Identity Manager 9.2 - Operational Guide

The InstallManager.Cli.exe program provides support for the installation of One Identity Manager. You can run the program from the command line.

IMPORTANT: Run the installation using the command line console in administrator mode.

Calling syntax

InstallManager.Cli.exe

-m install|change|remove|uninstall

-r {Directory}

[-i {Directory}]

[-fu]

[-mod {ModuleIDs}]

[-d {Targets}]

[-p {Packages}]

[-l {Path}]

[-fo]

[-cs {Service name} {Properties}]

[-dc]

Table 50: Program parameters and options
Parameter or option	Alternative	Description
-m	--mode	Installation mode. Permitted values are install: Install new modules. change: Update existing modules. remove: Delete modules. uninstall: Uninstall complete installation.
-r	--rootpath	Directory containing the installation sources.
-i	--installpath	(Optional) Directory in which to install.
-fo	--filesonly	(Optional) Only file actions will be run. No start menu entries or registry keys are generated and no services are installed.
-mod	--module	Space-delimited list of module IDs.
-d	--deploymenttarget	Space delimited list of machine roles.
-p	--packages	Space-delimited list of packages.
-l	--logfile	(Optional) Path to the log file.
-fu	--forceupdate	(Optional) All data will be reinstalled.
-cs	--changeservice	Changes the properties for registration of the service. The following values are expected: Service name: Name of the service to be changed Properties: New properties of the service with: Name: Name of the service. Display: Display name of the service. Description: Description of the service. Example: "Name=<New name>;Display=<New display>;Description=<New Description>" You only need to specify the properties that are to be changed.
-dc	--deleteconfig	(Optional) Configuration data and logs are removed in uninstall mode.
-h	--help	Display program help.

Example: Installing a single module

InstallManager.Cli.exe

-m install

-r c:\sourcedir

-mod QER ADS SAP LDAP ATT

Example: Updating a machine role

InstallManager.Cli.exe

-m change

-r c:\sourcedir

-d Server\JobServer\ADS

Example: Uninstalling the One Identity Manager components

InstallManager.Cli.exe

-m uninstall

-i c:\installdir

-dc

DBCompilerCMD.exe

The DBCompilerCMD.exe program supports compiling a database.You can run the program from the command line.

Calling syntax

DBCompilerCMD.exe

/Conn="{Connection string}"

/Auth="Module={Authentication string}"

[/IgnoreErrors=True|False]

[-W]

[/DumpModules]

[/Blacklist=[CompileWebServices] [CompileTypedWrappers] [CompileDialogScripts] [CompileScripts] [CompileJobChains] [CompileWebProjects] [CompileApiProjects] [CompileHtmlApps] [FillMultiLanguage]]

[/SkipModules=[CompileWebServices] [CompileTypedWrappers] [CompileDialogScripts] [CompileScripts] [CompileJobChains] [CompileWebProjects] [CompileApiProjects] [CompileHtmlApps] [FillMultiLanguage]]

/WaitTimeout

[-A]

[/AutoCompileCheckInterval]

[/AutoCompileWaitSeconds]

[/AutoCompileErrorWaitSeconds]

[-S]

[-C]

[-v]

