Chat now with support
Chat with Support

Identity Manager 9.2 - Installation Guide

About this guide One Identity Manager overview Installation prerequisites Installing One Identity Manager Installing and configuring the One Identity Manager Service Automatic updating of One Identity Manager Updating One Identity Manager Installing additional modules for a existing One Identity Manager installation Installing and updating an application server Installing the API Server Installing, configuring, and maintaining the Web Designer Web Portal Installing and updating the Manager web application Logging in to One Identity Manager tools Troubleshooting Advanced configuration of the Manager web application Machine roles and installation packages Configuration parameters for the email notification system How to configure the One Identity Manager database using SQL Server AlwaysOn availability groups

Installing application servers

IMPORTANT: Start the application server installation locally on the server.

NOTE: On Linux operating systems, use of oneidentity/oneim-appserver docker images is recommended.

To install an application server

  1. Launch autorun.exe from the root directory of the One Identity Manager installation medium.

  2. On the installation wizard's home page, perform the following actions:

    1. Change to the Installation tab.

    2. In the Web-based components pane, click Install.

    This starts the Web Installer.

  3. Select Install application server on the Web Installer and click Next.

  4. On the Database connection page, perform the following actions.

    • To use an existing connection to the One Identity Manager database, select it in the Select a database connection menu.

      - OR -

    • To create a new connection to the One Identity Manager database, click Add new connection and enter a new connection.

  5. Select the authentication method and, under Authentication method, enter the login data for the database.

  6. Configure the following settings on the Select setup target page.

    Table 27: Settings for the installation target
    Setting Description

    Application name

    Enter the name to use in the browser as the application name.

    Target in IIS

    Select the website on the Internet Information Services where the application is installed.

    Enforce SSL

    Specifies whether secure or insecure websites are available to install.

    If the option is set, only sites secured by SSL can be used for installing. This setting is the default value.

    If this option is not set, insecure websites can be used for installing.

    URL

    Enter the application's URL.

    Install dedicated application pool

    Enable this option if you want to install a separate application pool for each application. This allows applications to be set up independently of one another. If this option is set, each application is installed in its own application pool.

    Application pool

    Select the application pool to use. This can only be entered if the Install dedicated application pool option is not set.

    If you use the DefaultAppPool default value, the application pool has the following syntax:

    <application name>_POOL

    Identity

    Specify the permissions for implementing the application pool. You can use a default identity or a custom user account.

    If you use the ApplicationPoolIdentity default value, the user account has the following syntax:

    IIS APPPOOL\<application name>_POOL

    You can authorize another user by clicking ... next to the box, enabling the option Custom account and entering the user and password.

    Assign file permissions for application pool identity

    Specify whether the identity that the application pool was running with obtains the file permissions.

    Web authentication

    Specify which type of authentication to use against the web application. You have the following options:

    • Windows authentication (single sign-on)

      The user is authenticated against the Internet Information Services using their Windows user account and the web application logs in the identity assigned to the user account as role-based. If single sign-on is not possible, the user is diverted to a login page. You can only select this authentication method if Windows authentication is installed.

    • Anonymous

      Login is possible without Windows authentication. The user is authenticated against the Internet Information Services and the web application anonymously, and the web application is directed to a login page.

    Database authentication

    NOTE: You can only see this section if you have selected an SQL database connection on the Database connection page.

    Specify which type of authentication to use against the One Identity Manager database. You have the following options:

    • Windows authentication

      The web application is authenticated against the One Identity Manager database with the same Windows user account that your application pool uses. Login is possible with a user-defined user account or a default identity for the application pool.

    • SQL authentication

      Authentication is completed with a SQL Server login and password. The SQL Server login from the database connection is used. Use the [...] button to enter a different SQL login, for example, if the application is run with a access level for end users. This access data is saved in the web application configuration as computer specific encrypted.

  7. On the Assign machine roles page, define the machine roles.

    This enables the machine roles for the application server. The machine roles Search Service and Search Indexing Service are required for indexing the full text search. These machine roles are always used together.

    NOTE: If you want to use a Web Portal, you will need to use an application server with a search service installed.

  8. On the Set session token certificate page, select the certificate for creating and checking session tokens.

    NOTE: The certificate must have a key length of at least 1024 bits.

    • To use an existing certificate, set the following:

      1. Session token certificate: Select the Use existing certificate entry.

      2. Select certificate: Select the certificate.

        NOTE: It is strongly recommended to use the certificate already in use in other application servers and API Servers.

    • To create a new certificate, set the following:

      1. Session token certificate: Select the Create new certificate entry.

      2. Certificate issuer: Enter the issuer of the certificate.

      3. Key length: Specify the key length for the certificate.

      The certificate is entered in the application server's certificate management.

      NOTE: It is strongly recommended to export this newly created certificate and use it in other application servers and API Servers as well, so that all these server components have and use the identical session certificate.

