Configuration Tutorial

Once Ion Configuration Manager and Browsium Client installation are completed, you can begin building your project using Ion Configuration Manager. Ion Configuration Manager enables you to create, edit, and test configurations before deployment. As a security design, Ion only uses Ion Profiles to manage the settings for sites explicitly identified in Ion rules. This tutorial will take you through the process of creating and testing Ion Profiles and rules.

Systems must have the Browsium Client installed to test the configurations created by Ion Configuration Manager.

Create and Test a Project

In this tutorial, we will create a new project, add a Profile and a rule, and then test the configuration by simulating a client deployment. We’ll do all of this on a single system running both Ion Configuration Manager and Browsium Client. For this example, we’ll use Browsium’s YouRang demo website (www.yourang.us) which was designed to work well in IE8 but must be remediated with Ion to work properly in Microsoft Edge (Chromium) using Edge Internet Explorer Mode.

Create a Profile

Standard Ion Profiles provide the ability to bind specific custom file system, registry and file settings to a specific rendering mode. Ion includes twelve Standard Ion Profiles templates that can be used to create Profiles: ‘Default’, ‘Ion Adaptive IE Quirks’, ‘Ion Emulate IE7 Mode’, ‘Ion Emulate IE8 Mode’, ‘Ion Emulate IE9 Mode’, ‘Ion Emulate IE10 Mode’, ‘Ion IE Quirks Mode’, ‘Ion IE Edge Mode’, ‘Ion IE7 Standards Mode’, ‘Ion IE8 Standards Mode’, ‘Ion IE9 Standards Mode’ and the ‘Ion IE10 Standards Mode’.

Any Profile can be modified to suit your needs after it is created, but the templates will remain unchanged. Some organizations may not need to make any customizations to the settings defined in the template, while others will require several changes to a Profile to make their web applications function properly.

The following steps demonstrate how to create a Profile based on the ‘Ion IE8 Standards Mode’ document mode and load an older version of Java, both required by the YouRang website. By design, Internet Explorer and Edge Internet Explorer Mode can only load the latest version of Java installed on the PC. This design is ideal for security, but it impedes the ability to ensure web application compatibility. This example will illustrate how to create a Profile to load Java 6 update 45 (1.6.0_45) instead of the newer Java 8 update 301 (1.8.0_301) version installed on the system. Both can be found in the Java Archive website.

For this tutorial, you must be using a PC running Windows 10 or later with Microsoft Edge (Chromium). You must also install Java Development Kit (JDK) 8 update 301 and Java Runtime Environment (JRE) 6 update 45.

The versions of Java used in this example are for demonstration of this tutorial, the specific versions of Java needed by an organization will be determined by those applications.

Before building your Ion configuration, you may want to visit the YouRang website in Edge Internet Explorer Mode to see which portions of site fail to work properly without an Ion remediation.

OK, let’s get started on the Ion configuration we’ll need to make YouRang work properly in Edge Internet Explorer Mode.

1. Open Ion Configuration Manager. A new project is created by default. There are a variety of ways to open existing project files, but this section of the guide assumes this is your first time creating an Ion project. Therefore, we’ll have you start building your configuration from an empty new project.

2. Begin by naming your project “Ion test project” and give it the description “My first project”.
   
   {width=“6.041698381452319in” height=“2.78589457567804in”}

3. Click on the Profiles Node, then click ‘Add Profile’ in the Actions to open the Select Profile Type screen:

{width=“2.8143438320209975in” height=“2.4652777777777777in”}

Given the requirements for this web application, select ‘Standard Ion Profiles’ and click Next.

4. That brings up the Select Rendering Mode options:

{width=“2.7509219160104985in” height=“2.4097222222222223in”}

Here you’ll select the rendering mode needed for the YouRang web application. Since it ran well in IE8, we’ll chose Ion IE8 Standards Mode. If you are unsure which rendering mode to use, Browsium recommends starting with the Ion Adaptive IE Quirks Mode for legacy web applications. With newer applications you can start using the Default rendering mode and then work backwards as needed. For Java-only remediations, try starting with a Global Java Profile option.

5. Enter a name and description for the new Profile. The name and description fields are for reference purposes only and can be anything useful or meaningful to your organization and environment. The other values can be changed at any time.

{width=“5.830667104111986in” height=“2.688585958005249in”}

6. Next, you’ll configure a Java remediation using the Java Version Manager to override the default version of Java (Java 8 update 301 on this system) with the required version for the YouRang Timecard application (Java 6 update 45). Select Java Version Manager from the Profile Actions pane, and then select Java 1.6.0_45 from the dropdown list.

{width=“3.1325984251968504in” height=“2.591088145231846in”}

Click OK and once the Java Version Manager has completed building the Java version remediation the Profile Properties page will return.

The Java Version field should now display the value 1.6.0_45.

