Security requirements

The Meridian Enterprise Server setup program creates an application pool named BCEnterprise (by default) with the correct settings. To ease the configuration and maintenance, we recommend that you use this application pool with a dedicated system account that is also used for the Meridian Enterprise Server service.

The Meridian Enterprise Server service must run under an account with the following privileges:

• On the Meridian Enterprise Server computer:
  • A member of the Administrators group
  • Read/write access to C:\ProgramData\BlueCieloECM
  • Read/write access to any folders used by the rendering modules or system links
• On the SQL Server computer:
  • If the Integrated Windows authentication option is enabled, the account that is assigned to the application pool must have the db_owner role for the Meridian Enterprise Server configuration database. If the option is not enabled, the SQL Server account that is configured for the database connection as described in Creating the configuration database must have the db_owner role.
  • If Meridian Enterprise Server will be allowed to create the configuration database, the account must also have the db_creator role. If that is not permitted due to your organization’s security policy, create the database either with the database configuration wizard as described in Creating the configuration database or with the script in SQL Server database creation script. Specify this account for the IIS application pool and the account under which the Meridian Enterprise Server web service is run in the preceding descriptions.
• On the Oracle server:
  • Create a user account and database with the script in Oracle database creation script. Specify this account for the IIS application pool and the account under which the Meridian Enterprise Server web service is run in the preceding descriptions.
• On the source and destination systems:
  • Sufficient privileges to perform the configured actions (for example, updating the feedback property in a source system).

  The destination system account credentials are specified in the publishing job.

Notes

• All computers where documents are published from (by the BlueCielo File Publishing Service or PowerUser extension) or where the Publisher Queue website is opened in a web browser must have access to the Meridian Enterprise Server web services.

  For example, if Meridian Enterprise and BlueCielo Publisher are running on separate computers, we recommend that you change the EDM Server service from using the default SYSTEM account to use a domain account with sufficient permissions to access the web services on the Meridian Enterprise Server computer. If this is not done, users attempting to register documents for publishing in Meridian Enterprise PowerUser will see errors and registration will fail.

  The Meridian Enterprise Server server, the web server that hosts the Meridian Enterprise Server website (if separate), and the cluster nodes (if any) must all be able to communicate through Windows Communication Foundation (WCF) on HTTP port 8686. The primary node and the secondary noes of a cluster also communicate push notifications on port 40865.

• If a Meridian Explorer feedback type page will be used in web browsers other than Internet Explorer (for example, Firefox or Chrome), access denial errors can occur if the Meridian Enterprise Server application pool account is not the same as the Meridian Enterprise EDM Server service account.
• Be aware that Publisher is not capable of seeing documents that are hidden by work isolation in Meridian Enterprise vaults used as the source system. Therefore, it is not possible to publish documents that reside in work areas or in the Main area of the vault if Work Isolation Mode is enabled.
• To authenticate with Microsoft Online Services, the Windows Identity Foundation must be installed as described in Understanding the Meridian Enterprise Server system requirements.

• Internet Explorer Enhanced Security Configuration can cause the Meridian Explorer client home page to fail to load and to show JavaScript errors. It can be disabled in Windows Server Manager.

• If your Meridian Enterprise system will use more than one server, the services might need to be configured to allow security delegation as described in Understanding security delegation.

The account under which the Windows file system publishing service or the BlueCielo Project Portal publishing service is run must have the following privileges:

• On the Meridian Enterprise Server computer:
  • Access to the Meridian Enterprise Server web service
  • Write access to the Kronodoc.Service.exe.config file located in the Meridian Enterprise Server program folder.
• On the server where the monitored folder resides:
  • Full control