    • To create a new certificate file, set the following:

      1. Session token certificate: Select the Generate new certificate file entry.

      2. Certificate issuer: Enter the issuer of the certificate.

      3. Key length: Specify the key length for the certificate.

      4. Certificate file: Enter the directory path and name of the certificate file.

      The certificate file is stored in the specified directory of the web application.

      NOTE: It is strongly recommended to use this newly created certificate in other application servers and API Servers as well, so that all these server components have and use the identical session certificate.

  9. Specify the user account for automatic updating on the Set update credentials page. The user account is used to add or replace files in the application directory.

    • Use IIS credentials for update: Set this option to use the user account under which the application pool is run for the updates.

    • Use other credentials for updates: To use a different user account, set this option. Specify the domain, the user name, and the user password.

  10. (Optional) The One Identity Manager History Database is used to provide archived data for analyzing in reports and the TimeTrace. If you access the One Identity Manager History Database is through an application server, on the Edit History Database connections page, enter the One Identity Manager History Database ID and the connection parameters.

    NOTE: You can enter the One Identity Manager History Database‘s connection parameters at a later date. Use the configuration file (web.config) to do this.

    For more information about connecting to the One Identity Manager History Database through an application server and the required configuration, see the One Identity Manager Data Archiving Administration Guide.

  11. Installation progress is displayed on the Setup is running page. After installation is complete, click Next.

  12. Click Finish on the last page to end the program.

  13. Close the autorun program.

NOTE: The Web Installer generates both the web application and the configuration file (web.config). The Web Installer uses default values for the configuration settings. You can keep these values but it is recommended you check the settings. You will find the configuration file (web.config) in the web application directory in the Internet Information Services.

Related topics

Displaying application servers' status

You can access the application server from a browser.

Use the appropriate URL for this:

http://<server name>/<application name>

https://<server>/<application name>

TIP: You can open the web server's status display in the Job Queue Info. In the Job Queue Info, select View > Server state in the menu and, on the Web servers tab, open the web server status display from the Open in browser context menu.

You will see different status information. Status information for the application server is displayed as performance indicators. Users with the AppServer_Logs program function see the log.

In addition, API documentation is available here. To access the REST API in the application server, users require the AppServer_API program function. For more information about the REST API, see the One Identity Manager REST API Reference Guide

Installing or uninstalling a search service for full-text search

To use the Web Portal or full-text search in the Manager, you need an application server with a search service installed on it. You usually set up the machine roles for search indexing for full-text search when you install an application server.

If necessary, you can install the machine roles at a later date. If necessary you can uninstall the machine roles again. Customize the application server installation.

To install the search server on an application server at a later date

  1. Launch autorun.exe from the root directory of the One Identity Manager installation medium.

  2. On the installation wizard's home page, perform the following actions:

    1. Click Installation.

    2. In the Web-based components pane, click Install.

    Starts the Web Installer.

  3. On the Web Installer home page, click Modify application server installation and click Next.

  4. On the Installation source page, select the application server instance that you want to customize.

  5. On the Database connection page, select the database connection and authentication method.

  6. On the Assign machine roles page, enable the Search Service and Search Indexing Service machine roles.

  7. Installation progress is displayed on the Setup is running page. After installation is complete, click Next.

  8. Click Finish on the last page to end the program.

  9. Close the autorun program.

To uninstall the search server on an application server

  1. Launch autorun.exe from the root directory of the One Identity Manager installation medium.

  2. On the installation wizard's home page, perform the following actions:

    1. Click Installation.

    2. In the Web-based components pane, click Install.

    Starts the Web Installer.

  3. On the Web Installer home page, click Modify application server installation and click Next.

  4. On the Installation source page, select the application server instance that you want to customize.

  5. On the Database connection page, select the database connection and authentication method.

  6. On the Assign machine roles page, disable the Search Service and Search Indexing Service machine roles.

  7. Installation progress is displayed on the Setup is running page. After installation is complete, click Next.

  8. Click Finish on the last page to end the program.

  9. Close the autorun program.

Related topics

Updating the search index on application servers

The searched index is updated when changes are made to a table with indexed columns, to referenced tables or translations.

Use the Common | Indexing | BatchSize configuration parameter to define the maximum number of objects that can be indexed in a single indexing run. The default value is 50000.

The Common | Indexing | Interval configuration parameter contains the interval between two indexing runs. The default value is 120 seconds. Once this time interval has elapsed, a new indexing run is started.

You can also update the search index manually.

To manually update the search index on the application server:

  1. Open the status page for the application server in the browser.

  2. In the menu for the currently logged-in user, click Update Index.

  3. Select one of the following options:

    • All values: Updates all indexes.

    • Only changed values: Only updates changed indexes.

    • Optimize index: Optimizes the search index.

Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating