Learn how end users can take application management into their own hands using the new and improved Software Portal included in Altiris Client Management Suite 7.0. With the ability to tie into the Software Management Framework, the portal is more configurable and versatile in serving your end user's software needs.

Note: This article covers information presented at ManageFusion Las Vegas 2009

Introduction

The Software Portal in Software Management Solution 7.0 allows End-users access to initiate installs or make requests for software from a user-friendly interface. This allows users to:

• Install required software without IT interaction
• Request software for those applications where limited licensing exists
• See what software is recommended for them
• Request Software not listed within the Software Portal
• Request a Managed Delivery for application state management
• Request software for any system they log onto

In this article I'll cover the following topics:

1. Introduction to the Portal
   1. Improvements over the 6.x Software Portal
   2. The Portal Interface
2. Configuring the Software Portal
   1. Software Portal Agent
   2. Software Portal Settings
   3. Administrator Portal
3. Software Components and Managed Deliveries
   1. Software Components
   2. Managed Deliveries
4. Publishing to the Software Portal
   1. Adding a user or group to the Software Portal
   2. Managing Groups for targeted Publishing
5. Software Publishing Security
   1. Scope Security

Introduction to the Portal

What is the Software Portal? For those familiar with the Software Delivery 6.x Software Portal, what improvements have been made? What does the Software Portal look like and how does it operate?

What is the Software Portal?

The Software Portal is a web-driven interface End-users within the environment can automatically install software or request software. The portal is tied to a user's Domain User, showing only what software is available based on security assignments to that user and the groups they belong to. This allows administrators to control what users can install from the portal, all configured at the back end. For that software that requires tight control, the portal also provides the option to show software available by request. The request can then be answered by an administrator as approved of denied.

Improvements over the 6.x Software Portal

The 6.x Software Portal had limitations. The Portal was by far the top mechanism for feature requests submitted by administrators and users. This list details the improvements made in Software Management Solution 7.0:

• Ajax controls to bypass the need to install an ActiveX for the Software Portal to function.
• The ability to request unlisted software with a convenient informational interface.
• Software recommended for the user will automatically appear in the portal based off that user's Domain User account.
• Faster load times for environments with greater amounts of software available in the portal.
• A streamlined redesigned interface.
• Ability to customize certain features of the Portal, including adding a company logo.

Software Portal Interface

The Portal provides an intuitive interface. See this screenshot for an example of the Software Portal:

Click to view.

The software already listed when first loading the portal is considered Recommended for the user. Note the following concerning the controls of the Portal:

1. The list under the Request Software section can be multi-selected using Shift and Ctrl.
2. Click Request Software to request the selected software from the list below. The following window will appear:
   

   Click to view.

   NOTE: If a listed entry does not contain a command-line, the following message is displayed:
   You cannot request this software now. Contact your administrator.

3. The Request Unlisted Software provides an interface for users to make an informational request for software not listed in the Software Portal. The form includes a Date required setting as shown in this screenshot:
   

   Click to view.

4. There are two view options:
   1. Recommended Software (Default)
   2. Show All Software - Use the button that toggles between Show All and Show Recommended to switch the view.
5. The Request status section will list any software that has been requested and its request status.
6. The User Profile section appears whenever a user first accesses the Software Portal and all required fields must be entered before the Save changes button can be pressed. Once saved it moves to the Home page. See this screenshot for an example:
   
   

   Click to view.

7. If the logged on user is an Administrator, another option shows up next to Home and User Profile: Manage. This allows Administrators to service Software Portal Requests that they are in charge of addressing.

   NOTE: This is the same as the Administrator Portal covered in the Configuring the Software Portal section.

Configuring the Software Portal

To use the Portal you need to have the Altiris Agent and the Software Portal Agent. You also need to have the Software Portal Settings correctly configured for you environment. Use the following two procedures to setup the Software Portal for general use.

Software Portal Agent

Unlike other Altiris Agent Plug-ins, the Software Portal install is configured outside of the Plug-in area. The options for where the Software Portal Links are seen on managed systems are selected at the time of the deployment of the Portal Agent. Follow these steps to configure the links and rollout the Software Portal Agent:

1. In the Symantec Management Console, browse to Settings > All Settings > and browse down through Software > Software Portal Settings > and select Software Portal Agent Installation.
2. Check the options under "Configure Links" for where you want the Software Portal link to appear, from the choices:
   • Show link for Software Portal on Desktop
   • Show link for Software Portal in Start Menu
   • Show link for Software Portal in Altiris Agent's context menu
3. By default no Targets are selected. It is recommended to roll this out to all Managed systems. One intelligent method is detailed here:
   1. Under the Select Destination section, click Apply to and choose Computers.
   2. Click the Add rule button on the resulting window.
   3. Next the THEN:, choose exclude computers not in from the first dropdown.
   4. Select Filter from the second dropdown.
   5. Type 'All Windows Computers with Software' into the field, and click the dropdown.
   6. Select the option 'All Windows Computers with Software Management Solution Agent Installed'.
   7. In the window below you'll see the matching computers.
   8. Click OK and the selection will be saved.
4. Apply a Schedule to roll this out. See this screenshot for an example:
   

   Click to view.

