Introduction

With the introduction of LUNA 7.0, a number of additional tools have been introduced. The original LUNA Viewer, the LUNA Library, the LUNA Administrator, the LUNA Collection Manager, the LUNA Uploader and the LUNA Publisher. Insight still works with the LUNA Viewer as it did in previous versions.

LUNA can be installed into any of the supported configurations. Add the necessary database and ensure you have a minimum of 1024MB of free memory, or the recommended 1500MB of free memory, on your server.

There are three major components to LUNA: the LUNA Library, LUNA Publisher and LUNA Viewer. Each item requires a database. The databases will only store user generated information and will not store contents of the collections. This means the storage requirements for these databases are fairly small. 100MB should be plenty of space.

• Create one database that will contain everything for the LUNA Library, LUNA Viewer and the LUNA Publisher
  or
• Create three databases for the following: The LUNA Library, LUNA Viewer and the LUNA Publisher

Running the Installer

The LUNA Suite installer requires a GUI. If you are installing on Linux or Solaris, you will need X Windows to run the installer or another GUI interface.
Start the LUNA installer on your system and follow the prompts described in the following section.

Serial Number

The install requires a Serial Number to continue the installation process.
As a licensed institution, you should have been issued one. If not, contact our support department to obtain a valid licensed Serial Number.lunasupport@lunaimaging.com

LUNA Application Configuration

If this is the first time you install LUNA, then you must choose the first option "Configure LUNA Applications and create database tables".
If this is a subsequent installation and you just want to upgrade or reconfigure the LUNA application without deleting any user generated information, then choose "Upgrade or Reconfigure LUNA (Do not create db tables)".
NOTE: If you are upgrading, Stop Tomcat before running the installer
LUNA Suite Tools are deployed using Java W AR http://en.wikipedia.org/wiki/WAR_(file_format) files. This option will just configure the WAR file and deploy it.

Choose Install Set

For the Initial installation, you will generally choose Typical. This will include all system components.

• LUNA Library
• LUNA Viewer
• LUNA Uploader
• LUNA Administrator
• LUNA Publisher
• Tomcat
• Media Manager
  
  

LUNA Uploader

Installing a stand alone version of the Uploader can help reduce server load when processing a large volume of content. This is a non-typical setup and only recommended to solve certain server load issues. If your interested in implementing the stand alone uploader, contact LUNA Support. If you have implemented Shibboleth authentication, this setup may prove difficult to implement. 

Custom Install

For subsequent installations, you may wish to choose to install a specific component.
You can choose to install any of the following system components.

• • LUNA Library
  • LUNA Viewer
  • LUNA Uploader
  • LUNA Administrator
  • LUNA Publisher
  • Tomcat
  • Media Manager

Install Location

This will be the base of all the LUNA components selected.

Specifying an Administrative Username and Password for LUNA

LUNA requires you to specify an administrative username and password. This username and password will be used for authentication within the LUNA Administrator and for accessing the Tomcat management consoles. Users with this username and password have access to tools that can manage LUNA collection access and Credentials and modify LUNA's configuration, so be careful who it is shared with. NOTE: This password is not encrypted until first login. Do not use your network or system administrator password.

The Internal SYSTEM account is used within the various LUNA applications so that they may interact with each other. By default this is set to your Serial Number but you can change it if you wish.
 

Institution Name

This name is used on the LUNA Collections page to indicate the owner of the local LUNA Collections.
The format is:
<institution name> Collections

In the example below, it is set to Luna.

Institution ID

Institution ID is used within the LUNA Library to uniquely identify the server instance. This id in conjunction with the incremental suffix identifies a collection and will be used in the URL to specify a collection.

Example: LUNA~1~1 then LUNA~2~2

Tomcat Setup

The LUNA applications are served via Tomcat. The installation will take care of all major configurations with Tomcat but you may choose to select different ports for the application to run on.
Note: You are also choosing how much memory to allocate to the application. Make sure this much memory is freely available or the server will have out of memory errors.

Max upload filesize in MB. This should be set in association with how much memory you allocate to the tomcat service. You need between 4-6 times the memory to the file size. If you are uploading 200 MB file you should allocate at least 1200 MB to tomcat. The more memory the better.

