Understanding the security requirements

The Meridian Enterprise Server setup program creates an application pool named BCEnterprise (by default) with the correct settings. To ease the configuration and maintenance, we recommend that you use this application pool with a dedicated system account.

The Meridian Enterprise Server web service must run under an account with the following privileges:

• On the Meridian Enterprise Server computer:
• Read/write access to C:\ProgramData\BlueCieloECM
• Read/write access to any folders used by the rendering modules or system links
• On the database server:
• If the Integrated Windows authentication option is enabled the account that is assigned to the application pool, it must have the db_owner role for the Meridian Enterprise Server configuration database.

• Run the following script in SQL *Plus to create a user account and to grant the necessary privileges. Specify this account for the IIS application pool and the account under which the Meridian Enterprise Server web service is run in the preceding descriptions:

  CREATE USER <%UserName%> IDENTIFIED BY <%Password%>; 
  GRANT RESOURCE, CREATE SESSION TO <%UserName%>;
  GRANT RESOURCE, CONNECT TO <%UserName%>; 
  GRANT EXECUTE ON CTX_DDL TO <%UserName%>;
  GRANT CREATE VIEW TO <%UserName%>;
  GRANT ALTER ANY TABLE TO <%UserName%>;
  GRANT CREATE PROCEDURE TO <%UserName%>;
  GRANT CREATE TRIGGER TO <%UserName%>

• On the source and destination systems:
  • Sufficient privileges to perform the configured actions (for example, updating the feedback property in a source system).

  The destination system account credentials are specified in the publishing job.

Notes

• If a Meridian Explorer feedback type page will be used in web browsers other than Internet Explorer (for example, Firefox or Chrome), access denial errors can occur if the Meridian Enterprise Server application pool account is not the same as the Meridian Enterprise EDM Server service account.
• Be aware that Publisher is not capable of seeing documents that are hidden by work isolation in Meridian Enterprise vaults used as the source system. Therefore, it is not possible to publish documents that reside in work areas or in the Main area of the vault if Work Isolation Mode is enabled.

The account under which the Windows file system publishing service or the Meridian Project Portal publishing service is run must have the following privileges:

• On the Meridian Enterprise Server computer:
• Access to the Meridian Enterprise Server web service
• Write access to the Kronodoc.Service.exe.config file located in the Meridian Enterprise Server program folder.
• On the server where the monitored folder resides:
• Full control

All computers where documents are published from (by the BlueCielo File Publishing Service or PowerUser extension) or where the Publisher Queue website is opened in a web browser must have access to the Meridian Enterprise Server web services. The Meridian Enterprise Server server, the web server that hosts the Meridian Enterprise Server website (if separate), and the cluster nodes (if any) must be able to communicate through Windows Communication Foundation (WCF) on HTTP port 8686. The primary node and the secondary noes of a cluster also communicate push notifications on port 40865.

To authenticate with Microsoft Online Services, the Windows Identity Foundation must be installed as described in Meridian Enterprise Server system requirements.