---
version: "9.21"
language: "en"
---
# Welcome to SuperSTAR

## Start Here

*

  ### [Change History](https://docs.wingarc.com.au/superstar/9.21/change-history.md)

  This page describes major changes to the SuperSTAR suite from version 9.0 onwards. This is intended to assist customers who are upgrading to the latest version...
*

  ### [User Guide](https://docs.wingarc.com.au/superstar/9.21/user-guide-sw2.md)

  SuperWEB2 is a browser based client for the SuperSTAR platform. This user guide explains everything you need to know to get the most out of the SuperWEB2 clien...
*

  ### [Installation Requirements, Compatibility and Supported Platforms](https://docs.wingarc.com.au/superstar/9.21/installation-requirements.md)

  This section defines the hardware and software requirements for the SuperSTAR suite of products. This information is subject to change. Please contact customer...

## Documentation

### [SuperSTAR](https://docs.wingarc.com.au/superstar/9.21/superstar.md)

### [SuperSERVER](https://docs.wingarc.com.au/superstar/9.21/superserver.md)

### [SuperCHANNEL](https://docs.wingarc.com.au/superstar/9.21/superchannel.md)

### [SuperCROSS](https://docs.wingarc.com.au/superstar/9.21/supercross.md)

*

  ### [SuperTABLE](https://docs.wingarc.com.au/superstar/9.21/supertable.md)

### [SuperWEB2](https://docs.wingarc.com.au/superstar/9.21/superweb2.md)

### [Open Data API](https://docs.wingarc.com.au/superstar/9.21/open-data-api.md)

### [Production System](https://docs.wingarc.com.au/superstar/9.21/production-system.md)

### [Glossary](https://docs.wingarc.com.au/superstar/9.21/glossary.md)

*

  ### [Download Library](https://docs.wingarc.com.au/superstar/9.21/download-library.md)

*

  ### [Go-Live Checklist](https://docs.wingarc.com.au/superstar/9.21/go-live-checklist.md)

*

  ### [Change History](https://docs.wingarc.com.au/superstar/9.21/change-history.md)

---
version: "9.21"
language: "en"
---
# A

* [Active Directory](https://docs.wingarc.com.au/superstar/9.21/active-directory.md)
* [active table](https://docs.wingarc.com.au/superstar/9.21/active-table.md)
* [aggregated data](https://docs.wingarc.com.au/superstar/9.21/aggregated-data.md)
* [annotation](https://docs.wingarc.com.au/superstar/9.21/annotation.md)
* [Application Programming Interface (API)](https://docs.wingarc.com.au/superstar/9.21/application-programming-interface-api.md)
* [attributes](https://docs.wingarc.com.au/superstar/9.21/attributes.md)
* [axis](https://docs.wingarc.com.au/superstar/9.21/axis.md)
* [axis derivation](https://docs.wingarc.com.au/superstar/9.21/axis-derivation.md)
* [axis item](https://docs.wingarc.com.au/superstar/9.21/axis-item.md)
* [axis reference item](https://docs.wingarc.com.au/superstar/9.21/axis-reference-item.md)

---
version: "9.21"
language: "en"
---
# Accessibility

From version 9.20 onwards, SuperWEB2 complies with version 2.2 of the Web Content Accessibility Guidelines (WCAG), as published by the World Wide Web Consortium (W3C). SuperWEB2 complies at the AA level.

Earlier versions of SuperWEB2 were compliant with version 2.1.

Some examples of SuperWEB2 features that have been implemented to support accessible use of the platform include the following:

* SuperWEB2 can be used with assistive technologies such as screen readers.

* Descriptive text is provided for all images.

* The solution is fully keyboard navigable.

See <https://www.w3.org/TR/WCAG22/> for the official checklist published by the W3C. To assist our customers with their own validation and compliance requirements, we have also provided [our own checklist with detailed notes on how SuperWEB2 complies with each item](https://docs.wingarc.com.au/superstar/9.21/wcag-checklist.md).

## SuperWEB2 Keyboard Navigation

As part of SuperWEB2's accessibility support, SuperWEB2 can now be navigated entirely using the keyboard.

The SuperWEB2 keyboard controls generally follow [standard conventions for keyboard navigation](https://www.w3.org/WAI/GL/wiki/Using_ARIA_trees#Keyboard_Support):  

|     **Key**     |                                                                                                                                                                                                                                              **Description**                                                                                                                                                                                                                                              |
|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Tab**         | Navigate between interactive elements such as buttons, controls, menus and links in sequential order from top to bottom and left to right.                                                                                                                                                                                                                                                                                                                                                                |
| **Shift + Tab** | Navigate back through buttons, controls, menus and links in reverse order.                                                                                                                                                                                                                                                                                                                                                                                                                                |
| Arrow keys      | Navigate within elements such as tree controls (for example the list of datasets) and drop-down menus. To use these you need to first use the **Tab** key to move focus onto the element, and can then use the arrow keys to move up and down the menu items, or up and down the list of datasets. See below for more details. Please note that if you are using Apple Mac Voice Over, you will need to use **Command** + Arrow keys to navigate within these elements instead when Voice Over is active. |
| **Enter**       | Action the element that currently has focus (for example, follow a link, open a menu option, or execute a button action).                                                                                                                                                                                                                                                                                                                                                                                 |
| **Space**       | Select a check box that currently has focus.                                                                                                                                                                                                                                                                                                                                                                                                                                                              |

As you navigate through the items, your browser will highlight the element that currently has focus (the exact highlighting will depend on the browser you are using). In the following example, the **Graph View** link currently has focus, so pressing **Enter** in this case would open **Graph View**.  
![SuperWEB2 tab bar showing the Graph View tab with the black ring focus highlighat](https://docs.wingarc.com.au/__attachments/a_5f41ffc213786270f24d161b7e69de4bb175074f7973f53506c0fd763ce2ad0e/image2021-9-9_13-53-36.png?cb=f82bc8bc6fec99e28d48ca5ab5333738)

### Navigating Menus

To access the menus in SuperWEB2, such as the main menu, the **Table View** settings menu, and the in-table menu, you first need to use the **Tab** key to move focus onto the menu.

Once the menu has focus, you can:

* Use the up and down arrows to navigate up and down the menu items.

* Use the left or right arrows to navigate into sub-menus.

* Use **Enter** to select a menu item.

### Navigating Within Tree Controls

Several SuperWEB2 screens contain tree controls, such as the list of datasets and tables on the **Datasets** screen, as well as the list of fields and field values in **Table View**.

For these elements, pressing **Tab** will move focus onto and off the whole tree control. Once the tree control has focus, you then use the arrow keys to navigate within that tree control:

* Use the up and down arrow keys to navigate up and down through the individual items within the tree (for example to move up and down the list of datasets or fields).

* Use the left and right arrow keys (or **Enter**) when the focus is on a parent item in a hierarchy (such as a group of datasets, group of fields, or an individual field) to expand or collapse the child items.

  ![Use of black ring highlight and Enter button to open group items within the field tree](https://docs.wingarc.com.au/__attachments/a_1729fe1453bfb265b13830f3850a8cea40057e37896fe43e0aa993ba5761a7ba/image2021-9-9_14-5-48.png?cb=52b3b5cabb01a97f678c8657e6b6018f)

Once you have moved the focus to an individual item in the tree that you are interested in, you can interact with that item as follows:

* (On the **Datasets** and **Tables** trees): Use **Enter** to select the currently-highlighted item. For example, press **Enter** to open the highlighted dataset or table in **Table View**.

* (On trees containing fields and field items, such as the one in **Table View** ): Use **Space** to select or clear the check box for that item. You will then need to **Tab** back up to the**Add to** table buttons to add or remove your selected field items. See the steps below for more details.

  ![Use of black ring highlight and spacebar to select items within the field tree](https://docs.wingarc.com.au/__attachments/a_80cd89177072ebe73449e1c3992538ccdc3101483ee083754f784242b5859d66/image2021-9-9_14-2-19.png?cb=9fff14bf73bdacd5c6fb4f0086016686)

### Create Tables using Keyboard Navigation

It is possible to create tables using only keyboard controls. The basic process is to select the individual field items you want to add and then use the **Add to** table buttons to add your selections.

1. In **Table View** , use **Tab** to move focus onto the entire field tree.

2. Once the tree has focus, use the arrow keys to navigate to the field you are interested in.

3. Once you have move focus onto a field that you want to use, you can either select items individually, or use the **Select all at level** drop-downs:

   * To select items individually:

     1. Use the right arrow key to expand the field, then the up and down arrow keys to navigate down to an individual item

     2. Press **Space** to select the check box.

     3. Repeat the above steps until you have selected all the items you want to add to the table.

   * To use **Select all at level**:

     1. With the field in focus, press **Tab** to move to the **Select all at level** drop-down.

     2. Press **Enter** to open the drop-down.

     3. Use the arrow keys to navigate to the level you want to use.

     4. Press **Space** or **Enter**to select all items at that level.

4. Once you have selected all the items you want, use **Tab** to move focus back to one of the **Add to** table buttons (**Row** , **Column** , **Wafer** , and **Filter**), which appear above/before the field list.

5. Press **Enter** to action the button and add the selected items to the table.

You can also use these steps to remove items from the table. Simply use the steps to select the check boxes for items that are already in the table. When you **Tab** back to the buttons you will have access to the **Remove** button, which will remove those items from the table.  
When you select field items, you will usually want to select items from only one field at a time, and then use the buttons to add these to the table. If you select items from a mixture of fields, these will be [concatenated onto the same axis](https://docs.wingarc.com.au/superstar/9.21/adding-multiple-fields-to-an-axis.md).

For example, if you select **Male** , **Female** and **Unknown** from the **Gender** field, then use the **Add to Row** button, this will add these items from **Gender** into your table rows. However, if you select **Male** from Gender and **Single** from Marital Status, and then use the **Add to Row** button, this will concatenate these two items on the rows. Concatenating produces a table that gives you the number of people who are **Male** and the number of people with **Marital Status** of **Single** , but does not give the cross tabulation (the number of **Males** in the dataset who are **Single**).

### Navigating Map View

In **Map View** , when the focus is on one of the drop-down lists (such as the **Field** drop-down list), you can start typing to search through the available items in the list. For example, you can type the start of a field item to quickly move to that item within the list.

## Ensuring Customer Modifications are WCAG Compliant

There are a number of areas of SuperWEB2 where administrators can add their own content. This includes the HTML info pages that display on the dataset catalogue screen, the contents of the interactive tour, as well as descriptive metadata, annotations, and documentation accessible via the help link.

To maintain WCAG-compliance throughout the solution, it is important to ensure that any web content you add to SuperWEB2 also complies with the WCAG specification. Refer to [WCAG Checklist](https://docs.wingarc.com.au/superstar/9.21/wcag-checklist.md) or [the official W3C guidelines](https://www.w3.org/TR/WCAG22/) for more details.

## Accessibility Testing - Verified Screen Readers

WingArc has tested SuperWEB2 using the following screen reader technologies:

* Job Access With Speech ( [JAWS](https://www.freedomscientific.com/products/software/jaws/))

* NV Access ([NVDA](https://www.nvaccess.org/))

* [Microsoft Windows in-built text to speech / narration capability](https://www.microsoft.com/en-us/accessibility/windows?activetab=pivot_1%3aprimaryr2)

* [Apple Mac Voice Over](https://www.apple.com/au/accessibility/mac/)

## Browser Support

WingArc has tested SuperWEB2 using the following browsers:  

| **OS**  |     **Browser**      |                                                                     **Compliance**                                                                     |
|---------|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| Windows | Chrome               | WCAG 2.2 AA                                                                                                                                            |
| Windows | Edge                 | WCAG 2.2 AA                                                                                                                                            |
| Windows | Firefox              | WCAG 2.2 AA                                                                                                                                            |
| Windows | Internet Explorer 11 | WCAG 2.2 AA                                                                                                                                            |
| Mac     | Safari               | SuperWEB2 is not currently fully WCAG 2.2 AA compliant in this browser. We are actively working to resolve this and intend to fix in a future release. |
| Mac     | Chrome               | WCAG 2.2 AA                                                                                                                                            |

---
version: "9.21"
language: "en"
---
# account

This command allows you to create and manage users and groups.

Any changes you make to users and groups will be applied immediately, although users who are currently logged in will not see the effect of your changes until the log out and log back in again.  
The `account` command is for managing local user accounts. As an alternative to managing a set of local user accounts in SuperADMIN, you can connect SuperSTAR to an external authentication service such as Active Directory or LDAP. See [these instructions to learn more](https://docs.wingarc.com.au/superstar/9.21/active-directory-and-ldap.md).  

|-----------------------------------------------------------------|
| `account <id>`                                                  |
| Displays information about the specified user account or group. |

|------------------------------------------------------|
| `account users`                                      |
| Displays a list of all the configured user accounts. |

|-----------------------------------------------|
| `account groups`                              |
| Displays a list of all the configured groups. |

|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `account creategroup <group_id> [ <display_name> ]`                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Creates a new group. |   `<group_id>`   |                           The group ID. This must be unique across all users and groups defined on this server.                           | | `<display_name>` | (Optional): a display name for the group. If not specified this will be the same as the group ID. Display names do not need to be unique. | |------------------|-------------------------------------------------------------------------------------------------------------------------------------------| |

|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `account createuser <user_id> [ <display_name> ] [ <password> ]`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Creates a new user. |   `<user_id>`    | The user ID. This is the username that the user will use to login to the client. This must be unique across all users and groups defined on this server. | | `<display_name>` |         (Optional): a display name for the user. If not specified this will be the same as the user ID. Display names do not need to be unique.          | |   `<password>`   |         (Optional): the user's password. If you do not specify this on the command line you will be prompted to enter and confirm the password.          | |------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------| When you create a new user, that user will not have access to any datasets by default. You must either add the user to a group that has access to the appropriate datasets, or use the `cat` command to give the user access to datasets: `cat <dataset_id> access {<user>|<group>} read {true|false}` |

|------------------------------------------------------------------|
| `account <group_id> users`                                       |
| Displays a list of users who are members of the specified group. |

|---------------------------------------------------------------|
| `account <user_id> memberships`                               |
| Displays a list of groups that the specified user belongs to. |

|-------------------------------------------------|
| `account <user_id> addmembership <group_id>`    |
| Adds the specified user to the specified group. |

|-------------------------------------------------|
| `account <group_id> adduser <user_id>`          |
| Adds the specified user to the specified group. |

|------------------------------------------------------|
| `account <group_id> removeuser <user_id>`            |
| Removes the specified user from the specified group. |

|--------------------------------------|
| `account <id> remove`                |
| Deletes the specified user or group. |

|-----------------------------------------------------------|
| `account <id> displayname <new_display_name>`             |
| Changes the display name for the specified user or group. |

|---------------------------------------------------|
| `account <user_id> invalidate token`              |
| Revokes the current API access key for this user. |

|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `account maxattempts <value>`                                                                                                                                                                                                                                                                                                                                    |
| Sets the default number of failed login attempts before an account will be locked. This will be the default setting and will apply to all users unless a different setting has been specifically applied to an individual user account. If you do not want accounts to lock at all, no matter how many times users provide the wrong details, set this to `-1` . |

|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `account <id> maxattempts <value>`                                                                                                                                                   |
| Sets the maximum number of failed login attempts before an account will be locked. This is the same as the previous command, except that it applies to a specific user account only. |

|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `account locktime <seconds>`                                                                                                                                                                                                                                                                                                                                                                                       |
| Sets the number of seconds to lock an account once the user has exceeded the maximum failed login attempts. During this time the user will not be able to login even if they specify the correct credentials. For example, if `maxattempts` is set to `3` and `locktime` is set to `600` then a user who enters their password incorrectly 3 times will be locked out for 10 minutes before they can log in again. |

|--------------------------------------------------------------------------------------------------------------------------------------------------|
| `account <id> locktime <seconds>`                                                                                                                |
| Sets the number of seconds to lock an account. This is the same as the previous command, except that it applies to a specific user account only. |

|---------------------------------------------------------------|
| `account <user_id> locked`                                    |
| Check whether the specified user account is currently locked. |

|----------------------------------------------|
| `account <id> {lock|unlock}`                 |
| Locks or unlocks the specified user account. |

|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `account <id> nolock {true|false}`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Controls whether accounts can be locked. This setting can be applied to both individual users and groups; if it is applied to a group then it will apply to all members of that group. * If this is set to `true` for an individual user, that account can never be locked, either through incorrect login attempts or through the SuperADMIN console. * If a user belongs to a group that has `nolock` set to `true` (but the setting is not applied to the individual user account) then that account cannot be locked through incorrect login attempts, but can still be locked by an administrator through the SuperADMIN console. |

|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `account updateloginentry {true|false}`                                                                                                                                                                                                 |
| Enables or disables the logging of a user's last successful login time. You are recommended to set this to `false` (the last successful login timestamp will not be stored) as this will improve the overall performance of the system. |

|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `account <user_id> setpassword`                                                                                                                                                                                        |
| Changes the password of the specified user. Use this command to reset a user's password (for example if the user has forgotten their password). You will be prompted to enter and confirm a new password for the user. |

If a display name or ID includes non alphanumeric characters (e.g. a space) then you must enclose it in quote marks. You must also enclose a display name or ID in quotes if it starts with a numeric character.

## Note about Deleting Users and Groups and Reuse of User and Group IDs

If you delete a user account or group, you are recommended not to reuse the ID when creating subsequent users or groups. Due to a known issue, in some cases a new user or group may inherit the permission of the previous user or group, if they share the same user ID.

For this reason, you are recommended not to reuse IDs from previously deleted users and groups when creating new users and groups. The problem only occurs when IDs are reused; you can use the same display name as a previously deleted user or group and the issue will not occur (as long as the ID is different).

---
version: "9.21"
language: "en"
---
# Active Directory

Active Directory is an implementation of LDAP directory services by Microsoft for use in the Windows environments.

Active Directory allows administrators to assign enterprise-wide policies, deploy programs to many computers, and apply critical updates to an entire organisation. An Active Directory stores information and settings relating to an organisation in a central, organised, accessible database.

See also [Lightweight Directory Access Protocol (LDAP)](https://docs.wingarc.com.au/superstar/9.21/lightweight-directory-access-protocol-ldap.md).

---
version: "9.21"
language: "en"
---
# Active Directory, LDAP and SAML

This section describes how to configure SuperSTAR to authenticate users against third-party authentication services, such as LDAP, Active Directory, and SAML.  
**Intended Audience**

This document is for System Administrators setting up the SuperSTAR suite in an enterprise environment. It is expected that you are familiar with how to [launch and login to the SuperADMIN Console](https://docs.wingarc.com.au/superstar/9.21/superadmin-console.md) command-line tool.

It is also expected that you are familiar with the basics of the relevant third-party authentication scheme. For example, for LDAP the use of Distinguished Names (DNs) to identify elements (e.g. users and groups) in the LDAP directory tree.

## Authentication in SuperSTAR

In the SuperSTAR software suite, user access is managed by the SuperADMIN service. Other components (such as SuperSERVER and SuperWEB2) connect to SuperADMIN to authenticate users.

SuperADMIN uses the typical system of **Users** and **Groups** of users to manage authentication and authorisation. By default, SuperADMIN will use a locally maintained list of users and groups that you can manage using the SuperADMIN console.

However, organisations typically have an existing directory of users and user groups that they maintain. Rather than duplicating that user directory, you can configure SuperADMIN to use the existing external user directory directly.

### Authentication Providers

SuperADMIN includes a set of authentication providers for connecting to authentication services or directories. The standard SuperADMIN installation includes the following providers:  

|    **Provider**    |                                                                                                                                                                         **Description**                                                                                                                                                                         |
|--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| STRLocal           | The default user and group store managed entirely via the SuperADMIN console. This user store is private to SuperADMIN.                                                                                                                                                                                                                                         |
| ActiveDirectory    | Authentication against a Microsoft Active Directory system, optionally with Single Sign On using Kerberos. Azure Active Directory is also supported via the Microsoft Azure Active Directory Domain Services Add On.                                                                                                                                            |
| eDirectory         | Authentication using the eDirectory LDAP server.                                                                                                                                                                                                                                                                                                                |
| ExternalJAASModule | Provides a plugin mechanism for advanced users to integrate SuperSTAR with an external authentication system. For example, a module could be written to authenticate via an Intranet portal system. This is the most flexible authentication provider, but it requires custom code to be written. Contact support for further information on using this module. |
| LDAP               | Lightweight Directory Access Protocol. A generic authentication provider for all other LDAP servers.                                                                                                                                                                                                                                                            |
| SAML               | [Security Assertion Markup Language](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language). An open standard for exchanging authentication and authorisation data. Refer to [SAML](https://docs.wingarc.com.au/superstar/9.21/saml.md) for further details on configuring SAML authentication.                                                                                 |

The ActiveDirectory, eDirectory and LDAP providers are all different flavours of authentication using an external LDAP server. Most of the configuration settings are the same for each of these providers.

To view the list of providers available in your SuperADMIN installation, use the following console command:

    auth providers

### Authentication Services

A configured instance of an authentication provider is called an **authentication service**. To configure SuperADMIN to authenticate users against your LDAP server, you must create and configure a new authentication service.

If necessary, you can authenticate against multiple authentication providers by creating multiple authentication services.  
The built-in authentication service (STRLocal) is used for initial configuration and as a fallback login method in case the external authentication service experiences problems. STRLocal cannot be removed or altered.

To view the details of the authentication services currently configured in your SuperADMIN installation, use the following console command (note that the built-in STRLocal service is not listed):

    auth services

## Create a New LDAP Authentication Service

When LDAP authentication is in use, SuperSTAR still performs authorisation via its own internal system. However, groups from the LDAP directory can be used to assign permissions in the SuperSTAR system.

To create a new LDAP authentication service, login to SuperADMIN as a user with administrative privileges (typically you should use the local SuperADMIN user to do the configuration), then complete the following steps:

### Step 1 - Create the Service

Type the following command to create the service:

    auth add <provider> <service_name>

Replace:

* `<provider>` with either `ActiveDirectory`, `eDirectory` or `LDAP` (if you are not using Active Directory or eDirectory, use the generic LDAP provider for all other cases)

* `<service_name>` with your chosen name for the service

For example:

    auth add LDAP myService

### Step 2 - Configure the Service

Use all the following commands (except those marked as optional) to configure the service parameters.

* Each command starts with `auth <service_name>`, where `<service_name>` is the name you selected when you created the service.

