2.1Before you begin

Prepare the server

Make sure the server meets the requirements in Chapter 1, Introduction, and then:

1. 1Install Windows Server 2016 or later.
2. 2Add the Web Server (IIS) role.
3. 3If you want people to sign in with their Windows session (Kerberos), also add the IIS Windows Authentication role service. In PowerShell: Install-WindowsFeature Web-Windows-Auth.
4. 4Install the ASP.NET Core 10 Hosting Bundle from Microsoft. It contains the .NET 10 runtime and the ASP.NET Core Module for IIS. Install it after IIS, so that it registers the IIS module.
5. 5Decide which IIS site will host the product. The setup wizard does not create sites or bindings. Use an existing site — by default Default Web Site — and give it an HTTPS binding with a valid certificate for the host name your users will use.

Important: The product only works over HTTPS. The sign-in cookie is issued with the Secure flag, so a browser on a site reached over plain HTTP discards it and nobody can sign in.

Prepare the database

Choose a database provider:

For SQL Server or PostgreSQL, ask your database administrator to:

1. 1Create an empty database for the product. The setup wizard does not create the database, because collation, recovery model and file placement are decisions for the database administrator.
2. 2Give the identity the product will connect as enough rights to create and change tables, because the product creates its own schema and upgrades it on every new version. For SQL Server, membership of db_owner on the product's database is the simplest choice.

For SQL Server, the recommended identity is the IIS application pool's own identity, using Windows integrated authentication. With the default pool name this is IIS AppPool\api. It keeps any database password out of the configuration entirely. If the database is on another server, grant the rights to the server's computer account instead (DOMAIN\SERVERNAME$), because that is how a pool identity appears on the network.

For SQLite, choose a folder for the database file. The application pool identity needs write access to the folder, not only to the file, because SQLite writes a journal file next to the database.

Decide the public address

Decide the address users will type to reach the product, for example https://gateway.example.com. You will enter it in the wizard as the Public base URL. The product builds every absolute address it hands out from this value — single sign-on callback addresses, the address an integration polls for an approval result, password reset and account setup links — so it must be correct.

Allow outbound access to the licensing service

The server must reach https://public-hub.synergy.lt/ on port 443. It is used to activate and validate the licence, to check for updates, and to send feedback, bug reports and (if allowed) usage statistics.