SSL for sitewide https

Enabling this will force https on all LUNA tools. You must setup your web server to support SSL before LUNA will work with https. (7.2.6+) 

Select your certificate file location. This imports your certificate into a java truststore. Many certs will work without this, but if your certificate is from a non standard authority then you will need to select the file.

Allow Mixed Media Content

This option is required if you have any external collections that may not be running under https. Unsecure http content will be blocked by the browser unless this is selected.

This forces certain pages in LUNA to run under http not https. It must be selected if you have content from the LUNA Commons, AMICA or Archivision.

If your system needs to be full SSL throughout the site then Do Not select this option.

Slightly differnet selection in version 7.3.1

We have added an option to only have SSL for login's only

Tools Home URL Menu name

As shown below in the LUNA Library, the menu item that says Tools can be modified to a different name and directed to a customized launching page. 

LUNA component address confirmation

In most cases all the LUNA Tools will be installed on the same server and the same Tomcat instance. This may not be the case for all configurations. If your LUNA instance does have different addresses, make the appropriate changes in this panel.

LUNA Viewer Configuration

This section allows you to choose how the LUNA application is generally configured.

Insight User Manager Address

The LUNA Viewer can still use your existing Insight User Manager to grant access to your collections. However, the Insight User Manager will not work with the LUNA Administrator, LUNA Library or the LUNA Uploader.

Header Graphic Hyperlink

You have the option to make a link in the Header Graphic to go to a specific http address. By default the address will return to the LUNA Viewer Collections page (/luna/servlet).
This feature is useful if you want to create a launch page for the LUNA Viewer application, and from the LUNA Viewer the user can return to the launch page.

Personalized Footer

You have the option to add a personalized Footer in the LUNA Viewer. This footer will be placed at the bottom of all LUNA Viewer pages.
Just create a simple web page with a black background and place it on a web server.
Click here to see an example

Custom Footer Color

Clients who select  the white theme for their site may prefer the footer at the bottom of all Viewer pages to be white rather than black. Just enter the word "white" . It will also accept hex color code like "#4c5678".

Flowplayer License

Flowplayer is used to playback audio and video content. The license is used only to hide flowplayer branding. If you don't already have you license, contact LUNA support and send them the domain name of your LUNA server.

Path to Google Vision API JSON formatted key

Enter the path to the Google Vision API key. For more information on Activating the Google Cloud Vision API in LUNA

OAI-PMH Setup

If you would like to share some of your collections with OAI-PMH then enter a repository name and an Admin Email account. If not, leave these fields blank.

LUNA Viewer Configuration Continued

Enable Google ads

If you would like to place ads on the content of your site to generate potential revenue to support your collections, just check the ads box. The ads will be placed on the right side of the application. Go to http://www.google.com/intl/en/ads/ to sign up for an AdSense account. You will be prompted later in the installation to provide additional information specific to your AdSense account.

Enable End User Registration

The LUNA Viewer has built in end user self management. If you would like your end users to manage their own accounts (allowing them to create Media Groups, presentations and search External Media), select this item. Later in the configuration you will be asked for your email server information for outgoing messages.

Enable SSL for Login (not in 7.2.6+)

To prepare your system to support SSL during login, select this item. To properly support SSL you will need to have an Apache web server or similar running on Port 80 and the SSL module installed. Then AJP must be configured to connect with Tomcat. An SSL certificate will also need to added to your web server.

Enable Google Analytics

Prepare your system to support Google Analytics. You will also need to have a Google Analytics account to make use of this option. See http://www.google.com/analytics

Enable CAPTCHA for multiple failed Logins

To help reduce the risk of brute-force attacks, the LUNA Viewer has a CAPTCHA challenge option. The CAPTCHA will be presented when the user fails to enter the right username/password combination within a set number of tries.
7.2.6+

Remove deleted media from server

If checked the system is configured to remove media from the LUNA Sever. If not the media will not be deleted off the server when you delete content from the Uploader or LUNA Library.

