Hyland (Requordit) OnBase - Document Management

AS OUR LEGACY CLOUD, VFC, IS DESIGNED AS A FULL IT OUTSOURCING SOLUTION, REQUORDIT ONBASE CAN BE HOSTED IN ITS ENTIRETY IN ANY CURRENT VFC CUSTOMER'S ENVIRONMENT 

THIS FAQ APPLIES TO OUR NEWER CLOUDS ONLY:  VEC RDP, Viewpoint One (VP1), and Trimble Construction One (TC1)

Author: Eric Vasbinder

Applicable ERPs

• Vista

Logistics

Support Status:  APPROVED

Integration Methods:

• ODBC Direct Database AND DM Plugin-API

Connection Methods:

• IPSEC VPN From Third Party Cloud

Cloud Hosted:  No / Yes (Existing OnBase customers ONLY - No approval for New )

Server Hosting Location:   Third party cloud, usually provided by Requordit

• NOTE:  Viewpoint ERP Cloud customers with OnBase ALREADY physically hosted in Viewpoint ERP Clouds may continue to host in our clouds until further notice

  • NO NEW APPROVALS FOR ONBASE HOSTING IN VIEWPOINT ERP CLOUDS WILL BE GIVEN

Client Hosting Location:

• VP1/TC1 (VRL-based Clouds):  on-premise - No Viewpoint ERP hosting needed

• TC1 AVD / RDP (Backup to VRL):  OnBase Client not supported due to architectural limitations

• VEC RDP / VFC:  Supported for existing customers already hosting OnBase only

Additional Charge (NOT Hosted): NO - IPSEC VPN add-on should be included with your TC1/VP1 contract by default

Additional Charge (HOSTED - No Longer available for new customers):  YES

• LEGACY Customers ONLY - Total Additional Charges for Hosting:  1 x SQL Server + 2 x Standard Servers + 1 Third Party Mgmt fee

  • 1 third party integration mgmt fee

  • 1 SQL Server

  • 2 x Standard Servers (for Web and File Server Use)

  • VPN Required for Vista VRL client to see OnBase DM Server

Vendor URL:  https://www.hyland.com/en/products/onbase

Product Use Case

This product provides document management and tracking, allowing for the storage of an enterprise's entire document flow.  Hyland's OnBase solution, usually provided through Requordit, provides customers with a document management and storage system that integrates with Vista and Vista workflows.  It replaces Vista's built-in Document Management solution.

Similar Products

This product is similar to and competes with Paperless's pVault and partially overlaps with Viewpoint's Vista Document Management capabilities.

ERP Connection Overview

As per many other server-side integrations to third-party products, this product is designed to talk to Vista's database directly using ODBC.  This connection requires that the Vista server be "visible" to the third party system.  To ensure that the two systems can communicate, we set up a server to server IPSEC VPN between our cloud and wherever the third party solution's server is hosted, usually in Requordit's external cloud.  In addition, the rich client for this solution integrates into Vista using our DM plugin API at the client side, providing a client side connection between Vista's client and the OnBase client.  

Please note that the VRL connection method is the only supported client connection mechanism that will work with both our Vista ERP cloud and with OnBase being hosted in an external cloud, such as that provided by Requordit.

Please note that the option to host the OnBase servers in our cloud directly is no longer available for new installations.  

Existing installations will be supported for now, but will eventually need to relocate OnBase to Requordit's servers in their cloud, hosted outside of the Trimble Viewpoint ERP cloud.

Please NOTE:  No matter whether this application's server is a legacy install, hosted in our clouds, or not, all Vista VP1/TC1 VRL-based workstations MUST be on the customer's corporate VPN to allow those end users' workstations to see the IPSEC VPN to Requordit's and / or Viewpoint's cloud. With this, the Vista clients will be able to "see" OnBase.  

For the few legacy customers using OnBase already hosted in our VFC or VEC RDP clouds, the client for OnBase and Vista will be hosted in our terminal services and will access the OnBase servers and Vista servers hosted in our cloud.

