Identity Manager 9.1 - Installation Guide

The application server provides a connection pool for accessing the database and stores business logic. The following system prerequisites must be fulfilled for installation of the application server.

Table 11: System requirements - application server
Processor	8 physical cores 2.5 GHz+
Memory	8 GB RAM
Hard drive storage	40 GB
Operating system	Windows operating systems The following versions are supported: Windows Server 2022 Windows Server 2019 Windows Server 2016 Windows Server 2012 R2 Windows Server 2012 Linux operating systems Linux operating system (64-bit), supported by the Mono project, or Docker images provided by the Mono project. Note the operating system manufacturer's minimum requirements for Apache HTTP Server.
Additional software	Windows operating systems Microsoft .NET Framework version 4.8 or later Microsoft Internet Information Services 10 or 8.5 or 8 or 7.5 or 7 with ASP.NET 4.8 and the Role Services: Web Server > Common HTTP Features > Static Content Web Server > Common HTTP Features > Default Document Web Server > Application Development > ASP.NET Web Server > Application Development > .NET Extensibility Web Server > Application Development > ISAPI Extensions Web Server > Application Development > ISAPI Filters Web Server > Security > Basic Authentication Web Server > Security > Windows Authentication Web Server > Performance > Static Content Compression Web Server > Performance > Dynamic Content Compression Linux operating systems NTP Client Mono 5.14 or higher Apache HTTP Server 2.0 or 2.2 with the following modules: mod_mono rewrite ssl (optional)

NOTE: In order to use the application server's REST API, the HTTP request methods POST, GET, PUT, and DELETE must be permitted by the web server (IIS/Apache).

Users for One Identity Manager

Table 12: Users for One Identity Manager
User	Permissions
User for installing One Identity Manager	The installation user is needed for the initial installation of a One Identity Manager database using the Configuration Wizard. For more information, see Users with granular permission for the One Identity Manager database on an SQL Server and Permissions for the One Identity Manager database in a managed instance in an Azure SQL Database.
User for administrative tasks in One Identity Manager	The administrative user is used by components of One Identity Manager that require authorizations at server level and database level, for example, the Configuration Wizard, the DBQueue Processor, or the One Identity Manager Service. For more information, see Users with granular permission for the One Identity Manager database on an SQL Server and Permissions for the One Identity Manager database in a managed instance in an Azure SQL Database.
User for configuration tasks in One Identity Manager	The configuration user can run configuration tasks within the One Identity Manager, for example, creating customer-specific schema extensions or working with the Designer. Configuration users need permissions at the server and database levels. For more information, see Users with granular permission for the One Identity Manager database on an SQL Server and Permissions for the One Identity Manager database in a managed instance in an Azure SQL Database.
End user for One Identity Manager	End users are only assigned permissions at database level in order, for example, to complete tasks with the Manager or the Web Portal. For more information, see Users with granular permission for the One Identity Manager database on an SQL Server and Permissions for the One Identity Manager database in a managed instance in an Azure SQL Database.
User for Logging into One Identity Manager	One Identity Manager uses different authentication modules for logging in to administration tools. Authentication modules identify the system users to be used and load the user interface and database resource editing permissions depending on their permissions groups. For more information about One Identity Manager authentication modules, see the One Identity Manager Authorization and Authentication Guide.
User account for the One Identity Manager Service	The user account for the One Identity Manager Service requires user permissions to carry out operations at file level (adding and editing directories and files). The user account must belong to the Domain users group. The user account must have the Login as a service extended user permissions. The user account requires permissions for the internal web service. NOTE: If the One Identity Manager Service runs under the network service (NT Authority\NetworkService), you can grant permissions for the internal web service with the following command line call: netsh http add urlacl url=http://<IP address>:<port number>/ user="NT AUTHORITY\NETWORKSERVICE" The user account needs full access to the One Identity Manager Service installation directory in order to automatically update One Identity Manager. In the default installation, One Identity Manager is installed under: %ProgramFiles(x86)%\One Identity (on 32-bit operating systems) %ProgramFiles%\One Identity (on 64-bit operating systems) NOTE: Other target system specific permissions may be required for synchronizing One Identity Manager with each target system. These permissions are explained in the corresponding guide. For more information, see Setting up permissions for creating an HTTP server.

Setting up permissions for creating an HTTP server

The log files of the One Identity Manager Service can be displayed using an HTTP server (http://<Servername>:<Portnumber>).

Users require permission to open an HTTP server. The administrator must grant URL approval to the user to do this. This can be run with the following command line call:

netsh http add urlacl url=http://*:<port number>/ user=<domain>\<user name>

If the One Identity Manager Service has to run under the Network Service's user account (NT Authority\NetworkService), explicit permissions for the internal web service must be granted. This can be run with the following command line call:

netsh http add urlacl url=http://<IP address>:<port number>/ user="NT AUTHORITY\NETWORKSERVICE"

You can check the result with the following command line call:

netsh http show urlacl

Communications ports and firewall configuration

One Identity Manager is made up of several components that can run in different network segments. In addition, One Identity Manager requires access to various network services, which can also be installed in different network segments. You must open various ports depending on which components and services you want to install behind the firewall.

The following ports are required:

Table 13: Communications port
Default port	Description
1433	Port for communicating with the One Identity Manager database.
1880	Port for the HTTP protocol of One Identity Manager Service.
2880	Port for access tests with the Synchronization Editor, such as in the target system browser or for simulating synchronization. Default port for the RemoteConnectPlugin.
80	Port for accessing web applications.
88	Kerberos authentication system (if Kerberos authentication is implemented).
135	Microsoft End Point Mapper (EPMAP) (also, DCE/RPC Locator Service).
137	NetBIOS Name Service.
139	NetBIOS Session Service.

Other ports for connecting to target systems are also required. These ports are listed in the corresponding guides.

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Identity Manager 9.1 - Installation Guide

Minimum system requirements for the application server

Users for One Identity Manager

Setting up permissions for creating an HTTP server

Communications ports and firewall configuration