Configuring DRM Engine Caller Access

This section describes the configuration required for DRM Engine Caller Access.

Data Relationship Management (DRM) restricts access to the DRM Engine by validating the Windows identity of the calling process. Authorized caller identities are configured through the engineAllowedWindowsPrincipals setting in the DRM Engine configuration file.

Configuring Authorized Callers

The list of authorized Windows principals is defined in the DRM Engine configuration file:

The allowed callers are configured in drm-engine.exe.config using the engineAllowedWindowsPrincipals setting:

<add key="engineAllowedWindowsPrincipals" value="NT AUTHORITY\NETWORK SERVICE"/>

The value may contain one or more Windows users or groups, separated by semicolons or commas.

This default configuration allows DRM web applications running under the standard IIS Network Service identity to communicate with the DRM Engine on the same server.

Production Deployment Recommendations

For production environments, Oracle recommends replacing the default NETWORK SERVICE value with a dedicated domain security group or managed service account that is specifically assigned to DRM application components. Restricting access to approved service identities helps enforce the principle of least privilege and simplifies ongoing security administration.

When using a domain group, add all authorized DRM web server service accounts or application pool identities to the group and specify the group name in the engineAllowedWindowsPrincipals setting.

For production deployments, replace the default value with a dedicated domain group or service account. For example:

<add key="engineAllowedWindowsPrincipals" value="DOMAIN\DRM Engine Callers"/>

IIS Application Pool Identity

The IIS application pool identity used by DRM web applications must be included in the engineAllowedWindowsPrincipals setting. If a custom domain service account is configured for the application pool, ensure that the service account or its associated security group is authorized before restarting services.

Load-Balanced Deployments

In load-balanced or multi-server deployments, each web server that communicates with the DRM Engine must be authorized. If application pools run under machine accounts, add the corresponding machine accounts for all participating web servers to the authorized principals list. Alternatively, use a shared domain service account or security group to simplify administration across the environment.

Applying Configuration Changes

After modifying the engineAllowedWindowsPrincipals setting.

Perform the following steps:

  1. Save the updated drm-engine.exe.config file.

  2. Restart the DRM Engine service.

  3. Recycle the IIS application pools hosting DRM web applications.

  4. Verify that DRM web applications can successfully connect to the DRM Engine.

Failure to restart the DRM Engine service or recycle affected application pools may prevent configuration changes from taking effect.

For single-machine, non-domain installations where IIS and the DRM Engine run on the same server and the IIS application pool uses NetworkService, the default value is sufficient:

<add key="engineAllowedWindowsPrincipals" value="NT AUTHORITY\NETWORK SERVICE"/>

NOTE: Do not use personal user accounts for production service identities. Use dedicated service accounts or domain groups so that password expiration, account lockout, and staffing changes do not interrupt service.

NOTE: You must update the DRM Service properties to Log On using the same identity as the IIS application pool.