diff --git a/ansible/roles/onr-tomcat/defaults/main.yml b/ansible/roles/onr-tomcat/defaults/main.yml
new file mode 100644
index 000000000..9e511f512
--- /dev/null
+++ b/ansible/roles/onr-tomcat/defaults/main.yml
@@ -0,0 +1,33 @@
+---
+bip_bucket_name: nomis-combined-reporting-bip-packages20230612143115114600000001
+sap_bi_platform_unpack_base_directory: /opt/sap/bip
+sap_bi_platform_extraction_directory: /u02/software/BIP_4_3_SP1
+sap_bi_platform_installation_directory: /u01/app/bobj/BIP4
+sap_jvm_unpack_base_directory: /opt/sap/java
+
+ncr_environment: "{{ ec2.tags['nomis-combined-reporting-environment'] }}"
+cms_name: "{{ ncr_environment }}-ncr-cms"
+
+s3:
+  bip_bucket_name: nomis-combined-reporting-bip-packages20230612143115114600000001
+  packages_prefix: BIP/
+  files:
+    sap_bi_platform:
+      - BIPLATS4303P_300-70002683_P1.EXE
+      - BIPLATS4303P_300-70002683_P2.RAR
+    sap_jvm: SAPJVM8_94-80000202.SAR
+    sapcar: SAPCAR_1324-80000935.EXE
+
+ssm_parameters_prefix: "tomcat"
+
+tomcat_post_install_directories:
+  tomcat: /u01/app/bobj/BIP4/sap_bobj/tomcat
+  custom_config: /u01/app/bobj/BIP4/sap_bobj/enterprise_xi40/warfiles/webapps/BOE/WEB-INF/config/custom
+  biprws_config: /u01/app/bobj/BIP4/sap_bobj/enterprise_xi40/warfiles/webapps/biprws/WEB-INF/config/custom
+  webapps_root: /u01/app/bobj/BIP4/sap_bobj/enterprise_xi40/warfiles/webapps/ROOT
+
+tomcat_admin_secretsmanager_passwords:
+  tomcat_admin:
+    secret: "/ec2/ncr-tomcat-admin/{{ ncr_environment }}/passwords"
+    users:
+      - tomcat_admin: auto
diff --git a/ansible/roles/onr-tomcat/meta/main.yml b/ansible/roles/onr-tomcat/meta/main.yml
new file mode 100644
index 000000000..eda808260
--- /dev/null
+++ b/ansible/roles/onr-tomcat/meta/main.yml
@@ -0,0 +1,6 @@
+---
+dependencies:
+  - role: get-ec2-facts
+  - role: ansible-requirements
+  - role: disable-ipv6
+  - role: disable-firewall
diff --git a/ansible/roles/onr-tomcat/tasks/add_groups.yml b/ansible/roles/onr-tomcat/tasks/add_groups.yml
new file mode 100644
index 000000000..7b19fcf1b
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/add_groups.yml
@@ -0,0 +1,21 @@
+---
+- name: Ensure binstall group exists
+  ansible.builtin.group:
+    name: binstall
+    gid: 1201
+    state: present
+
+- name: Ensure oinstall group exists
+  ansible.builtin.group:
+    name: oinstall
+    state: present
+
+- name: Ensure dba group exists
+  ansible.builtin.group:
+    name: dba
+    state: present
+
+- name: Ensure sapsys group exists
+  ansible.builtin.group:
+    name: sapsys
+    state: present
diff --git a/ansible/roles/onr-tomcat/tasks/add_response_file.yml b/ansible/roles/onr-tomcat/tasks/add_response_file.yml
new file mode 100644
index 000000000..3e74ca43a
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/add_response_file.yml
@@ -0,0 +1,33 @@
+- name: Copy pre requesites file
+  ansible.builtin.template:
+    src: u02/software/BIP_4_3_SP1/prereq_checks.ini
+    dest: "{{ sap_bi_platform_extraction_directory }}/prereq_checks.ini"
+    owner: bobj
+    group: binstall
+    mode: "0755"
+
+- name: Copy response file
+  ansible.builtin.template:
+    src: u02/software/BIP_4_3_SP1/tomcat_admin_response.ini
+    dest: "{{ sap_bi_platform_extraction_directory }}/tomcat_admin_response.ini"
+    owner: bobj
+    group: binstall
+    mode: "0755"
+
+- name: Ensure product key is set in response file
+  ansible.builtin.lineinfile:
+    path: "{{ sap_bi_platform_extraction_directory }}/tomcat_admin_response.ini"
+    regexp: "^productkey="
+    line: "productkey={{ product_key }}"
+
+- name: Ensure CMS password is set in response file
+  ansible.builtin.lineinfile:
+    path: "{{ sap_bi_platform_extraction_directory }}/tomcat_admin_response.ini"
+    regexp: "^remotecmsadminpassword="
+    line: "remotecmsadminpassword={{ cms_admin_password }}"
+
+- name: Ensure CMS name is set in response file
+  ansible.builtin.lineinfile:
+    path: "{{ sap_bi_platform_extraction_directory }}/tomcat_admin_response.ini"
+    regexp: "^remotecmsname="
+    line: "remotecmsname={{ cms_name }}"
diff --git a/ansible/roles/onr-tomcat/tasks/assign_permissions.yml b/ansible/roles/onr-tomcat/tasks/assign_permissions.yml
new file mode 100644
index 000000000..e5cd247e1
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/assign_permissions.yml
@@ -0,0 +1,30 @@
+---
+- name: Assign bobj permissions
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: bobj
+    group: binstall
+    mode: "0775"
+  loop:
+    - "{{ sap_bi_platform_installation_directory }}"
+    - "{{ sap_bi_platform_extraction_directory }}"
+
+- name: Assign 775 oracle permissions
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: oracle
+    group: oinstall
+    mode: "0775"
+  loop:
+    - /u01/stage/
+    - /u01/app/oracle/
+
+- name: Assign 770 oracle permissions
+  ansible.builtin.file:
+    path: /u01/app/oraInventory/
+    state: directory
+    owner: oracle
+    group: oinstall
+    mode: "0770"
diff --git a/ansible/roles/onr-tomcat/tasks/extract_files.yml b/ansible/roles/onr-tomcat/tasks/extract_files.yml
new file mode 100644
index 000000000..7133cbb48
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/extract_files.yml
@@ -0,0 +1,29 @@
+---
+# unpack the SAP BIP rar archive
+
+- name: Check if setup.sh file exists
+  stat:
+    path: "{{ sap_bi_platform_extraction_directory }}/setup.sh"
+  register: result
+
+- name: Unpack the install files
+  block:
+    - name: Unpack the rar file
+      shell: /usr/local/bin/unrar x -y BIPLATS4303P_300-70002683_P1.exe
+      args:
+        chdir: "{{ sap_bi_platform_unpack_base_directory }}"
+      when: sap_bi_platform_unpack_base_directory is defined
+
+    - name: Untar the unpacked archive
+      ansible.builtin.unarchive:
+        src: "{{ sap_bi_platform_unpack_base_directory }}/BISERVONE.tgz"
+        dest: "{{ sap_bi_platform_extraction_directory }}"
+        remote_src: yes
+      when: sap_bi_platform_unpack_base_directory is defined
+  when: not result.stat.exists
+  rescue:
+    - name: Remove the unpacked RAR
+      file:
+        path: "{{ sap_bi_platform_unpack_base_directory }}/BISERVONE.tgz"
+        state: absent
+      when: sap_bi_platform_unpack_base_directory is defined
diff --git a/ansible/roles/onr-tomcat/tasks/get_facts.yml b/ansible/roles/onr-tomcat/tasks/get_facts.yml
new file mode 100644
index 000000000..206e7e7a7
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/get_facts.yml
@@ -0,0 +1,11 @@
+---
+- name: Get tomcat secrets
+  import_role:
+    name: secretsmanager-passwords
+  vars:
+    secretsmanager_passwords: "{{ tomcat_admin_secretsmanager_passwords }}"
+
+- name: Set password facts
+  set_fact:
+    cms_admin_password: "{{ secretsmanager_passwords_dict['tomcat_admin'].passwords['cms_admin_password'] }}"
+    product_key: "{{ secretsmanager_passwords_dict['tomcat_admin'].passwords['product_key'] }}"