Table 51: Program parameters and options
Parameter or option	Description
-A	(Optional) Automatic compilation of the database. The database is monitored and compiled if necessary. This runs until the program is terminated with Ctrl + C.
-C	(Optional) Compile only modified parts of the system.
-S	(Optional) Messages are outputted to the console without timestamp or severity level.
-v	(Optional) Provides additional information (verbose).
-W	(Optional) Wait for the processing of DBQueue Processor tasks to complete before starting compilation.
/Auth	Authentication data. The authentication data depends on the authentication module used. For more information about One Identity Manager authentication modules, see the One Identity Manager Authorization and Authentication Guide.
/AutoCompileCheckInterval	(Optional) Interval in seconds to check if the database needs to be compiled. Default: 30
/AutoCompileErrorWaitSeconds	(Optional) If an error occurs during compilation, the next compiler run is deferred by this time interval before actually being be performed. Default: 60
/AutoCompileWaitSeconds	(Optional) After a compilation request is detected, compilation is deferred by this time interval before actually being be performed. Default: 0
/Conn	Database connection parameter. A user with a minimum access level of Configuration user is required. For more information about permissions, see the One Identity Manager Installation Guide and the One Identity Manager Authorization and Authentication Guide. Alternatively, you can enter the name of the connection according to the registry HKEY_CURRENT_USER\Software\One Identity\One Identity Manager\Global\Connections.
/IgnoreErrors	(Optional) Specifies if error messages are ignored. Permitted values are True and False.
/LogLevel	(Optional) Scope of output to be processed. Permitted values are: Off: No logging. Fatal: All critical error messages are logged. Error: All error messages are logged. Info: All information is logged. Warn: All warnings are logged. Debug: Debugger outputs are logged. This setting should only be used for testing. Trace: Highly detailed information is logged. This setting should only be used for analysis purposes. The log file quickly becomes large and cumbersome.
/Modules	(Optional) Space-delimited list of compiler modules to be compiled. Permitted values are: CompileWebServices: Compile web services CompileTypedWrappers: Compile a type-safe database model CompileDialogScripts: Compile scripts from the script library CompileScripts: Compile templates, formatting scripts and task definitions CompileJobChains: Compile processes CompileWebProjects: Compile web projects Compiling of web projects can be restricted by the DBCompilerCMD.exe.config configuration file. FillMultiLanguage: Extract language-dependent texts Example: FillMultiLanguage CompileWebProjects
/DumpModules	(Optional) Deploying the compiler module without compiling.
/SkipModules	(Optional) Space-delimited list of compiler modules that must not be compiled. Example: FillMultiLanguage CompileWebProjects
/WaitTimeout	Maximum waiting time for DBQueue. Default: 00:10:00
-? \|-h	Display program help.

Example:

DBCompilerCMD.exe

/Conn="Data Source=<Database server>;Initial Catalog=<Database name>;User ID=<Database user>;Password=<Password>"

/Auth="Module=DialogUser;User=<User name>;Password=<Password>"

-W

Special features for compiling web projects

To limit which web projects are compiled and the scope of the compilation, edit the DBCompilerCMD.exe.config configuration file for running the DBCompilerCMD.exe.

Example:

Do not compile the CCC_Web web project.

The following section is added to the configuration file.

</appSettings>

Example:

Compile web projects with the following settings.

Compile the CCC_CustomerWeb web project with just the DEBUG setting.
Compile the testweb web project with the DEBUG and RELEASE settings.
Compile all other web projects with just the RELEASE setting.

The following section is added to the configuration file.

</appSettings>

Quantum.MigratorCmd.exe

The Quantum.MigratorCmd.exe program supports migration of a One Identity Manager database. You can run the program from the command line.

Calling syntax for installation

quantum.migratorcmd.exe

--INSTALL

/Connection="{Connection string}"

/System=MSSQL

/Module={Module IDs}[+]

/Destination="{Directory}"

[/Password={Password}]

[/Admin="mode=create|check|extend;login={SQL Server login name};password={SQL Server login password}]

[/Login="User=Config|User;login={SQL Server login name};password={SQL Server login password}"]

[/Person="condition={Condition};password={Identity password}"]

[/User="DialogUser={System user};password={System user password}"]

[/PasswordPolicy="{Password policy settings}"]

[/Group="GroupName={Group name}"|skip]

[/PreCheck={[+|-] Precheck ID}]

[/Edition]

[/DialogDatabase]

[/Config]

[/PostSQL]

Calling syntax for updating

quantum.migratorcmd.exe

--UPDATE

/Connection="{Connection string}"

/Module={Module IDs}[+] /destination="{Directory}"

[/Admin="mode=create|check|extend;login={SQL Server login name};password={SQL Server login password}]

[/SysAdmin="Data Source=<Database server>;Initial Catalog=<Database name>;User ID=<Database user>;Password=<Password>"]

[/Login="User=Config|User;login={SQL Server login name};password={SQL Server login password}"]

[/Person="condition={Condition};password={Identity password}"]

[/User="DialogUser={System user};password={System user password}"]

[/PasswordPolicy="{Password policy settings}"]

[/PreCheck={[+|-] Precheck ID}]

[/KeepUpdatePhase]

[/DialogDatabase]

[/Config]

[/PostSQL]

Calling syntax for restoring a database

quantum.migratorcmd.exe

--RESTORE

/Connection="{Connection string}"

/Destination="{Directory}"

[/Admin="mode=create|check|extend;login={SQL Server login name};password={SQL Server login password}]

[/Login="User=Config|User;login={SQL Server login name};password={SQL Server login password}"]

[/Person="condition={Condition};password={Identity password}"]

[/User="DialogUser={System user};password={System user password}"]

[/PasswordPolicy="{Password policy settings}"]

[/Group="GroupName={Group name}"|skip]

[/PreCheck={[+|-] Precheck ID}]

[/KeepUpdatePhase]

[/DialogDatabase]

[/Config]

[/PostSQL]

Calling syntax for deleting a database

quantum.migratorcmd.exe

--DELETE

/Connection="{Connection string}"

/Destination="{Directory}"

Calling syntax for passing parameters as a file

quantum.migratorcmd.exe @File

Table 52: Program parameters and options
Parameter or option	Description
--Delete	Deletes database including all files and SQL Server logins.
--Delta	For internal use only.
--Dump	For internal use only.
--Import	For internal use only.
--Install	Installs new database.
--Restore	This operation performs the necessary steps to make the database operational, such as initializing the DBQueue Processor or restoring logins.The operation can be performed after a database has been restored from a backup, for example on another server.
--Update	Updates database.
/Clear	For internal use only.
/Format	For internal use only.
/HashSize	For internal use only.
/KeepUpdatePhase	(Optional) If the parameter is set, the update phase is not reset to 0 after migration is complete (DialogDatabase.UpdatePhase).
/LogLevel	(Optional) Scope of output to be processed. Permitted values are: Off: No logging. Fatal: All critical error messages are logged. Error: All error messages are logged. Info: All information is logged. Warn: All warnings are logged. Debug: Debugger outputs are logged. This setting should only be used for testing. Trace: Highly detailed information is logged. This setting should only be used for analysis purposes. The log file quickly becomes large and cumbersome.
/Password	(Optional) Initial password for the viadmin system user when a new database is installed.
/Condition	For internal use only.
/Config	(Optional) Global JSON configuration file for variables.
/Connection	Database connection parameter. A user with a minimum access level of Administrative user is required. For more information about permissions, see the One Identity Manager Installation Guide and the One Identity Manager Authorization and Authentication Guide. Alternatively, you can enter the name of the connection according to the registry HKEY_CURRENT_USER\Software\One Identity\One Identity Manager\Global\Connections.
/From	For internal use only.
/To	For internal use only.
/Destination	Source directory .
/DialogDatabase	Passes information about the database (DialogDatabase table). The value updates the entry for the database in the DialogDatabase table. This allows a new database to immediately create a valid entry in the DialogDatabase table. Example: "CustomerName=<your name>;ProductionLevel=2"
/Edition	(Optional) Edition to be installed. Permitted values are: DGE: One Identity Manager Data Governance Edition STE: One Identity Manager Edition
/Group	(Optional) Creates custom permissions groups (DialogGroup.GroupName). To create several permissions groups, the parameter can be entered more than once. Example: /Group="GroupName=CCCCustomGroup" The skip keyword can be used to skip creation of the permission groups. This means that no permissions groups are created. Example: /Group=skip If the parameter is not provided, the default groups CCCEditPermissions, CCCViewPermissions, CCCEditRole, and CCCViewRole are created.
/Admin	(Optional) Mode for creating SQL Server logins if granular permissions are used. mode: Specifies in which mode the SQL Server login is created. Permitted values are: create : The SQL Server login does not exist yet and will be created. check: The SQL Server login already exists. This checks the permissions for the SQL Server login. If the necessary permissions are missing, an error message is displayed. extend: The SQL Server login already exists. This extends the permissions for the SQL Server login. login: Name of the SQL Server login. password: Password for the SQL Server login. Example: Create a new SQL Server login "OneIM_Admin" with password "secret". /admin="mode=create;Login=OneIM_Admin;Password=secret"
/Login	(Optional) Creates the other SQL Server logins if granular permissions are used. Multiple instances of this parameter are possible. user: Name of the database user according to QBMDBPrincipal.UserName. Permitted values are: Config: Configuration user. User: End user. login: Name of the SQL Server login. password: Password for the SQL Server login. Example: Creating SQL Server logins for configuration users and end users. /login="User=Config;Login=OneIM_Config;Password=secret" /login="User=User;Login=OneIM_User;Password=secret"
/Module	Comma delimited list of module IDs. For UPDATE operation: If the module ID is followed by a plus sign (+), only this module is updated. If no plus sign is specified, all modules listed are updated.
/ModuleOwner	For internal use only.
/operation	Alternative name of the operation. Example: /operation=INSTALL
/PasswordPolicy	(Optional) Temporarily altered configuration of the default password policy. For example, this could be used to override the policy settings and permitted character sets (corresponding to the QBMPwdPolicy table). The configuration is only used while the program is running and is not saved in the database. /PasswordPolicy="MinLen=12;MinNumbers=2"
/Person	(Optional) Configuration of an identity's password (Person.DialogUserPassword). Multiple instances of this parameter are possible. condition: A valid SQL condition for the person table. password: Password (plain text or password hash). Example: Sets the "secret" password for the identity with the internal name "Sys, admin". /person="Condition=InternalName='Sys, admin'; Password=secret"
/PostSQL	(Optional) Name of a file (*.sql) containing SQL queries that will be run after the database operation (Install/Update/Restore). This enables a database configuration without other programs.
/PreCheck	(Optional) Controls the handling of database pre-checks. The input is given as + or - followed by the ID for the pre-check. Multiple instances of this parameter are possible. +ID: The pre-check is repaired. If the pre-check is not repairable, an error message is displayed. -ID: Pre-check is ignored. This only works for optional tests. Example: /precheck=-JobqueueEmpty. The ID can be taken from the PreCheck with ID '{0}' failed! error message.
/SysAdmin	Connection parameter for an administrative database connection.
/System	Database system. Permitted value is MSSQL.
/User	(Optional) Configuration of a system user's password (Person.DialogUserPassword). Multiple instances of this parameter are possible. DialogUser: Name of the system user (DialogUser.UserName). password: Password (plain text or password hash).
@file	As an alternative to directly issuing commands, you can name a text file containing the commands. Every command is in a separate line.
-v	(Optional) Provides additional information (verbose).
-? \| h	Display program help.

