Chat now with support
Chat with Support

Identity Manager 9.2 - Installation Guide

About this guide One Identity Manager overview Installation prerequisites Installing One Identity Manager Installing and configuring the One Identity Manager Service Automatic updating of One Identity Manager Updating One Identity Manager Installing additional modules for a existing One Identity Manager installation Installing and updating an application server Installing the API Server Installing, configuring, and maintaining the Web Designer Web Portal Installing and updating the Manager web application Logging in to One Identity Manager tools Troubleshooting Advanced configuration of the Manager web application Machine roles and installation packages Configuration parameters for the email notification system How to configure the One Identity Manager database using SQL Server AlwaysOn availability groups

Installing and configuring a One Identity Manager database

IMPORTANT: Always start the Configuration Wizard on an administrative workstation. If you start the Configuration Wizard on a server on which you also want to configure a One Identity Manager Service, simply skip the section for installing the service on the local server in the Configuration Wizard.

To install a database in the Configuration Wizard

  1. Start the Configuration Wizard.

  2. On the Configuration Wizard's home page, select the Create and install database option and click Next.

  3. To install a new database, enter the following database connection data on the Create administrative connection page.

    • Server: Database server.

    • (Optional) Windows Authentication: Specifies whether the integrated Windows authentication is used. This type of authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication.

    • User: SQL Server Login name of the installation user.

    • Password: Password for the installation user.

    - OR -

    To use an existing empty database, on the Create administrative connectionpage, select the Use an existing, empty database for installation option and enter the database connection information.

    NOTE: To install the One Identity Manager schema in an existing database in Azure SQL Database, enable the option and enter the database connection credentials.

    NOTE: To install the One Identity Manager schema in an existing database in Amazon RDS, enable the option and enter the database connection credentials.

    • Server: Database server.

    • (Optional) Windows Authentication: Specifies whether the integrated Windows authentication is used. This type of authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication.

    • User: SQL Server Login name of the installation user.

    • Password: Password for the installation user.

    • Database: Name of the database.

    TIP: To configure additional connection settings, enable the Advanced option.

  4. If you are creating a new database, perform the following tasks on the Create database page.

    1. In the Database properties view, enter the following information about the database.

      Table 17: Database properties
      Data Description

      Database name

      Name of the database.

      Data directory

      Directory in which the data file is created. You have the following options:

      • <default>: The database server’s default directory.

      • <browse>: Select a directory using the file browser.

      • <directory name>: Directory in which data files are already installed.

      Log directory

      Directory in which the transaction log file is created. You have the following options:

      • <default>: The database server’s default directory.

      • <browse>: Select a directory using the file browser.

      • <directory name>: Directory in which transaction log files are already installed.

      Memory tables directory

      Directory for data file group and database file for memory-optimized tables. You have the following options:

      • <default>: The database server’s default directory.

      • <browse>: Select a directory using the file browser.

      • <Directory name>: Directory in which data files for memory-optimized tables are already installed.

      Initial size

      Initial size of the database files. You have the following options:

      • <Default>: Default entry for the database server.

      • <custom>: User-defined entry.

      • Different recommended sizes: Depending on the number of identities being administrated.

    2. In the Installation source pane, select the directory with the installation files.

    - OR -

    If you are using an existing database, on the Create database page, Installation source view, select the directory containing the installation files.

  5. On the Select configuration module page, select the configuration module .

    • If you started the Configuration Wizard from the install wizard, the configuration modules for the selected edition are already activated. In this case, check over the module selection.
    • Select the configuration module at this point if you started the Configuration Wizard directly. Dependent configuration modules are selected automatically.

  6. Error that prevent processing the database are displayed on the Database check page. Correct the errors before you continue with the installation.

  7. On the Create a new login for administrators page, decide which SQL server login to use for administrative users. You have the following options:

    • Create new SQL Server logins for the database: Select this option if you want to work with granular permissions.

      This sets up a new administrative login on the SQL Server.

      • Enter the login name, password, and password confirmation for the new SQL Server login.

      Later on in the process, the Configuration Wizard sets up additional SQL Server logins for the configuration user and the end user.

    • Use an existing SQL Server login: Select this option if you have already created an administrative SQL Server login and want to use this. Later on in the process, the Configuration Wizard sets up additional SQL Server logins for the configuration user and the end user.

      1. Enter the login name, password, and password confirmation for the SQL Server login.

      2. Set the Permissions option so that the SQL Server login obtains permissions for the database. If this option is not set, only the permissions are tested.

    • Use the current SQL Server login for the database: When you select this option, no additional SQL Server logins are created for the database. In this case, you cannot work with the granular permissions concept at SQL level. The user you specified is used to connect to the database.

      NOTE: To install the One Identity Manager schema in an existing database in Amazon RDS, select this option. The granular permissions concept is not supported.

      NOTE: If you want to switch to granular permissions at a later time, contact Support. To access the Support Portal, go to https://support.oneidentity.com/identity-manager/.

  8. The installation steps are shown on the Processing database page.

    Installation and configuration of the database are automatically carried out by the Configuration Wizard. This procedure may take some time depending on the amount of data and system performance. Once processing is complete, click Next.

    TIP: Set Advanced to obtain detailed information about processing steps and the migration log.

  9. On the Create SQL server logins page, enter the login name, the password, and password confirmation for the SQL Server logins for configuration users and end users.

    NOTE: The password must meet the Windows policy requirements for passwords.

  10. On the System information page, enter the customer information and create administrative system users for One Identity Manager.

    1. In the Customer information view, enter the full name of the company.

    2. In the System user view, configure the predefined administrative system users and enter your own administrative system users.

      • Enter a password and password confirmation for the predefined system users.

      • To create customer-specific system users, click the button and enter the name, password, and password confirmation.

      TIP: Use the <...> button next to the name of a system user to configure additional settings for that system user. You can also adjust these settings in the Designer at a later time.

    3. (Optional) Create custom permissions groups.

      The Configuration Wizard creates custom permissions groups, which you can use to define permissions for any custom schema extensions you require.

      • For non role-based login, the CCCViewPermissions and CCCEditPermissions are created permission groups. Administrative system users are automatically added to these permissions groups.

      • For role-based login, the CCCViewRole and CCCEditRole permission groups are created.

      To create more permissions groups

      1. Enable the Advanced option and in the Permissions groups view, click the button.

      2. Enter the name of the permissions group. Label custom permission groups with the prefix CCC.

      3. For role-based permissions groups, enable the Role-based option.

  11. On the Enable database encryption page, select one of the following options:

    • Skip database encryption: The database is not encrypted. You can encrypt the database at later date using the Crypto Configuration program.

    • Enable database encryption: The database is encrypted in the next step.

      1. In the Private key field, enter the name of the key file (default: private.key).

      2. Click New and, using the file browser, select the where you want to store the key file.

      3. Click Save.

        This generates the key file (*.key). This closes the file browser and displays the path and file name under Private key.

      4. Confirm that you have saved the key file.

        Take the Tips for working with an encrypted One Identity Manager database into account.

  12. On the Service installation page, you can create a Job server for the server on which the One Identity Manager database is installed.

    NOTE: If you do not want to set up a Job server with the One Identity Manager Service at this stage, select the Skip service installation option.

    1. In the Installation data pane, enter the following data for installing the One Identity Manager Service.

      • Computer: Select the server, on which you want to install and start the service, from the menu or enter the server's name or IP address.

        To run the installation locally, select Local installation from the menu.

      • Service account: Enter the details of the user account that the One Identity Manager Service is running under. Enter the user account, the user account's password and password confirmation.

      The service is installed using the user account with which you are logged in to the administrative workstation. If you want to use another user account for installing the service, you can enter it in the advanced options.

