Understanding the security requirements

The account used by the IIS application pool that is assigned to the Publisher web service requires:

• If the Windows authentication option is enabled in BlueCielo Application Manager as described in Configuring the BlueCielo Application Manager, the account must have the db_owner role for the BlueCielo Application Manager configuration database where publishing data is stored.
• Sufficient privileges in the publishing source and destination system to perform the configured actions (for example, updating the feedback property in a source system).

The Publisher setup program creates an application pool named BC-Publisher with the correct settings. To ease the configuration and maintenance, we recommend that you use this application pool with a dedicated user account.

Dex.exe must run under a user account with the following privileges:

• On the Publisher computer:
• The folder specified by the Windows %TEMP% environment variable for the user account under which the process is run (read/write access)
• BlueCielo Publisher folder (read/write access)
• BlueCielo Publisher\Logs folder (read/write access)
• Any folders used by the rendering modules or system links (read/write access)
• On the database server:
• If the Windows authentication option is enabled in BlueCielo Application Manager as described in Configuring the BlueCielo Application Manager, the account must have the db_owner role for the BlueCielo Application Manager configuration database where publishing data is stored.

• Run the following script in SQL *Plus to create a user account and to grant the necessary privileges. Specify this account for the IIS application pool and the account under which Dex.exe is run in the preceding descriptions:

  CREATE USER <%UserName%> IDENTIFIED BY <%Password%>; 
  GRANT RESOURCE, CREATE SESSION TO <%UserName%>;
  GRANT RESOURCE, CONNECT TO <%UserName%>; 
  GRANT EXECUTE ON CTX_DDL TO <%UserName%>;
  GRANT CREATE VIEW TO <%UserName%>;
  GRANT ALTER ANY TABLE TO <%UserName%>;
  GRANT CREATE PROCEDURE TO <%UserName%>;
  GRANT CREATE TRIGGER TO <%UserName%>

• On the source and destination systems:
  • Sufficient privileges to perform the configured actions (for example, updating the feedback property in a source system).

Note    Be aware that Dex.exe is not capable of seeing documents that are hidden by work isolation in Meridian Enterprise vaults used as the source system. Therefore, it is not possible to publish documents that reside in work areas or in the Main area of the vault if Work Isolation Mode is enabled.

The account under which the Windows file system publishing service or the Kronodoc publishing service is run must have the following privileges:

• On the Publisher computer:
• Access to the Publisher web services
• On the server where the monitored folder resides:
• Monitored folders (Full Control)

All computers where documents are published from (by the BlueCielo File Publishing Service or PowerUser extension) or where the Publisher Queue website is opened in a web browser must have access to the Publisher web services.

To authenticate with Microsoft Online Services, the Windows Identity Foundation must be installed as described in Publisher computer requirements. For more information on publishing to a cloud-hosted Microsoft SharePoint site, see Configuring the Microsoft SharePoint destination options.