Understanding the security requirements

The account used by the IIS application pool that is assigned to the Publisher web service requires:

• The db_owner role for the BlueCielo Application Manager configuration database where publishing data is stored.
• Sufficient privileges in the publishing source and destination systems to perform the configured actions (for example, updating the feedback property in a source system).

To ease the configuration and maintenance, we recommend a dedicated user account.

Dex.exe must run under a user account with the following privileges:

• On the Publisher computer:
• Windows Temp folder (read/write access)
• BlueCielo Publisher folder (read/write access)
• BlueCielo Publisher\Logs folder (read/write access)
• Any folders used by the rendering modules or system links (read/write access)
• On the database server (SQL Server or Oracle):
• Rights to create and update tables.

Note    Be aware that Dex.exe is not capable of seeing documents that are hidden by work isolation in Meridian Enterprise vaults used as the source system. Therefore, it is not possible to publish documents that reside in work areas or in the Main area of the vault if Work Isolation Mode is enabled.

The account under which the Windows file system publishing service is run must have the following privileges:

• On the Publisher computer:
• Access to the Publisher web services
• On the server where the monitored folder resides:
• Monitored folders (read/write access)

All computers where documents are published from (by the BlueCielo File Publishing Service or PowerUser extension) or where the Publisher Queue web site is opened in a web browser must have access to the Publisher web services.

To authenticate with Microsoft Online Services, the Windows Identity Foundation must be installed as described in Publisher computer requirements. For more information on publishing to a cloud-hosted Microsoft SharePoint site, see Configuring the Microsoft SharePoint destination options.