Configure Windows authentication

Microsoft recommends to use Windows authentication when you connect to a Microsoft SQL Server. This is more secure than SQL Server authentication.

  • Depending on the configuration of your database server, you can use Windows authentication on server-level or database-level. If you switch between authentication modes on server-level, other databases on this server will also be affected.
  • You can only use Windows authentication if all Identity Director components are member of a domain in the same AD forest or of a trusted domain (typically single-tenant sites). In an environment with disjointed AD connectivity (typically in multi-tenant sites), Windows authentication is not supported.
  • Windows authentication is not supported on Domain Controllers and on Microsoft Windows Small Business Server.
  1. In Microsoft Active Directory, create a Group for service accounts.
  2. Create an Active Directory User that is a member of this service accounts group.
  3. Create the following policy:
    1. Log on as a service for the service accounts group.
    2. Add the service accounts group to the local administrators group.
  4. Link the policy to the OU that contains the devices running the Management Portal, Setup and Sync Tool and/or Transaction Engine.
  5. Open Microsoft SQL Server Management Studio.
    1. In the Security folder, create a new login.
    2. Click Search and then Object Types.
    3. Add the service accounts group that you created earlier.
    4. Add Domain Admins (or any group of administrators that uses the Management Portal and Setup and Sync Tool).
  6. Create a new default database with the following settings:
    • Size 150MB, autogrow 25MB
    • Log 75MB, autogrow 10MB
  7. Open the properties of the service accounts group.
  8. On the User Mapping tab, select the database that you just created.
  9. In Database Role Membership, select the db_owner role.
  10. All users who need access to the Management Portal and Setup and Sync Tool need at least the following rights on the Datastore:
    • DB_Datareader
    • DB_Datawriter: To adjust these rights, do the following:
      1. Create an Active Directory group.
      2. Add all users who need access to the Management Portal and Setup and Sync Tool to this Active Directory group.
      3. Add this group in the Security node on the SQL server.
      4. Under User Mapping select the Identity Director Datastore and select the roles db_datareader and db_datawriter.
  11. Add the account that is going to create the database tables and add the role DBO.
  12. Alternatively, when using accounts from another domain:
    1. Add Domain Admins (or any group of administrators that uses the Management Portal and Setup and Sync Tool) and the service account group to a domain local group.
    2. In Microsoft SQL Server Management studio, add the domain local group to the database as db_owner.
  13. Install Identity Director with a user that has the role DBO.
  14. After installation of the Management Portal, change the application pool on the IIS server to run under the domain account that has sufficient access to the database.
  15. Start the Management Portal.
  16. When prompted, do NOT create a new database, but connect to the one that you just created.
  17. Provide the required information and select Windows Authentication.
  18. Specify the Service Account in the format: DOMAIN\username.
  19. Click Save.
  20. When you connect to the database, confirm to create the required tables.
  1. On the Microsoft SQL Server, switch the authentication mode for the Identity Director Datastore from mixed mode authentication to Windows Authentication.
  2. Follow the steps as described above, but skip the step where you create a new database.
  3. On the IIS server of the Management Portal, change the application pool to run under the domain account that has sufficient access to the database.
  4. Start the Management Portal and at Setup > Datastore select Windows Authentication.
  5. Provide the service account credentials and click Connect.

Transaction Engine

In addition, configure the Transaction Engine. The Transaction Engine service needs to run under the service account with access rights to the database. You need to configure this manually:

New installations:

  • For manual installations of the Transaction Engine, you can configure Windows Authentication settings in the installation wizard.
  • For unattended installations of the Transaction Engine, provide an empty value for the public property DBUSER.

Existing installations:

You can configure these settings by starting the configuration wizard of the Transaction Engine, using a (service) account with access rights to the database:
"%ProgramFiles%\RES Software\IT Store\Transaction Engine\resote.exe" /configdb

You can also do this silently with the following command line:
"%ProgramFiles%\RES Software\IT Store\Transaction Engine\resote.exe" /configdb /silent /dbtype=<dbtype> /dbserver=<server> /dbname=<database> /dbuser= /dbencryption=<yes/no>

Windows Authentication will only be used if the /dbuser argument has an empty value (... /dbuser= /dbencryption=no....). In this situation, the value of the /dbpassword argument will be ignored.

See also