      You can also change other One Identity Manager Service details in the advanced options, such as the installation directory, name, display name, and the One Identity Manager Service description.

    2. In the Machine roles pane, select the machine role for the service. By default, the Server | Job Server machine role is set. You can add more machine roles.

    3. (Optional) Enable the Advanced option and, in the Configuration pane, check the configuration of the One Identity Manager Service.

      NOTE: The initial service configuration is predefined already. If additional changes need to be made to the configuration, you can do this later with the Designer. For more information about configuring the One Identity Manager Service, see the One Identity Manager Configuration Guide.

    4. Click Next to start installing the service.

      Installation of the service occurs automatically and may take some time.

      NOTE: In a default installation, the service is entered in the server’s service management with the name One Identity Manager Service.

  13. The Processing database tasks page only appears if there are still tasks for the DBQueue Processor queued in the DBQueue that are required for installing the database. Once processing is complete, click Next.

  14. On the last page of the Configuration Wizard, click Finish.

Related topics

Editing a One Identity Manager database during setup using the Configuration Wizard

Installation and configuration of the One Identity Manager database is automatically carried out by the Configuration Wizard. The Configuration Wizard can create a new database and install the One Identity Manager schema. Alternatively, the One Identity Manager schema can be installed in an existing database.

The Configuration Wizard performs the following steps when processing the database:

  • Creates the required SQL Server logins and database users with permissions for the administrative user, configuration user and end user. For more information, see Users and permissions for the One Identity Manager database on an SQL Server.

  • Installs the One Identity Manager schema.

    Before the schema installation can take place, the Configuration Wizard tests the database. Error messages are displayed in a separate window. The errors must be corrected manually. The schema installation cannot be started until these are resolved.

    All the tables, data types, or database procedures that are required are loaded into the database through migration. The selected editions and configuration modules are enabled. During migration, calculation tasks are queued in the database. These are processed by the DBQueue Processor.

    When a schema is installed with the Configuration Wizard, migration date and migration revision are recorded in the database's transport history.

  • Compiles the system.

    Scripts, templates, and processes are declared in the database. The System user authentication module with the viadmin system user is used for compilation.

  • Uploads files for automatic software update.

    In order to distribute One Identity Manager files using the automatic software updating mechanism, the files are loaded into the One Identity Manager database.

  • Creates administrative system users and permissions groups.

    A system user is required for authentication in One Identity Manager. One Identity Manager provides various system users whose permissions are matched to the various tasks. For more information about system users, permissions groups, and granting permissions, see the One Identity Manager Authorization and Authentication Guide.

    The viadmin system user is the default system user in One Identity Manager. This system user can be used to compile and initialize the One Identity Manager database and for the first user login to the administration tools.

    IMPORTANT: Do not use the viadmin system user in a live environment. Create your own system user with the appropriate permissions.

    Custom system users are created as administrative system users by the Configuration Wizard. Administrative system users are automatically added to all non role-based permissions groups, and are assigned all permissions of the system user viadmin.

  • Installs and configures a One Identity Manager Service with direct access to the database for handling SQL processes and automatic server software updates.

    The One Identity Manager Service handles defined processes. The service has to be installed on the One Identity Manager network server to run the processes. The server must be declared as a Job server in the One Identity Manager database.

    During the initial schema installation with the Configuration Wizard, in the One Identity Manager database a Job server is already created for the server on which the One Identity Manager database is installed. This Job server receives the server functions SQL processing server and Update server:

    • The SQL processing server handles SQL processes.

    • The update sever ensures that software is updated automatically on other servers.

    The SQL processing server and the update server require a direct connection to the One Identity Manager database to handle processes. Use the Configuration Wizard to install the One Identity Manager Service on a server for handling these processes.

    The Configuration Wizard carries out the following steps.

    • Installs the One Identity Manager Service components.

    • Configuring the One Identity Manager Service

    • Starts the One Identity Manager Service.

