To install One Identity Manager tools on a Windows terminal server, you need to ensure that the Windows terminal server has been fully installed and configured. This includes profile handling in particular as well as permissions for Windows terminal server use.
NOTE: Ensure that in an Active Directory Domain, the users themselves also have the relevant permissions to use the Windows terminal server.
To install One Identity Manager components on a Windows terminal server:
-
Log in with a user account that has administrator permissions on the Windows terminal server.
Logging in using a console connection is recommended. You can use the following calling syntax:
Start/run: mstsc /Console /v:<server name>
with:
<server name>: Name of the terminal server (without leading "\")
-
Open the command line console (CMD.exe) and switch the Windows terminal server into software installation mode. You can do this with the following command line call:
CHANGE USER /INSTALL
-
Start the installation wizard and install the One Identity Manager components as described.
-
End the software installation mode on the Windows terminal server. You can do this with the following command line call:
CHANGE USER /EXECUTE
After the installation is complete, anyone who is an authorized Windows terminal server user can start the One Identity Manager tools and use them.
For more information about software installation on Windows terminal servers, refer to the Windows operating system documentation you are using.
Related topics
To set up the One Identity Manager database, use the Configuration Wizard. The Configuration Wizard runs the following steps.
-
Installs the One Identity Manager schema in a database.
The Configuration Wizard can create a new database and install the One Identity Manager schema. Alternatively, the One Identity Manager schema can be installed in an existing database.
-
Creates the required SQL Server logins and database users permissions for the administrative user, configuration user, and end user.
-
Creates administrative system users and permissions groups.
-
Encrypts the database.
-
Installs and configures a One Identity Manager Service with direct access to the database for handling SQL processes and automatic server software updates.
-
(Optional) Install and configure the Database Agent Service.
The Database Agent Service controls processing of DBQueue Processor tasks. The Database Agent Service is deployed through the One Identity Manager Service plugin.
IMPORTANT: This is an EXPERIMENTAL function. The performance impact on production systems has not been determined. Therefore this feature is not yet covered by support. However, you are welcome to try it (preferably in non-production systems) and if you have any feedback, send it to OneIM.Beta@oneidentity.com.
NOTE: Additional steps are run in One Identity Manager depending on the Edition and Configuration Wizard modules.
Additional steps are required to configure the One Identity Manager database following the schema installation:
-
Configure the database for a test, a development, or a live system.
-
Other system settings may be required for putting individual functions into operation in One Identity Manager.
Use configuration parameters to configure the behavior of the system's basic settings. One Identity Manager provides default settings for different configuration parameters. Check the configuration parameters and modify them as necessary to suit your requirements.
Configuration parameters are defined in the One Identity Manager modules. Each One Identity Manager module can also install configuration parameters. In the Designer, you can find an overview of all configuration parameters in the Base data > General > Configuration parameters category.
-
In certain circumstances, it is necessary to store encrypted information in the One Identity Manager database. If you did not encrypt the database when you installed with the Configuration Wizard, use the Crypto Configuration program to encrypt.
-
You can log changes to data and information from process handling in One Identity Manager. All entries logged in One Identity Manager are initially saved in the One Identity Manager database. The proportion of historical data to total volume of a One Identity Manager database should not exceed 25 percent. Otherwise, performance problems may arise. You must ensure that log entries are regularly removed from the One Identity Manager database and archived.
For more information about process monitoring and process history, see the One Identity Manager Configuration Guide. For more information about archiving data, see the One Identity Manager Data Archiving Administration Guide.
Detailed information about this topic
Related topics
IMPORTANT: Always start the Configuration Wizard on an administrative workstation. If you start the Configuration Wizard on a server on which you also want to configure a One Identity Manager Service, simply skip the section for installing the service on the local server in the Configuration Wizard.
To install a database in the Configuration Wizard
-
Start the Configuration Wizard.
-
On the Configuration Wizard's home page, select the Create and install a new database option and click Next.
-
To install a new database, enter the following database connection data on the Create administrative connection page.
-
Server: Database server.
-
(Optional) Windows Authentication: Specifies whether the integrated Windows authentication is used. This type of authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication.
-
User: SQL Server Login name of the installation user.
-
Password: Password for the installation user.
- OR -
On the Create administrative connection page, carry out the following steps to use an existing empty database.
-
Enable Advanced.
-
In the Advanced options pane, set the Use an existing, empty database for installation option.
-
Enter the following connection data for the database.
-
Server: Database server.
-
(Optional) Windows Authentication: Specifies whether the integrated Windows authentication is used. This type of authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication.
-
User: The user's SQL Server login name.
-
Password: Password for the user's SQL Server login.
-
Database: Select the database.
-
If you are creating a new database, perform the following tasks on the Create database page.
-
In the Database properties view, enter the following information about the database.
Table 15: Database properties
|
Database name |
Name of the database. |
|
Data directory |
Directory in which the data file is created. You have the following options:
-
<default>: The database server’s default directory.
-
<browse>: Select a directory using the file browser.
-
<directory name>: Directory in which data files are already installed. |
|
Log directory |
Directory in which the transaction log file is created. You have the following options:
-
<default>: The database server’s default directory.
-
<browse>: Select a directory using the file browser.
-
<directory name>: Directory in which transaction log files are already installed. |
|
Memory tables directory |
Directory for data file group and database file for memory-optimized tables. You have the following options:
-
<default>: The database server’s default directory.
-
<browse>: Select a directory using the file browser.
-
<Directory name>: Directory in which data files for memory-optimized tables are already installed. |
|
Initial size |
Initial size of the database files. You have the following options:
-
<Default>: Default entry for the database server.
