Release Summary

Release 1.7.10 contains several new enhancements to the i2b2 kernel, many of which improve the security around signing into the i2b2 Web Client. We have included some Auditing features like logging all successful and attempted logins into the i2b2 Web Client or keeping a log of all the Admin functions performed with the Admin Module.

Highlight of Features

• Log admin and sign on activity

• Lock users out after a specific number of failed login attempts

• Require users to change passwords after a specified interval of time

• Prevent users from using the same password when required to change it.

• Enforce complex password requirements defined by the i2b2 Administrator.

• Custom SQL Breakdowns

• Temporal query made simple

• Single sign-on

• Improve datasource validation

Installation Note

The 1.7.10 Release Notes apply to you if you are upgrading your existing i2b2 system from an earlier version of the i2b2 software.

SHRINE Networks

Upgrade Notes

Information about upgrading i2b2 to version 1.7.10 can be found in this section of the release notes.

i2b2 Components

In release 1.7.10 the following i2b2 components contain changes and therefore need to be updated when upgrading your i2b2 environment.

• i2b2 Database

• i2b2 Server (kernel)

• i2b2 Web Client

Database Drivers

The JDBC drivers were updated to the following versions.

Upgrade Paths

The i2b2 now provides two options for upgrading your i2b2 server.

1. Continue to download the source code provided in the zip file released on www.i2b2.org/software

2. Install the precompiled JAR files onto your existing i2b2 server to upgrade it to 1.7.10.

Both are acceptable paths to upgrade your i2b2 server and depending on which you choose will determine where you need to go to obtain the appropriate files. The location of the upgrade files for each component is outlined below.

Upgrade Software

Description	Where to find it	Requirements

Description	Where to find it	Requirements
Upgrade i2b2 database to 1.7.10	Software page (i2b2 Website)	Download i2b2createdb-1710.zip file under Source Code
Upgrade i2b2 Web Client to 1.7.10	Software page (i2b2 Website)	Download i2b2webclient-1710.zip file under Source Code
Upgrade i2b2 Server to 1.7.10 (Source Code)	Software page (i2b2 Website)	Download i2b2core-src-1710.zip file under Source Code
Upgrade i2b2 Server to 1.7.10 (JAR files)	Open  Upgrade to Release 1.7.10 from 1.7.09c page (Community Wiki)	See Technical Details section on the i2b2 Upgrades page and upgrade documentation on Upgrade to latest version page.

Upgrade Documentation

 These sections are located within this document. All other documents are external pages either on the community wiki or on the i2b2 Website.

Database Changes

Release 1.7.10 involves a few changes to the i2b2 Database. Some are simple an addition to the sample data that is included in the demo data that is delivered with the software while others are changes to the database structure to support new features that are included in 1.7.10

Crcdata Tables

QT_BREAKDOWN_PATH

• Added new breakdowns for the new SQL Query Breakdown feature

QT_QUERY_RESULT_TYPE

• Added new breakdowns for the new SQL Query Breakdown feature

• Added new column to support roles based access for the new SQL Breakdowns

  • New column name = QT_ROLE_CD

Pmdata Tables

PM_USER_LOGIN table

• Remove the primary key

• Added the PM_USER_LOGIN_IDX index

Change Summary - Release 1.7.10

Did you know?

• Changes to the i2b2 server & database are listed under i2b2 Kernel (Core) Software

• Changes to the i2b2 Web Client are listed under i2b2 Web Client Software

• Additional information about the new features can be found in the Feature Details - Release 1.7.10 section located this Change Summary section.
  
  

i2b2 Kernel (Core Software)

New Features and Improvements

Bug Fixes

i2b2 Web Client Software

New Features and Improvements

Bug Fixes

Feature Details - Release 1.7.10

Release 1.7.10 has many new features and for the purpose of this document we have grouped them into one of the following four categories:

1. Auditing improvements

2. Password management improvements

3. Query improvements

4. Miscellaneous improvements

Auditing improvements

The auditing improvements are part of a larger group of enhancements that are labeled in JIRA as "Security enhancements". There are only two auditing features and both involve keeping an audit trail of information for maintaining security. Right now the audit trail is limited to the i2b2 Admin module and the process of logging into the i2b2 Web Client.

Log number of attempted logins

JIRA Issue: CORE-285

All successful and failed login attempts to sign into the i2b2 Web Client will be logged in the PM_USER_LOGIN table.

Highlights of New Feature

• No additional setup is needed to turn the enhancement on

• Even when a user is locked out the system will log when they attempt to access the system

Log Admin Functions

JIRA Issue: CORE-286

Functions performed within the Admin module will be logged within the PM_USER_LOGIN table.

Password management improvements

The improvements to managing passwords are the other enhancements that are part of the larger group of "Security enhancements". There are four new features that are designed to help sites improve security of their i2b2 by improving how their user passwords are managed within the i2b2. The site administrators will now have control over requiring users to change passwords, use complex passwords, and lock users out for entering the wrong password too many times. 

4 New Features Include

1. Account lockout

2. Mandatory password change

3. Prevent repeat passwords

4. Enforce complex passwords

Account Lockout

JIRA Issue: CORE-287

Accounts are locked and users are not able to sign into the i2b2 after a specific number of failed login attempts have been made.

Highlights of New Feature

• 2 new global parameters

  1. PM_LOCKED_MAX_COUNT

  2. PM_LOCKED_MAX_WAIT_TIME

• Account lockout threshold and wait time is defined by the site Administrator.

• Users are locked-out when the defined number of failed attempts have been reached.

• Once locked

  • user receives a lockout message

  • user must wait a preset period of time

• Successful login resets the number of failed logins

New Parameters

Two new Global Parameters were created as part of the new lockout feature. These parameters must be defined in the PM_GLOBAL_PARAMS table for users to be locked out after the defined number of failed attempts and number of minutes they must wait before attempting to try again.

PM_LOCKED_MAX_COUNT Parameter

• Threshold for failed sign-in attempts

• The value is inclusive. i.e. if you enter 4 then the 4th time the user enters the wrong password they will receive the error message and their account will be locked.

Open

Open

PM_LOCKED_WAIT_TIME Parameter

• Number of minutes an account is locked before a user can sign in again.

Open

Open

Mandatory Password Change

JIRA Issue: CORE-287

Require users to change passwords after a specified interval of time. The i2b2 Administrator controls the number of days allowed before a password must be changed. If a user attempts to sign on after their password has expired, the i2b2 Change Password window will open and the user must change their password before they can sign on. Once the user changes their password, the system will calculate the next expiration date for that user.

Highlights of New Feature

• Require users to change passwords

• i2b2 Admins control how often (interval)

• Change password window will open when password expired

• 2 new parameters; 1 global & 1 user

• The system uses the value in the global parameter to calculate the next expiration date and adds the appropriate user parameter to the table.

Summary of password expiration process

New Parameters

Two new parameters were created as part of the Mandatory password change feature. Both parameters are called PM_EXPIRED_PASSWORD however one is set within PM_GLOBAL_PARAMS and the other within PM_USER_PARAMS. Each parameter has a different function in the password expiration process and is further defined below.

Table: PM_GLOBAL_PARAMS

The new Global Parameter called PM_EXPIRED_PASSWORD must be added to the PM_GLOBAL_PARAMS table to define the password change interval. Once this parameter has been set the mandatory password change feature will be turned on. If this parameter is not added as a global parameter then passwords will never expire.

Open

Highlights of global parameter PM_EXPIRED_PASSWORD

• Global Parameter PM_EXPIRED_PASSWORD

• Turns the feature on

• Defines password change interval

• Affects ALL users

Open

Table: PM_USER_PARAMS

The new user parameter, PM_EXPIRED_PASSWORD, is automatically added to the PM_USER_PARAMS table the first time a user successfully changes their expired password. When they change their password, the system will look to the PM_EXPIRED_PASSWORD parameter in the PM_GLOBAL_PARAMS table to see the change interval defined and then calculate the new expiration date to add to the user parameter.

Open

Highlights of user parameter PM_EXPIRED_PASSWORD

• User Parameter PM_EXPIRED_PASSWORD

• Date password will expire for user

• Added by system when password changed 1st time

• Can be manually added / edited to a future date for user accounts don't want to expire

Open

Prevent repeat password

JIRA Issue: CORE-300

Users are no longer allowed to use their current password as their new password when required to change it. 

Highlights of New Feature

• No additional setup is needed

• New password can't be same as current password

• Warning message displayed if user enters same password

Open

Enforce Complex Passwords

JIRA Issue: CORE-288

Passwords must meet complexity requirements defined by the i2b2 Administrator. The requirements will be enforced when users change their passwords for the Change Password Window. However, when an i2b2 Administrator is setting up a new user in the i2b2 Admin Module the requirements are not required when entering or editing the password in User Management.

Highlights of New Feature

• New global parameter

• i2b2 Administrator defines requirements for complexity

• Requirements are enforced when users change passwords

• User receives Warning message if new password doesn't meet requirements

Open

New parameter

A new Global Parameter was created to support the Enforce Complex Passwords feature. The new parameter defines the complexity requirements for the passwords and once it has been entered into the PM_GLOBAL_PARAMS table the feature will be turned on for all users. This means all users will be required to follow the new requirements the next time they change their password. Again, the only exception is when the password is set by the i2b2 Administrator from within the i2b2 Admin Module.

Global Parameter: PM_COMPLEX_PASSWORD

Table: PM_GLOBAL_PARAMS

Open

Complex Requirement Variables

Setting the parameter value for PM_COMPLEX_PASSWORD

• Each password requirement is defined as an independent variable.