Installing and Registering IQService

Warning
To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts.

You can download IQService from the configuration page of a source that requires it.

• Alternative Names: Look for "IQService," "Integration Service," or "Server Host".

• Network Protocol: IQService is compatible with both IPv4 and IPv6.

Download the Integration Service

Install this service only if you use one of the following sources:

• Azure Active Directory

• Active Directory

• HCL Domino (IBM Lotus Domino)

• Microsoft SharePoint Online

• Microsoft SharePoint Server

• Windows Local

Note
No need to install IQService if you do not already have one of these sources configured.

To download the service:

1. Go to Connections > Sources.

2. Select one of the sources that needs IQService.

3. On the source configuration page, find the panel labeled IQService or Integration Service.

   

4. Select Download.

Installation and Service Start-Up

1. Prepare the Installation Files

   Before you start, use the downloaded components in compliance with the active SailPoint license. Use the files only for their intended purpose and do not share or redistribute them. If you have questions about usage rights, contact your Account Representative or CSM.

   1. Unzip the archive - Extract the downloaded IQService.zip archive into your desired location. For example:

      C:\SailPoint\IQService\

   2. Verify DLLs - After extracting, right-click the DLL files and check the properties to confirm they are from a trusted source.

2. Install the Windows Service

   To improve security, the IQService installation enforces a TLS configuration by default. Complete the necessary TLS prerequisites before running the installation command. For detailed requirements and setup procedures, refer to Configuring TLS and Client Authentication for IQService.

   When you are ready, open a command prompt and run one of the following commands:

   Option A: Default installation

   This command installs the service as IQService-Instance1 on the default port 5050, if available.

   IQService.exe -i

   Option B: TLS-only installation

   This command installs the service as IQService-Instance1 on the TLS port number that you provide.

   IQService.exe -i -o <TLS Port Number>

3. Verify Configuration and Start the Service

   After the installation command completes, verify the service details, complete any required configuration, and start the service.

   Service and Port Details

   • Service name: The service is installed with the name IQService-Instance1. In the Windows Services console, its display name begins with "SailPoint".

   • Default port: By default, IQService uses port 5050 for the primary instance and 5051 for the secondary instance.

   For Existing Installations (If Updating)

   Disable the old non-TLS port if you are updating an existing IQService instance to use a TLS port. This is crucial to close security gaps and maintain a secure connection.

   • For detailed instructions, refer to Disabling Non-TLS Communication for an Existing IQService Instance.

   • For complete details on the requirements and procedures for a secure setup, refer to the IQService: TLS and client authentication configuration guide.

   Start the Service

   Select one of the following methods to start the service:

   1. From the Windows Services console - Open the Services console, locate the service name beginning with "SailPoint", and select Start.

   2. From the command line - Run the following command:

      IQService.exe -s

   Grant Service Account Access to the Certificate Private Key

   Note
   If you run IQService under a service account context, that service account must be granted access to the private key of the valid certificate on your VA machine.

   To grant access to the certificate private key:

   1. Go to Certificate Manager on your VA.

      

   2. Right-click the valid certificate and select All tasks > Manage private keys.

      

   3. Add the service account user that is used when configuring IQService.

      

   4. Select Apply.

   5. Restart IQService.