* You can type `auth services` at any time to review the settings you have already configured.

|                                    **Command**                                     |                                                                                                                                                                                                                                  **Configures**                                                                                                                                                                                                                                  |                                                      **Example**                                                      |
|------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> url <url>`                                                    | The fully qualified domain name of your LDAP/Active Directory/eDirectory server.                                                                                                                                                                                                                                                                                                                                                                                                 | `auth myService url "ldaps://ldaphost.company.com"`                                                                   |
| `auth <service_name> port <port>`                                                  | The port the LDAP server is running on. This property has been deprecated. It will be automatically set to either port `389` or `636` (the default LDAP ports) depending on whether you specify an `ldap` or `ldaps` url. If you need to specify a non standard port, you can do so in the URL parameter, in the form `<url>:<port>`. For example: `auth myService url "ldaps://ldap.foo.com:686"`                                                                               |                                                                                                                       |
| `auth <service_name> basedn <base>`                                                | The default base location for LDAP searches.                                                                                                                                                                                                                                                                                                                                                                                                                                     | `auth myService basedn "dc=company,dc=com"`                                                                           |
| `auth <service_name> user basedn <base>` `auth <service_name> group basedn <base>` | The default search location when searching for users or groups (optional).                                                                                                                                                                                                                                                                                                                                                                                                       | `auth myService user basedn "cn=users,dc=company,dc=com"` `auth myService group basedn "cn=groups,dc=company,dc=com"` |
| `auth <service_name> user userClass <attribute>`                                   | The LDAP "object class" of the objects that represent users or accounts (the standard Active Directory value is person).                                                                                                                                                                                                                                                                                                                                                         | `auth myService user userClass person`                                                                                |
| `auth <service_name> user groupAttr <attribute>`                                   | The name of the attribute of the LDAP user/account objects that indicates which groups the user is a member of (the standard Active Directory value is `memberOf`).                                                                                                                                                                                                                                                                                                              | `auth myService user groupAttr memberOf`                                                                              |
| `auth <service_name> user idAttr <attribute>`                                      | The name of the attribute of the LDAP user/account object that holds the unique ID of the user (the standard Active Directory value is `sAMAccountName`).                                                                                                                                                                                                                                                                                                                        | `auth myService user idAttr sAMAccountName`                                                                           |
| `auth <service_name> group groupclass <attribute>`                                 | The LDAP "object class" of the objects that represent groups of users or accounts (the standard Active Directory value is `group`).                                                                                                                                                                                                                                                                                                                                              | `auth myService group groupclass group`                                                                               |
| `auth <service_name> group memberAttr <attribute>`                                 | The name of the attribute of the LDAP group objects that indicates which users are members of the group (the standard Active Directory value is `member`).                                                                                                                                                                                                                                                                                                                       | `auth myService group memberAttr member`                                                                              |
| `auth <service_name> group idAttr <attribute>`                                     | The name of the attribute of the LDAP user/account object that holds the unique ID of the group (the standard Active Directory value is `cn`).                                                                                                                                                                                                                                                                                                                                   | `auth myService group idAttr cn`                                                                                      |
| `auth <service_name> adminGroup <group>`                                           | The name of a group of users from the LDAP server who should have administrator rights in SuperADMIN. Specify the group using just its name (you do not need a full DN).                                                                                                                                                                                                                                                                                                         | `auth myService adminGroup "SuperSTAR Administrators"`                                                                |
| `auth <service_name> group filter <groups>`                                        | The names of specific LDAP groups SuperADMIN will use for authorisation purposes. This is optional: if you omit this command then SuperADMIN will use all the groups defined in LDAP.                                                                                                                                                                                                                                                                                            | `auth myService group filter "Group1,Group2,Group3"`                                                                  |
| `auth <service_name> contextLogin true`                                            | Use this command and the following two commands to specify the LDAP user that SuperADMIN will use to login to the LDAP server. You are recommended to create a dedicated user for use by SuperADMIN.                                                                                                                                                                                                                                                                             | `auth myService contextLogin true`                                                                                    |
| `auth <service_name> contextLogin userdn <user>`                                   | The LDAP user that SuperADMIN will use to connect to the LDAP server.                                                                                                                                                                                                                                                                                                                                                                                                            | `auth myService contextLogin userdn "cn=superadmin,cn=Users,dc=domain"`                                               |
| `auth <service_name> contextLogin password <password>`                             | The password for the LDAP user that SuperADMIN will use to connect to the LDAP server.                                                                                                                                                                                                                                                                                                                                                                                           | `auth myService contextLogin password "autobuild"`                                                                    |
| `auth <service_name> priority <priority>`                                          | The priority for this authentication service. Each configured service has a priority: the service with the highest priority is tried first. If the login to the service fails, the next service is tried, and so on. The built-in STRLocal service has a priority of 100, so you should set your LDAP service to have a priority greater than 100. If you are adding multiple authentication services you can use the priority to control the order in which they will be tried. | `auth myService priority 200`                                                                                         |

### Step 3 - Additional Steps for Secure LDAP Connections

If you are configuring a secure LDAP connection, there are some additional steps required to add the LDAP server's trusted certificate to the Java Virtual Machine (JVM):

1. Ensure that you have specified the correct port in the LDAP URL when configuring the service. `636` is the default port for secure LDAP connections.

2. Obtain your LDAP server's signing certificate (you may need to ask your IT administrator for assistance with this step).

3. In a command prompt, change to the Java **bin** directory (if you are using the JRE supplied with SuperADMIN and have installed to the default location, this will be **C:\\Program Files\\STR\\SuperADMIN\\jre\\bin**).

4. Import the certificate using the following command:

       keytool -keystore <cacert_name> -importcert -alias <alias_name> -file <signing_certificate_file_location>

   For example:

       keytool -keystore ldapkeystore -importcert -alias ldapkeystore -file C:\ldapcert.cer

5. Run the following command to confirm that the certificate has been successfully imported:

       keytool -list -keystore <cacert_name>

   For example:

       keytool -list -keystore ldapkeystore

6. Modify SuperADMIN's **java-options.txt** file to add the following system properties (if you have installed to the default location, **java-options.txt** will be located in **C:\\ProgramData\\STR\\SuperADMIN\\server**):

       -Djavax.net.ssl.trustStore=<cacert_path_and_filename> 
       -Djavax.net.ssl.trustStorePassword=<password_entered_when_importing_the_certificate> 

   The properties need to be added to **java-options.txt** *before* the main class statement at the bottom of the file (i.e., they must appear at some point prior to the line that contains `au.com.str.superadmin.administration.server.impl.ServerLauncher`).

   For example:

       -Djavax.net.ssl.trustStore=C:\ldap\ldapkeystore
       -Djavax.net.ssl.trustStorePassword=MyPassword

7. Restart the SuperSTAR service.

#### Troubleshooting

To use a secure LDAP connection:

* The LDAP server's certificate must be trusted by the JVM. This should work without any additional configuration.

* If the SSL certificate you are using has not been signed by a trusted certificate authority, then you will not be able to login and an error similar to the following will appear in the SuperADMIN console **error.log** file. Please contact us for assistance if you encounter this error:

    javax.naming.CommunicationException: ... Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

### Step 4 - Activate the Service

When you have finished configuring all the service parameters, use the following command to activate your new service (replace `<service_name>` with the name of your service). Once you have activated the service it will be used to perform authentication if necessary:

    auth <service_name> active true

If you need to temporarily disable the authentication service for any reason, you can use the following command. This deactivates the service without deleting it:

    auth <service_name> active false

**Important Note**

Up to this point, you have most likely been using an administrator account that is defined by the STRLocal authentication service (the internal SuperADMIN authentication service).

Once you activate an external authentication service, such as LDAP, you need to switch to using an administrator account from that external authentication service (i.e., a user that belongs to the administrator group you specified using the `auth <service_name> adminGroup <group>` command).

You will not be able to manage permissions for the users or groups defined by this external authentication service unless you are logged in using an administrator account for that service.

If you set up multiple external authentication services, and you want to manage a user's account, then you must make sure you log in with an administrator account that belongs to the same authentication service as the user you want to manage. For example, this is important if you need to [unlock a user account when the user has authenticated through Active Directory/LDAP](https://docs.wingarc.com.au/superstar/9.21/unlock-a-user-account.md).  
The exception to the above rule is the `allusers` group. This is a special built-in group that applies to all users of the system. As an administrator user logged in under any authentication module, you can set permissions at the `allusers` level, and these permissions will be inherited by both local authentication users as well as users connected via an external authentication service.

For example, you can grant read access to a folder at the `allusers` level and this will apply to all users of the system unless specifically overridden at the individual user or group level.  
If you make changes to the configuration of your auth service after you activate it, you will need to reload the configuration using the following command:

`auth <service_name> reload`

## Learn More

* Now that you have configured LDAP, you can [use groups to configure user permissions](https://docs.wingarc.com.au/superstar/9.21/group-based-authorisation.md).

* As an alternative to typing out all the commands to configure LDAP/Active Directory, you can create a macro file and then run the macro in SuperADMIN. [See an example](https://docs.wingarc.com.au/superstar/9.21/example-macro.md).

* Learn some [other useful commands](https://docs.wingarc.com.au/superstar/9.21/other-useful-commands.md) for configuring an authentication service.

* To make it easier for SuperSERVER users to connect to the SuperSERVER, you can [enable Single Sign On with Kerberos](https://docs.wingarc.com.au/superstar/9.21/single-sign-on-with-kerberos.md).

---
version: "9.21"
language: "en"
---
# active table

A table that has been selected or built in SuperCROSS, SuperTABLE, or SuperWEB2.

---
version: "9.21"
language: "en"
---
# Add a Blank Row or Column to a Table

To make your table more readable, you can add spacing by using blank rows and columns. The blank rows and columns can either be completely blank rows/columns, or they can have headings.

For example, you could use blank rows to group values in your table as follows.  

|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Without blank rows:** ![No-Blank-Axis-Items.png](https://docs.wingarc.com.au/__attachments/a_4a717b62936a191ac3dfb92b79d89f104432c6e86f43371076032bb010ca51f0/No-Blank-Axis-Items.png?cb=3a926ed43a29202840cda6f5a5bc78ad) | **With blank rows:** ![With-Blank-Axis-Items.png](https://docs.wingarc.com.au/__attachments/a_a30ca8fd0de006d130bb793db24fbb98c5db1712b1440d6b084d558eb73cbc3d/With-Blank-Axis-Items.png?cb=3b4737ccaac5d971cdf69c73f9aaaea4) |

To add a blank field or axis item:

1. Right-click where you want to insert the blank item.

   * When adding a row, the blank row will be inserted *below* the one you clicked on.

   * When adding a column, the blank column will be inserted *to the right* of the column you clicked on.

2. Select **Derivations \> Add Blank Field Items** or **Derivations \> Add Blank Axis Items** (depending on whether you want to add the blank item to an individual field or to the axis).

   A dialog displays.  
   ![Add-Blank.png](https://docs.wingarc.com.au/__attachments/a_763eabe600b497b829285827ba1c8967e883d11b83d01c6d612636ffc9c22ae2/Add-Blank.png?cb=1f8a590979a094ab150a76d2acb36281)
3. If you want your blank axis item to have a heading, enter the heading text. Alternatively, leave this blank to create a completely blank spacer row or column.

4. Click **OK**.

---
version: "9.21"
language: "en"
---
# Add a New Language

This section describes what to do if you have [followed the instructions](https://docs.wingarc.com.au/superstar/9.21/set-up.md) and set up metadata already and now want to add an additional language to your deployment.  
Do not re-run the metadata configuration scripts, as this will replace your existing populated metadata database.

To add another language to an existing metadata database, simply follow these steps:

## Step 1 - Add the Language to your Metadata Database

Go to your metadata database and find the table called **meta_\<repository_id\>** (where **\<repository_id\>** is the repository ID you used when you set up the metadata database).

You will see that this table contains the details of the columns that exist in your metadata database (this will match the columns you set up in **metacolumns.txt** when you ran the batch file that created the metadata database):  
![SQL-language-tables.png](https://docs.wingarc.com.au/__attachments/a_295b67eb7d825f548ccc0e98a50c9d1ee3021fb16b454a5e4682068253e78343/SQL-language-tables.png?cb=e0f0c47476e1f8bdb9a577771b0bb398)

For each new language you want to add, add new name and description rows to this table. For example, to add translations for Spanish:  
![SQL-Add-language-tables.png](https://docs.wingarc.com.au/__attachments/a_5b5fea85f7925f1c7a1de7fcf74eba70c36bfc1e8ca131d9e74c22d32d0e075c/SQL-Add-language-tables.png?cb=e07cc2da8db78e7c21a28cd241ae9270)  
Make sure you use the correct [two character ISO 639-1 language code](http://en.wikipedia.org/wiki/List_of_ISO_639-1_codes) in the `ss_lang` column (for example, `en`, `fr`, `de`), or a combination of the two character ISO 639-1 language code and [the two character ISO 3166 country code](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2), separated by a hyphen (for example, `fr-CA`, `fr-FR`, `zh-CN`).

### Step 2 - Add Columns and Metadata to Each Table

For each table that you want to translate, you now need to add new columns for your new language. In this case we will need to add the columns `es_name` and `es_desc`:  
![SQL-Add-Columns.png](https://docs.wingarc.com.au/__attachments/a_e896e71b5ff810245f7f4c8c7c1a746c4084953d5fc5b549e5a58636d2f9f18b/SQL-Add-Columns.png?cb=f3b498af0488eda636c860f0ace27093)

Once you have added the columns, simply populate those columns with the metadata for that language. For example:  
![SQL-Add-Language-Columns.png](https://docs.wingarc.com.au/__attachments/a_b5f97acbd0a8f02e833ee6b07a2eea028800b919c2fb928a54cd8edc518ea570/SQL-Add-Language-Columns.png?cb=bdc0a2ee64022ef9ce429ed6f6ee68f5)

If there are any tables that you do not add the new columns and translations to, the client will simply display the values from the default language (in the examples shown here, the default is English).

### Step 3 - Update Metadata Config (SuperCROSS Only)

If you are using SuperCROSS, you need to check that the new language is specified in the SuperCROSS metadata configuration file, **metadata.config.xml** . In a default installation, this file is located in **C:\\ProgramData\\STR\\SuperCROSS**  
Make sure SuperCROSS is not running. Every time you close SuperCROSS, it writes out its current metadata configuration to **metadata.config.xml**. If you edit the file while SuperCROSS is running, the changes will not be picked up by the client, and when you subsequently close SuperCROSS your changes will be overwritten by the old settings from the client.  
Make a backup copy of this file before making any changes.

Open **metadata.config.xml** in a text editor, and locate the language map section, which will look similar to the following (in this example the file has been customised from the default to show the translated language names and the English language names in brackets):

    <KEY name="Lang-Map">
        <STRING name="ar">العربية (Arabic)</STRING>
        <STRING name="cy">Cymraeg (Welsh)</STRING>
        <STRING name="de">Deutsch (German)</STRING>
        <STRING name="en">English (English)</STRING>
        <STRING name="fr">Français (French)</STRING>
        <STRING name="it">Italiano (Italian)</STRING>
    </KEY>

If your new language is not already specified, add it to the list. Make sure the value of the `name` attribute matches the code you used in the `ss_lang` column:

    <KEY name="Lang-Map">
        <STRING name="ar">العربية (Arabic)</STRING>
        <STRING name="cy">Cymraeg (Welsh)</STRING>
        <STRING name="de">Deutsch (German)</STRING>
        <STRING name="en">English (English)</STRING>
        <STRING name="fr">Français (French)</STRING>
        <STRING name="it">Italiano (Italian)</STRING>
        <STRING name="es">Español (Spanish)</STRING>
    </KEY>

This step is not required for SuperWEB2. SuperWEB2 automatically sets the language names based on the language code.

### Step 4 - Update the Keyword Table

Update the `keyword` table in your metadata database so that it includes the translations of the keywords in the new language:

* Add a `<lang>_name` column to the keyword table (replace `<lang>` with the character code of the language you are adding).

* Populate this column with the keyword translations. See [Reference](https://docs.wingarc.com.au/superstar/9.21/reference.md) for details of the required keywords and where they are used in SuperCROSS and SuperWEB2.

### Step 5 - Restart the Metadata Server and Client

Restart Metadata Server, the SuperWEB2 service and SuperCROSS (as applicable) to apply the change.

Check that your changes have been picked up in the clients:

#### SuperCROSS

![SX-Select-Spanish-Table-Language.png](https://docs.wingarc.com.au/__attachments/a_2c3a63e5ec85085957a68d7ebea16ecf66ca58133343f1c8084cd063a1301ffe/SX-Select-Spanish-Table-Language.png?cb=5741a184d159e9da10599b4d45fb49d8)  
![SX-Spanish-Table.png](https://docs.wingarc.com.au/__attachments/a_f5e9fad99554b408298f56a6cd060bedc9d1af39c73dde100ee84d47331e3867/SX-Spanish-Table.png?cb=05e1c2a54ab6cb07db188ab64916a486)

#### SuperWEB2

![SW2-Multilingual-Drop-Downs-Spanish.png](https://docs.wingarc.com.au/__attachments/a_eaf27299a379ebe842f811f7160e9991528d81462492e5eb961599c683df5cec/SW2-Multilingual-Drop-Downs-Spanish.png?cb=38e3e8fd66b577803966a8758c079896)  
![SW2-Multilingual-Table-Spanish.png](https://docs.wingarc.com.au/__attachments/a_591593318c07240c2c423b1014954db51dd8ed58b1e44f127e2490d3f2dbf4a2/SW2-Multilingual-Table-Spanish.png?cb=5161168c71d2adb009de213cf1d7b560)

---
version: "9.21"
language: "en"
---
# Add a Terms and Conditions Screen

It is possible to configure SuperWEB2 to display a terms and conditions screen during log in. Users will need to accept the terms and conditions in order to log in to SuperWEB2. For example:  
![SuperWEB2 terms and conditions screen containing sample text](https://docs.wingarc.com.au/__attachments/a_a048424cf17dd310ab388faa43c6c76caa217f5f8d07ed3523320a736b6fd915/image2021-11-30_10-47-42.png?cb=ac1ff4a076a3e7fbbc06cb5d5f604a33)

To activate the terms and conditions screen, do the following:

## Step 1 - Activate the Terms and Conditions Page

1. Open **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\classes\\configuration.properties** in a text editor.

2. Locate the following line:

       login.requireTerms=

3. Set the property to `true`:

       login.requireTerms=true

4. Save your changes and restart SuperWEB2 or the Tomcat service.

### Step 2 - Add your Terms and Conditions

The second step is to add the text of your terms and conditions. You can do this by editing **\<tomcat_home\>\\webapps\\webapi\\terms.html** or replacing it with an HTML page containing your terms and conditions.

Only HTML body content is required in this file; your HTML page will be rendered inside the terms and conditions box during the login process.

## Require Users to Accept a New Set of Terms and Conditions

Users only need to accept the terms and conditions once. Once a particular user has accepted the conditions, those terms will not be shown to that user again on subsequent logins.  
In the case of guest users, their acceptance of the terms is stored in a cookie that expires when the browser closes. A guest user will therefore be required to accept the terms again if they close and reopen their browser before accessing SuperWEB2.

If your terms and conditions change, you can require all users to accept the new terms on next login. To do this:

1. Update **terms.html** to reflect your new terms and conditions.

2. Set (or update) the value of `login.requireTermsVersion` in [the **configuration.properties** file](https://docs.wingarc.com.au/superstar/9.21/configuration-properties.md). You can set this to any value you like. For example, you might set this to `v2`:

       login.requireTermsVersion=v2

   When a user accepts the terms, SuperWEB2 stores the current value of this property against that user's account information in SuperADMIN. On subsequent logins, SuperWEB2 checks if the stored value of `requireTermsVersion` for that user matches the current setting in **configuration.properties**. If the value does not match then the user will be prompted to accept the new terms.
3. Restart Tomcat or the SuperWEB2 service to apply the change.

---
version: "9.21"
language: "en"
---
# Add a User Interface Language

SuperCROSS comes supplied with a number of user interface language options. Users can change the user interface language by choosing an option from the **File \> Language** menu.  
![SX-File-Language.png](https://docs.wingarc.com.au/__attachments/a_723131db57ff2e3f08b0cfe29dbe402776770800eb03f05d2e0cb4281dc14703/SX-File-Language.png?cb=f7066bf77242e3a4627579249366520c)

If none of the supplied languages are suitable for your users, you can add new languages.  
The **File \> Language** option only changes the language for the user interface. It is also possible to have multiple languages for databases: see [Metadata and Multilingual Tables](https://docs.wingarc.com.au/superstar/9.21/metadata-and-multilingual-tables.md) for more information.

To add a new language:

1. Go to the SuperCROSS language directory (**C:\\Program Files (x86)\\STR\\SuperCROSS\\language** if you installed to the default location).

2. Make a copy of the template file, **Test_en-AU.txt** and rename it to match your new language. You are recommended to use the language codes in the filename (like the sample files), although this is not a strict requirement.

3. Replace the text strings in the file with the translations for the new language.

   * The file contains three columns, separated by tabs. The first two columns contain the internal codes used by SuperCROSS (do not change these), while the third column contains the text that needs to be translated. In the template file, the text that needs to be translated is in English.

   * In the template file, the text strings that need to be translated start with a $ symbol; this is used to indicate that the string has not yet been translated. Remove the $ symbol when you replace the English text with its translation.

   * At the top of the file, there is a line that defines the `LOCALE_NAME`. This is the language code for this language; it must be set to the [two character ISO 639-1 language code](http://en.wikipedia.org/wiki/List_of_ISO_639-1_codes) and [the two character ISO 3166 country code](http://en.wikipedia.org/wiki/ISO_3166-1), separated by a hyphen.

     For example:

         "0x9C42"    "LOCALE_NAME"    "fr-CA"    

   * At the end of the file, there is a line that defines the `LS_LANGUAGE_NAME`. This must be set to the translated name of the language. SuperCROSS will display this in the **File \> Language** menu.

   * If you need to include line breaks in your translations, use `\n`

   * Make sure that you do not change the file encoding when editing the language file; it should be encoded in UTF-8 without a Byte Order Mark (BOM).

   * For menu options, you can set the shortcut key (accessible to end users by pressing **Alt** ) by placing a `&` character before the shortcut key. For example:

         0x6227	CROSSMENU_MC	&Cross

4. When you have finished adding your translations, save your changes.

5. Open [**supermodule.ini**](https://docs.wingarc.com.au/superstar/9.21/supermodule-ini.md) in a text editor. If you installed to the default location, this file is located in **C:\\ProgramData\\STR\\SuperCROSS**

6. Locate the `[Language]` section and add your new language to the list, using the following format:

       <English Display Name>=<Language Text File>

   The English display name will be displayed in the **File \> Language** menu, in brackets after the translated name of the language (which comes from the text defined for the `LS_LANGUAGE_NAME` code in the language text file).

   For example, to add translations for Japanese, you might update the `[Language]` section as follows:

       [Language]
       English=English_en-US.txt
       Arabic=Arabic_ar-SA.txt
       Chinese=Chinese_zh-CN.txt
       TraditionalChinese=TraditionalChinese_zh-HK.txt
       Danish=Danish_da-DK.txt
       French=French_fr-FR.txt
       German=German_de-DE.txt
       Norwegian=Norwegian_nb-NO.txt
       Polish=Polish_pl-PL.txt
       Romanian=Romanian_ro-RO.txt
       Russian=Russian_ru-RU.txt
       Spanish=Spanish_es-ES.txt
       Swedish=Swedish_sv-SE.txt
       Welsh=Welsh_cy-GB.txt
       Japanese=Japanese_ja-JP.txt

   You can change the order the languages are listed here to change the order that they appear in the SuperCROSS menu.
7. Save your changes, and restart SuperCROSS to verify your new language translations.

---
version: "9.21"
language: "en"
---
# Add a User Interface Language

To add a new user interface language to SuperWEB2, you need to create a resource bundle. This is a set of properties files saved in **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\classes**.

For example, the file **messages.properties** contains values for various strings displayed in SuperWEB2. By default there are several versions of this file with the language code in the filename. These are used for the different languages that are supported out of the box:  
![The messages.properties file and its variants for Arabic, German, English, Japanese, Portuguese, Russian and Simplified Chinese](https://docs.wingarc.com.au/__attachments/a_1b7d5a37e4d023e13ecda5d715ee8e1474da13e3b2ac48b2639505e56ff7c002/image2021-10-26_13-33-12.png?cb=d008bd1838f8ef0f27759949983f39e1)  
This page describes the process for adding a user interface language only. This will not change the language used in the datasets. If you want your datasets to be available in multiple languages then you will need to [set up Metadata Server](https://docs.wingarc.com.au/superstar/9.21/metadata-server.md).

## Step 1 - Create Your Translations

You can use the base versions of the properties files as a template for creating a version for your new language. For example:

1. Open **messages.properties** in a text editor.

2. Save it as **messages_\<locale\>.properties**

   Replace **\<locale\>** with the relevant 2 character lower case ISO 639 language code (see <http://en.wikipedia.org/wiki/List_of_ISO_639-1_codes> for a list of codes).

   For example, to add support for French you would save it as **messages_fr.properties**.  
   If necessary, you can further specialise your properties files to support regional language variations (such as US and Australian English). See [Customise the User Interface Language Based on Country](https://docs.wingarc.com.au/superstar/9.21/customise-the-user-interface-language-country.md) for more details).
3. Each line in the file contains a property and a value. For example, the following lines define some of the text displayed on the login screen:

       page.login.window.title=Log in
       page.login.form.heading=SuperWEB2 - Log in

4. Change the values for each entry in the file to the appropriate translated text (but **do not** change the names of the properties themselves).

   For example:

       page.login.window.title=Ouverture de session
       page.login.form.heading=SuperWEB2 - Ouverture de session

   If your translations contain any non-ASCII characters, you must convert the encoding of these characters to 8-bit printable form. You can do this when you have finished adding all the translations to the file, using a tool supplied with the Java Development Kit. See the section below for further details.

Repeat these steps until you have translated all of the properties files. The following is a list of the main properties files that you need to localise:  

|            **Filename**             |                                                   **Contains...**                                                    |
|-------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| **CDataOnlineEditRules.properties** | Error messages that are displayed when the user attempts to create a table that breaches the configured table rules. |
| **common_labels.properties**        | Common labels used through the application.                                                                          |
| **database_labels.properties**      | Dataset-specific messages.                                                                                           |
| **messages.properties**             | General on screen labels used throughout the application.                                                            |
| **basemaps.properties**             | The text for the **Aerial Map** and **Street Map** drop-down labels shown in **Map View**.                           |
| **configuration.properties**        | Settings such as the location of the PDF download template and online help can be localised.                         |

In addition to the above properties files, which are also located in **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\classes** , there are also some text strings used in **Map View** that you may wish to translate. These are configured in **\<tomcat_home\>\\webapps\\webapi\\mapping\\arcgis-jsmap\\str\\amp\\nls\\Sw2EntryPoint_\<locale\>.js**.

### Step 2 - Update the Languages in faces-config.xml

When you have finished adding translated versions of all the required properties files, you need to add your new language to the list of supported locales in the **faces-config.xml** configuration file. See [Change the Supported User Interface Languages](https://docs.wingarc.com.au/superstar/9.21/change-the-supported-user-interface-languages.md) for more details.

You will need to restart Tomcat or the SuperWEB2 service after making the change to **faces-config.xml**.

