Securing and Setting Up Windows Identities for Data Relationship Management Engine Callers

This section explains how to secure and set up Windows identities for Data Relationship Management (DRM) engine callers.

Oracle Data Relationship Management (DRM) components that communicate with the Data Relationship Management Engine should run under known, controlled Windows identities.

Note:

It's recommended to use a dedicated domain service accounts or dedicated domain groups rather than personal user accounts.

This applies to the DRM Web Client, Oracle DRM Service, Batch Client, Diagnostics, Console, scheduled tasks, and other server-side DRM utilities.

Perform the following steps after installation or upgrade:

  1. Select a dedicated Windows identity or domain group.

    Use a domain service account or a domain group for DRM Engine callers. Do not use a personal user account, personal administrator account, or a broad group such as Domain Users.

  2. Configure the Data Relationship Management Web Client IIS application pool.

    Open IIS Manager, select the Data Relationship Management application pool, and set its Identity to the approved account or group-based service identity.

  3. Configure the Oracle Data Relationship Management Service Log On account.

    Open Services, find the Oracle Data Relationship Management Service, and set its Log On account to the approved service identity if that service calls the Data Relationship Management Engine.

  4. Update the Data Relationship Management Engine allowed-principals setting.

    Edit drm-engine.exe.config and add the selected account or group to engineAllowedWindowsPrincipals.

  5. Add every trusted server-side Data Relationship Management caller.

    Include identities used by Batch Client, Diagnostics, Console, scheduled tasks, automation jobs, and any custom utilities that call the Data Relationship Management Engine.

  6. Cover all hosts in distributed deployments.

    Make sure every server that contacts the Data Relationship Management Engine authenticates as an allowed identity.

  7. Cover all nodes in load-balanced IIS deployments.

    If the web tier uses one domain service account, add that account or group. If it uses NetworkService, add each web server machine account such as DOMAIN\WEB01$.

  8. Restart the DRM Engine and Recycle the IIS Application Pool.

    Restart the Data Relationship Management Engine after changing the allowed-principals file. Recycle the IIS application pool after changing its identity. Restart the Oracle Data Relationship Management Service and any scheduled tasks or utility processes that call the engine.

  9. Verify connectivity.

    Test the Web Client, Data Relationship Management Service, Console, Diagnostics, and Batch workflows to confirm that each one can connect to the Data Relationship Management Engine successfully.

Note:

  • In this release, installer does not fully automate for securing Data Relationship Management Engine caller identity. You must review and configure Windows identities after installation or upgrade.

  • Follow the installation steps in this guide exactly; incomplete configuration may prevent the product from starting or may cause authentication, connectivity, or authorization failures. These updates are required for the supported operation of this release. Ensure that all required configuration changes are applied as part of the installation or upgrade process before placing the system into production. If you cannot upgrade now, continue to ensure that access to administrative interfaces and service endpoints is managed in accordance with the product's documented deployment guidance, including limiting access to authorized accounts and trusted networks where appropriate.