The Active Roles Best Practices Guide describes best practices for core Active Roles product functionalities. This document is intended for general use, because Active Roles environments have different requirements and their functionality can extend beyond the scope of the best practices listed in this document.
Introduction
Installing and upgrading Active Roles
Active Roles topology
SQL database options
Active Roles Web Interface topologies
Active Roles client components
Multi-factor authentication and two-factor authentication support
Integration with other One Identity and Quest products
Customization support
General best practices
Minimum permissions
Active Roles service recovery
Establishing a baseline or benchmark
Active Roles deployment considerations
Custom scripts
Management History and Report Pack use cases
Job Server
Performance bottlenecks
Known performance issues and workarounds
Active Roles Synchronization Service connector performance
SQL Server considerations
Performance issues that are affecting only Active Roles Virtual Attributes
Other Windows host configuration considerations
Latency to the environment
Clearing obsolete cached information
Handling obsolete and incompatible external components
Preventing high CPU usage when running the Dynamic Group Updater scheduled task
Common SQL bottlenecks
Common memory bottlenecks
Hard drive space bottlenecks
CPU, network, third-party integration and Azure integration bottlenecks
Troubleshooting
Introduction
Introduction
Installing and upgrading Active Roles
Installing and upgrading Active Roles
IMPORTANT: Before installing Active Roles, see System requirements in the Active Roles Release Notes to ensure that all hardware and software components meet the minimum requirements. Failure to do so can result in an unsupported configuration.
The minimum requirements for Active Roles core components only list the necessary requirements for basic Active Roles functionality. When installing Active Roles, also consider the operating system and any other software installed on the system as well.
For example, an operating system with IIS installed requires 4 GB of RAM. Active Roles with all components installed requires an additional 10 GB of RAM. That total minimum is 14 GB.
Third-party add-ons or custom scripting also require additional memory.
Supported upgrade paths
|
|
CAUTION: Upgrading from an unsupported version can result in a loss of functionality. |
The supported upgrade paths can change with each version of Active Roles. For more information, see Upgrade and installation instructions in the Active Roles Release Notes.
Upgrading Active Roles
In addition to the Active Roles system requirements, check the following:
-
Make sure that any third-party components or add-ons, for example Safeguard Authentication Services, are compatible with the version of Active Roles that you are upgrading to. Refer to the documentation of those components and add-ons before proceeding with an upgrade.
-
Custom solutions provided by One Identity Professional Services might be version specific. Refer to any provided documentation or consult One Identity Professional Services before proceeding with an upgrade.
-
Test any other customizations in a lab or staging environment before upgrading.
TIP: One Identity recommends to test upgrading in a staging environment before upgrading in production.
You can upgrade Active Roles in two ways:
-
By performing an in-place upgrade. In this case, you install the new Active Roles version on top of an existing installation, providing a quick turnaround for service availability.
-
By performing a clean installation, then importing the configuration data. This allows you to fall back to the previous version if you experience any problems with the new Active Roles version.
Whichever option you choose, make sure to do the following:
-
Perform the upgrade as the existing Active Roles service account.
-
Follow the upgrade steps described in the Active Roles Upgrade Guide.
NOTE: Active Roles cannot communicate with older versions of SQL. Therefore, if the source Configuration database or Management History database resides on an older version of SQL, first copy the database to a supported version.
Active Roles topology
Active Roles topology
Active Roles can either run as a single instance or as multiple instances of the Active Roles service. When running multiple instances, you can configure the Active Roles servers to use the same SQL databases or take advantage of distributed SQL technologies.