-
<custom>: User-defined entry.
-
Different recommended sizes: Depending on the number of employees being administrated. |
-
In the Installation source pane, select the directory with the installation files.
- OR -
If you are using an existing database, on the Create database page, Installation source view, select the directory containing the installation files.
-
On the Select configuration module page, select the configuration module .
- If you started the from the install wizard, the configuration modules for the selected edition are already activated. In this case, check over the module selection.
- Select the configuration module at this point if you started the Configuration Wizard directly. Dependent configuration modules are selected automatically.
-
On the Select agent for processing page, specify which agent processes the internal database tasks.
-
Database Agent Service: Internal tasks are processed by the Database Agent Service. Ensure that the Database Agent Service is installed and configured. The Database Agent Service is deployed through the One Identity Manager Service plugin.
IMPORTANT: This is an EXPERIMENTAL function. The performance impact on production systems has not been determined. Therefore this feature is not yet covered by support. However, you are welcome to try it (preferably in non-production systems) and if you have any feedback, send it to OneIM.Beta@oneidentity.com.
-
SQL Server Agent: The internal tasks are processed by the SQL Server agent. This creates the required database schedules. Ensure that the SQL Server agent is started.
-
Error that prevent processing the database are displayed on the Database check page. Correct the errors before you continue with the installation.
-
On the Create a new login for administrators page, decide which SQL server login to use for administrative users. You have the following options:
-
Create new SQL Server logins for the database: Select this option if you want to work with granular permissions.
This sets up a new administrative login on the SQL Server.
Later on in the process, the Configuration Wizard sets up additional SQL Server logins for the configuration user and the end user.
-
Use an existing SQL Server login: Select this option if you have already created an administrative SQL Server login and want to use this. Later on in the process, the Configuration Wizard sets up additional SQL Server logins for the configuration user and the end user.
-
Enter the login name, password, and password confirmation for the SQL Server login.
-
Set the Permissions option so that the SQL Server login obtains permissions for the database. If this option is not set, only the permissions are tested.
-
Use the current SQL Server login for the database: When you select this option, no additional SQL Server logins are created for the database. In this case, you cannot work with the granular permissions concept at SQL level. The user you specified is used to connect to the database.
-
The installation steps are shown on the Processing database page.
Installation and configuration of the database are automatically carried out by the Configuration Wizard. This procedure may take some time depending on the amount of data and system performance. Once processing is complete, click Next.
TIP: Set Advanced to obtain detailed information about processing steps and the migration log.
-
On the Create SQL server logins page, enter the login name, the password, and password confirmation for the SQL Server logins for configuration users and end users.
NOTE: The password must meet the Windows policy requirements for passwords.
-
On the System information page, enter the customer information and create administrative system users for One Identity Manager.
-
In the Customer information view, enter the full name of the company.
-
In the System user view, configure the predefined administrative system users and enter your own administrative system users.
-
Enter a password and password confirmation for the predefined system users.
-
To create customer-specific system users, click the 
button and enter the name, password, and password confirmation.
TIP: Use the <...> button next to the name of a system user to configure additional settings for that system user. You can also adjust these settings in the Designer at a later time.
-
(Optional) Create custom permissions groups.
The Configuration Wizard creates custom permissions groups, which you can use to define permissions for any custom schema extensions you require.
-
For non role-based login, the CCCViewPermissions and CCCEditPermissions are created permission groups. Administrative system users are automatically added to these permissions groups.
-
For role-based login, the CCCViewRole and CCCEditRole permission groups are created.
To create more permissions groups
-
Enable the Advanced option and in the Permissions groups view, click the button.
-
Enter the name of the permissions group. Label custom permission groups with the prefix CCC.
-
For role-based permissions groups, enable the Role-based option.
-
On the Enable database encryption page, select one of the following options:
-
Skip database encryption: The database is not encrypted. You can encrypt the database at later date using the Crypto Configuration program.
-
Enable database encryption: The database is encrypted in the next step.
-
In the Private key field, enter the name of the key file (default: private.key).
-
Click New and, using the file browser, select the where you want to store the key file.
-
Click Save.
This generates the key file (*.key). The file browser is closed. The path and file name are displayed under Private key.
-
Confirm that you have saved the key file.
Take the Tips for working with an encrypted One Identity Manager database into account.
-
On the Service installation page, you can create a Job server for the server on which the One Identity Manager database is installed.
NOTE: If you do not want to set up a Job server with the One Identity Manager Service at this stage, select the Skip service installation option.
-
In the Installation data pane, enter the following data for installing the One Identity Manager Service.
-
Computer: Enter the name or IP address of the server that the service is installed and started on.
-
Service account: Enter the details of the user account that the One Identity Manager Service is running under. Enter the user account, the user account's password and password confirmation.
The service is installed using the user account with which you are logged in to the administrative workstation. If you want to use another user account for installing the service, you can enter it in the advanced options. You can also change other One Identity Manager Service details in the advanced options, such as the installation directory, name, display name, and the One Identity Manager Service description.
-
In the Machine roles pane, select the machine role for the service. The Job server machine role is defined by default. You can add more machine roles.
-
(Optional) Enable the Advanced option and, in the Configuration pane, check the configuration of the One Identity Manager Service.
NOTE: The initial service configuration is predefined already. If additional changes need to be made to the configuration, you can do this later with the Designer. For more information about configuring the One Identity Manager Service, see the One Identity Manager Configuration Guide.
-
Click Next to start installing the service.
Installation of the service occurs automatically and may take some time.
NOTE: In a default installation, the service is entered in the server’s service management with the name One Identity Manager Service.
-
On the last page of the Configuration Wizard, click Finish.
Related topics