### Step 3 - Check the File Encoding

If your translated text contains any non-ASCII characters (such as characters with accents and characters from non Roman alphabets), then you must ensure your `.properties` files are encoded in UTF-8 format, otherwise those characters will not display properly in SuperWEB2. For example:  
![SW2-Login-Text-Not-Encoded.png](https://docs.wingarc.com.au/__attachments/a_7fde2c39c37da03244907f504e44e589cd77edfee12ad196ca1e953aa728443a/SW2-Login-Text-Not-Encoded.png?cb=f4f9c60771291fdacaa744e91d8fec54)

Once the file has been encoded properly, those characters will be rendered correctly in SuperWEB2. For example:  
![SW2-Login-Text-Encoded-Correctly.png](https://docs.wingarc.com.au/__attachments/a_6578c09eb6a41563c3ee5e3c7bc79d0ff27b9bdb62efa91660943fde889df621/SW2-Login-Text-Encoded-Correctly.png?cb=221c8b808c661ef3d7e24ff8f7dec91b)

---
version: "9.21"
language: "en"
---
# Add a Warning Message to Printed Tables

It is possible to configure SuperWEB2 to include an additional message, such as a warning or disclaimer, whenever a user prints a table (either by clicking the **Print Table** button, or by pressing **CTRL-P**). SuperWEB2 will display this message at the top of the first page of the printed output.

For example:  
![SW2_Print_Warning.png](https://docs.wingarc.com.au/__attachments/a_9b9d1e2eff194c78f92b9a695cd2d67a766f5195eb7b6bb7fce6955f39086fea/SW2_Print_Warning.png?cb=3c9f41edc1fc05910d4e427d96c0c468)

To configure this message, you need to edit **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\classes\\common_labels.properties**.  
There may be multiple copies of this file for different languages and locales, with names like **common_labels_en.properties** , and **common_labels_en_AU.properties** . You need to make these changes in all versions of the file. The properties file that is used will depend on the language settings in the end user's web browser and the set of supported locales defined in the **faces-config.xml** configuration file (see [Multilingual and Localisation Support](https://docs.wingarc.com.au/superstar/9.21/multilingual-and-localisation-support.md) for more information about localisation and how SuperWEB2 uses the properties files).

1. Open the file in a text editor.

2. Locate the following section:

       printWarning=

3. Enter your warning message. For example:

       printWarning=WARNING: FOR OFFICIAL USE ONLY

4. Apply this change to all versions of this file for all the languages in use on your deployment.

5. Save your changes and restart Tomcat or the SuperWEB2 service.

If your warning message contains any non-ASCII characters (such as characters with accents and characters from non Roman alphabets), then you must convert these into 8-bit printable form in order to display them in SuperWEB2. See [Add a User Interface Language](https://docs.wingarc.com.au/superstar/9.21/add-a-user-interface-language-sw2.md) for more details.

---
version: "9.21"
language: "en"
---
# Add Datasets and Tables

On login, SuperWEB2 displays the catalogue of available data, where users can select a dataset or saved table to work with:  
![SuperWEB2 Datasets page with key parts explained](https://docs.wingarc.com.au/__attachments/a_87f25647816e06662f15cf5dadd006b4a3167e647946a20448b3e5915beb6c55/SW2-Select-database-or-topic-9.12.0.png?cb=2fe6105a28698a76018fac8dded3b59e)

* The **Datasets** list displays all the datasets installed on the SuperSERVER that the logged in user has permission to access.

* The **Tables** list displays saved tables for the currently selected dataset. Saved tables include:

  * Tables in the **Private** folder; these are tables created by the currently logged in user, and are only accessible to that user.

  * Shared tables. These are user-created tables that are shared between multiple users. You can set folder permissions in SuperADMIN to control which users can create shared tables and which users have access to them ([learn more](https://docs.wingarc.com.au/superstar/9.21/configure-folders-and-shared-tables.md)). It is also possible for an administrator to add and manage shared tables from within SuperADMIN.

  * Saved system tables installed on the SuperWEB2 server. All users will be able to access these tables, as long as they have access to the dataset the table is based on.

![Selecting the Account Profit by Gender table](https://docs.wingarc.com.au/__attachments/a_1a8d399fb6d8f17baa18013256f77582e166b00d24bf8211496411d76b8c252d/image2021-11-30_13-8-36.png?cb=797a84b77592ca2efa93b269cf5dba6f)

For example, in the catalogue shown above:

* **Retail Banking** and **people** are datasets installed on the SuperSERVER.

* **Credit Card Accounts in Victoria** and **Customers by Location** are user tables that the currently logged in user has created and saved using Retail Banking.

* **Credit Card Accounts in WA** and **Customers by Occupation** are shared user-saved tables accessible to the currently logged in user.

* **Account Profit by Gender** , **Accounts by Gender** , **Accounts by Marital Status** and **Credit Card Accounts in New South Wales by Gender** are saved system tables for Retail Banking.

* In this example the shared tables happen to be in a folder called **Shared Tables** ; if you enable shared tables in SuperWEB2 you can call the folders whatever you like. You can also rename your SuperSTAR server (in this example it is using the default name, **SuperSTAR Database Server**). Whatever name you give to the server in SuperADMIN will be shown in the catalogue page in SuperWEB2.

## Add a Dataset to the SuperSERVER

Use the `cat` command in SuperADMIN to manage the datasets installed on the SuperSERVER and control user access. [Learn more about managing the catalogue](https://docs.wingarc.com.au/superstar/9.21/configure-the-dataset-catalogue.md).

It is also possible to configure the order in which datasets are sorted when they display in SuperWEB2. [Learn more](https://docs.wingarc.com.au/superstar/9.21/change-the-sort-order-of-tables-and-datasets.md).  
If you add, remove, or update a dataset, you must [update the search index file, so that it is synchronised with the datasets on the server](https://docs.wingarc.com.au/superstar/9.21/update-the-search-index.md).

## Change the Name of the SuperSERVER

By default, your SuperSERVER instance will appear in the SuperWEB2 catalogue as **SuperSTAR Database Server**. To change this, use the following command in SuperADMIN:

    cat root displayname <new_display_name>

For example:

    > cat root displayName "My SuperSTAR"
    >

![The Retail Banking dataset with the SuperSTAR Database Server folder name changed to My SuperSTAR](https://docs.wingarc.com.au/__attachments/a_0733cf566bfbe21d5098df76f84f4a898c27b4818ea9fa3627a55456d1cc630a/image2021-11-30_13-11-57.png?cb=1c4e7f1b825e4f302f43eb40775e64a3)

## Allow Users to Save Shared Tables

In the above example, there are two shared tables that have been saved by SuperWEB2 users. If you want to allow your users to save tables that are shared with other users, then you will need to create folders in SuperADMIN and configure user permissions.

[Learn more about configuring access to shared tables in SuperWEB2](https://docs.wingarc.com.au/superstar/9.21/configure-folders-and-shared-tables.md).

## Add a System Table

This section describes how to save TXD system tables on disk for use in SuperWEB2. It is also possible to upload these TXD files to the user data repository through SuperADMIN. This makes the table available as a shared table, and is the recommended approach for adding tables to SuperWEB2. See [Configure Folders and Shared Tables](https://docs.wingarc.com.au/superstar/9.21/configure-folders-and-shared-tables.md) for more information.

To add a saved system table to SuperWEB2:

1. [Use SuperCROSS to define the structure of the table](https://docs.wingarc.com.au/superstar/9.21/user-guide-sx.md), and save it in Textual Table Definition (**.TXD**) format.

   Please note that some table structures are not supported by SuperWEB2. Refer to the [TXD Reference](https://docs.wingarc.com.au/superstar/9.21/txd-reference.md) for more details about TXD compatibility when opening a table saved in SuperCROSS in SuperWEB2.

   In addition, if you are using annotations then there are some additional restrictions on TXD support. See [Configure Display of Annotations](https://docs.wingarc.com.au/superstar/9.21/configure-display-of-annotations.md) for more information.  
   Choose carefully when selecting the filename. This is what will be displayed to users in the list in SuperWEB2, so you should choose something that describes the table contents.
2. Copy the TXD file to **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\resources\\txd** (you will need to create the **txd** directory if it does not already exist).

   ![image2021-11-30_13-19-11.png](https://docs.wingarc.com.au/__attachments/a_137baee90a5edec48fca5bbc4a9c4751f8dfe2fb4ef7dd94643b7652ebc7c505/image2021-11-30_13-19-11.png?cb=c0938bd08a045bb654ea213e1435b26e)
3. Open SuperWEB2 in your browser, select the dataset and check that the table appears in the **Tables** list.

### Using TXDs Created Prior to SuperCROSS 9.0

SuperSTAR 9.0 [added full Unicode support](https://docs.wingarc.com.au/superstar/9.21/unicode.md). This means that the SuperSTAR clients now support all characters and languages, regardless of the user's system codepage or locale.

You can continue to use TXDs that were created in earlier releases. However, if your TXDs were created in a version of SuperCROSS prior to version 9.0, then you may need to make some configuration changes in order to add these as saved system tables. This depends on the character set used in the TXDs.

If your TXDs contain only English/ASCII characters then they will work automatically with no further changes.

If your TXDs contain other characters, then you have two choices:

### Option 1: Set the TXDEncodingType

There is a configuration setting in [**\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\web.xml**](https://docs.wingarc.com.au/superstar/9.21/web-xml.md) called `TXDEncodingType`. If there is a particular system codepage that fully supports all the characters in your TXDs then you can change this setting to match that codepage and your TXDs will work automatically. You will need to restart Tomcat or the SuperWEB2 service after making this change to **web.xml**.

### Option 2: Convert the TXDs

If setting the codepage in **web.xml** is not an option for you, then you will need to convert the encoding of the TXD files to UTF-8 with a Byte Order Mark (BOM). One way to do this is to use a text editor such as Notepad++. Open the TXD file in Notepad++ and select **Encoding \> Convert to UTF-8**.  
![Selecting the Convert to UTF-8 option from the Encoding tab](https://docs.wingarc.com.au/__attachments/a_20b0c18c6aea5f0ffd1223b3670fda3883af27a7e82abbeeb0148e75661bf8f4/image2021-11-30_13-25-1.png?cb=94707229381f00319c054a85041c74c9)

Repeat this step for every TXD file that you want to use in SuperWEB2.

## Configure a Default Table for your Datasets

You can configure default tables for each of your datasets that will open automatically whenever a user opens that dataset.

[Learn more about configuring default tables in SuperWEB2](https://docs.wingarc.com.au/superstar/9.21/configure-a-default-table-for-your-datasets.md).

## Add User Defined Fields

If you have created user defined fields in SuperCROSS, then you can add these to the SuperWEB2 server and they will be available for users to select in the field tree, just like any other field.

[Learn more about adding user defined fields to SuperWEB2](https://docs.wingarc.com.au/superstar/9.21/add-defined-fields.md).

## Configure the Information Pane

On the right of the catalogue, the **Description** pane displays information about the currently selected dataset.

You can [add your own custom text to this section by editing an HTML file located on the SuperWEB2 server](https://docs.wingarc.com.au/superstar/9.21/configure-the-text-on-the-data-catalogue-page.md).

---
version: "9.21"
language: "en"
---
# Add Defined Fields

User Defined Fields (UDFs) are new (synthetic) fields that you can create directly in SuperCROSS based on existing fields and measures.

You can use UDFs to do things like:

* Compare two numeric fields.

* Perform calculations across several numeric fields.

* Range or band a continuous numeric field.

* Copy data from a child fact table to a parent. For example, deriving household income based on individual income.

* Determine if a parent object contains any children.

* Calculate a time or data span.

* Apply weights to a value set to be used in a subsequent calculation.

You can recode UDFs and in some instances use them to create other UDFs to build up complex results.

If you have created UDFs in SuperCROSS then you can add these to your SuperWEB2 server. The UDFs will appear in the field tree for use by SuperWEB2 users just like any other field in the dataset.

## Add Defined Fields to SuperWEB2

To add UDFs to SuperWEB2:

1. [Follow the steps in the SuperCROSS documentation](https://docs.wingarc.com.au/superstar/9.21/user-defined-fields.md) to create your UDFs.

2. Save your UDFs to a file in Textual Defined Field (**.txt**) format.

   You must use the textual format, not the binary Defined Field (**.fld**) format.
3. Copy the **.txt** file to **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\resources\\udf\\\<dataset_id\>\\** (where **\<dataset_id\>** is the ID of the dataset that the UDF applies to; you will need to create this directory if it does not already exist).

   For example, if you have created a UDF for Retail Banking (ID: **bank** ) you would copy the file to **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\resources\\udf\\bank\\**

Your UDFs will automatically be available to any user who accesses this dataset.

For example:  

|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Time span UDF created in SuperCROSS: ![The Time Span Field dialog](https://docs.wingarc.com.au/__attachments/a_206aa68c8957b5d4cbbbe1507be534e8e4d000261546700e8f87ac8bf8f5b307/image2021-12-7_11-35-13.png?cb=360bdbbd514492d30d39c76a384f0fb8) | The UDF as it appears in SuperWEB2: ![The new Customer Age on Account Open UDF listed as under the Summation Options](https://docs.wingarc.com.au/__attachments/a_6695d62b0eaff7e2364727521d171372d4ccf815984f553d60962cc4db6acc9a/image2021-12-7_11-42-51.png?cb=92eaed4f142f06ae12335916313775df) |

### Adding Multiple UDFs

If you want to add multiple UDFs to SuperWEB2, then you can either save these to individual **.txt** files or as a single **.txt** file with all the UDFs defined in it.  
UDFs are exported with their dependencies, for example a Comparison UDF may have a dependency on another UDF such as a Math UDF. This means that when the UDF is exported, the file contains multiple UDFs.

To overcome duplication of UDFs in SuperWEB2, it is recommended that you do not export UDFs that are already part of a UDF, for example when you export the Comparison UDF, there is no need to export the Math UDF.

If by chance, you accidentally export duplicate UDFs, for example you exported both the Comparison and Math UDF, you should manually remove the Math UDF from the dataset's UDF directory to avoid duplication in SuperWEB2.

### Ensure your UDFs have Unique Names

Take care to ensure that all your UDFs have unique names. If you add multiple UDFs with the same name, then users will be able to create tables but will not be able to save tables containing these UDFs.

### Invalid UDFs

If you create a UDF that is not valid for a particular dataset (for example because you have saved the UDF file to the wrong directory on the SuperWEB2 server) then this will be ignored. When SuperWEB2 encounters an invalid UDF in a **.txt** file, all UDFs defined in that **.txt** file will be ignored and will not be available in SuperWEB2.

---
version: "9.21"
language: "en"
---
# Add External Axis Item

You can import external data into a row, column or wafer axis.

Table data can be imported into a maximum of two axis fields (e.g. columns and rows or columns and wafers).

You have two options for importing external data: you can enter the data manually in SuperCROSS, or you can import from a file.

## Enter External Data Manually

To add a column and enter data manually:

1. Right-click the axis where you want to add data.

2. Select **Derivations \> Add External Axis Items** . The **External Data** dialog displays.

3. In the **Data** field, enter the heading for your new row, column or wafer.

   ![New-External-Column.png](https://docs.wingarc.com.au/__attachments/a_2c9bf84ffbc057122a490df9ee9dd88c2eebcd70de789a7527b9b78a082c890d/New-External-Column.png?cb=430b3c9826d7a31cc1ed2eacca1b69f8)
4. (Optionally) Set the order of evaluation for this new item. If you have multiple derivations in your table, this determines the order in which they are evaluated. You can either enter a value in the **Calculation Order** (items with a lower number are evaluated first) or click **Order Last** to set this item to be evaluated after all the other derivations.

   The calculation order is an important consideration if you are calculating percentages of fields and also using totals.
5. Click **OK** . SuperCROSS adds your new item to the table. In this example we are adding a column:

   ![New-External-Column-Added.png](https://docs.wingarc.com.au/__attachments/a_f3d2a1a7a002d14ea63b31c1e91bdba5678e52371e8d65b2a5371cbc295d0ee4/New-External-Column-Added.png?cb=9fa97c80f7fddc915ac40bcb38c39cf5)

6. You can now enter the values for your new item. To enter a value:

   1. Right-click the cell you want to enter a value for.

   2. Select **Edit Cell**.

   3. Enter the cell value and then click **Next \>** to save the value and move to the next cell.

      ![New-External-Column-Enter-Value.png](/__attachments/a_1645837f14a8ead027065da6dbad9c4f2de0a8f0324c30ae1dd34ab5932ac1d9/New-External-Column-Enter-Value.png?cb=0ba49223eee71df518ea9056f691a9b3)
   4. Continue until you have entered all the values. When you have finished click **Close** to stop editing.

### Import from a File

As an alternative to entering data manually in SuperCROSS, you can also import data from a file. The imported data must be column based data, and must match the format of the table you are importing the data into. If an imported record does not have a match in the table it is ignored.  
You can also import data into a table using the **File \> Import** menu option. That menu option is a better choice if you want to import multiple columns from a file in one go (whereas importing an axis item only allows you to import one column from the file at a time). See [Import and Append Data to a Table](https://docs.wingarc.com.au/superstar/9.21/import-and-append-data-to-a-table.md) for more information.

To import an axis item from a file:

1. Right-click the axis where you want to add data.

2. Select **Derivations \> Add External Axis Items** . The **External Data** dialog displays.

3. Click **Import Data** . The **Import Data** dialog displays.

   ![New-External-Column-From-File.png](https://docs.wingarc.com.au/__attachments/a_de164972033b4cd41391a7c7e928e6db648efd6a88bacb42fb9bb2a97b068f0c/New-External-Column-From-File.png?cb=741190b19dce4736d12c90b8f5959b3e)
4. Set the options as follows:

   |        **Option**         |                                                                                                                                                       **Description**                                                                                                                                                       |
   |---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
   | **Clipboard** or **File** | Specify whether you want to import data from the clipboard or from a file (click **Browse** to select the file).                                                                                                                                                                                                            |
   | **Start At**              | Select which row or line in the file to start the import from. This should be the row or line containing the column heading.                                                                                                                                                                                                |
   | **Data Item**             | Select the position of the column in the file that you want to import into the table. For example to import column B, enter 2.                                                                                                                                                                                              |
   | **File Type**             | Select the file type you are importing. If your file is not one of the default options (fixed length, comma separated, or tab delimited), select **Other Delimiter** and enter the character that separates the columns. If your source data is in CSV format, make sure your values do not include the thousand separator. |
   | **Length**                | If you are using **Fixed Length** format, specify the length of each column in the file.                                                                                                                                                                                                                                    |

5. Click **OK**. SuperCROSS imports your data and adds it to the table.

### Example of Importing An Axis Item from a File

For example, suppose we have the following data:

* A table in SuperCROSS showing customers by Australian state

  ![SX-EG-External-Axis-Table-1.png](https://docs.wingarc.com.au/__attachments/a_eb45b0a893ceab70f85b730e4abdd8e7bf9e8d9ca57d3a733254feb81dd2b967/SX-EG-External-Axis-Table-1.png?cb=b2eea9e0b51d9775abec2b88ea0deaa5)
* External data for customers in other countries:

  ![SX-EG-External-Axis-Table-2.png](https://docs.wingarc.com.au/__attachments/a_3f81dbfd584f9f906695e72afe9679ffb5a10b205d464c66917914685f371325/SX-EG-External-Axis-Table-2.png?cb=19e40dada6da250e2bbb48d22c8d9492)

Suppose we want to import the data for New Zealand into a new row in our table.  
When preparing your data for import, make sure that the row labels in the imported data match the corresponding labels in the SuperCROSS table.

For example, here we are importing a new row into our existing table. The row labels in the imported data must match the column labels in the SuperCROSS table (in this case **Male** and **Female**). SuperCROSS will automatically skip any rows in the imported data if they do not correspond to a column in the SuperCROSS table.

1. Right-click the last row in the table and select **Derivations \> Add External Axis Items** . The **External Data** dialog displays.

2. Click **Import Data** . The **Import Data** dialog displays.

3. Click **Browse** and select the file containing the data to import.

4. In the **Start at** field, enter **2** (because in this example file the column headings start in row 2).

5. In the **Data Item** section, select **(Data)** from the drop-down list, and set the **Position** to **4** (because in this example we want to import column D, the fourth column in the table).

6. In the **File Type** section, select the file type. In this example we have saved the data in CSV format, so we select **Comma Separated**.

7. Click **OK** .

   ![SX-EG-External-Axis-Table-3.png](https://docs.wingarc.com.au/__attachments/a_c1ae9f9333d4cb1c518fd81ef742c09c7b9dbd3c7b0628294bd8bec161083b44/SX-EG-External-Axis-Table-3.png?cb=c29e698d741ab32ed9f18b626e387e12)

   SuperCROSS imports the new row into the table:

   ![SX-EG-External-Axis-Table-4.png](https://docs.wingarc.com.au/__attachments/a_4d1cb9e2feceff2a4c7d4346d79c2714b0e5b6fae8fd594100946f936cfbb65b/SX-EG-External-Axis-Table-4.png?cb=2743c10fe4978615e78f4030e46d0020)

---
version: "9.21"
language: "en"
---
# Add Extra Fields to the Signup Form

By default, the user registration system only collects the following information:

* Email address (used to login to SuperWEB2)

* Name (optional)

* Password

You may wish to collect additional information from users who sign up for an account. You can add any other fields you want to collect by making some changes to the registration form.  
The steps described in this section require basic HTML and Javascript experience. Please contact support for assistance if necessary.

For example, you might want to collect details of the user's company and role:  
![SW2-UserRegAdditionalFields.png](https://docs.wingarc.com.au/__attachments/a_1bf1c5223db210bceabea887995f419e55fa4bf4193bc1e4486ddb7c40ccea01/SW2-UserRegAdditionalFields.png?cb=8ef3835890ef3300b2518387ae569e57)

The additional data that is submitted by users registering for an account will be stored in the `REG_EXTRA` table in the SuperADMIN catalogue (this is either stored in an H2 database or [another RDBMS if you have configured this](https://docs.wingarc.com.au/superstar/9.21/use-a-relational-database-to-store-superadmin-data.md)). This table has three columns:  

| `REG_ID` | The ID of the registered user. Each registered user will also have a record in the `SELF_REG` table, and this ID can be used to link the additional information to a registered user. |
|  `KEY`   |                                A key that identifies which field in the form this record relates to. You set this when you add the fields to the form.                                |
| `VALUE`  |                                                                            The value entered by the user.                                                                             |
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

For example:  
![SW2-REG_EXTRA.png](https://docs.wingarc.com.au/__attachments/a_84adb0a8752e4d2488d7db84abe2718740118aad11df6cab422f34064a17ef0d/SW2-REG_EXTRA.png?cb=44e05bce1b854b88a275c0b4769afbf9)

## Step 1 - Add your Fields to the Form

The first step is to add your fields to the signup form. This is stored in **\<tomcat_home\>\\webapps\\webapi\\user\\userRegistration.xhtml**

1. Open **userRegistration.xhtml** in a text editor.

   Make a backup copy of this file before making any changes.
2. Locate the section containing the form fields, which will be similar to the following:

   XML

                       <div class="user-form-inputContainer">
                           <label for="userRegistration-email">#{labels['register.signUpForm.email.label']}</label>
                           <input type="email"
                                  id="userRegistration-email"
                                  placeholder="#{labels['register.signUpForm.email.placeholder']}" />
                           <div id="userRegistration-email-error" class="user-form-field-error" role="alert"></div>
                       </div>

                       <div class="user-form-inputContainer">
                           <label for="userRegistration-name">#{labels['register.signUpForm.name.label']}</label>
                           <input type="text"
                                  id="userRegistration-name"
                                  placeholder="#{labels['register.signUpForm.name.placeholder']}" />
                           <div id="userRegistration-name-error" class="user-form-field-error" role="alert"></div>
                       </div>

                       <div class="user-panel-buttons">
                           <input id="userRegistration-submit"
                                  type="submit"
                                  class="activeButton bigButton"
                                  value="#{labels['register.signUpForm.submit']}" />
                       </div>

   Each `<div class="user-form-inputContainer> ... </div>` element represents a single form field, while the `<div class="user-panel-buttons"> ... </div>` section contains the submit button.
3. Add a new `<div class="user-form-inputContainer> ... </div>` section for each new field you want to add. For example, the following code adds a field for the user to enter their company name:

   XML

                       <div class="user-form-inputContainer">
                           <label for="userRegistration-company">#{labels['register.signUpForm.company.label']}</label>
                           <input type="text"
                                  id="userRegistration-company"
                                  placeholder="#{labels['register.signUpForm.company.placeholder']}" />
                       </div>

   Where:  

   |                `<label for="userRegistration-company">`                |                                                                                                                    This is the label displayed above the form field. Set `for` to the same value as the `id` of the `input` element.                                                                                                                    |
   |            `#{labels['register.signUpForm.company.label']}`            |                                                                                                               The text label that appears above the form field. In this example, the property key is `register.signUpForm.company.label`.                                                                                                               |
   |                          `<input type="text"`                          |                                                                                                                       The type of form field you are adding. In this case, a text box. You can use any standard HTML form field.                                                                                                                        |
   |                    `id="userRegistration-company"`                     |                                                                                                 This is a unique ID for the form field. Use the format `userRegistration-<field_name>` (where `<field_name>` is the name of the field you are adding).                                                                                                  |
   | `placeholder="#{labels['register.signUpForm.company.placeholder']}"/>` | The placeholder text that will appear in the form field until the user enters something. All text that appears onscreen should be added as references to translatable property keys, rather than hardcoded text. In this example, the property key is `register.signUpForm.company.placeholder`. You will add the actual text for this in a later step. |
   |------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### Step 2 - Configure the Form to Submit the Additional Fields

Locate the following section of **userRegistration.xhtml**:
JavaScript

                var getSignUpFormData = function() {
                    const trimmedName = $name.val().trim();
                    return withBaseUrl({
                        name: trimmedName.length === 0 ? $email.val() : trimmedName,
                        extras: {}
                    });
                };

For each additional field you have added, add `"<field_name>": $("#<form_field_id>").val()` to the `extras` section, where `<field_key>` is a key value that will be used to identify this piece of information in the `REG_EXTRA` tabel in the user database and `<form_field_id>` is the ID you set on the `<input>` field. For example:
JavaScript

                var getSignUpFormData = function() {
                    const trimmedName = $name.val().trim();
                    return withBaseUrl({
                        name: trimmedName.length === 0 ? $email.val() : trimmedName,
                        "extras": {  "Company": $("#userRegistration-company").val() }
                    };
                };

If you have added multiple fields, separate them with a comma. For example:
JavaScript

                var getSignUpFormData = function() {
                    const trimmedName = $name.val().trim();
                    return withBaseUrl({
                        name: trimmedName.length === 0 ? $email.val() : trimmedName,
                        "extras": {  "Company": $("#userRegistration-company").val(), "Position": $("#userRegistration-position").val() }
                    };
                };

### Step 3 - Add your Text Strings and Translations

As shown by the example above, all onscreen text should be included as references to translatable property keys, rather than hardcoded text.

In this example, the properties used are `register.signUpForm.company.placeholder` and `register.signUpForm.company.label`. You will need to add these properties and their corresponding translations to all the different language versions of the **common_labels.properties** file (located in **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\classes\\**) for the languages in use in your deployment.

Open the file in a text editor and locate the section with the existing `register` keys, then add your translations for the new ones.

For example:

    register.signUpForm.company.label=Company
    register.signUpForm.company.placeholder=Enter your employer name

### Step 4 - Add Input Validation (Optional)

You may want to add some input validation for the new fields. For example, you may want to set a field to be required, or enforce other constraints (such as ensuring that the value entered by the user is at least 5 characters long).

#### Basic Validation

For basic validation, you can simply add `required="required"` to the `<input/>` element:
XML

                        <input type="text" required="required"
                               id="userRegistration-company"
                               placeholder="#{labels['register.signUpForm.company.placeholder']}" />

Any modern web browser (HTML 5 compliant) will prevent the form from being submitted until a value is entered for this field.  
![SW2-BasicValidation.png](https://docs.wingarc.com.au/__attachments/a_4bd8ae5c8441f23674b6728bbc9172d320c4d96f5fc0335726e1e215e4b88ff8/SW2-BasicValidation.png?cb=6a9778e60a6360026d1c4a59337607d9)

One drawback of this option is that any messages displayed are controlled by the browser (so they will differ depending on the end user's browser and you cannot change the message content or styling).

#### Custom Validation

If you want more advanced validation and control over the error message that is displayed, you will need to add some additional HTML and some custom Javascript:

1. Add `<div id="<field_id>-error" class="user-form-field-error" role="alert"></div>` before the closing `<div>` of the form field (replace `<field_id>` with the ID you used for the form field). This will be used to display your custom validation error message (if any):

   XML

                       <div class="user-form-inputContainer">
                           <label for="userRegistration-name">#{labels['register.signUpForm.company.label']}</label>
                           <input type="text"
                                  id="userRegistration-name"
                                  placeholder="#{labels['register.signUpForm.company.placeholder']}" />
                           <div id="userRegistration-company-error" class="user-form-field-error" role="alert"></div>
                       </div>

2. In the `<script> ... </script>` section at the top of the file, add a new custom validator within the `$(document).ready()` function

   For example, the following Javascript validates that the company name entered by the user is at least 5 characters long:
   JavaScript

       var checkCompanyAndShowError = function () {
       	var $company = $("#userRegistration-company");
       	var $companyError = $("#userRegistration-company-error");
       	var isCompanyValid = $company.val().length > 5;

       	if ($company.val().length <= 5) {
       		userRegistration.showFieldError($company, $companyError, "#{labels['register.signUpForm.error.company']}");
       	} else {
       		userRegistration.hideFieldError($company, $companyError);
       	}

       	return isCompanyValid;
       };

3. Add any new properties to the **common_labels.properties** file. In this example, the error message itself uses the property `register.signUpForm.error.company`:

       register.signUpForm.error.company=Please enter at least 5 characters

4. Locate the form validator section:

   JavaScript

       var formValidator = function () {
           return window.userRegistration.checkEmailAndShowError();
       };

   Update the validation code to check your new validation function in addition to the existing check that they have entered an email. For example:
   JavaScript

       var formValidator = function () {
                       
           var isValidEmail= window.userRegistration.checkEmailAndShowError();
           var isValidCompany = checkCompanyAndShowError();
                  
           return isValidEmail && isValidCompany;

       };

   For example:  
   ![SW2-CustomValidation.png](https://docs.wingarc.com.au/__attachments/a_b4520d272122d50413e6e9bbbb55a5b84fc4142f66f5f9e00855ff940c5418ed/SW2-CustomValidation.png?cb=e7d7e69a8791607fab61f8b923581dd5)

You will need to restart Tomcat or the SuperWEB2 service to apply any changes you make to the **common_labels.properties** file.

---
version: "9.21"
language: "en"
---
# Add your Support Contact Email to Error Messages

There are some login error messages included with SuperWEB2 that contain an email address link for the user to contact support. For example:  
![image2021-10-25_11-48-40.png](https://docs.wingarc.com.au/__attachments/a_abaf1cc1d0d142302e2b33c4905eb58076eff19187feb77740e83f481b45ed57/image2021-10-25_11-48-40.png?cb=1a3805c708fbebf63abd2d3cbaa1baa9)

By default, these support links are configured to use a dummy email address (**support@example.com**). Before going into production, you should update these messages so that they use your real support email.

To update the links, you need to edit **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\classes\\common_labels.properties**.  
There may be multiple copies of this file for different languages and locales, with names like **common_labels_en.properties** , and **common_labels_en_AU.properties** . You need to make these changes in all versions of the file. The properties file that is used will depend on the language settings in the end user's web browser and the set of supported locales defined in the **faces-config.xml** configuration file (see [Multilingual and Localisation Support](https://docs.wingarc.com.au/superstar/9.21/multilingual-and-localisation-support.md) for more information about localisation and how SuperWEB2 uses the properties files).

1. Open the file in a text editor.

2. Search the file for all the instances of `mailto:support@example.com` and change the email address to your real support email.

3. For example, change these lines from:

       login.error.accountLocked=Account locked, please contact <a href="mailto:support@example.com">support</a>.

       login.error.serverUnreachable=The system is currently unavailable. Please contact <a href="mailto:support@example.com">support</a> or try again later.
       login.error.internalServer=The system has encountered an internal error and you have been logged out. Please try again or contact <a href="mailto:support@example.com">support</a> if this problem persists.

       login.error.accountNoDatabaseAccess=Your user account does not have access to any datasets, please contact <a href="mailto:support@example.com">support</a>.

       register.invalidResponse.description=Please try again or contact <a href="mailto:support@example.com">support</a> if this problem persists.

       register.resendLink.notSent.description=Reload the page and try again. Please contact <a href="mailto:support@example.com">support</a> if this problem persists.

       register.notProcessed.description=Please click on the link from your email and try this again. Please contact <a href="mailto:support@example.com">support</a> if this problem persists.

   To:

       login.error.accountLocked=Account locked, please contact <a href="mailto:superweb2admin@mycompany.com">support</a>.

       login.error.serverUnreachable=The system is currently unavailable. Please contact <a href="mailto:superweb2admin@mycompany.com">support</a> or try again later.
       login.error.internalServer=The system has encountered an internal error and you have been logged out. Please try again or contact <a href="mailto:superweb2admin@mycompany.com">support</a> if this problem persists.

       login.error.accountNoDatabaseAccess=Your user account does not have access to any datasets, please contact <a href="mailto:superweb2admin@mycompany.com">support</a>.

       register.invalidResponse.description=Please try again or contact <a href="mailto:superweb2admin@mycompany.com">support</a> if this problem persists.

       register.resendLink.notSent.description=Reload the page and try again. Please contact <a href="mailto:superweb2admin@mycompany.com">support</a> if this problem persists.

       register.notProcessed.description=Please click on the link from your email and try this again. Please contact <a href="mailto:superweb2admin@mycompany.com">support</a> if this problem persists.

4. Apply this change to all versions of this file for all the languages in use on your deployment.

5. Save your changes and restart Tomcat or the SuperWEB2 service.

---
version: "9.21"
language: "en"
---
# Adding Multiple Fields to an Axis: Nesting and Concatenation

You can add multiple fields to one axis in your table. You have two different options for doing this: nesting the fields, and concatenating them.

In this example, the **Gender** and **Marital Status** fields are nested on the row axis:  
![A table with Gender and Marital Status nested on the rows](https://docs.wingarc.com.au/__attachments/a_de6c92e6826e9006c59256ab45cd512bcb13efb34b3b894de740c84043e96805/image2021-9-10_12-28-23.png?cb=96f715fee4f474802368053a53022421)

In this example, **Gender** and **Marital Status** are concatenated on the row axis:  
![A table with Gender and Marital Status concatenated on the rows](https://docs.wingarc.com.au/__attachments/a_fcc93ab362ac1cefc3e33bd9b4078c2b35df237cfe7204fef1cc7874d23e671e/image2021-9-10_12-26-22.png?cb=55bd46651b84c3315d4aee528c94baee)

In this example, **Gender** and **Marital Status** are nested on the wafer:  
![A table with Gender and Marital Status nested on the wafers](https://docs.wingarc.com.au/__attachments/a_c2d4e994d645916ded0ecc7f9e996c3c820c7f9ed3049d3cbc5f8211b35cdcfe/image2021-9-10_16-10-29.png?cb=12486e5a1dcc2e1134560385f0e22610)

In this example, **Gender** and **Marital Status** are concatenated on the wafer:  
![A table with Gender and Marital Status concatenated on the wafers](https://docs.wingarc.com.au/__attachments/a_a0e4a74955dea07f755a40d10529b9d31f4925a2fe2e5dd9e71954cb80b24577/image2021-9-10_16-12-50.png?cb=daa618ebf34e483e4ab0dbdd80dba3c5)  
Concatenation is enabled in SuperWEB2 by default, but it is possible your administrator may have disabled this feature on your deployment. If this is the case you will be able to nest fields in your tables but not concatenate them.  
Some features are not available when you have nested or concatenated fields in your table. For example, mapping will not be available if you concatenate or nest a geographic field (although mapping will still be available if the nesting or concatenation is only on the opposite axis to the one that contains the geographic field).

In addition, if your administrator has configured mandatory fields then you will not be able to concatenate another field onto the same axis as the mandatory field (as this would allow you to circumvent the mandatory field restriction).

## Nesting Fields

There are two ways you can nest fields on an axis. The best one to choose will depend on whether you want to add all a field's items or whether you want to select specific items within the field.

### Drag and Drop

This method is the quickest way to start building up a table. It adds all of the items for a particular field at once with a simple drag and drop technique.

1. Click and drag the first field towards the table. As you start to do this, the **Row** , **Column** and **Wafer** options appear. Drop the field onto one of these options:

   ![Dragging the Gender field from the Field List onto the Row drop zone](https://docs.wingarc.com.au/__attachments/a_cd962f534d42a490bc5040a62d897e929881da458f61e2ecf149000d2b2bbf5a/image2021-9-10_12-39-55.png?cb=70fffd7d1e8553a8d16d5e313730669b)
2. Click and drag the second field onto the same option:

   ![Dragging the Marital Status field from the Field List onto the Row drop zone](https://docs.wingarc.com.au/__attachments/a_ba49d0274e038853e051f2cdd5e19186ca5f0f485920fa944ab23343770c8f49/image2021-9-10_12-43-33.png?cb=7d827ff8544fc16516aaff06d62308b3)
3. SuperWEB2 nests the fields in the table:

   ![A table with Gender and Marital Status nested on the rows](https://docs.wingarc.com.au/__attachments/a_fe07d2a126e3e8610a4d6f67915039709a5390e7d2fc5f74d058ac4f83859efc/image2021-9-10_15-53-54.png?cb=7b3378f5019d28d4ae37682f495e24ec)

The first field you added will be nested at the outermost level; if you want to change this you can rearrange the fields within the table by dragging and dropping the field names:  
![A table with Marital Status being dragged onto the Gender row heading drop zone](https://docs.wingarc.com.au/__attachments/a_78e86465ce016d45db90cfa228ed66b03c4392e56d1c37189377f34524e396e2/image2021-9-10_16-1-28.png?cb=9c335a745fdc26c78e954a85a7f1811e)

### Use the Add to Row or Add to Column Button

This method is a better option if you only want specific items from a field.

1. Select the check boxes next to the items you want to add from the first field and click **Add to Row** , **Column** , or **Wafer**:

   ![The field list with the Gender - Male and Gender - Female selected and the mouse pointer hovering over the Add to Row button](https://docs.wingarc.com.au/__attachments/a_a241065c86f5302b0166409d7da67922ff7473c7e4a0ebe881d61bcbe927aed1/image2021-9-10_13-1-34.png?cb=260365d3ba6e65335ad18ab97d118311)
2. Select the check boxes next to the items you want to add from the second field and click the button again:

   ![The field list with the Marital Status - Single, Married and Divorced items selected and the mouse pointer hovering over the Add to Row button](https://docs.wingarc.com.au/__attachments/a_b507639b860728c29e4becae31a7ea46b835bf24ee29258d7ea77288d959715c/image2021-9-10_13-4-19.png?cb=c6305e42dcc12739895969c1a94a301a)
3. SuperWEB2 nests the fields in the table:

   ![A table with Gender and Marital Status nested on the rows](https://docs.wingarc.com.au/__attachments/a_a755d59e852752db516b4924ce6922940a2ae02f2ecb18e92a11a29c29ab905e/image2021-9-10_13-7-42.png?cb=28f6cf327c6ed76fe68b945c6b5957db)

## Concatenating Fields

There are two ways you can concatenate fields on an axis. The best one to choose will depend on whether you want to add all a field's items or whether you want to select specific items within the field.

### Drag the Fields to the Table

This method is the quickest way to concatenate two fields in a table. It adds all of the items for a particular field at once with a simple drag and drop technique.

1. Click and drag the first field towards the table. As you start to do this, the **Row** , **Column** and **Wafer** options appear. Drop the field onto one of these options:

   ![The field list with the Gender field being dragged onto the Row drop zone](https://docs.wingarc.com.au/__attachments/a_7c02c53e8dcb6a1623df6cc7fc18c9517db5f85a4cad7b1da60ac33276b6d2cd/image2021-9-10_13-10-21.png?cb=70fffd7d1e8553a8d16d5e313730669b)
2. Click and drag the second field. As you start to do this, drop zones become available inside the table on the last item of any existing fields. Drag and drop the new field onto the drop zone:

   ![The field list with the Marital Status field being dragged onto the drop zone at the bottom of the table rows](https://docs.wingarc.com.au/__attachments/a_26dafa23dab8c2414a269074a4d1efc09bd67e8c399f0d096c5ca7b517a3b0f4/image2021-9-10_15-37-26.png?cb=50052ba206e76bf33d39c5049452e8a2)
3. SuperWEB2 concatenates the fields:

   ![A table with Gender and Marital Status concatenated on the rows](https://docs.wingarc.com.au/__attachments/a_32b63645cf62c47787760c1cf6fb41f3054d31b8939d0fdfcccbe5d8249a6150/image2021-9-10_15-39-53.png?cb=bd0beaa3fbab67ac81bb01c81418999c)

When you are using this method to concatenate fields on a wafer, the drop zone is the name of the existing field that is already in the wafer:  
![The field list and table with the Marital Status field being dragged onto an existing field in the wafers drop zone](https://docs.wingarc.com.au/__attachments/a_2d2c3dd29135db70feed7ce2918e79c172a40a7921840ae388dd8f839c0d1d13/image2021-9-10_15-42-7.png?cb=32844fc05297b4206855c5411de35fa1)

### Select Field Items from Multiple Fields

This method can be a better option if you want to select which items from a field you are adding to the table.

1. Select the check boxes next to the field items from multiple fields, then click **Add to Row** , **Column** , or **Wafer**:

   ![The field list with Male, Female, Single, Married and Divorced selected and the mouse pointer hovering over the Add to Row button](https://docs.wingarc.com.au/__attachments/a_3c920830be8bf08b239940b7cb146e5c353042610218f33654cbeecd0fe6573c/image2021-9-10_15-44-38.png?cb=21cf2445730cea0a3693b70530aeabfb)
2. SuperWEB2 concatenates the fields in the table (the ordering is based on the order you selected the check boxes; in this example we selected items from the **Gender** field first):

   ![A table with Gender then Marital Status in the rows, with the items Male, Female, Single, Married and Divorced in the table rows](https://docs.wingarc.com.au/__attachments/a_515de115da4137567915f575db36bae9c239738b15b28d813fc342b1551d6796/image2021-9-10_15-50-13.png?cb=519fcffb4161f000be700046f30c562b)

   If your administrator has disabled concatenation, then the fields will be nested instead.

---
version: "9.21"
language: "en"
---
# Advanced Confidentiality Rule Options

By default, the confidentiality rule will apply to all tables created from any dataset that the method has been applied to in SuperADMIN. From release 9.6 onwards, some additional configuration options have been added. For example, you can now configure the confidentiality rule so that it only applies when specific fields are in the table.

This section describes these additional options:

## Apply the Confidentiality Rule only when Specific Fields or Summation Options are in the Table

The confidentiality rule module now supports a `FIELDS` property, which takes a list of field codes or labels (separated by semi-colons). When this property is set, the confidentiality rule will only apply if at least one of the specified fields is in the table.

For example, the following method will only apply when the **Gender** or **Marital Status** fields appear in a table:

    method addmethod conditionalconfid mandatory "Conceal values 10 or less when Gender or Marital Status in table"
    method conditionalconfid adddcplugin confrule confidentialityrule
    method conditionalconfid confrule addproperty RULESET "THRESHOLD(10)"
    method conditionalconfid confrule addproperty FIELDS "Marital Status;Gender"

Once you have defined the method, you can apply it to a dataset in the usual way. For example:

    cat bank addmethod conditionalconfid

|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Age** by **Gender**, values 10 and under are concealed: ![SX_ConditionalConfidentialityFields1.png](https://docs.wingarc.com.au/__attachments/a_be1e8298c12c3520860c9ce9a0b36fae9ea4e395c011c4d4e8499217e27c96b2/SX_ConditionalConfidentialityFields1.png?cb=36675590b2ca2af16661e313ac4889b8) | **Age** by **Area**, values 10 and under are not concealed: ![SX_ConditionalConfidentialityFields2.png](https://docs.wingarc.com.au/__attachments/a_d6ae802756d17bb0370da6c084f5ae72fb005c5fcf5c570c9eb769d9d8832f6c/SX_ConditionalConfidentialityFields2.png?cb=ab1e05c5f366d2c7878e4ac4ed6327f7) |

### Summation Options

Prior to version 9.9.3, the `FIELDS` property only supported classification fields. From version 9.9.3 onwards, summation options or measures can now also be specified. Specify summation options using the `FIELDS` property in the same way as classifications. Both lables and IDs are supported. For example:

    method conditionalconfid confrule addproperty FIELDS "Marital Status;Customer Profit;Gender"

    method conditionalconfid confrule addproperty FIELDS "F_Customer:Marital_Status;F_Customer:Cust_Profit;F_Customer:Gender"

### Notes and Examples for Specifying Fields

|   **Specifying the fact table**   |                                                                                                                                                                                                                              You can optionally specify the fact table that a field belongs to (for example because you have a field with the same label in multiple fact tables but you only want the rule to apply to one of those fields). Specify the code or label of the fact table, followed by a colon, and then the code or label of the field. For example, the following setting applies confidentiality to the **Marital Status** field in the **Customers** table and the **Product Type** field in the **Accounts** table. It also applies to any instances of a field called **Gender**, regardless of which fact table it appears in: method conditionalconfid confrule addproperty FIELDS "Customers:Marital Status;Accounts:Product Type;Gender"                                                                                                                                                                                                                               |
| **Using codes instead of labels** | The `FIELDS` property accepts both field labels and codes. Using codes, the above example could be rewritten as: method conditionalconfid confrule addproperty FIELDS "F_Customer:Marital_Status;F_Account:Product_Type;Gender" You can obtain the field and fact tables codes from SuperADMIN by using the following command: cat <dataset_id> <field> For example, to obtain the code for **Marital Status** in the sample Retail Banking dataset (id: `bank`): > cat bank "Marital Status" [ XTAB Field : 'Marital Status' ] [ ID : 'SXV4__Retail_Banking__F_Customer__Marital_Status_FLD' ] [ Value Set : 'SXV4__Retail_Banking__C_Marital_Status' ] The codes are returned in the field ID, which takes the following format: `SXV4__<dataset>__<fact_table_code>__<field_code>_FLD`. In the example shown here, the fact table code is `F_Customer` and the field code is `Marital_Status` If you choose to specify the fact table as well as the field (such as `F_Customer:Marital_Status`), then you must use either the codes for both the fact table and field, or the labels for both. You cannot use a combination of the two, such as a fact table code followed by a field label. |
|     **Multilingual datasets**     |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   If you have a multilingual dataset, then you can still use either labels or codes to specify your list of fields. If specifying labels, you must use the label from the original language used when the SXV4 was channelled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
|       **Weighted datasets**       |                                                                                                                                                                                                   For weighted datasets, you must use the field codes. To find the correct code, first obtain the value of the `<LABELTEMPLATE/>` expression from the formula XML file and then use this to query SuperADMIN for the correct code to use. For example: <LABELTEMPLATE expression="Number of %MEASURE"/> You will need to replace `%MEASURE` with the relevant weighting when querying SuperADMIN. For example: > cat survey 'Number of Persons' [ Summation Field : 'Number of Persons' ] [ ID : 'SXV4_2018SURVEY__FACTTABLE__ITEM_1889318_VAR_FLD' ] > cat survey 'Number of Households' [ Summation Field : 'Number of Qualifications' ] [ ID : 'SXV4_2018SURVEY__FACTTABLE__ITEM_1889317_VAR_FLD' ] In the above example, the relevant codes are `ITEM_1889318_VAR` and `ITEM_1889317_VAR`.                                                                                                                                                                                                   |
|      **User Defined Fields**      |                                                                                                                                                                                                       The confidentiality rule also applies if there are any User Defined Fields (UDFs) in the table that are derived from one of the fields specified in the `FIELDS` property. This includes: * Summation UDFs (in this case, the confidentiality rule will apply to the entire table, even if there are other summation options used in the table that are not derived from a specified field). * Classification UDFs. * UDFs where the specified field is used as a filter even if it is not the main field being transformed (for example in multiple level UDFs and quantiles). The above applies recursively, so that a UDF based on a UDF that is based on one of the specified fields will also count for the purposes of determining whether to apply the confidentiality rule.                                                                                                                                                                                                        |
|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

## Set Different Thresholds for Totals and Non Totals

It is now possible to set a different threshold value depending on whether the cell is a total or a regular table cell. The `THRESHOLD` property now takes an optional second parameter that can be set to `TOTALS` or `NONTOTALS` to indicate which cells the threshold applies to. When setting both thresholds, specify two `THRESHOLD` properties, separated by the `|` character.

