Installation and configuration of the One Identity Manager database is automatically carried out by the Configuration Wizard. The Configuration Wizard can create a new database and install the One Identity Manager schema. Alternatively, the One Identity Manager schema can be installed in an existing database.
The Configuration Wizard performs the following steps when processing the database:
-
Creates the required SQL Server logins and database users with permissions for the administrative user, configuration user and end user. For more information, see Users with granular permission for the One Identity Manager database on an SQL Server.
-
Installs the One Identity Manager schema.
Before the schema installation can take place, the Configuration Wizard tests the database. Error messages are displayed in a separate window. The errors must be corrected manually. The schema installation cannot be started until these are resolved.
All the tables, data types, or database procedures that are required are loaded into the database through migration. The selected editions and configuration modules are enabled. During migration, calculation tasks are queued in the database. These are processed by the DBQueue Processor.
When a schema is installed with the Configuration Wizard, migration date and migration revision are recorded in the database's transport history.
-
Compiles the system.
Scripts, templates, and processes are declared in the database. The System user authentication module with the viadmin system user is used for compilation.
-
Uploads files for automatic software update.
In order to distribute One Identity Manager files using the automatic software updating mechanism, the files are loaded into the One Identity Manager database.
-
Creates administrative system users and permissions groups.
A system user is required for authentication in One Identity Manager. One Identity Manager provides various system users whose permissions are matched to the various tasks. For more information about system users, permissions groups, and granting permissions, see the One Identity Manager Authorization and Authentication Guide.
The viadmin system user is the default system user in One Identity Manager. This system user can be used to compile and initialize the One Identity Manager database and for the first user login to the administration tools.
IMPORTANT: Do not use the viadmin system user in a live environment. Create your own system user with the appropriate permissions.
Custom system users are created as administrative system users by the Configuration Wizard. Administrative system users are automatically added to all non role-based permissions groups, and are assigned all permissions of the system user viadmin.
-
Installs and configures a One Identity Manager Service with direct access to the database for handling SQL processes and automatic server software updates.
The One Identity Manager Service handles defined processes. The service has to be installed on the One Identity Manager network server to run the processes. The server must be declared as a Job server in the One Identity Manager database.
During the initial schema installation with the Configuration Wizard, in the One Identity Manager database a Job server is already created for the server on which the One Identity Manager database is installed. This Job server receives the server functions SQL processing server and Update server:
The SQL processing server and the update server require a direct connection to the One Identity Manager database to handle processes. Use the Configuration Wizard to install the One Identity Manager Service on a server for handling these processes.
The Configuration Wizard carries out the following steps.
-
Installs the One Identity Manager Service components.
-
Configuring the One Identity Manager Service
-
Starts the One Identity Manager Service.
-
Install and configure the Database Agent Service.
The Database Agent Service controls processing of DBQueue Processor tasks. The Database Agent Service is deployed through the One Identity Manager Service plugin. Alternatively, the Database Agent Service can be run from the DatabaseAgentServiceCmd.exe command line program.
NOTE: If the Database Agent Service is not working, a message is displayed in the status bar in all the administration tools. To see this message, users must have at least the configuration user access level.
Related topics
You use the staging level of the One Identity Manager database to specify whether the database is a test database, development database, or a live database. A number of database settings are controlled by the staging level.
If you change the database's staging level, the following settings are configured.
Table 16: Default settings for development, test, and live environments
|
Color of the One Identity Manager tools status bar |
None |
Green |
Yellow |
|
Maximum DBQueue Processor runtime |
20 minutes |
40 minutes |
120 minutes |
|
Maximum number of slots for the DBQueue Processor |
5 |
7 |
Maximum number of slots according to the hardware configuration |
To modify a database staging level
-
Start the Launchpad and log in to the One Identity Manager database.
-
In the Installation overview pane, select the Database staging level and click Run.
This starts the Designer.
-
In the Designer, select the Base Data > General > Databases category.
-
In the List Editor, select the database.
-
In the edit view, select the General tab.
-
Change the value of the Staging level property to Test environment, Development system, or Production system.
-
Confirm the security prompt with Yes.
-
Select the Database > Save to database and click Save.
The DBQueue Processor default configuration settings are configured for normal operation and do not normally need to be modified.
If several databases are operating in a managed instance in the Azure SQL Database, you can fix the number of slots. In the Designer, adjust the following configuration parameters.
-
QBM | DBServerAgent | CountSlotAgents: Exact number of slots. If the configuration parameter is set, the given number of slots are always set up. There is no internal calculation of the number of slots based on the hardware configuration. Changing the server's configuration has no effect. The value 15 is recommended.
NOTE: This configuration parameter is not recommended for implementing a database on an SQL Server. For implementing a database on an SQL Server, it is standard practice to use the hardware configuration to determine the slots.
The configuration settings are reduced for test environments and development environments because several databases may be located on a server. If it is necessary to change the settings for test environments or development environments for reasons of performance, you must modify the following configuration parameter settings in the Designer.
-
QBM | DBQueue | CountSlotsMax: Maximum number of slots to be used.
Use this configuration parameter to reduce the number of slots if required. Values lower than 5 are not permitted.
Exception: Enter a value of 0 for using the maximum number of slots available based on the hardware configuration.
-
QBM | DBQueue | KeepAlive: Maximum runtime of the central dispatcher. Tasks on slots currently in use are still processed when the timeout expires. Then the slot are stopped and the central dispatcher exits.
The lowest permitted value for runtime is 5 minutes; the maximum permitted value is 720 minutes.
For more information about using the DBQueue Processor, see the One Identity Manager Configuration Guide.
NOTE: It is recommended that you create a backup before encrypting the database information in a database. Then you can restore the previous state if necessary.
In certain circumstances, it is necessary to store encrypted information in the One Identity Manager database: If you did not encrypt the database when you installed with the Configuration Wizard, use the Crypto Configuration program to encrypt. With this program an encryption file is created and the contents of the database columns that are affected are converted.
To change the encryption method
NOTE: If the Common | EncryptionScheme configuration parameter is not set, RSA encryption is used as the method.
Detailed information about this topic
NOTE: It is recommended that you create a backup before encrypting the database information in a database. Then you can restore the previous state if necessary.
To create a new database key and encrypt the One Identity Manager database
-
Start the Launchpad and log in to the One Identity Manager database.
-
In the Installation overview pane, select the Encrypt the database and click Run.
This starts the Crypto Configuration program.
-
Click Next on the home page.
-
On the New database connection page, enter the valid connection credentials for the One Identity Manager database.
-
On the Select action page, select Create or change database key.
-
On the Private key page, select There was no encryption yet.
-
Create a new key on New private key.
-
Click Create key.
-
Select the directory path for saving the file using the file browser and enter a name for the key file.
-
Click Save.
The (*.key) key file is generated. The file browser is closed. The path and filename are displayed under Private key.
-
Click Next.
This establishes which data is encrypted.
-
The date to be encrypted is displayed on the Convert database page.
-
Click Convert.
-
Confirm the following two security questions with Yes.
The data encryption is started. Conversion progress is displayed.
-
Click Next.
-
Click Finish on the last page to end the program.
Related topics