diff --git a/ansible/roles/onr-tomcat/tasks/install_packages.yml b/ansible/roles/onr-tomcat/tasks/install_packages.yml
new file mode 100644
index 000000000..c3c114813
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/install_packages.yml
@@ -0,0 +1,30 @@
+---
+- name: Install packages with yum command as those are not getting installed by ansible yum
+  ansible.builtin.shell: |
+    set -eo pipefail
+    main() {
+      yum -y install {{ item }}
+    }
+    main 2>&1 | logger -p local3.info -t ansible-yum-install
+  loop:
+    - libnsl
+    - libnsl2
+    - libnsl.i686
+    - libnsl2.i686
+
+- name: Get unrar installer
+  ansible.builtin.get_url:
+    url: "https://www.rarlab.com/rar/rarlinux-x64-621.tar.gz"
+    dest: "/tmp/rarlinux-x64-621.tar.gz"
+
+- name: Extract unrar
+  ansible.builtin.unarchive:
+    src: "/tmp/rarlinux-x64-621.tar.gz"
+    dest: "/tmp/"
+    remote_src: yes
+
+- name: Install unrar
+  ansible.builtin.shell:
+    cmd: "make"
+    chdir: "/tmp/rar/"
+    creates: "/usr/local/bin/unrar"
diff --git a/ansible/roles/onr-tomcat/tasks/install_tomcat.yml b/ansible/roles/onr-tomcat/tasks/install_tomcat.yml
new file mode 100644
index 000000000..146808d13
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/install_tomcat.yml
@@ -0,0 +1,37 @@
+---
+- name: Check if product is installed
+  stat:
+    path: /u01/app/bobj/BIP4/sap_bobj
+  register: bip_installed_check
+
+- name: Install Tomcat
+  block:
+    - name: Perform pre-requesite checks
+      become_user: bobj
+      ansible.builtin.shell: /u02/software/BIP_4_3_SP1/setup.sh -InstallDir /u01/app/bobj/BIP4/ -pre_requisite_check /u02/software/BIP_4_3_SP1/prereq_checks.ini /u02/software/BIP_4_3_SP1/failedPrereqs.txt
+      ignore_errors: true
+
+    - name: Run Silent Installation
+      become_user: bobj
+      ansible.builtin.shell: |
+        . ~/.bash_profile 
+        /u02/software/BIP_4_3_SP1/setup.sh -InstallDir /u01/app/bobj/BIP4/ -r /u02/software/BIP_4_3_SP1/tomcat_admin_response.ini
+  when: not bip_installed_check.stat.exists
+
+- name: Check if init has been run
+  stat:
+    path: /etc/init.d/SAPBOBJEnterpriseXI40
+  register: setupinit_folder_check
+
+- name: Run setup
+  block:
+    - name: Copy setupinit file
+      ansible.builtin.template:
+        src: u01/app/bobj/BIP4/sap_bobj/init/setupinit.sh
+        dest: /u01/app/bobj/BIP4/sap_bobj/init/setupinit.sh
+
+    - name: Execute setup script
+      become: true
+      ansible.builtin.shell: /u01/app/bobj/BIP4/sap_bobj/init/setupinit.sh
+  when:
+    - not setupinit_folder_check.stat.exists
diff --git a/ansible/roles/onr-tomcat/tasks/main.yml b/ansible/roles/onr-tomcat/tasks/main.yml
new file mode 100644
index 000000000..6beffbb00
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/main.yml
@@ -0,0 +1,53 @@
+---
+- import_tasks: get_facts.yml
+  tags:
+    - amibuild
+    - ec2provision
+  when: ansible_distribution in ['RedHat']
+
+- import_tasks: install_packages.yml
+  tags:
+    - amibuild
+    - ec2provision
+  when: ansible_distribution in ['RedHat']
+
+- import_tasks: add_groups.yml
+  tags:
+    - amibuild
+    - ec2provision
+  when: ansible_distribution in ['RedHat']
+
+- import_tasks: assign_permissions.yml
+  tags:
+    - amibuild
+    - ec2provision
+  when: ansible_distribution in ['RedHat']
+
+- import_tasks: retrieve_files.yml
+  tags:
+    - amibuild
+    - ec2provision
+  when: ansible_distribution in ['RedHat']
+
+- import_tasks: extract_files.yml
+  tags:
+    - amibuild
+    - ec2provision
+  when: ansible_distribution in ['RedHat']
+
+- import_tasks: add_response_file.yml
+  tags:
+    - amibuild
+    - ec2provision
+  when: ansible_distribution in ['RedHat']
+# - import_tasks: install_tomcat.yml
+#   tags:
+#     - amibuild
+#     - ec2provision
+#   when: ansible_distribution in ['RedHat']
+
+# - import_tasks: post_installation_config.yml
+#   tags:
+#     - amibuild
+#     - ec2provision
+#   when: ansible_distribution in ['RedHat']
diff --git a/ansible/roles/onr-tomcat/tasks/post_installation_config.yml b/ansible/roles/onr-tomcat/tasks/post_installation_config.yml
new file mode 100644
index 000000000..0df573b5d
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/post_installation_config.yml
@@ -0,0 +1,69 @@
+### TOMCAT POST INSTALLATION CONFIGURATION
+---
+- name: Add tomcat config files
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ tomcat_post_install_directories.tomcat }}/{{ item.dest }}"
+  loop:
+    - { src: "../templates/server.xml", dest: "conf/server.xml" }
+    - { src: "../templates/context.xml", dest: "conf/context.xml" }
+    - { src: "../templates/setenv.sh", dest: "bin/setenv.sh" }
+
+- name: Modify wdeploy.conf
+  ansible.builtin.lineinfile:
+    path: "{{ sap_bi_platform_installation_directory }}/sap_bobj/enterprise_xi40/wdeploy/conf/wdeploy.conf"
+    regexp: "^disable_InfoView="
+    line: "disable_InfoView=true"
+  become: true
+  become_user: bobj
+
+- name: Add custom properties config files
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ tomcat_post_install_directories.custom_config }}/{{ item.dest }}"
+  loop:
+    - { src: "../templates/properties/BILogon.properties", dest: "BILogon.properties" }
+    - { src: "../templates/properties/CmcApp.properties", dest: "CmcApp.properties" }
+    - { src: "../templates/properties/FioriBI.properties", dest: "FioriBI.properties" }
+    - { src: "../templates/properties/global.properties", dest: "global.properties" }
+    - { src: "../templates/properties/OpenDocument.properties", dest: "OpenDocument.properties" }
+    - { src: "../templates/properties/PlatformServices.properties", dest: "PlatformServices.properties" }
+
+- name: Add biprws custom config file
+  ansible.builtin.template:
+    src: ../templates/properties/biprws.properties
+    dest: "{{ tomcat_post_install_directories.biprws_config }}/biprws.properties"
+
+- name: Rename main root files
+  block:
+    - name: Backup index file
+      ansible.builtin.copy:
+        remote_src: true
+        src: "{{ tomcat_post_install_directories.webapps_root }}/index.jsp"
+        dest: "{{ tomcat_post_install_directories.webapps_root }}/index_main.jsp"
+    - name: Check if BrowserCheck file exists
+      stat:
+        path: "{{ tomcat_post_install_directories.webapps_root }}/BrowserCheck.jsp"
+      register: browsercheck_file
+    - name: Backup BrowserCheck file
+      ansible.builtin.copy:
+        remote_src: true
+        src: "{{ tomcat_post_install_directories.webapps_root }}/BrowserCheck.jsp"
+        dest: "{{ tomcat_post_install_directories.webapps_root }}/BrowserCheck_Main.jsp"
+      when: browsercheck_file.stat.exists
+  become: true
+  become_user: bobj
+
+- name: Add root files
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ tomcat_post_install_directories.webapps_root }}/{{ item.dest }}"
+  loop:
+    - { src: "../templates/root/BIlogoff.jsp", dest: "BIlogoff.jsp" }