Custom Authenticator

If you are using Shibboleth then choose Custom all other setups use Normal

Shibboleth

For Shibboleth Only 7.1.2+
To configure LUNA for Shibboleth, you must first have your web server configured as a Service Provider (SP) for shibboleth. LUNA must also be setup with AJP so it runs through your web server that has been configured with Shibboleth. This configuration may be complex and we suggest you contact our support department: support@lunaimaging.com
Note: This documentation only covers the settings for LUNA and not specifics on Shibboleth configuration.

Choose Shibboleth and Replace Existing luna-security.xml.

Enter the Shibboleth Login URL which is the LUNA login address http://www.example.com/luna/servlet/login 
Enter the Shibboleth Logout URL which will log you out of Shibboleth http://shibbolethServer.example.com/Shibboleth.sso/Logout 

Enter the attribute that will return the unique User identity name

Enter the attribute that will return the Primary group affiliation (this will be mapped to a credential)

Enter the attribute that will return the groups affiliation (can be the same as primary)

LUNAversal Viewer Configuration

The LUNAversal Viewer is new in LUNA 7.4

• Responsive Interface (Mobile Friendly)
• Uses the LUNA Viewer API for all its data
• Only HTML, CSS and Javascript libraries
• Open to modifications and customizations
• Integrated Universal Viewer
• Approaches WCAG 2.0 aa compliance
• A starting point to customize your own Viewer.

There is the Main application color. The default is 486486 (blue) and looks like the following.

Next is the Footer text that you see at the bottom of the page. It shows up briefly on thumbnail pages and all the time on the home page.

The next option indicates how a Share link that was created in the LUNA Viewer should be launched. 

The last item is link at the bottom of the Hamburger menu. You can link to any page and set the text for the link.

Google AdSense Configuration

If you are seeing this screen, then you have selected to enable Google ads on your site. You will need to provide specific information to enable this feature properly. During your account setup in AdSense, you were provided information appropriate to this feature.

SMTP Mail Server Setup

If you selected end user registration, then fill in the following form.

• Your email domain address
• SMTP Port Number
• SMTP User (optional)
• SMTP Password (optional)
• Use TLS (Requires server to accept STARTTLS command)
• SSL Port (set to 0 to disable)
• Senders email account (the account end users will respond to if necessary)
• Registration CC (optional) (will cc this email account on any self registration)

Google Analytics Setup

If you selected Google Analytics, you will need to enter your Analytics ID and Tag Manager ID (Container ID) here. 

You can find more information here.

reCAPTCHA Setup

In order to make use of the CAPTCHA challenge, you will need to obtain a reCAPTCHA Public and Private key specific to your domain.
The process is very quick, just go to and follow the instructions.
Enter the reCAPTCHA public key
Enter the reCAPTCHA private key
Enter the number of failed login attempts to present before the reCAPTCHA is displayed.

Examples of the normal login window and CAPTCHA login window

Remove deleted media Shared Key

Enter the key that will be used between the Media Manager and the LUNA Library to authorize media deletion. This is your Serial Number by default.

LUNA Publisher maintenance setup

This is used by the LUNA Administrator to trigger a soft reset of the LUNA services. Enter a random set of letters and numbers.

LUNA Library storage repository

This location is used to store data for each item contained in the the LUNA Library as XML. It's also used in v7.1.5+ to store exported images and data.

Default Media Fields for Independent Media Items

Choose up to 6 fields that will be the default fields set when a user edits an Independent Media Item.

Technical Metadata Search for Independent Media Items (IMI)

The search options are set system wide for Independent Media Items. This is different from working with collections. Collections have these same options set individually in the Collection Manager

These settings allow you to search the embedded metadata that was contained in the images as they were imported. IPTC and XMP are more likely populated with user created data and EXIF is machine generated. EXIF can also have an extensive set of fields with only technical information. Because of this and to avoid erroneous search results, we recommend that you exclude EXIF from search.

LUNA Suite database creation

The LUNA Suite has three independent databases for the

• LUNA Viewer
• LUNA Library
• LUNA Publisher

Each database needs it's own schema. In the next few screens, you will be creating these databases. The Installer screens are very similar so pay close attention to which database you are creating.  