5. Click Save changes to finish

Software Portal Settings

The Software Portal settings provide some important features. Control how many software objects can be requested at any one time, and customize the Software Portal UI. Access these in the Symantec Management Console, browse to Settings > All Settings > and browse down through Software > Software Portal Settings > and select Software Portal Settings.

Under Flow Settings you'll see the option: Maximum number of open requests per user: [3]. Three is the default, but this can be changed to meet the requirements of your environment.

Under the UI Settings section you are given the options to brand the Software Portal. Copy a company logo to the Notification Server, and then use the Browse button to select that icon. This will brand the Software Portal with your unique logo. You are also provided a field to type in the company name which will be prominently displayed in the Software Portal.

Administrator Portal

This allows Administrators to service Software Portal Request that require approval. When the interface is loaded, the user who accessed it will see outstanding requests listed. See this screenshot for an example:

Click to view.

Recall that this same interface is available by having the same administrator access the Software Portal and click on the Manage tab. To service a request, follow these steps:

1. In the Symantec Management Console browse under Settings > All Settings > Software > Software portal Settings, and select Administrator Portal.
2. Use the filtering options if needed to change what is shown in the Portal.
3. Under the Requested Software field select the request you wish to fulfill.
4. Click Edit if you wish to add a comment or review the Request History, as shown in this screenshot:
   

   Click to view.

5. Set a status by using the Edit function detailed above, or by selecting the request in the Portal grid and using the Change Status bar to set the status.
6. A dialog will appear with the option to put in comments for the action selected. Click OK to initiate the given action.

This raises the question: How does a user request know what Administrator the request should be routed to? This is configured in the User Profile for an administrator. Unlike normal users, administrators have an additional section labeled Add Users: where administrators can add any users that report to them, as shown:

Click to view.

This isn't simply an employee-manager relationship, but specifically relates to what users need your approval for deployment Software.

Software Components and Managed Deliveries

The two basic object types that can be published to the portal are Software Components and Managed Deliveries. These two items are different and it's important to understand the difference between the two.

Software Components

Software components are one of three types of software management, namely:

1. Software Release - A Software release normally represents the base or regular install for an application.
2. Service Pack - A Service Pack typically provides major updates to a Software Release.
3. Software Update - A Software Update is usually a single point-fix or feature correction for a Software Release.

The following information applies to all types of Software Components:

Software Components can contain multiple packages and command-lines. If a component has more than one command-line, one of the command-lines needs to be set as the default in order for this software component to be a valid request. See this screenshot for an illustration for this:

Click to view.

Most Command types in the Command Line configuration allows the option to be checked. However for migrated packages from 6.x promoted to Software components in 7.0 the default option is Custom. Administrators can also set this type for command-lines that don't explicitly meet the labels available as install or uninstall, etc. Custom does not allow publishing to the software portal unless the command line is the only one available in the Software Resource.

The message you receive if more than one command-line exists and none of them are default is:
You cannot request this software now. Contact your administrator.

Rules only apply to Managed Delivery Jobs so any Rules defined under the Rule tab of a Software Component, regardless of the type, is not used. If you wish to use the Rules, create a Managed Delivery Job that utilizes the Software Component.

Managed Deliveries

Unlike a Software Component, a Managed Delivery represents a set of rules for actively managing software. Rules configured in Software Component apply to software components selected to be part of the Managed Delivery Job. Managed Deliveries are like Sequential Tasks, only much more powerful and intelligent, whereas Sequential Tasks offered little or no intelligence when deployment Software.

Managed Tasks are access in the Symantec Management Console under Manage > Policies > Software > Managed Software Delivery. See this screenshot for an example:

Click to view.

It is recommended to test a Managed Delivery before you publish it to the Software Portal. Because of the potential complexities involved, untested Managed Deliveries may show up correctly on the Portal but fail to function due to configuration issues.