+    - { src: "../templates/root/BrowserCheck.jsp", dest: "BrowserCheck.jsp" }
+    - { src: "../templates/root/BrowserCheck_Offline.jsp", dest: "BrowserCheck_Offline.jsp" }
+    - { src: "../templates/root/browsercheck.css", dest: "browsercheck.css" }
+    - { src: "../templates/root/browsercheck.js", dest: "browsercheck.js" }
+    - { src: "../templates/root/index.jsp", dest: "index.jsp" }
+    - { src: "../templates/root/keepalive.htm", dest: "keepalive.htm" }
+    - { src: "../templates/root/Unsupported_Browser.html", dest: "Unsupported_Browser.html" }
diff --git a/ansible/roles/onr-tomcat/tasks/retrieve_files.yml b/ansible/roles/onr-tomcat/tasks/retrieve_files.yml
new file mode 100644
index 000000000..96c1fa0b7
--- /dev/null
+++ b/ansible/roles/onr-tomcat/tasks/retrieve_files.yml
@@ -0,0 +1,52 @@
+---
+- name: Create directory to unpack BIP files
+  file:
+    path: "{{ sap_bi_platform_unpack_base_directory }}"
+    state: directory
+    mode: 0755
+
+- name: Create directory to unpack JVM
+  file:
+    path: "{{ sap_jvm_unpack_base_directory }}"
+    state: directory
+    mode: 0755
+
+# - name: Download JVM from S3
+#   aws_s3:
+#     mode: get
+#     bucket: "{{ s3.bip_bucket_name }}"
+#     object: "{{ s3.prefix }}{{ item }}"
+#     dest: "{{ sap_jvm_unpack_base_directory }}/{{ item|basename }}"
+#     overwrite: true
+#   with_items:
+#     - "{{ s3.files.sap_jvm }}"
+#     - "{{ s3.files.sapcar }}"
+
+- name: Check if the BIPLATS4303P_300-70002683_P1.exe exists
+  stat:
+    path: "{{ sap_bi_platform_unpack_base_directory }}/BIPLATS4303P_300-70002683_P1.exe"
+  register: s3_result
+
+- name: Download BI Platform from S3
+  block:
+    - name: Download BI files from S3
+      aws_s3:
+        mode: get
+        bucket: "{{ s3.bip_bucket_name }}"
+        object: "{{ s3.packages_prefix }}{{ item }}"
+        dest: "{{ sap_bi_platform_unpack_base_directory }}/{{ item|basename }}"
+        overwrite: never
+      with_items: "{{ s3.files.sap_bi_platform }}"
+
+    - name: Hacky rename
+      shell: |
+        for f in *;
+          do
+            e="${f##*.}";
+            b="${f%.*}";
+            mv -n "$f" "${b}.${e,,}";
+          done
+      args:
+        chdir: "{{ sap_bi_platform_unpack_base_directory }}"
+        executable: /bin/bash
+  when: not s3_result.stat.exists
diff --git a/ansible/roles/onr-tomcat/templates/context.xml b/ansible/roles/onr-tomcat/templates/context.xml
new file mode 100644
index 000000000..b2d75d12d
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/context.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!-- The contents of this file will be loaded for each web application -->
+<Context>
+
+    <!-- Default set of monitored resources. If one of these changes, the    -->
+    <!-- web application will be reloaded.                                   -->
+    <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <WatchedResource>WEB-INF/tomcat-web.xml</WatchedResource>
+    <WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>
+        <Resources cachingAllowed="true" cacheMaxSize="100000" />
+
+        <JarScanner>
+          <JarScanFilter defaultPluggabilityScan="false" />
+        </JarScanner>
+
+    <!-- Uncomment this to disable session persistence across Tomcat restarts -->
+    <!--
+    <Manager pathname="" />
+    -->
+    <Resources cachingAllowed="true" cacheMaxSize="500000" />
+</Context>
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/properties/BILogon.properties b/ansible/roles/onr-tomcat/templates/properties/BILogon.properties
new file mode 100644
index 000000000..ee71a00f5
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/properties/BILogon.properties
@@ -0,0 +1,55 @@
+# DO NOT MODIFY THIS FILE!
+# To customize any of the settings, create a new file in <BOE_Install_Dir>\<Enterprise_DIR>\warfiles\webapps\BOE\WEB-INF\config\custom
+# and run wdeploy. Only changes in the custom directory will be maintained over patches. The new file has to have the same file name
+# as this one and shall only contain the properties that you would like to customize.
+
+
+# Application name
+# These values are used in the place of the translated BI launch pad
+# If not supplied they will default to a translated BI launch pad name
+# app.name is used in most locations in the application. Optional
+app.name=Prison-NOMIS Reporting
+# app.name.short is used on the logon page. Optional
+app.name.short=Prison-NOMIS Reporting
+# Optional greeting not used in default application code
+app.name.greeting=Welcome
+
+# app.custom.product.name is used on the logon page to display the Product Name (defaults to SAP BusinessObjects). Optional
+app.custom.product.name=Prison-NOMIS
+
+# You can specify the default Authentication types here.  secEnterprise, secLDAP, secWinAD, secSAPR3
+authentication.default=secEnterprise
+
+# Choose whether to let the user change the authentication type.  If it isn't shown the default authentication type from above will be used
+authentication.visible=false
+
+# You can specify the authentications that are supported in this field.
+# By default all the authentications listed below will appear. You can add or remove values from the field, based on the authentications which are supported.
+# Authentications List --- secEnterprise,secLDAP,secWinAD,secSAPR3,secOraApps,secPSE1,secpsenterprise,secSiebel7
+logon.authentication.visibleList=secEnterprise
+
+# You can specify the default CMS machine name here
+cms.default=@nomis_t1
+
+# Choose whether to let the user change the CMS name
+cms.visible=false
+
+# Set to true to prompt when navigating away from a writable page in a modal dialog. Default is false
+dialog.prompt.enabled=false
+
+#The URL that a logout will redirect to if the logon was an external logon (i.e. via start.do). This is optional.
+url.exit=/BIlogoff.jsp
+
+# If the locale preference is disabled (only english languages will be used/allowed)
+# TMC - disable.locale.preference needs to be set to false otherwise the locale is always US and therefore dates are displayed in US format regardless of the users viewing preferences.
+disable.locale.preference=false
+
+#to enable notification polling
+notification.enabled=true
+
+#You can specify the default administration email_ids in semicolon separated format here.
+#The specified Email ids will be used when user will click on Contact Administrator on BILP Login screen
+admin.user.email=NationalApplicationsReportingTeam@justice.gov.uk
+
+#Set a global flag for Disclaimer message
+disclaimer.enabled=false
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/properties/CmcApp.properties b/ansible/roles/onr-tomcat/templates/properties/CmcApp.properties
new file mode 100644
index 000000000..eb7306396
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/properties/CmcApp.properties
@@ -0,0 +1,28 @@
+# DO NOT MODIFY THIS FILE!
+# To customize any of the settings, create a new file in <BOE_Install_Dir>\<Enterprise_DIR>\warfiles\webapps\BOE\WEB-INF\config\custom
+# and run wdeploy. Only changes in the custom directory will be maintained over patches. The new file has to have the same file name
+# as this one and shall only contain the properties that you would like to customize.
+
+
+# You can specify the default Authentication types here.  secEnterprise, secLDAP, secWinAD, secSAPR3.
+authentication.default=secEnterprise
+
+# Choose whether to let the user change the authentication type.  If it isn't shown the default authentication type from above will be used.
+authentication.visible=false
+
+# You can specify the authentications that are supported in this field.
+# By default all the authentications listed below will appear. You can add or remove values from the field, based on the authentications which are supported.
+# Authentications List --- secEnterprise,secLDAP,secWinAD,secSAPR3,secOraApps,secPSE1,secpsenterprise,secSiebel7
+logon.authentication.visibleList=secEnterprise
+
+# You can specify the default CMS machine name here
+cms.default=@nomis_t1
+
+# Choose whether to let the user change the CMS name.  If it isn't shown the default System from above will be used
+cms.visible=false
+
+# Set to true to prompt when navigating away from a writable page in a modal dialog. Default is false
+dialog.prompt.enabled=false
+
+#set global flag for Disclaimer
+disclaimer.enabled=false
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/properties/FioriBI.properties b/ansible/roles/onr-tomcat/templates/properties/FioriBI.properties
new file mode 100644
index 000000000..9a1ec2ddc
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/properties/FioriBI.properties
@@ -0,0 +1,60 @@
+# DO NOT MODIFY THIS FILE!
+# To customize any of the settings, create a new file in <BOE_Install_Dir>\<Enterprise_DIR>\warfiles\webapps\BOE\WEB-INF\config\custom
+# and run wdeploy. Only changes in the custom directory will be maintained over patches. The new file has to have the same file name
+# as this one and shall only contain the properties that you would like to customize.
+
+
+# Application name
+# These values are used in the place of the translated BI launch pad
+# If not supplied they will default to a translated BI launch pad name
+# app.name is used in most locations in the application. Optional
+app.name=Prison-NOMIS Reporting
+# app.name.short is used on the logon page. Optional
+app.name.short=Prison-NOMIS Reporting
+# Optional greeting not used in default application code
+app.name.greeting=Welcome
+
+# app.custom.product.name is used on the logon page to display the Product Name (defaults to SAP BusinessObjects). Optional
+app.custom.product.name=Prison-NOMIS
+
+# You can specify the default Authentication types here.  secEnterprise, secLDAP, secWinAD, secSAPR3
+authentication.default=secEnterprise
+
+# Choose whether to let the user change the authentication type.  If it isn't shown the default authentication type from above will be used
+authentication.visible=false
+
+# You can specify the authentications that are supported in this field.
+# By default all the authentications listed below will appear. You can add or remove values from the field, based on the authentications which are supported.
+# Authentications List --- secEnterprise,secLDAP,secWinAD,secSAPR3,secOraApps,secPSE1,secpsenterprise,secSiebel7
+logon.authentication.visibleList=secEnterprise
+
+# You can specify the default CMS machine name here
+cms.default=@nomis_t1
+
+# Choose whether to let the user change the CMS name
+cms.visible=false
+
+# Set to true to prompt when navigating away from a writable page in a modal dialog. Default is false
+dialog.prompt.enabled=false
+
+#The URL that a logout will redirect to if the logon was an external logon (i.e. via start.do). This is optional.
+url.exit=/BIlogoff.jsp
+
+# If the locale preference is disabled (only english languages will be used/allowed)
+# TMC - disable.locale.preference needs to be set to false otherwise the locale is always US and therefore dates are displayed in US format regardless of the users viewing preferences.
+disable.locale.preference=false
+
+#to enable notification polling.
+notification.enabled=true
+#to set notification polling time in milliseconds. Default is 200000
+notification.poling.time=200000
+
+#You can specify the default administration email_ids in semicolon separated format here.
+#The specified Email ids will be used when user will click on Contact Administrator on BILP Login screen
+admin.user.email=NationalApplicationsReportingTeam@justice.gov.uk
+
+#Set global disclaimer flag
+disclaimer.enabled=false
+
+# Set theme.enable to "custom" for enabling theming for Fiori BILaunchpad
+theme.enable=custom
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/properties/OpenDocument.properties b/ansible/roles/onr-tomcat/templates/properties/OpenDocument.properties
new file mode 100644
index 000000000..e556180ce
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/properties/OpenDocument.properties
@@ -0,0 +1,36 @@
+# DO NOT MODIFY THIS FILE!
+# To customize any of the settings, create a new file in <BOE_Install_Dir>\<Enterprise_DIR>\warfiles\webapps\BOE\WEB-INF\config\custom
+# and run wdeploy. Only changes in the custom directory will be maintained over patches. The new file has to have the same file name
+# as this one and shall only contain the properties that you would like to customize.
+
+
+app.name=Prison-NOMIS Reporting OpenDocument
+app.name.short=OpenDocument
+
+# app.custom.product.name is used on the logon page to display the Product Name (defaults to SAP BusinessObjects). Optional
+app.custom.product.name=Prison-NOMIS
+
+# You can specify the default Authentication types here.  secEnterprise, secLDAP, secWinAD, secSAPR3
+authentication.default=secEnterprise
+
+# Choose whether to let the user change the authentication type.  If it isn't shown the default authentication type from above will be used
+authentication.visible=false
+
+# You can specify the authentications that are supported in this field.
+# By default all the authentications listed below will appear. You can add or remove values from the field, based on the authentications which are supported.
+# Authentications List --- secEnterprise,secLDAP,secWinAD,secSAPR3,secOraApps,secPSE1,secpsenterprise,secSiebel7
+logon.authentication.visibleList=secEnterprise
+
+
+# You can specify the default CMS machine name here
+cms.default=@nomis_t1
+
+# Choose whether to let the user change the CMS name.  If it isn't shown the default System from above will be used
+cms.visible=false
+
+#Set a global flag for disclaimer message
+disclaimer.enabled=false
+
+#You can specify the default administration email_ids in semicolon separated format here.
+#The specified Email ids will be used when user will click on Contact Administrator on Open Document Login screen
+admin.user.email=NationalApplicationsReportingTeam@justice.gov.uk
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/properties/PlatformServices.properties b/ansible/roles/onr-tomcat/templates/properties/PlatformServices.properties
new file mode 100644
index 000000000..50fe34ca5
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/properties/PlatformServices.properties
@@ -0,0 +1,13 @@
+# DO NOT MODIFY THIS FILE!
+# To customize any of the settings, create a new file in <BOE_Install_Dir>\<Enterprise_DIR>\warfiles\webapps\BOE\WEB-INF\config\custom
+# and run wdeploy. Only changes in the custom directory will be maintained over patches. The new file has to have the same file name
+# as this one and shall only contain the properties that you would like to customize.
+
+
+# cms.clusters: comma separated list of cluster names.  Each cluster in the above list requires its own parameter: key = cms.clusters.<clustername> (without the @), value = comma separated list of cms servers. Note: Each param-name must match case with the corresponding value in cms.clusters.  No port needs to be given for a server.  If none is given, then the default port 6400 is assumed.