For example, the following method applies a threshold of 5 to non totals and 10 to total cells:

    method addmethod differenttotals mandatory "Conceal values of 5 or less in regular cells and 10 or less in totals"
    method differenttotals adddcplugin confrule confidentialityrule
    method differenttotals confrule addproperty RULESET "THRESHOLD(5,NONTOTALS)|THRESHOLD(10,TOTALS)"

Once you have defined the method, you can apply it to a dataset in the usual way. For example:

    cat bank addmethod differenttotals

|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| The example table shown here has no threshold rule applied to it. ![SX_ThresholdConfidentialityFields1.png](https://docs.wingarc.com.au/__attachments/a_dd4b1d5a2e37752956e3a0c68f6895f28e0f9b1d7d0891d9cf89ef48eaec5fd2/SX_ThresholdConfidentialityFields1.png?cb=8f4db2eca0bac85ea8423ac10a577e15) | With the above threshold rules, the low value cells are concealed. In the highlighted cells, values of 6 and 8 in regular table cells have not been concealed (as they are above 5). However, a value of 8 has been concealed in the total column. ![SX_ThresholdConfidentialityFields2.png](https://docs.wingarc.com.au/__attachments/a_479aace64a400914e077a3ca15555a1e66f224d8386192c5182c800b8ae45093/SX_ThresholdConfidentialityFields2.png?cb=ed9a436c76db0ebd22cea36c6fbfb9cb) |

## Set Different Frequency Rules for Totals and Non Totals

It is also possible to set a different frequency rule for totals and non totals. The `FREQ` rule now takes an optional additional parameter that can be set to `TOTALS` or `NONTOTALS`. When setting both frequency rules, specify two `FREQ` properties, separated by the `|` character.

For example, the following method applies a frequency rule of 3 to non totals and 5 to total cells:

    method addmethod differentfreqs mandatory "Conceal regular cells with 5 contributors or fewer and conceal totals with 10 contributors or fewer"
    method differentfreqs adddcplugin confrule confidentialityrule
    method differentfreqs confrule addproperty RULESET "FREQ(3,,NONTOTALS)|FREQ(5,,TOTALS)"

The double comma is required, as the `TOTALS` / `NONTOTALS` parameter is the *third* parameter accepted by the `FREQ` property (the second parameter is only used in cases where you want to specify a different cube when determining whether to conceal the results; see [Record Count](https://docs.wingarc.com.au/superstar/9.21/record-count.md) for more details on this setting).

Once you have defined the method, you can apply it to a dataset in the usual way. For example:

    cat bank addmethod differentfreqs

---
version: "9.21"
language: "en"
---
# Advanced Exclusion Rules

This page describes the new exclusion rule capability introduced in version 9.21. For the original field exclusion rule feature, see [Field Exclusion Rules](https://docs.wingarc.com.au/superstar/9.21/field-exclusion-rules.md). The new rule works independently of the existing feature.

In most cases you will want to disable the existing feature when using the new rules as all the existing capability can now be applied using the new feature.

You can use the exclusion rules feature to limit the combinations of items from particular groups that can be added to the table at any one time. The new exclusion rule capability allows you to create more advanced and flexible rules, as it allows you to define groups and then choose how you want those groups to be combined. For example, you can create groups that are only applied when some other group's limit is reached or exceeded.

In addition, the new feature allows you to specify rules that apply at the value set level.

## Step 1 - Confirm that the new Exclusion Rule is Active

1. Open **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\data\\.repository\\RulesEngine.xml** in a text editor.

2. Locate the `CDataOnlineEditRules` section:

   XML

       	<rules:RulesPipe name="CDataOnlineEditRules">
               <!-- <rules:rule-name name="OverrideDefaultSummationRule"/> -->
               <!-- <rules:rule-name name="MandatoryFieldsRule"/> -->
               <!-- <rules:rule-name name="MandatoryValuesRule"/> -->
               <!-- <rules:rule-name name="DBSummationOptionsRule"/> -->
               <!-- <rules:rule-name name="GuestUserCellLimitRule"/> -->
               <!-- <rules:rule-name name="noConcatenationRule"/> -->
                <rules:rule-name name="GroupQueryLimitRule"/>
               <!-- <rules:rule-name name="HierarchyLevelRule_All_Old"/> -->
               <!-- <rules:rule-name name="HierarchyLevelRule_All"/> -->
               <rules:rule-name name="DemographicVariablesRule"/>
               <rules:rule-name name="TableCellsNumberRule"/>
               <!-- <rules:rule-name name="checkAddToDimensionRule"/> -->
               <!-- <rules:rule-name name="checkDoubleCountingRule"/> -->
               <rules:rule-name name="SummationOptionsRule"/>
               <!-- <rules:rule-name name="DutyOfCareRule"/> -->
               <rules:rule-name name="FieldExclusionRule"/>
               <!-- <rules:rule-name name="ExclusionRule"/> -->
           </rules:RulesPipe>

   Remove the comments around the `ExclusionRule` (you may also want to comment *out* the existing `FieldExclusionRule` at this point, as shown below):
   XML

               <!-- <rules:rule-name name="FieldExclusionRule"/> -->
               <rules:rule-name name="ExclusionRule"/>
           </rules:RulesPipe>

3. In addition, locate the `QuantileFilterRules` and `NewTableRules` sections:

   XML

           <rules:RulesPipe name="QuantileFilterRules">
               <rules:rule-name name="FieldExclusionRule"/>
               <!-- <rules:rule-name name="ExclusionRule"/> -->
           </rules:RulesPipe>

           <rules:RulesPipe name="NewTableRules">
               <rules:rule-name name="FieldExclusionRule"/>
               <!-- <rules:rule-name name="ExclusionRule"/> -->
               <!-- <rules:rule-name name="MandatoryFieldsRule"/> -->
               <!-- <rules:rule-name name="MandatoryValuesRule"/> -->
           </rules:RulesPipe>

   Remove the comments around the `ExclusionRule` in both cases:
   XML

           <rules:RulesPipe name="QuantileFilterRules">
               <!-- <rules:rule-name name="FieldExclusionRule"/> -->
               <rules:rule-name name="ExclusionRule"/>
           </rules:RulesPipe>

           <rules:RulesPipe name="NewTableRules">
               <!-- <rules:rule-name name="FieldExclusionRule"/> -->
               <rules:rule-name name="ExclusionRule"/>
               <!-- <rules:rule-name name="MandatoryFieldsRule"/> -->
               <!-- <rules:rule-name name="MandatoryValuesRule"/> -->
           </rules:RulesPipe>

4. Save your changes to the file.

5. Restart SuperWEB2 or Tomcat to apply the changes.

### Step 2 - Check for existing Exclusion Rules in SuperADMIN

Before starting to create or update rules, you should check whether there are any existing exclusion rules defined. Login to SuperADMIN and use the following command (replace `<dataset_id>` with the ID of the dataset):

    cfg db <dataset_id> superweb2.rules.exclusion

SuperWEB2 will either display the list of existing rules (if some rules are already defined), or display `"not found"`.

The easiest way to define or update the rules is to use a text editor and then import the complete configuration. If there are existing rules defined then you should export those first and use that file; otherwise you can start from an empty text file. To export the existing configuration, use the following command (replacing `<dataset_id>` with the dataset ID, and `<filename>` with the full path and filename of the location to save the file on disk; do not use quotes even if the path contains spaces):

    cfg db <dataset_id> superweb2.rules.exclusion save <filename>

### Step 3 - Define the Groups and Rules

The advanced exclusion rules feature is very flexible, and allows you to construct complex rules from simple building blocks. The basic structure of the overall configuration is as follows:
JSON

    {
        "groups": {
            ...
        }
        "rules": {
            "root": { ... }
        }
    }

#### Groups:

* Within the `"groups"` section, you can define as many groups as you need, each with their own unique name of your choice.

* Groups can include fields and value sets (value sets allow you to refer only to specific levels in a hierarchical field, such as a particular level of geography).

* All elements need to be referenced using their IDs. Display names are not supported:

  * For fields you specify them using the fact table ID and field ID.

  * For value sets you specify them using the fact table ID, field ID, and value set ID.

* Value sets are applied explicitly, so if you want to block everything in a hierarchy from a certain level down, you need to specify each individual value set in the group.

* Groups can optionally include a `"limit"` setting, which acts as a default limit for that group (the limit can also be defined/overridden when the group is used in the `"rules"` section).

The following shows an example of some group configuration (items in `<` and `>` would be replaced with the relevant values):
JSON

    "groups": {
        "<group_name_1>": {
            "fields": [
                { "fact": "<fact_table_id>", "field": "<field_id>" },
                { "fact": "<fact_table_id>", "field": "<field_id>" },
                { "fact": "<fact_table_id>", "field": "<field_id>" }        
            ],
            "limit": 2
        },
        "<group_name_2>": {
            "fields": [
                { "fact": "<fact_table_id>", "field": "<field_id>", "valueSets": [ "<valueset_id>", "<valueset_id>" ... ] }
            ]
        },
        "<group_name_3>": {
            "fields": [
                { "fact": "<fact_table_id>", "field": "<field_id>" },
                { "fact": "<fact_table_id>", "field": "<field_id>" }        
            ]
        }
        ...
    }

All defined groups must be used in at least one rule. If there are groups defined that are not used, SuperWEB2 will reject the configuration, block access to the dataset, and generate an error in its log file.  
Fact table IDs, field IDs and value set IDs are validated at run time in SuperWEB2 (they are not validated when the configuration is loaded in SuperADMIN). If SuperWEB2 detects that an ID is invalid then it will reject the configuration, block access to the dataset, and generate an error in its log file.

#### Obtaining Fact Table, Field and Value Set IDs

You can find the IDs you need for the configuration in SuperADMIN by typing `cat <dataset_id> <field_name>`. For example:

    > cat bank Age
    [ XTAB Field : 'Age' ]
        [ ID : 'SXV4__Retail_Banking__F_Customer__Age_FLD' ]
        [ Value Set : 'SXV4__Retail_Banking__C_Age' ]

The reported ID value is in the following format; you will need the individual components, which are separated by double underscores, in your configuration):

    SXV4__<dataset>__<fact_table_id>__<field_id>_FLD 

For value sets, typing `cat <dataset_id> <field_name>` for the parent field will return all the value sets. For example:

    > cat bank Area
    [ XTAB Field : 'Area' ]
        [ ID : 'SXV4__Retail_Banking__F_Customer__Area_FLD' ]
        [ Value Set : 'SXV4__Retail_Banking__C_State' ]
            [ Value Set : 'SXV4__Retail_Banking__C_Geography_2' ]
                [ Value Set : 'SXV4__Retail_Banking__C_Geography_1' ]
                    [ Value Set : 'SXV4__Retail_Banking__C_Geography_0' ]

Each value set ID is in the following format; you will need the final part of this ID for your configuration, in addition to the fact table and field IDs:

    SXV4__<dataset>__<fact_table_id>__<valueset_id>

#### Rules Overview:

The `"rules"` section is where you define your rules themselves:

* It must include exactly one instance of `"root"`, which is the starting point for your chain of rules.

* You can define as many other rules as you need to within the `"rules"` section, and combine them together in a chain.

* `"root"` must contain one of the following:

  * `"any"`, set to a list of other rules enclosed in square brackets. This means that if any one of the listed rules is triggered, the table will be blocked;

  * `"all"`, set to a list of other rules enclosed in square brackets. This means that the table will only be blocked if all the listed rules are triggered (in the case where if/then rules are included in the list, this means that *both* the if and the then conditions need to be satisfied); or

  * An individual rule. In this case this will be the only rule applied.

All defined rules must be used in the chain. If there are rules defined that are not used, SuperWEB2 will reject the configuration, block access to the dataset, and generate an error in its log file.

#### Types of Rules:

The following rule types are supported:

* `"activate"`: this rule triggers when the specified limit is reached for the specified group. When defining the rule you must specify the group it applies to and the limit (this can be either in the group definition or in the rule; if both are set then the limit at rule level takes precedence).

* `"exclude"`: this rule type is the same as `"activate"` except that it triggers when the limit is exceeded.

* `"if"` ... `"then"`: this rule type combines two other rules: the `"then"` rule will only be applied when the `"if"` rule is triggered.

The following shortcut rule types are also supported:

* `"mutuallyLimiting"`, which must be set to a list of two groups enclosed in square brackets. The referenced groups must have a `"limit"` set at group level. This rule means that the table will be blocked only when the limits from both groups are exceeded. Each group can individually exceed its configured limit when the other group does not exceed its limit.

* `"mutuallyExclusive"`, which must be set to a list of two groups, enclosed in square brackets. The referenced groups do not need to have their own limits defined at group level. This rule means that if any item from one of the groups is in the table, all of the items in the other group will automatically be blocked from being added to the table.

* `"ifAct"` ... `"thenEx"`, which is a shortcut for defining an if/then rule with an activation and exclusion group. It requires limits to be set at group level. See the example below for more details.

#### Example Rule Definitions

This example defines three sets of if/then rules and will block the table if any one of the rules is triggered:
JSON

    "rules": {
        "<activate_rule_1>": { "activate": "<group_name_1>", "limit": <value> },
        "<exclude_rule_1>": { "exclude": "<group_name_2>", "limit": <value> }
        "<if_rule_1>": { "if": "<activate_rule_1>", "then": "<exclude_rule_1>" },

        "<activate_rule_2>": { "activate": "<group_name_3>", "limit": <value> },
        "<exclude_rule_2>": { "exclude": "<group_name_4>", "limit": <value> }
        "<if_rule_2>": { "if": "<activate_rule_2>", "then": "<exclude_rule_2>" },

        "<activate_rule_3>": { "activate": "<group_name_5>", "limit": <value> },
        "<exclude_rule_3>": { "exclude": "<group_name_6>", "limit": <value> }
        "<if_rule_3>": { "if": "<activate_rule_3>", "then": "<exclude_rule_3>" },
        "root": { "any": [ "<if_rule_1>", "<if_rule_2>", "<if_rule_3>" ] }
    }

This example just has a single rule, that triggers when this group exceeds the specified limit:
JSON

    "rules": {
        "root": { "exclude": "<group_name>", "limit": <value> }
    }

This example shows how the above rules could be combined in the `"any"`/`"all"` lists under `"root"`:
JSON

    "rules": {
        "<activate_rule_1>": { "activate": "<group_name_1>", "limit": <value> },
        "<exclude_rule_1>": { "exclude": "<group_name_2>", "limit": <value> }
        "<if_rule_1>": { "if": "<activate_rule_1>", "then": "<exclude_rule_1>" },

        "<activate_rule_2>": { "activate": "<group_name_3>", "limit": <value> },
        "<exclude_rule_2>": { "exclude": "<group_name_4>", "limit": <value> }
        "<if_rule_2>": { "if": "<activate_rule_2>", "then": "<exclude_rule_2>" },

        "<activate_rule_3>": { "activate": "<group_name_5>", "limit": <value> },
        "<exclude_rule_3>": { "exclude": "<group_name_6>", "limit": <value> }
        "<if_rule_3>": { "if": "<activate_rule_3>", "then": "<exclude_rule_3>" },
        "root": { "any": [ { "exclude": "<group_name>", "limit": <value> }, "<if_rule_1>", "<if_rule_2>", "<if_rule_3>" ] }
    }

Following are some examples of complete configuration that can be tested against the sample Retail Banking dataset:
Original Field Exclusion-style Rules  
This rule replicates the original field exclusion rule feature, allowing a maximum of any two fields from the group of Gender, Occupation or Marital Status:
JSON

    {
        "groups": {
             "field_exclusion_group": {
                "fields": [
                    { "fact": "F_Customer", "field": "Gender" },
                    { "fact": "F_Customer", "field": "Occupation" },
                    { "fact": "F_Customer", "field": "Marital_Status" }
                ]
            }
        },
        "rules": {
            "root": { "exclude": "field_exclusion_group", "limit": 2 }
        }
    }

This example shows how multiple groups can be combined, allowing a maximum of two out of the first group and a maximum of one out of the second group:
JSON

    {
        "groups": {
             "field_exclusion_group_1": {
                "fields": [
                    { "fact": "F_Customer", "field": "Gender" },
                    { "fact": "F_Customer", "field": "Occupation" },
                    { "fact": "F_Customer", "field": "Marital_Status" }
                ]
            },
    		"field_exclusion_group_2": {
                "fields": [
                    { "fact": "F_Customer", "field": "Age" },
                    { "fact": "F_Account", "field": "Product_Type" }
                ]
            }
        },
        "rules": {
    		"rule_1": { "exclude": "field_exclusion_group_1", "limit": 2 },
    		"rule_2": { "exclude": "field_exclusion_group_2", "limit": 1 },
            "root": { "any": [ "rule_1", "rule_2" ] }
        }
    }

If/Then Rule Examples  
This rule shows an example of an if/then rule. In this case:

* If there is at least one of Gender, Marital Status or Occupation in the table, then Postcodes (the lowest level of Area) cannot be in the table.

* Other levels of geography can be tabulated against one or more of those three fields.

* There is no restriction on tabulating Gender, Occupation and Marital Status against each other when postcodes is not in the table.

* Postcodes can be added to the table whenever those three fields are *not* in the table, and can be tabulated against any other field.

JSON

    {
        "groups": {
             "field_exclusion_group": {
                "fields": [
                    { "fact": "F_Customer", "field": "Gender" },
                    { "fact": "F_Customer", "field": "Occupation" },
                    { "fact": "F_Customer", "field": "Marital_Status" }
                ]
            },
    		"lower_level_area" : {
    			"fields": [
    			    { "fact": "F_Customer", "field": "Area", "valueSets": [ "C_Geography_0" ] }
    			]
    		}
        },
        "rules": {
    		"area_activate": { "activate": "field_exclusion_group", "limit": 1 },
            "area_exclude": { "exclude": "lower_level_area", "limit": 0 },
    		
            "root": { "if": "area_activate", "then": "area_exclude" }
        }
    }

The following is another example with multiple groups and multiple if/then rules: the two lower-level Area fields will be blocked if there are any two fields from the first group or any field from the second group in the table:
JSON

    {
        "groups": {
             "field_exclusion_group_1": {
                "fields": [
                    { "fact": "F_Customer", "field": "Gender" },
                    { "fact": "F_Customer", "field": "Occupation" },
                    { "fact": "F_Customer", "field": "Marital_Status" }
                ]
            },
    		"field_exclusion_group_2": {
                "fields": [
                    { "fact": "F_Account", "field": "Product_Type" },
                    { "fact": "F_Customer", "field": "Age" }
                ]
            },
    		"lower_level_area" : {
    			"fields": [
    			    { "fact": "F_Customer", "field": "Area", "valueSets": [ "C_Geography_1", "C_Geography_0" ] }
    			]
    		}
        },
        "rules": {
    		"area_activate_1": { "activate": "field_exclusion_group_1", "limit": 2 },
            "area_exclude_1": { "exclude": "lower_level_area", "limit": 0 },
            "area_v_rule_1": { "if": "area_activate_1", "then": "area_exclude_1" },
    		"area_activate_2": { "activate": "field_exclusion_group_2", "limit": 1 },
            "area_exclude_2": { "exclude": "lower_level_area", "limit": 0 },
            "area_v_rule_2": { "if": "area_activate_2", "then": "area_exclude_2" },
            "root": { "any": [ "area_v_rule_1", "area_v_rule_2" ] }
        }
    }

The following example is functionally the same as the previous one, but using the `"ifAct"` and `"thenEx"` shortcuts instead (as shown in this example, when using the shortcuts, the limits must be defined at group level):
JSON

    {
        "groups": {
             "field_exclusion_group_1": {
                "fields": [
                    { "fact": "F_Customer", "field": "Gender" },
                    { "fact": "F_Customer", "field": "Occupation" },
                    { "fact": "F_Customer", "field": "Marital_Status" }
                ],
                "limit": 2
            },
    		"field_exclusion_group_2": {
                "fields": [
                    { "fact": "F_Account", "field": "Product_Type" },
                    { "fact": "F_Customer", "field": "Age" }
                ],
                "limit": 1
            },
    		"lower_level_area" : {
    			"fields": [
    			    { "fact": "F_Customer", "field": "Area", "valueSets": [ "C_Geography_1", "C_Geography_0" ] }
    			],
                "limit": 0
    		}
        },
        "rules": {
            "area_v_rule_1": { "ifAct": "field_exclusion_group_1", "thenEx": "lower_level_area" },
            "area_v_rule_2": { "ifAct": "field_exclusion_group_2", "thenEx": "lower_level_area" },

            "root": { "any": [ "area_v_rule_1", "area_v_rule_2" ] }
        }
    }

The rules section for the previous example could also be further simplified as follows using the `"ifAct"` and `"thenEx"` shortcuts:
JSON

        "rules": {
            "root": { "any": [ { "ifAct": "field_exclusion_group_1", "thenEx": "lower_level_area" }, { "ifAct": "field_exclusion_group_2", "thenEx": "lower_level_area" } ] }
        }

Mutually Limiting Examples  
This example shows how the `"mutuallyLimiting"` shortcut can be used. In this example users will be blocked from adding more than two items from both groups in the same table. So, for example: Age by Gender by Marital Status would be permitted on its own, but would be blocked if both Company and Product Type are also in the table.
JSON

    {
        "groups": {
            "group1": {
                "limit": 2,
                "fields": [
                    { "fact": "F_Customer", "field": "Age" },
                    { "fact": "F_Customer", "field": "Gender" },
                    { "fact": "F_Customer", "field": "Marital_Status" },
                    { "fact": "F_Customer", "field": "Occupation" }
                ]
            },
            "group2": {
                "limit": 2,
                "fields": [
                    { "fact": "F_Customer", "field": "Cust_Mail_Ind" },
                    { "fact": "F_Customer", "field": "Company" },
                    { "fact": "F_Account", "field": "Product_Type" }
                ]
            }
        },
        "rules": { "root": { "mutuallyLimiting": [ "group1", "group2" ] } }
    }

Mutually Exclusive Examples  
This example shows how the `"mutuallyExclusive"` shortcut can be used. In this example, any one field from `"group1"` blocks all fields from `"group2"`, and vice versa. There is no restriction on adding multiple fields from one group when there is nothing from the other group in the table.

Although there are limits set at the group level in the example configuration, these limits are not used as they are overridden by the `"mutuallyExclusive"` rule.
JSON

    {
        "groups": {
            "group1": {
                "limit": 3,
                "fields": [
                    { "fact": "F_Customer", "field": "Age" },
                    { "fact": "F_Customer", "field": "Gender" },
                    { "fact": "F_Customer", "field": "Marital_Status" },
                    { "fact": "F_Customer", "field": "Occupation" }
                ]
            },
            "group2": {
                "limit": 2,
                "fields": [
                    { "fact": "F_Customer", "field": "Cust_Mail_Ind" },
                    { "fact": "F_Customer", "field": "Company" },
                    { "fact": "F_Account", "field": "Product_Type" }
                ]
            }
        },
        "rules": { "root": { "mutuallyExclusive": [ "group1", "group2" ] } }
    }

### Step 4 - Upload Your Rule Configuration

Once you have finished configuring your rules, upload them to the SuperADMIN configuration server using the following command:

    cfg db <dataset_id> superweb2.rules.exclusion load <filename>

## Optional Configuration

### Define a Custom Error Message for Rule Breaches

When a user's selection breaches one of your configured rules, SuperWEB2 displays a standard error message. The text of this message is defined by the `fieldExclusion.failure` property defined in **CDataOnlineEditRules.properties** (and the equivalent versions for other UI languages), which is located in **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\data\\.repository\\**.

You may wish to edit this message to reflect your preferred message to users when they exceed one of the configured limits.

    fieldExclusion.failure=Error: Table contains an excluded set of items.

---
version: "9.21"
language: "en"
---
# Advanced JQM Configuration

This section describes some advanced configuration adjustments you may want to make to Job Queue Manager. You should [install Job Queue Manager and confirm that the basic functionality is working](https://docs.wingarc.com.au/superstar/9.21/configure-jqm.md) before making any of these changes.

## Job Expiry and Removal

By default, jobs will not be removed from the database. [Click here to find out how to configure SuperWEB2 to automatically remove old jobs from the database](https://docs.wingarc.com.au/superstar/9.21/job-expiry-and-removal.md).

### Date Format

You can change the format used to display the time a job was added to the job queue and time it will expire. [Learn more.](https://docs.wingarc.com.au/superstar/9.21/configure-date-display.md)

### Server Outages

You can configure how often Job Queue Manager checks for server and network outages. You can also configure it to send an email when it loses connection and again when it reconnects. [Learn more](https://docs.wingarc.com.au/superstar/9.21/superstar-server-outages.md).

### Job Queue Status and Priorities

Administrators can configure how Job Queue Manager prioritises jobs. See [Job Queue Manager Priority](https://docs.wingarc.com.au/superstar/9.21/job-queue-manager-priority.md) for more details.

It is also possible to review the status of jobs and check for errors by reviewing the database directly. [Learn more about the possible job statuses and what they mean](https://docs.wingarc.com.au/superstar/9.21/manage-the-job-queue.md).

### SuperWEB2 Customisations

If you have customised SuperWEB2, then you must make sure that any customised resources (such as custom table labels, copyright statements, and language resources) are available to Job Queue Manager. [Learn more](https://docs.wingarc.com.au/superstar/9.21/customised-resources.md).

### Compression Level

Job Queue Manager compresses the data when it writes output to the database. You can change the compression level to either reduce the file size or increase the processing speed. [Learn more](https://docs.wingarc.com.au/superstar/9.21/compression.md).

