Additional upgrade instructions for sites with .NET Framework lower than 4.7.2 or using HTTP
This article covers additional steps to completed at the end of the upgrade process, if the site that you are upgrading:
uses a Microsoft .NET Framework version lower than 4.7.2 or
uses an http:// protocol.
If the site falls into one, or both, of these categories a manual change to the Web.config on the server is required, to avoid potential issues with the Phocas login screen caused by a change to browser security standards. This is a relatively straightforward process, but caution should be used whenever touching the Web.config files.
Before you start
You will need to have 'sysadmin' permissions on the site and admin permissions for Phocas and be familiar with making basic changes to a Windows environment.
NOTE: We recommend you take a copy of the Web.config file before making any changes. See instructions for doing this below under the heading ‘Opening the Web.config file’.
Accessing the Web.config file
Open Internet Information Serivces (IIS) Manager
Go to the start menu and type ‘IIS’ to search for IIS Manager. Click to open when it appears.
In the site directory that appears under IIS Manager, locate ‘Phocas’ and right-click > Explore (as shown in the screenshot below).
Opening the Web.config file
When you locate Web.config in the directory, we strongly recommend you take a copy of the Web.config file before making any changes.
To do this right-click on Web.Config > Copy and then Paste into the same directory as the original (this makes it easy to find if you need to roll back your changes). Windows will automatically rename the file to to web - Copy.config.
Now go back to the original Web.config file.
To open the Web.config right click > Open with and then select Notepad from the list of ‘Open with’ options.
Changing the Web.config
With the Web.config now open in Notepad, the next step is to change a value relating to SSL (this will get around potential browser-based security issues).
The Notepad window contains lines of code, each affecting various aspects of configuration. Depending on your situation, both of the items that may require changing are contained in the same line of code (shown below):
Sites with a .NET Framework version between 4.6.2 and 4.7.1 and using HTTP
Locate the attribute requireSSL (you can search for this, as shown below).
Change the value after ‘requireSSL' to be false (by default it will be set to “true”, as shown below). Simply overtype “False” in place of “True”.
3. Remove the sameSite=”None” attribute, which is in the same line. Remove the attribute and its value, i.e., all the words sameSite=”None” / change the value of the attribute "PhocasSameSite" from "None" to "Lax"
Now Save.
4. If they are on-prem and using SAML integration. The Webconfig has 2 Samesite areas, PhocasSameSite and Samesite, both of these fields should remain the default value of “None”.
Sites with a .NET Framework version 4.7.2 and above and using HTTP
For these sites follow steps 1 and 2 above and Save. You only need to change the requireSSL value.
Sites with a .NET Framework version 4.6.2 and 4.7.1 and using HTTPS
For these sites follow steps 1 and 3 above and Save. You only need to remove the sameSite attribute and its value.
Additional resources
https://helpphocassoftware.atlassian.net/wiki/spaces/userdoc/pages/589869 (article in Help site) Admin Guide
Also see Microsoft’s article on how to check .NET version: https://docs.microsoft.com/en-us/dotnet/framework/migration-guide/how-to-determine-which-versions-are-installed