+#cms.clusters.samplecluster=cmsone:6400, cmstwo
+#cms.clusters.samplecluster2=cms3, cms4, cms5
+#cms.clusters.samplecluster3=aps05
+
+cms.clusters=@nomis_t1
+cms.clusters.nomis_t1=t1-ncr-cms
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/properties/biprws.properties b/ansible/roles/onr-tomcat/templates/properties/biprws.properties
new file mode 100644
index 000000000..3bcbaf8d7
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/properties/biprws.properties
@@ -0,0 +1,29 @@
+#------------------------------------------------------Default CMS Configuration------------------------------------------------------
+CMS_Default=@nomis_t1
+#------------------------------------------------------System Property Configuration------------------------------------------------------
+Default_Number_Of_Objects_On_One_Page=50
+Enterprise_Session_Token_Timeout_In_Minutes=60
+Session_Pool_Size=1000
+Session_Pool_Timeout_In_Minutes=2
+Basic_Auth_Supported=false
+Basic_Auth_Type=
+#------------------------------------------------------Logger properties------------------------------------------------------
+Log_Level=Medium
+Log_Location=
+Log_File_Size=20000
+Log_Files_Num=5
+#------------------------------------------------------Trusted Authentication Configuration------------------------------------------------------
+Retrieving_Method=HTTP_HEADER
+User_Name_Parameter=X-SAP-TRUSTED-USER
+Trusted_Auth_Shared_Secret=
+# ------------------------------------------------------ SSO Related Default Global Core Web Properties ------------------------------------------------------
+# Vintela single sign on properties
+sso.enabled=false
+idm.realm=
+idm.princ=
+idm.keytab=
+idm.allowUnsecured=
+idm.allowNTLM=
+idm.logger.name=
+idm.logger.props=
+idm.allowS4U=
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/properties/global.properties b/ansible/roles/onr-tomcat/templates/properties/global.properties
new file mode 100644
index 000000000..bca2e1c2f
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/properties/global.properties
@@ -0,0 +1,29 @@
+# DO NOT MODIFY THIS FILE!
+# To customize any of the settings, create a new file in <BOE_Install_Dir>\<Enterprise_DIR>\warfiles\webapps\BOE\WEB-INF\config\custom
+# and run wdeploy. Only changes in the custom directory will be maintained over patches. The new file has to have the same file name
+# as this one and shall only contain the properties that you would like to customize.
+
+
+# DEFAULT GLOBAL PROPERTIES
+#
+# This file contains DEFAULT global properties.  A property defined here can have one of two scopes:
+#
+# Scope: global
+# - It can be overridden at a global level by specifying a value in the CUSTOM global.properties file.
+#
+# Scope: application:
+# - In addition to being overridable globally, it can also be on a per app basis.
+# - This could happen in 1 of 2 ways:
+#   o  It can be set in the app's CUSTOM config properties file.
+#   o  Alternatively it could be set internally by the app, in which any custom value
+#     (either globally or for that application) is ignored. This would be indicated by comments in the
+#      application's DEFAULT properties file
+
+
+# Configure whether "User list", "Group list" or "Group Hierarchy" should be selected (instead of "User list") in panels to select Users and UserGroups from
+# Scope: global (CMC and BILP)
+# Set to "userList" for "User list" to be default selection.
+# Set to "groupList" for "Group list" to be default selection.
+# Set to "groupHierarchy" for "Group Hierarchy" to be default selection
+#prefer.root.selected=userList
+prefer.root.selected=groupList
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/root/BIP_profile_icon.png b/ansible/roles/onr-tomcat/templates/root/BIP_profile_icon.png
new file mode 100644
index 000000000..e69de29bb
diff --git a/ansible/roles/onr-tomcat/templates/root/BIP_profile_menu_70pct.png b/ansible/roles/onr-tomcat/templates/root/BIP_profile_menu_70pct.png
new file mode 100644
index 000000000..e69de29bb
diff --git a/ansible/roles/onr-tomcat/templates/root/BIlogoff.jsp b/ansible/roles/onr-tomcat/templates/root/BIlogoff.jsp
new file mode 100644
index 000000000..12ade5f68
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/root/BIlogoff.jsp
@@ -0,0 +1,17 @@
+<%@ page session="false" language="java" pageEncoding="UTF-8" contentType="text/html; charset=UTF-8" %>
+<!DOCTYPE html>
+<html>
+<head>
+    <meta http-equiv="X-UA-Compatible" content="IE=edge,requiresActiveX=true" charset="UTF-8" />
+    <title>Prison-NOMIS Reporting</title>
+    <link rel="shortcut icon" type="image/x-icon" href="InfoView.ico" />
+    <link rel="stylesheet" href="browsercheck.css">
+</head>
+<body>
+    <div class="BILP-launchpadbackground">
+        <div class="divCenter">
+            Please close this window and use the link in Prison-NOMIS to enter the reporting system.
+       </div>
+    </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/root/BrowserCheck.jsp b/ansible/roles/onr-tomcat/templates/root/BrowserCheck.jsp
new file mode 100644
index 000000000..b73bdb066
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/root/BrowserCheck.jsp
@@ -0,0 +1,24 @@
+<%@ page session="false" language="java" pageEncoding="UTF-8" contentType="text/html; charset=UTF-8" %>
+<!DOCTYPE html>
+<html>
+<head>
+    <meta http-equiv="X-UA-Compatible" content="IE=edge,requiresActiveX=true" charset="UTF-8" />
+	<title>Prison-NOMIS Reporting</title>
+	<link rel="shortcut icon" type="image/x-icon" href="InfoView.ico" />
+    <link rel="stylesheet" href="browsercheck.css">
+    <script type="text/javascript" src="browsercheck.js?v=2"></script>
+    <script type="text/javascript">
+        window.onload = init;
+    </script>
+</head>
+<body>
+    <div class="BILP-launchpadbackground">
+        <div class="divCenter" id="checking" style="display:inline;">
+            Checking if your browser is supported by Prison-NOMIS Reporting...
+        </div>
+        <div class="divCenter" id="supported" style="display:none;">
+            Browser check complete, redirecting you to Prison-NOMIS Reporting...
+        </div>
+    </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/root/BrowserCheck_Offline.jsp b/ansible/roles/onr-tomcat/templates/root/BrowserCheck_Offline.jsp
new file mode 100644
index 000000000..9a2fb213d
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/root/BrowserCheck_Offline.jsp
@@ -0,0 +1,17 @@
+<%@ page session="false" language="java" pageEncoding="UTF-8" contentType="text/html; charset=UTF-8" %>
+<!DOCTYPE html>
+<html>
+<head>
+    <meta http-equiv="X-UA-Compatible" content="IE=edge,requiresActiveX=true" charset="UTF-8" />
+    <title>Prison-NOMIS Reporting</title>
+    <link rel="shortcut icon" type="image/x-icon" href="InfoView.ico" />
+    <link rel="stylesheet" href="browsercheck.css">
+</head>
+<body>
+    <div class="BILP-launchpadbackground">
+        <div class="divCenter">
+            Prison-NOMIS Reporting is briefly unavailable for maintenance.<br /><br />We apologise for the inconvenience, please try again shortly.
+       </div>
+    </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/root/InfoView.ico b/ansible/roles/onr-tomcat/templates/root/InfoView.ico
new file mode 100644
index 000000000..e69de29bb
diff --git a/ansible/roles/onr-tomcat/templates/root/Unsupported_Browser.html b/ansible/roles/onr-tomcat/templates/root/Unsupported_Browser.html
new file mode 100644
index 000000000..5321dfff5
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/root/Unsupported_Browser.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8" />
+    <title>Prison-NOMIS Reporting - Unsupported Browser</title>
+    <link rel="shortcut icon" type="image/x-icon" href="InfoView.ico" />
+    <link rel="stylesheet" href="browsercheck.css">
+</head>
+<body>
+    <div class="BILP-launchpadbackground">
+        <div class="divCenter">
+            Prison-NOMIS Reporting cannot load in Internet Explorer 8 as it is an unsupported browser.<br />MOJ Citrix Cloud Desktop within Quantum has a later version.
+       </div>
+    </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/root/browsercheck.css b/ansible/roles/onr-tomcat/templates/root/browsercheck.css
new file mode 100644
index 000000000..707cb8a19
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/root/browsercheck.css
@@ -0,0 +1,38 @@
+html,
+body
+{
+	margin: 0;
+	padding: 0;
+	height: 100%;
+
+	font-family: Arial;
+	font-size: 1.0rem !important;
+	font-weight: bold;
+	color: #346187 !important;
+}
+
+.BILP-launchpadbackground
+{
+	/* background-image: url("background.png"); */
+	background-image: linear-gradient(to bottom,#a9c6de,#e7ecf0);
+	opacity: 1;
+	background-repeat: no-repeat;
+	background-position: center;
+	background-size: cover;
+	background-color: #BBD1E3 !important;
+
+	height: 100%;
+}
+
+.divCenter {
+	position: absolute;
+	/* height: 60px;
+	width: 600px; */
+	/* z-index:15; */
+	top: 50%;
+	left: 50%;
+	margin: -30px 0 0 -300px;
+
+	vertical-align: middle;
+	text-align: center;
+}
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/root/browsercheck.js b/ansible/roles/onr-tomcat/templates/root/browsercheck.js
new file mode 100644
index 000000000..ab2126777
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/root/browsercheck.js
@@ -0,0 +1,33 @@
+function init() {
+    var isIELessThan11 = (navigator.userAgent.indexOf("MSIE") >= 0);
+    if (isIELessThan11) {
+        window.location.href = '/Unsupported_Browser.html';
+    }
+    else {
+        document.getElementById("checking").style.display = "none";
+        document.getElementById("supported").style.display = "inline";
+
+        var BIPURL = '/BOE/BI/logon/start.do?ivsLogonToken=';
+        var URL = window.location.href;
+        var qs = getParameterByName('t', URL);
+
+        if (!qs || qs.length === 0) {
+            window.location.href = '/BIlogoff.jsp';
+        } else {
+            //BIPURL = BIPURL + qs;
+            BIPURL = BIPURL + encodeURIComponent(qs);
+            window.location.href = BIPURL;
+        }
+    }
+
+    window.focus();
+}
+
+function getParameterByName(name, url) {
+    name = name.replace(/[\[\]]/g, '\\$&');
+    var regex = new RegExp('[?&]' + name + '(=([^&#]*)|&|#|$)'),
+        results = regex.exec(url);
+    if (!results) return null;
+    if (!results[2]) return '';
+    return decodeURIComponent(results[2].replace(/\+/g, ' '));
+}
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/root/index.jsp b/ansible/roles/onr-tomcat/templates/root/index.jsp
new file mode 100644
index 000000000..050702d99
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/root/index.jsp
@@ -0,0 +1,11 @@
+<%@ page session="false" language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<title>Prison-NOMIS Reporting</title>
+</head>
+<body>
+   <jsp:forward page="BIlogoff.jsp" />
+</body>
+</html>
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/root/keepalive.htm b/ansible/roles/onr-tomcat/templates/root/keepalive.htm
new file mode 100644
index 000000000..93adabc3e
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/root/keepalive.htm
@@ -0,0 +1,6 @@
+<html>
+<head>
+<title>Keepalive - NOMIS Reporting</title>
+</head>
+<body>Keepalive - NOMIS Reporting</body>
+</html>
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/server.xml b/ansible/roles/onr-tomcat/templates/server.xml
new file mode 100644
index 000000000..25288363d
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/server.xml
@@ -0,0 +1,157 @@
+?xml version="1.0" encoding="UTF-8"?><!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+--><!-- Note:  A "Server" is not itself a "Container", so you may not
+     define subcomponents such as "Valves" at this level.
+     Documentation at /docs/config/server.html
+ --><Server port="8005" shutdown="SHUTDOWN">
+  <Listener className="org.apache.catalina.startup.VersionLoggerListener"/>
+  <!-- Security listener. Documentation at /docs/config/listeners.html
+  <Listener className="org.apache.catalina.security.SecurityListener" />
+  -->
+  <!-- APR library loader. Documentation at /docs/apr.html -->
+  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on"/>
+  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
+  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
+  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
+  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
+
+  <!-- Global JNDI resources
+       Documentation at /docs/jndi-resources-howto.html
+  -->
+  <GlobalNamingResources>
+    <!-- Editable user database that can also be used by
+         UserDatabaseRealm to authenticate users
+    -->
+    <Resource name="UserDatabase" auth="Container" type="org.apache.catalina.UserDatabase" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" pathname="conf/tomcat-users.xml"/>
+  </GlobalNamingResources>
+
+  <!-- A "Service" is a collection of one or more "Connectors" that share
+       a single "Container" Note:  A "Service" is not itself a "Container",
+       so you may not define subcomponents such as "Valves" at this level.
+       Documentation at /docs/config/service.html
+   -->
+  <Service name="Catalina">
+
+    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
+    <!--
+    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
+        maxThreads="150" minSpareThreads="4"/>
+    -->
+
+
+    <!-- A "Connector" represents an endpoint by which requests are received
+         and responses are returned. Documentation at :
+         Java HTTP Connector: /docs/config/http.html
+         Java AJP  Connector: /docs/config/ajp.html
+         APR (HTTP/AJP) Connector: /docs/apr.html
+         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
+    -->
+    <Connector port="7777" protocol="HTTP/1.1" connectionTimeout="20000" relaxedQueryChars="[,]" redirectPort="8443" compression="on" URIEncoding="UTF-8" compressionMinSize="2048" noCompressionUserAgents="gozilla, traviata" compressibleMimeType="application/vnd.sap.cvom+vbo,text/html,text/xml,text/plain,text/css,text/javascript,text/json,application/javascript,application/json"/>
+    <!-- A "Connector" using the shared thread pool-->
+    <!--
+    <Connector executor="tomcatThreadPool"
+               port="8080" protocol="HTTP/1.1"
+               connectionTimeout="20000"
+               redirectPort="8443" />
+    -->
+    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
+         This connector uses the NIO implementation. The default
+         SSLImplementation will depend on the presence of the APR/native
+         library and the useOpenSSL attribute of the AprLifecycleListener.
+         Either JSSE or OpenSSL style configuration may be used regardless of
+         the SSLImplementation selected. JSSE style configuration is used below.
+    -->
+    <!--
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
+               maxThreads="150" SSLEnabled="true">
+        <SSLHostConfig>
+            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
+                         type="RSA" />
+        </SSLHostConfig>
+    </Connector>
+    -->
+    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
+         This connector uses the APR/native implementation which always uses
+         OpenSSL for TLS.
+         Either JSSE or OpenSSL style configuration may be used. OpenSSL style
+         configuration is used below.
+    -->
+    <!--
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
+               maxThreads="150" SSLEnabled="true" relaxedQueryChars="[,]">
+        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
+        <SSLHostConfig>
+            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
+                         certificateFile="conf/localhost-rsa-cert.pem"
+                         certificateChainFile="conf/localhost-rsa-chain.pem"
+                         type="RSA" />
+        </SSLHostConfig>
+    </Connector>
+    -->
+
+    <!-- Define an AJP 1.3 Connector on port 8009 -->
+    <!--
+    <Connector protocol="AJP/1.3"
+               address="::1"
+               port="8009"
+               redirectPort="8443" />
+    -->
+
+    <!-- An Engine represents the entry point (within Catalina) that processes
+         every request.  The Engine implementation for Tomcat stand alone
+         analyzes the HTTP headers included with the request, and passes them
+         on to the appropriate Host (virtual host).