Choosing a Database Type

The installer is designed to connect to your database server and to create database tables, fields and indexes for your LUNA Server and LUNA Publisher. Please choose the database type you wish to use. The information you identify here will be used to configure LUNA.

LUNA Viewer, LUNA Library and LUNA Publisher Database Information

For each of the three databases you will be asked to provide the information necessary to connect to your databases. This includes the hostname, database name and database port. The installer will offer default values based on information provided earlier. Review the defaults (and change them as needed).

Database Username and Password

Please specify the username and password for your database. This is the username and password that LUNA should use to connect to the database.

• WARNING: the installer will DROP ALL LUNA TABLES once it has connected, so be sure that you are not installing over an existing version of LUNA. (The installer will warn you again before it actually drops any tables.)

Creating the LUNA Database

Once the installer has tested the connection, it will present you with the database creation script window. Click "Run Script" to create the LUNA tables and indexes.

LUNA Graphics URL

The LUNA Graphics URL is used to access LUNA theme header graphics. Just make sure this URL is externally accessible from the installed machine. Do not use localhost or any other internal domain unless you know for sure the content will not be used outside of your institution.

Solr / Lucene Index Folders

LUNA uses Solr / Lucene to search for content in your collections. These indexes can add up to hundreds of megabytes depending on the content you have in your collections. 160,000 objects takes about 400MB but this is entirely dependent on the size of your collections that you are accessing. So choose an appropriate location that can grow with your collections.

LUNA Temp Files Location

During the use of LUNA, content is exported and this location is used to store that information temporarily.

LUNA Storage

LUNA and the LUNA Publisher need space to store information extracted from Insight collections and a place to create the Lucene indexes during the publishing process. This area can easily grow to several gigabytes.

Media Manager Storage Location

The Media Manager needs a location to store the content that is uploaded to it. Depending on the expected level of use, choose a storage location.

Start the Install Process

This may take several minutes depending on the server speed and how you are accessing the installer.

Starting LUNA

You can start these by launching the Tomcat.
Go to:
<Install Directory>/tomcat/bin


For Tomcat:
We have also supplied you with our standard java service wrapper version for starting and stopping the application:
start_tomcat.bat on windows and start_tomcat.sh for Linux and Solaris will start tomcat in a console mode.
If you would like to start tomcat as a service on windows, we have supplied you with the install_as_service.bat file.
If you want to run tomcat in the background using the java service wrapper on Linux or Solaris, you can start it with:
./tomcat_service.sh start

The script has the following options:
console | start | stop | restart | status




Once started go to http://www.example.edu:8181/
You should see something like the following:

The LUNA application will now be available at http://www.example.edu:8181/luna/servlet and it will look similar to the following page:

Media Manager testing

Testing the Media Manager

In your browser, go to http://www.example.com:8180/MediaManager/srvr
You should get a message like the following:

Testing the JPEG2000 Decoder

http://www.example.com:8180/MediaManager/jp2ktest

You should get a page like the following:

Troubleshooting a Media File Compromised Error

One error with the Media Manager is that the base file path for media may be slightly different from the actual path. This most commonly occurs on Windows where file-paths are not case sensitive while the Media Manager's checks are. So in Windows make sure your drive letter is upper case ( C:\ and not c:\ ). If you see an error similar to the following, then check the MediaFileRootDir parameter.

 
To change the MediaFileRootDir property: 

1. 1. Open your MediaManager.dat file (located in the media_manager directory) in a text editor.
   2. Find the MediaFileRootDir parameter.
   3. Check that the value matches the path to your media exactly (check the case of all pieces as well).
   4. Save the file.
   5. Restart Tomcat.

LDAP Setup

Introduction

The configuration for LUNA is done in the luna-security.xml file located in the following location

• <LUNA Install Directory>/tomcat/luna_apps/luna.war/WEB-INF

In the section that follows, only sections that are pertinent to the configuration are shown.