### Queue Processing Frequencey

By default, Job Queue Manager checks for new jobs to process every 10 seconds. You can change this setting. [Learn more](https://docs.wingarc.com.au/superstar/9.21/queue-processing-frequency.md).

### Display Name

If you have multiple Job Queue Manager instances running against the same database, you may wish to set the display name. This name is displayed in the database, and will allow you to tell which jobs belong to which Job Queue Manager instance. [Learn more](https://docs.wingarc.com.au/superstar/9.21/display-name.md).

### Field Level Security and Data Control

If you are using field level security, you are recommended to set this up before creating saved tables and queries in SuperWEB2. Changes to field level security may cause problems with existing saved tables. [Learn more...](https://docs.wingarc.com.au/superstar/9.21/field-level-security-and-data-control.md)

### Support for Concealment and Not a Number

If you have modified SuperWEB2's default settings for Concealment or Not a Number, you need to make the same configuration changes to Job Queue Manager. Learn more about changing the Job Queue Manager settings for [concealment](https://docs.wingarc.com.au/superstar/9.21/concealment.md) and [NaN support](https://docs.wingarc.com.au/superstar/9.21/cells-with-no-contributors.md).

### Logging

You can configure the amount of logging information that Job Queue Manager writes to its log files. [Learn more](https://docs.wingarc.com.au/superstar/9.21/logging-jqm.md).

---
version: "9.21"
language: "en"
---
# aggregated data

See [summary data](https://docs.wingarc.com.au/superstar/9.21/summary-data.md).

---
version: "9.21"
language: "en"
---
# annotation

Additional information associated with a table or chart.

For example, a symbol in a cell to denote a special condition (such as **Not Available**).

There are two parts to an annotation: a symbol in the cell and a footnote text for the symbol.

---
version: "9.21"
language: "en"
---
# Annotation Repository Schema

The annotation repository schema supports the following functions:

* Add/delete an annotation

* Update an annotation's symbol

* Update an annotation's description

* Enforce the uniqueness of annotation symbols

* Add/delete database assignments

* Add/delete field assignments

* Add/delete field value assignments

* Add/delete cell assignments

* Update assignments with a new annotation symbol

The annotation repository schema is represented in the following database entity diagram:  
![worddavb63da9ba92bf1edbe4176c0ad7ff40a5.png](https://docs.wingarc.com.au/__attachments/a_c8f101b9451accba33d5764e0db4cb2dc7708ba27666181e452775b07fda861f/worddavb63da9ba92bf1edbe4176c0ad7ff40a5.png?cb=b63da9ba92bf1edbe4176c0ad7ff40a5)

The tables in the annotation repository schema are:  

|         **Table**          |                                                                                                             **Description**                                                                                                             |   **Primary Key**    |                          **Foreign Key**                          |
|----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------|-------------------------------------------------------------------|
| `AnnotationDetails`        | Stores annotation symbols and descriptions.                                                                                                                                                                                             | `AnnotationID`       |                                                                   |
| `DbAssignment`             | Stores database annotation assignments.                                                                                                                                                                                                 |                      | Refers to the primary key in the `AnnotationDetails` table.       |
| `FieldAssignment`          | Stores field annotation assignments.                                                                                                                                                                                                    | `UniqueCode`         | `AnnotationID`. Refers to the primary key in `AnnotationDetails`. |
| `FieldValueCodeAssignment` | Stores field value annotation assignments.                                                                                                                                                                                              | `UniqueCode`         | `AnnotationID`. Refers to the primary key in `AnnotationDetails`. |
| `Annotation`               | Stores the joins between `AnnotationDetails` and `CellAssignment`.                                                                                                                                                                      | `AnnotationAssignID` | `AnnotationID`. Refers to the primary key in `AnnotationDetails`. |
| `CellAssignment`           | Stores cell assignment. All records that share the same `AnnotationAssignID` will be used to identify the position of cells. When a measure is used, `ValueSetName` and `FieldValueCode` must be left empty (") and not be set to null. |                      | `AnnotationAssignID`. Refers to the primary key in `Annotation`.  |

---
version: "9.21"
language: "en"
---
# Annotations

The SuperSERVER annotation functionality allows you to automatically show additional information or explanatory notes when particular fields and values appear in a table.

The clients display the annotations beneath the table. For example:  
![A table with annotation symbols next to field names and the corresponding list of annotations beneath it](https://docs.wingarc.com.au/__attachments/a_fd1964a261523140fe49042f7e175423c293df7a7e3fe5ee764bbe09eb566444/SW2-Annotations.png?cb=c5ba1a12b3c1cd1d337a3d2ad0bfd6b7)

You can enable annotations for a field (for example: **Gender** ), a field value (for example: **Male**), an individual cell value (a specific combination of fields) or an entire dataset.

You can also use [conditional annotations](https://docs.wingarc.com.au/superstar/9.21/conditional-annotations.md) to provide further control over when a particular annotation is shown (for example, to show a particular annotation when a given field appears in the table, except when another specific field is also in the table).  
You are recommended not to create more than 100,000 annotations on any particular table.

SuperSERVER stores annotations in a relational database called the static annotation repository, which you need to create using a public domain relational database implementation called [SQLite](http://www.sqlite.org/).

The annotation repository must be stored in a file named **\<database_filename\>.sxv4.sqlite.db**, saved in the same directory as the SXV4 database file it relates to. For example:  

|                     **If the Database File Is...**                      |                     **The Annotation Repository Must Be...**                      |
|-------------------------------------------------------------------------|-----------------------------------------------------------------------------------|
| **C:\\ProgramData\\STR\\SuperSERVER SA\\databases\\RetailBanking.sxv4** | **C:\\ProgramData\\STR\\SuperSERVER SA\\databases\\RetailBanking.sxv4.sqlite.db** |
| **C:\\ProgramData\\STR\\SuperSERVER SA\\databases\\people.sxv4**        | **C:\\ProgramData\\STR\\SuperSERVER SA\\databases\\people.sxv4.sqlite.db**        |
| **E:\\Databases\\SurveyResults2013.sxv4**                               | **E:\\Databases\\SurveyResults2013.sxv4.sqlite.db**                               |

From version 9.9.3 onwards, SuperSERVER supports two types of annotation: static annotations, which can be assigned to specific datasets, fields, values and cells, and [conditional annotations](https://docs.wingarc.com.au/superstar/9.21/conditional-annotations.md), which provide advanced control over when the annotation is shown (for example you can configure annotations to only display if a specific combinations of fields appear in the table). [Learn more](https://docs.wingarc.com.au/superstar/9.21/conditional-annotations.md).

The following steps explain how to create your own annotation repositories.

## Step 1 - Create your SQL Scripts

The first step is to create a script file containing all the SQL statements required to populate your annotation database. SuperSERVER is supplied with a number of files to help you with this step, which you can find in **C:\\ProgramData\\STR\\SuperSERVER SA\\etc\\annotations** (or the equivalent directory if you installed to a different location):

* **schema.sql** contains SQL statements for creating an empty annotation repository. You do not need to edit this file; you will use it in the next step to create an empty annotation repository, ready to be populated with your annotations.

* **RetailBanking.sql** and **financial.sql** contain examples of the SQL required to populate the annotation repository. You can use these as a template for writing the SQL insert statements you need to populate your own annotation repository.

* **RetailBanking.sxv4.sqlite.db** and **Financial.sxv4.sqlite.db** are examples of pre built annotation repositories for the sample databases. You can test these out by copying them to the same directory as the sample SXV4 databases (**C:\\ProgramData\\STR\\SuperSERVER SA\\databases** by default).

To setup your SQL scripts:

1. Make a copy of either **RetailBanking.sql** or **financial.sql** and save it in the same directory as your database. Rename it to match the name of your SXV4.

2. Open the SQL file in a text editor.

3. Make sure that your SQL file is encoded in UTF-8 without a Byte Order Mark. This step is particularly important if you will be using non-ASCII characters, as it will allow you to use the full range of unicode characters in your annotations.

   The way to check and set the text file encoding depends on your text editor (not all text editors allow you to do this). For example in Notepad++ you can do this using the **Encoding** menu:  
   ![Annotations-Encoding.png](https://docs.wingarc.com.au/__attachments/a_2eebd67945567a3ca91cb9340f6dd4df11ea22fc2effac9e0673ffb321b823b1/Annotations-Encoding.png?cb=f967b131752927b686bb9e6713897e50)  
   If you are using non-ASCII characters, you must also ensure that your annotations schema includes the `FileInfo` table with the `FileVersion` set to `2`. This table will be created automatically if you use the supplied **schema.sql** file to create your initial annotation repository.
4. Modify the SQL insert statements to define the annotations you want for your database.

As you will see if you inspect the sample files (**RetailBanking.sql** or **financial.sql**), there are a number of tables you need to populate to set up your annotations:  

|         **Table**          |                                                                                                                                                                                                                                                                                                                                                                                                                                           **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                           |
|----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `AnnotationDetails`        | Each row in this table contains an individual annotation. There are three columns in this table: |-------------------------|-----------------------------------------------------------------------------| | **Column**              | **Description**                                                             | | `AnnotationID`          | A unique ID used in the other tables to refer to this annotation.           | | `AnnotationSymbol`      | A symbol that will be displayed in the clients to identify this annotation. | | `AnnotationDescription` | The text content of the annotation to display in the clients.               |                                                                                                                                                                                                                                                  |
| `DBAssignment`             | Use this table to assign an annotation to the entire database. The annotation will be shown for all tables created using this database. This table contains a single column (`AnnotationID`). Set this to the ID of the annotation (from the `AnnotationDetails` table) that you want to assign to this database.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| `FieldAssignment`          | Use this table to assign an annotation to a specific field. The annotation will be shown whenever this field appears in the table. There are three columns in this table: set `AnnotationID` to the ID of the annotation you want to assign, and use `TableName` and `FieldName` to identify the field it applies to. You must use the underlying ID of the table and field (from the source database), rather than their display names.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| `FieldValueCodeAssignment` | Use this table to assign an annotation to a specific field value.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| `CellAssignment`           | Use this table to assign annotations to specific cell values. This table works in conjunction with the `Annotation` table.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| `Annotation`               | Use this table to store joins between the `AnnotationDetails` and `CellAssignment`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| `FileInfo`                 | This table sets the annotation file version. It must contain a single row with the values `FileVersion` and `2`. This table will be created and populated automatically in your annotation repository if you use the supplied **schema.sql** file to create your initial annotation repository. This table is required if you are using non-ASCII characters in annotations (i.e., your annotations include Unicode characters). The `FileInfo` table was added to the annotations schema in SuperSTAR 9.0. It will be created automatically if you use the supplied **schema.sql** file to create a new annotation repository. However, if you have an existing annotations repository that was created before SuperSTAR 9.0 then it may not contain this table. You will need to manually add the `FileInfo` table to your repository in order to support Unicode characters in your annotations. |

### Step 2 - Check the SQLite Version

To configure the static annotations, you need the SQL command line utility **sqlite.exe** . A version of this utility is provided with SuperSERVER, in **C:\\Program Files\\STR\\SuperSERVER SA** . You can also download it from [www.sqlite.org](http://www.sqlite.org/).

SuperSERVER requires SQLite version 3.3 or above. You can check the version you have installed using the following command from a command prompt:

    C:\>sqlite -version
    3.7.4
    C:\>

### Step 3 - Create the Annotation Repository

Once you have finished creating your own SQL script file, you can use SQLite to create the static annotation repository file.

1. Open a command prompt and navigate to the directory containing the SXV4 database. For example:

       C:\>cd /d "E:\Databases\"

2. Use the command `sqlite <database_name>.sxv4.sqlite.db` to start SQLite and begin creating the repository file.

   For example:

       E:\databases>sqlite SurveyResults2013.sxv4.sqlite.db

       SQLite version 3.7.4
       Enter ".help" for instructions
       Enter SQL statements terminated with a ";"

       sqlite>

3. Run the supplied schema script to set up the empty repository. You can either use a relative or an absolute path to the **schema.sql** file, but you must use forward slashes. For example:

       sqlite> .read "C:/ProgramData/STR/SuperSERVER SA/etc/annotation/schema.sql" 

4. Run the SQL file you created in the previous step. You can either use a relative path (relative to the current directory) or an absolute path, but must use forward slashes. For example:

       sqlite> .read SurveyResults2013.sql

5. Close SQLite:

       sqlite> .exit

       C:\ProgramData\STR\SuperSERVER SA\databases>

You can now start one of the SuperSTAR clients and open the database to see your annotations in use.

There is no additional SuperSERVER configuration required for it to start using your annotations. As long as the SQLite database file is in the same directory as the SXV4 database (and the SXV4 has been added to the SuperSERVER database catalogue in SuperADMIN), then the server will automatically send the annotations to the clients to display.

### Updating the Annotations

If you need to make further changes to the annotation repository, you can simply:

1. Edit the SQL file to contain your new annotations.

2. Delete the existing **.sqlite.db** file.

3. Repeat Step 3 above to recreate the annotations.

Alternatively, you can use a tool like SQLite Browser (available from <http://sqlitebrowser.org/>) to make changes to your SQLite database file without recreating it from scratch.  
In some cases you may not be able to delete or update the existing **.sqlite.db** file because it is locked by the SuperSERVER process (**scsa.exe** ). In this case you may need to use SuperADMIN to remove the database from the SuperSERVER database catalogue first so that SuperSERVER releases its file lock on the **.sqlite.db** file. You can then add the database back to SuperSERVER once you have rebuilt your annotation repository.

### Multilingual Annotations

If you are using the [Metadata Server](https://docs.wingarc.com.au/superstar/9.21/metadata-server.md) to display your datasets in multiple languages, then you can also translate your dataset annotations.

You need to create a table in your metadata database called `fnote_<dataset_id>` for each dataset that has annotations, and make sure this is referenced in the `ss_fnote` column of the `db_domain` table.

You can then populate your `fnote_<dataset_id>` table with the translations of your annotations: add the annotation symbol to the `ss_code` column and the translated text to the `<lang>_name` column. See [Reference](https://docs.wingarc.com.au/superstar/9.21/reference.md) for more details on populating the `fnote_<dataset_id>` table.

### Using a Graphical Editor to Populate the Annotations Database

As an alternative to using the command line interface to create your SQLite DB file, there are several third party browser tools for editing SQLite files. For example: <http://sqlitebrowser.org/>

If you decide to use one of these tools to edit your file, then you simply use the supplied **schema.sql** file to populate the initial schema of the repository and then add your annotations via the editor GUI.

### Learn More

There are some other ways you can create annotations and have them display with the table:

* Users can create annotations directly in SuperCROSS, although those annotations are not saved to the server. Users who create their own annotations can view them during the current SuperCROSS session and save them with the table. [Learn more about annotations in SuperCROSS](https://docs.wingarc.com.au/superstar/9.21/annotations-sx.md).

* You can write your own Data Control module to add your custom annotations. See [Annotations](https://docs.wingarc.com.au/superstar/9.21/annotations-2.md) for more information.

---
version: "9.21"
language: "en"
---
# Annotations

SuperSERVER maintains a separate database for storing annotation information. For details of the database schema and facilities supported by the SuperSERVER annotation subsystem, see [Annotations 4](https://docs.wingarc.com.au/superstar/9.21/annotations-2.md).

The following functions allow access to the annotation facilities within SuperSERVER.

## AddSymbolDescriptionT()

Add an annotation symbol and description to the results.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    AddSymbolDescriptionT(JobInfoT* JobInfo, const char* Symbol, const char* Description)

| **Arguments** |     |   **JobInfo**   | Input |   Information about the current job.   | |   **Symbol**    | Input | The symbol (or ID) for the annotation. | | **Description** | Input |      The annotation description.       | |-----------------|-------|----------------------------------------|      |
|  **Returns**  | | **1** |                                      Success.                                      | | **0** | The operation failed. For example because you attempted to add a duplicate symbol. | |-------|------------------------------------------------------------------------------------| |
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### GetALLSymbolDescriptionT()

Retrieve all annotations.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    GetALLSymbolDescriptionT(JobInfoT* JobInfo, const SymbolDescriptionT** Values, int* Len)

| **Arguments** | | **JobInfo** | Input  |                  Information about the current job.                   | | **Values**  | Output | An array containing the returned annotation symbols and descriptions. | |   **Len**   | Output |                   The length of the returned array.                   | |-------------|--------|-----------------------------------------------------------------------| |
|  **Returns**  |                                                                                   | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------| If the operation is successful, but the result set is empty, then `Len` will be set to zero and `Values` will be `NULL`.                                                                                    |
|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### AddDatabaseAnnotationT()

Assign a database annotation to the tabulation request.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    AddDatabaseAnnotationT(JobInfoT *JobInfo, const char* Symbol)

| **Arguments** | | **JobInfo** | Input |    Information about the current job.    | | **Symbol**  | Input | The symbol for the annotation to assign. | |-------------|-------|------------------------------------------| |
|  **Returns**  |                                                  | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------|                                                   |
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### DeleteDatabaseAnnotationT()

Delete a database annotation from the tabulation request.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    DeleteDatabaseAnnotationT(JobInfoT *JobInfo, const char* Symbol)

| **Arguments** | | **JobInfo** | Input |    Information about the current job.    | | **Symbol**  | Input | The symbol for the annotation to delete. | |-------------|-------|------------------------------------------| |
|  **Returns**  |                                                  | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------|                                                   |
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### GetDatabaseAnnotationT()

Retrieve all the database annotations for the tabulation request.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    GetDatabaseAnnotationT(JobInfoT *JobInfo, const char*** Values, int* Len)

| **Arguments** | | **JobInfo** | Input  | Information about the current job.  | | **Values**  | Output |    An array of returned values.     | |   **Len**   | Output | The length of the returned results. | |-------------|--------|-------------------------------------| |
|  **Returns**  |               | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------| If the operation is successful, but the result set is empty, then `Len` will be set to zero and `Values` will be `NULL`.                |
|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### AddFieldAnnotationT()

Assign an annotation to a field.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    AddFieldAnnotationT(JobInfoT *JobInfo, int Dimension, int FieldOffset, const char* Symbol)

| **Arguments** | |   **JobInfo**   | Input |                 Information about the current job.                 | |  **Dimension**  | Input |             The dimension index within the data cube.              | | **FieldOffset** | Input | The field index within this dimension to assign the annotation to. | |   **Symbol**    | Input |               The symbol for the annotation to add.                | |-----------------|-------|--------------------------------------------------------------------| |
|  **Returns**  |                                                                                                                                                                                                | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------|                                                                                                                                                                                                 |
|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### DeleteFieldAnnotationT()

Delete an annotation from a field.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    DeleteFieldAnnotationT(JobInfoT *JobInfo, int Dimension, int FieldOffset, const char* Symbol)

| **Arguments** | |   **JobInfo**   | Input |                  Information about the current job.                  | |  **Dimension**  | Input |              The dimension index within the data cube.               | | **FieldOffset** | Input | The field index within this dimension to delete the annotation from. | |   **Symbol**    | Input |               The symbol for the annotation to delete.               | |-----------------|-------|----------------------------------------------------------------------| |
|  **Returns**  |                                                                                                                                                                                                     | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------|                                                                                                                                                                                                      |
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### GetFieldAnnotationT()

Retrieve all annotations from a specified field.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    GetFieldAnnotationT(JobInfoT *JobInfo, int Dimension, int FieldOffset, const char*** Values, int* Len)

| **Arguments** | |   **JobInfo**   | Input  |                Information about the current job.                | |  **Dimension**  | Input  |            The dimension index within the data cube.             | | **FieldOffset** | Input  | The field index within this dimension to get the annotation for. | |   **Values**    | Output |                   An array of returned values.                   | |     **Len**     | Output |               The length of the returned results.                | |-----------------|--------|------------------------------------------------------------------| |
|  **Returns**  |                                                                                                                                                                                 | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------| If the operation is successful, but the result set is empty, then `Len` will be set to zero and `Values` will be `NULL`.                                                                                                                                                                                  |
|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### AddFieldValueAnnotationT()

Assign an annotation to a field value.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    AddFieldValueAnnotationT(JobInfoT *JobInfo, int Dimension, int FieldOffset, int WhichItem, const char* Symbol)

| **Arguments** | |   **JobInfo**   | Input |                 Information about the current job.                  | |  **Dimension**  | Input |              The dimension index within the data cube.              | | **FieldOffset** | Input |               The field index within this dimension.                | |  **WhichItem**  | Input | The index of the item within the field to assign the annotation to. | |   **Symbol**    | Input |              The symbol for the annotation to assign.               | |-----------------|-------|---------------------------------------------------------------------| |
|  **Returns**  |                                                                                                                                                                                                                                                    | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------|                                                                                                                                                                                                                                                    |
|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### DeleteFieldValueAnnotationT()

Delete an annotation from a field value.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

    DeleteFieldValueAnnotationT(JobInfoT *JobInfo, int Dimension, int FieldOffset, int WhichItem, const char* Symbol)

| **Arguments** | |   **JobInfo**   | Input |                  Information about the current job.                   | |  **Dimension**  | Input |               The dimension index within the data cube.               | | **FieldOffset** | Input |                The field index within this dimension.                 | |  **WhichItem**  | Input | The index of the item within the field to delete the annotation from. | |   **Symbol**    | Input |               The symbol for the annotation to delete.                | |-----------------|-------|-----------------------------------------------------------------------| |
|  **Returns**  |                                                                                                                                                                                                                                                          | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------|                                                                                                                                                                                                                                                          |
|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### GetFieldValueAnnotationT()

Retrieve all annotations for a field value.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

    GetFieldValueAnnotationT(JobInfoT *JobInfo, int Dimension, int FieldOffset, int WhichItem, const char*** Values, int* Len)

| **Arguments** | |   **JobInfo**   | Input  |                 Information about the current job.                  | |  **Dimension**  | Input  |              The dimension index within the data cube.              | | **FieldOffset** | Input  |               The field index within this dimension.                | |  **WhichItem**  | Input  | The index of the item within the field to get the annotations from. | |   **Values**    | Output |                    An array of returned values.                     | |     **Len**     | Output |                 The length of the returned results.                 | |-----------------|--------|---------------------------------------------------------------------| |
|  **Returns**  |                                                                                                                                                                                                                                            | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------| If the operation is successful, but the result set is empty, then `Len` will be set to zero and `Values` will be `NULL`.                                                                                                                                                                                                                                            |
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### AddCurrentCellAnnotationT()

Assign an annotation to the current cell.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    AddCurrentCellAnnotationT(JobInfoT *JobInfo, const char* Symbol)

| **Arguments** | | **JobInfo** | Input | Information about the current job. | | **Symbol**  | Input |  The annotation symbol to assign.  | |-------------|-------|------------------------------------| |
|  **Returns**  |                                         | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------|                                          |
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### DeleteCurrentCellAnnotationT()

Delete an annotation from the current cell.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    DeleteCurrentCellAnnotationT(JobInfoT *JobInfo, const char* Symbol)

| **Arguments** | | **JobInfo** | Input | Information about the current job. | | **Symbol**  | Input |  The annotation symbol to delete.  | |-------------|-------|------------------------------------| |
|  **Returns**  |                                         | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------|                                          |
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### GetCurrentCellAnnotationT()

Get all annotations for the current cell.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    GetCurrentCellAnnotationT(JobInfoT *JobInfo, const char*** Values, int* Len)

| **Arguments** | | **JobInfo** | Input  | Information about the current job.  | | **Values**  | Output |    An array of returned values.     | |   **Len**   | Output | The length of the returned results. | |-------------|--------|-------------------------------------| |
|  **Returns**  |               | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------| If the operation is successful, but the result set is empty, then `Len` will be set to zero and `Values` will be `NULL`.                |
|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

### AddCellAnnotationT()

Assign an annotation to a particular cell.  

| **Available To** | `PrepareJob` | `PerformJob` | `CleanUpJob` |
|------------------|--------------|--------------|--------------|

C++

    AddCellAnnotationT(JobInfoT *JobInfo, const int* CellLocation, int Len ,const char* Symbol)

| **Arguments** | |   **JobInfo**    | Input |                   Information about the current job.                    | | **CellLocation** | Input | An array of dimension item indexes identifying a cell in the data cube. | |     **Len**      | Input |                      The length of `CellLocation`.                      | |    **Symbol**    | Input |                    The annotation symbol to assign.                     | |------------------|-------|-------------------------------------------------------------------------| |
|  **Returns**  |                                                                                                                                                                                                               | **1** |       Success.        | | **0** | The operation failed. | |-------|-----------------------|                                                                                                                                                                                                                |
|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

---
version: "9.21"
language: "en"
---
# Annotations

The annotation functionality lets you create annotations and assign them to values in the table. Annotations can be assigned to various table components such as databases, fields, field values, and data cells (cross section of two or more field values).

An annotation contains two parts:

* Annotation symbol assignments - This is used to associate an annotation symbol with a table item.

* Annotation description -This contains detailed descriptive information for the annotation symbol.