{width=“5.629156824146982in” height=“3.5350623359580053in”}

7. To ensure the YouRang website always opens an Edge Internet Explorer Mode window, change the Browser Platform to ‘Edge Internet Explorer Mode’.

{width=“5.635068897637796in” height=“3.5387751531058615in”}

8. Next, we’ll add a String Replacement to fix an issue with the YouRang Phone Purchase application. YouRang was built for IE8 and some of the JavaScript used in the site is not compatible with the JavaScript engine in IE11. In this case, the developer named a variable “formAction”, which worked fine in IE8 and IE9, but in IE10 and IE11, Microsoft changed the JavaScript engine and “formaction” became an official attribute of button objects. This change breaks customer lookup function, as the submit button no longer works. The fix is to change the variable name to a value that is not reserved by Internet Explorer.

After selecting the String Replacement Manager node, click on Add to bring up the String Replacement Editor. Then enter the following values:

a) Name the string replacement “Phone Purchase String Replacement”.

b) Description is “Fix the formAction issue in the YouRang Phone Purchase application.”

c) Enter http://yourang.us/purchase_phone.php for the Target URI.

d) Leave both Match Method and Find/Replace Method at their default values of “Simple”.

e) Enter the value “formAction” in the ‘String to Find’ field.

f) Enter the value “buttonAction” in the ‘Replace with’ field. This will change all instances of formAction with buttonAction.

g) Click ‘OK’ to save the string replacement.

{width=“4.534722222222222in” height=“3.2929407261592303in”}

9. Profile creation is now complete. Now it’s time to create a rule to invoke this Profile for the YouRang.us website.

Create a Rule

Ion uses rules to determine when to invoke a Profile. The rules system is simple and powerful but working with it requires some care to ensure the behaviors are as expected. This section provides the basics on creating and editing rules using Ion Configuration Manager.

In this example, we have identified a web application YouRang.us which is not compatible with IE11 and the current version of Java. We have just walked you through creating a Profile to remediate the YouRang application, so we need to make a rule invoke this Profile when users visit that web application.

The easiest way to create a rule using the Profile you just created is to use the ‘Add Rule using this Profile…’ link in the Actions pane from the Profile Properties page. Rules can also be created using Add Rule link in the Rules Manager Actions pane.

1. Select the Ion IE8 Standards Mode Profile you just created in the Objects pane. Click the ‘Add Rule using this Profile…’ link in the Profile Actions pane to bring up the Rule Editor window. Enter a name for the rule. Rule names are friendly names for organizational and identification purposes only and have no effect on the behavior of a rule. For this example, we will choose “YouRang website”.
   
   Keep the Enable checkbox selected in order to make this rule active for use.

{width=“3.8207141294838145in” height=“2.7631944444444443in”}

There are five Match Method options to choose from for ensuring the rule is triggered when desired conditions are met. The Simple — Host Name Only method does a simple string match of the Fully Qualified Domain Name (FQDN) against the text in the Value field. The Simple — Full Url method performs a case-insensitive, substring match on the entire Url including subpath AND query string. The Starts With method does a case-insensitive, ‘starts with’ string matches (and if provided, the protocols must exactly match). The RegEx method is provided for scenarios that require a set of complex matching criteria. Zone will match the Internet Explorer Zone of the target website. Most rules will only need the Simple — Host Name Only (the default option) method. For this example, we will leave the Match Method set to the default ‘Simple — Host Name Only’.

2. Enter a Value to check for rule matching conditions. For this example, we will use the domain name for our application — yourang.us.

{width=“3.7054877515310585in” height=“2.6798611111111112in”}

3. Notice that the last field, Profile, already contains the name of our Profile ‘Ion IE8 Standards Mode Profile’. This is because we used the ‘Add Rule using this Profile…” link to create this rule. If a new rule was created via the Rules Manager, the Profile dropdown would be set to <No Profile>. But any available Profile can then be selected from the dropdown.

{width=“4.493055555555555in” height=“3.265344488188976in”}

4. When you are done creating the rule, click the ‘OK’ button to save the rule to the Rules Manager.

{width=“5.180555555555555in” height=“2.2925251531058617in”}

5. Now you’re ready to test the configuration.

Test a Configuration

Ion Configuration Manager provides a simple way to save and test configurations before deployment. The following steps walk you through this process for our YouRang example.

1. Use the ‘Start Test Configuration’ menu option which will prompt you to save the project file, enter comments for Project History, and then immediately and automatically apply project file pointers directly in the system registry and start Browsium Controller to read the new Ion configuration.

{width=“1.7609306649168854in” height=“2.1942475940507435in”}

Projects should be saved regularly to ensure work is not accidently lost. Ion Configuration Manager does not auto-save work in progress.