 Active Directory LDAP example

<!-- 
The properties of ldapAuthenticationSearch need to be specified in the 
same way as Insight User Manager 6.x. See the InsightUserServer.dat file. 
Example for Active Directory
-->
<bean id="ldapAuthenticationSearch" class="com.luna.insight.client.security.ldap.LDAPAuthenticationSearchImpl">
   <property name="ldapUserAttribute" value="insightUser" />
   <property name="ldapURL" value="ldap://ldap.luna.edu" />
   <property name="baseDN" value="dc=luna,dc=edu" />
   <property name="loginSSL" value="0" />
   <property name="trustStorePath" value="" />
   <!--
Example for LDAPS:
<property name="ldapUserAttribute" value="insightUser"/>
<property name="ldapURL" value="ldaps://ldap.luna.edu"/>
<property name="baseDN" value="dc=luna,dc=edu"/>
<property name="loginSSL" value="1"/>
<property name="trustStorePath" value="C:/myStoreFile">
-->
</bean>

Assigning credentials by pattern matching in user's DN for Active Directory LDAP

The ldapSearchFilters and credentialsConditions properties work in the same way as ldapAuthenticationSearch.

In the following example, pattern matching is applied to the DN returned after applying the search filter (sAMAccountName=(0)), where sAMAccountName is the login name for every user.

This is done in the order from top to bottom, and when there is a match, the corresponding credential under "mappedValues" is assigned and the rest of the conditions are ignored. If there is no match, it is assigned a default credential ID set above.

Regular expression can be used in conditions.

Syntax for "conditions":
<attribute value>=<pattern>

For example, in condition "distinguishedName=CN=admin,OU=Art History*", we are trying to match the <attribute value> "distinguishedName" against the <pattern> "CN=admin,OU=Art History*"

Example DN's and expected results from the credential mappings set below:

distinguishedName: CN=admin,OU=Art History Department,OU=College of Letters and Science,DC=luna,DC=edu 

admin will get credential 4

distinguishedName: CN=John Smith,OU=Art History Department,OU=College of Letters and Science,DC=luna,DC=edu 

jsmith will get credential 3

distinguishedName: CN=Jenny Anderson,OU=Art History Department,OU=College of Letters and Science,DC=luna,DC=edu

janderson will get credential 3

distinguishedName: CN=Jane Doe,OU=English Department,OU=College of Letters and Science,DC=luna,DC=edu

jdoe will get credential 3

distinguishedName: CN=Jill Emerson,OU=French Department,OU=College of Letters and Science,DC=luna,DC=edu

jemerson will get credential 2

<!-- Example for Active Directory -->
<bean id="ldapCredentialsMap" class="com.lunaimaging.insight.core.domain.authenticators.ldap.LdapCredentialsMap">
   <property name="ldapSearchFilters">
      <list>
         <value>(sAMAccountName={0})</value>
      </list>
   </property>
   <property name="ldapSearchAttributes">
      <list>
         <value>insightUser</value>
      </list>
   </property>
   <property name="conditions">
      <list>
         <value>distinguishedName=English Department</value>
         <value>distinguishedName=CN=admin,OU=Art History*</value>
         <value>distinguishedName=Art History*</value>
         <value>distinguishedName=College of Letters and Science</value>
      </list>
   </property>
   <property name="mappedValues">
      <list>
         <value>3</value>
         <value>4</value>
         <value>3</value>
         <value>2</value>
      </list>
   </property>
</bean>

 Open LDAP example

<bean id="authenticatorSearchLDAP" class="com.lunaimaging.insight.core.domain.authenticators.LdapSearchAuthenticator">
  <property name="defaultCredentialsId" value="2"/>
  <property name="ldapAuthenticationSearch">
    <ref bean="ldapAuthenticationSearch" />
  </property>
  <property name="ldapSearchMap">
    <ref bean="ldapCredentialsMap"/>
  </property>
</bean>
<!-- 
The properties of ldapAuthenticationSearch need to be specified in the 
same way as Insight User Manager 6.x. See the InsightUserServer.dat file. 
Example for OpenLDAP:
-->
<bean id="ldapAuthenticationSearch" class="com.luna.insight.client.security.ldap.LDAPAuthenticationSearchImpl">
  <property name="ldapUserAttribute" value="insightUser"/>
  <property name="ldapURL" value="ldap://ldap.luna.edu"/>
  <property name="baseDN" value="dc=luna,dc=edu"/>
  <property name="loginSSL" value="0"/>
  <property name="trustStorePath" value=""/>
  <!--
Example for LDAPS:
<property name="ldapUserAttribute" value="insightUser"/>
  <property name="ldapURL" value="ldaps://ldap.luna.edu"/>
  <property name="baseDN" value="dc=luna,dc=edu"/>
  <property name="loginSSL" value="1"/>
  <property name="trustStorePath" value="/usr/local/insight/LunaImaging/myStoreFile">
-->
<property name="ldapSearchFilters">
  <list>
    <value>(uid={0})</value>
  </list>
</property>
<property name="ldapSearchAttributes">
  <list>
    <value>insightUser</value>
  </list>
</property>
<property name="ldapSecurityPrincipal" value="{0}"/>
<property name="ldapSecurityPrincipalAttributes" value="dn"/>
</bean>