Unlike Software Components, Managed Deliveries are not a one-time Task rollout. Once requested, the Managed Delivery Job/Policy will reside locally on the computer, ensuring that the software being managed to installed correctly. Note the following about typical Managed Deliveries:

• If the managed software is uninstalled later, a validation rule will invoke a reinstall task
• If the managed software becomes corrupt, a validation rule will invoke a repair on the software
• More than one piece of software can be included in a Managed Delivery, for example:
  • Microsoft Office 2007 Professional - Software Release
  • Microsoft Office 2007 SP1 - Service Pack
  • Additional Updates - Software Update

Publishing to the Software Portal

To publish software to the Software Portal, you need to work with Portal Security. As previously explained what shows in a user's Software Portal based solely on their account. Below find how to publish software, whether components or Managed Deliveries, to the Portal, and examine some best practices for how to use Groups to manage your Software Portal.

Adding a single user or group to the Software Portal

The following process illustrates how to add a user or group to the Software Portal:

1. In the Symantec Management Console browse in Manage > Software > Software Catalog > Deliverable Software.
2. Select the Software Resource in question (whether a Software Release, Software Update, or Service Pack) and click the edit icon.
3. In the resulting window, click on the Software Publishing tab.
4. Check the option Publish to the Software Portal.
5. It is recommended to update the Software Name field to something users will be able to understand. Also use the Description field to expound on what the software does. See this screenshot for an example:
   

   Click to view.

6. Click the Add User icon.
7. Enter search criteria. Note that this can be either groups or users.
8. Click Search and select the desired user or group from the list.
9. Click OK to save the selection.
10. Highlight the new user or group and configure the settings to the right.
    1. Select Approved or Requires Approval.
    2. Check the Recommended option if you want this software to show up listed in the portal when the user or users in the group access the Portal.

       NOTE: Overuse of this option will affect the load time of the Portal and render its usefulness ineffective.

    3. See more details under Scope Security.
11. Click Save Changes to finish.

Managing Groups for Targeted Publishing

Configuring each End-user would be extremely time-consuming. Normally only specific individuals such as executive management or IT administrators may require specific entries. Otherwise local or domain-level security groups can be utilized to simplify the configuration of the Software Portal. When a user accesses the portal, all of that user's security contexts are passed to the NS for processing, including any groups they belong to. For proper maintenance, note the following:

• AD Organization required to be updated and current
• Correct assignments of auxiliary groups that may be granted access to Software
• Removal of users when switching organizations or leaving the company to remove access to company licensed software

To illustrate this point please reference the following table:

Note the following when viewing this table:

• The AD Groups can be added as objects under the Software Publishing tab and assigned rights.
• The right three columns represent the Portal Configuration. The following configurations are possible:
  • Approved, Recommended
  • Requires Approval, Recommended
  • Approved, Not Recommended
  • Requires Approval, Recommended
• In the above scenario the configuration Requires Approval, Recommended is not used as I thought why make software recommended if it requires approval?
• The Software Listed is for example purposes only.

By using the AD Groups listed on the left for assigning rights to the Software Components or Managed Deliveries, all individual users within that group will have the access granted to the group.

Software Publishing Security

When a user accesses the Software Portal, the system they are logged onto does not directly drive what software shows up in the portal. The exception is the Portal will filter based on basic OS type between Windows and Macintosh. Otherwise the physical system is not presented to the NS when the Portal is loaded. It's the user's Domain account that drives what software shows up on the portal, what software can be installed automatically, and what software requires approval.

Scope Security

When the portal loads, the user's SID is transmitted to the Notification Server. The NS will enumerate through all available Software Components and Managed Deliveries to see what objects the user has rights for, and what software is recommended for him or her. The two available options are shown to the side of the security dialog in this screenshot:

Click to view.

By selecting either Approved or Requires Approval a scope-based security item is created for that user with the selected permission. This fits into the natural Symantec Management Platform security. Things to note:

1. Adding many single users can cause performance issues when security functions are called across the Notification Server as each user will require a security account within NS.
2. Managing Groups instead of users will not only increase the effectiveness of administration, but lighten the load on any Security related function.
3. An entry for Approved will override an entry for Requires Approval. Thus if a user is given specific rights to request software requiring approval, but that user also resides in a group that provides software already approved, the user will default to Approved when accessing the Software Portal.

Conclusion

By utilizing the Software Portal, IT Administrators can put the power to obtain required, recommended, or available software to the users with an easy interface accessible from any system on the network. This not only saves time and money for IT, but allows users to get the software they need faster, also saving money and time by giving users the tools they need to fulfill their responsibilities.