Understanding the security requirements

The account used by the IIS application pool that is assigned to the Publisher web service requires:

• If the Windows authentication option is enabled in Data Library as described in Configuring the BlueCielo Application Manager, the account must have the db_owner role for the Data Library configuration database where publishing data is stored.
• Sufficient privileges in the destination system to perform the configured actions.

The Meridian Enterprise setup program creates an application pool named BC-Publisher with the correct settings. To ease the configuration and maintenance, we recommend that you use this application pool with a dedicated user account.

Dex.exe must run under a user account with the following privileges:

• On the Publisher computer:
• The folder specified by the Windows %TEMP% environment variable for the user account under which the process is run (read/write access)
• BlueCielo Publisher folder (read/write access)
• BlueCielo Publisher\Logs folder (read/write access)
• On the database server:
• If the Windows authentication option is enabled in Data Library as described in Configuring the BlueCielo Application Manager, the account must have the db_owner role for the Data Library configuration database where publishing data is stored.

• Run the following script in SQL *Plus to create a user account and to grant the necessary privileges. Specify this account for the IIS application pool and the account under which Dex.exe is run in the preceding descriptions:

  CREATE USER <%UserName%> IDENTIFIED BY <%Password%>; 
  GRANT RESOURCE, CREATE SESSION TO <%UserName%>;
  GRANT RESOURCE, CONNECT TO <%UserName%>; 
  GRANT EXECUTE ON CTX_DDL TO <%UserName%>;
  GRANT CREATE VIEW TO <%UserName%>;
  GRANT ALTER ANY TABLE TO <%UserName%>;
  GRANT CREATE PROCEDURE TO <%UserName%>;
  GRANT CREATE TRIGGER TO <%UserName%>

• On the source and destination systems:
  • Sufficient privileges to perform the configured actions (for example, updating the feedback property in a source system).

  The destination system account credentials are specified in the publishing job.

Note    Be aware that Dex.exe is not capable of seeing documents that are hidden by work isolation in Meridian Enterprise vaults used as the source system. Therefore, it is not possible to publish documents that reside in work areas or in the Main area of the vault if Work Isolation Mode is enabled.