Assigning credentials by pattern matching in user's DN for OpenLDAP

The ldapSearchFilters and credentialsConditions properties work in the same way as ldapAuthenticationSearch.

OpenLDAP:
In the following example, pattern matching is applied to the DN returned after applying the search filter (uid=(0)), where uid is the login name for every user.

This is done in the order from top to bottom, and when there is a match, the corresponding credential under "mappedValues" is assigned and the rest of the conditions are ignored. If there is no match, it is assigned a default credential ID set above.

Regular expression can be used in conditions.

Syntax for "conditions":

<attribute value>=<pattern> 

for example, in "dn=uid=admin,ou=Art History*",
we are trying to match the <attribute value> "dn" against the <pattern> "uid=admin,ou=Art History*"
Example DN's and expected results from the credential mappings:

dn: uid=admin,ou=Art History Department,ou=College of Letters and Science,dc=luna,dc=edu

admin will get credential 4

dn: uid=jsmith,ou=Art History Department,ou=College of Letters and Science,dc=luna,dc=edu

jsmith will get credential 3

dn: uid=janderson,ou=Art History Department,ou=College of Letters and Science,dc=luna,dc=edu

janderson will get credential 3

dn: uid=jdoe,ou=English Department,ou=College of Letters and Science,dc=luna,dc=edu

jdoe will get credential 3

dn: uid=jemerson,ou=French Department,ou=College of Letters and Science,dc=luna,dc=edu

jemerson will get credential 2

<bean id="ldapCredentialsMap" class="com.lunaimaging.insight.core.domain.authenticators.ldap.LdapCredentialsMap">
   <property name="ldapSearchFilters">
      <list>
         <value>(uid={0})</value>
      </list>
   </property>
   <property name="ldapSearchAttributes">
      <list>
         <value>insightUser</value>
      </list>
   </property>
   <property name="conditions">
      <list>
         <value>dn=English Department</value>
         <value>dn=uid=admin,ou=Art History*</value>
         <value>dn=Art History*</value>
         <value>dn=College of Letters and Science</value>
      </list>
   </property>
   <property name="mappedValues">
      <list>
         <value>3</value>
         <value>4</value>
         <value>3</value>
         <value>2</value>
      </list>
   </property>
</bean>

Remove Multicast Requirement

(For versions previous to 7.1.2.7)

If your system is requiring a login for each tool that you switch to then Multicast might not be working on your network.

We found a way to make the system flip between applications without the need for multicast.

We made some changes to the ehcache.xml files for each application.

Download ehcache.zip
 

So here is where you can make the changes. 

The location of these files is as follows

7.x/LUNA/tomcat/luna_apps/luna.war/WEB-INF/classes/ehcache.xml

7.x/LUNA/tomcat/luna_apps/webadmin.war/WEB-INF/classes/ehcache.xml

7.x/LUNA/tomcat/luna_apps/editor.war/WEB-INF/classes/ehcache.xml

7.x/LUNA/tomcat/luna_apps/uploader.war/WEB-INF/classes/ehcache.xml

Rename the original ehcache.xml to ehcache_org.xml
then place the appropriate attached file into that location and rename it to ehcache.xml

Once all files have been changed start tomcat and try LUNA's application switching.

This should work for all but the publisher and eliminates the mulitcast requirement.