Deployment Methodology

This application may be hosted externally from Viewpoint's cloud, in an external cloud managed by Requordit and connected over an IPSEC VPN tunnel (preferred).  Conversely, legacy customers already hosting OnBase in our cloud may continue to do so.  Note: due to SOC 2/2 security requirements, Viewpoint may not host any applications other than Vista on the Vista server in our cloud.  As such, continuing to host this third-party integration in our cloud will necessitate the customer continuing to pay for THREE third-party integration servers as we will need to pass on the costs of these additional servers.  

NOTE:  REGARDLESS OF HOSTING LOCATION - If the OnBase rich client is in use, two sets of credentials will be required:  one to authenticate to OnBase via SQL accounts directly into Vista and one for Vista cloud authentication (e.g. through SSO).

The integration to the Vista rich client does not encounter this situation and can be used with OnBase with only Vista authentication.

OnBase Client Deployment (REQUORDIT OR CUSTOMER Hosted OnBase Servers ONLY)

In this scenario, the customer themselves, or their IT provider, hosts and manages the OnBase solution in their environment.  As per the legacy deployment option, a site to site IPSEC VPN is required in between the customer's corporate network and where OnBase is hosted.  The only difference is that the OnBase clients are not connecting over the IPSEC VPN to a Viewpoint hosted server.  Rather, they are connecting to the location where the OnBase server is hosted; usually Requordit's Cloud.  In addition, a second tunnel is needed from the third party cloud to the Vista database in our cloud.

As such, you will need two VPNs in this scenario:  one from the customer network to the third party cloud to support the OnBase clients themselves and one from the third party cloud to the Viewpoint ERP cloud to support the server to server connectivity needs of OnBase to the Vista server.

OnBase Client Deployment (Viewpoint Hosted OnBase Servers ONLY - LEGACY ONLY - NO NEW APPROVALS)

In VP1/TC1 (i.e. VRL-based clouds), the OnBase rich client is hosted on each end user's local workstation.  As it needs direct access to the OnBase server, the client MUST have network connectivity to the OnBase server.  Critically, we will not expose the OnBase client directly over the Internet for security reasons.  Now, you might ask, "So, how do you get OnBase to work if Trimble Viewpoint is hosting it, if you don't allow Internet connectivity??"   Ah, the answer is indubitably clear, my dear Watson:  the IPSEC VPN!

As such, If the customer has chosen to have Viewpoint host Requordit OnBase (LEGACY ONLY), their end user workstations need to be connected through a site-to-site IPSEC VPN to the Vista cloud environment where OnBase is hosted.  These site to site VPNs are stood up between a customer's main corporate office network and the Viewpoint environment in our cloud.  Thus, end users who need to have access to the OnBase system will need to use their client when connected to the corporate network, not over the Internet directly.  Of course, this works fine when end users are connected via their client VPNs into the main corporate network, as they can then piggyback on the main IPSEC site to site VPN from their current location.

It is realized that this is not as simple as using Vista over VRL from any Internet-based location.  However, for security reasons, due to the architecture of OnBase, bouncing through a VPN is required.

tl;dr: Customers should host OnBase in the external Requordit-managed cloud (PREFERRED) or in an internal server in their network.  Either way, new installations of OnBase are no longer allowed in the Viewpoint ERP clouds.  Customers who choose to continue to host OnBase in Requordit's cloud will need two VPNs:  one from Requordit to Viewpoint's cloud and another from their network to Requordit.  Legacy customers who choose to have Viewpoint continue to host this integration will need to purchase a additional servers in the Viewpoint cloud AND use the IPSEC VPN for both the OnBase server AND clients.

In all cases, VP1/TC1 customers will need to ensure that their end-users use another, client-side VPN (e.g. SSL VPN Client) of their own to connect their end users to their corporate office so the workstations for those end users may see the IPSEC VPN.