+         Documentation at /docs/config/engine.html -->
+
+    <!-- You should set jvmRoute to support load-balancing via AJP ie :
+    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
+    -->
+    <Engine name="Catalina" defaultHost="localhost">
+
+      <!--For clustering, please take a look at documentation at:
+          /docs/cluster-howto.html  (simple how to)
+          /docs/config/cluster.html (reference documentation) -->
+      <!--
+      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+      -->
+
+      <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+           via a brute-force attack -->
+      <Realm className="org.apache.catalina.realm.LockOutRealm">
+        <!-- This Realm uses the UserDatabase configured in the global JNDI
+             resources under the key "UserDatabase".  Any edits
+             that are performed against this UserDatabase are immediately
+             available for use by the Realm.  -->
+        <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
+      </Realm>
+
+      <Host name="localhost" appBase="/u01/app/bobj/BIP4/sap_bobj/tomcat/webapps" unpackWARs="true" autoDeploy="true">
+
+        <!-- SingleSignOn valve, share authentication between web applications
+             Documentation at: /docs/config/valve.html -->
+        <!--
+        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
+        -->
+
+        <!-- Access log processes all example.
+             Documentation at: /docs/config/valve.html
+             Note: The pattern used is equivalent to using pattern="common" -->
+        <!--<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
+               prefix="localhost_access_log" suffix=".txt"
+               pattern="%h %l %u %t &quot;%r&quot; %s %b" />-->
+      </Host>
+    </Engine>
+  </Service>
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/setenv.sh b/ansible/roles/onr-tomcat/templates/setenv.sh
new file mode 100644
index 000000000..3df84fbc1
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/setenv.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# Do not remove the line 'source bobjenv.sh' as it is required by the SAP installer and applications.
+. ./bobjenv.sh
+# START USERCONFIG - Enter your user config settings to be retained here
+JAVA_OPTS="$JAVA_OPTS -Xmx4096m -XX:MaxMetaspaceSize=1024m"
+
+# END USERCONFIG
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/u01/app/bobj/BIP4/sap_bobj/init/setupinit.sh b/ansible/roles/onr-tomcat/templates/u01/app/bobj/BIP4/sap_bobj/init/setupinit.sh
new file mode 100644
index 000000000..d700e64ce
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/u01/app/bobj/BIP4/sap_bobj/init/setupinit.sh
@@ -0,0 +1,106 @@
+#!/bin/sh
+# This file copies the rc files and creates the proper symlinks.
+# This can only be done by root.
+
+USERNAME=`id | sed -e "s|).*\$||" -e "s|^.*(||" `
+if [ "$USERNAME" != "root" ]; then
+        echo "Log in as root and run in order to set up the init scripts. (STU00136)"
+        exit 0
+fi
+
+errorExit()
+{
+        echo $1
+        exit 1
+}
+
+chown root "/u01/app/bobj/BIP4/sap_bobj/init/SAPBOBJEnterpriseXI40" || errorExit "System initialization scripts failed. (STU00131)"
+
+SOFTWARE=`uname -s`
+case X"$SOFTWARE" in
+XSunOS)
+        if [ -f "/etc/init.d/SAPBOBJEnterpriseXI40" ]; then
+                rm -rf "/etc/init.d/SAPBOBJEnterpriseXI40"
+                mv -f "/u01/app/bobj/BIP4/sap_bobj//init/SAPBOBJEnterpriseXI40" "/etc/init.d/SAPBOBJEnterpriseXI40" || errorExit "System initialization scripts failed. (STU00131)"
+                exit 0
+        fi
+
+    mv -f "/u01/app/bobj/BIP4/sap_bobj//init/SAPBOBJEnterpriseXI40" "/etc/init.d/SAPBOBJEnterpriseXI40" || errorExit "System initialization scripts failed. (STU00131)"
+    cd /etc/init.d || errorExit "System initialization scripts failed. (STU00131)"
+    ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc3.d/S99SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+    ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc1.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+    ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc0.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+;;
+XLinux)
+        if [ -f "/etc/init.d/SAPBOBJEnterpriseXI40" ]; then
+                rm -rf "/etc/init.d/SAPBOBJEnterpriseXI40"
+                mv -f "/u01/app/bobj/BIP4/sap_bobj//init/SAPBOBJEnterpriseXI40" "/etc/init.d/SAPBOBJEnterpriseXI40" || errorExit "System initialization scripts failed. (STU00131)"
+                exit 0
+        fi
+
+    mv -f "/u01/app/bobj/BIP4/sap_bobj//init/SAPBOBJEnterpriseXI40" "/etc/init.d/SAPBOBJEnterpriseXI40" || errorExit "System initialization scripts failed. (STU00131)"
+    cd /etc/init.d || errorExit "System initialization scripts failed. (STU00131)"
+    if [ -f "/etc/redhat-release" ]; then
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc0.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc1.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc2.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc3.d/S99SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc4.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc5.d/S99SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ../rc6.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+    else
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ./rc3.d/S99SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ./rc5.d/S99SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ./rc3.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+            ln -s /etc/init.d/SAPBOBJEnterpriseXI40 ./rc5.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+        insserv -v SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+    fi
+
+;;
+XAIX)
+        if [ -f "/etc/SAPBOBJEnterpriseXI40" ]; then
+                rm -rf "/etc/init.d/SAPBOBJEnterpriseXI40"
+                mv -f "/u01/app/bobj/BIP4/sap_bobj/init/SAPBOBJEnterpriseXI40" "/etc/SAPBOBJEnterpriseXI40"
+                exit 0
+        fi
+
+    mkdir -p /etc/SAPBOBJEnterpriseXI40
+    mv -f "/u01/app/bobj/BIP4/sap_bobj/init/SAPBOBJEnterpriseXI40" "/etc/SAPBOBJEnterpriseXI40"
+    if ! grep BobjE140 /etc/inittab >/dev/null; then
+        echo "BobjE140:2:once:/etc/SAPBOBJEnterpriseXI40/SAPBOBJEnterpriseXI40 start > /dev/null 2>&1" >> /etc/inittab
+    fi
+    if [ ! -f "/etc/rc.shutdown" ]; then
+        echo "#!/bin/sh" >> /etc/rc.shutdown
+        chmod 755 /etc/rc.shutdown
+    fi
+    if ! grep SAPBOBJEnterpriseXI40 /etc/rc.shutdown >/dev/null; then
+        echo "/etc/SAPBOBJEnterpriseXI40/SAPBOBJEnterpriseXI40 stop > /dev/null 2>&1" >> /etc/rc.shutdown
+    fi
+;;
+XHP-UX)
+        if [ -f "/sbin/init.d/SAPBOBJEnterpriseXI40" ]; then
+                rm -rf "/sbin/init.d/SAPBOBJEnterpriseXI40"
+                mv -f "/u01/app/bobj/BIP4/sap_bobj//init/SAPBOBJEnterpriseXI40" "/sbin/init.d/SAPBOBJEnterpriseXI40" || errorExit "System initialization scripts failed. (STU00131)"
+                exit 0
+        fi
+
+    mv -f "/u01/app/bobj/BIP4/sap_bobj//init/SAPBOBJEnterpriseXI40" "/sbin/init.d/SAPBOBJEnterpriseXI40" || errorExit "System initialization scripts failed. (STU00131)"
+    cd /sbin/init.d || errorExit "System initialization scripts failed. (STU00131)"
+
+    SNUM=99
+    if [ `uname -m` = "ia64" ]; then
+        SNUM=901
+        while [ "" != "`ls /sbin/rc2.d | grep ^S$SNUM`" -a $SNUM -lt 999 ]; do
+            SNUM=`expr $SNUM + 1` # increment counter
+        done
+    fi
+
+    ln -s /sbin/init.d/SAPBOBJEnterpriseXI40 ../rc2.d/S"$SNUM"SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+    ln -s /sbin/init.d/SAPBOBJEnterpriseXI40 ../rc1.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+    ln -s /sbin/init.d/SAPBOBJEnterpriseXI40 ../rc0.d/K01SAPBOBJEnterpriseXI40 || errorExit "System initialization scripts failed. (STU00131)"
+;;
+esac
+
+echo "System initialization scripts created."