Example: Installing a database

quantum.migratorcmd.exe

--Install

/connection="Data Source=<Database server>;Initial Catalog=<Database>;User ID=<Database user>;Password=<Password>"

/module="TSB,ATT,CPL,HDS,POL,RMB,RMS,RPS"

/destination="C:\install"

Example: Restoring a database

quantum.migratorcmd.exe

--Restore

/connection="Data Source=<Database server>;Initial Catalog=<Database>;User ID=<Database user>;Password=<Password>"

/destination="C:\install"

/LogLevel=Warning

/precheck=-JobqueueEmpty

AppServer.Installer.CMD.exe

The AppServer.Installer.CMD.exe program supports installing and uninstalling of application servers. You can run the program from the command line.

NOTE: Run the installation using the command line console in administrator mode.

Calling syntax for installation

AppServer.Installer.CMD.exe

--conn={Connection string}

--auth={Authentication string}

--appname={Application name}

[--site={site}]

[--app-pool={Application pool}]

[--source-dir={Directory}]

[--deployment-target={Machine role}]

[--allow-http]

[--windows-auth]

[--db-windows-auth]

[--skip-file-permissions]

[--runtime-connection={Connection string}]

[--hdb-connection={History Database ID|Connection string}]

[/updateuser {User name} [/updateuserdomain {Domain}] [/updateuserpassword {Password}]]

[

--cert-mode=existing --cert-thumbprint={Thumbprint}

--cert-mode=new --cert-issuer {Issuer} [--cert-key=1024|2048|4096]

--cert-mode=newfile --cert-issuer {Issuer} [--cert-key=1024|2048|4096] [--cert-file={Path to certificate file}]

]

[--set-connection]

[--conn-id={History Database ID}]

[--verbose]

