see Section 1.4.5, Database Credentials.

Click OK, then click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

Changing the Database Configuration Settings for a Large Installation

If your Filr site is configured for a large installation, it is recommended that you use your organization’s existing MySQL or Microsoft SQL database as the Filr database.

Alternatively, you can use the MySQL database appliance that ships with Filr as the Filr database. You modify the configuration settings of the MySQL database appliance as described in Configuring and Maintaining the MySQL Database Appliance in the Novell Filr 1.1 Installation and Configuration Guide.

1.4.3 Database Type

Filr can be configured to use a MySQL or Microsoft SQL database in a large deployment. In a small deployment, Filr uses a MySQL database.

1.4.4 Database Location in a Small Deployment

When you install a single virtual appliance for a small deployment, all components are on the same appliance. This is the preferable location for a small deployment. The default database name is filr.

Database Server

Default Location

MySQL

/vastorage/mysql

1.4.5 Database Credentials

The MySQL database defaults to root for the administrative user name.

IMPORTANT:The MySQL root user name is not the same as the Linux root user on a Linux appliance.

1.5 Changing Your Search Index Configuration

Section 1.5.1, Understanding Indexing

Section 1.5.2, Changing Search Index Configuration Settings

Section 1.5.3, Running the Search Index As Its Own Appliance

Section 1.5.4, Running Multiple Search Indexes

1.5.1 Understanding Indexing

The search index is responsible for indexing all data on the Filr site so that Filr users can easily use the Search feature to retrieve the information that they need. Text posted in file metadata (such as a file description) is easy to index, because the formatting is simple. However, text within a file itself arrives in many different file formats, many of which require conversion before the text in the files can be indexed. Therefore, the search index is dependent on the available file conversion technology in order to perform its indexing function. For information about the file viewers that Filr uses, see File Viewer Information in the Novell Filr 1.1 Installation and Configuration Guide.

The search index provides additional services on your Filr site in addition to indexing. In fact, you cannot access your Filr site if the search index is not running. For this reason, Novell Filr provides multi-server configuration options.

1.5.2 Changing Search Index Configuration Settings

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration options for the Lucene search index:

Configuration Type: Select from the following configuration types:

Local: This is the default configuration type for a small Filr deployment, when the Lucene search index, the MySQL database, and the Filr software are running on the same virtual machine.

Server: Select this option in a large Filr deployment when only one Lucene search index is running as a stand-alone appliance.

High Availability: Select this option in a large Filr deployment when two Lucene search indexes are running as stand-alone appliances.

For a high availability Lucene search index deployment:

Specify a user name and password for the Lucene service. This user name and password applies to all Lucene search indexes in the system:

Lucene User Name: (This option must be set in the configuration for both Server and High Availability Lucene configurations.) Specify Lucene Service in the User Name field.

Lucene User Password: (This option must be set in the configuration for both Server and High Availability Lucene configurations.) Specify the password for the Lucene user.

Click Add, specify the information for the first Lucene index appliance, then click OK.

Click Add, specify the information for the second Lucene index appliance, then click OK.

Name: Specify a name for the Lucene search index appliance. (This option is visible only when Configuration Type is set to High Availability.)

In a clustered Filr deployment with multiple Filr appliances, the name that you specify for a specific search index node must be the same for that same node on each Filr appliance in the cluster. For example, if from one Filr appliance you give Search Index Node A (which has the DNS name of filr.mycompany.com) the name filr_index1, then you must give Search Index Node A this same name (filr_index1) from each of the Filr appliances in the cluster.

Description: Specify a short description for the Lucene appliance. (This option is visible only when Configuration Type is set to High Availability.)

Host Name: This is localhost if your Configuration Type is Local. If your Configuration Type is Server or High Availability, use this field to specify the host name or IP address of the appliance where the search indexes are running. (If your Configuration Type is High Availability, click Add to configure multiple search indexes.)

RMI Port: When the search index is running as its own appliance, it communicates with Filr by using the RMI port. (Default 1199.) (See Remote Method Invocation.) In a clustered environment where you are running multiple search index servers, ensure that each Lucene index server is running on the same ports. Novell recommends that you do not change this port from the default of 1199.

Lucene User Name: (This option must be set in the configuration for both Server and High Availability Lucene configurations.) Specify Lucene Service in the User Name field.

Lucene User Password: (This option must be set in the configuration for both Server and High Availability Lucene configurations.) Specify the password for the Lucene user.

Click OK, then click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

If your Filr site is configured for a large installation (your search index is a stand-alone appliance), you can make additional configuration settings for your Lucene search index appliance, as described in Configuring and Maintaining the Search Index Appliance in the Novell Filr 1.1 Installation and Configuration Guide.

1.5.3 Running the Search Index As Its Own Appliance

If the search index requires more memory, disk space, or CPU resources than are available on the Novell Filr appliance in a small deployment, you should configure the search index to run as a separate appliance in a large deployment. For instructions, see Creating a Large Deployment in the Novell Filr 1.1 Installation and Configuration Guide.

1.5.4 Running Multiple Search Indexes

Because the availability of the index is critical to the functioning of the Novell Filr site, you can install multiple search indexes as multiple appliances to provide high availability. For instructions, see Installing the Search Index Appliance in the Novell Filr 1.1 Installation and Configuration Guide.

1.6 Language

The Novell Filr installation program runs in English only. When you install the Filr software, you can set the primary language to any of the following:

Chinese-Simplified

Chinese Traditional

Czech

Danish

Dutch

English

French

German

Hungarian

Italian

Japanese

Polish

Portuguese

Russian

Spanish

Swedish

Some languages have an additional distinction by locale (the country where the language is spoken).

The language you select during installation establishes the language of the global text that displays in locations where all Filr users see it, such as in the Workspace tree when you click the Workspace tree icon :

The language you select also establishes the default interface language and locale for creating new user profiles.

1.7 Changing Clustering Configuration Settings

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration options:

Enable Clustered Environment: Select this option to enable clustering.

JVM Route: If you plan to use Apache as the reverse proxy, add a JVM route for each filr Appliance in the Cluster. Otherwise, you can leave the JVM Route field empty. The purpose of this field is to uniquely identify each Filr Appliance to Apache.

In the JVM Route field, specify worker1. On the second Filr node, in the JVM Route field, specify worker2, and so forth for each Filr node, incrementing the JVM Route setting. Each Tomcat instance should have a unique JVM Route setting.

worker1, worker2, and so forth are the default names for the matching values used for the reverse proxy configuration. For example, if you have set up Apache or IIS as a reverse proxy, these are the default values. The JVM Route setting in the Filr installer must match these values.

Hibernate Caching Provider: memcached is the only option available when configuring Filr in a clustered environment.

For more information about Memcached caching, see Memcached.

Server Address: Each Filr server in the cluster must list all of the Lucene servers (hostname or IP address) in the cluster, with each server separated by a space. For example, lucene_hostname1 lucene_hostname2.

Changes made to one Filr node are immediately visible in other Filr nodes.

Click OK, then click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

1.8 Changing Reverse Proxy Configuration Settings

Section 1.8.1, Understanding Reverse Proxy and NetIQ Access Manager

Section 1.8.2, Understanding How Port Redirection Affects Reverse Proxy Settings

Section 1.8.3, Changing Reverse Proxy Configuration Settings

Section 1.8.4, Bypassing NetIQ Access Manager to Log In to Filr and Perform Administrative Tasks

You might need to modify the reverse proxy configuration settings for your Filr appliance for either of the following reasons:

When you configure a reverse proxy server, such as NetIQ Access Manager

For more information about this scenario, see Section 1.8.1, Understanding Reverse Proxy and NetIQ Access Manager.

If you have enabled port redirection in your network settings page (as described in Section 1.2.1, Changing the Network Configuration Settings)

For more information about this scenario, see Section 1.8.2, Understanding How Port Redirection Affects Reverse Proxy Settings.

1.8.1 Understanding Reverse Proxy and NetIQ Access Manager

NetIQ Access Manager can provide secure single sign-on access to your Novell Filr site by functioning as a reverse proxy server. When using Access Manager with Novell Filr, Access Manager 3.1 SP1 IR1 is required and is an additional add-on product. You can download the required version of Access Manager from the NetIQ Downloads site.

For background information about setting up NetIQ Access Manager 3.1, see the Access Manager 3.1 Documentation website. For instructions specific to Filr, see Section 12.1, Configuring a Protected Resource for a Novell Filr Server.

After you have configured NetIQ Access Manager, you must configure your Filr site with the IP address of one or more Access Gateway servers and with the logout URL. When you configure the Filr site to use the Access Gateway, the IP addresses that you specify are the only locations from which the Filr site accepts logins. The logout URL is the location where users find themselves when they log out of the Filr site.

When you enable the Access Gateway for use with your Filr site, all Filr users must log in through the Access Gateway. It is not possible to set up the Filr site so that some users log in through the Access Gateway and some do not.

1.8.2 Understanding How Port Redirection Affects Reverse Proxy Settings

If you have enabled the reverse proxy settings in Filr (as described in Section 1.2.1, Changing the Network Configuration Settings) and you have an additional reverse web proxy such as NetIQ Access Manager that is servicing Filr requests, ensure that the ports that the additional proxy connects to are the same as the ports that are configured in the Filr reverse proxy settings. (This is the Reverse Proxy HTTP port and the Reverse Proxy Secure HTTP Port.)

The reverse proxy HTTP port should be set to 80, and the reverse proxy secure HTTP port should be set to 443. If the reverse proxy ports are not correct, links that are sent from Filr in email notifications are incorrect, and users are not able to access Filr.

This issue is described in Section A.2, Email Notification URLs Are Not Working.

1.8.3 Changing Reverse Proxy Configuration Settings

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration options:

Host: The host name is used to build some of the URLs that are sent in notifications. It should reflect the host used to access the Filr system from any user (either an internal or external user). It is common across all the Filr Virtual Appliances, and represents the reverse proxy or L4 device that fronts the Filr Virtual Appliance.

If Access Manager is being used to front Filr, specify the NetIQ Access Manager published DNS name for Filr application in the Host field.

Reverse Proxy HTTP Port: Select Enabled if you want to use a non-secure port for the reverse proxy. Specify the port number that you want to use. You must use port 80 if you have enabled port redirection in your network settings page.

Reverse Proxy Secure HTTP Port: Specify the port number that you want to use for the secure reverse proxy HTTP port. You must use port 443 if you have enabled port redirection in your network settings page. (Port redirection allows users to access the Filr site without specifying the port number in the URL. For information about port redirection, see Section 2.2, Changing Network Settings.)

Enable Access Gateway: Select this option to enable the reverse proxy Access Gateway.

Access Gateway address(es): Specify the IP address of the Access Gateway that is used for the connection to the Filr server. You must specify the IP address; host names are not supported.

If the Access Gateway is part of a cluster, add the IP address for each cluster member. Wildcards such as 164.99.*.* are allowed.

IMPORTANT:When you specify specific IP addresses in this option, Filr access is allowed only from the specified addresses. Also, if Authorization header credentials are not present or are incorrect, the user is prompted for login using Basic Authentication.

Logout URL: Specify the URL of the published DNS name of the reverse proxy that you have specified for the ESP, plus /AGLogout.

You can find the domain used for the ESP by editing the LAG/MAG cluster configuration and then clicking Reverse Proxy / Authentication.

For example, if the published DNS name of the proxy service that you have specified for the ESP is esp.yoursite.com, specify the following URL:

https://esp.yoursite.com/AGLogout

Click OK, then click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

1.8.4 Bypassing NetIQ Access Manager to Log In to Filr and Perform Administrative Tasks

To perform administrative tasks on your Filr system, you need to log in to bypass NetIQ Access Manager and log in to Filr directly as the Filr administrator.

To allow administrator access to the Filr system when your Filr system is fronted by Access Manager:

Add another IP address to the Access Gateway address(es) field, as described in Section 1.8.3, Changing Reverse Proxy Configuration Settings.

Click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

Access this IP address that you added in Step 1 at port 8443. For example, 172.17.2.3:8443.

1.9 Changing Outbound Email Configuration Settings

Section 1.9.1, Understanding Outbound Email

Section 1.9.2, Changing Outbound Email Configuration Settings

Section 1.9.3, Outbound Email Protocol

Section 1.9.4, Outbound Email Host

Section 1.9.5, Outbound Email Authentication

1.9.1 Understanding Outbound Email

Your Novell Filr site can be configured to send outbound email through an existing email system or through the included Postfix SMTP outbound mail server. The following activities generate email from the Filr site:

Filr users can subscribe to email notifications, so that they automatically receive a message whenever content of interest changes. For more information, see Subscribing to a Folder or File in Getting Informed in the Novell Filr 1.1 Web Application User Guide.

Filr users can configure folders that they own to send email notifications to other users. For more information, see Configuring Folders to Send Email Notifications to Other Users in the Novell Filr 1.1 Web Application User Guide.

Filr users can send email messages to folder contributors, as described in Sending an Email to Folder Contributors in the Novell Filr 1.1 Web Application User Guide.

Filr users can send notifications when a folder of file is shared, as described in Sharing Files and Folders in the Novell Filr 1.1 Web Application User Guide.

After installation, outbound email can be disabled and enabled again on the Filr site, as described in Section 5.0, Configuring Email Integration. However, you must configure outbound email in the Filr appliance.

1.9.2 Changing Outbound Email Configuration Settings

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration options:

Use Local Postfix Mail Server: Select this option to use the Postfix mail server, which is the default mail system included with Filr. To use another mail system (such as GroupWise), deselect this option, then specify the appropriate information for the protocol, host, and port of the mail system that you want to use.

Protocol: Select the type of protocol your email system uses. For more information, see Section 1.9.3, Outbound Email Protocol.

Host: Specify the hostname of your SMTP mail server. For more information, see Section 1.9.4, Outbound Email Host.

Port: The port through which Filr can connect to the SMTP mail server. The default SMTP port of 25 is typically appropriate, unless the SMTP mail server requires port 465 or 587 for SMTPS connections.

Time Zone: Select the time zone that you want Filr to use when sending email messages. When the Filr site sends email notifications for scheduled events, the messages are time-stamped according to the time zone you specify here during installation. This setting allows you to use a time zone for email notifications that is different from the time zone where the server is located. For more information, see Section 1.9.4, Outbound Email Host.

User Name: Specify an email address to be used when sending outbound email. Many SMTP mail hosts require a valid email address before they establish the SMTP connection.

This user name is used to authenticate to the email server (if required), and is used as the From component of email notifications that are sent from Filr.

For more information, see Section 1.9.5, Outbound Email Authentication.

Password: Specify a password for the user name. Some email systems also require a password. Some do not. If authentication is required, you should also provide a password. For more information, see Section 1.9.5, Outbound Email Authentication.

Authentication required: Select this option to require authentication.

Allow sending email to all users: Select this option to allow users to send email to the All Users group.

By default, this functionality is not enabled. On a very large Filr site, when a user sends a message to all Filr users, a very large number of email messages is generated.

Force HTTPS links: Select this option for all links contained in outbound email messages to be secure HTTP (HTTPS) instead of HTTP.

If this option is not selected, links contained in outbound email messages match the way that the user who sends the email connects to the Filr site: if the user connects via HTTP, links are HTTP. If the user connects via HTTPS, links are HTTPS.

Enable STARTTLS: Select this option to enable STARTTLS on the Filr system. Depending on how your email application is configured, you might need to configure Filr outbound email with TLS over SMTP for secure email. Novell GroupWise, for example, can be configured to require this. If you are using GroupWise or another email application that requires this type of configuration, you can configure Filr with TLS over SMTP by enabling STARTTLS.

From email address override: Specify the email address that you want to appear in the From address for messages sent from the Filr site.

Use from email address override for all outbound email: Select this option to always use the address that you specified in the From email address override field for messages sent from Filr. (For more information about the activities that generate email from Filr, see Section 1.9.1, Understanding Outbound Email.)

If this option is not selected and there is an email address in the From email address override field, the email address is used only in messages that Filr sends out as a result of a subscription (either when you subscribe to receive email notifications about a file or folder, or another user subscribes you to receive notifications).

Connection Timeout (in seconds): Specify the amount of time before the connection times out.

Click OK, then click Reconfigure Filr Server for your changes to take effect.

NOTE:This stops and restarts your Filr server. As this results in server downtime, you should restart the server at off-peak hours.

1.9.3 Outbound Email Protocol

Email systems communicate by using SMTP (Simple Mail Transfer Protocol). You need to determine whether the email system that you want your Filr site to communicate with is using SMTP or SMTPS (secure SMTP).

For GroupWise, you can check how the Internet Agent is configured:

In ConsoleOne, browse to and right-click the Internet Agent object, then click Properties.

Click GroupWise > Network Address.

In the SMTP field, if the SSL column displays Disabled, GroupWise is using SMTP. If the SSL column displays Enabled, GroupWise is using SMTPS.

Click Cancel to close the Network Address page.

If the email system requires SMTPS, see Section 29.3, Securing Email Transfer.

1.9.4 Outbound Email Host

In order to send messages to your email system, Filr needs to know the host name of your SMTP mail server.

The default SMTP port of 25 is typically appropriate, unless the SMTP mail server requires port 465 or 587 for SMTPS connections.

If you are using GroupWise, this is the host name of a server where the Internet Agent is running. GroupWise always uses port 25, even when SSL is enabled.

When the Filr site sends email notifications for scheduled events, the messages are time-stamped according to the time zone you specify here during installation. This setting allows you to use a time zone for email notifications that is different from the time zone where the server is located. The time zone list is grouped first by continent or region, optionally by country or state, and lastly by city. Common selections for United States time zones:

Time Zone

Continent/City

Pacific Time

America/Los Angeles

Mountain Time

America/Denver

Central Time

America/Chicago

Eastern Time

America/New York

1.9.5 Outbound Email Authentication

Many SMTP mail hosts require a valid email address before they establish the SMTP connection. Some email systems can construct a valid email address if you specify only a valid user name; other email systems require that you specify the full email address for successful authentication. You should provide a user name (email address) to ensure a successful connection. Email notifications from the Filr system are sent using this email address in the From field.

Some email systems also require a password. If authentication is required, you should also provide a password.

Consider the following tips when using GroupWise or Exchange:

GroupWise

Exchange

GroupWise

If you are using Novell GroupWise, the GroupWise Internet Agent does not require authentication in order to receive inbound messages. However, the /forceinboundauth startup switch is available for use in the Internet Agent startup file (gwia.cfg) to configure the Internet Agent to refuse SMTP connections where a valid email user name and password are not provided. The Internet Agent can accept just the user name or the full email address.

Exchange

If you are using Microsoft Exchange and you set up the outbound email server to require authentication (by selecting the option Authentication Required), Exchange must be configured to allow the From address to be different from the user who is configured for Exchange authentication. The Exchange permission that you need to add is ms-Exch-SMTP-Accept-Any-Sender.

This is required because Exchange, by default, enforces that the From address of outbound emails match the exchange user who you configured for authentication, and many emails that are sent from Filr use the From address of the Filr user who is performing an action.

1.10 Changing Configuration Settings for Requests and Connections

You can configure the number of client requests and database connections that Filr is able to support.

If you have an extremely large Filr site and you need to make numerous client requests and database connections, you might see improved performance by increasing these settings.

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration options:

Max Threads: The maximum number of simultaneous client request threads that Filr is able to support. The default is 250 threads.

Max Active: The maximum number of database connections that can be allocated from this pool at the same time. The default is 300.

Max Idle: The maximum number of database connections that can be idle in this pool at the same time. The default is 300 connections.

Scheduler Threads: The size of thread pool used for background execution of scheduled tasks. The default is 20.

Max REST Requests (upload/download): This is the max number of concurrent upload and download requests made by the Filr desktop and mobile applications. Specifying a max number of concurrent REST requests ensures that the Filr server does not exceed capacity. If the max number is reached and requests continue to be made, the server responds to requests when it is no longer busy. The default is 50.

Click OK, then click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

1.11 Changing the JVM Configuration Settings

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration options:

JVM Min Heap Size: The default JVM minimum heap size is 5 GB. You can increase or decrease this value as needed.

JVM Max Heap Size: The default JVM minimum heap size is 5 GB. You can increase or decrease this value as needed.

The values for the JVM heap size must end with g or m, and cannot contain fractional values. For example, if you want your JVM minimum heap size to be 1.5 GB, you must specify 1536m.

Allow generation of a system dump on a user signal: Select this option to configure Filr to generate a system dump in addition to a heap dump and java core dump at the time a dump is triggered on a user signal.

This can be useful when troubleshooting issues with your Filr system. However, a system dump takes more time and the files consume more disk space than a heap dump or java core dump.

Java Home: Displays the path to the JavaHome variable. This cannot be changed.

Click OK, then click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

1.12 Changing WebDAV Authentication Configuration Settings

Section 1.12.1, Understanding WebDAV

Section 1.12.2, Changing the WebDAV Authentication Configuration Settings

Section 1.12.3, Choosing the WebDAV Authentication Method

1.12.1 Understanding WebDAV

WebDAV is a standard collaborative editing and file management protocol. Novell Filr relies on the WebDAV protocol for Edit-in-Place to use tools such as OpenOffice and Microsoft Office to edit documents on the Filr site.

IMPORTANT:When Filr users are running Windows 7 as the client operating system, various issues can be introduced because of WebDAV limitations in Windows 7. If your Filr users are using the Windows 7 operating system, see Section 15.0, Configuring Filr to Support WebDAV on Windows 7.

1.12.2 Changing the WebDAV Authentication Configuration Settings

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

You can modify the following configuration option:

WebDAV authentication method: Select either Basic or Digest. The WebDAV authentication method determines how user credentials are passed from Filr to the WebDAV server. For more information, see Section 1.12.3, Choosing the WebDAV Authentication Method.

Click OK, then click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

1.12.3 Choosing the WebDAV Authentication Method

The WebDAV authentication method determines how user credentials are passed from Filr to the WebDAV server. Filr supports two types of WebDAV authentication methods:

Choosing Basic Authentication

Choosing Digest Authentication

Choosing Basic Authentication

Basic authentication encodes the user name and password with the Base64 algorithm. The Base64-encoded string is unsafe if transmitted over HTTP, and therefore should be combined with SSL/TLS (HTTPS).

Digest authentication is the default. Do not select Basic authentication unless there is a specific reason for doing so.

Choosing Digest Authentication

Digest authentication applies MD5 cryptographic, one-way hashing with nonce values to a password before sending it over the network. This option is safer than Basic authentication when used over HTTP.

Select this type of authentication when client users are using Windows 7 as their operating system and Microsoft Office as their text editor.

1.13 Enabling Logging

You can enable logging on the appliance. This is useful for debugging issues with your Filr system.

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

On the License page, the Current License Information section displays information about your current Filr license, including the date it was issued and the number of days from the issue date that the license is valid.

Select Enable host access logging.

Click Reconfigure Filr Server for your changes to take effect.

This stops and restarts your Filr server. Because this results in server downtime, you should restart the server at off-peak hours.

1.14 Viewing and Updating the Filr License

You can view information about your current Filr license, as well as update your Filr license.

Filr ships with a 60-day evaluation license. You need to update this license to a full product license.

IMPORTANT:If you are running Filr in a clustered environment, you must update the license for each Filr appliance in the cluster.

The database and search index appliances do not require a license.

Follow the steps in Section 1.1, Changing Configuration Options for the Filr Appliance.

On the License page, the Current License Information section displays information about your current Filr license, including the date it was issued and the number of days from the issue date that the license is valid.

To update your Filr license:

In the Update License section, browse to and select a new valid license-key.xml file that you have previously downloaded to your workstation.

You can obtain a new valid license key from the Novell Customer Center (NCC).

Reconfigure the Filr server by clicking the Reconfigure Filr Server button that appears in the Configuration column.

2.0 Configuring and Maintaining the Novell Appliance

The Novell Appliance is the operating system that the Filr, MySQL, and search index applications run on. You might need to change certain configuration settings for the Novell Appliance, such as administrative passwords to the appliance, network settings, and certificate settings.

Section 2.1, Changing Administrative Passwords

Section 2.2, Changing Network Settings

Section 2.3, Changing Time Configuration

Section 2.4, Replacing the Self-Signed Digital Certificate for an Official Certificate

Section 2.5, Managing Certificates

Section 2.6, Changing the Ganglia Configuration

Section 2.7, Changing System Services Configuration

Section 2.8, Viewing the Firewall Configuration

Section 2.9, Managing Support Configuration Files

Section 2.10, Managing Field Test Patches

Section 2.11, Managing Memcached (Search Index Appliance Only)

Section 2.12, Managing Storage

Section 2.13, Modifying Logging Options

Section 2.14, Shutting Down and Restarting the Novell Appliance

2.1 Changing Administrative Passwords

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Administrative Passwords.

Specify new passwords for the root and vaadmin administrators.

If you are changing the root password, you must first specify the current root password.

(Optional) Select or deselect Allow root access to SSH. When this option is selected, the root user is able to SSH to the appliance. If this option is not selected, only the vaadmin user can SSH to the appliance.

SSH is disabled by default. For information about how to start SSH on the appliance, see Section 2.7, Changing System Services Configuration.

Click OK.

2.2 Changing Network Settings

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Network.

In the DNS Configuration section, you can modify the name servers, search domains, and gateway settings for your Novell appliance network.

If the Search Domains field is left blank, it is auto-populated with the domain of the appliance hostname. For example, if the hostname of the appliance is filr.mycompany.com, the domain is auto-populated with mycompany.com.

In the NIC Configuration section, you can modify the IP address, hostname, and network mask of any Network Interface Controller (NIC) associated with the appliance. (If you configured multiple NICs for the Filr appliance, you can configure the additional NICs.)

In the NIC Configuration section, click the ID of the NIC.

Edit the IP address, hostname, or network mask.

If you change the IP address, you must restart the appliance in order for the change to be reflected

Click OK.

(Optional) In the Appliance Administration UI (port 9443) Access Restrictions section, specify the IP address of any networks for which you want to allow access to the Filr site. Leave this section blank to allow any network to access the Filr site.

Click OK.

2.3 Changing Time Configuration

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Time.

As necessary, change the following time configuration options:

NTP Server: Specify the NTP server that you want to use for time synchronization.

Region: Select the region where your Novell Appliance is located.

Time Zone: Select the time zone where your Novell Appliance is located.

Click OK.

2.4 Replacing the Self-Signed Digital Certificate for an Official Certificate

The Novell Appliance ships with a self-signed digital certificate. Instead of using this self-signed certificate, you should use a trusted server certificate that is signed by a trusted certificate authority (CA) such as VeriSign or Equifax.

The certificate works for both the Novell Appliance and the Filr software (ports 9443 and 8443). You do not need to update your certificate when you update the Filr software.

Complete the following sections to change the digital certificate for your Novell Appliance. You can use the digital certificate tool to create your own certificate and then have it signed by a CA, or you can use an existing certificate and key pair if you have one that you want to use.

NOTE:If you are using a Godaddy SSL certificate with Filr, follow the steps in Godaddy SSL Certificates for Filr at the Novell Cool Solutions website.

Section 2.4.1, Using the Digital Certificate Tool

Section 2.4.2, Using an Existing Certificate and Key Pair

Section 2.4.3, Activating the Certificate

2.4.1 Using the Digital Certificate Tool

Creating a New Self-Signed Certificate

Getting Your Certificate Officially Signed

Creating a New Self-Signed Certificate

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Digital Certificates.

In the Key Store drop-down list, ensure that Web Application Certificates is selected.

Click File > New Certificate (Key Pair), then specify the following information:

Alias: Specify a name that you want to use to identify and manage this certificate.

Validity (days): Specify how long you want the certificate to remain valid.

Key Algorithm: Select either RSA or DSA.

Key Size: Select the desired key size.

Signature Algorithm: Select the desired signature algorithm.

Common Name (CN): This must match the server name in the URL in order for browsers to accept the certificate for SSL communication.

Organizational Unit (OU): (Optional) Small organization name, such as a department or division. For example, Purchasing.

Organization (O): (Optional) Large organization name. For example, Novell, Inc.

City or Lacality (L): (Optional) City name. For example, Provo.

State or Province (ST): (Optional) State or province name. For example, Utah.

Two-letter Country Code (C): (Optional) Two-letter country code. For example, US.

Click OK to create the certificate.

After the certificate is created, it is self-signed.

Make the certificate official, as described in Getting Your Certificate Officially Signed.

Getting Your Certificate Officially Signed

On the Digital Certificates page, select the certificate that you just created, then click File > Certificate Requests > Generate CSR.

Complete the process of emailing your digital certificate to a certificate authority (CA), such as Verisign.

The CA takes your Certificate Signing Request (CSR) and generates an official certificate based on the information in the CSR. The CA then mails the new certificate and certificate chain back to you.

After you have received the official certificate and certificate chain from the CA:

Revisit the Digital Certificates page by clicking Digital Certificates from the Novell Appliance.

Click File > Import > Trusted Certificate. Browse to the trusted certificate chain that you received from the CA, then click OK.

Select the self-signed certificate, then click File > Certification Request > Import CA Reply.

Browse to and upload the official certificate to be used to update the certificate information.

On the Digital Certificates page, the name in the Issuer column for your certificate changes to the name of the CA that stamped your certificate.

Activate the certificate, as described in Section 2.4.3, Activating the Certificate.

2.4.2 Using an Existing Certificate and Key Pair

When you use an existing certificate and key pair, use a .P12 key pair format.

Go to the Digital Certificates page by clicking Digital Certificates from the Novell Appliance.

Click File > Import > Trusted Certificate. Browse to and select your existing certificate, then click OK.

Click File > Import > Trusted Certificate. Browse to your existing certificate chain for the certificate that you selected in Step 2, then click OK.

Click File > Import > Key Pair, then browse to and select your .P12 key pair file, specify your password if needed, then click OK.

Because of a browser compatibility issue with HTML 5, the path to the certificate is sometimes shown as c:\fakepath. This does not adversely affect the import process.

Continue with Section 2.4.3, Activating the Certificate.

2.4.3 Activating the Certificate

On the Digital Certificates page, select the certificate that you want to make active, click Set as Active, then click Yes.

Verify that the certificate and the certificate chain were created correctly by selecting the certificate and clicking View Info.

2.5 Managing Certificates

All certificates that are included with the IBM Java package that is bundled with the version of SLES that Filr ships with are installed when you install Filr.

Filr uses only the certificates that relate to LDAP and SMTP.

You can use the Digital Certificates tool on the Filr appliance to remove certificates that are not used by your organization if you are concerned about keeping them.

Also, you can use the Digital Certificates tool on the Filr appliance to maintain the certificate store by removing certificates that have expired and then installing new certificates as needed, according to your organization’s security policies.

To access the Digital Certificates tool:

Click Digital Certificates from the Novell Appliance.

2.6 Changing the Ganglia Configuration

Ganglia is a scalable, distributed monitoring system that allows you to gather important information about your Filr system.

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Ganglia Configuration.

As necessary, change the following Ganglia configuration options:

Enable Full Monitoring Services: Select this option to receive and store metrics from other appliances, and to allow the Ganglia Web Interface to run on the same machine as the Filr appliance.

You might want to disable Ganglia monitoring by deselecting this option if:

You already have a monitoring system that you plan to use for Filr.

You plan to configure a dedicated appliance for viewing monitoring information. (You do this by selecting Unicast below and then specifying the DNS name or IP address of the appliance where monitoring information will be collected.)

Enable monitoring on this appliance: Select this option to enable Ganglia monitoring on this appliance.

Multicast: Select this option to send monitoring information to other appliances on the network.

Unicast: (Recommended) Select this option to send monitoring information to a single destination.

Unicast mode is recommended for improving performance of the Filr system.

Publish to: Specify the URL where Ganglia sends monitoring information when it is running in Unicast mode.

(Optional) Click Reset Database to remove all existing Ganglia metrics from this appliance.

This option is not related to the Filr database.

Click OK.

For more information about how to use Ganglia monitoring with Filr, see Section 26.1, Monitoring Filr Performance with Ganglia.

2.7 Changing System Services Configuration

The following system services are available on the Novell appliance, depending on which appliance you are accessing.

Filr Appliance

SSH: This is the SSH service that is running on the appliance.

Novell Filr: This is the Filr service that is running on the appliance. Click Download to access the appserver.log and catalina.out files.

Jetty: This is the Jetty service that is running on the appliance. Click Download to access the jetty.stderrout.out file.

Postfix: This is the Postfix SMTP outbound mail server. This allows email to be sent from the Filr site, as described in Section 1.9.1, Understanding Outbound Email. Click Download to access the mail file.

Novell FAMT: This is the Novell FAMT service that allows communication between Filr and the external OES, Windows, or NetWare file system. Click Download to access the famtd.log file.

MySQL: This is the MySQL service that is running on the appliance. Click Download to access the mysqld.log file.

The MySQL service runs on the Filr appliance in a small deployment, and on the MySQL appliance in a large deployment.

Lucene Search Index Appliance

SSH: This is the SSH service that is running on the appliance.

Jetty: This is the Jetty service that is running on the appliance. Click Download to access the jetty.stderrout.out file.

Search: Click Download to access the indexserver.log file

Memcached: Click Download to access the jetty.stderrout.out file.

In Filr 1.1 and later, Memcached runs on the Lucene search index appliance. When updating to Filr 1.1, it is recommended that you move Memcached from the Filr appliance to the Lucene search index appliance, as described in Moving the Memcached Service to the Search Index Appliance in the Novell Filr 1.1 Installation and Configuration Guide.

MySQL Database Appliance

SSH: This is the SSH service that is running on the appliance.

Jetty: This is the Jetty service that is running on the appliance. Click Download to access the jetty.stderrout.out file.

MySQL: This is the MySQL service that is running on the appliance. Click Download to access the mysqld.log file.

This section describes the kinds of actions you can perform in regards to these services.

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click System Services.

You can perform various actions for system services:

Section 2.7.1, Starting, Stopping, or Restarting System Services

Section 2.7.2, Making System Services Automatic or Manual

Section 2.7.3, Downloading Log Files for System Services

2.7.1 Starting, Stopping, or Restarting System Services

You might want to start, stop, or restart a service. For example, you can start SSH so that you can remote into the appliance without using a VMware client.

Select the service that you want to start, stop, or restart.

Click Action, then click Start, Stop, or Restart.

Click Close to exit System Services.

2.7.2 Making System Services Automatic or Manual

Select the service that you want to make automatic or manual.

Click Action, then click Set as Automatic, or Set as Manual.

2.7.3 Downloading Log Files for System Services

In the Log Files column of the table, click the download link for the service for which you want to view log files.

The following files are available for each service:

SSH: N/A

Novell Filr: catalina.out, appserver.log (Filr appliance)

The catalina.out file reports all timestamps in UTC/GMT.

Jetty: jetty.stderrout.log (Filr, Search, and MySQL database appliances)

Postfix: mail (Filr appliance)

Novell FAMT: famtd.log (Filr appliance)

Search: indexserver.log (Search appliance)

MySQL: mysqld.log (MySQL database appliance)

Memcached: jetty.stderrout.out (Search appliance)

Click Close to exit System Services.

2.8 Viewing the Firewall Configuration

You can view your current firewall configuration directly from the Filr appliance:

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Firewall.

Port numbers are listed with the current status of each port number. This page is not editable, but is for informational purposes.

For more information about port numbers in Filr, see Section 1.2.2, Port Numbers.

2.9 Managing Support Configuration Files

You can use the Novell appliance to upload configuration files to Novell Support via FTP, or to download the configuration files so that you can send them by an alternative method.

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Support.

Select Automatically send the configuration to Novell using FTP to automatically send your Filr system’s configuration information to Novell Support via FTP.

or

Select Download and save the configuration file locally, then send it to Novell manually to download your Filr system’s configuration information to your management workstation. You can then send the information to Novell Support using a method of your choice.

Click OK to complete the process.

2.10 Managing Field Test Patches

You can manage field test patches for the Filr appliance directly from the Novell appliance. You can install new patches, view currently installed patches, and uninstall patches.

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Field Test Patch.

(Optional) Install a new patch:

Before you can install a patch, you first need to download it from the Novell Support web site to your management workstation.

From the Field Test Patch page on the Novell appliance, click Browse.

Browse to and select the patch that you downloaded in Step 3.a.

Click Install Selected Patch.

(Optional) Uninstall a patch:

In the Patch Name column of the provided table, select the patch that you want to uninstall.

Click Uninstall Latest Patch.

2.11 Managing Memcached (Search Index Appliance Only)

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Memcached.

You can change the following configuration settings for Memcached:

Listen Interface: The URL that Memcached listens on.

Number of Threads: The number of threads to use when processing incoming requests.

Max Memory: Max memory that can be used by Memcached.

Max Simultaneous Connections: Specify the number of network connections that can be handled by memcached simultaneously.

2.12 Managing Storage

Filr provides native tools to allow you to expand the storage space for the /vastorage and /var partitions. (You should have already created partitions for /vastorage and /var, as described in the Novell Filr 1.1 Installation and Configuration Guide.)

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Storage.

Use the tools provided by your virtualization platform vendor to expand the virtual disks that contain the partitions your are expanding.

In the provided table, select the partitions to be expanded.

Click Expand partitions.

Appliance services are stopped, the selected partitions are expanded to the size of their respective disks, and appliance services are restarted.

If there are any Bash console sessions open on the appliance, close them before proceeding to Step 7.

Reboot the appliance so the operating system can detect the disks that have been expanded.

2.13 Modifying Logging Options

Filr system events are logged in the /var directory. Prior to Filr 1.1, the /var directory was located on the appliance boot partition. Because the /var directory can fill up with log files and cause the boot partition to grow, it is recommended that /var be located on a separate hard disk on the appliance.

To move the /var directory to a dedicated disk:

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Logging.

Specify the hard disk information for the /var directory:

Select disk: Select the hard disk where you want to place /var.

If you haven’t already, you need to create a dedicated hard disk for /var, as described in the Novell Filr 1.1 Installation and Configuration Guide.

File system type: Specify the type of file system.

Click OK.

2.14 Shutting Down and Restarting the Novell Appliance

You might need to shut down or restart the Novell appliance for maintenance.

Log in to the Novell appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Reboot or Shutdown.

II Setting Up the Filr Site before Users Log In

After you have installed and started Novell Filr, you need to perform several administrative tasks before your Filr site is ready for users to log in and start using Filr efficiently. Filr ships with most settings disabled by default, so you as the Filr administrator must enable each piece of functionality. This ensures that your data is not unknowingly exposed to users who do not normally have access to certain information. For example, users cannot share files until you give them the ability to do so.

