Installing and Registering IQService

Warning
To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts.

• Alternative Names: Look for "IQService," "Integration Service," or "Server Host".

• Network Protocol: IQService is compatible with both IPv4 and IPv6.

Downloading IQService

Installation and Service Start-Up

1. Prepare the Installation Files

   Before you start, use the downloaded components in compliance with the active SailPoint license. Use the files only for their intended purpose and do not share or redistribute them. If you have questions about usage rights, contact your Account Representative or CSM.

   1. Unzip the archive - Extract the downloaded IQService.zip archive into your desired location. For example:

      C:\SailPoint\IQService\

   2. Verify DLLs - After extracting, open the DLL file properties and confirm they are from a trusted source.

2. Install the Windows Service

   TLS and client authentication are mandatory for communication with IQService. Complete the TLS prerequisites before running the installation command. IQService disables privileged services over non-TLS connections. For detailed requirements and setup procedures, refer to Configuring TLS and Client Authentication for IQService.

   When you are ready, open a command prompt and run one of the following commands:

   Option A: Default installation

   This command installs the service as IQService-Instance1 on the default port 5050, if available.

   IQService.exe -i

   Option B: TLS-only installation

   This command installs the service as IQService-Instance1 on the TLS port number that you provide.

   IQService.exe -i -o <TLS Port Number>

   Security Notice During a Fresh Install

   When you run a fresh install of IQService, the installer displays a security notice in the command prompt. The notice states that selected services are disabled by default and must be explicitly enabled after TLS is configured.

   The notice is similar to the following:

   ╔══════════════════════════════════════════════════════════════════════════════╗
   ║  SECURITY NOTICE - Services Disabled by Default                              ║
   ╠══════════════════════════════════════════════════════════════════════════════╣
   ║  Starting this release, the following services are DISABLED                  ║
   ║  by default and must be explicitly enabled before use:                       ║
   ║                                                                              ║
   ║      GMSAPassword  - Using gMSA as a Service Account                         ║
   ║      ScriptExecutor - Script execution (before and after script)             ║
   ║                                                                              ║
   ║  To enable a service, run (TLS must be configured first):                    ║
   ║    IQService.exe -g --enable <ServiceName>                                   ║
   ║                                                                              ║
   ║  Example:  IQService.exe -g --enable GMSAPassword                            ║
   ╚══════════════════════════════════════════════════════════════════════════════╝

   Note
   Use the exact service name shown by IQService.exe -g when you run --enable. The gMSA service is called GMSAPasswordData. Confirm the name in your build before you enable the service. Refer to Option to Enable/Disable Services.

3. Verify Configuration and Start the Service

   After the installation command completes, verify the service details, complete any required configuration, and start the service.

   Service and Port Details

   • Service name: The service is installed with the name IQService-Instance1. In the Windows Services console, its display name begins with "SailPoint".

   • Default port: By default, IQService uses port 5050 for the primary instance and 5051 for the secondary instance.

   For Existing Installations (If Updating)

   Disable the old non-TLS port if you are updating an existing IQService instance to use a TLS port. This is crucial to close security gaps and maintain a secure connection.

   • For detailed instructions, refer to Disabling Non-TLS Communication for an Existing IQService Instance.

   • For complete details on the requirements and procedures for a secure setup, refer to Configuring TLS and Client Authentication for IQService.

   Start the Service

   Select one of the following methods to start the service:

   1. From the Windows Services console - Open the Services console, locate the service name beginning with "SailPoint", and select Start.

   2. From the command line - Run the following command:

      IQService.exe -s

   Grant Service Account Access to the Certificate Private Key

   Note
   If you run IQService under a service account context, grant that service account access to the private key of the valid certificate on the Windows IQService host.

   To grant access to the certificate private key:

   1. Open Certificate Manager for the local computer on the Windows IQService host.

      

   2. Open the valid certificate context menu and select All tasks > Manage private keys.

      

   3. Add the service account user that is used when configuring IQService.

      

   4. Select Apply.

   5. Restart IQService.