Installation instructions for hot fix P04008 on Windows for x64

Installation Instructions for Hot Fix P04008

Windows for x64

Hot fix P04008 addresses the issue(s) in SAS Enterprise GRC 5.1_M5 as documented in the Issue(s) Addressed section of the hot fix download page:

http://ftp.sas.com/techsup/download/hotfix/HF2/P04.html#P04008

P04008 is a "container" hot fix that contains the following "member" hot fixes which will update the software components as needed.

P03008 updates SAS Enterprise GRC Administrative Tools 5.1_M5
P02008 updates SAS Enterprise GRC Mid-Tier 5.1_M5
V23001 updates SAS Enterprise GRC Server 5.1_M5

See What is a container hot fix? in the Hot Fix FAQ for more information about container hot fixes.

Before applying this hot fix, follow the instructions in SAS Note 35968 to generate a SAS Deployment Registry report, then verify that the appropriate product releases are installed on your system. The release number information in the Registry report should match the 'member' release number information provided above for the software components installed on each machine in your deployment.

The hot fix downloaded, P04008pt.zip, includes the updates required for all components listed above on all applicable operating systems. To apply this hot fix on multiple machines, you can either save P04008pt.zip on each machine or save it in a network location that is accessible to all machines.

Do NOT extract the contents of P04008pt.zip. The hot fix installation process will extract the contents as needed.

IMPORTANT NOTES

Files delivered in this hot fix will be backed up during the installation process. However, it is good general practice to back up your system before applying updates to software.
You must have Administrator Privileges on your CLIENT or SERVER machine.
All currently active SAS sessions, daemons, spawners and servers must be terminated before applying this hot fix.
This hot fix should be installed using the same userid who performed the initial software installation.

INSTALLATION

Hot Fix P04008 must be installed on each machine where the updated components of the product, listed above, are installed. During the installation process you may see references to all operating systems for which updates are provided in the hot fix. The installation process will determine the operating system and which component(s) of SAS Enterprise GRC 5.1_M5 require updating on the machine. See SAS Note 44810 for more details.

The hot fix will be applied using the SAS Deployment Manager. By default, the SAS Deployment Manager will search in the <SASHOME>\InstallMisc\HotFixes\New directory for hot fixes to be applied, but will also prompt for a location if you have downloaded hot fixes to a different directory.

After downloading P04008pt.zip, follow the instructions for applying hot fixes in the SAS Deployment Wizard and SAS Deployment Manager 9.3: User's Guide.

The hot fix installation process generates the log file

<!SASHOME>\InstallMisc\InstallLogs\IT_date-and-time-stamp.log

for example, IT_2011-10-31-13.18.21.log. Each attempt to apply a hot fix results in the creation of a new log file giving detailed information regarding the installation process.

Postexec log files are created after the installation is completed and identifies the files that were added, backed up, changed and removed. These log files include the ‘member’ hot fix id in the name of the file and are also written to the <!SASHOME>\InstallMisc\InstallLogs directory. There is one postexec log for each ‘member’ hot fix applied (member hot fixes are listed at the top of these instructions).

The content of this hot fix is listed in the hot fix manifest.

POST-INSTALLATION INSTRUCTIONS

For each product installed, click the link to be redirected to post-installation instructions.

P03008 updates SAS Enterprise GRC Administrative Tools 5.1_M5
P02008 updates SAS Enterprise GRC Mid-Tier 5.1_M5
V23001 updates SAS Enterprise GRC Server 5.1_M5

P03008 updates SAS Enterprise GRC Administrative Tools 5.1_M5

Perform the following steps to ensure the administrative tools are running with the latest updates.

Make a backup of the file “picklist” under <SASCONFIGDIR>/Applications/SASEnterpriseGRCAdministrativeTools/5.1/dbscripts
Copy the new “picklist” from <SASHOME>/SASEnterpriseGRCAdministrativeTools/5.1/picklist

to

<SASCONFIGDIR>/Applications/SASEnterpriseGRCAdministrativeTools/5.1/dbscripts/picklist

and overwrite the current contents.

P02008 updates SAS Enterprise GRC Mid-Tier 5.1_M5

Re-build and Re-deploy Web Application

This hot fix requires that the WebApp be rebuilt and redeployed. Use the following steps to perform this post-installation task:

Step 1: Re-build Web Application
In order for this step to execute correctly, the Metadata Server must be running.
1.1 Invoke the SAS Deployment Manager 9.3
From the SASDeploymentManager directory launch sasdm.sh.
SAS Deployment Manager is installed in the following default location:
<SASHOME>/SASDeploymentManager/9.3

1.2 Select a language in the Choose Language box
1.3 Select Rebuild Web Applications
1.4 Select Configuration Directory or Enter the Configuration Directory and Level that needs to be updated
1.5 Specify Connection Information, including the sasadm User ID and Password
1.6 Select Enterprise GRC MidTier 5.1 as the Web Application to Rebuild
1.7 Verify the information on the Summary screen and select Start
1.8 Select Finish when the deployment is complete
This process will update the Enterprise GRC MidTier 5.1 ear in <SASCONFIGDIR>/Web/Staging.
A backup of the original ear file will be placed in the directory below:

<SASCONFIGDIR>/Web/Staging/Backup

Step 2: Re-deploy Web Applications
Re-deploy the web applications based on the instructions for the web application server you are using.

Clean up the Application Server cache. Please contact your Administrator for detail steps specific to your application server.

Notes:

Please see SAS Note 54281 and SAS Note 54282 for recommended changes to the SAS Enterprise GRC workflow and notification templates.
The system can now be configured to hide the allocation/monetary breakdown tab in the incident wizard using a new option "monitor.incidentMonetaryBreakdown.enable". To disable this tab, set the following properties in configdata.properties:
monitor.incidentAllocation.enable = false
monitor.incidentMonetaryBreakdown.enable = false

By default, both values are true. A restart of the SAS Enterprise GRC MidTier server is required for this change to take effect.
A new configuration option has been added to allow users to delete accepted tests. To enable this behavior, set the following property in configdata.properties:
monitor.controlTesting.canDeleteAcceptedTest = true

By default, the value is false, and accepted tests cannot be deleted or unloaded.
As part of security fix to prevent cross-scripting vulnerability, please update configdata.properties file and add the property "monitor.http.xframeoptions" with one of the following values:
SAMEORIGIN - only allows current site to frame content
ALLOW-FROM uri - only allows the page to be framed from the specified origin (may not be supported on all browsers)
DENY - prevents any domain from framing the content (not recommended)
none - turn off header, do not set any value (default)
A new configuration option has been added to allow excluding test plans from the task list. To enable this behavior, set the following property in configdata.properties:
monitor.tasklist.excludedtypes=TestPlan

By default, the value is empty.
A new configuration option has been added to include draft incidents in the task list, even if incident workflow has been disabled. To enable this behavior, set the following property in configdata.properties:
monitor.tasklist.includedraftincidents=true

By default, the value is false.
A new configuration option has been added that enabled additional permission checking when tests are opened. To enable test definition permission checking when opening tests, set the following property in configdata.properties:
monitor.controlTesting.verifyTestDefinitionPermissionUponOpeningTests=true

By default, the value is false.
A new configuration option has been added that enabled additional permission checking when tests are opened. To enable test definition permission checking when opening tests, set the following property in configdata.properties:
monitor.controlTesting.verifyTestDefinitionPermissionUponOpeningTests=true

By default, the value is false.
New configuration options have been added to turn off status reset of data loaded or migrated test definitions and tests from "In Progress" to "Returned to Originator".
monitor.controlTesting.testDefinitions.resetStatusInNewWorkflow=false
monitor.controlTesting.tests.resetStatusInNewWorkflow=false
By default, the values are true.
A new configuration option has been added that excludes all columns from dimension searches. To search only on the name column, set the following property in configdata.properties:
monitor.ora.searchIncludesAllColumns=false
By default, the value is true, and all columns in the table are used when searching.
A new configuration option has been added to control the change reason prompt behavior for test definitions and tests. To let workflow transitions determine whether a change reason prompt appears, add the following option to configdata.properties:

monitor.controlTesting.workflow.promptChangeReasonOverride=true
By default, the property is false. When setting to true, it is recommended that the workflow template for tests and test definitions be updated to have the "GRC_PROMPT_CHANGE_REASON" data object with a value of "Yes" at the root level, and then selectively disable the change reason by setting the value on individual transitions.
A new configuration option has been added to set GRC_ISMODIFIED for test definitions based on whether a control or issue has been changed. To enable this behavior, set the following option in configdata.properties.
monitor.controlTesting.testDefinitions.checksControlsAndIssuesForIsModified=true
By default, the property is false.
A new configuration option has been added to allow test definitions to be excluded from the task list by validation state code value:
monitor.tasklist.exclude.TestDefinition=validationStateCd1,validationStateCd2
By default, this value is empty.
As part of a security fix, an additional configuration option has been added to control what content can be embedded into the product. The following configuration option has been added:
# List of acceptable embedded urls.
# If urls start with / the context root is prefixed before checking
# Otherwise an exact match is used.
monitor.embed.whitelist=/CPBDocumentation?docType=COMPONENTS&topLevel=true,/CPBDocumentation?docType=FUNCTIONS&topLevel=true,/CPBDocumentation?docType=DIRECTIVES&topLevel=true,/CPBDocumentation?docType=PROPERTIES&topLevel=true
IMPORTANT: This option is enabled by default with the values shown above, even though it may not be shown in configdata.properties. After installing the HF, you must check your menu XML for any menu items with embed="true", append them to the default property values. For example:
monitor.embed.whitelist=/CPBDocumentation?docType=COMPONENTS&topLevel=true, /CPBDocumentation?docType=FUNCTIONS&topLevel=true,/CPBDocumentation?docType=DIRECTIVES&topLevel=true, /CPBDocumentation?docType=PROPERTIES&topLevel=true,<menu-option1>,<menu-option2>
Although not recommended, this option may be disabled altogether by setting monitor.embed.whitelist=OFF
This hotfix contains a performance optimization for object permission checks, which may improve performance for large operational areas. To enable the optimization, set the following property in configdata.properties:
monitor.query.canQueryOptimizationEnabled=true
By default, the optimization is off (false).
This hotfix contains a performance optimization for loading recent tests for a test definition. This option must be used in conjunction with the option “monitor.cloneTestDefnitions=false”. To enable the optimization, set the following property in configdata.properties:
monitor.query.optimizeRecentTestsQuery=true
By default, the optimization is off (false).
This hotfix contains a performance optimization for loading recent test results. To enable the optimization set the following property in configdata.properties:
monitor.query.optimizeRecentTestResultsQuery=true
By default, the optimization is off (false).
This hotfix contains a security enhancement to prevent unvalidated redirects. To allow redirects to specific URLs, specify the following property in configdata.properties:
monitor.redirect.whitelist=<url1>,<url2>,<url3>,…
It can specify a comma-separated list of URLs, where each URL is either a full URL (http://www.sas.com), or a URL relative to the SASEnterpriseGRC context root, which must start with “/”. After applying the hotfix, you should examine your “MainNavigationMenu.xml”, and add entries to this list of any menu option with the sas-sso attribute set to “true”. Although not recommended, you may also specify a value of “OFF” to disable enforcement. By default, the property is empty.
This hotfix contains a performance optimization for loading recent assessments when viewing a risk. To control the number of assessments are listed based on the age of the answer sheet in days, set the following property in configdata.properties:
monitor.query.recentAssessmentCutoffDays=<num_of_days>
where <num_of_days> is the age of the assessment’s answer sheet in days. By default, the value is -1, and all assessments will be shown.
This hotfix allows for new tests to be placed in a custom location. To enable this fix, set the following option in configdata.properties:
monitor.controlTesting.newTestsLocation=useCustom
The default value is “useControl”, which uses the control location. The value “useTestDef” uses the test definition’s location.

When this option is set to “useCustom”, the system will look for a Groovy script called “customNewTestLocation.groovy” in /sasdav/Products/SASEnterpriseGRC/EnterpriseGRCMidTier5.1/Scripts/ which implements a getCustomLocation method with access to the Test Definition and Control Instance locations. An example implementation of customNewTestLocation.groovy is provided in the location “<SASHOME>\SASEnterpriseGRCMidTier\5.1\Config\Deployment\Content\Preload\Scripts”, which may be uploaded to the content server to use a custom location. After adding the groovy script to the content server, you must flush caches or restart the GRC application server for the change to be effective.
A new error message key has been added, “PermissionsException.noLockForEditPermission.message.fmt.txt”, which will be used if a user has permission to view and re-assign an incident, but not to edit it. The value may be customized in customMessages.properties

V23001 updates SAS Enterprise GRC Server 5.1_M5

Copy SAS Changes to <SASCONFIGDIR>

The following files have been updated as part of the this hotfix but are not directly copied to the <SASCONFIGDIR>.

Copy the files below from

<SASHOME>\SASFoundation\9.3\ormonitormva\ucmacros\orm_add_cust_fields.sas
<SASHOME>\SASFoundation\9.3\ormonitormva\ucmacros\orm_all_cust_fields.sas
<SASHOME>\SASFoundation\9.3\ormonitormva\ucmacros\orm_pivot_datatype.sas

to

<SASCONFIGDIR>\Applications\SASEnterpriseGRCServerCfg\5.1\Source\ucmacros\orm_add_cust_fields.sas
<SASCONFIGDIR>\Applications\SASEnterpriseGRCServerCfg\5.1\Source\ucmacros\orm_all_cust_fields.sas
<SASCONFIGDIR>\Applications\SASEnterpriseGRCServerCfg\5.1\Source\ucmacros\orm_pivot_datatype.sas