Refer to the following sections to set up your Filr site:

Section 3.0, Logging In as the Filr Site Administrator

Section 4.0, Adding New Users to Your Filr Site

Section 5.0, Configuring Email Integration

Section 6.0, Setting Up Sharing

Section 7.0, Setting Up Personal Storage

Section 8.0, Setting Up Net Folders

Section 9.0, Creating Groups of Users

Section 10.0, Configuring User Access to the Filr Site

Section 11.0, Setting Up Site Branding

Section 12.0, Allowing Access to the Filr Site through NetIQ Access Manager

Section 13.0, Configuring Mobile Device Access to the Filr Site

Section 14.0, Configuring the Filr Desktop Application to Access Files

Section 15.0, Configuring Filr to Support WebDAV on Windows 7

Section 16.0, Managing Document HTML Conversions

Section 17.0, Managing a Multiple-Language Filr Site

3.0 Logging In as the Filr Site Administrator

After logging in to the Novell Filr site, you should reset the Filr administrator’s password.

Section 3.1, Logging In

Section 3.2, Resetting the Filr Administrator Password

Section 3.3, Creating Additional Filr Administrators

3.1 Logging In

After installing and configuring Filr, you need to log in to the Filr site to perform additional administrative tasks.

In your web browser, specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL; if you are using NetIQ Access Manager, the Filr login screen is not used. For more information about Filr configurations that affect login, see Section 2.2, Changing Network Settings.

Log in using admin as the login name and admin as the password.

The Change Password dialog box is automatically displayed when you first log in to the Filr site.

3.2 Resetting the Filr Administrator Password

When you first install Novell Filr, the Filr administrator user name is admin and the password is admin. When you first log in to the Filr site as the administrator, you should change the administrator password from the default password to a secure password of your own choosing.

In your Web browser, specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL; if you are using NetIQ Access Manager, the Filr login screen is not used. For more information about Filr configurations that affect login, see Section 2.2, Changing Network Settings.

Log in using admin as the login name and admin as the password.

The Change Password dialog box is automatically displayed when you first log in to the Filr site.

Change the default administrator password to a secure password.

In the Change Password dialog box, type the admin in the Current password field, then go to the New password and Confirm new password fields and specify a new password.

3.3 Creating Additional Filr Administrators

You might want to create additional Filr administrators just in case the primary Filr administrator is unable to access his or her account. Creating additional Filr administrators is a safe way to ensure that the right people are able to access the Filr site in an administrative capacity if the need arises.

Only the original (built-in) Filr administrator can add or remove site administrator rights for users and groups.

To minimize the time-consuming indexing of the Filr site, it is most effective to create a group that has administrative rights, then assign users to that group as needed.

Section 3.3.1, Assigning Administrative Rights to a User

Section 3.3.2, Assigning Administrative Rights to the Administration Group

3.3.1 Assigning Administrative Rights to a User

Log in to Filr as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Novell Teaming Log In page.

In the Management section, click Users.

Select the users for whom you want to grant administrator rights.

Click More > Add Administrator Rights.

To remove administrator rights from a user:

Select the users for whom you want to remove administrator rights.

Click More > Remove Administrator Rights.

3.3.2 Assigning Administrative Rights to the Administration Group

You can assign administrative rights to any group, or you can create an administrator group and assign rights only to that group, as described in Section 9.0, Creating Groups of Users.

To assign administrative rights to a group:

Log in to Filr as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Novell Teaming Log In page.

In the Management section, click Groups.

Select the groups for whom you want to grant administrator rights.

Click More > Add Administrator Rights.

To remove administrator rights from a group:

Select the groups for whom you want to remove administrator rights.

Click More > Remove Administrator Rights.

4.0 Adding New Users to Your Filr Site

You can add new users to your Filr site in any of the following ways:

Synchronizing from an LDAP directory, as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

Manually adding local users, as described in Section 18.2, Creating a New Local User.

Importing profile files for local users, as described in Section 18.8, Managing Local Users and Groups by Importing Profile Files.

5.0 Configuring Email Integration

Your Novell Filr site can be configured to send outbound email through an existing email system or through the included Postfix SMTP outbound mail server. Email from the Filr site is useful for the following activities:

Filr users can subscribe to email notifications, so that they automatically receive a message whenever content of interest changes. For more information, see Subscribing to a Folder or File in Getting Informed in the Novell Filr 1.1 Web Application User Guide.

Filr users can configure folders that they own to send email notifications to other users. For more information, see Configuring Folders to Send Email Notifications to Other Users in the Novell Filr 1.1 Web Application User Guide.

Filr users can send email messages to folder contributors, as described in Sending an Email to Folder Contributors in the Novell Filr 1.1 Web Application User Guide.

Filr users can send notifications when a folder or file is shared, as described in Sharing Files and Folders in the Novell Filr 1.1 Web Application User Guide.

Initial email configuration is performed when you install Novell Filr. Additional aspects of email handling are configured on the Filr site. For information about how to further configure email settings beyond what is covered in this section, see Section 23.0, Managing Email Configuration.

Section 5.1, Enabling/Disabling Outbound Emailing of Folder Digests

5.1 Enabling/Disabling Outbound Emailing of Folder Digests

During the configuration of the Filr appliance, you configured Novell Filr to communicate with your email system, as described in Section 1.9, Changing Outbound Email Configuration Settings. As a result, Filr users can send email messages to other Filr users and to anyone whose email address they know. They can also send email notifications when they create folders, add files, share files and folders, and so on.

In addition to this basic email functionality, you can configure your Filr site so that users can receive folder digests of site activity that are created and sent to the users who have subscribed to the folders. (For information about how users can subscribe to folders, see Subscribing to a Folder or File in the Novell Filr 1.1 Web Application User Guide.)

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL; if you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Novell Teaming Log In page.

Under System, click Email.

Select Enable Outgoing Email.

This option applies to all outgoing emails sent from the Filr system.

In the Default Digest Schedule section, adjust the schedule of digest notifications sent from the Filr system to meet the needs of the majority of your Filr users.

Users can receive digest notifications for folders when they subscribe to a folder (as described in Subscribing to a Folder or File in the Novell Filr 1.1 Web Application User Guide) or when someone configures folders to send notifications to others (as described in Configuring Folders to Send Email Notifications to Other Users in the Novell Filr 1.1 Web Application User Guide).

Users can turn the digests on and off for individual folders, but they cannot change the email schedule that you establish.

By default, folder digests are compiled and sent daily at fifteen minutes after midnight.

(Optional) To set a data quota on outgoing mail messages, specify the quota limit in the Maximum Size for the Sum of All File Attachments and the Maximum Size of Each File Attachment fields.

By default, there is no limit to the size of attached files. You can leave the fields blank to retain the default of no limit.

To restrict any attachments from being sent, specify 0 in each field.

Click Apply to save the settings, then click Close.

6.0 Setting Up Sharing

As the Filr administrator, you need to enable sharing privileges for users on your Filr site before users are able to share files and folders. There are various sharing privileges that you can grant.

Section 6.1, Understanding Sharing

Section 6.2, Enabling Users to Share

Section 6.3, Managing Shares

6.1 Understanding Sharing

Sharing in Filr enables users to grant access to files and folders to other users, either internal or external to the organization. You can enable users to share the following kinds of files and folders:

Files in users’ My Files areas. This includes files in users’ personal storage (if personal storage has been enabled, as described in Section 7.0, Setting Up Personal Storage) and in users’ Home directories.

Sharing of files and folders in the My Files area is enabled by default for all users after sharing is enabled for the site. You can disable sharing for files and folders in the My Files area on an individual user basis.

Files in Net Folders. Files in Net Folders are files that are synchronized to Filr from a corporate file system and that are located in the Net Folders tab in Filr.

Sharing of files in Net Folders is disabled by default after sharing is enabled for the site. You must enable sharing for each Net Folder and specify which users are allowed to share and what rights they have.

The ability to share folders from Net Folders is not available.

If multiple users share the same item with a single user, the user who receives the share is granted the highest level of access that was shared with the user. For example, User B shares a file with User A and grants User A Read rights to the file. Then User C shares the same file with User A and grants Read and Write rights to the file. As a result, User A has Read and Write rights to the file.

The following sections describe how sharing works in conjunction with Filr rights and file system rights. For more detailed information about how sharing works in Filr, see Sharing through Filr in the How Filr Works–Overview Guide.

Section 6.1.1, Users Can’t Grant Share Roles That They Don’t Have

Section 6.1.2, File System Rights Also Affect the Ability to Assign Share Roles

6.1.1 Users Can’t Grant Share Roles That They Don’t Have

Users with Contributor rights on folders can grant Viewer, Editor, and Contributor rights to other users as Filr system share and Net Folder share settings allow.

On the other hand, Users with Viewer rights on folders can only grant Viewer rights to other users with whom they are allowed to share.

6.1.2 File System Rights Also Affect the Ability to Assign Share Roles

Sharing of files and directories involves an additional layer that provides access and manages what those who are granted rights to share files can actually do.

For users to grant Viewer, Editor, or Contributor rights to another user, they must have the minimum rights that those roles require, as outlined in the following tables.

Table 6-1 NSS File System Rights Required for Assigning Filr Roles

Role

Minimum NSS Rights Required

Comments

Viewer

Read (R), File Scan (F)

These are the minimum file system trustee rights that users must have to view files and folders.

Editor

Read (R), Write (W), File Scan (F)

If the Write file system trustee right is added to Read and File Scan, users can then modify file content.

Contributor

Read (R), Write (W), Erase (E), Create (C), Modify, File Scan (F)

or

Supervisor

To perform contributor functions, users must either have all file system trustee rights to the file or folder (except for Access Control) or the Supervisor right to the file or folder.

The presence or absence of Access Control has no meaning in Filr because Filr cannot modify file system trustee rights. A Filr user with the Access Control right on the file system cannot grant file system access to another user through Filr.

It is true that Filr users with sufficient Filr permissions can share access to files and folders with other users, but this is a Filr function that leverages the file system rights of Net Folder proxy users. Access to shared files and folders is independent of any file system rights that individual users have or do not have.

Table 6-2 NTFS Permissions Required for Assigning Filr Roles

Role

Minimum NTFS Permissions Required

Comments

Viewer

Read, Read & Execute, List Folder Content

These are the minimum basic permissions that users must have in order to view files and folders. The default special permissions associated with these basic permissions are also required.

Editor

Read, Read & Execute, List Folder Content, Write

If the basic Write permission is added, users can then modify file content. The default special permissions associated with these basic permissions are also required.

Contributor

Read, Read & Execute, List Folder Content, Write, Modify

or

Full Control

To perform contributor functions, users must either have the basic Modify permission added or they must have the basic Full Control permission. The default special permissions associated with these basic permissions are also required.

6.2 Enabling Users to Share

IMPORTANT:You must enable the sharing feature before any sharing can take place on the Filr system. After you enable the sharing feature, all users by default are granted rights to share files in the My Files area (this includes files in the Home folder and files in personal storage). You can then refine sharing rights on a user basis and set up sharing on individual Net Folders.

When you enable the sharing feature, it is best to keep the share rights fairly unrestricted (for example, give the All Internal Users group the ability to share whatever they want). You can then restrict sharing of files in the My Files area on a per-user basis. In the Net Folder configuration, you can set the share rights to be more granular (for example, only Groups A and Groups B can share files from the Net Folder).

When you set up sharing for your Filr site, complete the necessary steps in the following order:

Set up sharing for the entire Filr site (as described in Section 6.2.1, Enabling Sharing for the Entire Site).

Configure sharing for individual users (as described in Section 6.2.2, Restricting Share Rights on a User Basis).

After you have enabled sharing for the entire Filr system, you can fine-tune share rights throughout the site on the user level.

For example, if you want only a few groups of users to be allowed to share with external users, you first need to enable sharing to external users at the site level. After you have enabled it at the site level, you can then remove this ability from the users who you do not want to have this ability.

Set up sharing for specific Net Folders (as described in Section 6.2.3, Enabling Sharing for Specific Net Folders).

Users who are given share rights on a specific Net Folder are able to share files within that Net Folder that they have rights to at least view on the file system.

Section 6.2.1, Enabling Sharing for the Entire Site

Section 6.2.2, Restricting Share Rights on a User Basis

Section 6.2.3, Enabling Sharing for Specific Net Folders

6.2.1 Enabling Sharing for the Entire Site

After you set up sharing for the entire Filr site, all users by default are granted rights to share files in the My Files area (this includes files in the Home folder and files in personal storage), with the site-wide access rights that you specify. If you want only certain users to be allowed to share files from their My Files area, you must enable sharing for the entire site as described in this section. Then you must restrict sharing privileges at the user level, as described in Section 6.2.2, Restricting Share Rights on a User Basis.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under System, click Share Settings.

The Share Settings page is displayed.

Select Allow all users to share with groups that have been imported from LDAP to enable users to share with LDAP groups.

If you select this option, groups that were imported from the LDAP directory are displayed in the Share with field when users are sharing an item (as described in Sharing Files and Folders in the Novell Filr 1.1 Web Application User Guide). All users in the LDAP group then have access to the item that was shared.

To enable sharing for all internal users on the Filr site, go to the User or Group field, begin typing All Internal Users, then select it when it appears in the drop-down list.

or

To enable sharing on a per-user or per-group basis, go to the Select user/group field, begin typing the name of the user or group for whom you want to grant share rights, then select the name when it appears in the drop-down list.

The Edit Share Rights dialog box is displayed. Select from the following options:

Re-share items: When users share a file or folder, they can give the users they are sharing with the ability to re-share the file or folder. The user receiving the share can share the file only if that user has been given administrative rights to share the file or folder.

IMPORTANT:When selecting this option, be aware that if one user's access rights to an item are removed, it does not remove the access rights of the user with whom the item was re-shared.

For example, suppose User A shares an item with User B and grants re-share rights. User B then shares the item with User C. If User A revokes User B's access rights to the item, User C continues to have access to the shared item.

Share with Internal users: Allows users to share items with internal users.

Share with “All Internal Users” group: Allows users to perform a mass share to all internal users by sharing with the All Internal Users group.

Share with External users: Allows users to share items with users external to the organization.

In addition to selecting this option, you might also want to allow external users to access the Filr site with an OpenID account (Google or Yahoo), as described in Section 10.1.2, Allowing Users to Access the Filr Site with Google and Yahoo Accounts (OpenID). If you do not allow this, external users must create a Filr user account in order to see items that have been shared with them.

Users external to the organization receive an email notification with a link to the shared item, and they can then log in to the Filr site. For more information, see Sharing with People Outside Your Organization in the Novell Filr 1.1 Web Application User Guide.

Share with Public: Allows users to make items publicly available. This means that anyone with the correct URL to the shared item can access the shared item without logging in to the Filr site.

In addition to selecting this option, you also need to enable Guest access to the Filr site if you want to allow users to share items with the public. For information about how to enable Guest access to the Filr site, see Section 10.1.1, Allowing Guest Access to Your Filr Site.

Share using Filr Link: Allows users to share a link to a file in Filr. Any user with the link can then access the file. However, the file is not displayed in the Public area, so users must have direct access to the link in order to access the file.

For more information about Filr Links, see Distributing a Link to a File in the Novell Filr 1.1 Web Application User Guide.

(Optional) Click the Whitelist / Blacklist tab to configure which email addresses and domains users can share with when sharing externally.

The following options are available when configuring a whitelist or blacklist for sharing:

No restrictions: Select this option to disregard any email addresses or domains that might already exist in the Email addresses and Domains fields. Selecting this option means that users can share with any email address.

Whitelist: Select this option to allow sharing only with email addresses and domains that have been specified in the Email addresses and Domains fields.

Blacklist: Select this option to disallow sharing with any email addresses and domains that have been specified in the Email addresses and Domains fields.

Email addresses: Click Add, specify the email address that you want to add to the whitelist or blacklist, then click OK.

Repeat this process to add multiple email address.

Domains: Click Add, specify the domain that you want to add to the whitelist or blacklist (for example, yahoo.com), then click OK.

Repeat this process to add multiple domains.

Delete shares that don’t meet the criteria: Select this option to delete all existing shares in the Filr system that do not match the criteria you set.

For example, if you selected Blacklist and then specified yahoo.com in the Domains field, selecting this option would delete all Filr shares made to Yahoo email addresses.

Click OK.

6.2.2 Restricting Share Rights on a User Basis

After you have enabled sharing of files for the entire Filr system (as described in Section 6.2.1, Enabling Sharing for the Entire Site), you can restrict share rights throughout the site on the user level.

You cannot grant individual users more rights than are currently defined for the site-wide setting.

To restrict share rights for specific users:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Users.

Select the users whose sharing rights you want to manage, then click More > Workspace Share Rights.

Select the radio button in the Clear column next to the sharing right that you want to remove from the user or group, then click OK.

or

If you have already removed a share right and you want to add it again, select the radio button in the Allow column next to the sharing right that you want to add to the user or group, then click OK.

6.2.3 Enabling Sharing for Specific Net Folders

Ensure that you have configured sharing as described in Section 6.2.1, Enabling Sharing for the Entire Site.

Configure sharing for the Net Folder as described in Section 8.4, Creating and Managing Net Folders or Section 8.8, Modifying Net Folder Connections (depending on whether the Net Folder has already been created).

6.3 Managing Shares

As the Filr administrator, you are in control of all shared items in the Filr system. You can view who has shared items, what items have been shared, what access rights have been granted via the share, and so forth. Furthermore, you can modify share rights for existing shares or delete existing shares.

You can manage shares through a management interface, where you can filter by user, file, folder, or all shares. Or, you can manage shares for individual folders and files as you encounter them in the Filr site.

Users are not notified about changes that you make to shared items.

Section 6.3.1, Managing Shares for the Filr Site

Section 6.3.2, Managing Individual Shares

6.3.1 Managing Shares for the Filr Site

You can manage all active shares in the Filr system with the Manage Shares dialog box in the administration console. You can filter shares by individual users, files, or folders. Or, you can view all active shares in the Filr system.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Manage Shares.

The Manage Shares dialog box is displayed.

In the Find share items by drop-down list, select one of the following options by which you want to manage shares:

User: Begin typing the name of a user in the User field, then select the user name when it appears in the drop-down list. All active shares from that user are displayed in the table.

File: Begin typing the name of a file in the File field, then select the file name when it appears in the drop-down list. All active shares associated with that file are displayed in the table.

Folder: Begin typing the name of a folder in the Folder field, then select the folder name when it appears in the drop-down list. All active shares associated with that folder are displayed in the table.

Find all shares: Displays all active shares in the Filr system.

(Optional) Change the access control settings, expiration date, and note for a shared item.

For more information about these options, see Sharing Files and Folders in the Novell Filr 1.1 Web Application User Guide.

(Optional) Remove a user or group’s access to a shared item by selecting the share that you want to remove, then clicking Delete.

Click OK.

6.3.2 Managing Individual Shares

As the administrator, you can manage shares for individual folders and files as you encounter them in the site.

In an area such as a Net Folder or in your Shared with Me area, select one or more files for which you want to manage sharing, then click More > Manage Shares.

The Manage Shares dialog box is displayed.

(Optional) Change the access control settings, expiration date, and note for a shared item.

For more information about these options, see Sharing Files and Folders in the Novell Filr 1.1 Web Application User Guide.

(Optional) Remove a user or group’s access to a shared item by selecting the share that you want to remove, then clicking Delete.

Click OK.

7.0 Setting Up Personal Storage

As the Filr administrator, you can enable or disable user access to personal storage. Personal storage includes all files and folders in the My Files area that are not associated with the user’s Home directory if they have one.

IMPORTANT:This setting affects only users whose accounts are synchronized to your Filr system via LDAP. Users who are created locally (as described in Section 18.2, Creating a New Local User) always have access to personal storage in the My Files area.

Guest users and external users never have access to personal storage in the My Files area.

Filr allows you to access, share, and collaborate on files that are in two key locations:

My Files: Users can upload files directly to the Filr site for personal use or to promote collaboration. Users can create folders to better organize files. For more information about how users can upload files, see Adding Files to a Folder in the Novell Filr 1.1 Web Application User Guide.

Files and folders that are located in a user’s My Files area are visible only to that user by default. Users can make files and folders available to others by sharing them, as described in Sharing Files and Foldersin the Novell Filr 1.1 Web Application User Guide.

Unlike Net Folders or Home folders, files in users’ personal storage in the My Files area are not synchronized from an external file system.

Files in Net Folders: Novell Filr gives users easy access to folders and files on the corporate file system. Corporate files can be files on a home drive, files on a mapped drive, or files on a remote server. Filr gives users seamless access to these files, regardless of their location. The corporate files that users have access to are defined by the Filr administrator.

In Filr, users access these corporate files by clicking Net Folders in the masthead. For more information about Net Folders, see the Novell Filr 1.1 Web Application User Guide.

You can enable or disable user access to personal storage (in the My Files area) for all users or for individual users:

Section 7.1, Understanding How Personal Storage Relates to Home Folders

Section 7.2, Enabling Personal Storage for All Users

Section 7.3, Enabling Personal Storage for Individual Users

Section 7.4, Enabling Personal Storage for Individual Groups

7.1 Understanding How Personal Storage Relates to Home Folders

Personal storage is a location in the My Files area where users can store files (files in personal storage are maintained on Filr servers; unlike Net Folders or Home folders, files in personal storage are not synchronized from an external file system). Personal storage is displayed differently depending on whether users have a Home folder enabled. If Home folders are enabled, the Home folder is displayed in each user’s My Files area. (For more information about Home folders in Filr, see Section 8.2, Configuring Home Folders for Display in the My Files Area.)

If Personal storage is enabled and Home folders are also enabled: The Home folder is displayed in the user’s My Files area at the same level of any other folder that the user decides to add to the My Files area.

If Personal storage is disabled and Home folders are enabled: The name of the Home folder is displayed at the top of the folder listing and the view lists only the content of the Home folder.

If Personal storage is enabled and Home folders are disabled: Only files that the user adds via one of the Filr clients are displayed in the My Files area.

If both Personal storage and Home folders are disabled: Users cannot see files or add files in the My Files area.

7.2 Enabling Personal Storage for All Users

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Personal Storage.

Select or deselect Allow LDAP users to have personal storage area, depending on whether you want users whose accounts are synchronized via LDAP to have access to the My Files area.

Click OK.

7.3 Enabling Personal Storage for Individual Users

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Users.

The Manage Users page is displayed.

Select the check boxes next to the names of the users for whom you want to enable personal storage, then click More > Enable Personal Storage.

If you have enabled personal storage for all users or for individual users, you can disable it for specific users.

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Users.

The Manage Users page is displayed.

Select the check boxes next to the names of the users for whom you want to disable personal storage, then click More > Disable Personal Storage.

To change individual users to use the global personal storage settings:

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Users.

The Manage Users page is displayed.

Select the check boxes next to the names of the users for whom you want to change personal storage settings to match the default global setting, then click More > Use Default Personal Storage Setting.

7.4 Enabling Personal Storage for Individual Groups

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Groups.

The Manage Groups page is displayed.

Select the check boxes next to the names of the groups for which you want to enable personal storage, then click More > Enable Personal Storage.

If you have enabled personal storage for all users, you can disable it for users in specific groups.

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Groups.

The Manage Groups page is displayed.

Select the check boxes next to the names of the groups for which you want to disable personal storage, then click More > Disable Personal Storage.

To change individual users to use the global personal storage settings:

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Groups.

The Manage Users page is displayed.

Select the check boxes next to the names of the groups for which you want to change personal storage settings to match the default global setting, then click More > Use Default Personal Storage Setting.

8.0 Setting Up Net Folders

Net Folders in Filr provide access to files on your corporate OES, NetWare, or Windows file servers by synchronizing file metadata. In essence, a Net Folder is simply a pointer or a reference to a specific folder on a specific file server.

Filr can be configured to index the content of Net Folders to make the content searchable.

IMPORTANT:Configuring Net Folders in a sub-optimal way can result in unsatisfactory performance of your Filr system. The ideal Net Folder configuration can vary greatly depending on the number of files that you want to synchronize to Filr, the frequency in which files are modified, and so forth. Before configuring Net Folders, become familiar with the various subtleties related to Net Folders, as described in Section 8.1, Planning Net Folder Creation.

The following video walks you through the Net Folder planning process:

http://www.youtube.com/watch?v=En7PtGcHffA

To see other Novell Filr videos, see the Novell Filr YouTube playlist.

The following sections describe the process for setting up and managing Net Folders:

Section 8.1, Planning Net Folder Creation

Section 8.2, Configuring Home Folders for Display in the My Files Area

Section 8.3, Configuring and Managing Net Folder Servers

Section 8.4, Creating and Managing Net Folders

Section 8.5, Setting Up Sharing for Net Folders

Section 8.6, Enabling Just-in-Time Synchronization

Section 8.7, Setting Global Net Folder Configuration Options

Section 8.8, Modifying Net Folder Connections

8.1 Planning Net Folder Creation

Section 8.1.1, Understanding Known Issues

Section 8.1.2, Planning the Net Folder Server Proxy User

Section 8.1.3, Planning Access and Sharing for Net Folders

Section 8.1.4, Planning the Synchronization Method

Section 8.1.5, Planning the Synchronization Schedule

Section 8.1.6, Planning a Clustered Filr System to Support Net Folder Synchronization

Section 8.1.7, Planning the Amount of Data to Synchronize

Section 8.1.8, Planning the Number of Net Folders

Section 8.1.9, Planning the Time Zone of the Filr Appliance to Match the Time Zone of any File Servers

8.1.1 Understanding Known Issues

Before you begin planning for and setting up Net Folders, ensure that you are aware of any known issues. For more information, see Net Folder Issues in the Novell Filr Readme.

8.1.2 Planning the Net Folder Server Proxy User

It is important that you understand the purpose, rights requirements, expected user name format, and character restrictions associated with the Net Folder Server proxy user before you configure a Net Folder Server.

Purpose of the Net Folder Server Proxy User

Rights Requirements for the Proxy User

Expected Name Format for File Servers

Special Character Restrictions in Proxy Names

Purpose of the Net Folder Server Proxy User

The Net Folder Server proxy user is used to read, write, create, and delete files on your corporate OES, Windows, or NetWare file servers on behalf of users who do not have native rights to the files, but have been granted rights via a Share in Filr.

For example, User A has native Read and Write access to a file on an OES server, and User B does not have any native access to that file. User A shares the file with User B in Filr and grants User B Read access. User B can now view the file within Filr because the Net Folder Server proxy user is giving User B the ability to read it, because of the Share. If User B tries to access the same file directly from the OES server, he does not have sufficient rights.

Users with native rights to files do not use the Net Folder Server proxy user.

The Net Folder Server proxy user is not the same as the LDAP proxy user used to synchronize users and groups (as described in Base DN:).

Rights Requirements for the Proxy User

The Net Folder Server proxy user that you specify here synchronizes volume objects and file objects. Ensure that this proxy user has rights to access the files and folders for the Net Folder that will be associated to the Net Folder server. Specifically, the Net Folder Server proxy user should have the rights shown in the following graphic:

Figure 8-1 Net Folder Server Proxy User Rights Requirements

Expected Name Format for File Servers

The expected format for the name of the Net Folder Server proxy user differs depending on whether the proxy user is accessing an OES, Windows, or NetWare file server. Only the following syntax is supported:

OES/NetWare: cn=admin,o=context

Windows: Administrator or cn=Administrator,cn=users,dc=domain,dc=com, domain\user, user@domain

IMPORTANT:When using Distributed File System (DFS) namespaces, the proxy user name format must be domain\user. For example, acme\administrator.

Special Character Restrictions in Proxy Names

Proxy names that contain special characters and/or spaces are not supported. For example, adminuser is supported, but @dm!n and admin user are not. Other special characters that are not supported in the proxy name are / \ [ ] : | = , + * ? < > @ ".

8.1.3 Planning Access and Sharing for Net Folders

It is important that you understand what to expect when configuring access rights for Net Folders. Furthermore, the access rights that you define on a Net Folder affect how items can be accessed by users who receive shares to items in the Net Folder.

Understanding Access Rights for Net Folders

Understanding Sharing Rights for Net Folders

Understanding Access Rights for Net Folders

When you configure a Net Folder, users who already have rights to files and folders on the file system rights are granted the same rights in Filr only when all of the following conditions are met:

The users are synchronized to the Filr system via the LDAP synchronization process (as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory).

If the users’ file system rights are contingent on membership in a particular group on the file system, those groups are also synchronized to the Filr system via the LDAP synchronization process (as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory).

The users are given access rights within the Net Folder, either individually or as part of a group in Filr (as described in Section 8.4, Creating and Managing Net Folders).

After you assign users rights to the Net Folder, users are granted the same level of access rights that they currently have on the file system.

If you assign users access rights within the Net Folder and those users do not already have file system rights, they are not able to see files and folders within the Net Folder.

Understanding Sharing Rights for Net Folders

Users Must Have File System Rights to Share from Filr

Users Do Not Need File System Rights to Receive a Share

Users Must Have File System Rights to Share from Filr

Users who share files from a Net Folder can grant Viewer, Editor, or Contributor access to the file, depending on their rights in the file system. For users to grant these rights to another user, they must have the minimum rights that those roles require, as outlined in the following tables.

Table 8-1 NSS File System Rights Required for Assigning Filr Roles

Role

Minimum NSS Rights Required

Comments

Viewer

Read (R), File Scan (F)

These are the minimum file system trustee rights that users must have to view files and folders.

Editor

Read (R), Write (W), File Scan (F)

If the Write file system trustee right is added to Read and File Scan, users can then modify file content.

Contributor

Read (R), Write (W), Erase (E), Create (C), Modify, File Scan (F)

or

Supervisor

To perform contributor functions, users must either have all file system trustee rights to the file or folder (except for Access Control) or the Supervisor right to the file or folder.

The presence or absence of Access Control has no meaning in Filr because Filr cannot modify file system trustee rights. A Filr user with the Access Control right on the file system cannot grant file system access to another user through Filr.

It is true that Filr users with sufficient Filr permissions can share access to files and folders with other users, but this is a Filr function that leverages the file system rights of Net Folder proxy users. Access to shared files and folders is independent of any file system rights that individual users have or do not have.

Table 8-2 NTFS Permissions Required for Assigning Filr Roles

Role

Minimum NTFS Permissions Required

Comments

Viewer

Read, Read & Execute, List Folder Content

These are the minimum basic permissions that users must have in order to view files and folders. The default special permissions associated with these basic permissions are also required.

Editor

Read, Read & Execute, List Folder Content, Write

If the basic Write permission is added, users can then modify file content. The default special permissions associated with these basic permissions are also required.

Contributor

Read, Read & Execute, List Folder Content, Write, Modify

or

Full Control

To perform contributor functions, users must either have the basic Modify permission added or they must have the basic Full Control permission. The default special permissions associated with these basic permissions are also required.

Users Do Not Need File System Rights to Receive a Share

Users who receive a share for a file on a Net Folder might or might not have file system rights to the shared file. Whether they have file system rights to the shared file affects how they can access the file in Filr. Users who do not have file system rights to a shared file can gain access to the file via the Net Folder Server proxy user. (For more information about the Net Folder proxy user, see Section 8.1.2, Planning the Net Folder Server Proxy User.)

Users can access shared items through the following methods from any of the Filr clients (web, desktop, or mobile), depending on their file system access rights:

From the Net Folders area (by navigating to the file): Only users who have file system rights to the shared item and who have been granted access to the Net Folder in Filr. (Users are granted access to a file either through a share or from being granted access by the Filr administrator.)

In the Shared with Me area: All users who receive a share.

8.1.4 Planning the Synchronization Method

When you synchronize files in Net Folders, only file metadata is synchronized. Whether the content of files is brought into Filr is determined by the index settings that you choose when creating a Net Folder, as described in Section 8.4, Creating and Managing Net Folders. Files must be synchronized before they can be indexed.

When you configure Net Folders, you have the option to use one or both of the available synchronization methods (Full synchronization or Just-in-Time synchronization). Depending on the nature of your data, it might make sense to use full synchronization on some of your Net Folders and to use Just-in-Time synchronization on other Net Folders. You might want to use a combination of both methods of synchronization for other Net Folders.

Full synchronization: Synchronizes all files from a given Net Folder either at a schedule that you specify or from a manual action. All files are examined for changes, and any changes are then synchronized.

This type of synchronization ensures that all files are synchronized; however, it is more time-consuming and resource-intensive than Just-in-Time synchronization.

For information about the time required to perform a full synchronization on a Net Folder, see Section 8.1.7, Planning the Amount of Data to Synchronize.

Just-in-Time synchronization: Synchronizes individual files at the time users access the files. Only files that are accessed are synchronized.

Just-in-Time synchronization is one method that you can use to synchronize files from Net Folders to be accessed in Filr. When you enable Just-in-Time synchronization, files are synchronized the moment users access them via the Filr Web application or via the Filr mobile app. This means that data users access through Filr is more accurate and that processes to make the data available are less resource-intensive. However, this also means that files cannot be indexed (and therefore are not returned in searches and are not available to be synchronized via the Filr desktop application) until after users access them for the first time from the Filr Web application or from the mobile app. (For more information, see Searchability of Data and Usage of the Filr Desktop Application.)

Just-in-Time synchronization provides two key benefits:

Allows you to make files available to your users without needing to wait for all files within a given Net Folder to synchronize. Only those files that users want access to are synchronized. A file is synchronized to Filr at the time the user accesses the file within Filr.

Users do not have to wait for files to synchronize based on the Net Folder synchronization schedule (which by default is every 15 minutes). If one user edits a file and saves it, another user who views the file only a few seconds later will see the recent change.

For more detailed information about Just-in-Time synchronization, as well as how to enable it, see Section 8.6, Enabling Just-in-Time Synchronization.

When you plan the type of synchronization method to use for a given Net Folder, consider the nature of the content you plan to synchronize and how you plan to use it after it is synchronized. Table 8-3 and the sections that follow describe which synchronization method is most suitable for certain types of content and the way you intend to use that content in Filr.

Table 8-3 Full Sync vs. Just-in-Time Sync

Static Content

Dynamic Content

Large Amounts of Data

Searchability of Data

Filr Desktop Application

Full Synchronization

X

X

X

Just-in-Time Synchronization

X

X

Static versus Dynamic Data

The Amount of Data

Searchability of Data

Usage of the Filr Desktop Application

Static versus Dynamic Data

Depending on whether your data never changes (static) or is constantly changing (dynamic) should influence the type of synchronization method that you implement for the Net Folder.

Full synchronization is more suited for static content, while Just-in-Time synchronization is more suited for dynamic content.

For example, a Net Folder that contains static files, such as medical records that are read-only, might be best synchronized to Filr by running one manual synchronization and disabling the scheduled synchronization as well as the Just-in-Time synchronization. The files could then be accessed via Filr without any unnecessary load being placed on the Filr system.

Conversely, a Net Folder that contains dynamic files that users actively collaborate on, such as marketing documents for a company’s current products, might be best synchronized to Filr by enabling Just-in-Time synchronization. Users would then always have the latest information when they access a file.

In some cases, you might want to enable both scheduled synchronization as well as Just-in-Time synchronization. In such cases, consider also the amount of data that is located on the Net Folder.

The Amount of Data

The amount of data on the Net Folder should influence the type of synchronization method that you implement, because of the system resources that are required to perform a scheduled synchronization. If a Net Folder contains a large amount of data, a scheduled synchronization might consume a large amount of system resources more frequently than is necessary.

If you have a large amount of data but still want the data to be searchable, you might consider running one full synchronization so that you can then index the data and then use Just-in-Time synchronization thereafter.

Searchability of Data

Whether you want data to be immediately searchable might influence the type of synchronization method that you implement for the Net Folder, because data cannot be indexed (and therefore is not returned in searches) until after the data is synchronized.

In a full synchronization, the synchronization process begins when you configure the Net Folder. In a Just-in-Time synchronization, the synchronization process begins on a per-file basis only after a user accesses a file for the first time. After a file is accessed for the first time, the file is synchronized and is then indexed.

NOTE:File indexing is disabled by default. You must enable file indexing for a given Net Folder if you want the files in the Net Folder to be searchable. You enable indexing during the creation of the Net Folder Server, as described in Section 8.3, Configuring and Managing Net Folder Servers, or during the creation of individual Net Folders, as described in Section 8.4, Creating and Managing Net Folders.

Usage of the Filr Desktop Application

The Filr desktop application triggers Just-in-Time synchronization only for the top-level folder that the user has chosen to synchronize (not the entire folder tree); it is triggered only when Personal Storage has been disabled. For all sub-folders, files must already be synchronized and accessible via the Filr web interface.

If your users are using the Filr desktop application, it is best to run one manual synchronization and/or enable the scheduled synchronization of the Net Folder or Net Folder Server. If you don’t, the Filr desktop application might not download all of the files in the Net Folder.

8.1.5 Planning the Synchronization Schedule

You can configure Net Folders and Net Folder Servers to be synchronized at a schedule that you specify.

Synchronization in this sense means that content is simply mirrored in Filr; it is not transferred from the remote file server for replication on the Filr storage. Only metadata such as the name, path, owner, trustees, and so forth is actually stored in Filr.

Consider the following when planning the synchronization schedule:

Synchronizations can be scheduled only if you have configured the Net Folder or Net Folder Server to perform full synchronization as the synchronization method (as described in Section 8.1.4, Planning the Synchronization Method).

When a schedule is configured on a Net Folder Server, all Net Folders associated with that Net Folder Server are synchronized on the same schedule. However, if you configure a separate synchronization schedule for an individual Net Folder, this schedule is used for synchronizing the Net Folder, instead of the Net Folder Server synchronization schedule.

When setting the synchronization schedule, be aware that the schedule that you choose can greatly affect system performance. Consider the information in Table 8-4, Net Folder Synchronization Example and avoid the following scenarios, which can cause your Filr system to be slow or sluggish:

You configure Net Folder synchronization schedules among various Net Folders and Net Folder Servers in such a way so that Filr is constantly synchronizing information.

A single synchronization schedule is so frequent that a new synchronization begins as soon as the previous one finishes.

HINT:If you have a Net Folder or Net Folder Server that contains hundreds of thousands of files, consider doing only one initial Full Synchronization (if you need all of the file content to be indexed and searchable), and using Just-in-Time synchronization as the ongoing synchronization process.

8.1.6 Planning a Clustered Filr System to Support Net Folder Synchronization

Performing a full synchronization on a Net Folder can consume a significant amount of resources on your Filr appliance. If you plan to synchronize thousands of files via Net Folders, you should configure a clustered Filr system that includes multiple Filr appliances.

In a clustered environment, it is a good idea to set aside a single Filr appliance to handle the load of any manual Net Folder synchronizations. (For information about how to perform a manual synchronization on a Net Folder, see Synchronizing a Net Folder.)

For more information about how to configure clustering, see Multi-Server (Clustered) Deployment in the Novell Filr 1.1 Installation and Configuration Guide.

For more information about how to set aside a Filr appliance, see Setting Aside a Filr Appliance for Re-Indexing and Net Folder Synchronization in a Clustered Environment in the Novell Filr 1.1 Installation and Configuration Guide.

8.1.7 Planning the Amount of Data to Synchronize

The time required to perform a full synchronization on a Net Folder varies depending on many factors, including the following:

The configuration of your Filr system (Large vs. Small vs. Clustered deployment)

The number of active users

Whether indexing is enabled (all file content is indexed and searchable, or only file metadata is synchronized)

The complexity and depth of the file server’s directory tree and the LDAP directory

Whether Just-in-Time synchronization is enabled

The database type (MySQL vs. Microsoft SQL)

The file server type (OES vs. Windows vs. NetWare)

The number of CPUs allocated to the Filr appliance

The amount of memory allocated to the Filr appliance

Net Folder Synchronization Example

The example in Table 8-4 illustrates the time required to synchronize files from five Net Folders in a large Filr deployment (one Filr appliance, one database appliance, and one search index appliance) with the following environment:

No indexing of content

No active users on the system

No Just-in-Time synchronization

100,000 files were synchronized

750 sub-directories in the file system

OES file system

MySQL database

Table 8-4 Net Folder Synchronization Example

Number of Files Synchronized per Second

Number of Files Synchronized per Minute

Number of Files Synchronized per Hour

Initial Synchronization:

196

11,760

705,600

Ongoing Synchronization:

952

57,120

3,427,200

8.1.8 Planning the Number of Net Folders

Unless only a small number of files exist in a volume or share on a file server, it is unwise to create a single Net Folder at the root of a volume or share. Instead, create multiple Net Folders. With multiple Net Folders created, you can be more flexible with the way you administer the Net Folders, such as the synchronization methods that you use and the rate at which you synchronize data.

For example, you can synchronize the Net Folders to Filr using different synchronization methods, depending on the nature of the data that each Net Folder contains. If the data in one Net Folder is static, you can perform a full synchronization on that Net Folder. You’re then free to perform a Just-in-Time synchronization on a different Net Folder that contains more dynamic data. (For more information about the types of synchronization methods, see Section 8.1.4, Planning the Synchronization Method.)

8.1.9 Planning the Time Zone of the Filr Appliance to Match the Time Zone of any File Servers

The Filr appliance and any file servers that the Filr appliance connects to via a Net Folder should be synchronized to the same time and to the same time zone. You configured the time zone of the Filr appliance during the appliance installation, as described in Installing the Filr Appliance in the Novell Filr 1.1 Installation and Configuration Guide.

If time zones are not synchronized in this way, users might see conflicting creation and modification times for files.

8.2 Configuring Home Folders for Display in the My Files Area

Most organizations using Open Enterprise Server (OES) or Windows will have user Home folders. If your organization has existing Home folders for users, the Net Folder Server will be discovered and created automatically when you provision users during the LDAP synchronization process. (For information about how to synchronize users via LDAP, see Section 18.1, Synchronizing Users and Groups from an LDAP Directory.) After the synchronization is complete, you are reminded to complete the Net Folder Server setup (by adding proxy credentials) when logging in to the Filr administration console.

If your organization does not currently leverage user Home folders on OES or Windows, you must first create a connection to your existing file system by creating a Net Folder Server. Then you can create a connection to specific volumes (on OES servers) and shares (on Windows servers) by creating a Net Folder.

Section 8.2.1, Configuring Home Folders

Section 8.2.2, Editing Home Folders for Individual Users

Section 8.2.3, Understanding How Home Folders Relates to Personal Storage

8.2.1 Configuring Home Folders

Prerequisites

Configuring Home Folders

Prerequisites

If you are using Active Directory, the Active Directory Home folder for users must be configured as if it were on a network folder, even if the Home folder is local to the server. It cannot be configured on a local path.

To change a user’s Home folder to be configured as a network folder:

In the Active Directory Administrative Center, access a user’s profile information.

In the Profile section, in the Home folder area, select Connect.

Select a drive in the drop-down list, then use the To field to specify the path to the local directory.

For example, \\172.17.2.3\HOME\jchavez

Configuring Home Folders

To configure Home Folders to be displayed in the My Files area:

Configure synchronization from your LDAP directory, as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

Configure the Net Folder Server, as described in Section 8.3, Configuring and Managing Net Folder Servers.

IMPORTANT:The Filr administrator must supply proper proxy account information for a Net Folder Server before any end user logs in to Filr. This is because Filr automatically creates each user’s Home folder using the appropriate Net Folder Server with its associated proxy user credentials when the user logs in for the first time. If you do not supply the proxy account information before the user logs in, the Home directories are not created correctly and the internal log files contain Null Pointer Exceptions.

Similarly, if the user Home folder is moved on the file system to a different volume or share or a different server, a new Net Folder Server is created and must be configured at the time the user logs in to Filr.

(Optional) Allow users to have files and folders in personal storage in the My Files area in addition to the Home folder.

Whether users are allowed to have files in personal storage in the My Files area affects how the Home folder is displayed in the My Files area. For more information, see Section 7.0, Setting Up Personal Storage.

NOTE:A user’s personal workspace (including the Home folder) is not displayed until the user has logged in to one of the Filr clients (web, mobile, or desktop) at least one time.

8.2.2 Editing Home Folders for Individual Users

After Home folders have been configured as described in Section 8.2.1, Configuring Home Folders, you can edit the Home folder settings for individual users:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click User Accounts.

Click the drop-down arrow next to the user whose properties you want to view, then click User Properties.

The User Properties page is displayed.

Click Edit Home Folder. (This option is displayed only if a Home folder has been configured for the user, as described in Section 8.2.1, Configuring Home Folders.)

Make any modifications to the configuration, synchronization schedule, and data synchronization settings.

For information about each option that you can modify for Net Folders, see Section 8.4, Creating and Managing Net Folders.

Click OK to save your changes.

8.2.3 Understanding How Home Folders Relates to Personal Storage

For information about how Home folders relate to Personal storage in Filr, see Section 7.1, Understanding How Personal Storage Relates to Home Folders.

8.3 Configuring and Managing Net Folder Servers

Section 8.3.1, Configuring Net Folder Servers

Section 8.3.2, Managing Net Folder Servers

8.3.1 Configuring Net Folder Servers

Net Folder Servers represent a physical OES, NetWare, or Windows file server. Net Folder Servers are connections to specific NSS volumes (on OES and NetWare servers) and shares (on Windows servers). You can set up multiple connections to each server as needed.

You can set up each Net Folder Server to synchronize on a schedule that you specify.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folder Servers.

The Manage Net Folder Servers page is displayed.

(Conditional) If the LDAP synchronization process for importing users contains at least one user who has a Home folder associated with them, a Net Folder Server is ready to be configured immediately after running the LDAP synchronization process. (For more information about LDAP synchronization in Filr, see Section 18.1, Synchronizing Users and Groups from an LDAP Directory.)

In the Name column, click the LDAP server name that you synchronized during the LDAP synchronization process, then skip to Step 6.

(Conditional) If the LDAP synchronization process for importing users does not contain at least one user who has a Home folder associated with them, you need to manually add a new Net Folder Server. Or, you can run the LDAP synchronization, as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

To manually add a new Net Folder Server, click Add.

Whether you are adding a new Net Folder Server or configuring one that is synchronized through LDAP, you now need to configure it or finish configuring it.

On the Configuration tab, specify the following information:

Name: Specify a name for this Net Folder Server

This is already populated if the search context of your LDAP sync contains an OES or Windows server.

Server type: The type of file server, whether OES, NetWare, or Windows.

Server path: The path to the NSS volume (OES or NetWare) Windows share, file server.

Windows: The server path must be entered using UNC syntax. For example, \\server_DNS\share

OES or NetWare: The server path must be entered using UNC syntax. For example, \\server_DNS\volume

The Server path field is already populated if the LDAP synchronization process for importing users contains at least one user who has a Home folder associated with them.

You can use DNS or IP address in the Name and Server path fields. DNS must be properly configured on the virtual appliance in order for it to work.

Click the Authentication tab, then specify the following information:

Proxy name and password: Specify the fully qualified, comma-delimited name and password for the proxy user used to access the OES, NetWare or Windows, server. (You can use the Browse icon next to the Proxy field to browse the LDAP directory for the proxy user that you want to use.)

IMPORTANT:Before you specify a proxy name and password for the Net Folder server, ensure that you review the information in Section 8.1.2, Planning the Net Folder Server Proxy User.

Test connection: Click this button to ensure that the path is accurate and that the credentials are valid, then click OK after the test succeeds.

Sometimes proxy users with the incorrect context pass this test. Ensure that the context for your proxy user is correct, as described in Expected Name Format for File Servers.

Authentication type: Select the authentication service for the file server that you are connecting to. This option corresponds with the Server type setting that you selected on the Configuration tab. If you selected OES or NetWare as the server type, only Novell NMAS is available as the authentication type. If you selected Windows as the server type, you can select either Kerberos, NTLM, or Auto detect as the authentication type. (Auto detect means that it tries authenticating with Kerberos first, and if that fails, authenticates with NTLM.)

NOTE:If Kerberos is selected as the authentication type, ensure that the DNS name server is able to resolve DNS queries for the Active Directory domains.

If the Kerberos port (port 88) is disabled on the Windows server, select NTLM as the authentication type.

To schedule the synchronization of the Net Folder Server, click the Synchronization Schedule tab, then select Enable scheduled synchronization.

Specify the schedule for when you want the synchronization between the file system server and Filr to occur. This becomes the default schedule for each Net Folder associated with this server.

Synchronizations can be scheduled only if you have configured the Net Folder Server to use Full Synchronization as the synchronization method (as described in Section 8.1.4, Planning the Synchronization Method). When setting the synchronization schedule, be aware that the schedule that you choose can greatly affect system performance.

Before you set a synchronization schedule, review the information in Section 8.1.5, Planning the Synchronization Schedule.

Click the Synchronization Options tab, then specify the following information:

Index the contents of Net Folders: Select this option to index all file content for each Net Folder associated with this Net Folder Server. (Before indexing can occur, file metadata must first be synchronized either via a full synchronization or Just-in-Time synchronization.)

When this option is selected, all content for each synchronized file within the Net Folders is indexed, and therefore is searched when performing a search in Filr. Deselect this option if you do not want file content to be indexed. This means that file content is not searched when performing a search in Filr. However, file names and access controls are always indexed at the time of synchronization regardless of this setting. (For more information about content searchability, see Searchability of Data.)

File metadata must first be synchronized to Filr via a full synchronization or Just-in-Time synchronization before the indexing process can begin. For more information about the synchronization process, see Section 8.1.4, Planning the Synchronization Method.

Indexing is performed as a background process. Depending on the number of files that need to be indexed, it can take several hours or even days before all content is indexed and searchable in the Filr system.

Enable Just-in-Time synchronization: When you enable Just-in-Time synchronization, files are synchronized the moment users access them. Just-in-Time synchronization is one method that you can use to synchronize files from Net Folders to be accessed in Filr.

When enabling Just-in-Time synchronization, you can configure the following options:

Maximum age for Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved information about this folder or file, it retrieves the information again. The default is 30 seconds.

Maximum age for ACL Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved access control information about this folder or file, it retrieves the information again. The default is 60 seconds.

Allow the desktop app to trigger initial home folder sync: Select this option to ensure that user Home folders are synchronized to the Filr desktop application.

If this option is not selected, user Home folders are synchronized to the Filr desktop application only after the user logs in to Filr on the web, or after the Filr administrator triggers a full initial synchronization from the administration console (as described in Synchronizing a Net Folder Server).

When this option is selected, the Filr desktop application triggers a full initial synchronization of user Home folders on the Filr server. Home folder information is then synchronized to the Filr desktop application.

The following conditions must be met in order for the Filr desktop application to trigger an initial synchronization of a user’s Home folder:

The Allow the desktop app to trigger initial home folder sync option is selected.

The user selects to synchronize the My Files area to the desktop application (as described in Configuring Folders to Synchronize in the Filr Desktop for Windows Quick Start and the Filr Desktop for Mac Quick Start).

The user’s Home folder has not previously been synchronized to the Filr server.

Click OK > Close.

For Home folders to be displayed in the My Files area for each user, ensure that you have completed the steps in Section 7.0, Setting Up Personal Storage.

8.3.2 Managing Net Folder Servers

After Net Folder Servers already exist in your Filr system, you can manage them as described in this section.

Modifying a Net Folder Server

Synchronizing a Net Folder Server

Deleting a Net Folder Server

Modifying a Net Folder Server

NOTE:You cannot modify a Net Folder Server’s URL if the Net Folder Server was created automatically. Net Folder Servers are automatically created in the following scenarios:

At the time of the LDAP synchronization (if the LDAP synchronization process for importing users contains at least one user who has a Home folder associated with them).

When a user authenticates to Filr (if the user has a Home folder associated with them).

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folder Servers.

The Manage Net Folder Servers page is displayed.

Click the name of the Net Folder Server that you want to modify.

Make the desired modifications, then click OK.

For information about the options you can modify, see Section 8.3.1, Configuring Net Folder Servers.

Synchronizing a Net Folder Server

When you create a Net Folder Server, you can enable a synchronization schedule, as described in Section 8.3.1, Configuring Net Folder Servers.

To manually synchronize the Net Folder:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folder Servers.

The Manage Net Folder Servers page is displayed.

Select the Net Folder Server that you want to manually synchronize, then click Sync.

Deleting a Net Folder Server

NOTE:Before you can delete a Net Folder Server, you must first delete any Net Folders that are associated with the Net Folder Server.

To delete a Net Folder Server after all Net Folders associated with the Net Folder Server have been deleted:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folder Servers.

The Manage Net Folder Servers page is displayed.

Select the Net Folder Server that you want to delete, then click Delete.

8.4 Creating and Managing Net Folders

Net Folders are connections to specific directories on OES, NetWare, or Windows server. You can set up multiple connections for each Net Folder Server that you have previously configured. You can set up each Net Folder to synchronize on a schedule that you specify, independent of the schedule set for the Net Folder Server.

Section 8.4.1, Creating Net Folders

Section 8.4.2, Managing Net Folders

8.4.1 Creating Net Folders

Before you can create a Net Folder as described in this section, you must first create a Net Folder Server as described in Section 8.3, Configuring and Managing Net Folder Servers.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folders.

The Manage Net Folders page is displayed.

Click Add.

The New Net Folder dialog box is displayed.

On the Configuration tab, specify the following information:

Name: Specify a name for the Net Folder. This is the name that users see when accessing the Net Folder. This can be any name you choose.

Net Folder Server: Select the Net Folder Server that the new Net Folder is associated with.

New Net Folder Server: Click this option if you have not already established a connection to a Net Folder Server, as described in Section 8.3, Configuring and Managing Net Folder Servers.

Relative Path: Specify the relative path to the folder on the Net Folder Server that you want this Net Folder to represent. If this field is left blank, it uses the root of the Net Folder Server. (The root of the Net Folder Server is the OES volume or the Windows share.)

For example, if the relative path to the folder on your Net Folder Server that you want this Net Folder to represent is \\server_address\vol1\marketing, and \\server_address\vol1 is the server path to your Net Folder Server, you would enter marketing in the Relative Path field for the Net Folder.

The path must be entered using UNC syntax.

Test connection: Click this option to test the connection to the Net Folder.

Use the index content setting defined on the Net Folder Server: Select this option to configure this Net Folder to retain the same setting for indexing content as you selected for the Net Folder Server.

For example, if you configured the Net Folder Server to index content, select this option to index content for this Net Folder.

Use the index content setting defined below: Select this option to configure this Net Folder with a different setting for indexing content than you configured for the Net Folder Server.

For example, if you configured the Net Folder Server to not index content, but you want this Net Folder server to index content, select this option and also select the following option, Index the contents of this Net Folder.

Index the contents of this Net Folder: When this option is selected, all content for each file within the Net Folder is indexed, and therefore is searched when performing a search in Filr. (Before indexing can occur, file metadata must first be synchronized either via a full synchronization or Just-in-Time synchronization.)

Deselect this option if you do not want file content to be indexed. This means that file content is not searched when performing a search in Filr. However, file names and access controls are always indexed at the time of synchronization regardless of this setting. (For more information about content searchability, see Searchability of Data.)

Files must first be synchronized to Filr before the indexing process can begin. For more information about the synchronization process, see Section 8.1.4, Planning the Synchronization Method.

Indexing is performed as a background process. Depending on the number of files that need to be indexed, it can take several hours or even days before all content is indexed and searchable in the Filr system.

Use the Just-in-Time settings defined on the Net Folder Server: Select this option to configure this Net Folder to retain the same setting for Just-in-Time synchronization as you selected for the Net Folder Server.

For example, if you configured the Net Folder Server to use Just-in-Time synchronization, select this option to use Just-in-Time synchronization for this Net Folder.

Use the Just-in-Time settings defined below: Select this option to configure this Net Folder with different Just-in-Time synchronization settings than you configured for the Net Folder Server.

For example, if you configured the Net Folder Server to not use Just-in-Time synchronization, but you want this Net Folder server to use Just-in-Time synchronization, select Enable Just-in-Time synchronization. You can also modify synchronization options.

Enable Just-in-Time synchronization: When you enable Just-in-Time synchronization, files are synchronized the moment users access them. Just-in-Time synchronization is one method that you can use to synchronize files from Net Folders to be accessed in Filr.

When enabling Just-in-Time synchronization, you can configure the following options:

Maximum age for Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved information about this folder or file, it retrieves the information again. The default is 60 seconds.

Maximum age for ACL Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved access control information about this folder or file, it retrieves the information again. The default is 3600 seconds (1 hour).

There are various options for synchronizing files from a Net Folder. Before you decide on a synchronization method for a Net Folder, see Section 8.1.4, Planning the Synchronization Method.

Click the Rights tab, then use the User or Group field to begin typing the name of a user or group that you want to have access to the files and folders on the Net Folder. Click the name when it appears in the drop-down list.

You can specify the following types of users, groups, and Organization Units (OUs) for granting rights:

Individual users (either imported from the LDAP directory or that have been created in Filr)

Groups (either imported from the LDAP directory or that have been created in Filr)

Organization Units (when using eDirectory as the LDAP directory)

After you specify the user, group, or Organization Unit and select it, the Grant Rights dialog box is displayed.

In the Grant Rights dialog box, select Allow access to the Net Folder.

Users are granted the same level of access rights that they currently have on the file system. Users who have rights on the file system do not have access to the same files through Filr until this option is selected for them. If you select this option for users who do not currently have access rights on the file system, these users cannot see files within the Net Folder, but they are able to see the folder names. (This access is obtained via the Net Folder Server Proxy user. For more information about the Net Folder Server proxy user, see Section 8.1.2, Planning the Net Folder Server Proxy User.)

For more information, see Section 8.1.3, Planning Access and Sharing for Net Folders.

Select whether you want the users or groups that you specified in Step 6 to be able to share with internal users, external users, and the public, and whether you want to allow them to give users that they share with the ability to re-share items.

Users who receive a share for a Net Folder do not have file system rights to the shared item. This means they can access the shared item only in the Shared with Me area through one of the Filr clients (web, desktop, or mobile); they cannot access the shared item directly through a mapped drive on the file system nor can they access the shared item from the Net Folders area through one of the Filr clients. This is because the Net Folder proxy user is used to grant the user access to an item through a share. (For more information about the Net Folder proxy user, see Section 8.1.2, Planning the Net Folder Server Proxy User.)

For more information, see Section 8.1.3, Planning Access and Sharing for Net Folders.

Click OK to save your rights changes.

(Optional) Click the Synchronization Schedule tab to configure the synchronization between the Net Folder and the file system server.

Specify the following information for the synchronization schedule:

Use the synchronization schedule defined on the Net Folder Server: If you already set a synchronization schedule for the Net Folder Server (as described in Section 8.3, Configuring and Managing Net Folder Servers), and if you want the Net Folder to use that same schedule, select this option. If you select this option, skip to Step 11.

Use the synchronization schedule defined below: Select this option to create an independent synchronization schedule for the Net Folder. (If you do set a synchronization schedule for the Net Folder, this schedule is used for synchronizing the Net Folder, instead of the Net Folder Server synchronization schedule.)

Synchronizations can be scheduled only if you have configured the Net Folder to use Full Synchronization as the synchronization method (as described in Section 8.1.4, Planning the Synchronization Method). When setting the synchronization schedule, be aware that the schedule that you choose can greatly affect system performance.

Before you set a synchronization schedule, review the information in Section 8.1.5, Planning the Synchronization Schedule.

Enable scheduled synchronization: Select this option to enable the synchronization, then select from the following synchronization options:

Every day: Synchronize files every day.

On selected days: Synchronize files only on designated days of the week.

At: Select the time of day to synchronize files.

Repeat every xx hours: Select how frequently the synchronization occurs.

(Optional) Click the Data Synchronization tab to configure whether the Net Folder is synchronized with the Filr desktop application.

Specify the following information:

Desktop application: Select this option to allow users to access files on the Net Folder via the Filr desktop application. (For more information about the Filr desktop application, see the Filr Desktop Application for Windows Quick Start or the Filr Desktop Application for Mac Quick Start.)

How Filr is set up to synchronize with Net Folders can affect how quickly files from the Net Folder are available to the Filr desktop application. For specific information, see Usage of the Filr Desktop Application in Section 8.1.4, Planning the Synchronization Method.

Click OK to finish creating the Net Folder.

8.4.2 Managing Net Folders

After Net Folders already exist in your Filr system, you can manage them as described in this section.

Modifying a Net Folder

Synchronizing a Net Folder

Viewing the Synchronization Status of a Net Folder

Deleting a Net Folder

Modifying a Net Folder

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folders.

The Manage Net Folders page is displayed.

(Optional) To filter the list of Net Folders, specify the name of a Net Folder in the Filter List field.

(Optional) To display user Home directories in the list of Net Folders, click the drop-down arrow next to the Filter List field, then select Show Home Directories.

Click the name of the Net Folder that you want to modify.

Make the desired modifications, then click OK.

Synchronizing a Net Folder

When you create a Net Folder, you can enable a synchronization schedule, as described in Section 8.4.1, Creating Net Folders.

To manually synchronize the Net Folder:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folders.

The Manage Net Folders page is displayed.

Select the Net Folder that you want to manually synchronize, then click Sync.

In a clustered environment, it is a good idea to dedicate a single Filr appliance to handle the load of any manual Net Folder synchronizations. (For information about how to dedicate a Filr appliance, see Setting Aside a Filr Appliance for Re-Indexing and Net Folder Synchronization in a Clustered Environment in the Novell Filr 1.1 Installation and Configuration Guide.)

Viewing the Synchronization Status of a Net Folder

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper right-corner of the page, then click the Administration Console icon .

Under Management, click Net Folders.

The Manage Net Folders page is displayed.

In the Sync status column, the synchronization status is displayed. You can click the icon for more detailed status information.

Deleting a Net Folder

To delete a Net Folder, and thereby delete access to files from the Net Folder from within Filr:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folders.

The Manage Net Folders page is displayed.

Select the Net Folder that you want to delete, then click Delete.

8.5 Setting Up Sharing for Net Folders

To allow users to share files that are located in a Net Folder, you as the Filr administrator must give users the proper share rights when setting up the net folder or when modifying the Net Folder’s configuration. Ensure that:

Users who you want to be allowed to view files (and by extension, receive shared items) for files in the Net Folder have been given the Allow Access to the Net Folder right. For information about how to give users this right, see Section 6.0, Setting Up Sharing.

Users who you want to be allowed to share files that are located in the Net Folder have been given one of the appropriate Share rights (located on the Rights tab when creating or modifying a Net Folder), as described in Section 8.4, Creating and Managing Net Folders and Section 8.8, Modifying Net Folder Connections.

When you create a Net Folder, you specify which users you want to be allowed to access files on the Net Folder. Users who already have file system rights to files have the same rights to these files in Filr. Users who do not have file system rights to files are not able to see the files and folders unless items have been shared with them. It is up to you as the Filr administrator whether users with native rights are allowed to share these files with others.

IMPORTANT:If a user moves or renames a file directly from the file server (instead of using a Filr client to do the move or rename), any shares that are associated with that file in Filr are removed. This means that users who gained access to a file via a share in Filr no longer have access to the file if the file was renamed or moved from the file server. Additionally, the file is not displayed in users’ Shared by Me and Shared with Me views.

If this situation occurs, files must be re-shared in Filr.

8.6 Enabling Just-in-Time Synchronization

You can enable Just-in-Time synchronization for a given Net Folder in addition to or in place of full synchronization. Before you decide on a synchronization method for a Net Folder, see Section 8.1.4, Planning the Synchronization Method.

Just-in-Time synchronization is one method that you can use to synchronize files from Net Folders to be accessed in Filr. When you enable Just-in-Time synchronization, files are synchronized the moment users access them via the Filr Web application or via the Filr mobile app. This means that data users access through Filr is more accurate and that processes to make the data available are less resource-intensive. However, this also means that files cannot be indexed (and therefore are not returned in searches and are not available to be synchronized via the Filr desktop application) until after users access them for the first time from the Filr Web application or from the mobile app. (For more information, see Searchability of Data and Usage of the Filr Desktop Application.)

Just-in-Time synchronization provides two key benefits:

Allows you to make files available to your users without needing to wait for all files within a given Net Folder to synchronize. Only those files that users want access to are synchronized. A file is synchronized to Filr at the time the user accesses the file within Filr.

Users do not have to wait for files to synchronize based on the Net Folder synchronization schedule (which by default is every 15 minutes). If one user edits a file and saves it, another user who views the file only a few seconds later will see the recent change.

You must enable Just-in-Time synchronization for the Filr system before you can enable Just-in-Time synchronization for individual Net Folders.

Section 8.6.1, Enabling Just-in-Time Synchronization for the Filr System

Section 8.6.2, Enabling Just-in-Time Synchronization for a Net Folder Server

Section 8.6.3, Enabling Just-in-Time Synchronization for a Specific Net Folder

Section 8.6.4, Enabling Just-in-Time Synchronization for a Specific User’s Home Directory

8.6.1 Enabling Just-in-Time Synchronization for the Filr System

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folder Settings.

The Net Folder Global Settings page is displayed.

The following options for configuring Just-in-Time synchronization are available:

Enable Just-in-Time synchronization of Net Folders: Select this option to allow Just-in-Time synchronization to be enabled for Net Folders in your Filr system. You can enable or disable Just-in-Time synchronization on specific Net Folder Servers or Net Folders.

Maximum wait time for results (in seconds): When a user clicks on a folder, the Just-in-Time operation retrieves the information for x seconds (x being the number that you specify). If the operation has not completed its work within x seconds, it returns to the user the work it has done up to that point, and the work continues in the background. The default is 5 seconds.

Click OK.

Enable Just-in-Time synchronization for each Net Folder where you want this type of synchronization to occur, as described in Section 8.6.3, Enabling Just-in-Time Synchronization for a Specific Net Folder.

8.6.2 Enabling Just-in-Time Synchronization for a Net Folder Server

Just-in-Time synchronization settings that are set for specific Net Folder Servers are not active until Just-in-Time synchronization has been enabled at the system level, as described in Section 8.6.1, Enabling Just-in-Time Synchronization for the Filr System.

By default, Just-in-Time synchronization settings are applied to all Net Folders associated with the Net Folder Server.

To enable Just-in-Time synchronization for a specific Net Folder Server:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folder Servers.

The Manage Net Folder Servers page is displayed.

Click the name of the Net Folder Server where you want to enable Just-in-Time synchronization.

On the Synchronization Options tab, select Enable Just-in-Time synchronization, then specify the following options:

Maximum age for Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved information about this folder or file, it retrieves the information again. The default is 60 seconds.

Maximum age for ACL Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved access control information about this folder or file, it retrieves the information again. The default is 3600 seconds (1 hour).

Click OK to save your changes.

8.6.3 Enabling Just-in-Time Synchronization for a Specific Net Folder

Just-in-Time synchronization settings that are set for specific Net Folders are not active until Just-in-Time synchronization has been enabled at the system level, as described in Section 8.6.1, Enabling Just-in-Time Synchronization for the Filr System.

To enable Just-in-Time synchronization for a specific Net Folder:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folders.

The Manage Net Folders page is displayed.

Click the name of the Net Folder where you want to enable Just-in-Time synchronization.

On the Configuration tab, select Use the Just-in-Time settings defined below, then specify the following options:

Enable Just-in-Time synchronization: When you enable Just-in-Time synchronization, files are synchronized the moment users access them. Just-in-Time synchronization is one method that you can use to synchronize files from Net Folders to be accessed in Filr.

When enabling Just-in-Time synchronization, you can configure the following options:

Maximum age for Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved information about this folder or file, it retrieves the information again. The default is 60 seconds.

Maximum age for ACL Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved access control information about this folder or file, it retrieves the information again. The default is 3600 seconds (1 hour).

Click OK to save your changes.

8.6.4 Enabling Just-in-Time Synchronization for a Specific User’s Home Directory

Just-in-Time synchronization settings that are set for specific user’s Home directory are not active until Just-in-Time synchronization has been enabled at the system level, as described in Section 8.6.1, Enabling Just-in-Time Synchronization for the Filr System.

To enable Just-in-Time synchronization for a specific user’s Home directory:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Users.

Click the drop-down arrow next to the user whose properties you want to view, then click User Properties.

The User Properties page is displayed.

Click Edit Home Folder. (This option is displayed only if a Home folder has been configured for the user, as described in Section 8.2.1, Configuring Home Folders.)

On the Configuration tab, select Enable Just-in-Time synchronization, then specify the following options:

Maximum age for Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved information about this folder or file, it retrieves the information again. The default is 30 seconds.

Maximum age for ACL Just-in-Time results (in seconds): When a user clicks a folder or file, if it has been more than x seconds (x being the number that you specify) since the Just-in-Time operation retrieved access control information about this folder or file, it retrieves the information again. The default is 60 seconds.

Click OK to save your changes.

8.7 Setting Global Net Folder Configuration Options

To modify global configuration options that affect all Net Folders in your Filr system:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folder Settings.

The Net Folder Global Settings page is displayed.

The following options are available:

Enable Just-in-Time synchronization of Net Folders: Select this option to allow Just-in-Time synchronization to be enabled for Net Folders in your Filr system. You can enable or disable Just-in-Time synchronization on specific Net Folder Servers or Net Folders.

Maximum wait time for results (in seconds): When a user clicks on a folder, the Just-in-Time operation retrieves the information for x seconds (x being the number that you specify). If the operation has not completed its work within x seconds, it returns to the user the work it has done up to that point, and the work continues in the background. The default is 5 seconds.

For more detailed information about configuring Just-in-Time synchronization at a global level, see Section 8.6.1, Enabling Just-in-Time Synchronization for the Filr System. For more generic information about Just-in-Time synchronization, as well as how to enable it for specific Net Folders, see Section 8.6, Enabling Just-in-Time Synchronization.

Use directory rights in addition to file system rights: When this option is selected, Filr consults eDirectory for user and group rights information when accessing files and folders on the file system via a Net Folder. Users and groups who have inherited Supervisor rights on the NCP server object (and therefore have implicit rights on the volume) in eDirectory are considered as trustees.

This option is enabled by default. You might want to disable this option if no users are inheriting Supervisor rights from eDirectory. If users are inheriting Supervisor rights from eDirectory, disabling this option might affect users’ ability to access certain files.

Changes made to this option take effect at the system level the next time the Filr server is restarted, or they take effect on a Net Folder Server the next time the Net Folder Server is reconfigured.

Refresh cached rights information every xx Minutes: Specify the frequency that the Filr server checks the rights information from the OES file system and from eDirectory. (The option Use directory rights in addition to file system rights must be selected in order for Filr to check the rights information from eDirectory.)

The default for refreshing cached rights information is every 5 minutes.

Rights information is available in Filr only after one of the following occurs since the last successful cache refresh:

Someone triggers Just-in-Time synchronization on the folder.

A Full (manual) synchronization is triggered on the folder.

For information about how to perform a manual synchronization, see Synchronizing a Net Folder and Synchronizing a Net Folder Server.

A scheduled synchronization is triggered on the folder.

IMPORTANT:The Refresh cached rights information every xx Minutes option affects only OES file systems; NetWare and Windows file systems are not affected.

With NetWare file systems, rights information is refreshed every 60 minutes.

With Windows file systems, rights are not cached, but are rather refreshed dynamically in Filr at the time that they are changed on the file system.

Click OK.

8.8 Modifying Net Folder Connections

You can modify the connection settings for a Net Folder after the Net Folder has been created. You can modify configuration settings, rights that users have in the Net Folder, the synchronization schedule, and whether the Net Folder can be accessed via the Filr desktop application and the Filr mobile app.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Net Folders.

The Manage Net Folders page is displayed.

Click the name of the Net Folder that you want to modify.

For information about each option that you can modify for Net Folders, see Section 8.4, Creating and Managing Net Folders.

Click OK to save your changes.

9.0 Creating Groups of Users

This section describes how to create groups within Filr. You can also synchronize groups of users from your LDAP directory to your Novell Filr site, as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

You might want to create groups for any of the following reasons:

To facilitate sharing on your Filr site. For background information on sharing, see Section 6.0, Setting Up Sharing.

To facilitate managing data quotas, as described in Section 22.2, Managing User Data Quotas.

You can create either static or dynamic groups.

Section 9.1, Creating Static Groups

Section 9.2, Creating Dynamic Groups

9.1 Creating Static Groups

Static groups are groups whose membership does not change based on LDAP queries.

This section describes how to create static groups directly from Filr. Alternatively, you can synchronize static groups to Filr from your LDAP directory as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

To create static groups in Filr:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Groups, then click Add.

Fill in the following fields:

Name: Specify the unique name under which the group is stored in the Filr database. You can use only alphanumeric characters (a-z, A-Z, 0-9), hyphens (-), and underscores (_).

This is the name that appears to users in Filr.

You can modify the name completion settings (the group name that is displayed when users are specifying the group, such as in the Share dialog) to use the Title instead of the Name.

For more information about modifying the name completion settings, see Section 19.4, Managing How Group Names Are Displayed during Name Completion.

Title: Enter a descriptive group title. This string can include any characters that you can type.

You can modify the name completion settings (the group name that is displayed when users are specifying the group, such as in the Share dialog) to use the Title instead of the Name.

For more information about modifying the name completion settings, see Section 19.4, Managing How Group Names Are Displayed during Name Completion.

Description: Describe what the members of this group have in common.

Select Group membership is static.

This means that group membership does not change based on LDAP queries.

Click Edit group membership.

Select Allow external users and groups if you want to allow external users and groups to be members of the group that you are creating.

Click the Users or Groups tab, depending on whether you want to add users or groups to the group that you are creating.

In the User or Group field, specify the name of the user or group that you want to add to the group that you are creating, then click the name of the user or group when it appears in the drop-down list.

Repeat Step 8 and Step 9 to add multiple users and groups to the group that you are creating, then click OK when you have finished adding users and groups.

Click OK to create the group.

After you have created one or more small groups, you can use the Groups field to create larger groups from smaller groups.

9.2 Creating Dynamic Groups

Groups based on LDAP queries are dynamic because they can be configured to have their membership updated when the information in the LDAP directory changes.

Creating groups based on LDAP queries is a quick way to create Filr groups that consist of users who match specific criteria. You can create dynamic groups as described in the following sections:

Section 9.2.1, Creating Dynamic Groups within LDAP

Section 9.2.2, Creating Dynamic Groups within Filr

9.2.1 Creating Dynamic Groups within LDAP

Depending on the LDAP directory that you are using, you might be able to create dynamic groups within your LDAP directory. For example, you can create dynamic group objects in eDirectory with NetIQ iManager (for more information, see the iManager Documentation).

Dynamic groups created within LDAP are stored in your LDAP directory and can then be synchronized to Filr, as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

9.2.2 Creating Dynamic Groups within Filr

You can create dynamic groups in Filr by querying the LDAP directory.

Prerequisites

Advantages

Considerations with Multiple LDAP Sources

Creating the Group

Prerequisites

Users must already have existing Filr user accounts in order for them to be added to a Filr group as described in this section. If your LDAP query includes users who are not already Filr users, the users are not added to the Filr group

When you configure your LDAP connection, you must specify the name of the LDAP attribute that uniquely identifies the user (the value of this attribute never changes). For eDirectory, this value is GUID. For Active Directory, this value is objectGUID. For more information about this attribute, see GUID attribute:.

The Filr process that creates a dynamic group uses the LDAP configuration settings in Filr to authenticate to the LDAP directory server. The credentials that are used are the LDAP server URL, user DN, and password. For more information on how to configure these and other LDAP configuration settings in Filr, see Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

Advantages

Advantages to creating dynamic groups within Filr rather than within your LDAP directory include the following:

Allows the Filr administrator to control group membership without having direct access to the group object in the LDAP user store.

Your LDAP directory might not support dynamic groups.

You do not want dynamic groups to sync to applications other than Filr that are leveraging your LDAP directory.

Considerations with Multiple LDAP Sources

Consider the following if your Filr site is configured with multiple LDAP sources:

You should not create dynamic groups in Filr if the base DN that you define for the dynamic group does not exist in each LDAP source. This is because the membership of the dynamic group might not be updated correctly.

If your Filr site is configured with multiple LDAP sources and the base DN that you define for the dynamic group exists in each LDAP source, the membership of the dynamic group contains users from each LDAP source that match the dynamic group’s filter.

Creating the Group

To create the dynamic group within Filr:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Groups, then click Add.

Fill in the following fields:

Name: Specify the unique name under which the group is stored in the Filr database. You can use only alphanumeric characters (a-z, A-Z, 0-9), hyphens (-), and underscores (_).

This is the name that appears to users in Filr.

You can modify the name completion settings (the group name that is displayed when users are specifying the group, such as in the Share dialog) to use the Title instead of the Name.

For more information about modifying the name completion settings, see Section 19.4, Managing How Group Names Are Displayed during Name Completion.

Title: Enter a descriptive group title. This string can include any characters that you can type.

You can modify the name completion settings (the group name that is displayed when users are specifying the group, such as in the Share dialog) to use the Title instead of the Name.

For more information about modifying the name completion settings, see Section 19.4, Managing How Group Names Are Displayed during Name Completion.

Description: Describe what the members of this group have in common.

Select Group membership is dynamic.

This means that group membership is based on an LDAP query that you will define in this procedure.

Click Edit group membership.

Specify the following options:

Base DN: Specify the base DN where you want to start your search.

If you have multiple LDAP sources, see Considerations with Multiple LDAP Sources before proceeding.

HINT:You can use the Browse icon Group Membership box next to the Base DN field to browse the LDAP directory for the base DN that you want to use.

LDAP Filter: Specify the filter criteria.

For example, to search for all users located in Utah, specify (st=Utah).

Search subtree: Select this option if you want to also search for matches in subtrees of the base dn you are currently searching.

Update group membership during scheduled ldap synchronization: Select this option to update the membership of this group during each scheduled LDAP synchronization. Group membership is updated based on changes that might have occurred in the LDAP directory.

For information on how to set the LDAP synchronization schedule, see Configuring the Synchronization Schedule.

(Optional) Click Test ldap query to test the results of your LDAP query.

This process can take several minutes, depending on the size of your LDAP directory.

Click OK > OK to create the group.

10.0 Configuring User Access to the Filr Site

Section 10.1, Allowing External Users Access to Your Filr Site

Section 10.2, Allowing Web Crawler Access to Your Filr Site

Section 10.3, Disabling User Access to the Filr Site on the Web

Section 10.4, Disabling Downloads from the Filr Site on the Web

10.1 Allowing External Users Access to Your Filr Site

IMPORTANT:Prior to Filr 1.1, users could log in to the Filr site with their Google or Yahoo account. This functionality is no longer available to new Filr users in Filr 1.1.

Users whose Filr accounts were created by logging in to Filr with their Google or Yahoo accounts prior to Filr 1.1 are able to continue accessing Filr via their Google or Yahoo accounts in Filr 1.1 if the settings are enabled as described in the following sections. However, because the OpenID authentication service that this functionality is based on is being deprecated by Google, Filr will be moving to other more relevant authentication mechanisms in the future. Filr versions later than 1.1 will not support any OpenID authentication for new or existing users.

Users external to your organization can access the Filr site either as the Guest user or as a registered user (after performing an auto-registration process). By default, these features are not enabled.

Users can auto-register or log in with their Google or Yahoo account only if sharing with external users has been enabled, if you have configured Filr to allow users to log in with OpenID, and if an item has been shared with them. Guest users can access the site at any time if Guest access has been enabled as described in this section.

Section 10.1.1, Allowing Guest Access to Your Filr Site

Section 10.1.2, Allowing Users to Access the Filr Site with Google and Yahoo Accounts (OpenID)

10.1.1 Allowing Guest Access to Your Filr Site

When guest access is enabled on the Filr site (as described in this section), and users enter the Filr site as the Guest user, the person is considered to be a Guest user on the site. This is indicated by the user name displayed in the upper-right corner of the page:

Guest Access Limitations

Understanding the Guest User

Setting Up Guest Access for the Filr Site

Monitoring Guest User Access

Guest Access Limitations

Guest access to the Filr site is not possible in the following situations:

If you are using NetIQ Access Manager to provide single sign-on functionality.

For more information about NetIQ Access Manager, see Section 1.8, Changing Reverse Proxy Configuration Settings.

If users are using the Filr mobile app. For guest users to access the Filr site, they must access the full user interface from a browser.

For more information about using the Filr mobile app, see the Novell Filr 1.1 Mobile App Quick Start.

Understanding the Guest User

As the administrator, you can choose whether you want people who do not have Filr user names to be able to access information on the Filr site as the Guest user.

For example, a government organization such as a city might give Filr user accounts only to key city knowledge workers. However, it is critical that other city workers and regular citizens also access the site to see a listing of upcoming events, read city news, report complaints, and so forth. As a Filr administrator, you can allow guests to access Filr as the Guest User.

When people visit your Filr site as the Guest user, they are presented with the following user experience:

Any user who knows the Filr site URL can access the Filr site as the Guest User and is immediately taken to the Shared with Me tab where they see all files and folders that are shared with the public.

If a Guest user uses the Search feature, the only information returned is information that the Guest user has been granted access to see.

Setting Up Guest Access for the Filr Site

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under System, click Web Application.

Select Allow Guest Access.

Guest access means that when users without a user account access the root page of your Filr site and the login dialog box is displayed, they can click Enter as guest on the login dialog box to enter the Filr site as the Guest user. Only items that have been shared with the public are available to the Guest user.

If an item is shared with the public, recipients of that shared item are given the URL to the shared item, and no login is required.

(Optional) Select Guest access is read only if you do not want the Guest user to be allowed to add files or make comments on files.

Click OK.

Ensure that users are allowed to share with the public, as described in Section 6.2, Enabling Users to Share.

If no items have been shared with the public, the guest user does not have access to any files.

Monitoring Guest User Access

As the Filr site administrator, you can create a report of all locations on the Filr site that the Guest user can access. For instructions, see Section 26.2.7, User Access Report.

10.1.2 Allowing Users to Access the Filr Site with Google and Yahoo Accounts (OpenID)

IMPORTANT:Because OpenID authentication will not be supported in versions of Filr later than Filr 1.1, enabling OpenID as described in this section allows only existing OpenID users (users who authenticated to Filr via OpenID prior to Filr 1.1) to access the Filr 1.1 system.

This option allows users external to the organization who have received a shared item in Filr to log in to the Filr site using their Google or Yahoo accounts. If you do not enable this option, external users who receive a shared item must create a Filr account.

Users attempting to access the Filr site by using OpenID must have direct HTTPS access to the OpenID provider.

For more information about the user experience for external users accessing the Filr site, see Logging in As an External User to See a Shared Item in the Novell Filr 1.1 Web Application User Guide.

To allow external users to access the Filr site by using their Google and Yahoo accounts:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Configure User Access page.

Under System, click Web Application.

Ensure that Allow external user access through OpenID is selected.

Click OK.

Ensure that sharing with external users has been enabled, as described in Section 6.2, Enabling Users to Share.

10.2 Allowing Web Crawler Access to Your Filr Site

If you allow Guest access to your Novell Filr site, as described in Section 10.1, Allowing External Users Access to Your Filr Site, you can provide Internet search engines (such as Google) with the Filr permalinks for folders that you want to make publicly available on the Internet. A Filr permalink is the complete URL that someone outside of your Filr site and outside of your organization, such as a web crawler, could use to access a specific location on your Filr site.

To determine the permalink of a folder, click Permalinks at the bottom of a folder page.

10.3 Disabling User Access to the Filr Site on the Web

If you want users to have access to the Filr system only through the Filr desktop application or through the Filr mobile app, you can disable users’ ability to access the Filr site via a web browser.

You can restrict access to the Filr site on the web for all users, or for specific users and groups. Alternatively, you can disable access to the site for all users and then enable access for specific users and groups.

Section 10.3.1, Disabling Access for All Users

Section 10.3.2, Disabling or Enabling Access for Individual Users

Section 10.3.3, Disabling or Enabling Access for Individual Groups

10.3.1 Disabling Access for All Users

Disabling access as described in this section disables access to Filr on the web for all users in the Filr system, except for the Filr administrator.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Configure User Access page.

Under System, click Web Application.

Select Disable web access.

Click OK.

10.3.2 Disabling or Enabling Access for Individual Users

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Configure User Access page.

Under Management, click Users.

The Manage Users page is displayed.

(Conditional) If you have not disabled access for all users (as described in Section 10.3.1, Disabling Access for All Users), you can disable access for an individual user by clicking the drop-down arrow next to the user’s name and then clicking Disable Web Access for this User.

or

To disable access for multiple users, select the users whose access you want to disable, then click More > Disable Web Access.

(Conditional) If you have disabled access for all users, you can enable access for an individual user by clicking the drop-down arrow next to the user’s name and then clicking Enable Web Access for this User.

or

To enable access for multiple users, select the users whose access you want to enable, then click More > Enable Web Access.

10.3.3 Disabling or Enabling Access for Individual Groups

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Configure User Access page.

Under Management, click Groups.

The Manage Groups page is displayed.

(Conditional) If you have not disabled access for all users (as described in Section 10.3.1, Disabling Access for All Users), you can disable access for users who belong to an individual group by clicking the drop-down arrow next to the group name and then clicking Disable Web Access for Users in this Group.

or

To disable access for multiple users, select the users whose access you want to disable, then click More > Disable Web Access.

(Conditional) If you have disabled access for all users, you can enable access for users who belong to an individual group by clicking the drop-down arrow next to the group name and then clicking Enable Web Access for Users in this Group.

or

To enable access for multiple users, select the users whose access you want to enable, then click More > Enable Web Access.

10.4 Disabling Downloads from the Filr Site on the Web

You can disable the ability for users to download files from the Filr site on the web. If you do not disable downloads as described in this section, users can download files to their personal workstations, as described in Downloading Files in the Novell Filr 1.1 Web Application User Guide. If you do disable file downloads, users can view the file only in a web browser.

You can disable the ability for users to download files from the Filr site on the web for all users, or for specific users and groups. Alternatively, you can disable downloads for all users and then enable downloads for specific users and groups.

Section 10.4.1, Disabling Downloads for All Users

Section 10.4.2, Disabling or Enabling Downloads for Individual Users

Section 10.4.3, Disabling or Enabling Downloads for Individual Groups

10.4.1 Disabling Downloads for All Users

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Configure User Access page.

Under System, click Web Application.

Select Disable file downloads.

Click OK.

10.4.2 Disabling or Enabling Downloads for Individual Users

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Configure Web Application page.

Under Management, click Users.

The Manage Users page is displayed.

(Conditional) If you have not disabled downloads for all users (as described in Section 10.4.1, Disabling Downloads for All Users), you can disable downloads for an individual user by clicking the drop-down arrow next to the user’s name and then clicking Disable File Downloads for this User.

or

To disable access for multiple users, select the users whose access you want to disable, then click More > Disable File Downloads.

(Conditional) If you have disabled downloads for all users, you can enable downloads for an individual user by clicking the drop-down arrow next to the user’s name and then clicking Enable File Downloads for this User.

or

To enable downloads for multiple users, select the users who you want to allow to download files, then click More > Enable File Downloads.

10.4.3 Disabling or Enabling Downloads for Individual Groups

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Configure Web Application page.

Under Management, click Groups.

The Manage Groups page is displayed.

(Conditional) If you have not disabled access for all users (as described in Section 10.4.1, Disabling Downloads for All Users), you can disable access for users who belong to an individual group by clicking the drop-down arrow next to the group name and then clicking Disable Web Access for Users in this Group.

or

To disable access for multiple users, select the users whose access you want to disable, then click More > Disable File Downloads.

(Conditional) If you have disabled downloads for all users, you can enable downloads for users who belong to an individual group by clicking the drop-down arrow next to the group name and then clicking Enable File Downloads for Users in this Group.

or

To enable access for multiple users, select the users whose access you want to enable, then click More > Enable File Downloads.

11.0 Setting Up Site Branding

You can brand your Filr site to display a corporate logo on the login dialog box before users log in. You can also display a corporate brand on each Filr page after users log in.

Section 11.1, Branding the Filr Site

Section 11.2, Branding the Login Dialog Box

11.1 Branding the Filr Site

You can brand your Novell Filr site to match your corporate brand. When you add a site-wide brand to your Filr site, the brand is displayed on every Filr page. You can create your brand by adding an image, by creating the brand in HTML using CSS styles, or by using a combination of both.

Sign in to the Filr site as the Filr administrator.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Configure Web Application page.

The Administration page is displayed.

In the System section, click Site Branding.

The Site Branding dialog box is displayed.

(Conditional) If you have not done so already, upload to Filr any images that you want to use in your site branding:

Click any Browse icon Configure Web Application page on the Site Branding page to browse to and upload your image to Filr to be used in the site branding.

The Add File Attachment dialog box is displayed.

(Optional) Click Add file if you want to upload multiple images to the Filr site. After images are uploaded to the Filr site, they can then be used in the site branding.

Browse to and select the images that you want to upload.

Click OK to exit the Add File Attachment dialog box.

Specify the following information to create your desired brand:

Use Branding Image: Select this option if you want to use the drop-down list to select an existing image for the branding foreground, such as a company name. To have no branding image, select None in the drop-down list. (Powered by Novell Filr is displayed in the upper-right corner below each user’s name.)

Images are available in the drop-down list after you upload them by clicking the Browse icon Configure Web Application page, as described in Step 4.

Use Advanced Branding: Select this option, then click Edit Advanced if you want to create a brand that includes advanced features, such as HTML. You can create your brand in HTML by using CSS styles and copying them into the HTML editor by clicking HTML in the Edit Advanced Branding dialog box. (Powered by Novell Filr is displayed in the upper-right corner below each user’s name.)

Background Image: Use the drop-down list to select an existing image. The background image is displayed behind your branding image or your advanced branding.

HINT:Buttons in the header (such as My Files, and Shared with Me) display better when your background image is a medium to darker color. Lighter images make it more difficult to see the buttons.

Images are available in the drop-down list after you upload them by clicking the Browse icon Configure Web Application page, as described in Step 4.

Stretch Image: Stretches the image to occupy the entire branding area.

If you stretch your background image, the image overrides any background color that you have set.

Background Color: Adds a background color that occupies the entire branding area. To change the background color, click the color picker icon Configure Web Application page to the right of this field, select the new color, then click OK.

If you added a background image and stretched the image, the background color is not displayed.

Text Color: Changes the text color of the workspace name in the upper-right corner of the branding area. To change the text color, click the color picker icon Configure Web Application page to the right of this field, select the new color, then click OK.

Clear branding: Click this option to clear all your current branding selections.

Click OK.

The Filr site now displays the brand that you created.

11.2 Branding the Login Dialog Box

You can change the image that is used in the login dialog box that users see before they log in to the Novell Filr site.

To re-brand the login dialog box to contain a custom image:

Sign in to the Filr site as the Filr administrator.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

The Administration page is displayed.

In the System section, click Site Branding.

The Site Branding dialog box is displayed.

(Conditional) If you have not done so already, upload to Filr any images that you want to use in your site branding:

Click the Browse icon to browse to and upload your image to Filr to be used in the site branding.

The Add File Attachment dialog box is displayed.

(Optional) Click Add file if you want to upload multiple images to the Filr site. After images are uploaded to the Filr site, they can then be used in the site branding.

Browse to and select the images that you want to upload.

The suggested image size to use in the login dialog box is width: 400px, height: 60 px.

Click OK to exit the Add File Attachment dialog box.

In the Sign In Dialog Image section, in the Current image drop-down list, select the file that you want to use for branding the login dialog box.

12.0 Allowing Access to the Filr Site through NetIQ Access Manager

To allow access to the Filr site through NetIQ Access Manager, you need to make configuration changes in NetIQ Access Manager to configure a protected resource for a Novell Filr server as described in Section 12.1, Configuring a Protected Resource for a Novell Filr Server.

IMPORTANT:When you use NetIQ Access Manager with Filr, external users cannot access your Filr site. This means that the following features are not functional:

Users are not able to share with external users, as described in Sharing with People Outside Your Organization in the Novell Filr 1.1 Web Application User Guide.

Users are not able to share a File Link, as described in Distributing a Link to a File in the Novell Filr 1.1 Web Application User Guide.

Users cannot make items accessible to the public, as described in Making Files Accessible to the Public in the Novell Filr 1.1 Web Application User Guide.

This means that public users cannot access the Filr site as the Guest user. For more information about the Guest user, see Section 10.1.1, Allowing Guest Access to Your Filr Site.

For more information about external users in Filr, see Section 10.1, Allowing External Users Access to Your Filr Site.

12.1 Configuring a Protected Resource for a Novell Filr Server

The following sections explain how to configure the Access Gateway with a domain-based multi-homing service. The instructions assume that you have a functioning Novell Filr server on Linux and a functioning Access Manager system (3.1 SP1 IR1 or higher) with a reverse proxy configured for SSL communication between the browsers and the Access Gateway.

The Filr server needs to be configured to trust the Access Gateway to allow single sign-on with Identity Injection and to provide simultaneous logout. You also need to create an Access Gateway proxy service and configure it.

Section 12.1.1, Configuring the Novell Filr Server to Trust the Access Gateway

Section 12.1.2, Configuring a Reverse-Proxy Single Sign-On Service for Novell Filr

For information on other possible Access Gateway configurations, see “Teaming 2.0: Integrating with Linux Access Gateway”.

12.1.1 Configuring the Novell Filr Server to Trust the Access Gateway

To use Novell Filr as a protected resource of an Access Gateway and to use Identity Injection for single sign-on, the Filr server needs a trusted relationship with the Access Gateway. With a trusted relationship, the Filr server can process the authorization header credentials. The Filr server accepts only a simple user name (such as user1) and password in the authorization header.

To configure a trusted relationship and simultaneous logout, specify the reverse proxy configuration settings for your Filr appliance, as described in Section 1.8, Changing Reverse Proxy Configuration Settings.

12.1.2 Configuring a Reverse-Proxy Single Sign-On Service for Novell Filr

To configure a reverse-proxy single sign-on service for Filr, complete the following tasks:

Creating a New Reverse Proxy

Configuring the Domain-Based Proxy Service

Creating Policies

Configuring Protected Resources

Disabling a Rewriter Profile and Enabling Port Redirection

Creating a New Reverse Proxy

Before you can configure the domain-based proxy service, you need to create a new reverse proxy. For information, see Managing Reverse Proxies and Authentication in Configuring the Access Gateway to Protect Web Resources in the https://www.netiq.com/documentation/novellaccessmanager32/accessgatewayhelp/data/bookinfo.html#bookinfo.

Configuring the Domain-Based Proxy Service

In the Administration Console, click Devices > Access Gateways > Edit, then click the name of the reverse proxy that you created in Creating a New Reverse Proxy.

Click the reverse proxy link that you have previously created. In the Reverse Proxy List, click New, then fill in the following fields:

Proxy Service Name: Specify a display name for the proxy service that the Administration Console uses for its interfaces.

Published DNS Name: Specify the DNS name that you want the public to use to access your site. This DNS name must resolve to the IP address that you set up as the listening address. For example, Filr.doc.provo.novell.com.

Web Server IP Address: Specify the IP address of the Filr server.

Host Header: Select the Forward received host name.

Web Server Host Name: Because of your selection in the Host Header field, this option is dimmed.

Click OK.

Click the newly added proxy service, then select the Web Servers tab.

Configure the Connect Port to match the Reverse Proxy Secure HTTP Port setting that you configured from the Filr appliance, as described in Section 1.8, Changing Reverse Proxy Configuration Settings. This will be either port 443 or 8443.

When using SSL, select Use SSL in the Access Manager configuration, then select one of the following:

Any in reverse proxy store: Select this option if your Filr and Access Manager servers are in separate geographical locations, or if you want added security within your local network.

Do not verify: Select this option if your Filr and Access Manager servers are part of the same local network.

Click TCP Connect Options.

Click OK.

Continue with Configuring Protected Resources.

Creating Policies

You need to create two policies: LDAP Identity Injection and X-Forward-Proto:

Creating the LDAP Identity Injection Policy

Creating the X-Forward-Proto HTTP Header Policy

Creating the LDAP Identity Injection Policy

In the Administration Console, click Policies > Policies.

Select the policy container, then click New.

Specify ldap_auth as the name for the policy, select Access Gateway: Identity Injection for the type, then click OK.

(Optional) Specify a description for the injection policy. This is useful if you plan to create multiple policies to be used by multiple resources.

In the Actions section, click New, then select Inject into Authentication Header.

Fill in the following fields:

User Name: If users are provisioned with cn or uid attributes, select Credential Profile, then select LDAP Credentials:LDAP User Name. In the Refresh Data Every drop-down, select Session.

or

If users are provisioned with mail attributes, select LDAP Attribute, then select mail. In the Refresh Data Every drop-down, select Session.

Password: Select Credential Profile, then select LDAP Credentials:LDAP Password.

Leave the default value for the Multi-Value Separator, which is comma.

Click OK.

To save the policy, click OK, then click Apply Changes.

For more information on creating such a policy, see Configuring an Authentication Header Policy in the https://www.netiq.com/documentation/novellaccessmanager32/policyhelp/data/bookinfo.html#bookinfo.

Creating the X-Forward-Proto HTTP Header Policy

When communicating over HTTPS from the browser to Access Manager, and over HTTP from Access Manager to Filr, the X-Forwarded-Proto is a best practice.

In the Administration Console, click Policies > Policies.

Select the policy container, then click New.

Specify x-forward as the name for the policy, select Access Gateway: Identity Injection for the type, then click OK.

(Optional) Specify a description for the injection policy. This is useful if you plan to create multiple policies to be used by multiple resources.

In the Actions section, click New, then select Inject into Custom Header.

Fill in the following fields:

Custom Header Name: Specify X-Forward-Proto as the name.

Value: Select String Constant in the drop-down, then specify https.

Leave the other settings at the defaults.

Click OK.

To save the policy, click OK, then click Apply Changes.

For more information on creating such a policy, see Configuring an Authentication Header Policy in the https://www.netiq.com/documentation/novellaccessmanager32/policyhelp/data/bookinfo.html#bookinfo.

Configuring Protected Resources

You need to create two protected resources, one for HTML content and a public protected resource:

Create a protected resource for HTML content:

In the Protected Resource List, click New, specify Basic auth with redirection for the name, then click OK.

(Optional) Specify a description for the protected resource. You can use it to briefly describe the purpose for protecting this resource.

Click the Edit icon next to the Authentication Procedure drop-down list.

Create a new authentication procedure by clicking New, specifying a name for the authentication procedure, and then clicking OK.

In the dialog box that is displayed, fill in the following fields.

Contract: Select the Secure Name/Password - Form contract.

Non-Redirected Login: Select this option.

Realm: Specify a name that you want to use for the Filr server. This name does not correspond to a Filr configuration option. It appears when the user is prompted for credentials.

Redirect to Identity Server When No Authentication Header is Provided: Select this option.

Click OK twice.

In the URL Path List, add the following paths for HTML content:

/*
/ssf/*

On the configuration page for the protected resource, select the authentication procedure that you just created from the Authentication Procedure drop-down list, then click OK.

Create a public protected resource for Web Services:

NetIQ Access Manager is not designed to protect certain public resources. You must complete the following steps to allow these resources to be protected by the Filr server itself, rather than by NetIQ Access Manager.

In the Protected Resource List, click New, specify public for the name, then click OK.

(Optional) Specify a description for the protected resource. You can use it to briefly describe the purpose for protecting this resource.

For the Authentication Procedure, select None.

Click OK.

In the URL Path List, remove the /* path and add the following paths:

For public content:

/ssf/atom/*
/ssf/ical/*
/ssf/ws/*
/ssf/rss/*
/ssr/*
/rest/*
/rest
/
/dave/*
/my_files/*
/net_folders/*
/shared_with_me
/desktopapp/*

The /ssf/rss/* path enables non-redirected login for RSS reader connections.

Filr provides authentication for all of the paths listed above.

Click OK.

Assign the X-Forward-Proto Header policy to both protected resources that you created:

Click Access Gateways > Edit > [Name of Reverse Proxy] > [Name of Proxy Service] > Protected Resources.

For each Filr protected resource, click the Identity Injection link, select the x-forward policy that you created, click Enable, then click OK.

Click OK.

Assign the Identity Injection policy to the HTML protected resource that you created, specifically, Basic auth with redirection.

Click Access Gateways > Edit > [Name of Reverse Proxy] > [Name of Proxy Service] > Protected Resources.

For each Filr protected resource, click the Identity Injection link, select the ldap_auth policy that you created, click Enable, then click OK.

Click OK.

To save the configuration changes, click Devices > Access Gateways, then click Update.

In the Protected Resource List, ensure that the protected resources that you created are enabled.

To apply your changes, click Devices > Access Gateways, then click Update.

Continue with Disabling a Rewriter Profile and Enabling Port Redirection.

Disabling a Rewriter Profile and Enabling Port Redirection

NOTE:If you have changed the Filr and Access Manager ports from their defaults (8443 for Filr and 443 for Access Manager), you cannot disable the rewriter profile and enable port redirection as described in this section. Instead, you must configure a rewriter profile in Access Manager, as described in Configuring a Rewriter Profile in the https://www.netiq.com/documentation/novellaccessmanager32/accessgatewayhelp/data/bookinfo.html#bookinfo.

To disable the HTML Rewriter and enable port redirection:

In the Proxy Service List in Access Manager, ensure that the HTML Rewriter is disabled.

Under the Web Servers tab, ensure that the Connect Port has been modified to port 443. (This matches the configuration that you made in Step 5 in Configuring the Domain-Based Proxy Service.)

Enable port redirection on the Filr server, as described in Section 1.2.1, Changing the Network Configuration Settings.

This allows Filr to listen on port 8443, and allows Access Manager to forward client requests to port 443.

13.0 Configuring Mobile Device Access to the Filr Site

Filr provides the capability for users to access Filr content via the Filr mobile app on a mobile device.

You can enable this functionality for all users in the Filr system, or for individual users and groups. By default, this functionality is not enabled.

In addition to enabling mobile device access for the Filr site, Filr also provides native controls to limit certain actions that users might perform within the Filr mobile app that are related to security. For example, you can restrict users from cutting or copying data and pasting it into another app. If you are using Filr in conjunction with an MDM solution, such as ZENworks Mobile Management, settings made within the MDM solution override any setting made within the Filr administration console.

If you make configuration changes, users must log out of the app and log in again in order to see the changes.

Section 13.1, Configuring Mobile Device Access for All Users

Section 13.2, Configuring Mobile Device Access for Individual Users and Groups

Section 13.3, Managing Mobile Devices

Section 13.4, Understanding Filr Data Security for Mobile Devices

13.1 Configuring Mobile Device Access for All Users

To customize the mobile experience for all users in your Filr system:

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under System, click Mobile Applications.

The Configure Mobile Applications dialog box is displayed.

As necessary, configure Filr to allow the Filr mobile app to support the following features.

Most of the following options can be changed on a per-user basis, as described in Section 13.2, Configuring Mobile Device Access for Individual Users and Groups.

Access Filr: Allows users to access the Filr site through the Filr mobile app.

Cache the user’s password: Allows users to enable the Save Password option when logging in to the Filr site through a Filr mobile app.

Allow files to be added to the Downloads area for offline access: Allows users to download files from Filr to the mobile device. Downloaded files can then be viewed in offline mode by accessing the Downloads section in the app.

This setting applies to all files that users have access to, including files in Net Folders.

You should be aware that even if this option is disabled, users can still work around this by accessing Filr from a web browser on their device and then downloading the file to their mobile device via the regular Filr web browser.

In order for files to remain secure after they are downloaded, users are responsible for configuring their mobile device to encrypt files, as described in Encrypting Downloaded Files in the Novell Filr 1.1 Mobile App Quick Start.

Cut/Copy: Allows users to cut or copy data from the Filr mobile app so that the data can be pasted into third-party applications.

Screen capture: Allows users to take a screen capture while inside the Filr application.

This option controls the ability to take screen captures on Android devices only. Users can always take screen captures on iOS devices.

Disable applications on rooted or jail-broken devices: Disables users’ ability to run the Filr mobile app on devices that have been rooted or jail-broken.

Open in: This option controls users’ ability to use Open In functionality for iOS devices and the Share or Send To functionality for Android devices. This functionality allows users to open files from the Filr app into third-party applications.

For example, users can view a file in Filr, open that file in a document editing application, edit the file in the document editing application, and then save the file back to the Filr app.

This setting applies to all files that users have access to, including files in Net Folders.

Select from the following options:

Disabled: Disables users’ ability to open files from the Filr app into third-party applications.

All applications: Allows users to open files from the Filr app into any third-party application.

Whitelist: Allows you to specify which third-party applications users can open files into.

If you select this option, you need to provide the Android package name or the iOS bundle ID for the applications that you want to allow:

Click Add, specify the Android package name or iOS bundle ID, then click OK.

For example, the bundle ID for the Pages app on iOS is com.apple.iwork.pages.

The package name for the Gallery app on Android is com.google.android.gallery3d.

HINT:An easy way to find the package name for an Android app is to install the Package Name Viewer app from the Google Play store. This app displays the package name for each app that is currently installed on the device.

To find the bundle ID for an iOS app:

(Conditional) If the app for which you want to location the bundle ID has not yet been synchronized to iTunes from your device, you must sync the device with iTunes.

In your iTunes library on your Mac or PC, open the Mobile Applications folder.

On a Mac, this is usually in your Home directory, at the following location: ~/Music/iTunes/Mobile Applications/

On Windows 7, this is usually at the following location: C:\Users\username\My Music\iTunes\Mobile Applications/

In the Mobile Applications folder, locate the app for which you want the bundle ID.

Create a copy of the file, and re-save the copy as a .zip file.

Unzip the newly created .zip file.

You now see a folder by the name of the application name.

Locate the iTunesMetadata.plist file within the folder and open it in a text editor.

Locate the softwareVersionBundleid key within the file.

The string value below this key is the bundle ID.

If you are using MobileIron to manage devices in your organization, the Open In setting exists both in the Filr administration console and in the MobileIron administration console. This setting should be consistent in both locations (if it is enabled in Filr, it should also be enabled in MobileIron). The one exception to this rule is if you want Open In functionality to be enabled for devices that are being managed by MobileIron and disabled for devices that are not being managed by MobileIron. To achieve this, you can enable this setting in MobileIron and disable it in Filr. In this case, only devices that are being managed by MobileIron are able to use Open In functionality; devices that are not being managed by MobileIron are not able to use Open In functionality.

For more information about using MobileIron with Filr, see Section 13.3.3, Configuring MobileIron to Manage the Filr App.

Synchronize every xx Minutes: Specify the interval (in minutes) for how often content is synchronized between Filr servers and the Filr mobile app. This lets you control the amount of load the Filr mobile app puts on the Filr server.

Click OK.

13.2 Configuring Mobile Device Access for Individual Users and Groups

To customize the mobile experience for individual users and groups in your Filr system:

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Users.

The Manage Users page is displayed.

Select the check boxes next to the names of the users or groups for whom you want to configure the Filr mobile app, then click More > Mobile Application Settings.

The Configure User Mobile Application Settings page is displayed.

To change the mobile app settings for the selected users to be different from the global settings, select Use user settings to allow mobile applications to, then choose from the following options:

Access Filr: Allows users to access the Filr site through the Filr mobile app.

Cache the user’s password: Allows users to enable the Save Password option when logging in to the Filr site through a Filr mobile app.

Allow files to be added to the Downloads area for offline access: Allows users to download files from Filr to the mobile device. Downloaded files can then be viewed in offline mode by accessing the Downloads section in the app.

This setting applies to all files that users have access to, including files in Net Folders.

Be aware that even if this option is disabled, users can still work around this by accessing Filr from a web browser on their device and then downloading the file to their mobile device via the regular Filr web browser.

In order for files to remain secure after they are downloaded, users are responsible for configuring their mobile device to encrypt files, as described in Encrypting Downloaded Files in the Novell Filr 1.1 Mobile App Quick Start.

Cut/Copy: Allows users to cut or copy data from the Filr mobile app so that the data can be pasted into third-party applications.

Screen capture: Allows users to take a screen capture while inside the Filr application.

This option controls the ability to take screen captures on Android devices only. Users can always take screen captures on iOS devices.

Disable applications on rooted or jail-broken devices: Disables users’ ability to run the Filr mobile app on devices that have been rooted or jail-broken.

Open in: This option controls users’ ability to use Open In functionality for iOS devices and the Share or Send To functionality for Android devices. This functionality allows users to open files from the Filr app into third-party applications.

For example, users can view a file in Filr, open that file in a document editing application, edit the file in the document editing application, and then save the file back to the Filr app.

This setting applies to all files that users have access to, including files in Net Folders.

Select from the following options:

Disabled: Disables users’ ability to open files from the Filr app into third-party applications.

All applications: Allows users to open files from the Filr app into any third-party application.

Whitelist: Allows you to specify which third-party applications users can open files into.

If you select this option, you need to provide the Android package name or the iOS bundle ID for the applications that you want to allow:

Click Add, specify the Android package name or iOS bundle ID, then click OK.

For example, the bundle ID for the Pages app on iOS is com.apple.iwork.pages.

The package name for the Gallery app on Android is com.google.android.gallery3d.

HINT:An easy way to find the package name for an Android app is to install the Package Name Viewer app from the Google Play store. This app displays the package name for each app that is currently installed on the device.

To find the bundle ID for an iOS app:

(Conditional) If the app for which you want to location the bundle ID has not yet been synchronized to iTunes from your device, you must sync the device with iTunes.

In your iTunes library on your Mac or PC, open the Mobile Applications folder.

On a Mac, this is usually in your Home directory, at the following location: ~/Music/iTunes/Mobile Applications/

On Windows 7, this is usually at the following location: C:\Users\username\My Music\iTunes\Mobile Applications/

In the Mobile Applications folder, locate the app for which you want the bundle ID.

Create a copy of the file, and re-save the copy as a .zip file.

Unzip the newly created .zip file.

You now see a folder by the name of the application name.

Locate the iTunesMetadata.plist file within the folder and open it in a text editor.

Locate the softwareVersionBundleid key within the file.

The string value below this key is the bundle ID.

If you are using MobileIron to manage devices in your organization, the Open In setting exists both in the Filr administration console and in the MobileIron administration console. This setting should be consistent in both locations (if it is enabled in Filr, it should also be enabled in MobileIron). The one exception to this rule is if you want Open In functionality to be enabled for devices that are being managed by MobileIron and disabled for devices that are not being managed by MobileIron. To achieve this, you can enable this setting in MobileIron and disable it in Filr. In this case, only devices that are being managed by MobileIron are able to use Open In functionality; devices that are not being managed by MobileIron are not able to use Open In functionality.

For more information about using MobileIron with Filr, see Section 13.3.3, Configuring MobileIron to Manage the Filr App.

Click OK.

If you have set individual and group settings for the Filr mobile app, you can change those settings back to the global settings for the individual users and groups.

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click User Accounts.

The Manage Users page is displayed.

Select the check boxes next to the names of the users or groups for whom you want to configure the mobile app, then click More > Mobile Application Settings.

The Configure User Mobile Application Settings page is displayed.

To change the desktop application settings back to the global settings for the selected users, select Use global settings.

Click OK.

13.3 Managing Mobile Devices

You can manage the Filr application on users’ mobile devices with either MobileIron or ZENworks Mobile Management (ZMM).

Section 13.3.1, Key-Value Pairs

Section 13.3.2, Configuring ZMM to Manage the Filr App

Section 13.3.3, Configuring MobileIron to Manage the Filr App

Section 13.3.4, Managing Mobile Devices with Filr

13.3.1 Key-Value Pairs

Key-value pairs allow you to populate user login information and set configuration options, such as whether the Filr app allows for opening into other apps or copying information to other apps.

Depending on your MDM solution, the key-value pairs listed here might not be necessary for setting configuration options. For example, if you are using MobileIron as your MDM solution, you can set configuration options for opening into third-party apps by using the MobileIron interface.

Table 13-1 Filr Key-Value Pairs

Key

Value

server

Specify the URL of your Filr site. For example, filr.acme.com.

username

Specify $USERID$ to cause MobileIron to automatically populate the app with the user’s MobileIron user ID

Alternatively, you can specify an individual user’s user ID.

password

Specify $PASSWORD$ to cause MobileIron to automatically populate the app with the user’s MobileIron password.

Alternatively, you can specify an individual user’s password.

allowOpenIn

Specify 1 as the value if you have disabled Open In or Send To support for the mobile apps in the Filr administration console, but you want to allow the Filr secure app to integrate with other secure apps.

A value of 1 indicates that users can open Filr files into any secure app.

A value of 2 allows you to designate specific apps that users can open Filr files into. You do this by creating a whitelist of apps using the openInWhitelist key.

openInWhitelist

Specify 1 as the value if you want to allow the Filr secure app to integrate with only the specific secure apps that you designate. To designate apps for the whitelist, specify the applications’ bundle ID (for iOS apps) and package name (for Android apps) in a comma-delimited list.

In order for the openInWhitelist values to be recognized, the value for the allowOpenIn key must be set to 2.

An easy way to find the package name for an Android app is to install the Package Name Viewer app from the Google Play store. This app displays the package name for each app that is currently installed on the device.

To find the bundle ID for an iOS app:

(Conditional) If the app for which you want to location the bundle ID has not yet been synchronized to iTunes from your device, you must sync the device with iTunes.

In your iTunes library on your Mac or PC, open the Mobile Applications folder.

On a Mac, this is usually in your Home directory, at the following location: ~/Music/iTunes/Mobile Applications/

On Windows 7, this is usually at the following location: C:\Users\username\My Music\iTunes\Mobile Applications/

In the Mobile Applications folder, locate the app for which you want the bundle ID.

Create a copy of the file, and re-save the copy as a .zip file.

Unzip the newly created .zip file.

You now see a folder by the name of the application name.

Locate the iTunesMetadata.plist file within the folder and open it in a text editor.

Locate the softwareVersionBundleid key within the file.

The string value below this key is the bundle ID.

allowCutCopy

Specify 1 as the value if you want users to be able to copy information from the Filr app and paste it into other apps.

13.3.2 Configuring ZMM to Manage the Filr App

IMPORTANT:ZENworks Mobile Management (ZMM) can be used with the iOS and Android Filr mobile apps with the following version requirements:

Android requirements: Filr mobile app 1.0.3 or later with Android 2.3 or later.

iOS requirements: Filr mobile app 1.0.4 or later with iOS 7.1 or later.

For information about how to configure ZMM to manage the Filr app, see Novell Filr in the ZENworks Mobile Management 2.9.x Organization Administration Guide.

13.3.3 Configuring MobileIron to Manage the Filr App

Supported Features

Adding the Filr App to MobileIron

Pre-Populating Fields for Filr Login

Configuring Data Loss Prevention Policies

Distributing the Filr App to Devices

Supported Features

When using MobileIron to manage the Filr app, the following features are supported:

iOS Supported Features

Android Supported Features

iOS Supported Features

Populate the Server IP Address field for login

Populate the User ID field for login

Open In support to allow or disallow users to open files in other applications

If you are using MobileIron to manage devices in your organization, the Open In setting exists both in the Filr administration console and in the MobileIron administration console. This setting should be consistent in both locations (if it is enabled in Filr, it should also be enabled in MobileIron). The one exception to this rule is if you want Open In functionality to be enabled for devices that are being managed by MobileIron and disabled for devices that are not being managed by MobileIron. To achieve this, you can enable this setting in MobileIron and disable it in Filr. In this case, only devices that are being managed by MobileIron are able to use Open In functionality; devices that are not being managed by MobileIron are not able to use Open In functionality.

For information about how to configure this option in Filr, see Section 13.1, Configuring Mobile Device Access for All Users and Section 13.2, Configuring Mobile Device Access for Individual Users and Groups.

Android Supported Features

Populate the Server URL field for login

Populate the User ID field for login

Populate the User Password field for login

Adding the Filr App to MobileIron

Adding the Android Filr App

Adding the iOS Filr App

Adding the Android Filr App

To add the Android Filr app to MobileIron, you need to upload the .apk file and then apply the Android label to the application:

Download the .apk file for the Filr mobile app from the Novell downloads site.

Upload the file to MobileIron.

In the MobileIron Admin Portal, click the Apps tab.

On the App Distribution Library tab, in the Select Platform drop-down list, select the platform for the app that you want to add. For example, if you are uploading the Filr mobile app for Android, select Android.

Click Add App.

The Add App Wizard is displayed.

Click Next, then specify the following information:

Distribution Type: Select In-house App.

Silently Install: If your device supports a silent install, you can select Yes. If the device does not support a silent install or you are unsure, select No.

App Upload: Browse to and select the .apk file that you downloaded in Step 1.

Click Next, then specify the following information:

App Name: Novell Filr is already specified for you. This cannot be changed.

Display Version: The version is already specified for you. This cannot be changed.

Code Version: The version is already specified for you. This cannot be changed.

Description: Specify a short description for the app.

Override URL: For information about this feature, see the blue information icon next to this field.

Featured: Select whether you want to feature this app.

Category: Select the category that most closely matches the app. You can add a new category as described in the dialog box.

Click Next, then click Browse to upload any screen shots that you have for the app.