Calling syntax for uninstalling

AppServer.Installer.CMD.exe

--conn={Connection string}

--auth={Authentication string}

--appname={Application name}

--uninstall

Table 53: Program parameters and options
Parameter or option	Alternative	Description
--conn	--connection\| -c	Database connection parameter. To install an application server you require at least one user with the Configuration user access level. For more information about permissions, see the One Identity Manager Installation Guide and the One Identity Manager Authorization and Authentication Guide. Alternatively, you can enter the name of the connection according to the registry HKEY_CURRENT_USER\Software\One Identity\One Identity Manager\Global\Connections.
--auth	--auth-props\|-a	Authentication data for the installation. The authentication data depends on the authentication module used. For more information about authentication modules, see the One Identity Manager Authorization and Authentication Guide.
--appname		Application name.
--site		(Optional) Website on the Internet Information Services where the application is installed. If the parameter is not set, Default Web Site is used (default).
--app-pool		(Optional) Application pool. If this parameter is set, the installation is performed in the specified application pool. If this parameter is not set, a new application pool is installed (default).
--source-dir	-s	(Optional) Installation source. If this parameter is set, the installation is performed from the file system. If this parameter is not set, the installation is performed from the database (default).
--deployment-target	-t	(Optional) Machine role for the installation. This parameter can be used more than once. Alternatively, multiple machine role can be separated with a pipe [\|]. If this parameter is not set, the Server \| Web \| Appserver machine role is used.
--allow-http		(Optional) If the parameter is set, HTTP is permitted. If this parameter is not available, HTTPS is used (default).
--windows-auth	-w	(Optional) Type of authentication used for the web application. If this parameter is set, Windows authentication is used. If this parameter is not set, anonymous authentication is used on IIS (default).
--db-windows-auth		(Optional) Type of authentication used for the One Identity Manager database. If this parameter is set, Windows authentication is used. If this parameter is not set, the SQL login from the connection parameters is used.
--skip-file-permissions	-f	(Optional) If this parameter is set, no permissions are allocated for the IIS_USRS user. If this parameter is not set, the permissions are allocated for the IIS_USRS user (default).
--runtime-connection	--run-conn	(Optional) Database connection parameters used as authentication for the One Identity Manager database, for example, if the application server is run with the end user access level. If this parameter is not set, the SQL Server login from the connection parameters is used for the installation (default).
--update-user		(Optional) User for updating. If no user is given, the same user account is used for the application pool.
--update-user-domain		Active Directory domain of the user.
--update-user-password		User password.
--cert-mode		(Optional) Type of certificate selection. Permitted values are: existing: Uses an existing certificate. new: Uses a new certificate. newfile: Creates a new certificate file. (default)
--cert-thumbprint		Thumbprint of the certificate if an existing certificate is used.
--cert-issuer		Issuer of the certificate if a new certificate or a new certificate file is created. Example: "CN=Application Server"
--cert-key		Length of the certificate’s key 1024, 2048 (default), and 4096 are permitted.
--cert-file		(Optional) Directory path and name of the certificate file if a new certificate file is created. If this parameter is not set, "App_Data\SessionCertificate.pfx" is used.
--hdb-connection		(Optional) History Database connection parameter. This value is a combination of the ID and the connection parameter (pipe (\|) delimited). Example: “<History Database ID>\|key1=value1;key2=value2;...”
--set connection	-S	Changes the connection parameters for an installed application.
--conn-id		(Optional) Connection parameter identifier. If this parameter is not set, the application server’s own connection parameters are used.
--uninstall	-R	Removes the application server.
--verbose	-v	(Optional) Provides additional information (verbose).
--help	-h, -?	Display program help.

Parameter formats

Multiple-character options can be given in the following forms:

--conn="..."

--conn "..."

/conn="..."

/conn "..."

Single-character options can be given in the following forms:

-c="..."

-c "..."

/c="..."

/c "..."

Switches are allowed in the forms:

-R

Example: Installing an application server

AppServer.Installer.CMD.exe

--conn="Data Source=<Database server>;Initial Catalog=<Database name>;User ID=<Database user>;Password=<Password>"

--auth="Module=DialogUser;User=<User name>;Password=<Password>"

--appname=MyApplicationServer

--allow-http

Example: Uninstalling an application server

AppServer.Installer.CMD.exe

--conn="Data Source=<Database server>;Initial Catalog=<Database name>;User ID=<Database user>;Password=<Password>"

--auth="Module=DialogUser;User=<User name>;Password=<Password>"

--appname=MyApplicationServer

--uninstall

Example: Changing the connection parameters of the application server

AppServer.Installer.CMD.exe

--set-connection

--appname=MyApplicationServer

--conn="Data Source=<Database server>;Initial Catalog=<Database name>;User ID=<Database user>;Password=<Password>"

Example: Changing the parameters for connecting a History Database

AppServer.Installer.CMD.exe

--set-connection

--appname=MyApplicationServer

--conn-id=<History Database ID>

--conn="Data Source=<Database server>;Initial Catalog=<Database name>;User ID=<Database user>;Password=<Password>"

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Identity Manager 9.2 - Operational Guide

InstallManager.CLI.exe

Calling syntax

Example: Installing a single module

Example: Updating a machine role

Example: Uninstalling the One Identity Manager components

DBCompilerCMD.exe

Calling syntax

Example:

Special features for compiling web projects

Example:

Example:

Quantum.MigratorCmd.exe

Calling syntax for installation

Calling syntax for updating

Calling syntax for restoring a database

Calling syntax for deleting a database

Calling syntax for passing parameters as a file

Example: Installing a database

Example: Restoring a database

AppServer.Installer.CMD.exe

Calling syntax for installation

Calling syntax for uninstalling

Parameter formats

Example: Installing an application server

Example: Uninstalling an application server

Example: Changing the connection parameters of the application server

Example: Changing the parameters for connecting a History Database