Page History

IIS

1. Run IIS and switch to Default Web Site\pam
   
2. Open the Configuration Editor from Management section
3. Open the Section: drop-down list and select system.webServer\security\requestFiltering item
4. Open the requestLimits item, set maxQueryString to 8192
5. Click Apply in Actions section
6. Switch to Default Web Site\pam\core
7. Open the

IIS

1. Run IIS and switch to Default Web Site
   
2. Select the api application and open the Configuration Editor from Management section
3. Open the Section: drop-down list and select system.webServer - serverRuntime \serverRuntime item
4. Set the uploadReadAheadSize parameter to value of  to 1048576
5. Click Apply in Actions section

Indeed PAM Core

Switch to C:\inetpub\wwwroot\pam\apicore folder and edit webappsettings.configjson file:

<logServer … />: 

• Url - API URL for the uniform event log

<logServer Url="http://logserver.indeed-id.local/ils/api" CertificateThumbprint="" CertificateFilePath="" CertificateFilePassword="" />

<logServerClient … />:

• EventCacheDirectory - a temporary folder for event writing
  

<logServerClient AppId="pam" Component="server" EventCacheDirectory="C:\Temp\ILS\Core\EventCacheDirectory" LogServerTargetConfigFile="" EventCacheSendingIntervalSec="10"/>

<encryptionSettings ... />:

ConnectionStrings section

• PamCore - IPAMCore database connection string
• JobsQueue - IPAMTasks database connection string

Connection String parameters:

• Server - DBMS server name or named instance
• Database - Database name
• User ID - account to use with Database

• Password - account password
  
  

  Code Block
  language js
  "ConnectionStrings": { "PamCore": "Server=sql.domain.local;Database=IPAMCore;Integrated Security=False;User ID=IPAMSQLService;Password=password", "JobsQueue": "Server=sql.domain.local;Database=IPAMTasks;Integrated Security=False;User ID=IPAMSQLService;Password=password" },

  
  

  Warning
  icon false
  If using a Named Instance of Microsoft SQL Server, the value of the Server parameter must be specified in the Server Name\\Named instance format. Code Block language js "PamCore": "Server=sql\\instance; ..."

  
  

Database section

Provider - DBMS provider

• mssql - Microsoft SQL Server
• pgsql - PostgreSQL, PostgreSQL Pro

Auth section

• IdpUrls - Indeed PAM IdP URL address

• ApiSecret - Key for component authentication purposes
  

  
  

  Note
  icon false
  The key for the ApiSecret parameter is generated by the console utility Pam.ConsoleApp.exe

  
  

• PamGatewayIpAddresses - Indeed PAM Gateway or SSH PROXY IP Addresses
  
  

  Code Block
  language js
  "Auth": { "IdpUrls": [ "https://pam.domain.local/pam/idp" ], "ApiSecret": "aEB+UkZI3imDdp4xLHgHz/pxLZI9XEX4q6uI822/XfdPKaXJjfGrDVCH/u7SxVq3Os3GTFnfgkQc+AJBhmm4rQ==", "MediaDataUrlsSecret": "42C329CF-B932-46DE-83F5-0C302AE9E486", "PamGatewayIpAddresses": "192.168.48.155, 192.168.48.202", "GatewayCertificateValidation": { "Enabled": false, "Filter": "" } },

  
  

Encryption section

• Algorithm - encryption algorithm

• Key - encryption

• key
  
  

  Note
  icon false
  The encryption key is generated by the IndeedPAM.KeyGen.exe utility, which is the part of the Indeed PAM distribution and is located in the /Misc directory.

  
  

  Code Block

<encryptionSettings cryptoAlgName="DES" cryptoKey="ea06v76ht457t2l8" />

<adUserCatalogProvider ... >:

• serverName - is the DNS name of Domain Controller that performs Global Catalog function
  
• containerPath - is the LDAP path to container or unit to be used as Active Directory user directory
• userName - service account for working with Active Directory user directory
• Password - service account password

<adUserCatalogProvider id="ad" serverName="dc.indeed-id.local" containerPath="OU=organization unit,DC=indeed-id,DC=local" userName="IPAMManager" password="password">

1. <add name="DBConnection" ... />:
   • Data Source - Microsoft SQL Server Name or Instance Name
   • Initial Catalog - database Name (IPAMCore)
   • User ID - service account to use with Indeed PAM databases
   • Password - service account password
     
2. <add name="JobsQueueConnectionString" ... />:
   • Data Source - Microsoft SQL Server Name or Instance Name
   • Initial Catalog - database Name (IPAMTasks)
   • User ID - service account to use with Indeed PAM databases
   • Password - service account password
     

An example of connecting to a Microsoft SQL Server database

<connectionStrings>
	<add name="DBConnection" connectionString="Data Source=MSSQLServer;Initial Catalog=IPAMCore;Integrated Security=False;User ID=IPAMSQLService;Password=password" providerName="System.Data.SqlClient" />
	<add name="JobsQueueConnectionString" connectionString="Data Source=MSSQLServer;Initial Catalog=IPAMTasks;Integrated Security=False;User ID=IPAMSQLService;Password=password" providerName="System.Data.SqlClient" />
</connectionStrings>

An example of connecting to a PostgreSQL Pro database

<connectionStrings>
	<add name="DBConnection" connectionString="Data Source=PostgreSQLProServer;Initial Catalog=IPAMCore;Integrated Security=False;User ID=IPAMSQLService;Password=password" providerName="Npgsql" />
	<add name="JobsQueueConnectionString" connectionString="Data Source=PostgreSQLProServer;Initial Catalog=IPAMTasks;Integrated Security=False;User ID=IPAMSQLService;Password=password" providerName="Npgsql" />
</connectionStrings>

For PostgreSQL Pro, in the <appSettings> ... </appSettings> section, add the line

<appSettings>
	...
	<add key="DBMS" value="PostgreSQL" /> 
</appSettings>

If using a Named Instance of Microsoft SQL Server, the value of the Data Source parameter must be specified in the <Server Name>\<Named instance> format.

<connectionStrings>
	<add name="DBConnection" connectionString="Data Source=MSSQLServer\Named instance; ... "/>
	<add name="JobsQueueConnectionString" connectionString="Data Source=MSSQLServer\Named instance; ... "/>
</connectionStrings>

<add key="IdpUrl" ... />:

• value - URL Indeed PAM IdP

<add key="IdpUrl" value="https://pam.indeed-id.local/idp"/>

<add key="PamProxyIpAddresses" … />:

• value - Indeed PAM Gateway server IP address
  

• language js
  "Encryption": { "Algorithm": "AES", "Key": "4258egk74n834rr93bf458813l7618wq7f1jei9a58915pk511z63n5j0svt1m1o8", "MediaFiles": { "Algorithm": "AES" } },

  
  

Features section

• AllowRevealAccountName - option for reveal the Account in the user console. If false, the Account names will not be revealed in the user console.
• AllowRevealCredentials - option for reveal the Password in the user console. If false, the password from Accounts will not be revealed in the user console..

LogServer section

• Directory - temporary folder for recording events

• Url - Indeed Log Server API URL address

  Code Block
  language js
  "LogServer": { "AppId": "pam", "Component": "server", "EventCache": { "Directory": "C:\\ILS\\Core", "SendingIntervalSec": 10 }, "Server": { "Url": "https://pam.domain.local/ls/api", "Certificate": { "Thumbprint": "", "FilePath": "", "FilePassword": "" } } },

  
  

UserCatalog section

• ServerName - is the DNS name of Domain Controller that performs Global Catalog function
• ContainerPath - is the Distinguished name of Container or OU to be used as Active Directory user directory
• UserName - service account for working with Active Directory user directory

• Password - service account password

  Code Block
  language js
  "UserCatalog": { "RootProvider": "ad", "Providers": { "ActiveDirectory": [ { "Id": "ad", "ServerName": "domain.local", "ContainerPath": "DC=domain,DC=local", "UserName": "IPAMManager", "Password": "password", "UserMapRules": { "Settings": [ { "Category": "person", "Class": "user" } ] } } ] } }