The mandatory image size is displayed in the dialog box.

Click Finish to close the Add App Wizard.

Apply the Android label to your application:

From the App Distribution Library tab on the Apps tab, select the Novell Filr app that you just created, then click Actions > Apply To Label.

The Apply To Label dialog box is displayed.

Select the Android label, then click Apply > OK.

Adding the iOS Filr App

To add the iOS Filr app to MobileIron, you need to import it from the Apple Appstore and then apply the iOS label to the application:

Import the app from the Apple Appstore.

In the MobileIron Admin Portal, click the Apps tab.

On the App Distribution Library tab, in the Select Platform drop-down list, select iOS.

Click App Store Import.

The App Store Search dialog box is displayed.

In the App Name field, type Novell Filr.

In the App Store field, select the country appropriate to your location.

Click Search.

Click Import next to the Novell Filr app, then click OK after it is imported.

Close the App Store Search dialog box.

From the App Distribution Library tab on the Apps tab, click the Edit icon next to the Novell Filr app that you just imported.

The Edit App for iOS dialog box is displayed.

Make any desired changes to the app details and icon, then click Save.

Apply the iOS label to your application:

From the App Distribution Library tab on the Apps tab, select the Novell Filr app that you just created, then click Actions > Apply To Label.

The Apply To Label dialog box is displayed.

Select the iOS label, then click Apply > OK.

Pre-Populating Fields for Filr Login

You can pre-populate the fields on the Filr login screen for users in your system by configuring the Filr key-value pairs in MobileIron. You can pre-populate the server URL and user ID fields for both the iOS and Android apps. For the Android app, you can also pre-populate the user password field.

You accomplish this within MobileIron by modifying the app configuration for Android, and by creating a new app configuration for iOS.

Modifying the Android Filr App Configuration for MobileIron

Creating the iOS Filr App Configuration for MobileIron

Key-Value Pairs

Modifying the Android Filr App Configuration for MobileIron

In the MobileIron Admin Portal, click the Policies & Configs tab.

On the Configuration tab, in the Name column, click the name of the Filr configuration for the Filr app that you uploaded, as described in Adding the Android Filr App.

Click Edit.

The Modify AppConnect App Configuration dialog is displayed.

Specify the following information:

Name: Provide a name for the configuration, or keep the default.

Description: (Optional) Provide a description for the configuration, or keep the default.

Application: Select Novell Filr from the drop-down list.

In the App-specific Configurations section, keep or remove the key-value pairs that are shown in Table 13-2, Filr Key-Value Pairs. Key-value pairs that remain in the table represent the information that will be pre-populated for Filr login.

Click Save.

Creating the iOS Filr App Configuration for MobileIron

In the MobileIron Admin Portal, click the Policies & Configs tab.

On the Configuration tab, click Add New > AppConnect > Configuration.

The New AppConnect App Configuration dialog box is displayed.

Specify the following information:

Name: Provide a name for the configuration, such as Filr iOS Configuration.

Description: (Optional) Provide a description for the configuration.

Application: Specify the Filr iOS bundle ID, which is com.novell.vibefilr.

In the App-specific Configurations section, click the Plus icon to add a new field to the key-value pair table; you can then specify the key-value pair to be included in the configuration. The key-value pairs that you can add are shown in Table 13-2, Filr Key-Value Pairs. Key-value pairs that you add to the table represent the information that will be pre-populated for Filr login.

Click Save.

Key-Value Pairs

Table 13-2 Filr Key-Value Pairs

Key

Value

server

Specify the URL of your Filr site. For example, filr.acme.com.

username

Specify $USERID$ to cause MobileIron to automatically populate the app with the user’s MobileIron user ID.

Alternatively, you can specify an individual user’s user ID.

password

Specify $PASSWORD$ to cause MobileIron to automatically populate the app with the user’s MobileIron password.

Alternatively, you can specify an individual user’s password.

Configuring Data Loss Prevention Policies

You can configure policies to restrict users from performing actions that could lead to data loss. For iOS devices, you can restrict users’ ability to print, copy or paste, and open in other apps. For Android, you can restrict users’ ability to take a screen capture.

You accomplish this within MobileIron by modifying the app policy for Android, and by creating a new app policy for iOS.

Modifying the Android Filr App Policy for MobileIron

Creating the iOS Filr App Policy for MobileIron

Modifying the Android Filr App Policy for MobileIron

In the MobileIron Admin Portal, click the Policies & Configs tab.

In the Name column, click the name of the Filr policy for the Filr app that you uploaded, as described in Adding the Android Filr App.

Click Edit.

The Modify AppConnect App Container Policy dialog is displayed.

Specify the following information:

Name: Provide a name for the policy, or keep the default.

Description: (Optional) Provide a description for the policy, or keep the default.

Application: Select Novell Filr from the drop-down list.

In the Data Loss Prevention Policies section, you can change the following configuration option for Android devices:

Screen Capture: Allow users to take a screen capture from within any AppConnect app (including Filr).

Click Save.

Creating the iOS Filr App Policy for MobileIron

In the MobileIron Admin Portal, click the Policies & Configs tab.

On the Configuration tab, click Add New > AppConnect > Container Policy.

The New AppConnect App Configuration dialog box is displayed.

Specify the following information:

Name: Provide a name for the policy, such as Filr iOS Policy.

Description: (Optional) Provide a description for the policy.

Application: Specify the Filr iOS bundle ID, which is com.novell.vibefilr.

In the Data Loss Prevention Policies section, you can change the following configuration options for iOS devices:

Print: This setting is not honored in the Filr app. There is no printing ability from within the Filr app.

Copy/Paste To: This setting is ignored in this release of the Filr mobile app. Copy/Paste functionality is included in the Open In setting. In other words, you must disable Open In in order to disable Copy/Paste.

Open In: Allow users to use the Open In functionality. If allowed, specify whether users can open into all apps on the device, only into AppConnect apps, or only into a list of apps that you specify.

To specify individual apps via the whitelist option, specify the apps bundle ID. For example, the bundle ID for the Pages app is com.apple.iwork.pages.

Click Save.

Distributing the Filr App to Devices

You need to distribute the Filr app to devices in your organization via MobileIron if this is the first time your organization is using MobileIron with Filr, or any time a new device enters the organization.

It is possible that some users independently download the Filr app from the app store before their device is managed by MobileIron. In this case, you still need to push the app to their device via MobileIron. (These devices will lose any cached or downloaded files within the Filr app after their device becomes managed and the Filr app is pushed to their device.)

13.3.4 Managing Mobile Devices with Filr

You can view users who have accessed your Filr system from a mobile device, and if necessary, wipe all Filr data from the user’s device.

For more information, see Section 20.0, Managing Filr Data for Mobile Devices.

13.4 Understanding Filr Data Security for Mobile Devices

Section 13.4.1, App Security

Section 13.4.2, File Security

13.4.1 App Security

On Android devices, the application itself and cached content are stored on internal storage. Internal storage on Android devices is always secure (unless the device has been rooted contrary to manufacturer recommendations). iOS devices do not have a concept of external storage, so data within the application is always secure.

13.4.2 File Security

Files that are downloaded or opened in third-party apps are by nature less secure than files that remain within the app. On Android devices, downloaded files are stored on the device’s external storage.

It is up to you as the Filr administrator to decide whether to allow users to download files and open them in third-party applications, as described in Section 13.1, Configuring Mobile Device Access for All Users.

In order for downloaded files to remain secure, users should configure their devices to encrypt files. However, not all devices support file encryption. For information about how to enable file encryption on iOS and Android devices, see Encrypting Downloaded Files in the Novell Filr 1.1 Mobile App Quick Start.

14.0 Configuring the Filr Desktop Application to Access Files

The Novell Filr desktop application enables you to work with Filr files on your personal computer. The Novell Filr desktop application synchronizes files from the Filr server with your personal workstation, allowing you to manage Filr files from the file system on your computer. For more information about the Novell Filr desktop application, see the Novell Filr Desktop Application for Windows Quick Start and the Novell Filr Desktop Application for Mac Quick Start.

As a Filr administrator, you must enable file synchronization for the Filr desktop application in order for users to take advantage of this functionality. There are also optional administrative procedures that you might want to perform when configuring the Filr desktop application.

If you make configuration changes, users must log out of the application and log in again in order to see the changes.

IMPORTANT:For optimal performance, users should not configure the Filr desktop application to synchronize more than 35,000 total files, or to synchronize individual files that are larger than 5 GB to their workstations.

Section 14.1, Planning Filr Desktop Application Usage for Your Filr Site

Section 14.2, Configuring the Filr Desktop Application for All Users or for Individual Users and Groups

Section 14.3, Configuring a Separate Web Server to Deploy the Filr Desktop Application

Section 14.4, Updating the Filr Desktop Application

Section 14.5, Distributing the Filr Desktop Application Synchronization Traffic

Section 14.6, Managing the Filr Desktop Application

14.1 Planning Filr Desktop Application Usage for Your Filr Site

Section 14.1.1, Understanding System Load

Section 14.1.2, Understanding Rights Requirements for Installation

14.1.1 Understanding System Load

Depending on your environment and the settings that you choose for the Filr desktop application, the Filr desktop application can put a significant load on your Filr system.

Factors that affect the Filr load:

The number of users in your Filr system

The number of files that users plan to synchronize to their workstations with the Filr desktop application

Whether users have Home folders and how many files are in each user’s Home folder

Home folders are synchronized by default to each user’s workstation

The synchronization schedule that you specify when configuring the Filr desktop application

If your environment is such that the Filr desktop application is likely to place significant load on your Filr system, consider making the Filr desktop application available to only a few hundred users to begin with. After the initial group of users have synchronized all files to their workstations and Filr is running smoothly, make the application available to another set of users. Continue this process until all users in your system are using the Filr desktop application.

For information about how to make the Filr desktop application available to only a subset of users, see Section 14.2.2, Configuring the Filr Desktop Application for Individual Users and Groups.

14.1.2 Understanding Rights Requirements for Installation

Administrator privileges are required when installing the Filr desktop application on user workstations (either through client management software or directly).

14.2 Configuring the Filr Desktop Application for All Users or for Individual Users and Groups

The Filr desktop application allows users to synchronize their Novell Filr files with their personal computers. You can enable this functionality for all users in the Filr system, or for individual users and groups. By default, this functionality is not enabled.

In addition to enabling or disabling this functionality for users, you can also make configuration changes that affect the load that the Filr desktop application puts on your Filr system, as well as make changes that ensure tighter security.

Users need to download, install, and configure the Filr desktop application on their personal computers. For more information, see the Novell Filr Desktop Application for Windows Quick Start and the Novell Filr Desktop Application for Mac Quick Start.

Section 14.2.1, Configuring the Filr Desktop Application for All Users

Section 14.2.2, Configuring the Filr Desktop Application for Individual Users and Groups

14.2.1 Configuring the Filr Desktop Application for All Users

To customize the desktop application experience for your Filr system:

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under System, click Desktop Application.

In the Configure Desktop Application dialog box, select On.

As necessary, configure Filr to allow the Filr desktop application to support the following features:

Access Filr: Allows users to access the Filr site through the Filr desktop application.

NOTE:Depending on the amount of anticipated load that the Filr desktop application will put on your Filr system, you might want to make the application available to users in a staged process. For more information, see Section 14.1, Planning Filr Desktop Application Usage for Your Filr Site.

You must individually enable each Net Folder to be accessed by the Filr desktop application. For information about how to enable Net Folders to be accessed by the Filr desktop application, see Step 11 in Section 8.4, Creating and Managing Net Folders.

Allowing access to the Filr site through the Filr desktop application can be changed on a per-user basis, as described in Section 14.2.2, Configuring the Filr Desktop Application for Individual Users and Groups.

Cache the user’s password: Allows users to enable the Remember password option on the Account Information page in the Novell Filr Console.

This option can be changed on a per-user basis, as described in Section 14.2.2, Configuring the Filr Desktop Application for Individual Users and Groups.

Be deployed: Select this option to make the Filr desktop application available to users. If this option is selected, users can download the Filr desktop application as described in Downloading and Installing the Filr Desktop Application in the Novell Filr 1.1 Desktop Application for Windows Quick Start or the Novell Filr 1.1 Desktop Application for Mac Quick Start. If this option is not selected, the link to download the Filr desktop application is not visible to users.

After you select this option, select from the following methods of deploying the Filr desktop application:

Deploy files contained locally: Select this option to use the Filr server for deploying the Filr desktop application.

If you select this option, no other configuration is necessary for making the Filr desktop application available to users to download.

Deploy files accessed via a URL to another location: (Recommended) Select this option if you want to configure a separate web server to deploy the Filr desktop application. Deploying the desktop application in this way minimizes load on the Filr server.

Select this option if your Filr system is fronted by an L4 or L10 switch.

For information about how to set up a separate web server to deploy the application, see Section 14.3, Configuring a Separate Web Server to Deploy the Filr Desktop Application.

If this option is selected, the available field must be populated with the URL of the web server that you configure for deploying the desktop application.

NOTE:You might want to leave the Be deployed option deselected if you plan to deploy the Filr desktop application to user workstations by using client management software such as Novell ZENworks. The MSI file is available to you if you are planning to deploy the Filr desktop application by using ZENworks. However, when deploying the Filr desktop application with the MSI file, ensure that .NET Framework 4 or 4.5 is also installed on client workstations.

You can access individual download files (including the MSI file) for the Filr desktop application from the Filr downloads page on the Novell Downloads site.

Synchronization every xx Minutes: Specify the interval (in minutes) for how often the Filr desktop application checks the Filr server for changes to files. The default is every 15 minutes. This means that 15 minutes after one synchronization ends, another begins. This lets you control the amount of load that the Filr desktop application puts on the Filr server.

Changes made in the desktop application are automatically synchronized to the server regardless of this setting.

Maximum file size that can be synchronized: Specify the maximum file size (in MB) that can be synchronized between the Filr desktop application and the Filr server.

Click OK.

14.2.2 Configuring the Filr Desktop Application for Individual Users and Groups

Individual user and group settings override global settings. This section describes how to customize the desktop application experience for individual users and groups on your Filr system.

To make the desktop application available to only a subset of users in your system, configure the application for all users, as described in Section 14.2.1, Configuring the Filr Desktop Application for All Users, then restrict access to the users and groups who should not have access to the application, as described in this section.

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click User Accounts.

The Manage Users page is displayed.

Select the check boxes next to the names of the users or groups for whom you want to configure the Filr desktop application, then click More > Desktop Application Settings.

The Configure Desktop Application page is displayed.

To change the desktop application settings for the selected users to be different from the global settings, select Use user settings to allow the desktop application to, then choose from the following options:

Access Filr: Allows users to access the Filr site through the Filr desktop application.

You must individually enable each Net Folder to be accessed by the Filr desktop application. For information about how to enable Net Folders to be accessed by the Filr desktop application, see Step 11 in Section 8.4, Creating and Managing Net Folders.

Cache the user’s password: Allows users to enable the Remember password option on the Account Information page in the Novell Filr Console.

Click OK.

If you have set individual and group settings for the Filr desktop application, you can change those settings back to the global settings for the individual users and groups.

In Filr, click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click User Accounts.

The Manage Users page is displayed.

Select the check boxes next to the names of the users or groups for whom you want to configure the Filr desktop application, then click More > Desktop Application Settings.

The Configure Desktop Application page is displayed.

To change the desktop application settings back to the global settings for the selected users, select Use global settings.

Click OK.

14.3 Configuring a Separate Web Server to Deploy the Filr Desktop Application

By default, the Filr server is configured to deploy the Filr desktop application and to provide the auto-update information. As a best practice to minimize load on the Filr server, we recommend that you set up a separate web server and configure it to deploy the desktop application and provide the auto-update information.

Set up a web server as a host for the Filr desktop application auto-update information.

This web server must be set up so that it does not require authentication.

Download and extract the NovellFilrAutoUpdate.tgz file onto the web server. (You can download the NovellFilrAutoUpdate.tgz file from the Filr downloads page on the Novell Downloads site.)

This compressed file contains all of the files required for installing the Filr desktop application.

For example, if you download this file to the Desktop, extracting the file results in the following directories:

https://web_server_DNS_or_IP/filr/desktop/novellfilr/osx

https://web_server_DNS_or_IP/filr/desktop/novellfilr/windows

(Conditional) If you have Windows XP workstations in your environment that will run Filr, you need to rename a couple files so that they are used instead of the default files.

IMPORTANT:Because Microsoft .NET Framework 4.5 is not supported on Windows XP, the NovellFilrSetup-winxp-version.exe and novellfilr/windows/x86/version-winxp.json files are provided for organizations that have workstations that are running Windows XP. This version of Filr contains Microsoft .NET Framework 4.0 instead of 4.5.

The only difference between this version of Filr and the version that runs Microsoft .NET Framework 4.5 is that the Filr tab is not available from the Windows Properties dialog box.

Rename the version.json file to version-x86.json (or any other name of your choosing).

Rename the version-winxp.json file to version.json.

(Optional) Ensure that you can access the files on your web server through one of the following methods:

From a browser

For example:

http://web_server_address/desktopap/novellfilr/windows/x64/version.json

From a command line

For example, from the Web server, SSH to the Filr appliance and run the following command:

#wget http://web_server_address/desktopapp/novellfilr/windows/x64/version.json

Configure the Filr desktop application as described in Section 14.2.1, Configuring the Filr Desktop Application for All Users.

In the Deploy files accessed via a URL to another location field, specify one of the following URLs, depending on whether your web server is configured with secure HTTP:

https://web_server_DNS_or_IP:8443/file_path/desktopapp/

http://web_server_DNS_or_IP:8080/file_path/desktopapp/

Click OK.

14.4 Updating the Filr Desktop Application

You can update the Filr desktop application on users’ workstations by updating the application on the Filr server or on a separate web server. You can also distribute the application using the .msi file in conjunction with client management software such as Novell ZENworks. However, there are certain dependencies that are not installed by default when using the .msi file. These are described in the following sections:

Section 14.4.1, Understanding Missing Dependencies Related to Updating the Filr Desktop Application by Using the MSI File

Section 14.4.2, Updating the Filr Desktop Application on the Filr Server or on a Separate Web Server

14.4.1 Understanding Missing Dependencies Related to Updating the Filr Desktop Application by Using the MSI File

If you use the .msi file to distribute the Filr desktop application to user workstations (by using client management software such as Novell ZENworks), you need to install the following items to each user workstation, independent of the Filr software:

One of the following versions of Microsoft .NET Framework, depending on whether there are workstations in your environment that are dependent on Windows XP:

Microsoft .NET Framework 4.5 (Applies to 64-bit Windows and Mac workstations. You should use this version if workstations in your environment are not dependent on Windows XP.)

The ability for users to view the Novell Filr tab on the Windows Properties dialog (as described in Viewing Filr Properties for a File or Folder in the Novell Filr Desktop Application for Windows Quick Start) is available only with Microsoft .NET Framework 4.5.

Microsoft .NET Framework 4.0 (Can be used with all supported operating systems; however, because Microsoft .NET Framework 4.5 is not supported on Windows XP, this is the only option for workstations that are running Windows XP.)

Microsoft Visual C++ 2013 Redistributable Package (Applies to all workstations except for Windows XP workstations)

IMPORTANT:Workstations running Windows XP cannot see the Novell Filr tab on the Windows Properties dialog (as described in Viewing Filr Properties for a File or Folder in the Novell Filr Desktop Application for Windows Quick Start).

This is because Microsoft .NET Framework 4.5 is not supported on Windows XP.

14.4.2 Updating the Filr Desktop Application on the Filr Server or on a Separate Web Server

If you have configured your Filr system to deploy the Filr desktop application (as described in Section 14.2, Configuring the Filr Desktop Application for All Users or for Individual Users and Groups), or if you have configured a separate web server to deploy the Filr desktop application (as described in Section 14.3, Configuring a Separate Web Server to Deploy the Filr Desktop Application), you can replace the Filr desktop application download files on the Filr back end so that users are prompted to update the Filr desktop application on their individual workstations.

The files to use for updating the Filr desktop application are the same for all versions of Windows, except for Windows XP.

To download the Filr desktop application:

Before downloading the new version of the Filr desktop application, you need to preserve your existing Filr desktop installation. This will allow you to roll back to the older version if the need arises.

To preserve your existing installation of the Filr desktop application, rename the existing directory on the server so that the old files are not overwritten when the new version is downloaded:

Change to the directory where the files are being stored. For example:

cd /opt/novell/filr/apache-tomcat/webapps/desktopapp/

This is the default location if the Filr desktop application is installed on the Filr server.

Rename the novellfilr directory to novellfilr.bak. For example:

mv novellfilr novellfilr.bak

(Optional) If you need to roll back to the older version of the Filr desktop application, you can do so by deleting the new novellfilr directory and renaming the novellfilr.bak directory to novellfilr.

Download and extract the NovellFilrAutoUpdate.tgz file onto your Filr server or separate web server.

tar xvzf NovellFilrAutoUpdate.tgz

You can download the NovellFilrAutoUpdate.tgz file from the Novell Downloads site.

If you are installing onto the Filr server, download and extract this file to the opt/novell/filr/apache-tomcat/webapps/desktopapp/ directory.

cd /opt/novell/filr/apache-tomcat/webapps/desktopapp

This compressed file contains all of the files required for updating the Filr desktop application.

Run the following commands on the extracted directory to appropriately modify the file permissions:

chown -R wwwrun:www novellfilr/

chmod -R g-w novellfilr/

chmod -R o-rwx novellfilr/

(Conditional) If you have Windows XP workstations in your environment that will run Filr, you need to rename a couple files so that they are used instead of the default files.

IMPORTANT:Because Microsoft .NET Framework 4.5 is not supported on Windows XP, the NovellFilrSetup-winxp-version.exe and novellfilr/windows/x86/version-winxp.json files are provided for organizations that have workstations that are running Windows XP. This version of Filr contains Microsoft .NET Framework 4.0 instead of 4.5.

The only difference between this version of Filr and the version that runs Microsoft .NET Framework 4.5 is that the Filr tab is not available from the Windows Properties dialog box.

Rename the version.json file to version-x86.json (or any other name of your choosing).

If you do not rename version-x86.json, Windows XP users will be prompted to upgrade the Filr desktop application, but the upgrade will fail and Windows XP users will continue to be prompted to upgrade.

Rename the version-winxp.json file to version.json.

14.5 Distributing the Filr Desktop Application Synchronization Traffic

The Filr desktop application can cause a large amount of traffic on the Filr servers. To prevent the Filr desktop application synchronization process or the Filr site from becoming slow, you can distribute the Filr desktop application traffic among dedicated Filr servers with your load balancer or reverse proxy server.

For example, if you have a Filr installation with four servers, you could dedicate one server to handle the Filr desktop application traffic and use the remaining three servers to serve the main Filr Web application. This configuration prevents an unusual spike in the Filr desktop application traffic from impacting the Filr site.

You can distribute the Filr desktop application traffic differently, depending on whether you want traffic from all applications (not just the Filr desktop application) that are accessing Filr to be handled in the same way, or whether you want the Filr desktop application traffic to be handled independently from each other and from other applications that are accessing Filr.

Section 14.5.1, Distributing Filr Desktop Application Traffic Separately from Other Applications

Section 14.5.2, Distributing Filr Desktop Traffic in Conjunction with Other Applications

Section 14.5.3, Load Balancer and Reverse Proxy Server Configuration

14.5.1 Distributing Filr Desktop Application Traffic Separately from Other Applications

You can configure your load balancer or reverse proxy server to distribute Filr desktop application synchronization traffic among multiple Filr servers. Filr desktop application traffic is independent of traffic from other applications that are accessing Filr.

NOTE:Your load balancer or reverse proxy server must be able to make routing decisions based on the request headers.

Configure your load balancer or reverse proxy server to use the user agent request header. For the Filr desktop application, the request header begins with NovellFilrDesktop. For example: User-Agent: NovellFilrDesktop/1.0 (Windows NT 6.1; Python/2.7.0; en_US) suds/0.4.

For specific information on how to configure the load balancer or reverse proxy server, see Section 14.5.3, Load Balancer and Reverse Proxy Server Configuration.

14.5.2 Distributing Filr Desktop Traffic in Conjunction with Other Applications

You can configure your load balancer or reverse proxy server to distribute Filr desktop application synchronization traffic (along with traffic coming from all other applications that use the Filr Web service interface) among multiple Filr servers.

Examples of other applications that use the Filr Web service interface:

GroupWise client SOAP requests

All other SOAP requests from third-party applications

NOTE:Your load balancer or reverse proxy server must be able to make routing decisions based on the HTTP URL path.

Configure your load balancer or reverse proxy server to send all HTTP requests for the Filr desktop application (designated by the following paths /ssf/ws/TeamingServiceV1 and /rest/*) to one pool of Filr servers.

All other requests are sent to another pool of Filr servers.

For specific information on how to configure the load balancer or reverse proxy server, see Section 14.5.3, Load Balancer and Reverse Proxy Server Configuration.

14.5.3 Load Balancer and Reverse Proxy Server Configuration

For information on how to configure a reverse-proxy server for your Filr site, see Section 1.8, Changing Reverse Proxy Configuration Settings.

14.6 Managing the Filr Desktop Application

You can manage the Filr desktop application on users’ workstations with client management software such as Novell ZENworks.

NOTE:The ability to manage the Filr desktop application is available only with Filr desktop 1.0.2 and later.

You can customize the installation and control whether Windows Explorer is restarted.

Section 14.6.1, Customizing the Installation for the Filr Desktop Application

Section 14.6.2, Controlling Windows Explorer Restart

14.6.1 Customizing the Installation for the Filr Desktop Application

You can customize the installation process of the Filr desktop application for your organization in the following ways:

Configure default values for each installation option of the Filr desktop application. (Users can change these default values when configuring the Filr desktop application.)

Auto-configure all values for each installation option of the Filr desktop application. (Users specify only their user name and password when configuring the Filr desktop application; users cannot change the default values during initial configuration.)

Disallow users from modifying configuration options in the Filr desktop application. (Users cannot change the default values during initial configuration, and cannot modify the values via the Filr console after initial configuration.)

NOTE:This does not prevent users from manually modifying configuration settings in the registry or file system.

The following sections describe how to make these customizations.

Configuring Default Values

Enabling Auto-Configuration

Disallowing User Configuration

Modifying the Filr Desktop Configuration

Configuring Default Values

You can configure the default values for each installation option of the Filr desktop application. Users can change these default values when configuring the Filr desktop application.

You accomplish this on Windows by creating registry values, and on Mac by adding properties to the application’s Info.plist file.

Windows: Access the following location where you will create registry values:

\\HKLM\Software\Novell\Filr

Mac: Access the Info.plist file where you will add properties. This file is usually in the following location:

/Applications/Novell Filr/Contents/Info.plist

Create Windows registry values and add properties to the Info.plist file for the values for which you want to configure defaults.

The following table displays the available options for configuring default values.

Table 14-1 Default Value Configuration Options

Windows Registry Value Name

Value Type

Mac Property Name

Value Type

Supports Env Variables

Default Value

Default Server URL

REG_SZ

FilrDefaultServerURL

string

No

https://

Default Username

REG_SZ

FilrDefaultUsername

string

Yes

%USERNAME%

or

$USER

Default Account Name

REG_SZ

FilrDefaultAccountName

string

No

Hostname in server URL

Default Remember Password

REG_SZ (“true” or “false”)

FilrDefaultRememberPassword

<true/> or <false/>

No

false

Default Sync Dir

REG_SZ

FilrDefaultSyncDir

string

Yes

%USERNAME%\Filr

or

$USER\Filr

Default Start On Login

REG_SZ (“true” or “false”)

FilrDefaultStartOnLogin

<true/> or <false/>

No

true

Default Folder List

REG_MULTI_SZ

FilrDefaultFolderList

Array of strings

No

My Files

Shared with Me

Enabling Auto-Configuration

After you have configured default values for the Filr desktop application installation, you can enable auto-configuration. When auto-configuration is enabled, users cannot change the default values during initial configuration. (Users specify only their user name and password when configuring the Filr desktop application.)

You accomplish this on Windows by creating registry values, and on Mac by adding properties to the application’s Info.plist file.

Windows: Access the following location where you will create registry values:

\\HKLM\Software\Novell\Filr

Mac: Access the Info.plist file where you will add properties. This file is usually in the following location:

/Applications/Novell Filr/Contents/Info.plist

Create Windows registry values and add properties to the Info.plist file for the values for which you want to configure defaults.

The following table displays the available options for auto-configuration.

Table 14-2 Auto-Configuration Options

Windows Registry Value Name

Value Type

Mac Property Name

Value Type

Supports Env Variables

Default Value

Auto Configure

REG_SZ (“true” or “false”)

FilrAutoConfigure

<true/> or <false/>

No

false

Disallowing User Configuration

You can disallow users from modifying configuration options in the Filr desktop application. This means that users cannot change the default values during initial configuration, and they cannot modify the values via the Filr console after initial configuration.

NOTE:This does not prevent users from manually modifying configuration settings in the registry or file system.

You accomplish this on Windows by creating registry values, and on Mac by adding properties to the application’s Info.plist file.

Windows: Access the following location where you will create registry values:

\\HKLM\Software\Novell\Filr

Mac: Access the Info.plist file where you will add properties. This file is usually in the following location:

/Applications/Novell Filr/Contents/Info.plist

Create Windows registry values and add properties to the Info.plist file for the values for which you want to configure defaults.

The following table displays the available options for disallowing user configuration.

Table 14-3 Disallow User Configuration Options

Windows Registry Value Name

Value Type

Mac Property Name

Value Type

Supports Env Variables

Default Value

Allow User Configuration

REG_SZ (“true” or “false”)

FilrAllowUserConfiguration

<true/> or <false/>

No

true

Modifying the Filr Desktop Configuration

If you have configured the Filr desktop application with auto-configuration (as described in Enabling Auto-Configuration), you can modify the configuration settings:

Change the options in the registry or .plist file, then restart the Filr desktop application.

When the Filr desktop application starts, it detects that the default settings have changed and applies the new settings.

NOTE:The one exception is that the synchronization directory cannot be changed after the Filr desktop application has been configured.

14.6.2 Controlling Windows Explorer Restart

The Filr desktop application for Windows includes overlay icons that do not appear until Windows Explorer is restarted. Prior to the Filr 1.0.2 desktop application, the Windows MSI always restarted Windows Explorer during the installation (except when using the No UI option). Because restarting Explorer might not always be desirable, the Filr 1.0.2 desktop application allows you to override the default.

The Windows installer supports four basic user interface levels for installing MSI files:

No UI (“msiexec /qn”)

Windows Explorer is never restarted when using this option.

Basic UI (“msiexec /qb”)

Reduced UI (“msiexec /qr”)

Full UI (“msiexec /qf” or simply “msiexec”, since this is the default)

For example, use the following command to install the MSI with basic UI and without restarting Windows Explorer:

msiexec /qb /i NovellFilr-version.msi RESTARTEXPLORER=no

15.0 Configuring Filr to Support WebDAV on Windows 7

WebDAV is a standard collaborative editing and file management protocol. Novell Filr relies on the WebDAV protocol to edit files, as described in Editing Files with Edit-in-Place in the Novell Filr 1.1 Web Application User Guide.

If your Filr users are running a supported client operating system other than Windows 7, editing files works without any problems. Windows 7 must be configured to use a self-signed certificate in order to work with WebDAV.

The information in this section assumes that your environment requires the use of Microsoft Office. If your environment does not require the use of Microsoft Office, see Section 15.1.4, Using OpenOffice as Your Document Editor for WebDAV.

Section 15.1, Planning Your WebDAV Implementation

Section 15.2, Editing Files with Edit-in-Place Functionality

Section 15.3, Mapping a Filr Folder as a WebDAV Folder

Section 15.4, Configuring Windows 7 to Use a Self-Signed Certificate with Filr

Section 15.5, Allowing Basic Authentication over an HTTP Connection on Windows 7

15.1 Planning Your WebDAV Implementation

Section 15.1.1, Understanding the Different Types of WebDAV Authentication Methods

Section 15.1.2, Using WebDAV When Filr Is Fronted by NetIQ Access Manager

Section 15.1.3, Meeting Filr Certificate Requirements on Windows 7

Section 15.1.4, Using OpenOffice as Your Document Editor for WebDAV

15.1.1 Understanding the Different Types of WebDAV Authentication Methods

Novell Filr supports the following WebDAV authentication methods:

Basic Authentication: The user name and password are encoded with the Base64 algorithm. The Base64-encoded string is unsafe if transmitted over HTTP, and therefore should be combined with SSL/TLS (HTTPS).

For more information, see Choosing Basic Authentication.

If you plan to use Basic authentication over a non-secure connection (HTTP), you need to modify the registry on each Windows 7 client workstation, as described in Section 15.5, Allowing Basic Authentication over an HTTP Connection on Windows 7. The registry modification allows users to use WebDAV with Microsoft Office 2007. However, Microsoft Office 2010 is not supported.

Digest Authentication: Applies MD5 cryptographic, one-way hashing with nonce values to a password before sending it over the network. This option is more safe than Basic Authentication when used over HTTP.

For more information, see Choosing Digest Authentication.

15.1.2 Using WebDAV When Filr Is Fronted by NetIQ Access Manager

If your Filr system is fronted by NetIQ Access Manager, you must use the designated WebDAV authentication method:

Product Fronting Filr

Designated Authentication Method

NetIQ Access Manager

If your Filr installation is fronted by NetIQ Access Manager, as described in Section 1.8, Changing Reverse Proxy Configuration Settings, you must use basic authentication for your WebDAV implementation.

During the Filr appliance configuration, select basic when configuring WebDAV, as described in Section 1.12, Changing WebDAV Authentication Configuration Settings.

15.1.3 Meeting Filr Certificate Requirements on Windows 7

If you are using WebDAV functionality (Edit-in-Place) with Filr on Windows 7 with a secure (HTTPS) connection, ensure that the Filr server certificate requirements are met. If all of the requirements are not met, various Windows 7 services fail.

Filr server certificate requirements:

You must use a trusted server certificate that is accepted by Windows 7. This server certificate must be signed by a trusted certificate authority (CA) such as VeriSign or Equifax.

NOTE:You can use a self-signed certificate only if the certificate is imported into the Trusted Root Certification Authorities store on each Windows 7 client computer.

The trusted server certificate must be issued to a name that exactly matches the domain name of the URL that you are using it for. This means that it must match the URL of your Filr site.

The date range for the trusted server certificate must be valid. You cannot use an expired server certificate.

15.1.4 Using OpenOffice as Your Document Editor for WebDAV

If your environment does not require the use of Microsoft Office, you might consider migrating users to OpenOffice 3.1 or later as their document editor. Using OpenOffice 3.1 or later provides seamless integration between the WebDAV server and Filr, regardless of which operating system is being used.

15.2 Editing Files with Edit-in-Place Functionality

You can leverage Edit-in-Place functionality to edit files by using tools such as OpenOffice and Microsoft Office. For information on how to edit files in Filr with Edit-in-Place functionality, see Editing Files with Edit-in-Place in the Novell Filr 1.1 Web Application User Guide.

If you are using Edit-in-Place functionality over HTTP, no additional setup is required. However, if you are using Edit-in-Place functionality over HTTPS on Windows 7, ensure that you have met the Filr server certificate requirements, as described in Section 15.1.3, Meeting Filr Certificate Requirements on Windows 7.

For more information about editing Filr documents in Microsoft Office with Windows 7, see “TID 7006717: Document editing failure with Windows 7 and Microsoft Office” in the Novell Support Knowledgebase.

15.3 Mapping a Filr Folder as a WebDAV Folder

Mapping a Novell Filr folder as a WebDAV folder on the client computer allows access to Filr files from a WebDAV-compliant file navigation tool such as Windows Explorer or Nautilus. For information on how to map a Filr folder, see Adding Files to a Folder through WebDAV in the Novell Filr 1.1 Web Application User Guide.

When you map a Filr folder as a WebDAV folder on Windows 7, consider the following:

When mapping a Filr folder over HTTPS, ensure that all Filr server certificate requirements are met, as described in Section 15.1.3, Meeting Filr Certificate Requirements on Windows 7.

15.4 Configuring Windows 7 to Use a Self-Signed Certificate with Filr

Configuring Windows 7 to use a self-signed certificate with Novell Filr is a two-step process. The first step is accomplished by the Filr administrator on the Filr server, and the second step is accomplished by each Filr user on his or her Windows 7 workstation.

Section 15.4.1, Administrator Configuration Responsibilities

Section 15.4.2, User Configuration Responsibilities

15.4.1 Administrator Configuration Responsibilities

Ensure that the following prerequisites are met in order to configure Windows 7 to use a self-signed certificate with Filr:

The self-signed server certificate must be issued to a name that exactly matches the domain name of the URL that you use it for. This means that it must match the URL of your Filr site.

The date range for the trusted server certificate must be valid. You cannot use an expired server certificate.

15.4.2 User Configuration Responsibilities

Each Windows 7 workstation user must import the self-signed certificate of the Filr server into the Trusted Root Certification Authorities store.

In a controlled corporate environment where the system administrator sets up each client workstation before use, this certificate can be preinstalled on each Windows 7 workstation. This can minimize end-user error and frustration.

Launch the Internet Explorer browser.

Click Tools > Internet Options to display the Internet Options dialog box.

Click the Security tab, then select Trusted sites.

Click Sites.

In the Add this website to the zone field, specify the URL of the Filr web site, then click Add > Close.

Browse to your Filr site.

(Conditional) If a prompt displays indicating that there is a problem with this web site’s security certificate, complete the following steps:

Click Continue to this website (not recommended).

Click Certificate Error at the right of the address bar, then click View certificates.

Click Install Certificate, then click Next in the wizard.

Select Place all certificates in the following store.

Click Browse, browse to and select Trusted Root Certification Authorities, then click OK.

In the wizard, click Next, then click Finish.

(Conditional) If a Security Warning dialog box displays, click Yes.

Click OK to close the Certificate Import Wizard.

Click OK to close the Certificate window.

Shut down all instances of the Internet Explorer browser, then restart the browser.

Browse to the Filr site. You should no longer see the certificate error message.

If you continue to see the certificate error message, the server’s self-signed certificate might not match the site URL, as described in Section 15.4.1, Administrator Configuration Responsibilities.

15.5 Allowing Basic Authentication over an HTTP Connection on Windows 7

You can modify the Windows registry to allow Basic authentication to WebDAV over an HTTP connection. This registry change allows users to use Microsoft Office 2007 on the Windows 7 operating system, but does not allow them to use Microsoft Office 2010. Microsoft Office 2010 is not supported with Basic Authentication over an HTTP connection.

To modify the Windows registry:

On each Windows 7 workstation, click Start > Run, then specify regedit in the Open field.

Click OK.

In the Registry Editor window, navigate to the following registry entry:

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlset\services\WebClient\Parameters\BasicAuthLevel

Change the value of this registry entry to 2.

Navigate to the Services interface, then restart the WebClient service.