Annotations can be assigned to the following elements within a table:

* Database - Setting an annotation for a database. The symbol will display in the title, next to the database name.

* Field - Setting an annotation for a field. The field can be across-tabulation or measure field. This annotation will display next to the field name in the table's title.

* Field value (category) - Setting an annotation for a field value. The field must be across-tabulation field. This annotation will display next to that value in the column, row or wafer of the table.

* Data cell:

  * Setting an annotation for a combination of field values. The symbol will display in all the cells that correspond to this combination.

  * Setting an annotation for a combination of field values and a measure field. The symbol will display in all the cells that correspond to this combination.

You are recommended not to create more than 100,000 dynamic annotations on any particular table.

Using the Data Control API, you can assign annotations to the table dynamically during cross-tabulation. See [Module Callback API](https://docs.wingarc.com.au/superstar/9.21/module-callback-api.md) for more information about the callbacks you need to use for this.

## Defining an Annotation Assignment

### Database

A database annotation assignment can be defined by associating a database identifier with at least one annotation symbol. It can be described as:

    [Database identifier] → [symbol, symbol , ...]

#### Field

Annotation assignment on a cross-tabulation/measure field can be defined by associating a field identifier with at least one annotation symbol. A cross-tabulation/measure identifier consists of a table name to which this field belongs and a field name. This assignment can be described as:

    [Table Name, Field Name] → [symbol, symbol,, ...]

#### Field value (category)

Annotation assignment on a field value (category) can be defined by associating the field value identifier with at least one annotation symbol. A field value identifier consists of a table name to which this field belongs, a field name, a value set name and a value set value code. This assignment can be described as:

    [Table Name, Field Name, Value Set Name, Value Set Value Code] → [symbol, symbol, ...]

#### Data cell

Annotation assignment on a data cell can be defined by associating a combination described in Table Items with at least one annotation symbol. The assignment can be described as:

    [ (Table Name, Field Name, Value Set Name, Value Set Value Code)+] → [symbol, symbol, ...]

and

    [ (Table Name, Field Name, Value Set Name, Value Set Value Code)+, (Table Name, Field Name) ] →
    [symbol, symbol, ...]

A measure field can only be described as (Table Name, Field Name).

---
version: "9.21"
language: "en"
---
# Annotations Sample Code

The **etc\\annotation** directory (**C:\\ProgramData\\STR\\SuperSERVER SA\\etc\\annotation**) contains sample code for the annotations:

* **etc\\annotation\\Financial.sxv4.sqlite.db**

* **etc\\annotation\\README.txt**

* **etc\\annotation\\financial.sql**

* **etc\\annotation\\schema.sql**

The annotation engine uses a Public Domain relational database implementation, SQLite, available from [http://www.sqlite.org](http://www.sqlite.org/).

The SuperSERVER installation includes the necessary run-time components of SQLite to allow annotations to be processed by the server. However, to configure annotations in the database it is necessary to obtain an SQL command line utility, **sqlite3.exe**.

You can download this for Windows and Linux installations from the 'downloads' page at [http://www.sqlite.org](http://www.sqlite.org/).  
The SuperSERVER implementation requires at least version 3.3 to operate correctly.

SQLite is often shipped automatically with Linux installations, but this may be an older (incompatible) version of SQLite (for example GNU/Linux 2.6.13-15-smp ships with SQLite v2.8.16).

To determine the version of a previously installed **sqlite3.exe** from a DOS shell or Linux command prompt invoke the command:
PowerShell

    > sqlite3 -version

## Create a new Annotations Database

The SuperSERVER implementation associates the SQLite database with a SuperSERVER database by name. For example, annotations for the Retail Banking sample database would be stored in a file called **Retail Banking.sxv4.sqlite.db**.

To create a new annotations database perform the following steps:

1. Open a command prompt.

2. Change directory to the database directory of the SuperSERVER installation.

3. Run the command:

   PowerShell

       > sqlite3 <YourDBName>.sxv4.sqlite.db

4. At the SQLite command prompt run following command to configure the schema:

   PowerShell

       sqlite> .read ..\etc\annotation\schema.sql

5. Add annotations using SQL Insert statements (from the sqlite3 command prompt) for your table.

   To exit SQLite type the EOF character (normally **Ctrl-D**).

---
version: "9.21"
language: "en"
---
# Annotations

You can add annotations to cells, fields, and the table header. For example, you can use them to add notes, explain the recodes used or provide information about certain cell values within the table.

The annotations appear at the bottom of the table with reference markers against the relevant cells:  
![SX-Table-With-Annotations.png](https://docs.wingarc.com.au/__attachments/a_2cf053ecbe2a5ae121b2a36b83ccb1f5be05b3cc1e47ae232e910676088f8878/SX-Table-With-Annotations.png?cb=ada5c6a10935bd77ec60d634d507de79)  
By default, all the annotations you add appear in the table footer, even if you remove the items they refer to from the table. To change this, right-click the footer and select **Filter Annotation Footnotes**. When this option is selected, the list of annotations in the footer dynamically updates to only show annotations for items that currently appear in the table.  
Your system administrator may have [configured annotations at the server level](https://docs.wingarc.com.au/superstar/9.21/annotations.md). If this is the case, then any annotations you add in SuperCROSS will display in addition to the server-level annotations. Annotations you create in SuperCROSS will not be saved to the server; they will be visible during the current session and will be saved with the table when you save to certain formats (see below).

## Create or Edit Annotations

To add or edit an annotation, do the following.  

|   **To Annotate...**   |                                                                                                                                        **Do This...**                                                                                                                                         |
|------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Individual cells       | Select the cell or cells and then do one of the following: * Right-click and select **Annotate Cells \> Annotate Selected Cells**; or * Select **Edit \> Data Area \> Annotate Cells \> Annotate Selected Cells**.                                                                            |
| Fields or field values | Right-click the row, column, or wafer where the field appears and select either: * **Assign Annotations \> Annotate Selected Field** to annotate the field you clicked; or * **Assign Annotations \> Annotate Selected Field Value** to annotate the individual field value that you clicked. |
| Table Header           | Right-click the table header and select one of the options from the **Assign Annotations** menu. The options will depend on the fields in your table                                                                                                                                          |

The **Annotate**window displays.  
![SX-Annotate-Field-Window.png](https://docs.wingarc.com.au/__attachments/a_1ac2d815cecdcce481cbf7b2e381e22931eb6a613532e7336cba02b7dbc8d592/SX-Annotate-Field-Window.png?cb=362e4ac882f7f983c1126323c50643f1)

Here you can add and remove annotations:  

|  **To Do This...**   |                                                                                                                                                                                                                                                                                                **Do This...**                                                                                                                                                                                                                                                                                                 |
|----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Add a New Annotation | To add a new annotation: 1. Click **Add New**. 2. In the **Symbol** field, enter the symbol that will display in the table next to the annotated item (up to 10 characters). 3. In the **Description** field, enter the text of the annotation (this is the text that displays in the table footer area). This can be up to 224 characters. If you are entering a long annotation, click **\>\>\>** to access a larger text area at the bottom of the window. 4. Select the **Assigned** check box next to the annotation to assign it to the field, field value, cell or table header item. 5. Click **OK**. |
| Remove an Annotation | To delete an annotation, select it in the list and click **Delete**. This will remove the annotation completely. If you want to keep the annotation in the list, but remove it from the selected field, field value, cell or table header, select the annotation and click **Clear Assignments**.                                                                                                                                                                                                                                                                                                             |

### Save Annotations

Annotations will be saved with the table when you save it to any of the following formats:

* SuperCROSS (.SCS)

* Excel 97 or 2003 (.XLS)

* Excel 2007 or 2010 (.XLSX)

* XML

For more information, see [Saving](https://docs.wingarc.com.au/superstar/9.21/saving.md).

### Limitations of Annotations

* Annotations on fields where there are duplicated field names in different fact tables are not supported when loading **scs** files in table view.

* RSE Annotations are not supported (RSE can still be used as part of the summation options).

* Annotation of derivations or cells with derivations is not supported.

* Annotation of a concatenated field is not supported, but you can annotate the underlying fields by using the right-click menu on the table title area.

* Updating the multilingual description of an annotation from SuperCROSS is not supported in multilingual mode. The user supplied description will be used in preference to any translations. You can update the metadata database by other means. If translations are required, add the annotations to the **sqlite.db** file, and the translations to the metadata database.

---
version: "9.21"
language: "en"
---
# Antlr 2 License

We reserve no legal rights to the ANTLR--it is fully in the public domain. An individual or company may do whatever they wish with source code distributed with ANTLR or the code generated by ANTLR, including the incorporation of ANTLR, or its output, into commerical software.

We encourage users to develop software with ANTLR. However, we do ask that credit is given to us for developing ANTLR. By "credit", we mean that if you use ANTLR or incorporate any source code into one of your programs (commercial product, research project, or otherwise) that you acknowledge this fact somewhere in the documentation, research report, etc... If you like ANTLR and have developed a nice tool with the output, please mention that you developed it using ANTLR. In addition, we ask that the headers remain intact in our source code. As long as these guidelines are kept, we expect to continue enhancing this system and expect to make other tools available as they are completed.

---
version: "9.21"
language: "en"
---
# API Administration

As a SuperWEB2 administrator, you can control who has access to the Open Data API, and how often they are allowed to issue requests.

This section describes the administration options available to you:  
* [Install](https://docs.wingarc.com.au/superstar/9.21/install-odapi.md)
* [Restrict Access to the API](https://docs.wingarc.com.au/superstar/9.21/restrict-access-to-the-api.md)
* [Rules Engine - Open Data API](https://docs.wingarc.com.au/superstar/9.21/rules-engine-open-data-api.md)
* [Configure API Performance Settings](https://docs.wingarc.com.au/superstar/9.21/configure-api-performance-settings.md)
* [Configure the Cache](https://docs.wingarc.com.au/superstar/9.21/configure-the-cache.md)
* [Required IIS Configuration](https://docs.wingarc.com.au/superstar/9.21/required-iis-configuration.md)

## configuration.properties

The Open Data API and SuperWEB2 each have their own **configuration.properties** file that contain the same settings. You need to update both files if you also want to apply the same property settings to the Open Data API. For more information about the properties, see [**configuration.properties**](https://docs.wingarc.com.au/superstar/9.21/configuration-properties.md).  

| **Location** | **\<tomcat_home\>\\webapps\\webapi#rest#v1\\WEB-INF\\classes\\configuration.properties** |
|--------------|------------------------------------------------------------------------------------------|

---
version: "9.21"
language: "en"
---
# API Cache

The Open Data API automatically caches table, schema and authentication results, as well as any data from [metadata server](https://docs.wingarc.com.au/superstar/9.21/metadata-server.md) where applicable (such as dataset and field labels). The API will return the results from the cache rather than requerying the server where possible.

The API provides very flexible configuration options that allow you to control exactly how long data is cached for (see [Configure the Cache](https://docs.wingarc.com.au/superstar/9.21/configure-the-cache.md) for more details). In addition, the cache will automatically be cleared in situations where you make changes to datasets, saved tables, and user permissions that invalidate the current contents. For example, if you remove a user's access to a dataset entirely, then any cached results for that dataset will be cleared for the corresponding user. Similarly, changes to Field Level Security will cause any affected cached contents to be cleared.

However, you may still find you need to manually clear the cache in some cases. You can use the `/cache` endpoint to manually clear:

* The entire Open Data API cache.

* The table, schema or authentication cache for a specific user.

* The table or schema cache for a specific dataset.

* The metadata cache. You may need to clear this cache if you change the dataset, field and valueset labels in your metadata database.

## Overview

|  **Endpoint**   |                                                       `https://<server>/webapi/rest/v1/table/cache`                                                       |                                      Clear the entire table cache.                                      |
|                 |                                              `https://<server>/webapi/rest/v1/table/cache?userId=<user_id>`                                               |                              Clear the table cache for the specified user.                              |
|                 |                                           `https://<server>/webapi/rest/v1/table/cache?datasetId=<dataset_id>`                                            |                            Clear the table cache for the specified dataset.                             |
|                 |                                   `https://<server>/webapi/rest/v1/table/cache?userId=<user_id>&datasetId=<dataset_id>`                                   |                 Clear the table cache for the specified dataset for the specified user.                 |
|                 |                                                      `https://<server>/webapi/rest/v1/schema/cache`                                                       |                                     Clear the entire schema cache.                                      |
|                 |                                              `https://<server>/webapi/rest/v1/schema/cache?userId=<user_id>`                                              |                             Clear the schema cache for the specified user.                              |
|                 |                                           `https://<server>/webapi/rest/v1/schema/cache?datasetId=<dataset_id>`                                           |                            Clear the schema cache for the specified dataset.                            |
|                 |                                  `https://<server>/webapi/rest/v1/schema/cache?userId=<user_id>&datasetId=<dataset_id>`                                   |                Clear the schema cache for the specified dataset for the specified user.                 |
|                 |                                                       `https://<server>/webapi/rest/v1/auth/cache`                                                        |                                  Clear the entire authentication cache                                  |
|                 |                  `https://<server>/webapi/rest/v1/auth/cache?userId=<user_id>` `https://<server>/webapi/rest/v1/auth/cache?apiKey=<key>`                  | Clear the authentication cache for the specified user. You can either use the user ID or their API Key. |
|                 | `https://<server>/webapi/rest/v1/auth/cache?userId=<user_id1>&userId=<user_id2>` `https://<server>/webapi/rest/v1/auth/cache?apiKey=<key1>&apiKey=<key2>` |                           Clear the authentication cache for multiple users.                            |
|                 |                                                     `https://<server>/webapi/rest/v1/metadata/cache`                                                      |                                        Clear the metadata cache.                                        |
| **HTTP Method** |                                                                          DELETE                                                                           |                                                                                                         |
|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|

### Request Headers

| `APIKey` | The [API Key to use to authenticate this request](https://docs.wingarc.com.au/superstar/9.21/api-keys.md). You can obtain your API key from the **Account**page in SuperWEB2. | Required in all requests. Must be an administrator account. |
|----------|----------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------|

---
version: "9.21"
language: "en"
---
# API Keys

In order to use the API, you must first obtain an API key. This is used for authorisation and must be submitted in an `APIKey` header in every request you make to the API.

## Obtain your API Key

To get your key, login to SuperWEB2 and select the **Account** option from the menu on the top right:  
![GetAPIKeyPrefs.png](https://docs.wingarc.com.au/__attachments/a_4a2cf1d14af48d475a9b9e7bb695c1e501ca0a7875ce482d8c57d478f01def13/GetAPIKeyPrefs.png?cb=f8227d2eb158e38f1d4386de415d9736)

If you have API access, SuperWEB2 displays your key:  
![GetAPIKey.png](https://docs.wingarc.com.au/__attachments/a_814237c34bb28ae95823a9f6fe3d2ff55c1ca927b3da4aceed6e9c74ac5a4c81/GetAPIKey.png?cb=fc6e4126a425d69f9b0b3b69595b73da)

You can click **Copy** to copy the key to the clipboard, or use the **Reset** button to revoke this key and generate a new one.  
SuperWEB2 administrators can [control who has access to the API](https://docs.wingarc.com.au/superstar/9.21/restrict-access-to-the-api.md). If you do not see an API key listed on this page then this means you do not have API access. Contact your system administrator for assistance.

---
version: "9.21"
language: "en"
---
# API Practical Examples

The Open Data API can be used to integrate SuperSTAR data into your own applications and third-party tools. This section contains some practical examples to help you get started building your integrations.  
* [Open Data API: Power BI Tutorial](https://docs.wingarc.com.au/superstar/9.21/open-data-api-power-bi-tutorial.md)

---
version: "9.21"
language: "en"
---
# Application Programming Interface (API)

A programmatic interface into a software application.

An API allows developers to write their own applications that interact with the software.

---
version: "9.21"
language: "en"
---
# ASM Licence

Copyright (c) 2012 France Télécom

All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. Neither the name of the copyright holders nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

---
version: "9.21"
language: "en"
---
# attributes

The properties of objects, elements, or files. These usually consist of a name and value.

---
version: "9.21"
language: "en"
---
# Audit Logging

Audit logging is an optional SuperSTAR feature that you can use to monitor user activity.

You can activate audit logging for SuperWEB2, Job Queue Manager, SuperADMIN and SuperSERVER. These applications will then log all user activity (such as who has logged in or out of the system, the queries they ran and what features they used). The audit logs will also record details of failed login attempts.

By default, SuperSERVER is automatically configured to use audit logging, so you only need to activate it for SuperADMIN, SuperWEB2 and Job Queue Manager.  
* [Configure](https://docs.wingarc.com.au/superstar/9.21/configure.md)
* [Logged Events](https://docs.wingarc.com.au/superstar/9.21/logged-events.md)  
This section describes how to activate the feature so that SuperSTAR generates the audit log files.

Analysis of the log files is not discussed here, but there are a number of third party tools available that you can use to combine the log files from each component and analyse the results.

[Please contact us](mailto:support@spacetimeresearch.com) if you wish to discuss implementing a log analysis solution that meets your specific requirements.

---
version: "9.21"
language: "en"
---
# auth, authentication

This command controls user authentication. Use it to configure an external authentication service, such as LDAP, SAML or Active Directory.  
`auth` and `authentication` are the same command and can be used interchangeably.

## Overview

By default, SuperSTAR is configured to use the built-in local authentication service (`STRLocal`). Use the `auth` command to configure SuperADMIN to connect instead to an external authentication service such as LDAP or Active Directory.

There are three steps involved in setting up external authentication:

1. Use the `auth` command to add a new authentication service.

2. Configure the authentication service.

3. Activate the authentication service.

See below for the complete list of available commands, or see [these instructions explaining how to configure authentication to an LDAP or Active Directory server](https://docs.wingarc.com.au/superstar/9.21/active-directory-and-ldap.md) and [these instructions for configuring SAML authentication](https://docs.wingarc.com.au/superstar/9.21/saml.md).

### Usage

|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth providers`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Displays details of all the available authentication providers. * `STRLocal` is the built-in local authentication service. This will always be available to ensure that you can always login to the system regardless of whether any external service is running. It is also available so that you can complete the initial configuration. * Other available providers include Active Directory, eDirectory, SAML, and LDAP. * The `ExternalJAASModule` provider allows you to create your own JAAS (Java authentication and authorisation service) module to integrate with other types of external authentication systems. For more information, see the sample code in the **etc\\samples** directory in your installation. This sample code explains how to create a custom authentication module that can be integrated with SuperADMIN. |

|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth add <provider> <service_name>`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Creates a new authentication service based on one of the available authentication providers. |------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `<provider>`     | The name of the provider. This must exactly match the name of one of the available authentication providers (e.g. `LDAP`, `SAML`, `ActiveDirectory`, `eDirectory`, `ExternalJAASModule`). | | `<service_name>` | Your chosen name for this authentication service. You will use this name to manage and configure the service in SuperADMIN.                                                               | |

|-------------------------------------------------------------|
| `auth services`                                             |
| Displays details of all configured authentication services. |

|---------------------------------------------------------------------------------------|
| `auth <service_name>`                                                                 |
| Displays the current configuration settings for the specified authentication service. |

|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> active {true|false}`                                                                                                                                         |
| Activates (`true`) or deactivates (`false`) the specified authentication service. Use this command to activate your authentication service when you have finished configuring it. |

|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> priority <priority>`                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Sets the priority for this authentication service. Each configured service has a priority: the service with the highest priority is tried first. If the login to the service fails, the next service is tried, and so on. The built-in STRLocal service has a priority of 100, so you should set your external service to have a priority greater than 100. If you are adding multiple authentication services you can use the priority of each one to control the order in which they will be tried. |

|----------------------------------------------------------------------|
| `auth <service_name> id <new_service_name>`                          |
| Changes the name of the specified service to the new specified name. |

|-----------------------------------------------|
| `auth <service_name> remove`                  |
| Removes the specified authentication service. |

|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> adminGroup <group>`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Sets the name of the group of users who should have administrator rights in SuperADMIN. If you are using an external authentication provider this will be a group from the external server (only the group name is required; you do not need a full Distinguished Name/DN). For SAML authentication modules, when using this setting you also need to ensure that the group specified as the `adminGroup` is configured to be passed through to SuperADMIN via the `groupMapping`, either explicitly or using a wildcard (the group itself does not need to exist as a local group in SuperADMIN). |

|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> reload`                                                                                                                                                                                        |
| Reload the configuration for the specified service. Use this command to force SuperADMIN to reload the configuration if you have changed one or more of the service's settings after it has already been activated. |

### Configuring LDAP, Active Directory and eDirectory

The following commands apply to LDAP, Active Directory, and eDirectory services only.  

|------------------------------------------------------------------------------------------|
| `auth <service_name> url <url>`                                                          |
| Sets the fully qualified domain name of the LDAP, Active Directory or eDirectory server. |

|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> port <port>`                                                                                                                     |
| Sets the port to use to connect to the LDAP, Active Directory or eDirectory server. This is only required if the server is using a non-standard port. |

|------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> basedn <base>`                                                                                                                  |
| Sets the default base location for LDAP searches. This will be used to search for users or groups if they do not have an explicit `basedn` assigned. |

|---------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> group nameattr <attribute>`                                                                    |
| Sets the name of the attribute in the external authentication service that holds the descriptive name of the group. |

|------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> group idattr <attribute>`                                                                                                             |
| Sets the name of the attribute in the external authentication service that holds the unique ID of the group (the standard Active Directory value is `cn`). |

|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> group basedn <base>`                                                                                                                |
| Sets the default search location when searching for groups. This is optional. If it is not set then it will use the `basedn` configured for the service. |

|---------------------------------------------------------------------------------|
| `auth <service_name> group addbasedn <base>`                                    |
| Adds the specified `basedn` to the list stored in the group `basedn` parameter. |

|--------------------------------------------------------------------------------------|
| `auth <service_name> group removebasedn <base>`                                      |
| Removes the specified `basedn` from the list stored in the group `basedn` parameter. |

|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> group memberAttr <attribute>`                                                                                                                           |
| Sets the name of the attribute in the external authentication service that indicates which users are members of the group (the standard Active Directory value is `member`). |

|--------------------------------------------------------------------------------------|
| `auth <service_name> group groupClass <class>`                                       |
| Sets the class type that will be used to identify groups within the LDAP repository. |

|-----------------------------------------------|
| `auth <service_name> group addfilter <group>` |
| Adds the specified group to the group filter. |

|----------------------------------------------------|
| `auth <service_name> group removefilter <group>`   |
| Removes the specified group from the group filter. |

|--------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> user nameattr <attribute>`                                                                    |
| Sets the name of the attribute in the external authentication service that holds the descriptive name of the user. |

|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> user idattr <attribute>`                                                                                                                         |
| Sets the name of the attribute in the external authentication service that holds the unique ID of the user (the standard Active Directory value is `sAMAccountName`). |

|---------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> user basedn <base>`                                                                                                                |
| Sets the default search location when searching for users. This is optional. If it is not set then it will use the `basedn` configured for the service. |

|--------------------------------------------------------------------------------|
| `auth <service_name> user addbasedn <base>`                                    |
| Adds the specified `basedn` to the list stored in the user `basedn` parameter. |

|-------------------------------------------------------------------------------------|
| `auth <service_name> user removebasedn <base>`                                      |
| Removes the specified `basedn` from the list stored in the user `basedn` parameter. |

|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> user groupAttr <attribute>`                                                                                                                               |
| Sets the name of the attribute in the external authentication service that indicates which groups the user is a member of (the standard Active Directory value is `memberOf`). |

|------------------------------------------------------------------------------------------|
| `auth <service_name> user userClass <class>`                                             |
| Sets the class type that will be used to identify groups within the external repository. |

|--------------------------------------------------------------------------------------------|
| `auth <service_name> contextlogin {true|false} `                                           |
| Enables or disables the use of a search login user, to find an initial context for logins. |

|-----------------------------------------------------------------------------------------------------------------|
| `auth <service_name> contextlogin password <password>`                                                          |
| Sets the password to use for the context login. This setting only applies when `contextlogin` is set to `true`. |

|----------------------------------------------------------------------------------------------------|
| `auth <service_name> contextlogin userdn <dn>`                                                     |
| Sets the DN for the context login. This setting only applies when `contextlogin` is set to `true`. |

|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> qualifieduser {true|false}`                                                                                                                                                                                                                                                                     |
| Specifies whether the name entered when a user is attempting to login is a fully qualified DN or a name that must be matched against the `idattr` set for user accounts. You are recommended to leave this set to `false` to allow users to login using their normal login credentials rather than the full LDAP DN. |

### Configuring ExternalJAASModule

The following commands apply to services using the ExternalJAASModule only.  