{width=“4.640583989501312in” height=“2.682831364829396in”}

By default, Ion projects have the field ‘Show Splash Screen on Start’ set to Disabled so end users will not see the splash screen. But Start Test Configuration will always display the splash screen so that you can be sure Browsium Controller has started before testing your configuration. If you have configured Catalyst or Proton, you’ll see these entries here as well.

2. Once the test configuration has been started, open Microsoft Edge (Chromium) and browse to www.yourang.com. The YouRang website will open in an Ion-managed instance of Edge Internet Explorer Mode. You can test the Order Phone and Timecard applications with Ion to see how well they work. If you haven’t already tested these applications without Ion, you can select Clear Test Configuration from the File menu to remove the Ion configuration and allow Microsoft Edge (Chromium) to render the site natively.

{width=“6.5in” height=“3.586956474190726in”}

[]{#_How_to_create_2 .anchor}

Administration Best Practices

You completely control the Ion experience. No rules are included ‘out of the box’. There is nothing hidden from you and Ion does not make any decisions for you. We can, however, provide some guidance on writing rules that might work effectively for your organization.

For security and performance purposes, we have designed Ion not to interfere with content that fails to match a declared rule. This opt-in model prevents unwanted content from being displayed using anything other than the standard Internet Explorer experience. While the Ion design increases security and protects both systems and users from inadvertently loading malicious content, unmatched rule content can still be displayed.

Recommendations for Writing Rules that Work Well

Ion was designed so users browsing the web are unaware anything ‘special’ about the content they are viewing and to remove from users the burden of ensuring line-of-business applications ‘just work’. This is the key to a successful experience. Users should not be concerned with the browser rendering engine that they are using with line-of-business applications and websites. Anything else can disrupt and interfere with workflow and efficiency. When writing rules with Ion Configuration Manager, there are some things to take into consideration that can help your users have a better experience.

Any browser upgrade requires an organization to begin the process by assessing which applications and websites are incompatible with the newer (target) version of Internet Explorer. Without a detailed review of which applications need remediation, organizations may look at building broad sets of rules. Most internal web applications are accessed using only a few defined hostnames. At first, you may want to write a rule that covers all hostnames. This will help ensure that all your internal web applications render as they have in previous versions of Internet Explorer. Over time, you can build a library of rules that cover the specific web applications which either do not work with later versions of the browser or still need to be tested. Then, you can remove the overarching hostname rule so that the specific rules apply.

Ion Rules Behavior

Since Ion uses a rule-based opt-in model, the ordering of rules is critical to ensure web applications function properly. The Ion design allows an organization to manage configurations in either centralized or distributed models. If a centralized team manages the configuration, there is less likelihood of overlapping configurations.

Organizations which choose to distribute configuration settings to various business units or web application teams may encounter conflicting configurations. In these instances Ion will always use the ‘Last In, First Out’ (LIFO) method, meaning that newer configuration values will overwrite previously read values for the same name. These conflicts can be avoided by using your organizations defined change control process or appointing a release manager to verify configurations prior to deploying in production. Ion Configuration Manager does not offer a mechanism to validate or rationalize multiple configuration files to look for overlapping conditions or errors.

Why Users Can’t Create Their Own Rules

Only administrative installs of Ion can create Profiles and rules. The justification for this design boils down to a simple reason: security.

Older web applications and ActiveX controls were not designed with modern exploits in mind and may not be updated as frequently as their newer counterparts (or at all, in the case of end-of-life software). That’s why it’s important to run modern, up-to-date software for normal, everyday web browsing. Ion helps organizations do just that, allowing them to migrate to the latest platforms while continuing to use the legacy software on an as needed basis.

A user faced with an incompatible web application might be tempted to use Ion excessively or even exclusively. But running Ion to render like IE6 and exposing outdated ActiveX Controls to the Internet just isn’t a good idea.

Compatibility problems are frustrating and incur a cost to users’ productivity. Since users are not given a way to enable Ion manually to ‘fix’ something that appears to be broken, we encourage companies to use existing support feedback mechanisms, such as helpdesk or support escalation systems, to give users ways to provide feedback and get new sites added to the Ion rules lists.

Ion does not install any legacy Internet Explorer components that may be exploited by a malicious site or application. Installing Ion will not add any potentially exploitable legacy Internet Explorer software. The Ion design simply manages how Internet Explorer and Edge Internet Explorer Mode renders content and the environment in which it runs. If a web application requires removing or lowering security settings present in the newer version of Internet Explorer or Edge Internet Explorer Mode you are running, those changes will be restricted to the pages loaded by sites that are defined by rule.

{width=“0.9305555555555556in” height=“0.9305555555555556in”}

Section Five

Ion Deployment in the Enterprise

In this section, you will learn:

• Deploying the Browsium Client in the enterprise

• Deploying registry pointers to Ion project files

• Options for deploying Ion project files

• Verifying deployment settings on end user PCs

• Project file caching behavior

• How to change client logging behavior for troubleshooting