+
+# EOF
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/u02/software/BIP_4_3_SP1/prereq_checks.ini b/ansible/roles/onr-tomcat/templates/u02/software/BIP_4_3_SP1/prereq_checks.ini
new file mode 100644
index 000000000..9c0797307
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/u02/software/BIP_4_3_SP1/prereq_checks.ini
@@ -0,0 +1,6 @@
+# This is a sample response file.
+# For full instructions on customizing it to suit your environment, please consult the Install Guide.
+
+# InstallDir requires a trailing slash
+InstallDir=/u01/app/bobj/BIP4
+SetupUILanguage=en
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/u02/software/BIP_4_3_SP1/tomcat_admin_response.ini b/ansible/roles/onr-tomcat/templates/u02/software/BIP_4_3_SP1/tomcat_admin_response.ini
new file mode 100644
index 000000000..dbc76bd0a
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/u02/software/BIP_4_3_SP1/tomcat_admin_response.ini
@@ -0,0 +1,153 @@
+## Choose to Integrate Introscope Enterprise Manager: integrate or 
+nointegrate
+chooseintroscopeintegration=nointegrate
+
+### Installation Directory
+installdir=/u01/app/bobj/BIP4/
+
+### Choose install type: default, custom, webtier
+installtype=webtier
+
+### Product Keycode
+productkey=********
+
+### Remote CMS administrator name
+remotecmsadminname=Administrator
+
+### Remote CMS administrator password
+remotecmsadminpassword=********
+
+### Remote CMS name
+remotecmsname=
+
+### Remote CMS port
+remotecmsport=6400
+
+requiredspace=17958
+
+### Language Packs Selected to Install
+selectedlanguagepacks=en
+
+### Setup UI Language
+setupuilanguage=en
+
+### Tomcat connection port
+tomcatconnectionport=7777
+
+### Tomcat redirect port
+tomcatredirectport=8443
+
+### Tomcat shutdown port
+tomcatshutdownport=8005
+
+### Available features
+### ------------------
+### root
+###   WebTier
+###     JavaWebApps1
+###     MobileServices
+###       MobileServers
+###       MobileAddon
+###     IntegratedTomcat
+###   Servers
+###     PlatformServers
+###       CMS
+###       FRS
+###       PlatformServers.IntegratedDB.SQLAnywhere
+###       PlatformServers.EventServer
+###       PlatformServers.WebAppContainerService
+###       AdaptiveProcessingServer
+###       AdaptiveJobServer
+###       Platform.RestWebService
+###       Platform.Action.Framework.backend
+###       Subversion
+###     ConnectionServices
+###       ConnectionProcService
+###     DataFederatorServices
+###       DataFederatorQueryService
+###     AdvancedAnalysisServices
+###       MultidimensionalAnalysisServices
+###       BExWebApplicationsService
+###     CrystalReportsServers
+###       CrystalReportsProcServices
+###       CrystalReportSchedulingServices
+###     WebIServers
+###       WebIProcServer
+###       WebISchedulingServices
+###     XcelsiusServers
+###       BWPublisherServerUNIX
+###     ExtAuth
+###       ExtAuth.JDEdwards
+###       ExtAuth.Peoplesoft
+###       ExtAuth.OracleEBS
+###       ExtAuth.SAPR3
+###   AdministratorTools
+###     Automation.Framework
+###     PromotionManagementWizard
+###     MultitenancyManager
+###   DeveloperTools
+###     SL_SDK
+###       SL_SDK_java
+###       SL_SDKSamples
+###     WebI_REST_samples
+###     SPL_Warehouse
+###   DataAccess
+###     DataAccess.DataFederator
+###     DataAccess.HPVertica
+###     DataAccess.MySQL
+###     DataAccess.GenericJDBC
+###     DataAccess.GenericOLEDB
+###     DataAccess.OptionalDataDirectODBC.DataDirect7.1
+###     DataAccess.MaxDB
+###     DataAccess.SQLite
+###     DataAccess.SAPHANA
+###     DataAccess.Snowflake
+###     DataAccess.PrestoDB
+###     DataAccess.TrinoDB
+###     DataAccess.MariaDB
+###     DataAccess.MongoDB
+###     DataAccess.Athena
+###     DataAccess.Denodo
+###     DataAccess.Salesforce
+###     DataAccess.Netezza
+###     DataAccess.Microsoft_AnalyticalServices
+###     DataAccess.MicrosoftExchange
+###     DataAccess.MicrosoftOutlook
+###     DataAccess.Microsoft_SQLServer
+###     DataAccess.Microsoft_Access
+###     DataAccess.Greenplum
+###     DataAccess.PostgreSQL
+###     DataAccess.Progress
+###     DataAccess.IBMDB2
+###     DataAccess.Informix
+###     DataAccess.Oracle
+###     DataAccess.Sybase
+###     DataAccess.Teradata
+###     DataAccess.SAPBW
+###     DataAccess.SAPERP
+###     DataAccess.XMLWebServices
+###     DataAccess.OData
+###     DataAccess.PersonalFiles
+###     DataAccess.JavaBean
+###     DataAccess.OpenConnectivity
+###     DataAccess.BigQuery
+###     DataAccess.HadoopHive
+###     DataAccess.Amazon
+###     DataAccess.Spark
+###     DataAccess.Hortonworks
+###     DataAccess.Essbase
+###     DataAccess.Universe
+###     DataAccess.MyCube
+###     DataAccess.XML
+###     DataAccess.ADO.NET
+###     DataAccess.COMData
+###     DataAccess.DataSet
+###     DataAccess.SymantecACT
+###     DataAccess.FieldDefinitions
+###     DataAccess.FileSystem
+###     DataAccess.NTEventLog
+###     DataAccess.WebActivityLog
+###     DataAccess.dBase.DataDirect7.1
+###     DataAccess.CMSDBDriver
+###   Samples
+features=JavaWebApps1,MobileAddon,IntegratedTomcat
\ No newline at end of file
diff --git a/ansible/roles/onr-tomcat/templates/wdeploy.conf b/ansible/roles/onr-tomcat/templates/wdeploy.conf
new file mode 100644
index 000000000..3d4e07a27
--- /dev/null
+++ b/ansible/roles/onr-tomcat/templates/wdeploy.conf
@@ -0,0 +1,29 @@
+##
+## Business Objects Configuration Utility for WDeploy
+##
+
+# Lang: The language setting for WDeploy UI Preferential order for WDeploy UI to load language setting
+as_lang=en
+
+# work_dir: To store the deployable war files/static resources generated by the WDeploy predeploy/predeployall command
+work_dir=
+
+# war_dir: Generic war file location (Ensure all the generic war files are in the same location)
+war_dir=
+
+# app_source_tree: Global parameter for all web application source tree (Ensure all the web applications source tree folders are in the same location)
+app_source_tree=
+
+# To Enable/Disable CMC or InfoView(BI Launch Pad) web application
+disable_CmcApp=false
+disable_InfoView=true
+
+# This parameter is used to include or exclude JCO related libraries for SAP and Non-SAP web application server deployment
+# Default value is blank.
+JCoStandalone=
+
+# root_context_path: The root context path on web application server to deploy to.
+root_context_path=
+
+# recent_app_svr: the most recent app server that used to deploy BO web apps.
+recent_app_svr=Tomcat 9.0
\ No newline at end of file