|-----------------------------------------------------------------------|
| `auth <service_name> groupprincipalclass <fully_qualified_classname>` |
| Sets the custom JAAS principal that stores the group name.            |

|----------------------------------------------------------------------|
| `auth <service_name> userprincipalclass <fully_qualified_classname>` |
| Sets the custom JAAS principal that stores the user name.            |

|--------------------------------------------------------------------|
| `auth <service_name> loginmoduleclass <fully_qualified_classname>` |
| Sets the custom login class that implements JAAS Login module.     |

|-----------------------------------------------------------------------------|
| `auth <service_name> pluginImplementationClass <fully_qualified_classname>` |
| Sets the implementation class for the AuthPlugin interface.                 |

|---------------------------------------------------------|
| `auth <service_name> addparameter <param_name> <value>` |
| Adds a custom parameter.                                |

|----------------------------------------------------|
| `auth <service_name> removeparameter <param_name>` |
| Removes the specified custom parameter.            |

### Configuring SAML

The following commands apply to services using SAML authentication only. See [SAML](https://docs.wingarc.com.au/superstar/9.21/saml.md) for more details on each setting, and examples.  

|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> identityProviderMetadataPath <url_or_file_path>`                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Replace `<url_or_file_path>` with the location of the metadata file supplied by the identity provider, enclosed in double quotes. In most cases this will be a URL, but can also be a file path to a local file (starting with `file://`) in cases where the SAML identity provider supplies a file for download and local hosting, rather than a direct link. For example: `auth saml_keycloak identityProviderMetadataPath "https://example.com/realms/master/protocol/saml/descriptor"` |

|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> entityId <entity_ID>`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| A unique identifier for this entity to be configured on the SAML identity provider, enclosed in double quotes. In most cases you should follow these [general best practice guidelines](https://spaces.at.internet2.edu/display/federation/saml-metadata-entityid) for creating an entity ID. If the SAML identity provider is only used internally then you may have your own entity ID format, in which case you should use that instead (if the identity provider is only used for this service, then the entity ID can use any format you wish). |

|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> callbackUrl <callback_url>`                                                                                                                                                                                                                                                                                                                                                                                             |
| The URL that the user will be redirected to after successful login via the SAML identity provider. Set this to the full URL of your SuperWEB2 instance, followed by `rest/saml/login` and enclosed in double quotes. For example, if your SuperWEB2 server is available at https://myserver.com/webapi/ then the callback URL would be configured as follows: `auth saml_keycloak callbackUrl "https://myserver.com/webapi/rest/saml/login"` |

|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> groupAttribute <attribute>`                                                                                                                                                                                                                                                                                                                                                    |
| The type of attribute used on the SAML identity provider for managing collections of permissions, enclosed in double quotes. This will typically be either `Role` or `Group`. For example: `auth saml_keycloak groupAttribute "Role"` In the next section, you will use the `groupMapping` parameter to configure how these roles or groups should be mapped to local groups defined in SuperADMIN. |

|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> groupDelimiter <attribute>`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| **(Optional).** A delimiter used to split the `attributeValues` string in the `SAMLAttribute` returned from the SAML identity provider, enclosed in double quotes. If you choose to specify a delimiter, then the string in the SAML ticket will be split into individual groups using the delimiter character. For example, if the SAML ticket contains the following value: `attributeValues=[public|registered|census]` Then you can split this into the individual groups `public`, `registered`, and `census` by setting the delimiter to `|`. For example: `auth saml_keycloak groupDelimiter "|"` |

|                                                                                                                                                             `auth <service_name> authnRequestBindingType <type>`                                                                                                                                                              |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **(Optional).** Use a specific binding type (`redirect` or `post`) on the identity provider. If the specified binding is not supported, it will fall back to the supported binding. If not specified, defaults to `post`. Supported values: * `post` or `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST` * `redirect` or `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect` |

|                                                                                                                                                                             `auth <service_name> nameIdFormat <format>`                                                                                                                                                                             |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **(Optional).** The attribute to use as the name ID (unique ID for the user). You will need to ensure you have configured the identity provider accordingly for whatever value you set in SuperADMIN. If not specified, defaults to `urn:oasis:names:tc:SAML:1.1:nameid-format:persistent`. For example: `auth saml_keycloak nameIdFormat "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"` |

|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `auth <service_name> groupMapping <mapping>`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| A mapping between the roles or groups on the identity provider and the corresponding local groups defined in SuperADMIN. These mappings *can*be based on information provided by the identity provider, but you should take care about how explicitly you configure the mappings, depending on how much you trust or control the identity provider. If you have not already done so, you will need to use the SuperADMIN console to create local groups as appropriate and define permissions for those groups. Configure the mappings in the form: `"<remote_group>=<local_group>"` * Replace `<remote_group>` with the name of the role or group on the SAML identity provider. * Replace `<local_group>` with the local SuperADMIN group you want to map it to. * Separate each mapping with a semi colon. * Enclose the complete mapping definition in double quotes. You can use the wildcard `*` on the left side to represent all roles or groups and `_` on the right side to map a remote role or group to a group of the same name in SuperADMIN. Following are some examples in order of safety: **Map All Users to a Specific SuperADMIN Group** For example: `"*=keycloak_users"` This will map all users who are authenticated through this identity provider (including users who are not part of any group) to a SuperADMIN group named `keycloak_users`. This is the safest mapping as the identity provider has no control over the groups that users are assigned to. **Map Specific Groups/Roles to Specific SuperADMIN Groups** For example: `"subscribers=keycloak_subscribers;guests=_"` This will map: * All users with the `subscribers` group attribute to a SuperADMIN group named `keycloak_subscribers`. * All users with the `guests` group attribute to a SuperADMIN group named `guests`. This type of mapping is reasonably safe even if you do not fully trust or control the identity provider as it only applies to specific groups that you explicitly define. You should be careful about mapping any groups to SuperADMIN's `administrators` group (including via use of the `_` wildcard), as this would allow the identity provider to designate users as SuperSTAR administrators. **Pass Through all Groups/Roles Unchanged** `"*=_"` This will map all groups or roles on the identity provider to the corresponding SuperADMIN groups of the same name. This should only ever be used if you fully trust or control the identity provider. |

|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         `auth <service_name> adminGroup <group>`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **(Optional).** A group of users from the identity provider who should have administrator-level permissions in SuperWEB2. If you choose to specify this setting, you must also ensure that the group is passed through to SuperADMIN using the `groupMapping`. It can either be explicitly mapped, or passed through using a wildcard (the group itself does not need to exist as a local group in SuperADMIN). If you do not set a value for `adminGroup` in your authentication module, it will be added automatically and set to `administrators` by default. This default setting will not take effect unless you also configure the `groupMapping` to pass through the `administrators` group. Note that as SAML authentication is currently supported only for SuperWEB2 connections, the effect of designating users as administrators is currently limited to those users having access to all datasets in SuperWEB2. They will not be able to log in to the SuperADMIN console via the SAML-authenticated users. |

|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 `auth <service_name> displayNameAttribute <attribute>` `auth <service_name> enableDisplayName {true|false}`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **(Optional).** The attribute from the identity provider to use as the display name for the user. For example: auth saml_keycloak displayNameAttribute "displayName" The display name appears in the logout option on the menu in the top-right of SuperWEB2. By default, SuperWEB2 will attempt to use the display name attribute sent by the identity provider. In most cases this will work automatically and you will not need to set a value for `displayNameAttribute` in your authentication module. However, if you want to use a different attribute to the default (or the default does not work for your provider), set `displayNameAttribute` to the name of the attribute you want to use. You do not need to set the `enableDisplayName` property unless you want to stop using display names completely: if you set `enableDisplayName` to `false` SuperWEB2 will use the configured name ID instead. You can revert back to using display names by setting the value of `enableDisplayName` to `true`. You should avoid changing the display name settings after going into production with SAML authentication as future changes to this setting will affect the ability of users to access their previously saved tables. |

---
version: "9.21"
language: "en"
---
# Automate Search Index Updates

If you add or remove a dataset from SuperSERVER, you will need to update the search index to keep it in sync.

If you regularly make changes to the catalogue, you may want to consider setting up your deployment to automatically update the search index.

This section describes one option for automating search index updates: creating a batch file that automatically exports the current catalogue and executes the indexing script. Once this is set up you can configure it to run at regular intervals.

## Step 1 - Create a Macro File

The first step is to create a SuperADMIN macro file that will generate a list of all the datasets on the server.

1. Create a text file called **createdatabaselist.sam**

2. Open the file in a text editor and add the following commands:

   **createdatabaselist.sam**

       login user1 user1
       createdatabaselist "C:\ProgramData\STR\SuperSERVER SA\" localhost "C:\ProgramData\STR\SuperADMIN\MetaData\MetaDataUtilities\databases.txt" true
       logout
       quit

   This macro logs in to SuperADMIN and generates a list of all the datasets in the catalogue.

   You will need to replace the username and password on the first line with the username and password of an administrator user on your deployment.

   You may also need to change some of the arguments to the `createdatabaselist` command. In particular:
   * The first argument (`C:\ProgramData\STR\SuperSERVER SA\`) is the prefix to be added to any relative paths. It should be set to the SuperSERVER program data directory. If SuperSERVER is not installed to the default location then you will need to change this.

   * The third argument (`C:\ProgramData\STR\SuperADMIN\MetaData\MetaDataUtilities\databases.txt`) is the location where the list file will be created. You will most likely want to save this file to the same directory as the search indexing script.

   See [the documentation for the createdatabaselist command](https://docs.wingarc.com.au/superstar/9.21/createdatabaselist.md) for more information about these options.
3. Save your completed macro file to the SuperADMIN **macros** directory. By default, this is **C:\\ProgramData\\STR\\SuperADMIN\\console\\macros**

### Step 2 - Create AutoIndex.bat

The next step is to create a text file called **AutoIndex.bat** and save this to the same directory as the search indexing scripts. By default, this is **C:\\ProgramData\\STR\\SuperADMIN\\MetaData\\MetaDataUtilities**

Open **AutoIndex.bat** in a text editor and paste in the following contents:

#### **AutoIndex.bat**

    @echo off 
    REM This is an automation utility for creating index files used by SuperADMINs 
    REM search functionality script can be run as a scheduled task 
    REM This is suitable for the most common deployment of SuperADMIN server and 
    REM SuperSERVER on a single host. 
    REM configure the directory where SA Console is installed 
    SET SA_CONSOLE_INSTALL_FOLDER=%programdata%\STR\SuperADMIN\console
    REM create a macro that logs in as an administrative user and creates a list of datasets. 
    REM Read help on the command "createdatabaselist" for more information on how to create a databaselist 
    REM Configure the name of the macro file to create a list of dataseys
    REM Make sure this macro exists in the directory defined for storing macros 
    SET MACRO_TO_CREATEDATABASELIST=createdatabaselist.sam 
    echo Creating datasey list... 
    call %SA_CONSOLE_INSTALL_FOLDER%\Console.bat "-Dmacro=createdatabaselist.sam">autoindex.log
    type autoindex.log | find "logged in" > NUL
    if errorlevel 1 goto ERROR 
    :BUILDINDEX 
    echo Building index ... 
    call BuildSXV4SearchIndex.bat 
    GOTO SUCCESS
    :ERROR echo Check if SA console is installed in %SA_CONSOLE_INSTALL_FOLDER% 
    GOTO END 
    :SUCCESS 
    echo Search Index file created 
    :END 
    del autoindex.log 

You may need to make some changes to this file:

* If you have installed SuperADMIN to a non standard location, you will need to update the definition of `SA_CONSOLE_INSTALL_FOLDER` (line 7) to point to the directory where the SuperADMIN **Console.bat** script is located on your system.

* If the name of the macro file you just created is not **createdatabaselist.sam** then you will need to change the definition of `MACRO_TO_CREATEDATABASELIST` (line 12) to match whatever you called your macro file.

* If you have multilingual datasets on your system you will need to change line 19 from `call BuildSXV4SearchIndex.bat` to `call BuildMetadataSearchIndex.bat` (you will also need to make sure you have [configured the required settings in the **BuildMetadataSearchIndex.bat** script](https://docs.wingarc.com.au/superstar/9.21/update-the-search-index-for-multilingual-datasets.md)).

Once you have finished creating **AutoIndex.bat**, it is a good idea to run the batch file to check it runs correctly and updates the search index. If there are any errors displayed, check your settings and try again.

### Step 3 - Set up a Scheduled Task

The final step is to create a scheduled task and configure it to execute **AutoIndex.bat** at your preferred interval.

In Windows, you can create a scheduled task from **Control Panel \> System and Security \> Administrative Tools \> Schedule Tasks**.

---
version: "9.21"
language: "en"
---
# Automatically Expand the Fields when Selecting All

By default, when you use the **Select all at level** option in SuperWEB2, the field does not automatically expand to show the selected values:  
![image-20250902-060155.png](https://docs.wingarc.com.au/__attachments/a_be59006a243ffd3d06e4a2e128007771fc6a6330476890e931d6b346540451d1/image-20250902-060155.png?cb=072f9a2eaa42e1d1312767296047ace4)

To view the selected values, you have to manually expand the field by clicking the folder to the left of the field name.

If you prefer, you can configure SuperWEB2 so that fields automatically expand to show the selected values when you use the **Select all at level** option:  
![image-20250902-060249.png](https://docs.wingarc.com.au/__attachments/a_3cb0af5750888096794584367965cc3d1e097aafc10eed30d665088b0f5efbf4/image-20250902-060249.png?cb=0f863dd2f867275c33c7bafacdadab70)

To make this change, you need to edit the file **\<tomcat_home\>\\webapps\\webapi\\WEB-INF\\classes\\configuration.properties**  
Make a backup copy of this file before making any changes.

1. Open **configuration.properties** in a text editor.

2. Locate the following section:

       schemaTree.expandOnSelection=

3. Set the value to **true**:

       schemaTree.expandOnSelection=true

4. Save your changes.

5. Restart Tomcat (or the SuperWEB2 Service).

6. Log in to SuperWEB2 and use the **Select all at level** option on a field to verify that it automatically expands.

---
version: "9.21"
language: "en"
---
# Automatically Generate R Keys for Perturbation

If you want to use the Perturbation feature to confidentialise your data, then you need to have R Keys in your unit records. SuperCHANNEL can generate the R Keys automatically when it creates your SXV4.  
In some cases, you are recommended to generate the R Keys yourself in the unit records. See [How It Works](https://docs.wingarc.com.au/superstar/9.21/how-it-works.md) for more details about the situations where the automatic functionality can be safely used.

To enable this feature:

1. In the **Target View**, select the very top item (the database):

   ![SC-RKEYS-Select-Database.png](https://docs.wingarc.com.au/__attachments/a_8f15ba8048efd0eddfda2033cbd8475351e96b42f2b066fb0adc7b6fe11f94d8/SC-RKEYS-Select-Database.png?cb=8aa6241a36b24cb2d55ada96e5994303)
2. In the toolbar, click the **Attributes** icon to display the **Target Attributes** pane on the left.

3. Select the **Generate Rkey Automatically** check box.

   ![SC-RKEYS-Generate-Rkeys-Automatically.png](https://docs.wingarc.com.au/__attachments/a_909fad7923fb06d6cb2287282cc9d2b6f879dd32f7b918c9b91f054479277296/SC-RKEYS-Generate-Rkeys-Automatically.png?cb=dfc80d0f56af59257a291af2bf520090)

Now that you have enabled the feature, you need to edit the **Rkey Generation** settings for each of your fact tables.

For each fact table in your database, do the following:

1. In the **Target View**, select the fact table.

2. In the **Target Attributes** pane, enter values for the two new options that are now available: **Rkey Seed** and **Rkey Generator**:

   ![SC-RKEYS-Rkey-Settings.png](https://docs.wingarc.com.au/__attachments/a_f9721899c80a51fa900cb45352a245ec0c980c4fbaad080d57de422a025d2caf/SC-RKEYS-Rkey-Settings.png?cb=09547be05ac94bb7342d3a30bf12d49b)
   * **Rkey Seed** is the seed value to use when generating the R Keys.

   * **Rkey Generator** is the module used to generate the R Keys. If you want to use the generator supplied with SuperCHANNEL, set this to `str.database.rkey.SecureRandomRkeyGenerator`. Alternatively, you can provide your own generator. See [Using a Custom R Key Generator](https://docs.wingarc.com.au/superstar/9.21/using-a-custom-r-key-generator.md) for more details on this option.

3. Repeat these steps for any other fact tables in your database.

It is also possible to configure the R Key settings in your registry tables. See [FACTS](https://docs.wingarc.com.au/superstar/9.21/facts.md) for details.

---
version: "9.21"
language: "en"
---
# Automation and SuperADMIN

SuperADMIN includes macro functionality. You can use this to automate repetitive tasks.

## Creating a Macro File

There are two options:

* Use [the macro command](https://docs.wingarc.com.au/superstar/9.21/macro.md) in SuperADMIN to record a series of commands to a macro file.

* Create the macro file in a text editor. Make sure you save the file in the macros directory and use the file extension **.sam**.

Macros are stored in the SuperADMIN **console\\macros** directory. In a default installation the macros directory is: **C:\\ProgramData\\STR\\SuperADMIN\\console\\macros**

See [the macro command reference](https://docs.wingarc.com.au/superstar/9.21/macro.md) for more details about how to create a macro file.

### Comments in Macro Files

You can add comments in your macro files for readability and maintainability. There are two ways to include a comment:

* Type a # character at the start of the line: the line will not be treated as a command, but the remainder of the text on the line will be output to the SuperADMIN console and any logs.

* Type a semi colon at the start of the line. The line will be ignored and will not be output to the console.

For example, suppose you have the following lines in a macro file:

    # This comment will be output to the console and logs
    ; This comment appears in the macro file but will not be output

This would be executed in SuperADMIN as follows:

    > macro play MyMacro
     This comment will be output to the console and logs
    >

You can also use blank lines in your macro file, for readability. These will be ignored when the macro is executed.

### Macros Calling Macros

You can use the `macro play <name>` command inside a macro to call another macro file. When the embedded macro completes execution, control passes back to the initial macro, which then continues to execute. It is not possible to pass parameters from one macro to another.

### Playing a Macro File

Once you have created your macro file, you can play it back in the SuperADMIN console. SuperADMIN will execute each command as if you had typed them manually.

Use the following command (replace `<name>` with the name of the macro file you want to play):

    macro play <name>

### Automating SuperADMIN

The SuperADMIN console also has a command line option you can use to play a macro file at startup. This allows you to fully automate SuperADMIN tasks.

To run SuperADMIN and execute a macro file, use the following command line option (replace `<name>` with the filename of the macro file you want to play; you do not need to include the **.sam** filename extension):

    console.bat "-Dmacro=<name>"

For example:

    C:\ProgramData\STR\SuperADMIN\console>console.bat "-Dmacro=superadmin-automation-macro" 

### Managing Logins When Automating SuperADMIN

If you are running macros using the above command line option, then you will need to ensure that your macro includes the commands to log in and out of SuperADMIN.

The recommended approach when programmatically generating macro files is to use [the loginToken command](https://docs.wingarc.com.au/superstar/9.21/logintoken.md). With this command, your macro can use a single-use token, rather than a username and password. As this token can only be used once, there is minimal risk to including it in the macro file on disk as it will be of no use once the macro has used the token.

SuperADMIN exposes a REST endpoint on port 9000 at `/v1/auth/login` that your code can query to obtain a token before each macro run. For example, when connected directly to the machine running SuperADMIN, the endpoint will be available at <http://localhost:9000/v1/auth/login>  
Port 9000 needs to be internally accessible to the SuperSTAR components, but must not be externally accessible. See [the SuperSTAR port usage recommendations](https://docs.wingarc.com.au/superstar/9.21/port-usage.md) for further details.

Therefore, to use the `loginToken` command in a macro, your code should:

1. Send a GET request to the `login` endpoint with the username and password passed via HTTP basic auth.

2. Extract the value of `refreshToken` from the response.

3. Write a `loginToken` command to your macro file in the following format (replacing `<token>` with the value of `refreshToken` returned by the endpoint):

       loginToken <token>

4. Run the macro using the command line option shown above.

The tokens themselves have a limited lifespan. By default, the refresh token lifespan is set to 1 hour after they were generated (see [Security](https://docs.wingarc.com.au/superstar/9.21/security.md) for more details), so you will typically need to generate a token around the time you are running the macro. The response from the `login` endpoint also contains a `refreshTokenExpiry` value, which is a UNIX timestamp indicating the exact time when the provided token will expire.

By design, these tokens can only be used for a single login, so you will need to generate a new token every time you need to run the macro.

You are not recommended to use the `login` command in macro files, as this requires you to include the username and password of the user running the macro in plaintext, which is a potential security risk. However, should you choose to do this, then you will need to use the short form of the `login` command to automate the process (`login <username> <password>`), otherwise the SuperADMIN console will pause and prompt for the login credentials before completing the macro commands.

---
version: "9.21"
language: "en"
---
# axis

One of three dimensions in a SuperCROSS or SuperWEB2 table (row, column, and wafer/layer).

---
version: "9.21"
language: "en"
---
# axis derivation

An axis derivation is an arithmetic expression that can use axis items from a specific axis in a table as variables. Axis derivations could be percentages, sums, subtotals and other such expressions. An axis derivation differs from a field derivation because you can access any item in the axis, not just an item from the relevant field.

---
version: "9.21"
language: "en"
---
# axis item

An axis item is an individual row, column, or wafer item not necessarily related to a specific field. For example, a row representing males aged 50 could be an axis item.

---
version: "9.21"
language: "en"
---
# axis reference item

Any axis item can be manually set as the axis reference item.

You can have multiple axis reference items in a table, but only one per axis (row, column, or wafer). By default, the axis reference item will be either the first or last in the list depending on the setting configured in SuperCROSS under **Edit \> Options \> Totals \> Recode Total**.

---
version: "9.21"
language: "en"
---
# AxisMapEntry

|                                                                                                                                                                                                                                                                                                                                                                                                                                                         |||   **SuperCROSS**   ||                                **Production System**                                 |                                         **SuperWEB2**                                          ||
|    **Element**     |                                                    **Format**                                                    |                                                                                                                                                  **Description**                                                                                                                                                  | **Save** | **Load** |                                       **Load**                                       | **Save** |                                       **Load**                                       |
|--------------------|------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|----------|--------------------------------------------------------------------------------------|----------|--------------------------------------------------------------------------------------|
| AxisMapEntry       | ***AxisMapEntryDefine AxisMapBody AxisMapEnd***                                                                  | AxisMap is ignored if the axis is in large axis mode.                                                                                                                                                                                                                                                             |          |          |                                                                                      |          |                                                                                      |
| AxisMapEntryDefine | **'AXIS_MAP'**                                                                                                   |                                                                                                                                                                                                                                                                                                                   | Yes      | Yes      | Yes                                                                                  | Yes      | Yes                                                                                  |
| AxisMapBody        | **{** ***OrderEntry*** **} {(** ***AxisMapInsert*** **)\*} {(** ***AxisMapHide*** **)\*} {** ***RefItem*** **}** |                                                                                                                                                                                                                                                                                                                   |          |          |                                                                                      |          |                                                                                      |
| Inserts            | **'INSERT' (AxisItem) ('BEFORE' \| 'AFTER') ( AxisItem)**                                                        | * AxisItem(1) -- Indicates the axis item to move. * AxisItem(2) -- Indicates the axis item to insert AxisItem(1) before or after.                                                                                                                                                                                 | Yes      | Yes      | Ignored                                                                              | No       | Ignored                                                                              |
| AxisItem           | **FieldItem {('' FieldItem)+}**                                                                                  |                                                                                                                                                                                                                                                                                                                   | Yes      | Yes      | Yes                                                                                  | No       | No                                                                                   |
| FieldItem          | ***IdentifierString*** ***AnyChar*** ***PositiveInteger***                                                       | * IdentifierString -- Name of an item within a field. * AnyChar -- Is the char specified in RecodeEscapeChar. * PositiveInteger -- Indicates the occurrence of this item. This is used when there are multiple items within a table with the same name. This number indicates which occurrence of the item it is. | Yes      | Yes      | Yes                                                                                  | No       | No                                                                                   |
| Hides              | **'HIDE' (AxisItem)**                                                                                            | AxisItem -- Indicates the axis item to hide.                                                                                                                                                                                                                                                                      | Yes      | Yes      | Incorrect results. Duplicate items appear within the field that has the hidden item. | No       | Incorrect results. Duplicate items appear within the field that has the hidden item. |
| RefItem            | **'REFITEM' (AxisItem)**                                                                                         |                                                                                                                                                                                                                                                                                                                   | Yes      | Yes      | Yes                                                                                  | No       | Yes                                                                                  |
| AxisMapEnd         | **'END AXIS_MAP'**                                                                                               |                                                                                                                                                                                                                                                                                                                   | Yes      | Yes      | Yes                                                                                  | Yes      | Yes                                                                                  |

---
version: "9.21"
language: "en"
---
# B

* [bivariate statistic](https://docs.wingarc.com.au/superstar/9.21/bivariate-statistic.md)
* [branched hierarchy](https://docs.wingarc.com.au/superstar/9.21/branched-hierarchy.md)

[Next Page](https://docs.wingarc.com.au/llms-full.txt/1)