  • Installs and configures the Database Agent Service.

    The Database Agent Service controls processing of DBQueue Processor tasks. The Database Agent Service is deployed through the One Identity Manager Service plug-in. Alternatively, the Database Agent Service can be run from the DatabaseAgentServiceCmd.exe command line program.

    NOTE: If the Database Agent Service is not working, a message is displayed in the status bar in all the administration tools. To see this message, users must have at least the configuration user access level.

Related topics

Configuring a One Identity Manager database for testing, development, or production

You use the staging level of the One Identity Manager database to specify whether the database is a test database, development database, or a live database. A number of database settings are controlled by the staging level.

If you change the database's staging level, the following settings are configured.

Table 18: Default settings for development, test, and live environments

Setting

 Development environment Test environment Live environment

Color of the One Identity Manager tools status bar

None

Green

Yellow

Maximum DBQueue Processor runtime

20 minutes

40 minutes

120 minutes

Maximum number of slots for the DBQueue Processor

5

7

Maximum number of slots according to the hardware configuration

To modify a database staging level

  1. Start the Launchpad and log in to the One Identity Manager database.

  2. In the Installation overview pane, select the Database staging level and click Run.

    This starts the Designer.

  3. In the Designer, select the Base Data > General > Databases category.

  4. In the List Editor, select the database.

  5. In the edit view, select the General tab.

  6. Change the value of the Staging level property to Test environment, Development system, or Production system.

  7. Confirm the security prompt with Yes.

  8. Select the Database > Commit to database and click Save.

The DBQueue Processor default configuration settings are configured for normal operation and do not normally need to be modified.

If several databases are operating in a managed instance in Azure SQL Database, you can fix the number of slots. In the Designer, adjust the following configuration parameters.

  • QBM | DBServerAgent | CountSlotAgents: Exact number of slots. If the configuration parameter is set, the given number of slots are always set up. There is no internal calculation of the number of slots based on the hardware configuration. Changing the server's configuration has no effect. The value 15 is recommended.

    NOTE: This configuration parameter is not recommended for implementing a database on an SQL Server. For implementing a database on an SQL Server, it is standard practice to use the hardware configuration to determine the slots.

The configuration settings are reduced for test environments and development environments because several databases may be located on a server. If it is necessary to change the settings for test environments or development environments for reasons of performance, you must modify the following configuration parameter settings in the Designer.

  • QBM | DBQueue | CountSlotsMax: Maximum number of slots to be used.

    Use this configuration parameter to reduce the number of slots if required. Values lower than 5 are not permitted.

    Exception: Enter a value of 0 for using the maximum number of slots available based on the hardware configuration.

  • QBM | DBQueue | KeepAlive: Maximum runtime of the central dispatcher. Tasks on slots currently in use are still processed when the timeout expires. Then the slot are stopped and the central dispatcher exits.

    The lowest permitted value for runtime is 5 minutes; the maximum permitted value is 720 minutes.

For more information about using the DBQueue Processor, see the One Identity Manager Configuration Guide.

Encrypting database information

NOTE: It is recommended that you create a backup before encrypting the database information in a database. Then you can restore the previous state if necessary.

In certain circumstances, it is necessary to store encrypted information in the One Identity Manager database: If you did not encrypt the database when you installed with the Configuration Wizard, use the Crypto Configuration program to encrypt. With this program an encryption file is created and the contents of the database columns that are affected are converted.

To change the encryption method

  • In the Designer, set the Common | EncryptionScheme configuration parameter and select one of the options:

    • RSA: RSA encryption with AES for large data (default).

    • FIPSCompliantRSA: FIPS certified RSA with AES for large data. This method is used if encryption must match the FIPS 104-2 standard. The local security policy Use FIPS compliant algorithms for encryption, hashing, and signing must be enabled.

NOTE: If the Common | EncryptionScheme configuration parameter is not set, RSA encryption is used as the method.

Detailed information about this topic
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating