Checklist

After completing the installation, here is a list of small tasks to go through to confirm the installation works as expected.

Login #

For security reasons, logging in is only possible via HTTPS. Attempting to log in via HTTP produces the following error:

Access is forbidden

The message also appears when accessing via HTTPS if an upstream reverse proxy terminates the TLS connection and Relution does not recognize the request as secure. This is the case if the proxy does not send the header X-Forwarded-Proto: https or connects from an IP address that is not considered a trusted internal proxy (e.g., a reverse proxy on a separate server). Cause and solution are described under Login: Access is forbidden →. Requests made directly via localhost, 127.0.0.1 or [::1] are exempt from this check.

System Administrator #

The system administrator can be used to create additional organizations.

Logging in to Relution as a System Administrator uses the username admin and the password defined in the application.yml or in the environment variables. If an email address was set under email or SYSTEM_ADMIN_EMAIL at the first server start, logging in with that email address is also possible.

application.yml

relution:
  system:
    admin:
      password: ""
      email: ""

Environment variables

SYSTEM_ADMIN_PASSWORD=""
SYSTEM_ADMIN_EMAIL=""

If the password is left empty, Relution does not create a system administrator. The server log then shows the warning System admin cannot be created - password is not set.

An additional system administrator account can be created via the configuration without database access, see Creating an additional system administrator →.

Organization administrator #

Logging in to Relution as an organization administrator is also possible. The credentials of the first organization administrator are set during installation via the environment variables ORGA_ADMIN_USERNAME, ORGA_ADMIN_PASSWORD and ORGA_ADMIN_EMAIL, or assigned when the organization is created. If LDAP → is used, logging in with at least one LDAP user account should be possible.

For security reasons, changing the password after the first login is strongly recommended.

Certificates #

A connection to Relution via the external hostname should be possible. Mobile devices can be stricter when it comes to verifying SSL certificates. Even if the desktop browser shows a valid HTTPS connection, the devices may reject the connection if some things are not configured properly. Checking with SSL Labs → is strongly recommended to verify that everything is set up correctly.

Common errors

• Incomplete certificate chain (missing intermediate certificates). Chrome, Firefox, etc. can ignore this, but mobile devices may reject the connection.

• Reverse proxy uses server name indication (SNI). This is not supported by some older Android versions. As a workaround, the MDM server’s certificate should be the first one returned.

Mobile devices reject the certificate #

Possible cause

• The certificate chain may be incomplete. An incomplete chain is ignored by most desktop browsers, but may cause errors on mobile devices.

Solution

• SSL Labs → can be used to verify that the SSL certificate is set up correctly. The test takes about 5 minutes to complete. Any reported issues should be fixed.

Mobile devices receive a different certificate #

Possible cause

• The server may be using Server Name Indication (SNI), which is not supported by all mobile devices.

Solution

• The web server should be configured so that the first certificate returned is the one required by the mobile devices. The devices are not able to request a specific certificate and always use the first one sent by the server.

Database backups #

A working database backup should exist. This is important in case the hardware fails or an upgrade goes wrong. If an object storage (S3) is connected, the bucket is backed up as well. Details on scope and procedure are described under Disaster Recovery →.

iOS #

Using the Relution App Family for iOS from the public App Store is recommended. When an organization is created, Relution Agent, Relution Teacher and Relution Files are automatically imported from the Apple App Store into the Relution App Store. Other apps such as Relution Assets or Relution Decon can be added manually from the App Store if required. If ORGA_SKIPPREFILL=true is set during installation, this import is skipped for the organization created in the process.

Android #

When an organization is created, Relution automatically imports the Relution Agent and Relution Teacher from Google Play. The server itself determines the current versions of the Android Companion and the Android Agent via repo.relution.io. The versions installed on the devices are shown under Settings → Relution Client Apps.

For environments without access to Google Play or repo.relution.io, the installation packages are also available directly:

• Android Companion →
• Android Agent →

Support #

For support purposes, allowing remote access to the Relution server can be useful. Enabling or installing remote access software such as Remote Desktop, SSH or TeamViewer is recommended. For the best possible security, SSH with key-based authentication is recommended.

Using a separate user account for support personnel (e.g., for audit purposes) is also recommended. The support staff usually needs read and write access to the Relution installation directory and the ability to restart the Relution service.

Relution support is usually chargeable.