16.0 Managing Document HTML Conversions

Filr caches document HTML conversions by default. Because of this, you need to understand what document HTML conversions are and how to delete them if they begin consuming large amounts of disk space. Also, you can install additional fonts on the Filr server to improve HTML rendering.

Section 16.1, Understanding Document HTML Conversions

Section 16.2, Manually Deleting Saved Document Conversions

Section 16.3, Installing Additional Fonts to Improve Document HTML Rendering

16.1 Understanding Document HTML Conversions

Filr converts documents to HTML to enable users to quickly view documents without the need of a separate editing or viewing application. (For information about how users can view files in HTML, see Viewing the File in Your Web Browser in the Novell Filr 1.1 Web Application User Guide.)

Document conversions are saved and stored in the Filr cache store, in the /cachefilestore directory. After a document conversion has been saved, Filr does not need to convert the document to HTML the next time a user views the file in HTML, if the file has not been changed since it was last converted. This process of saving and re-using HTML conversions places less load on the Filr system.

To conserve disk space, the contents of the /cachefilestore/converted_html_files directory are deleted when the Filr appliance is restarted at a time when the /cachefilestore/converted_html_files directory exceeds 10 GB. If the Filr appliance is restarted and the contents of the /cachefilestore/converted_html_files directory do not exceed 10 GB, the contents of the directory are not deleted.

For information about how to manually delete document conversions, see Section 16.2, Manually Deleting Saved Document Conversions.

16.2 Manually Deleting Saved Document Conversions

You might want to delete saved document conversions if your Filr system is running out of disk space or if existing document conversions become out of date or corrupted for any reason. After the document conversions have been deleted, they are re-created the next time a document is viewed in HTML.

Document conversions are automatically deleted when the Filr appliance is restarted at a time when the /cachefilestore/converted_html_files directory exceeds 10 GB, as described in Section 16.1, Understanding Document HTML Conversions.

To manually delete all saved document conversions:

Purge the /cachefilestore directory.

Re-create the /cachefilestore directory at the same location.

16.3 Installing Additional Fonts to Improve Document HTML Rendering

Users can view files in an HTML view either from the Filr web client (as described in Viewing the File in Your Web Browser in the Novell Filr 1.1 Web Application User Guide) or from the Filr mobile app. This is often the easiest way for users to view a file in Read-Only mode.

To improve the way fonts are displayed when they are rendered into HTML, you can install additional fonts on your Filr server.

IMPORTANT:The fonts that you apply will get overwritten when you update your Filr system. You must re-apply the fonts as described in this section after you update Filr.

You can upload Microsoft TrueType fonts as well as fonts for viewing Asian characters.

Section 16.3.1, Uploading Microsoft TrueType Fonts to the Filr Server

Section 16.3.2, Uploading Chinese Fonts to the Filr Server

16.3.1 Uploading Microsoft TrueType Fonts to the Filr Server

Log in as root to the Filr command prompt.

Type the following command to navigate to the fonts directory, then press Enter:

cd /filrinstall/fonts

Install the supported RPM files by typing the following command, then press Enter:

rpm -ivh *.rpm

The RPM files are now installed on the Filr server.

Run the script to retrieve the fonts by typing the following command, then press Enter:

sh fetchmsttfonts-11.1-5.7.10-fetchmsttfonts.sh.txt

The fonts are downloaded from Sourceforge and installed on your Filr server.

16.3.2 Uploading Chinese Fonts to the Filr Server

Log in as root to the Filr command prompt.

Launch YaST2 control center by typing the following command:

YaST2

Under System, select Language, then press Enter.

On the Languages page, tab down to the Secondary Languages section, then scroll to and select Traditional Chinese.

Select OK.

Configure a software repository that has access to a SLES 11 server. For example, you can insert a SLES 11 SP3 DVD into the workstation where Filr is running, or point to a URL of a SLES 11 SP3 repository.

In the YaST2 control center, under Software, select Software Repositories.

Select Add, then select the method by which you want to connect to the repository.

For example, select DVD if you want to insert a SLES 11 SP3 DVD into the workstation.

In the YaST2 control center, under Software, select Software Management.

Search for MozillaFirefox-translations, then install this package.

Verify that the following packages were installed:

FZFangSong
FZHeiTi
FZKaiTi
FZSongTi
ttf-arphic-gbsn00lp
ttf-arphic-gkai00mp
ttf-arphic-ukai
ttf-arphic-uming
yast2-trans-zh_CN
kde3-i18n-zh_CN
kde4-l10n-zh_CN
libreoffice-help-zh-CN
libreoffice-l10n-zh-CN
sles-installquick_zh_CN
translation-update-zh_CN

17.0 Managing a Multiple-Language Filr Site

Section 17.1, Accommodating Multiple Languages

17.1 Accommodating Multiple Languages

Section 17.1.1, Understanding the Filr Site Default Language

Section 17.1.2, Changing the Default Language on the Login Page

17.1.1 Understanding the Filr Site Default Language

There can be only one default language for the entire Novell Filr site.

When you create Filr users, you can select a locale for each user, which determines the language of each personal profile. However, when users who speak various languages work together on a Filr site, they can often see interface text that is not in their preferred language. For example:

Standardized text such as Home Workspace, Global Workspaces, Personal Workspaces, and Team Workspaces in the Workspace tree

Standardized group names, such as All Users

Login page

You cannot change standardized group names, such as All Users. Although the Filr login page can be displayed in only one language, you can change the page’s default language. You must be logged in as the Filr administrator.

17.1.2 Changing the Default Language on the Login Page

The language of the Filr login page is decided by the Guest user account. Because of this, you can display only one language for your entire Filr site in the login page.

To change the language of the Guest user account and change the language that is displayed on the Filr login page:

Navigate to the Guest profile.

On the Profile page, click Edit.

The User page is launched.

In the Locale drop-down list, select the language that you want to be displayed on your login page.

Users who log in as Guest view the Filr site in the language that you select.

Click OK.

Each Filr user can change the language on a per-user basis by changing the Locale setting in the user profile, as described in Modifying Your Profile in the Novell Filr 1.1 Web Application User Guide.

III Maintaining the Filr Site

Section 18.0, Managing Users

Section 19.0, Managing Groups

Section 20.0, Managing Filr Data for Mobile Devices

Section 21.0, Managing Folders and Files

Section 22.0, Managing Disk Space Usage with Data Quotas and File Restrictions

Section 23.0, Managing Email Configuration

Section 24.0, Managing the Lucene Index

Section 25.0, Backing Up Filr Data

Section 26.0, Monitoring the Filr System

18.0 Managing Users

As time passes on your Novell Filr site, users come and go, resulting in the need for periodic maintenance activities.

Section 18.1, Synchronizing Users and Groups from an LDAP Directory

Section 18.2, Creating a New Local User

Section 18.3, Listing Filr Users

Section 18.4, Viewing User Properties

Section 18.5, Renaming a Filr User

Section 18.6, Deleting a Filr User

Section 18.7, Disabling Filr User Accounts

Section 18.8, Managing Local Users and Groups by Importing Profile Files

Section 18.9, Understanding the XSS Security Filter

18.1 Synchronizing Users and Groups from an LDAP Directory

Unless you are planning a very small Novell Filr site, the most efficient way to create Filr users is to synchronize initial user information from your network directory service (NetIQ eDirectory, Microsoft Active Directory, or other LDAP directory service) after you have installed the Filr software. Over time, you can continue to synchronize user information from the LDAP directory to your Filr site.

IMPORTANT:The following limitations apply when synchronizing user information to Filr from an LDAP directory service:

Filr performs one-way synchronization from the LDAP directory to your Filr site. If you change user information on the Filr site, the changes are not synchronized back to your LDAP directory.

Filr does not support multi-value attributes. If your LDAP directory contains multi-value attributes, Filr recognizes only the first attribute. For example, if your LDAP directory contains multiple email addresses for a given user, only the first email address is synchronized to Filr.

Users that are imported to Filr via LDAP are always authenticated to Filr via the LDAP source. If the LDAP source is unavailable for any reason, the LDAP-imported users cannot log in to Filr.

For information about known issues with LDAP synchronization in Filr, see LDAP Synchronization Issues in the Novell Filr 1.1 Readme.

Table 18-1 shows user synchronization rates based on samples from test labs at Novell. Results may vary depending on hardware, LDAP server, database, and network topology.

Table 18-1 LDAP Synchronization Performance Rate Samples

Number of Users Synchronized

Time Required to Complete Synchronization

1,000

20 seconds

2,500

44 seconds

10,000

2 minutes

20,000

5 minutes

50,000

13 minutes

To synchronize users and groups from LDAP:

Log in to Filr as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under System, click LDAP.

Section 18.1.1, Configuring an LDAP Connection

Section 18.1.2, Configuring LDAP Synchronization

Section 18.1.3, Restricting Local User Accounts from Logging In

Section 18.1.4, Previewing and Running the LDAP Synchronization

Section 18.1.5, Viewing Synchronization Results

Section 18.1.6, Deleting an LDAP Configuration

18.1.1 Configuring an LDAP Connection

You can configure one or more LDAP connections to your directory.

You should never configure multiple LDAP connections to point to the same location on the same LDAP directory. If you need a failover solution, you should use a load balancer.

To configure an LDAP connection:

On the LDAP Configuration page, click the LDAP Servers tab.

To create a new LDAP connection, click Add.

or

To modify an existing LDAP connection, click the URL of the connection in the Server URL column of the provided table.

On the LDAP Server Configuration dialog box, specify the information on each tab, as described in the following sections:

Server Information

Users

Groups

Server Information

On the LDAP Servers tab, click Add.

The LDAP Server Configuration dialog box is displayed.

Specify the following information on the Server Information tab:

LDAP Server URL: In order to synchronize initial user information, Filr needs to access an LDAP server where your directory service is running. You need to provide the host name of the server, using a URL with the following format:

ldap://hostname

If the LDAP server requires a secure SSL connection, use the following format:

ldaps://hostname

If the LDAP server is configured with a default port number (389 for non-secure connections or 636 for secure SSL connections), you do not need to include the port number in the URL. If the LDAP server uses a different port number, use the following format for the LDAP URL:

ldap://hostname:port_number
ldaps://hostname:port_number

If the LDAP server requires a secure SSL connection, additional setup is required. You must complete the steps in Section 29.2, Securing LDAP Synchronization to import the root certificate for your LDAP directory into the Java keystore on the Filr server before you configure Filr for LDAP synchronization.

User DN (proxy user for synchronizing users and groups): Filr needs the user name and password of a user on the LDAP server who has sufficient rights to access the user information stored there:

Directory Service

Required Rights

eDirectory

[All Attribute Rights] - Compare & Read

[Entry Rights] - Browse (on the container containing the users that need to be imported into Filr)

Active Directory

Any authenticated user can be used as the proxy user as long as there are no read restrictions in place on the Organizational Unit (OU) that contains the users

Required rights if OU read restrictions are in place:

Read (on the Organizational Unit containing the users that need to be imported into Filr)

Ensure that This object & all descendant objects is selected in the Security tab under the advanced options.

You need to provide the fully qualified, comma-delimited user name, along with its context in your LDAP directory tree, in the format expected by your directory service.

Directory Service

Format for the User Name

eDirectory

cn=username,ou=organizational_unit,o=organization

Active Directory

cn=username,ou=organizational_unit,dc=domain_component

Password: Password for the User DN.

Directory Type: The directory type that you are connecting to. Select eDirectory or Active Directory.

GUID attribute: Depending on the directory type that you chose, this field is populated with the name of the LDAP attribute that uniquely identifies a user or group. For eDirectory, this value is GUID. For Active Directory, this value is objectGUID. This attribute always has a unique value that does not change when you rename or move a user in the LDAP directory. It ensures that Filr modifies the existing user instead of creating a new user when the user is renamed or moved in the LDAP directory.

If this attribute is not set and you rename or move a user in the LDAP directory, Filr assumes that the new name (or the new location of the same name) represents a new user, not a modified user, and creates a new Filr user.

For example, suppose you have a Filr user named William Jones. If William changes his name to Bill, and you make that change in the LDAP directory, Filr creates a new user named Bill Jones.

If you want to map users to a different attribute, select Other in the drop-down list, specify the name of the LDAP attribute, then click OK. Before you do this, ensure that the attribute that you use is a binary attribute. For example, the cn attribute cannot be used because it is not a binary attribute.

Filr account name attribute: The attribute you choose here depends on the directory type you selected in the Directory type drop-down list. If you selected eDirectory in the Directory type drop-down list, you see cn and Other as options for this attribute. If you selected Active Directory or Other in the Directory type drop-down list, you see sAMAccountName, cn, and Other as options for this attribute. If you select Other as the value for this attribute, you are prompted to enter the name of the LDAP attribute. The value of the attribute that you enter is used for the Filr account name.

The Filr account name attribute has two purposes:

Used as the Filr user name when the user is first provisioned from LDAP. The value of this attribute must be unique.

During Filr login, Filr uses this attribute to locate the user in the LDAP directory and then tries to authenticate as that user.

LDAP directories differ in the LDAP attribute used to identify a User object. Both eDirectory and Active Directory might use the cn (common name) attribute. A more sure alternative for Active Directory is to use the sAMAccountName attribute. Other LDAP directories might use the uid (unique ID) attribute, depending on the structure and configuration of the directory tree.

You might need to consult with your directory administrator in order to determine which attribute is best to use. In some cases where not all users are imported successfully, you might need to set up two LDAP sources pointing to the same LDAP server and have each source use a different value for the LDAP Attribute Used for Filr Name. For example, set up one LDAP source and use cn as the Filr account name attribute. Then set up a separate source to the same LDAP server and use sAMAccountName as the Filr account name attribute.

In addition to the attributes already mentioned in this section, other LDAP attributes can be used for the Filr account name attribute, as long as the attribute is unique for each User object. For example, the mail LDAP attribute on User objects could be used to enable Filr users to log in to the Filr site by using their email addresses.

NOTE:Because the login name becomes part of the user’s workspace URL, the at sign (@) in the email address is replaced with an underscore (_) in the workspace URL because @ is not a valid character in a URL.

Continue with Users.

Users

On the LDAP Server Configuration page, click the Users tab, then click Add.

The LDAP Search dialog box is displayed.

Specify the following information n the LDAP search dialog box:

Base DN: Filr can find and synchronize initial user information from User objects located in one or more containers in the LDAP directory tree. A container under which User objects are located is called a base DN (distinguished name). The format you use to specify a base DN depends on your directory service.

Directory Service

Format for the User Container

eDirectory

ou=organizational_unit,o=organization

Active Directory

ou=organizational_unit,dc=domain_component

Container names cannot exceed 128 characters. If the container name exceeds 128 characters, users are not provisioned.

HINT:You can use the Browse icon next to the Base DN field to browse the LDAP directory for the base DN that you want to use.

Filter: To identify potential Filr users, Filr by default filters on the following LDAP directory object attributes:

Person

orgPerson

inetOrgPerson

You can add attributes to the user or group filter list if necessary. You can use the following operators in the filter:

| OR (the default)

& AND

! NOT

You might find it convenient to create a group that consists of all the users that you want to set up in Filr, regardless of where they are located in your LDAP directory. After you create the group, you can use the following filter to search for User objects that have the specified group membership attribute:

IMPORTANT:If you create a filter to search for a specific group to find users, users that are located in any sub-groups to that group are not synchronized.

When synchronizing against Active Directory, you can create a filter that synchronizes users in sub-groups by using the following rule object identifier (OID):

<attribute name>:<matching rule OID>:=<value>

Be sure to include the parentheses in your filter.

Directory Service

Filter to search for User objects

eDirectory

(groupMembership=cn=group_name,ou=organizational_unit,o=organization)

Active Directory

(memberOf=cn=group_name,ou=organizational_unit,dc=domain_component)

Search subtree: Select whether you want Filr to search for users in containers underneath the base DN (that is, in subtrees).

Home Directory Net Folder Configuration: Select from the following options for creating Home directories for users in the Filr system:

For more information about Home directories, see Section 8.2, Configuring Home Folders for Display in the My Files Area.

Use the following custom criteria: Select this option to specify the Net Folder Server and path where user Home directory information is located.

In the Net Folder Server field, select the Net Folder Server that will be used with the Home directory Net Folders that will be created automatically when a user logs in. If you have not already created Net Folder Servers, or if you need to create a new one, click Create Net Folder Server. For information about how to create a Net Folder Server, see Section 8.3, Configuring and Managing Net Folder Servers.

In the Relative path field, specify the path that points to user home directories on the selected server.

You must use a replaceable parameter in the Relative path field. Replaceable parameters are entered by using the following syntax: %attributeName%. Replaceable parameters are evaluated dynamically each time a user logs in to Filr, and are replaced with the value of the given LDAP attribute. For example, if each users’ Home directory is associated with the cn value in the LDAP directory, specify the following in the Relative path field: \Home\%cn%.

The server path must be entered using UNC syntax.

Use the LDAP Home directory attribute: Select this option to use the LDAP Home directory attribute. This attribute is detected during the LDAP synchronization process. If the search context of the LDAP synchronization contains an OES or Windows server that has a Home folder attribute associated with at least one user, a Net Folder Server is ready to be configured immediately after running the LDAP synchronization process. (For more information about configuring the Net Folder Server, see Section 8.3, Configuring and Managing Net Folder Servers.)

Use the specified LDAP attribute: Select this option to specify the name of the LDAP attribute that contains the home directory information. The attribute must be of type String. The attribute must contain a string that is a UNC path, with one of the following forms:

\\server\volume\path

\\server\share\path

\\server\share

Don’t create a Home directory Net Folder: Select this option if you do not want user Home directories to be created at the time that users are imported into the Filr system.

Click OK.

Continue with Groups.

Groups

On the LDAP Server Configuration page, click the Groups tab, then click Add.

The LDAP Search dialog box is displayed.

Specify the following information on the LDAP Search dialog box:

Base DN: Filr can find and synchronize initial user information from group objects located in one or more containers in the LDAP directory tree. A container under which User objects are located is called a base DN (distinguished name). The format you use to specify a base DN depends on your directory service.

Directory Service

Format for the User Container

eDirectory

ou=organizational_unit,o=organization

Active Directory

ou=organizational_unit,dc=domain_component

Container names cannot exceed 128 characters. If the container name exceeds 128 characters, users are not provisioned.

HINT:You can use the Browse icon next to the Base DN field to browse the LDAP directory for the base DN that you want to use.

Filter: To import groups based on information in your LDAP directory, Filr filters on the following LDAP directory object attributes:

group

groupOfNames

groupOfUniqueNames

You can add attributes to the group filter list if necessary. You can use the following operators in the filter:

| OR (the default)

& AND

! NOT

IMPORTANT:Be sure to include the parentheses in your filter.

Directory Service

Filter to search for Group objects

eDirectory

(groupMembership=cn=group_name,ou=organizational_unit,o=organization)

Active Directory

(memberOf=cn=group_name,ou=organizational_unit,dc=domain_component)

Search subtree: Select whether you want Filr to search for groups in containers beneath the base DN (that is, in subtrees).

Click OK, then click OK again to save the LDAP server configuration.

Continue with Section 18.1.2, Configuring LDAP Synchronization.

18.1.2 Configuring LDAP Synchronization

When you configure LDAP synchronization, you configure user synchronization options, groups synchronization options, and the synchronization schedule.

NOTE:Because the synchronization options apply to all LDAP configurations for the Filr system, you cannot have customized synchronization settings for each LDAP configuration.

Configuring User Synchronization Options

Configuring Group Synchronization Options

Configuring the Synchronization Schedule

Configuring User Synchronization Options

On the LDAP Configuration page, click the Users tab.

Specify the following information for enabling and configuring user synchronization from your LDAP directory to your Filr site:

Register LDAP user profiles automatically: Select this option to automatically add LDAP users to the Filr site. However, workspaces are not created until users log in to the Filr site for the first time.

Synchronize user profiles: Select this option to synchronize user information whenever the LDAP directory information changes after initial Filr site setup. The attributes that are synchronized are the attributes that are found in the map box on the Server Information tab on the LDAP Server Configuration page.

Filr synchronizes the following attributes from the LDAP directory:

First name

Last name

Phone number

Email address

Description

For user accounts provisioned from LDAP that are no longer in LDAP: Because deleting user accounts cannot be undone, Novell recommends that you leave Disable account selected.

For more information about disabled users in Filr, see Section 18.7, Disabling Filr User Accounts.

Select Delete account only if you are certain that you want to delete users that exist on the Filr site but do not exist in your LDAP directory. If you do decide to delete user accounts, you can select the option Also delete associated user workspaces and content to remove obsolete information along with the user accounts.

IMPORTANT:A deleted user cannot be undeleted; deleting a user is permanent and is not reversible.

If you are sure that you want to automatically delete users that are not in LDAP, this option is designed to be used under the following conditions:

You have deleted users from your LDAP directory and you want the LDAP synchronization process to also delete them from Filr.

In addition to the users synchronized from LDAP, you create some Filr users manually, as described in Section 18.2, Creating a New Local User, and you want the LDAP synchronization process to delete the manually created users.

Use the following time zone when creating new users: Select this option to set the time zone for user accounts that are synchronized from the LDAP directory into your Filr site. The time zone list is grouped first by continent or region, optionally by country or state, and lastly by city.

Common selections for United States time zones:

Time Zone

Continent/City

Pacific Time

America/Los Angeles

Mountain Time

America/Denver

Central Time

America/Chicago

Eastern Time

America/New York

Use the following locale when creating new users: Select this option to set the locale for user accounts that are synchronized from the LDAP directory into your Filr site. The locale list is sorted alphabetically by language.

Continue with Configuring Group Synchronization Options.

Configuring Group Synchronization Options

On the LDAP Configuration page, click the Groups tab.

Specify the following information for enabling and configuring user and group synchronization from your LDAP directory to your Filr site:

Register LDAP group profiles automatically: Select this option to automatically add LDAP groups to the Filr site.

Synchronize group profiles: Select this option to synchronize group information, such as the group description, to the Filr site whenever this information changes in LDAP.

Synchronize group membership: Select this option so that the Filr group includes the same users (and possibly groups) as the group in your LDAP directory. If you do not select this option, and you make changes to group membership in the LDAP directory, the changes are not reflected on your Filr site.

If users have rights to files on your OES or Windows file systems through group membership, you must select this option to synchronize group membership to Filr. If you do not synchronize group membership, users who have access rights to files through membership in a group might not have the appropriate access rights in Filr.

Delete groups that were provisioned in LDAP but are no longer in LDAP: Select this option to delete groups that exist on the Filr site but do not exist in your LDAP directory. Use this option under the following conditions:

You have deleted groups from your LDAP directory and you want the LDAP synchronization process to delete them from Filr as well.

In addition to the groups synchronized from LDAP, you create some Filr groups manually, as described in Section 9.0, Creating Groups of Users, and you want the LDAP synchronization process to delete the manually created groups.

Continue with Configuring the Synchronization Schedule.

Configuring the Synchronization Schedule

This section describes how to set a schedule for the LDAP synchronization.

When planning the schedule, take into account how often your LDAP directory user (and, optionally, group) information changes and the server resources required to perform the synchronization for the number of users (and, optionally, groups) that you have.

On the LDAP Configuration page, click the Synchronization Schedule tab.

Select Enable schedule to enable a schedule for the LDAP synchronization to occur.

Select whether to run the LDAP synchronization every day, or select specific days of the week when you want it run (for example, on Monday, Wednesday, and Friday).

You can choose to have it run once a day at a specified time (for example, at 2:00 a.m.), or you can set a time interval, so that it is run multiple times each day (for example, every four hours). The smallest time interval you can set is .25 hours (every 15 minutes).

(Conditional) If you want to restrict local users from logging in to the Filr site, continue with Section 18.1.3, Restricting Local User Accounts from Logging In.

Continue with Section 18.1.4, Previewing and Running the LDAP Synchronization.

18.1.3 Restricting Local User Accounts from Logging In

By default, Filr allows locally created users to log in the Filr site. This section describes how to configure Filr to allow only users that are synchronized via LDAP to log in.

On the LDAP Configuration page, click the Local User Accounts tab.

Leave Allow log in for local user accounts (i.e. user accounts not in LDAP) to allow users who you have created locally to log in to the Filr site.

For more information about creating users, see Section 18.2, Creating a New Local User.

Continue with Section 18.1.4, Previewing and Running the LDAP Synchronization.

18.1.4 Previewing and Running the LDAP Synchronization

Before you run the LDAP synchronization, it is a good idea to preview the synchronization so that you are aware what changes will occur when you run the live synchronization.

Previewing LDAP Synchronization

Running the LDAP Synchronization

Previewing LDAP Synchronization

After you have configured the LDAP connection, you can see a preview of what the synchronization results will be. This allows you to see beforehand the users and groups that will be added or deleted, as well as the users that will be disabled, before you run the actual synchronization.

To preview the LDAP synchronization:

On the LDAP Configuration page, click the LDAP Servers tab, then click Preview sync.

Users and groups that will be modified by running the LDAP sync are shown, along with information about how they will be modified (whether they will be added, modified, deleted, or disabled).

(Optional) Specify a user or group in the Filter List field to filter the list of users and groups to be synchronized.

or

Click the drop-down arrow next to the Filter List field, then select the type of users or groups that you want to display, then click OK. (For example, select to display added users, modified users, modified groups, and so forth.)

After you review the results of the synchronization, click Close, then continue with Running the LDAP Synchronization.

Running the LDAP Synchronization

After you have run the preview of the LDAP synchronization (as described in Running the LDAP Synchronization), you are ready to run the live synchronization.

On the LDAP Configuration page, click the LDAP Servers tab, then click Sync All.

Users and groups that have been modified by running the LDAP sync are shown, along with information about how they have been modified (whether they were added, modified, deleted, or disabled).

(Optional) Specify a user or group in the Filter List field to filter the list of users and groups to be synchronized.

or

Click the drop-down arrow next to the Filter List field, then select the type of users or groups that you want to display. (For example, select to display added users, modified users, modified groups, and so forth.)

Click Close.

18.1.5 Viewing Synchronization Results

You can view the synchronization results of the most recent LDAP synchronization for the current browser session. If you perform a synchronization, log out of Filr, and then log in again, you cannot view the results of the LDAP synchronization for your previous session.

To view the results for a previous synchronization:

On the LDAP Configuration page, click the LDAP Servers tab.

Click Show sync results.

18.1.6 Deleting an LDAP Configuration

IMPORTANT:If you delete an LDAP configuration and you have selected the option to delete user accounts that are provisioned from LDAP that are no longer in LDAP, all users that were synchronized to the Filr site through that LDAP configuration are deleted from the Filr site. (For more information about the configuration option concerning user accounts provisioned from LDAP, see Configuring User Synchronization Options.)

On the LDAP Configuration page, click the LDAP Servers tab.

Select the LDAP configuration that you want to delete, then click Delete.

18.2 Creating a New Local User

You can manually create users on the Filr site, rather than synchronizing user information from an LDAP directory. Users created in this way are local users, and are not added to your LDAP directory. For more information about synchronizing users with an LDAP directory, see Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

To create a local Filr user:

Log in to Filr as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

In the Management section, click Users.

Click New.

The User page is displayed.

Provide the user’s information in the User page, then click OK.

18.3 Listing Filr Users

On the Novell Filr site, you can view a comprehensive list of all the Filr users.

Click the User List icon in the masthead.

All of the users are displayed in the main viewing window.

You can use this page in the following ways:

Section 18.3.1, Navigating the User List

Section 18.3.2, Navigating to a User’s Individual Profile

Section 18.3.3, Modifying the Title

18.3.1 Navigating the User List

You can navigate the user list by using the filter in the upper-right corner of the list.

18.3.2 Navigating to a User’s Individual Profile

You can use the user list to navigate to a user’s individual profile.

In the user list, in the Full Name column, click the name of the user whose profile you want to navigate to.

For information about how to navigate to a user’s My Files area, or any other area in Filr, see Section 21.0, Managing Folders and Files.

18.3.3 Modifying the Title

Filr enables you to modify the name of the User List. This name is displayed when navigating the Workspace tree (as described in Section 21.1, Navigating the Workspace Tree) and when performing a search.

Click the User List icon in the masthead.

Click the Configure icon next to the folder name, then click Rename Workspace.

In the New Name field, specify a new name for the workspace, then click OK.

18.4 Viewing User Properties

User properties show you important information about any user in your Filr system, such as profile, account, Home directory, data quota, sharing, and Net Folder information.

To view user properties:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Settings, click Users.

Click the drop-down arrow next to the user whose properties you want to view, then click User Properties.

18.5 Renaming a Filr User

Novell Filr users are identified by name (first, middle, last) and by user ID. User names are used to identify personal profiles. User IDs are used for logging in. You can change users’ names, but not their user IDs. The way you change a user’s name depends on how you created the user.

Section 18.5.1, Renaming a Filr User from LDAP

Section 18.5.2, Renaming a Local Filr User

18.5.1 Renaming a Filr User from LDAP

If you are synchronizing user information from an LDAP directory, as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory, you change a user’s first, middle, or last name by updating it in the LDAP directory. The updated information then synchronizes to the Filr site according to the schedule you have established for LDAP synchronization. If you change a user’s first, middle, or last name by updating information on the Filr site, the change is not synchronized back to the LDAP directory, so the two sources of user information can be out of sync.

18.5.2 Renaming a Local Filr User

If you manually create Filr users on the Filr site, rather than synchronizing user information from an LDAP directory, you can change users’ names (first, middle, last) on the Filr site.

When a user logs in to the Filr site for the first time, the user’s personal profile is created. Before a user logs in, he or she does not have a personal profile. Filr enables site administrators to manually rename both types of users.

Renaming Users Who Have Logged In to Filr

Renaming Users Who Have Not Logged In to Filr

NOTE:Filr does not allow you to change a user ID after the user account has been created.

Renaming Users Who Have Logged In to Filr

To rename a user who has previously logged in to the Filr site and therefore has a personal profile:

Navigate to the user’s personal profile.

Click Edit on the Profile page.

The User page is displayed.

Modify the First Name, Middle Name, and Last Name fields as desired.

Click OK.

Renaming Users Who Have Not Logged In to Filr

To rename a user who has not previously logged in to the Filr site and therefore does not have a personal profile:

Click the User List icon in the masthead.

Click the name of the user who you want to rename, then click Modify.

The User page is displayed

Modify the First Name, Middle Name, and Last Name fields as desired.

Click OK.

18.6 Deleting a Filr User

When users no longer need access to your Novell Filr site, you have two options to revoke their access to the Filr site: disabling or deleting their Filr user accounts.

IMPORTANT:Novell recommends that you disable user accounts instead of deleting them. When you delete a user account, the account can never be re-activated. If there is the slightest possibility that the user might return to your Filr site, disable the user account rather than delete it. Disabled accounts do not count as a licensed user. For information on how to disable a user, see Section 18.7, Disabling Filr User Accounts.

The you delete a user depends on how you originally created the user:

Section 18.6.1, Deleting a Local User

Section 18.6.2, Deleting an LDAP User

Section 18.6.3, Recovering User Workspaces from the Trash

18.6.1 Deleting a Local User

Any user account that has been created manually (not created by the LDAP synchronization process) can be deleted as described in this section. To delete a user account that was created by the LDAP synchronization process, see Section 18.6.2, Deleting an LDAP User.

Users must have logged in to the Filr site at least one time in order to delete the user workspace. However, you can delete the user object in conjunction with the user workspace at any time (users do not need to have logged in).

IMPORTANT:If you delete user accounts that were created by the LDAP synchronization process without following the instructions in Section 18.6.2, Deleting an LDAP User, new users with the same name are created the next time the users log in or the next time the LDAP synchronization occurs.

When deleting local users, you should be familiar with the following terms:

User Workspaces: User workspaces are a physical location in the Filr system where information related to the user is stored. When a user’s workspace is deleted, all information within the user’s My Files area is deleted. The user, however, can still access the Filr system.

User Object: User objects refer to the actual user in the Filr system. When a user object is deleted, the user’s profile is deleted, and the user cannot access the Filr system.

When you delete a user object, the following user information is deleted and cannot be recovered:

All profile information, including profile pictures (User Object)

Access controls to workspaces and folders (User Object)

When you delete a user workspace, the following user information is deleted and cannot be recovered:

Files added to the user's Personal Storage area (User Workspace)

Shares made to other users from the Personal Storage area (User Workspace)

To delete local users (the user workspace only or the user workspace and the user account):

Log in to Filr as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

In the Management section, click Users.

Select the users whose accounts you want to delete, then click Delete.

The Delete Users dialog box is displayed.

Depending on whether users who are being deleted have Home folders, you can select from the following options:

If users being deleted do not have Home folders, the following options are displayed:

Move user workspaces to trash: Moves user workspaces to the trash. Does not delete the user objects. You can restore the user workspaces from the trash, as described in Section 18.6.3, Recovering User Workspaces from the Trash.

Delete user workspaces: Does not delete the user objects, but deletes the user workspaces. The user workspaces cannot be restored. If the user logs back in, a new workspace is created as if the user is new to the Filr system.

Delete user objects: Deletes the user objects and the user workspaces from the Filr system. The users no longer exist in the Filr system and cannot log in. Neither the user objects nor the user workspaces can be restored.

If all users being deleted have Home folders, the following option is displayed:

Delete all selected user objects: Deletes the user objects and the user workspaces from the Filr system. The users no longer exist in the Filr system and cannot log in. Neither the user objects nor the user workspaces can be restored. If the user logs back in to Filr, a new workspace is created as if the user is new to the Filr system.

If some users being deleted have Home folders and others do not, the following options are displayed:

Move local user workspaces with only Personal Storage to the trash and delete others: Moves user workspaces that contain no Home folder to the trash. Deletes user workspaces that do contain a Home folder. Does not delete the user objects. You can restore user workspaces that were moved to the trash, as described in Section 18.6.3, Recovering User Workspaces from the Trash.

Delete user objects whose workspaces are deleted: Deletes the user objects that are associated with the user workspaces that are being deleted. The users no longer exist in the Filr system and cannot log in. Neither the user objects nor the user workspaces can be restored.

Delete all user workspaces: Deletes all user workspaces, regardless of whether user workspaces contain a Home folder. Does not delete the user objects. The user workspaces cannot be restored. If the user logs back in, a new workspace is created as if the user is new to the Filr system.

Delete user objects: Deletes the user objects and the user workspaces from the Filr system. The users no longer exist in the Filr system and cannot log in. Neither the user objects nor the user workspaces can be restored.

Click Yes to confirm the deletion.

18.6.2 Deleting an LDAP User

User accounts can be synchronized to the Filr site with an LDAP directory. Although you can delete Filr user accounts, Novell recommends that you disable them, as described in Section 18.7, Disabling Filr User Accounts.

If you decide to delete Filr user accounts, it is safer to manually delete than to delete them through the LDAP synchronization process. Because user accounts that are deleted cannot be recovered, ensure that you know exactly which users you are deleting; the only way to be sure is to manually delete them.

Manually Deleting User Accounts That Are Being Synchronized through LDAP

Configuring LDAP to Automatically Delete User Accounts

Manually Deleting User Accounts That Are Being Synchronized through LDAP

The following method is preferred for deleting user accounts from the Filr site if the accounts are being synchronized from an LDAP directory:

In your LDAP directory, modify the User objects that you want to delete from the Filr site so that the User objects no longer match the LDAP synchronization criteria that you previously set.

For information about setting LDAP synchronization criteria, see Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

In Filr, manually delete the user accounts, as described in Section 18.6.1, Deleting a Local User.

Configuring LDAP to Automatically Delete User Accounts

IMPORTANT:Although it is possible to configure LDAP synchronization to automatically delete Filr users and workspaces, this should be avoided because it might result in unwanted deletion of users. For example, if the LDAP context is entered incorrectly and none of the users match the incorrect LDAP context, all of the users are permanently deleted.

For more information about how to configure the LDAP synchronization to automatically delete Filr users and workspaces, see For user accounts provisioned from LDAP that are no longer in LDAP:.

18.6.3 Recovering User Workspaces from the Trash

If you have deleted user workspaces, you can restore the workspaces from the trash.

IMPORTANT:It is not possible to restore user objects that have been deleted. This section describes how to restore user workspaces. The process for deleting user workspaces and/or user objects is described in Section 18.6.1, Deleting a Local User.

Log in to Filr as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

In the Management section, click Users.

Click the Trash icon , located in the upper-right corner of the page.

Select the user’s workpsace and My Files Storage folder (if applicable) that you want to restore, then click Restore.

18.7 Disabling Filr User Accounts

Novell recommends that you disable user accounts instead of deleting them. When you delete a user account, the account can never be re-activated. If there is the slightest possibility that the user might return to your Filr site, disable the user account rather than delete it.

Disabled accounts do not count as a licensed user.

The way to disable a user account differs depending on whether the user was created in Filr or in an LDAP directory and then synchronized to Filr.

Section 18.7.1, Disabling a Local User Account

Section 18.7.2, Disabling an LDAP User Account

18.7.1 Disabling a Local User Account

Log in to Filr as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

In the Management section, click Users.

Select the user accounts that you want to disable, then click More > Disable.

Names of disabled users are displayed in grey.

To enable local user accounts after they have been disabled:

Log in to Filr as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

In the Management section, click Users.

Select the user accounts that you want to enable, then click More > Enable.

18.7.2 Disabling an LDAP User Account

If users are being synchronized from an LDAP directory, you must disable the accounts directly from the LDAP directory. User accounts that are disabled in the LDAP directory are disabled in Filr at the next LDAP synchronization.

For more information about LDAP synchronization in Filr, see Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

18.8 Managing Local Users and Groups by Importing Profile Files

You can manage local users and groups by importing profile files that contain user or group information in XML format. This is a good way to simultaneously perform multiple actions when you are not using LDAP.

You can perform the following actions:

Create or modify users

Delete users

Create or modify groups

To manage local users and groups by importing profile files:

Log in to Filr as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

In the Management section, click Users.

Click Import Profiles.

Click Choose File, then navigate to and select the file that contains user or group profile information in XML format.

Ensure that the format of your file matches the format that is shown in the provided sample file. To view the provided sample file, click View a Sample File in the Import Files tab.

Click OK.

18.9 Understanding the XSS Security Filter

Cross-site scripting (XSS) is a client-side computer attack that is aimed at Web applications. Because XSS attacks can pose a major security threat, Novell Filr contains a built-in security filter that protects against XSS vulnerabilities.

The XSS security filter protects the Filr site from XSS in two key areas:

Text and HTML fields in entries and folders

Uploaded HTML files

19.0 Managing Groups

Creating groups is a useful way to manage and maintain users throughout your Filr site. For more information about why it is important to create groups, see Section 9.0, Creating Groups of Users.

Section 19.1, Creating Groups

Section 19.2, Modifying Groups

Section 19.3, Deleting Groups

Section 19.4, Managing How Group Names Are Displayed during Name Completion

19.1 Creating Groups

For information on how to create groups, see Section 9.0, Creating Groups of Users.

19.2 Modifying Groups

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Groups.

Click the name of the group that you want to modify.

Modify the title, description, and group membership, then click OK.

For more information about editing static and dynamic group membership, see Section 9.0, Creating Groups of Users.

19.3 Deleting Groups

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Groups.

Select the group that you want to delete, then click Delete.

19.4 Managing How Group Names Are Displayed during Name Completion

Certain fields throughout the Filr site employ name completion (or Type-to-Find) functionality. For example, when you share an item in Filr and you begin typing the name of a user or group in the Share with field, names of users or groups that match what you have typed so far appear in a drop-down list.

In the Type-to-Find drop-down list, Filr includes the group name or group title, as well as secondary information about the group (either the group description or the Fully Qualified DN). This secondary information helps distinguish between multiple groups that have the same name.

Filr allows you to determine the way group names are displayed in this Type-to-Find drop-down list.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under System, click Name Completion Settings.

The following options are available:

Primary display text: Select Name or Title. Name represents the name of the group as it appears in Filr. Title represents the title as it appears in the LDAP directory.

Secondary display text: Select Description or Fully Qualified DN. Description represents the description of the group as it appears in Filr. Fully Qualified DN represents the Fully Qualified Domain Name as it appears in the LDAP directory.

Click OK.

20.0 Managing Filr Data for Mobile Devices

Filr provides native mobile device management functionality, directly from the Filr Administration Console.

You can perform the following tasks:

Section 20.1, Viewing Device Information

Section 20.2, Wiping All Data from a Device

Section 20.3, Deleting a Mobile Device

20.1 Viewing Device Information

You can view all devices (and device owners) that have accessed your Filr system, as well as valuable information about the device and login history.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

To view all mobile devices in the Filr system, under Management, click Mobile Devices.

The Manage Mobile Devices page is displayed.

or

To view all mobile devices belonging to a specific user, under Management, click Users, then click the icon in the mobile device column (the number in the icon represents the number of devices that belong to the user).

The following information is displayed about each mobile device that has accessed the Filr system:

Description: The name given to the device by the device owner, the type of device (such as iPhone), and the operating system on the device.

User: The name of the Filr user who owns the device.

Last login: The date and time when the device was last used to log in to the Filr system.

Wipe scheduled: Whether a wipe has been scheduled to occur to remove all Filr data from the device.

Last wipe: The last time Filr data was wiped from the device.

20.2 Wiping All Data from a Device

You might want to wipe all Filr data from a device in the even that it is lost or stolen.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

To view all mobile devices in the Filr system, under Management, click Mobile Devices.

The Manage Mobile Devices page is displayed.

or

To view all mobile devices belonging to a specific user, under Management, click Users, then click the icon in the mobile device column (the number in the icon represents the number of devices that belong to the user).

Select the mobile device that you want to wipe, then click Wipe > Schedule Devices to be Wiped.

The device will be wiped at the next synchronization (by default, synchronization occurs every 15 minutes). You can change the synchronization schedule as described in Section 13.1, Configuring Mobile Device Access for All Users.

(Optional) To cancel the wipe from taking place, click Yes in the Wipe scheduled column.

20.3 Deleting a Mobile Device

You can delete a mobile device so that it is no longer displayed on the Manage Mobile Devices page. (The app is still available on the device.) If the device accesses the Filr site again, the device is re-added to the Manage Mobile Devices page.

IMPORTANT:If the device was lost or stolen, you should wipe the device before deleting it (as described in Section 20.2, Wiping All Data from a Device), because deleting a device does not cause the Filr data to be removed from the device.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

To view all mobile devices in the Filr system, under Management, click Mobile Devices.

The Manage Mobile Devices page is displayed.

or

To view all mobile devices belonging to a specific user, under Management, click Users, then click the icon in the mobile device column (the number in the icon represents the number of devices that belong to the user).

Select the mobile device that you want to delete, then click Delete > Yes.

21.0 Managing Folders and Files

As an administrator for Novell Filr, you can perform management functions on all Filr folders. For information on how to perform general folder management functions, such as creating a folder, deleting a folder, moving a folder, and so forth, see Managing and Using Folders in the Novell Filr 1.1 Web Application User Guide.

You can perform additional folder management tasks as the Filr administrator:

Section 21.1, Navigating the Workspace Tree

Section 21.2, Managing Workspace Disk Space Usage

Section 21.3, Restoring Files and Folders from the Trash

21.1 Navigating the Workspace Tree

You can use the Workspace Tree to navigate to any location on the Filr site. The Workspace Tree displays the path of all of the workspaces and folders that contain the place you are currently viewing, without leaving the current page.

This is the only way to navigate to another user’s My Files area.

Only the Filr administrator has access to the Workspace Tree.

Click the Workspace Tree icon in the upper-left corner of any Filr page.

Navigate to and click the linked name of the desired location in the Workspace Tree.

(Optional) To navigate to a user’s My Files area, click a folder within that user’s personal workspace.

21.2 Managing Workspace Disk Space Usage

Disk space usage is managed on a folder basis as well as on an individual user or group basis.

For more information, see Section 22.0, Managing Disk Space Usage with Data Quotas and File Restrictions.

21.3 Restoring Files and Folders from the Trash

You can view all items that have been sent to the trash and restore them to their previous location.

IMPORTANT:Only items from a user’s My Files area (Personal Storage) that were moved to the trash are able to be restored from the trash. Items that were permanently deleted from a user’s My Files area cannot be restored. Items deleted from a Net Folder are never sent to the trash, and cannot be restored.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Users.

The Manage Users page is displayed.

Click the Trash icon , located in the upper-right corner of the page.

Select the items that you want to restore, then click Restore.

22.0 Managing Disk Space Usage with Data Quotas and File Restrictions

As time passes, your Novell Filr site occupies more and more disk space as users post files. As the Filr administrator, you can impose limits on the amount of data that is uploaded into the Filr site.

Only files count toward the data quota. Folders that do not contain files do not count toward the data quota. Files that are located in Net Folders do not count toward the data quota.

You can limit the amount of disk space for individual users and groups as well as for individual folders.

Section 22.1, Understanding Data Quota Behavior and Exclusions

Section 22.2, Managing User Data Quotas

Section 22.3, General Data Quota Management

Section 22.4, Managing the File Upload Size Limit

Section 22.5, Managing Quotas for Outgoing Email Messages

22.1 Understanding Data Quota Behavior and Exclusions

Section 22.1.1, Understanding Default Data Quota Behavior

Section 22.1.2, Understanding Data Quota Exclusions

22.1.1 Understanding Default Data Quota Behavior

The following sections describe the default behavior for how user data quotas work after they have been enabled.

Exceeding the Data Quota

Exceeding the High-Water Mark

Exceeding the Data Quota

Filr users are strictly held to the data quota that you set. If a user who is approaching his or her data quota tries to upload a file to the Filr site and that file exceeds the user’s data quota, Filr rejects the upload attempt and the entry is lost. This is also true with data quotas that are set on folders.

Exceeding the High-Water Mark

When a user exceeds the data quota high-water mark, a warning message is displayed on the user’s profile page informing the user that he or she is approaching the data quota. Filr displays how many kilobytes of disk space are still available.

For more information on selecting an appropriate high-water mark, see Selecting an Appropriate High-Water Mark.

22.1.2 Understanding Data Quota Exclusions

Files that are located in Net Folders do not count against data quotas because they are not uploaded into the Filr site. Only files in users’ Personal Storage count against data quota.

Folders that do not contain files do not count toward the data quota.

22.2 Managing User Data Quotas

Each user’s data quota establishes how much disk space the user’s files can occupy in the Filr site. Folders that do not contain files do not count toward a user’s data quota.

By default, users are not limited in the disk space that their files occupy in the Filr site. As the Filr administrator, you can decide when limiting users’ disk space usage becomes appropriate.

Section 22.2.1, Planning User Data Quotas

Section 22.2.2, Setting User Data Quotas

Section 22.2.3, Modifying User Data Quotas

Section 22.2.4, Removing User Data Quotas

Section 22.2.5, Repairing a User’s Data Quota

Section 22.2.6, Managing Your Personal Data Quota

Section 22.2.7, Monitoring User Data Quotas

22.2.1 Planning User Data Quotas

Understanding User Data Quota Priority

Selecting the Default User Data Quota for All Users

Selecting an Appropriate High-Water Mark

Determining Data Quotas for Specific Users

Determining Data Quotas for Specific Groups

Understanding User Data Quota Priority

Because users can have multiple data quotas assigned to them (either individually, through group membership, or through the site-wide default), Filr prioritizes the existing data quotas and uses only one for each individual Filr user. If users have multiple data quotas that pertain to them, the priority level is as follows:

User Quota: A quota that is set for an individual user overrides the site-wide default quota and any other quotas that are associated with any groups where the user is a member.

Group Quota: A quota that is set for an individual group overrides the site-wide default quota. This pertains to all users who are members of that group.

When a user is a member of multiple groups that have data quotas associated with them, the user is given the highest data quota. For example, if a Filr user is a member of Group A, Group B, and Group C, and the data quotas for each of these groups is 10, 20, and 30, the Filr user’s data quota is 30.

Site-Wide Default: The site-wide default quota is used for all Filr users who have not been assigned individual quotas, and who are not associated with any groups where a quota has been set.

Selecting the Default User Data Quota for All Users

When you enable the data quota feature, the initial default data quota is 100 MB. This means that each Filr user can upload 100 MB of files and attachments to the Filr site.

When you select the default data quota for your Filr site, consider the size of your Filr site, the number of Filr users, the amount of available disk space, and so on. You can override the default data quota on a per-user and per-group basis, as described in Section 22.2.2, Setting User Data Quotas.

As described in Exceeding the Data Quota, when a user adds enough files and attachments to exceed the data quota, the user can no longer attach files or create versions until existing files have been deleted and purged to free up storage space.

For information about purging deleted files to make storage space available, see Section 22.3.1, Purging Deleted Files.

For information about which data quota is used when users have multiple data quotas that pertain to them, see Understanding User Data Quota Priority.

Selecting an Appropriate High-Water Mark

The high-water mark is the percentage of the data quota that must be reached before the user is made aware that he or she is approaching the data quota (a warning message is displayed on the user’s profile page). The default high-water mark is 90% of a user’s data quota.

This high-water mark also applies to data quotas that are set on workspaces and folders.

Determining Data Quotas for Specific Users

If there is a user in your Filr site who needs either a higher or lower data quota than the site-wide default, you can assign that user an individual user data quota.

When you set data quotas for specific users, remember that individual user data quotas override the default user data quota, as well as quotas that are assigned to any groups where the user is a member, as described in Understanding User Data Quota Priority.

Determining Data Quotas for Specific Groups

When you set data quotas for specific groups, remember that group data quotas override the default site-wide data quota, but do not override individual user quotas, as described in Understanding User Data Quota Priority.

22.2.2 Setting User Data Quotas

You can set data quotas for the entire Filr site, for individual groups, and for individual users.

Setting a Default Data Quota

Setting Data Quotas for Individual Groups

Setting Data Quotas for Individual Users

Setting a Default Data Quota

When you set a default data quota, the quota applies to all Filr users who have not been assigned individual quotas, and who are not associated with any groups where a quota has been set.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Personal Storage.

Select Enable User Data Quotas.

Set the Default User Data Quota Size and Default High-Water Mark options as determined in Section 22.2.1, Planning User Data Quotas.

Click Apply > Close to save the user data quota settings.

Setting Data Quotas for Individual Groups

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Personal Storage Quotas.

Select Enable User Data Quotas.

Click Add a Group.

In the Group field, start typing the name of the group for which you want to set a quota, then click the group name when it appears in the drop-down list.

Repeat this process to add additional groups for which you want to assign the same data quota.

In the Quota field, specify the disk space limit for the group.

Click OK, then click Apply > Close to save the user data quota settings.

Setting Data Quotas for Individual Users

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Add Group Data Quota.

Under Management, click Personal Storage Quotas.

Select Enable User Data Quotas.

Click Add a User.

In the User field, start typing the name of the user for which you want to set a quota, then click the user’s name when it appears in the drop-down list.

Repeat this process to add additional users for which you want to assign the same data quota.

In the Quota field, specify the disk space limit for the user.

Click OK, then click Apply > Close to save the user data quota settings.

22.2.3 Modifying User Data Quotas

Filr enables you to modify data quotas that you have previously set. You can modify data quotas for your entire Filr site, or modify data quotas for individual groups and users.

Modifying User Data Quotas for the Entire Filr Site

Modifying User Data Quotas for Individual Groups and Users

Modifying User Data Quotas for the Entire Filr Site

Filr enables you to easily modify the site-wide default user data quota.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Add User Data Quota.

Under Management, click Personal Storage Quotas.

In the Default User Data Quota Size field, delete the existing quota and specify the new quota.

You can also modify the default high-water mark in the Default High-Water Mark field. For more information about the high-water mark, see Selecting an Appropriate High-Water Mark.

Click Apply > Close to save the user data quota settings.

Modifying User Data Quotas for Individual Groups and Users

Filr enables you to easily modify individual group and user data quota settings that you have previously set.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Personal Storage Quotas.

In the Group Quotas table or User Quotas table, click the group name or user name that represents the group or user whose quota you want to modify.

In the Quota field, delete the existing quota and specify a new quota.

Click OK, then click Apply > Close to save the user data quota settings.

22.2.4 Removing User Data Quotas

Filr enables you to disable data quotas that you have previously set. You can disable data quotas for your entire Filr site, or remove data quotas from individual groups and users.

Disabling User Data Quotas for the Entire Filr Site

Removing User Data Quotas from Individual Groups and Users

Disabling User Data Quotas for the Entire Filr Site

If you decide that you no longer need to impose limits on the amount of data that users are permitted to upload into the Filr site, you can disable the data quota feature. Disabling the data quota feature enables all Filr users to upload as much data to the Filr site as they want.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Modify User Data Quota.

Under Management, click Personal Storage Quotas.

The Data Quotas and File Upload Limits page is displayed.

Deselect Enable User Data Quotas, then click Apply.

Data quotas are no longer enabled for your Filr site.

Removing User Data Quotas from Individual Groups and Users

You can remove data quotas that you have previously set for individual groups and users. Users are held to the site-wide data quota default setting if they do not have an individual quota defined for them and they are not members of any groups where a group quota has been assigned.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Manage Data Quotas Page.

Under Management, click Personal Storage Quotas.

In the Group Quotas table or User Quotas table, select the check box next to the group or user whose quota you want to remove.

Click Delete, then click Apply > Close to save the user data quota settings.

22.2.5 Repairing a User’s Data Quota

It is possible for a user’s data quota calculation to become inaccurate if errors occur during processing that is related to a user’s file handling. If this happens and a user’s quota calculation is inaccurate, you can repair the data quota:

Repairing a User’s Quota When an Individual Data Quota Is Set

Repairing a User’s Quota When a Default or Group Data Quota Is Set

Repairing a User’s Quota When an Individual Data Quota Is Set

You can repair a user’s data quota when an individual data quota is set on the user.

Remove the data quota that is set on the user, as described in Removing User Data Quotas from Individual Groups and Users.

Set the data quota for the user again, as described in Setting Data Quotas for Individual Users.

Repairing a User’s Quota When a Default or Group Data Quota Is Set

You can repair a user’s data quota when a default data quota is set, or when a group data quota is set and the user is a member of the group.

Set an individual data quota for the affected user, as described in Setting Data Quotas for Individual Users.

Remove the individual data quota that you just set, as described in Removing User Data Quotas from Individual Groups and Users.

22.2.6 Managing Your Personal Data Quota

NOTE:As a Filr administrator, you are also held to a data quota if quotas are enabled. If you want to assign yourself a larger quota than the site-wide default, you can add an individual quota for yourself, as described in Setting Data Quotas for Individual Users.

All Filr users need to manage their personal data quotas. When you have a limited allocation of disk space, you need to be aware of the amount of disk space that you have available and how to make more disk space available as you approach your quota.

For information on how to accomplish these and other important tasks as you manage your data quota, see Managing Your Data Quota in the Novell Filr 1.1 Web Application User Guide.

22.2.7 Monitoring User Data Quotas

You can monitor which users in the Filr site have exceeded or are close to exceeding their data quotas by generating the following reports:

Section 26.2.1, Data Quota Exceeded Report

Section 26.2.2, Data Quota Highwater Exceeded Report

22.3 General Data Quota Management

Section 22.3.1, Purging Deleted Files

22.3.1 Purging Deleted Files

You might want to purge deleted files in order to make space available within a data quota or to recover disk space.

Purging Deleted Files to Create Data Quota Space

Purging Deleted Files to Recover Disk Space

Purging Deleted Files to Create Data Quota Space

When users delete files or file versions, the disk space occupied by the deleted files and versions counts against the data quotas until users purge the files and versions, as described in Making Disk Space Available by Deleted Trashed Items in the Novell Filr 1.1 Web Application User Guide.

As a Filr administrator, you can purge files and versions anywhere on the Filr site in order to make space available within a user’s data quota.

Purging Deleted Files to Recover Disk Space

Whether disk space is recovered after you purge files using the Filr interface differs depending on whether you are purging files in Net Folders or files from a user’s personal storage in the My Files area:

Purging Files in Net Folders

Purging Files in Personal Storage

Purging Files in Net Folders

If you want to recover disk space on your file system, purging files in Net Folders using the Filr interface should also purge the files from the underlying file system, depending on the underlying implementation of the storage.

Purging Files in Personal Storage

If you want to recover disk space on the Filr system, you must purge the files from Filr.

For information about how to purge items, see Making Disk Space Available by Deleted Trashed Items in the Novell Filr 1.1 Web Application User Guide.

22.4 Managing the File Upload Size Limit

The file upload size limit conserves disk space on your Novell Filr site because it prevents users from uploading large files to the Filr site. The default size limit for uploading files into your Filr site is 2 GB.

Browsers also impose limits on the size of files that can be uploaded. This limit differs depending on which browser you are using to run Filr.

Section 22.4.1, Modifying the File Upload Size Limit for the Filr Site

Section 22.4.2, Setting a File Upload Size Limit for Individual Users and Groups

22.4.1 Modifying the File Upload Size Limit for the Filr Site

As the Filr administrator, you can increase or decrease the file upload size limit for the Filr site. Workspace and folder owners can set a file upload size limit for their own workspaces and folders, but the limit in individual workspaces and folders cannot exceed what you set for the Filr site.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click File Upload Limits.

In the Default File Upload Size Limits field, specify the new file upload size limit.

Click Apply > Close.

22.4.2 Setting a File Upload Size Limit for Individual Users and Groups

You can assign a file upload size limit to individual users and groups that is different from the site-wide file upload size limit. For example, if the file upload size limit for your Filr site is 2 GB, but your Marketing team often uploads large files, you can give the Marketing group a file upload size of 3 GB.

Setting a Limit for a Group

Setting a Limit for a User

Setting a Limit for a Group

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click File Upload Limits.

In the File Upload Size Limits section, click Add a Group.

Specify the following information:

Group: Begin typing the group name for which you want to set a file upload size limit, then click the name when it appears in the list.

File Size Limit: Specify the new file size limit for the group.

Click OK.

Setting a Limit for a User

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click File Upload Limits.

In the Default File Upload Size Limits section, click Add a User.

Specify the following information:

User: Begin typing the user name for which you want to set a file upload size limit, then click the name when it appears in the list.

File Size Limit: Specify the new file size limit for the user.

Click OK.

22.5 Managing Quotas for Outgoing Email Messages

You can set data quotas on the amount of content users can send on email messages that are sent from the Filr system.

For information about how to do this, see Section 5.0, Configuring Email Integration.

23.0 Managing Email Configuration

After you enable email integration for the Filr site as described in Section 5.0, Configuring Email Integration, you can further modify the way email is managed on the Filr site.

Section 23.1, Configuring Outbound Email with TLS over SMTP

23.1 Configuring Outbound Email with TLS over SMTP

Depending on how your email application is configured, you might need to configure Filr outbound email with TLS over SMTP for secure email. Novell GroupWise, for example, can be configured to require this. If you are using GroupWise or another email application that requires this type of configuration, you can configure Filr with TLS over SMTP by using STARTTLS.

NOTE:During the Filr appliance configuration, when configuring Outbound email, ensure that you have selected SMTP in the Protocol drop-down list, and that Enable STARTTLS is selected, as described in Section 1.9, Changing Outbound Email Configuration Settings.

24.0 Managing the Lucene Index

For background information about the Lucene index, see Section 1.5.1, Understanding Indexing.

Section 24.1, Changing Your Lucene Configuration

Section 24.2, Optimizing the Lucene Index

Section 24.3, Rebuilding the Lucene Index

Section 24.4, Performing Maintenance on a High Availability Lucene Index

24.1 Changing Your Lucene Configuration

You can change your Lucene Configuration settings as described in Section 1.5.2, Changing Search Index Configuration Settings.

24.2 Optimizing the Lucene Index

If you notice that search performance in Novell Filr is becoming slower over time, you might want to optimize your Lucene index.

IMPORTANT:In order for optimization to run, there must be at least 51% free disk space on the Lucene search index appliance.

For a medium to large Filr system, you should run the optimization once a week. You should run the optimization during off hours or on weekends when the Filr system is not being heavily used.

Optimizing the Lucene index does not repair a damaged or out-of-date index. To repair a damaged or out-of-date index, you must rebuild the index, as described in Section 24.3, Rebuilding the Lucene Index.

Section 24.2.1, Optimizing a Single Search Index

Section 24.2.2, Optimizing the Search Index with Multiple Index Servers

24.2.1 Optimizing a Single Search Index

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under Management, click Search Index.

Click the Optimize Search Index tab.

Select Run Immediately if you want to run the optimization right now.

Select Run at Scheduled Time, then specify the days and times that you want the optimization to occur.

Click OK.

24.2.2 Optimizing the Search Index with Multiple Index Servers

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Optimize the Search Index page.

In the Search Index section, click Index.

Click the Optimize Search Index tab.

Select Run Immediately if you want to run the optimization right now.

Select Run at Scheduled Time, then specify the days and times that you want the optimization to occur.

Select each node that you want to optimize.

Click OK.

24.3 Rebuilding the Lucene Index

The Lucene index provides access to all data in your Novell Filr site. If it becomes damaged or out-of-date for some reason, you can rebuild it. Users might first notice a problem with the Lucene index if they cannot find information that they know should be available on the Filr site. If you are running multiple Lucene Index Servers, follow the instructions in Section 24.4, Performing Maintenance on a High Availability Lucene Index.

Rebuilding the Lucene search index can consume a significant amount of resources on your Filr appliance. In a clustered environment, it is a good idea to set aside a single Filr appliance to handle the load of rebuilding the search index. (For information about how to set aside a Filr appliance, see Setting Aside a Filr Appliance for Re-Indexing and Net Folder Synchronization in a Clustered Environment in the Novell Filr 1.1 Installation and Configuration Guide.)

The steps to reset the search index differ depending on whether you have multiple Lucene Index servers.

Section 24.3.1, Rebuilding a Single Search Index

Section 24.3.2, Rebuilding the Search Index with Multiple Index Servers

24.3.1 Rebuilding a Single Search Index

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Optimize the Search Index page.

In the Management section, click Search Index.

To reindex the entire Filr site, select Re-Index Everything.

Depending on the size of your Filr site, this can be a very time-consuming process.

or

Select one or more parts of your Filr site to re-index.

Click OK to start the indexing.

Users can still access the Filr site during the indexing process, but search results might not be accurate until the index has been completely rebuilt.

To view when indexing is complete, keep the Search Index dialog box open to see the status. Alternatively, a message is displayed in either the appserver.log files stating that reindexing is complete.

To ensure that the rebuild was successful, verify that the following messages appear in the appserver.log file:

Completed indexing of tree with xxx binders. Tim taken for indexing is xxx.xxx msAdministrative reindexing completed on binders [1]

For information about how to access the appserver.log file, see Section 2.7, Changing System Services Configuration.

24.3.2 Rebuilding the Search Index with Multiple Index Servers

To avoid downtime when rebuilding the search index with multiple search index servers:

Take the first search index node out of service to rebuild it while the other is still running.

For information about how to take a node out of service, see Section 24.4, Performing Maintenance on a High Availability Lucene Index.

Rebuild the search index node from the Index section of the Administration Console.

After the first search index node is rebuilt, put it back into service.

For information about how to put a node back into service, see Section 24.4, Performing Maintenance on a High Availability Lucene Index.

Repeat this process for the second search index node.

To view when indexing is complete, keep the Search Index dialog box open to see the status. Alternatively, a message is displayed in either the appserver.log files stating that reindexing is complete.

To ensure that the rebuild was successful, verify that the following messages appear in the appserver.log file:

Completed indexing of tree with xxx binders. Tim taken for indexing is xxx.xxx msAdministrative reindexing completed on binders [1]

For information about how to access the appserver.log file, see Section 2.7, Changing System Services Configuration.

24.4 Performing Maintenance on a High Availability Lucene Index

If you have a high availability Lucene configuration, you can take one Lucene node out of service for maintenance while other Lucene nodes continue to operate. Then you can synchronize the out-of-date Lucene node with the current indexing data.

Log in to the Novell Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Take the Lucene node that needs maintenance out of service:

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Manage the Search Index page.

Under Search Index, click Nodes.

In the list, locate the node that needs maintenance.

Ensure that Enable Deferred Update Log is selected.

In the User Mode Access box, change Read and Write to one of the following options, depending on the type of maintenance that you want to perform:

Write Only: Select this option if you are performing a re-index on the search index node.

No Access: Select this option if you are performing other types of maintenance on the search index node, such as upgrading it, adding more disk space or memory, and so forth.

Selecting this option ensures that no data is written to the index while the maintenance is being performed.

Click Apply, then click Close.

The new setting is put into effect immediately, so that the Lucene node is no longer accessible to Filr users.

Perform the needed maintenance on the Lucene node. For example, for information about how to perform a re-index on the node, see Section 24.3, Rebuilding the Lucene Index.

Return the out-of-date Lucene node to full service:

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Lucene Nodes page.

Under Search Index, click Nodes.

If you moved the Lucene node to No Access, the out-of-date Lucene node is flagged with Deferred Update Log Records Exist.

The User Mode Access option shows Read and Write because this is the last selected setting.

Select Apply Deferred Update Log Records to the Index, then click Apply.

The Deferred Update Log options disappear if the update is successful.

Click Close.

The Lucene node that was out of service has now been updated with current indexing data.

(Conditional) If both Lucene nodes require maintenance, repeat Step 1 through Step 4 for the second Lucene node.

25.0 Backing Up Filr Data

Reliable backups are critical to the stability of your Novell Filr site.

IMPORTANT:Do not use VMware snapshots as a backup method for Filr. Doing so creates problems when managing the system disk and inhibits your ability to update Filr in the future.

Section 25.1, Locating Filr Data to Back Up

Section 25.2, Scheduling and Performing Backups

Section 25.3, Restoring Filr Data from Backup

Section 25.4, Manually Restoring Individual Files and Folders

25.1 Locating Filr Data to Back Up

In order to keep adequate backups of your Novell Filr data, you must back up the following types of data:

Section 25.1.1, Filr File Repository

Section 25.1.2, Filr Database

Section 25.1.3, Lucene Search Index

Section 25.1.4, Certificates

25.1.1 Filr File Repository

Back up the following location on the Filr appliance. In a large deployment, back up this location on each Filr appliance in the cluster.

/vastorage/filr/filerepository

For more information about the Filr file repository, see Planning the File Repository in the Novell Filr 1.1 Installation and Configuration Guide.

25.1.2 Filr Database

Back up the following location on the Filr appliance (in a small deployment) or on the MySQL database appliance (in a large deployment):

/vastorage/mysql

Specifically, you should back up the following databases: filr, information_schema, mysql

Refer to the database backup method information in the MySQL documentation.

For more information about the Filr database, see Filr Database in the Novell Filr 1.1 Installation and Configuration Guide.

25.1.3 Lucene Search Index

You can back up the following location on the Filr appliance (in a small deployment) or the Lucene search index appliance (in a large deployment):

/vastorage/conf

The Lucene search index does not need to be backed up because it can be rebuilt at any time. For information about how to rebuild the Lucene search index, see Section 24.3, Rebuilding the Lucene Index.

For more information about the Lucene search index, see Search Index in the Novell Filr 1.1 Installation and Configuration Guide.

25.1.4 Certificates

Back up the following location on the Filr appliance. In a large deployment, back up this location on each Filr appliance in the cluster.

/vastorage/conf

25.2 Scheduling and Performing Backups

You do not need to bring your Novell Filr site down in order to perform backups. You might want to back up the Filr file repository and the Filr database every night, perhaps doing a full backup once a week and incremental backups on other days. You can back up the Lucene index whenever it is convenient. You can always reindex the Filr site in order to re-create the Lucene index, but being able to restore content from a backup can save time in case of an outage.

25.3 Restoring Filr Data from Backup

If you need to restore your Novell Filr site from a backup, restoring the same backup version for both the file repository and the database creates a Filr site that is consistent within itself but might be missing information that was added after the backups were created. If you lose the file repository but not the database, you can restore the backed-up file repository and keep the more current database, but some files are missing from the file repository.

25.4 Manually Restoring Individual Files and Folders

Files and folders from users’ My Files area (personal storage) that were moved to the trash and were not permanently deleted can be restored from the trash. Unlike files from users’ personal storage, files from Net Folders cannot be restored from the Filr trash.

The Filr administrator can view all items that were moved to the trash and restore them to their previous location, as described in Section 21.3, Restoring Files and Folders from the Trash.

Individual Filr users can restore items from the trash, as described in Restoring Items from the Trash in the Novell Filr 1.1 Web Application User Guide.

26.0 Monitoring the Filr System

You can monitor activity on your Novell Filr site by using Filr reports and log files.

Section 26.1, Monitoring Filr Performance with Ganglia

Section 26.2, Monitoring Filr by Generating Reports

Section 26.3, Using the Filr Log File

Section 26.4, Understanding Disk Usage Checks

Section 26.5, Checking the Filr Site Software Version

26.1 Monitoring Filr Performance with Ganglia

Ganglia is a scalable, distributed monitoring system that allows you to gather important metric data about your Filr system’s performance. The default metrics that you can monitor are CPU, disk, load, memory, network, and process.

For information about how to configure Ganglia for your environment, including changing from multicast mode to unicast mode, see Section 2.6, Changing the Ganglia Configuration.

NOTE:Setting Ganglia hosts to unicast mode can help to improve overall performance of the Filr system.

You can view metrics for individual nodes or for multiple Filr nodes that are running in a clustered environment:

Section 26.1.1, Viewing Metrics for an Individual Node

Section 26.1.2, Viewing Metrics for Multiple (Clustered) Filr Nodes

Section 26.1.3, Filr Monitoring Metrics

26.1.1 Viewing Metrics for an Individual Node

You can view metrics for individual nodes in your Filr system, including the Filr appliance, search index appliance or database appliance. To view Ganglia monitoring of your Filr system:

In a small installation, log in to the Filr appliance.

or

In a large installation, log in to either the Filr appliance, search index appliance, or database appliance.

Use the following URL for each appliance: https://server_url:9443.

Click the Ganglia icon.

An overview is displayed of all the nodes in the cluster, including information such as CPU utilization, memory, load, and so forth.

In the Grid-Node drop-down list, select a node that you want to monitor.

or

Scroll to the bottom of the page and click a node.

For a list of available metrics, see Section 26.1.3, Filr Monitoring Metrics.

26.1.2 Viewing Metrics for Multiple (Clustered) Filr Nodes

If your Filr site is running in a clustered environment, you can see information about a particular metric for all Filr nodes in a combined view:

In a small installation, log in to the Filr appliance.

or

In a large installation, log in to either the Filr appliance, search index appliance, or database appliance.

Use the following URL for each appliance: https://server_url:9443.

Click the Ganglia icon.

An overview is displayed of all the nodes in the cluster, including information such as CPU utilization, memory, load, and so forth.

Click the Aggregate Graphs tab.

Specify the appropriate information for the following fields to create the aggregate graph:

Title: The title that appears on the aggregate graph after it is created.

Vertical (Y-Axis) label: The label that appears for the graph’s Y-axis after the graph is created.

Limits: Defines the lower and upper limits of the Y-axis. (The Y-scale of the graph.)

Host Regular expression: Specify the nodes in the cluster that you want to compare. Nodes must be separated by a vertical bar (|). For example, node1|node2.

Metric Regular expression: Specify the name of the metric that you want to view. For example, typing FILR_Unique_Users displays information about the number of unique logged in users. As you type, matching metric names that you can choose from are displayed. (You can also see the metric name to specify in this field by clicking on the Main tab and looking in the upper-left corner of each metric graph.)

For a list of available metrics, see Section 26.1.3, Filr Monitoring Metrics.

Graph Type: Select whether you want a line or stacked graph to be created.

Legend options: Select whether to show or hide the legend.

Click Create Graph.

(Optional) To save this graph for future use, click Direct Link to this aggregate graph, then save the resulting URL.

26.1.3 Filr Monitoring Metrics

Filr Server Metrics

Filr Search Metrics

Filr Server Metrics

Total Failed Logins: Number of failed logins from the web client since the server started.

This does not include failed logins from the Filr desktop or mobile clients.

Failed Logins: Number of failed logins from the web client since the last metric interval.

This does not include failed logins from the Filr desktop or mobile clients.

Sessions: Number of valid sessions in memory.

Peak Sessions: Peak number of valid sessions in memory.

Unique Logged in Users: Number of unique users who have logged in to Filr by using the web client since the server started.

These users might not be currently logged in.

Unique Logged in Users Since: Number of unique users since the last time the information was dumped (dumps occur at a 60-minute interval).

File Writes: Number of file writes to the file repositories, including the remote file systems that are exposed through Net Folders and Home directories, as well as the local file repository that is exposed through file folders in personal storage.

File Writes Since: Number of file writes since the last time the information was dumped (dumps occur at a 60-minute interval).

File Reads: Number of file reads from the file repositories, including the remote file systems that are exposed through Net Folders and Home directories, as well as the local file repositories that are exposed through file folders in personal storage.

File Reads Since: Number of file reads since the last time the information was dumped (dumps occur at a 60-minute interval).

Files Shared: Number of files shared since the server started.

This number indicates the number of shares made through the Filr interface. This does not include shares made via the file system.

Files Shared Since: Number of files shared since the last time the information was dumped (dumps occur at a 60-minute interval).

This number indicates the number of shares made through the Filr interface. This does not include shares made via the file system.

Folders Shared: Number of folders shared since the server started.

This number indicates the number of shares made through the Filr interface. This does not include shares made via the file system.

Folders Shared Since: Number of folders shared since the last time the information was dumped (dumps occur at a 60-minute interval).

This number indicates the number of shares made through the Filr interface. This does not include shares made via the file system.

Total Filr Preview Conversions: Number of actual file preview requests since the last metric interval.

Represents only those requests that resulted in a conversion.

Filr Preview Conversions: Number of actual file preview requests since the server started.

Represents only those requests that resulted in a conversion.

Total Filr Preview Requests: Number of file preview requests since the last metric interval.

Represents any request for a file preview whether a conversion is required or cache is used.

Filr Preview Requests: Number of file preview requests since the server started.

Represents any request for a file preview whether a conversion is required or cache is used.

REST Requests: Number of REST calls made to this server.

REST Requests Since: Number of REST calls since the last time the information was dumped (dumps occur at a 60-minute interval).

Filr Search Metrics

Adds: Number of adds to the index since the server started. This indicates the number of Lucene documents added to the index.

This number is not necessarily the same as the number of Filr entities that are indexed. For example, indexing a file entry results in two Lucene documents being created. Also, this number is not necessarily the same as the number of remote invocations that the Filr server makes to the index server, because in many cases, the Filr server combines multiple Lucene documents to add in a single remote invocation.

Add Since: Number of adds to the index since the last time the information was dumped (dumps occur at a 60-minute interval).

Deletes: Number of deletes from the index since the server started. This indicates the number of delete operations made on the index.

This number is not necessarily the same as the number of Lucene documents deleted from the index as the result of the request. In some cases, a single such request can result in a large number of Lucene documents being deleted from the index (for example, during system re-indexing). Also, this number is not necessarily the same as the number of remote invocations that the Filr application server makes to the index server, because of request batches from the application server.

Deletes Since: Number of deletes from the index since the last time the information was dumped (dumps occur at a 60-minute interval).

File Searches: Number of searches on the index since the server started. This includes all search operations, including user-directed searches, system-directed searches (such as folder listing), tag searches, and searches used by type-to-find functionality (name completion).

Searches Since: Number of searches on the index since the last time the information was dumped (dumps occur at a 60-minute interval).

26.2 Monitoring Filr by Generating Reports

Most Novell Filr reports are created in CSV format, so that you can import them into a spreadsheet and easily manipulate the data to suit your needs. The default CSV file name is report.csv. If you create multiple reports without manually renaming them, the default file name is incremented (report-n.csv). The default location to save the report is /tmp.

Section 26.2.1, Data Quota Exceeded Report

Section 26.2.2, Data Quota Highwater Exceeded Report

Section 26.2.3, Disk Usage Report

Section 26.2.4, Email Report

Section 26.2.5, License Report

Section 26.2.6, Login Report

Section 26.2.7, User Access Report

Section 26.2.8, User Activity Report

Section 26.2.9, XSS Report

26.2.1 Data Quota Exceeded Report

The Data Quota Exceeded report lists individual users who have exceeded the data quota. The report provides a spreadsheet with the following information for each user:

Data Quota Used (MB): Displays the amount of disk space the user is currently using.

Data Quota: Displays the user’s individual quota if one has been set.

For information on how to set a quota for individual users, see Section 22.2.2, Setting User Data Quotas.

Max Group Quota (MB): Displays the largest data quota for any group that the user is a member of. Users are assigned the highest of all data quotas for any group for which they are a member.

Default Data Quota (MB): Displays the site-wide default quota.

For information on how to set a default data quota, see Section 22.2.2, Setting User Data Quotas.

To generate the Data Quota Exceeded report:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under System, click Reports.

In the Report to run drop-down list, select Data Quota Exceeded Report.

Click Create Report to generate the report.

The report is launched in a spreadsheet.

26.2.2 Data Quota Highwater Exceeded Report

The Data Quota Highwater Exceeded report lists individual users who have exceeded the data quota high-water mark. The report provides the following information for each user:

Data Quota Used (MB): Displays the amount of disk space the user is currently using.

Data Quota (MB): Displays the user’s individual quota if one has been set.

For information on how to set a quota for individual users, see Section 22.2.2, Setting User Data Quotas.

Max Group Quota (MB): Displays the largest data quota for any group that the user is a member of. Users are assigned the highest of all data quotas for any group for which they are a member.

Default Data Quota (MB): Displays the site-wide default quota.

For information on how to set a default data quota, see Section 22.2.2, Setting User Data Quotas.

To generate the Data Quota Highwater Exceeded report:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Data Quota Exceeded Report.

Under System, click Reports.

In the Report to run drop-down list, select Data Quota Highwater Exceeded Report.

Click Create Report to generate the report.

The report is launched in a spreadsheet.

26.2.3 Disk Usage Report

The Disk Usage report lists the amount of disk space for workspaces on the Filr site by user, by workspace, or by both. In addition, you can restrict the reporting to only those workspaces that exceed a specified number of megabytes.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Data Quota Highwater Exceeded Report.

Under System, click Reports.

In the Report to run drop-down list, select Disk Usage Report.

Select the type of Disk Usage report that you want to generate:

Total Usage by User: Lists all Filr users whose disk space usage is above the amount specified in the Usage Greater Than field.

Total Usage by Workspace: Lists all workspaces where disk space usage is above the amount specified in the Usage Greater Than field. Disk space usage for each folder in each workspace is listed separately. The data is organized by workspace and folder ID.

Total Usage by User and Workspace: Combines the user and workspace data into a single report.

Usage Greater Than: Specify the number of megabytes above which you want to list disk space usage. This eliminates smaller disk space usages from the report.

Click Create Report to generate the Disk Usage report.

Select a text editor to view the report in, then click OK.

For a short report, you might obtain the information you need by viewing the CSV file.

(Optional) Save the CSV file with a meaningful name in a convenient location, then retrieve it into a spreadsheet program for further examination.

Click Close when you are finished checking disk space usage.

26.2.4 Email Report

The Email Report lists mail messages that have been sent from and into the Filr site. It also lists email errors that have been encountered.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the hostname or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Disk Usage Report page.

Under System, click Reports.

In the Report to run drop-down list, select Email Report.

Specify the date range for the Email report.

Select whether you want a report on email that was sent from Filr or email errors that occurred.

Because Filr cannot currently be configured to receive email messages, the option Received emails is not a valid option.

Click Create Report.

The report contains the following information:

Send Date: Date when the email was sent.

From Address: Address that the email was sent from. This is the email address that the user has defined in his or her user profile.

To Address: Address that the email was sent to.

Type: This is the action that caused the message to be sent. For example, sendMail indicates that an item was shared.

Status: Status of the message, such as Sent or Received.

Subject Line: Subject line of the message.

Attached Files: File name of any attachments that were included in the email message.

Errors: Any errors that are associated with the email message.

26.2.5 License Report

The License report lists information about your Filr license, as well as information about the number of users in your Filr site and how many of those users have accessed the site.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon E-Mail Report page.

Under System, click Reports.

In the Report to run drop-down list, select License Report.

Specify the date range for the License report, then click Create Report.

The License report lists the following information:

Filr version

License key type

Date the license key was issued

Date range when the license key is valid

Maximum number of logged-in users during the date range

Current active user count

List of dates in the date range with the following user license information:

Local Users: The user account was created within Filr, and is not being synchronized from an LDAP directory.

Users Synchronized from LDAP: The user account was created from an LDAP source. (Only synchronized accounts that are not marked as Deleted or Disabled are counted.)

Users Who Used Filr During the Previous 365 Days: Users who have logged in at least once in the past year.

The Filr software does not limit the number of Filr users that you can create. However, sites where Filr licenses have been purchased and the Filr software installed are periodically audited against their purchased number of licenses.

Click Close when you are finished reviewing the License report.

26.2.6 Login Report

The Login report lists the Filr users who have logged in to the Filr site during a specified period of time. In addition, it can include a dated list of every login by each user.

Logins are recorded only for the web application. Logins via the desktop application and mobile app are not recorded.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon License Report page.

Under System, click Reports.

In the Report to run drop-down list, select Login Report.

Specify the date range for the Login report.

Leave the People field blank to list all user logins.

or

In the People field, start typing the first name of a Filr user, then in the drop-down list of names that match what you have typed, select a user whose logins you want to be reported. Repeat this process to include multiple users in the report.

Select the type of Login report that you want to generate.

Summarize Login Entries: Lists how many times the selected users have logged into the Filr site. In the Sort Report By drop-down list, select User, Last Login, or Number of Logins to organize the data.

List All Login Entries: Lists each individual user login and includes the following data about the action:

First name

Last name

User name

Date

Time

In the Sort report by drop-down list, select Login Date or User to organize the data in the way that is most helpful to you.

Click Create Report to generate the Login report.

Select a text editor to view the report in, then click OK.

For a short report, you might obtain the information you need by viewing the CSV file.

(Optional) Save the CSV file with a meaningful name in a convenient location, then retrieve it into a spreadsheet program for further examination.

26.2.7 User Access Report

The User Access report lists the locations on the Filr site where a specified user has access rights. In addition, you can view, and if necessary, change or remove the access rights for any location. This report is especially useful on Filr sites where Guest user access has been granted, as described in Section 10.1, Allowing External Users Access to Your Filr Site.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Login Report page.

Under System, click Reports.

In the Report to run drop-down list, select User Access Report.

Start typing the first name of a Filr user.

In the drop-down list of names that match what you have typed, select the user whose site access you want to be reported.

(Conditional) The following steps are for informational purposes only. Novell recommends that you do not modify access controls in Filr as described below. Instead, use file system access controls.

Click the name of a location to display the Configure Access Control page for that location.

In this example, the Guest user has been granted Visitor access to Janet DeSoto’s personal workspace.

Select or deselect access rights as needed.

Click Save Changes, then click Close to return to the User Access Report page

Rerun the report to view the results of your changes.

(Conditional) If you want to save the user access information, select it and copy it into a text editor.

Click Close when you are finished checking user access rights.

26.2.8 User Activity Report

The User Activity report lists how many times specified users have viewed, added, modified, or deleted content on the Filr site during a specified period of time. In addition, it can include the date and time of each action, along with the location of the action.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon User Access report results.

Under System, click Reports.

In the Report to run drop-down list, select User Activity Report.

Specify the date range for the User Activity report.

Leave the Select User field blank to list all user activity.

or

In the Select User field, start typing the first name of a Filr user.

In the drop-down list of names that match what you have typed, select a user whose activity you want to be reported. Repeat this process to include additional users.

Select the type of User Activity report that you want to generate.

Activity Summary: Lists how many times the selected users have performed the following actions in the Filr site:

View

Add

Edit

Delete (purge)

Pre-Delete (delete but not purge)

Restore (restore a deleted item that has not been purged)

Workspace or Folder Activity: Lists each individual user action and includes the following data about the action:

User

Activity

Date

Time

Folder

Entry title

Entry type

Click Create Report to generate the User Activity report.

Select a text editor to view the report in, then click OK.

For a short report, you might obtain the information you need by viewing the CSV file.

(Optional) Save the CSV file with a meaningful name in a convenient location, then retrieve it into a spreadsheet program for further examination.

26.2.9 XSS Report

Cross-site scripting (XSS) is a client-side computer attack that is aimed at web applications. Because XSS attacks can pose a major security threat, Novell Filr contains a built-in security filter that protects against XSS vulnerabilities. For more general information about XSS, see Section 30.4.3, Securing the Filr Site against XSS.

The XSS report in Filr enables you to remove potentially harmful XSS threats from your Filr site.

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon Activity by User page.

Under System, click Reports.

In the Report to run drop-down list, select XSS Report.

Select the directories (subdirectories are included) for which you want to generate the report, then click Create Report.

IMPORTANT:Because XSS attacks often are designed to wait for users with extra privileges (such as the administrator) to view the page where the attack was set, it is important that you don’t navigate to the page after you run the report.

For information about how to run the XSS report and safely remove XSS threats, see TID 7007381: Running the XSS Report in Novell Filr in the Novell Support Knowledgebase.

26.3 Using the Filr Log File

Section 26.3.1, Filr Log File

26.3.1 Filr Log File

The Novell Filr log file (appserver.log) is available from the Filr site.

Log in as the Filr site administrator.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Under System, click Reports.

In the Report to run drop-down list, select System Error Logs.

Click Download Log.

You are prompted to open or save a file named logfiles.zip, which contains the current appserver.log file. This file contains any stack traces or warning messages because of unexpected events encountered by the Filr program.

Save the appserver.log file to a convenient location on the Filr server.

This file is helpful when you need assistance resolving a problem with your Filr site.

26.4 Understanding Disk Usage Checks

Each hour, Filr checks the amount of disk space that is being used on the system drive for a given appliance. If disk usage reaches 90% capacity or greater on the system drive for any appliance, the Filr and FAMT services are stopped.

Following are the scripts that are used to monitor disk usage for each type of appliance:

Filr Appliance: /etc/cron.hourly/filr-diskcheck.sh

Search Index Appliance: /etc/cron.hourly/lucene-diskcheck.sh

Database Appliance: /etc/cron.hourly/mysql-diskcheck.sh

When the Filr and FAMT services are stopped because of low disk space, a message is logged to both the /var/opt/novell/va_status and /var/log/messages files.

After the services are stopped, you must clean up unneeded data or add additional disk space to the appliance before restarting the services.

26.5 Checking the Filr Site Software Version

To display the version number and software date of the Novell Filr software:

Log in to the Filr site as the Filr administrator.

Launch a web browser.

Specify one of the following URLs, depending on whether you are using a secure SSL connection:

http://filr_hostname:8080
https://filr_hostname:8443

Replace filr_hostname with the host name or fully qualified domain name of the Filr server that you have set up in DNS.

Depending on how you have configured your Filr system, you might not be required to enter the port number in the URL. If you are using NetIQ Access Manager, the Filr login screen is not used.

Click the admin link in the upper-right corner of the page, then click the Administration Console icon .

Click the information icon .

The Filr software version and date are displayed in the Administration Information dialog box.

IV Interoperability

Novell Filr can be used in conjunction with various other software products. By incorporating these products into your Filr system, you can add functionality, increase security, and maximize the value of Filr.

Section 27.0, NetIQ Access Manager

Section 28.0, Novell Dynamic File Services

27.0 NetIQ Access Manager

Using Novell Filr in conjunction with NetIQ Access Manager adds enterprise-level security to your Filr system.

IMPORTANT:When you use NetIQ Access Manager with Filr, external users cannot access your Filr site. This means that the following features are not functional:

Users are not able to share with external users, as described in Sharing with People Outside Your Organization in the Novell Filr 1.1 Web Application User Guide.

Users are not able to share a File Link, as described in Distributing a Link to a File in the Novell Filr 1.1 Web Application User Guide.

Users cannot make items accessible to the public, as described in Making Files Accessible to the Public in the Novell Filr 1.1 Web Application User Guide.

This means that public users cannot access the Filr site as the Guest user. For more information about the Guest user, see Section 10.1.1, Allowing Guest Access to Your Filr Site.

For more information about external users in Filr, see Section 10.1, Allowing External Users Access to Your Filr Site.

Before internal users can access your Filr site through NetIQ Access Manger, you must first configure specific protected resources in Access Manager to be public, as described in Section 12.0, Allowing Access to the Filr Site through NetIQ Access Manager.

Furthermore, you can configure NetIQ Access Manager to work with Novell Filr in the following way:

Configure NetIQ Access Manager to provide single sign-on access to the Filr site.

For more information, see Section 1.8, Changing Reverse Proxy Configuration Settings.

When you set up NetIQ Access Manager to work with Filr, ensure that you specify the correct HTTP/HTTPS port numbers during the configuration of the Filr appliance, as described in HTTP/HTTPS Ports When You Use NetIQ Access Manager with Filr.

28.0 Novell Dynamic File Services

You can manage your Novell Filr files by leveraging the functionality of Novell Dynamic File Services. Novell Dynamic File Services is an information life-cycle management technology that uses a policy-based approach for relocating files between two paths located on different storage devices. You can use Dynamic File services to better manage your premium storage for Filr by offloading large or seldom used files to a secondary storage location. Dynamic File Services provides a merged view of the data to the Filr application, which allows its users to transparently access their files without being aware of where they are physically stored.

For information on how to configure Filr with Novell Dynamic File Services, see “Setting Up a Merged View for Collaboration Applications: Novell Teaming” in the Dynamic File Services Administration Guide.

V Site Security

Section 29.0, Security Administration

Section 30.0, Security Policies

29.0 Security Administration

SSL (Secure Socket Layer) and TLS (Transport Layer Security) can be used to secure the connections between your Novell Filr site and other network services.

Section 29.1, Replacing the Self-Signed Digital Certificate for an Official Certificate

Section 29.2, Securing LDAP Synchronization

Section 29.3, Securing Email Transfer

Section 29.4, Restricting SSH Access for the Root User

Section 29.5, Setting Up Filr in a DMZ

Section 29.6, Filr Component Security

29.1 Replacing the Self-Signed Digital Certificate for an Official Certificate

The Novell Appliance ships with a self-signed digital certificate. Instead of using this self-signed certificate, you should use a trusted server certificate that is signed by a trusted certificate authority (CA) such as VeriSign or Equifax.

The certificate works for both the Novell Appliance and the Filr software (ports 9443 and 8443). You do not need to update your certificate when you update the Filr software.

Complete the following sections to change the digital certificate for your Novell Appliance. You can use the digital certificate tool to create your own certificate and then have it signed by a CA, or you can use an existing certificate and key pair if you have one that you want to use.

NOTE:If you are using a Godaddy SSL certificate with Filr, follow the steps in Godaddy SSL Certificates for Filr at the Novell Cool Solutions web site.

Section 29.1.1, Using the Digital Certificate Tool

Section 29.1.2, Using an Existing Certificate and Key Pair

Section 29.1.3, Activating the Certificate

29.1.1 Using the Digital Certificate Tool

Creating a New Certificate

Getting Your Certificate Officially Signed

Creating a New Certificate

Log in to the Novell Appliance at https://server_url:9443, then click the Appliance Configuration icon.

Click Digital Certificates.

In the Key Store drop-down list, ensure that Web Application Certificates is selected.

Click File > New Certificate (Key Pair), then specify the following information:

Alias: Specify a name that you want to use to identify and manage this certificate.

Avoid using periods (.) in the Alias name, because doing so can result in unpredictable behavior with some browsers when importing trusted certificates.

Validity (days): Specify how long you want the certificate to remain valid.

Key Algorithm: Select either RSA or DSA.

Key Size: Select the desired key size.

Signature Algorithm: Select the desired signature algorithm.

Common Name (CN): This must match the server name in the URL in order for browsers to accept the certificate for SSL communication.

Organizational Unit (OU): (Optional) Small organization name, such as a department or division. For example, Purchasing.

Organization (O): (Optional) Large organization name. For example, Novell, Inc.

City or Lacality (L): (Optional) City name. For example, Provo.

State or Province (ST): (Optional) State or province name. For example, Utah.

Two-letter Country Code (C): (Optional) Two-letter country code. For example, US

Click OK to create the certificate.

After the certificate is created, it is self-signed.

Make the certificate official, as described in Getting Your Certificate Officially Signed.

Getting Your Certificate Officially Signed

On the Digital Certificates page, select the certificate that you just created, then click File > Certificate Requests > Generate CSR.

Complete the process of emailing your digital certificate to a certificate authority (CA), such as Verisign.

The CA takes your Certificate Signing Request (CSR) and generates an official certificate based on the information in the CSR. The CA then mails the new certificate and certificate chain back to you.

After you have received the official certificate and certificate chain from the CA:

Revisit the Digital Certificates page by clicking Digital Certificates from the Novell Appliance.

Click File > Import > Trusted Certificate. Browse to the trusted certificate chain that you received from the CA, then click OK.

Select the certificate that you created in Creating a New Certificate, then click File > Certification Request > Import CA Reply.

Browse to and upload the official certificate to be used to update the certificate information.

On the Digital Certificates page, the name in the Issuer column for your certificate changes to the name of the CA that stamped your certificate.

Activate the certificate, as described in Section 29.1.3, Activating the Certificate.

29.1.2 Using an Existing Certificate and Key Pair

When you use an existing certificate and key pair (such as in the case of a wildcard certificate), use a .P12 key pair format.

Go to the Digital Certificates page by clicking Digital Certificates from the Novell Appliance.

Click File > Import > Trusted Certificate. Browse to and select your existing certificate, then click OK.

Click File > Import > Trusted Certificate. Browse to your existing certificate chain for the certificate that you selected in Step 2, then click OK.

Click File > Import > Key Pair, then browse to and select your .P12 key pair file, specify your password if needed, then click OK.

Because of a browser compatibility issue with HTML 5, the path to the certificate is sometimes shown as c:\fakepath. This does not adversely affect the import process.

Continue with Section 29.1.3, Activating the Certificate.

29.1.3 Activating the Certificate

On the Digital Certificates page, select the certificate that you want to make active, then click Set as Active, then click Yes.

Verify that the certificate and the certificate chain were created correctly by selecting the certificate and clicking View Info.

29.2 Securing LDAP Synchronization

If your LDAP directory service requires a secure LDAP connection (LDAPS), you must configure Novell Filr with a root certificate. The root certificate identifies the root certificate authority (CA) for your Filr site, which enables you to export a self-signed root certificate based on your eDirectory or Active Directory tree.

Section 29.2.1, Exporting a Root Certificate

Section 29.2.2, Importing the Root Certificate into the Java Keystore

29.2.1 Exporting a Root Certificate

Exporting a Root Certificate for eDirectory

Exporting the Root Certificate for Active Directory

Exporting a Root Certificate for eDirectory

Launch and log in to iManager for your tree.

Click Directory Administration.

Click Modify Object.

Click the magnifying glass icon to browse to and select the “Tree Name CA” object in the Security container of the eDirectory tree.

Click OK.

Click the Certificates tab.

Select the check box for the root certificate (this is not the certificate titled Self Signed Certificate, but rather the root certificate), then click Validate.

Select the check box for the root certificate, then click Export.

Deselect Export private key, then click Next.

Click Save the exported certificate, then select File in binary DER format.

Save the file to a location where it can be accessed later and with a file name that you can remember, such as SelfSignCert.der.

Click Close > OK.

Continue with Section 29.2.2, Importing the Root Certificate into the Java Keystore.

Exporting the Root Certificate for Active Directory

On the Windows server, click Start > Run, then enter mmc.

In MMC, type Ctrl+M.

If the Internet Information Services (IIS) Manager snap-in is not installed on your Windows server, install it.

With IIS selected, click Add, then click OK.

In the left frame, click Internet Information Services, then click a Windows server that Filr can connect to for synchronizing users.

In the Filter list, scroll down to Server Certificates and double-click the icon.

In the Actions list, click Create Self-Signed Certificate.

Name the certificate with a name you can remember, such as the server name, then click OK.

Type Ctrl+M, select the Certificates plug-in, then click Add.

Select Computer account, then click Next.

Click Finish.

In the Snap-ins dialog, click OK.

In MMC, expand the Certificates plug-in, expand Personal, then click Certificates.

Right-click the certificate you created, select All Tasks, then click Export....

In the Certificate Export wizard, click Next.

Ensure that No, do not export the private key is selected, then click Next.

Ensure that DER encoded binary is selected, then click Next.

Name the certificate, then click Next.

Click Finish > OK.

The certificate is saved in C:\Users\Your-User-Name.

Ensure that the certificate is accessible from your management browser.

Continue with Section 29.2.2, Importing the Root Certificate into the Java Keystore.

29.2.2 Importing the Root Certificate into the Java Keystore

Navigate to the management console of your Novell Appliance:

https://ip_address:9443

Click the Appliance System Configuration icon.

The Novell Appliance Configuration page is displayed.

Click Digital Certificates.

In the Key Store drop-down list, select JVM Certificates.

Click File > Import > Trusted Certificate.

A .der certificate is required for the import to be successful.

Browse to and select the trusted root certificate that you want to import.

If you want to import multiple certificates, ensure that the certificate names are different for each certificate.

Do not make any changes to the Alias field. It is populated by default.

Click OK.

The certificate should now be displayed in the list of JVM certificates.

Restart Filr so that Tomcat rereads the updated Java keystore file.

You can restart the Filr service as described in Section 2.7, Changing System Services Configuration.

You are now ready to configure your Filr site for secure LDAP synchronization, as described in Section 18.1, Synchronizing Users and Groups from an LDAP Directory.

29.3 Securing Email Transfer

When you install Novell Filr, you can choose whether the Filr internal mail host uses TLS (Transport Layer Security) when it communicates with other SMTP mail hosts.

If your Filr site needs to send email messages to an email system that requires secure SMTP (SMTPS), the Filr site must have the same type of root certificate that is required for secure LDAP (LDAPS). If you have not already set up secure LDAP for your Filr site, follow the instructions in Section 29.2, Securing LDAP Synchronization to set up secure SMTP for communications with your email system.

29.4 Restricting SSH Access for the Root User

By default, the root user is able to SSH to each appliance in the Filr system. You can disable this access on each appliance so that only the vaadmin user can SSH to the system.

For information about how to disable SSH access for the root user, see Section 2.1, Changing Administrative Passwords.

29.5 Setting Up Filr in a DMZ

IMPORTANT:Security is a complex subject and Novell does not attempt to suggest a complete defense solution with this example. Novell recommends that you consult with your security professional to implement Filr in a DMZ.

To provide an additional level of security, you can set up Filr in a DMZ. You might want to consider setting up Filr in a DMZ especially if you are planning to allow external users to access the Filr system (as described in Section 10.1, Allowing External Users Access to Your Filr Site). It is most secure to restrict external user access to Filr appliances that are located in the DMZ, rather than allowing external users access to a Filr appliance behind the internal firewall.

The actual data is never stored in the DMZ. It is stored behind the internal firewall on the database and search appliances, on the Windows and OES servers (for your Net Folders), and on a SAN for files in personal storage.

Figure 29-1 illustrates a basic setup with Filr running in a DMZ, including information about the ports that you need to open for the firewalls and for communication between the various servers.

Figure 29-1 Filr in a DMZ

Only traffic destined to the DMZ is allowed through the front-end firewall, and only traffic from the DMZ to the internal network is allowed through the back-end firewall.

In a clustered environment, it is also possible for some of the Filr appliances in the cluster to run behind the internal firewall while others run in the DMZ. Doing so can result in performance benefits for internal users. Setting up Filr in this way requires that you use memcached caching. For more information about configuring memcached caching, see Section 1.7, Changing Clustering Configuration Settings.

For more information about port configuration in Filr, see Section 1.2.2, Port Numbers.

For information about setting up NetIQ Access Manager as a reverse proxy, see Section 27.0, NetIQ Access Manager.

29.6 Filr Component Security

Section 29.6.1, Filr Software Security

Section 29.6.2, Filr Database Security

Section 29.6.3, Filr Search Index Security

29.6.1 Filr Software Security

The Filr software is a customized version of Apache Tomcat. The version of Apache used for the Filr software contains all security fixes and patches that were available when Filr was released.

29.6.2 Filr Database Security

The Filr database is a MySQL database built with SuSE Studio, and contains all security fixes and patches that were available when Filr was released.

29.6.3 Filr Search Index Security

The Filr search index is a Lucene search index. It contains all security fixes and patches that were available when Filr was released.

30.0 Security Policies

Section 30.1, Why Security?

Section 30.2, Out of the Box, Filr Is Locked Down

Section 30.3, Securing the Filr Data

Section 30.4, Securing the Filr Site

Section 30.5, Securing Filr Data on Mobile Devices

Section 30.6, Securing the Filr Desktop Application

Section 30.7, Certificates

Section 30.8, Sharing

Section 30.9, Comments

Section 30.10, LDAP-Provisioned Users and Local Users

Section 30.11, External Users and OpenID

Section 30.12, Proxy Users

Section 30.13, File Servers

Section 30.14, Audit Trail

Section 30.15, Simplified Rights Model

Section 30.16, Antivirus

Section 30.17, Backup and Restore

Section 30.18, NESSUS Scans

Section 30.19, Coverity

Section 30.20, Encryption

30.1 Why Security?

Enterprise data is a critical resource that must be protected from unauthorized access, eavesdropping, corruption, unintended modification, or Trojan horses.

Generating, storing, and protecting enterprise data requires significant investments in time, money, and other resources.

Filr is designed to enhance an organization’s ability to use and leverage its data. It has been carefully engineered to guard against exposing data to additional vulnerabilities.

30.2 Out of the Box, Filr Is Locked Down

Client access is only allowed using REST over SSL (HTTPS), using unique self-signed certificates for each instance.

All access through Filr is turned off by default.

All Filr sharing is off by default.

User provisioning can be done via LDAP over SSL (LDAPS).

Filr supports replacing self-signed certificates with certificates that have been signed by a trusted certificate authority (CA).

All security-related credentials and passwords are encrypted with unique 2048-bit keys.

Communication between virtual machines is authenticated and encrypted.

30.3 Securing the Filr Data

Section 30.3.1, Understanding Administrator Access to Filr Data

Section 30.3.2, Limiting Physical Access to Filr Servers

Section 30.3.3, Protecting the Filr Database

30.3.1 Understanding Administrator Access to Filr Data

The Filr administrator can see all files and folders:

In each user's My Files area (includes files in personal storage or files in a home directory on a remote file server)

In every Net Folder

This includes file content as well as file metadata (comments, creation and modification information, and so forth).

30.3.2 Limiting Physical Access to Filr Servers

Servers where Novell Filr data resides should be kept physically secure so that unauthorized persons cannot gain access to the server consoles.

30.3.3 Protecting the Filr Database

Depending on your local security guidelines, you might want to encrypt the database connections between the Filr software and the Filr database. SSL-encrypted data between the Filr application and the database server imposes a performance penalty because of the increased overhead of encrypting and decrypting the retrieved data.

Support for this is highly dependent on the database client drivers and JDBC connector support, and on how you are configuring your database client and server certificates. You should check with your database vendor on how to set up SSL connections on both the client and server sides of the connection. You might need to modify the JDBC URL when configuring the Filr appliance, as described in Section 1.4.4, Database Location in a Small Deployment. For example, for MySQL, you might add useSSL=true&requireSSL=true to the options part of the JDBC URL.

30.4 Securing the Filr Site

Section 30.4.1, Configuring a Proxy Server

Section 30.4.2, Setting the Filr Administrator Password

Section 30.4.3, Securing the Filr Site against XSS

30.4.1 Configuring a Proxy Server

Your Novell Filr system should be located behind your firewall. If Filr users want to access the Filr site from outside your firewall, you should set up a proxy server outside your firewall to provide access. You can use NetIQ Access Manager to protect your Filr site, as described in Section 1.8, Changing Reverse Proxy Configuration Settings.

30.4.2 Setting the Filr Administrator Password

The Filr site is initially installed to allow administrator access by using the user name admin and the password admin. The Filr administrator password should be changed immediately after installation, as described in Section 3.2, Resetting the Filr Administrator Password.

30.4.3 Securing the Filr Site against XSS

Cross-site scripting (XSS) is a client-side computer attack that is aimed at web applications. Because XSS attacks can pose a major security threat, Novell Filr contains a built-in security filter that protects against XSS vulnerabilities. This security filter is enabled by default.

The following sections describe the types of content that the security filter blocks from the Filr site, where exactly it blocks it from entering, and how you can disable the security filter or enable specific users to bypass the security filter.

Understanding What Content Is Not Permitted

Understanding Where the Content Is Not Permitted

Listing All XSS Threats in Your System

Understanding What Content Is Not Permitted

By default, the XSS security filter in Filr is very strict, and does not allow users to add certain types of content. For example, the following content is not permitted:

HTML that contains JavaScript

Forms

Frames

Objects

Applets

Understanding Where the Content Is Not Permitted

The type of content discussed in Understanding What Content Is Not Permitted is filtered by Filr in the following areas:

Text and HTML fields in entries and folders

Uploaded HTML files

Listing All XSS Threats in Your System

Filr enables you to run an XSS report that lists XSS threats that are contained in your Filr system. For more information, see Section 26.2.9, XSS Report.

30.5 Securing Filr Data on Mobile Devices

For information about data security for mobile devices, see Section 13.4, Understanding Filr Data Security for Mobile Devices.

30.6 Securing the Filr Desktop Application

For information about data security for the Filr desktop application, see Section 14.0, Configuring the Filr Desktop Application to Access Files.

30.7 Certificates

All communication with Filr appliances is done using certificates.

Self-signed certificates are used by default.

You can import your own trusted CA certificates so that clients configured to trust these certificates do not get a certificate warning.

Filr appliances use the same certificate for all services on the appliance (VA Admin, Web Application, Apache, Tomcat, Jersey/Jetty).

30.8 Sharing

Sharing is turned off by default.

Sharing controls must be configured for files in the My Files area (includes users’ personal storage and Home directories) and for Net Folders.

Sharing for files in the My Files area can be configured on a global level for all users or for individual users or groups.

Even if sharing is turned on for a given user or group, it must also be turned on at every Net Folder and for each user for files in their Home folder.

My Files vs. Net Folders

My Files: Filr expects that you want users to be able to share their own files and folders.

After sharing is enabled at the global level, users can share files and folders in their My Files area by default (includes users’ personal storage and Home directories).

Net Folders: Filr expects that you do not want users sharing files in Net Folders unless they are specifically authorized to do so.

Sharing is enabled at the global level for Net Folders. However, users cannot share the files in any Net Folder until you specifically turn sharing on for them at the Net Folder level (either individually or as part of a group).

Folders within Net Folders cannot be shared.

Sharing privileges are granular:

Share Internal: Users can share only with internal users (provisioned and administrator-created local users).

Share External: Users can share with external users. These are users that have been invited via an email notification to provision themselves as users in Filr based on their email address identity.

Share public: Users can share with the public. No authentication is required. The URL that is shared in public sharing can be forwarded, posted, emailed, tweeted, blogged, and disseminated in any way. Anyone who has that URL can access the shared information.

30.9 Comments

All users that have access to a file or folder (via native rights or shared) can read the comments on that file or folder.

All users, except public users, can write comments.

Comment writing for public users is configurable, but it is off by default for two reasons:

Because public users are anonymous, there is a risk that they might be abusive, offensive, or meddlesome.

Comments cannot be deleted.

Novell plans to add more granular control over who can see comments in the future:

Add private comments that are directed at a specific set of users or groups. (In addition to open comments that are visible to all users with access.)

External users cannot write comments; they can only view comments.

Public users cannot read any comments.

30.10 LDAP-Provisioned Users and Local Users

Filr supports authentication using IDs and credentials that are validated with the LDAP identity source from which they were provisioned. The credentials from these LDAP providers are cached within Filr, but they are never really synchronized from the LDAP provider.

Local users that are not provisioned via LDAP have their local credentials stored in Filr. These credentials are secured, encrypted, and protected.

30.11 External Users and OpenID

External users provision themselves via a registration and validation process.

External users’ credentials are encrypted and securely stored and protected in Filr.

Filr also supports the OpenID authentication standard.

OpenID users authenticate through the OpenID provider. OpenID user credentials are never stored or copied to Filr’s credential storage area.

30.12 Proxy Users

Filr uses administrator-created proxy users for communicating with LDAP providers and Net Folder servers.

LDAP proxy users must have sufficient rights to read user and group objects from the desired contexts within LDAP providers.

Net Folder proxy users must have full rights to the file server volumes or shares that contain the Net Folders.

Proxy users’ identities and credentials are secured, encrypted, and protected in Filr.

30.13 File Servers

Filr honors and respects all trustee rights, file attributes, and folder attributes on all targeted file systems.

Filr never changes any rights or attributes on targeted file systems.

The only time file system rights are effectively bypassed is when a Filr user shares a file or folder with another user. In this case, the proxy user’s rights are used on behalf of the user receiving the share.

For example, if a user with full file system rights to a folder shares Contributor privileges on that folder with another user, the other user has rights to create new files in the folder via the proxy user, as authorized by Filr.

30.14 Audit Trail

Every authorization change is logged in Filr.

Every authentication decision is logged in Filr.

Enhanced reporting features are planned in this area in future releases.

Enhanced integration with audit trail analysis tools, such as NetIQ Sentinel, are planned in future releases.

30.15 Simplified Rights Model

Filr supports the following file systems:

Microsoft NTFS

Novell NSS

Filr supports the following native file access protocols:

Microsoft SMB/CIFS

Novell NCP

Many more storage subsystems and protocols are planned to be supported in future Filr releases.

Instead of mapping the intricate and sophisticated rights models from each of the possibly many storage systems, Filr adopted a simplified rights model that maps to the rights models of many storage systems.

The four roles in Filr:

None: No rights

Viewer: READ and VISIBILITY rights

Editor: READ, WRITE and VISIBILITY rights (WRITE includes modifying the contents of a file)

Contributor: READ, WRITE, CREATE, DELETE, RENAME, MOVE, COPY

IMPORTANT:Folders only, not Files.

Also, the rights apply only to folder contents, not to the folder itself.

Filr attempts to mimic the visibility features of each file system.

For example, if a user Tom has rights to a file in some sub-folders, Filr will ensure that Tom has VISIBILITY rights to all parent folders up to the top level of the Net Folder or My Files container.

30.16 Antivirus

You can leverage what you are doing on your file servers.

30.17 Backup and Restore

You can leverage what you are doing on your file servers.

VMware lets you create virtual disks on remote storage that is able to be backed up and restored independent of Filr.

30.18 NESSUS Scans

The Filr development team runs NESSUS scans on all Filr code and fixes all reported problems.

This means that no unexpected ports are open and all open ports are protected according to industry standards.

30.19 Coverity

The Filr development team runs all Filr code through Coverity.

Coverity not only checks for memory leaks and possible bugs using stack code analysis techniques, but it also helps developers identify security vulnerabilities, such as buffer over-runs.

30.20 Encryption

Filr encrypts all sensitive authentication credentials and all data on the wire between each Filr appliance.

Filr does not encrypt any back-end data on local or remote file servers.

Filr should work well with compatible back-end servers that support full-disk encryption.

Filr clients should work well with any client solutions, either desktop or mobile, including Novell ZENworks Full Disk Encryption.

Communication between the Filr desktop application and the Filr server is sent with SSL encryption.

Communication between the Filr mobile apps and the Filr server is sent with SSL encryption.

Additional encryption features are planned for future releases.

A.0 Troubleshooting the Filr System

Section A.1, Unable to Connect to the Filr Site (HTTP 500 Error)

Section A.2, Email Notification URLs Are Not Working

Section A.3, FAMT Error Codes

Section A.4, Enabling Debug Logging

A.1 Unable to Connect to the Filr Site (HTTP 500 Error)

Problem: You see an HTTP 500 error when trying to connect to the Filr site.

To fix this problem, ensure that your DNS server is properly configured and that your Filr server is directed at the proper DNS server.

For information about how to configure Filr to point to your DNS server, see Section 1.2.1, Changing the Network Configuration Settings.

A.2 Email Notification URLs Are Not Working

The network and reverse proxy settings that you configure after installing Filr affect how email notification URLs are constructed. If you have configured port redirection and have failed to verify the reverse proxy ports, email notifications from Filr can be constructed in such a way that users who click on the email notification URL are not able to access the Filr site.

When port redirection is enabled (as described in Section 1.2.1, Changing the Network Configuration Settings), ensure that the reverse proxy ports are set to 80 for the HTTP port and to 443 for the secure HTTP port. For information about how to change the reverse proxy ports, see Section 1.8, Changing Reverse Proxy Configuration Settings.

A.3 FAMT Error Codes

When errors occur in the FAMT component of Filr, an error code is displayed. These codes can be helpful for diagnosing problems with FAMT. The following table lists the possible error codes and a brief interpretation.

Error Code

Interpretation

0

FAMT_SUCCESS

1

FAMT_FAILURE

2

FAMT_NO_MEMORY

3

FAMT_OPEN_FILE_FAIL

4

FAMT_GET_FILE_SIZE_FAIL

5

FAMT_READ_FILE_FAIL

6

FAMT_WRITE_FILE_FAIL

7

FAMT_SOCKET_WRITE_FAIL

8

FAMT_LOGIN_FAILED

9

FAMT_GET_FILE_INFO_FAIL

10

FAMT_CREATE_FILE_FAILED

11

FAMT_PATH_NOT_FOUND

12

FAMT_CONFLICT

13

FAMT_SHARING_VIOLATION

14

FAMT_ALREADY_EXIST

15

FAMT_NO_CONTENT

16

FAMT_REQUIRED_AUTH

17

FAMT_UNDEFINED_VOLUME

18

FAMT_INVALID_PARAMETERS

19

FAMT_ADD_TRUSTEE_FAILED

20

FAMT_MAP_OBJ_TOID_FAIL

21

FAMT_ACCESS_VIOLATION

22

FAMT_GET_RIGHTS_FAILED

23

FAMT_LOCK_NOT_EXIST

24

FAMT_RESOURCE_BUSY

25

FAMT_DUP_ENTRY

26

FAMT_SERVER_DOWN

27

FAMT_PATH_TOO_LONG

100

FAMT_XML_PARSING_FAILED

A.4 Enabling Debug Logging

Section A.4.1, Enabling Debug Logging for Filr

Section A.4.2, Enabling Debug Logging for FAMT

A.4.1 Enabling Debug Logging for Filr

In a text editor, open the log4j.properties file from both of the following directories:

/opt/novell/filr/apache-tomcat/conf

Uncomment each line for which you want to enable debug logging in the log4j.properties file.

For example, to trace file synchronization and accesses through mirrored folders, uncomment the following lines in the log4j.properties file:

log4j.category.com.novell.teaming.module.folder.impl.PlusFolderModule=DEBUG
log4j.category.org.kablink.teaming.module.file.impl.FileModuleImpl=DEBUG
log4j.category.org.kablink.teaming.fi=DEBUG
log4j.category.com.novell.teaming.fi=DEBUG
log4j.category.com.novell.teaming.repository.fi=DEBUG

To trace interactions with resource drivers, uncomment the following lines in the log4j.properties file:

log4j.category.org.kablink.teaming.util.TraceableInputStreamWrapper=DEBUG
log4j.category.com.novell.teaming.fi.TraceableAclResourceDriverWrapper=DEBUG
log4j.category.com.novell.teaming.fi.TraceableAclResourceSessionWrapper=DEBUG

Monitor the /var/opt/novell/tomcat-filr/logs/appserver.log file.

A.4.2 Enabling Debug Logging for FAMT

Setting Debug Logging for FAMT

Viewing FAMT Log Files

Clearing FAMT Log Files

Setting Debug Logging for FAMT

From the command line of the Filr appliance, change to the following directory:

/opt/novell/filr/bin

Set the FAMT log level as follows:

./famtconfig -s loglevel 4

or

To view the current log level:

./famtconfig -g loglevel

Viewing FAMT Log Files

Change to the following location on the Filr server:

/var/opt/novell/filr/log

The famtd.log, debug, and core files are available for debugging functionality issues related to FAMT.

Clearing FAMT Log Files

Run the following command to clear the log files:

/etc/logratoate.d/novell-famt-logs

FAMT logs are rotated after the log size exceeds 5MB.

B.0 Documentation Updates

There have been no changes made to the guide since the initial release of Novell Filr 1.1.

C.0 Legal Notices

Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the Novell International Trade Services web page for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export approvals.

Copyright © 2013-2014 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc.

1800 South Novell Place

Provo, UT 84606

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see the Novell Documentation web page.

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list.

Third-Party Materials

All third-party trademarks are the property of their respective owners.