Security requirements

The Meridian Enterprise setup program creates an application pool named BCEnterprise (by default) with the correct settings. To ease the configuration and maintenance, we recommend that you use this application pool with a dedicated system account that is also used for the Meridian Enterprise Server service.

The Meridian Enterprise Server service must run under an account with the following privileges:

Note

All computers where documents are published from (by the BlueCielo File Publishing Service or PowerUser extension) or where the Publisher Queue website is opened in a web browser must have access to the Meridian Enterprise Server web services.

For example, if Meridian Enterprise and BlueCielo Publisher are running on separate computers, we recommend that you change the EDM Server service from using the default SYSTEM account to use a domain account with sufficient permissions to access the web services on the Meridian Enterprise Server computer. If this is not done, users attempting to register documents for publishing in Meridian Enterprise PowerUser will see errors and registration will fail.

The Meridian Enterprise Server server, the web server that hosts the Meridian Enterprise Server website (if separate), and the cluster nodes (if any) must all be able to communicate through Windows Communication Foundation (WCF) on HTTP port 8686. The primary node and the secondary nodes of a cluster also communicate push notifications on port 40865.
If a Meridian Explorer feedback type page will be used in web browsers other than Internet Explorer (for example, Firefox or Chrome), access denial errors can occur if the Meridian Enterprise Server application pool account is not the same as the Meridian Enterprise EDM Server service account.
To authenticate with Microsoft Online Services, the Windows Identity Foundation must be installed as described in Understanding the Meridian Enterprise Server system requirements. Only Azure Active Directory with DirSync is supported.
Internet Explorer Enhanced Security Configuration can cause the Meridian Explorer client home page to fail to load and to show JavaScript errors. It can be disabled in Windows Server Manager.
If your Meridian Enterprise system will use more than one server, the services might need to be configured to allow security delegation as described in Understanding security delegation.
Access denied errors can occur during import package scanning and import if the Meridian Enterprise Server and the Meridian Enterprise EDM Server are not running under the same account.
Path or access errors can occur for Novell NetWare mapped drives if the drives are not available to the Meridian Enterprise Server application pool account in administrator mode. To ensure that the drives are available, run a scheduled task at system startup as the NT AUTHORITY\SYSTEM account with the Run with highest privileges option enabled and the following command line:
```
cmd.exe /C net use <drive letter:> "<UNC path>" /persistent:yes
```

The account under which the Windows file system publishing service or the BlueCielo Project Portal publishing service is run must have the following privileges: