Prerequisites

The following lists the software, hardware, and service account requirements.

Software Requirements

Operating Systems

• Microsoft Windows Server 2025
• Microsoft Windows Server 2022
• Microsoft Windows Server 2019
• Microsoft Windows Server 2016

.NET Framework

• .NET Framework version 4.8 and later

Hardware Requirements

The hardware requirements are specified as:

Service Account

The service account defined in the SailPoint source that connects to IQService, is used for provisioning operations, aggregation (for Active Directory, terminal services and Skype attributes), and server-less binding for respective target system.

However, the account defined for the IQService Log On as account in Windows, is used for the before/after scripts where Powershell is being used and if the source's service account is not used then the Powershell session is opened under the service account credentials of IQService.

To use gMSA as a service account for Active Directory sources, refer to Configuring IQService to Use gMSA as a Service Account for Active Directory for more information.

Source-Specific Additional Prerequisites

The following lists the sources that require IQService and the respective additional prerequisites:

Active Directory

• The user must be a Local Administrator and an Account Operator or Domain Administrator in Active Directory.

  Note

  The Account Operator user can manage passwords of the normal users. However, if any of the users are at a higher level than Account Operator (such as a Domain Admin), then the Service Account needs to be at the same level or higher and the Service Account must have appropriate rights on the Active Directory.

• Windows PowerShell 3.0

• The Domain Controller must be accessible from IQService host computer.

• For Microsoft Skype for Business Server user management:

  • IQService host must have Skype Server Administrative Tools installed
  • IQService must be installed in the same domain as the Skype server
  • The user must be a member of RTCUniversalServerAdmins and CSAdministrator domain groups. The user must also be a member of local Administrator group where IQService is installed.

  Note

  Skype Server Administrative Tools cannot be installed on a Domain Controller. If the IQService is currently running on a Domain Controller, you must move it to any other machine where tools can be installed, before provisioning to Skype.

• For Microsoft Exchange provisioning:

  • To manage Microsoft Exchange Server 2010 and above, the user and the user running IQService must be a member of the Recipient Management group.
  • Windows PowerShell 3.0 is required if you want to manage Exchange using the Active Directory source and IQService is installed on servers with operating systems older than Microsoft Windows 2012.

  Note

  For Microsoft Exchange Server 2007 and Skype for Business Server, rename the app.config file present in the IQService directory to IQService.exe.config.

  Note

  The IQService has the multi-forest support for the Active Directory source.

• The Active Directory source supports Serverless configuration. To get the closest Active Directory Server (DomainController) for a particular domain, the source calls the IQService.

• If the Active Directory source is configured in Serverless mode (no explicit Active Directory Server defined), the following are the prerequisites:

  1. Windows PowerShell 3.0 or above.
  2. Active Directory Module for Windows PowerShell must be installed.

HCL Domino

• A HCL Notes Client that has the same version as the HCL Domino Server.

• Microsoft Visual Studio C++ 2015-2022 Redistributable 14.0 onwards.

  Note

  Ensure that the PATH environment variable must contain the Notes data folder. For example, C:\Program Files\HCL\Notes

• If you are running a 32-bit version of HCL Notes (that is, a version prior to HCL Domino Client 14.0), IQService must be running as a 32-bit process to interact with 32-bit HCL Notes. If IQService must be installed on a 64-bit Windows system, perform the following before installing the IQService:

  1. Download Microsoft Windows SDK or .NET Framework SDK.
  2. Extract the IQService zip file into a temporary folder. For example, C:\temp

  3. Run the following command from the command prompt:

     <SDK Bin>\CorFlags.exe C:\temp\IQService.exe /32BIT+
     

     For example,

     C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\x64>CorFlags.exe C:\temp\IQService.exe /32BIT+
     

     This command converts the IQService.exe to a 32-bit application.

  4. Copy all the files from C:\temp to the C:\Program Files (x86)\HCL\Notes path.

  5. Install and start the IQService. For more information on IQService installation steps, refer to Installing and Configuring IQService.

• If you are running a 64-bit version of HCL Notes (that is, HCL Domino Client 14.0 and onwards), IQService must be running as a 64-bit process in order to interact with the 64-bit HCL Domino Client.

  1. Extract IQService zip file into a temporary folder. For example, C:\temp
  2. From path C:\temp\IQService\SPLotusNotes-x64\, copy the SPLotusNotesWrapper.dll file and replace it with the destination C:\temp\IQService\
  3. Copy all the files from C:\temp to the C:\Program Files\HCL\Notes path.
  4. Install and start the IQService. For more information on IQService installation steps, refer to Installing and Configuring IQService.

Azure Active Directory

• Location: Remote or Local
• Other Libraries: .NET Framework version 4.5.x onwards
• PowerShell version 5.1.x onwards (with the exception of PowerShell v7, which is not supported).

Ports Used with Active Directory Integrations

The IQService provisioning agent calls functions exposed by Microsoft's .net packages that are a "black box" that communicate to Active Directory indirectly. SailPoint does not control what port numbers these APIs leverage to interact with Active Directory. Microsoft publishes a list of ports that the .net API and ADSI interfaces use to communicate with an Active Directory server. Were a firewall to be placed between IQService and the Active Directory domain controllers it would need to be exceedingly permissive by opening a large number of dynamic ports. The complete list of ports is published by Microsoft here: Active Directory and Active Directory Domain Services Port Requirements.

The IQService agent uses a sub-set of these ports documented by Microsoft. For communication between IQService and a domain controller SailPoint recommends at least the following ports must be opened:

• LDAP Ports 389 and 636
• Kerberos port 88
• Active Directory Web Services 9389
• Active Directory port 3268
• Active Directory port 3269
• Active Directory DNS port 53
• Active Directory Replication, Login services port 445
• Kerberos Passwords, port 464
• Authentication port UDP 137
• Authentication port TCP 139

For more information, refer to IQService Architecture - Network Ports and Firewalls.

Required Permissions

The IQService supports configuration of the minimum permissions. The sources supporting IQService minimum permissions are:

• Active Directory
• Microsoft SharePoint Server

Prerequisites

• The IQService must have been installed with the admin permission.
• A domain user or local user can be used to run the IQService with minimum required permission.

Steps for Running Service with Minimum Permission User

1. Install the IQService with admin permission.

2. In registry, assign full permissions to the domain user or Local user or GMSA user created previously (as mentioned in Prerequisites) to the IQService instance that is installed and needs to be run.

   Note

   The default location for the registry is Computer\HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\IQService-InstanceName

Steps to Assign Full Permissions to the User That Is Required to Manage the IQService Instance

1. Assume a new IQService instance is installed on machine (IQService-InstanceName).

2. Navigate to registry and search for SailPoint registry hive.

   Computer\HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\IQService-InstanceName

   Right-click on the Instance and select permission.

3. Add the required user and assign full Control Permission. Save the changes.

4. Use the same user for "log on as service" from Services tab for the IQService instance.

5. Restart the IQService to work with the user defined above.

   Log file must also have the required permission to user for writing files. The IQService Instance folder must also have the required permissions.

For enabling TLS for IQService settings, a normal user or gMSA user must have full permission to access the IQService certificate that is required for communication between secure TLS communication between SailPoint and IQService. Perform the following:

1. On IQService host, navigate to Personal Folder (on Local System) where the certificate exists.

2. Add full control access on Certificate to the user

   1. Right click on IQService Certificate > All tasks > Manage Private keys > Add user > Full control > Ok
   2. Add the user and provide full permission that is used for managing the IQService.

Configuring IQService to Use gMSA As a Service Account for Active Directory

For all the gMSA(s) that will be used during Active Directory source configuration, PrincipalsAllowedToRetrieveManagedPassword permission is required to be added to the IQSerivce Log On User.

Add the following permission to the Log-On User of the IQService using the Active Directory PowerShell module:

Set-ADServiceAccount -Identity <gMSA-SAMAccountName> -PrincipalsAllowedToRetrieveManagedPassword "<IQService-LogOn-User>"

For example,

Set-ADServiceAccount -Identity Aug13u1$ -PrincipalsAllowedToRetrieveManagedPassword IQserviceuser1

Refer to Using gMSA as a Service Account for more information.

When gMSA password retrieval is required, configure TLS on IQService and run IQService.exe -g --enable GMSAPasswordData, then restart IQService. Refer to Option to Enable/Disable Services and Using gMSA as a Service Account for upgrade steps and related security changes.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.