Recent Updates

UpdateService

With the latest release, IQService is packaged with UpdateService which needs to be configured alongside IQService to enable the auto update functionality. Once the UpdateService is configured, no manual intervention is required for further releases. To ensure secure communication between the services, SailPoint recommends that you use TLS and Client Authentication for IQService configuration, which in turn is used by the UpdateService for communication.

Configuration of Timeout

IQService supports configuring a maximum waiting time before terminating the inactive connection while reading requests. By default, the timeout value is 15 seconds. For example, you can use the IQService.exe -q 20 command to set up the time for 20 seconds.

.NET Framework Prerequisite for IQService

SailPoint recommends .NET Framework 4.8. IQService is compatible with .NET Framework 4.5.2 or later.

Correct Display of Logs

The IQService IQService.exe -v command now displays the trace level logs.

Additionally, the IQService log level values:

0=off
1=error
2=info
3=debug

By default, it is 1 = error level logs.

Improved TLS Connection

IQService now successfully connects with TLS from SailPoint when certificate SAN (subject name) is in a foreign language.

Disabling Non-TLS Communication for an Existing IQService Instance

If you are enabling TLS communication for an existing IQService instance that previously used non-TLS communication, you must ensure that non-TLS communication is disabled for that same instance. You can achieve this using one of the following methods:

Method 1 - Setting the Port

Set the existing non-TLS port to zero (0) or any negative number (such as -1, -2, -3) using the command line:
```
IQService.exe -p <zero or negative port number>
```
For example,
```
IQService.exe -p 0
IQService.exe -p -1
```
Note

Ensure to disable the non-TLS port for both the primary service and the secondary service (if configured).
After setting the port, restart the IQService.

Method 2 - Deleting the Registry Entry

Optionally, you can delete the non-TLS port entry from the IQService instance registry configuration.

Warning

Directly editing the registry can cause serious, potentially unrecoverable errors if done incorrectly. Only modify fields that are specifically intended for modification.

Following are the steps to delete non-TLS port entry from IQService instance:

Locate the registry configuration for your IQService instance.

You can find the registry path for the primary service at:
```
HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\<IQService-Instance>
```
You can find the registry path for the secondary service at:
```
HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\<IQService-Instance>\Secondary
```
Replace <IQService-Instance> with the name of your IQService instance.
Look for the port attribute.
Delete the port attribute entry.

After completing one of these methods, the IQService will only communicate using TLS, ensuring secure communication between the IQService and other components. To verify that the non-TLS port has been successfully disabled for your IQService instance, run the following command:

IQService.exe -v

After running this command, the output should display only the Configured TLS Port information along with the corresponding TLS port number, such as Configured TLS Port : <TLS Port Number>

Install and Command Line Notices

A fresh IQService install displays a security notice banner in the command prompt. The IQService.exe -? help output includes an additional TLS security warning and lists features disabled when TLS is not configured. Refer to Installing and Registering IQService and IQService Commands.

IQService Security Updates

The ScriptExecutor and GMSAPasswordData services are disabled by default. If you are upgrading from a previous version, you must configure TLS and explicitly enable each required service to avoid interruption.

Configure TLS with IQService.exe -o <TLS_Port>. For instructions, refer to Secure Communication Between VA and IQService. Enable services with IQService.exe -g --enable <Service Name>, then restart IQService. Refer to Option to Enable/Disable Services for service names and usage details.

ScriptExecutor

Used for native before and after provisioning scripts, including when the nativeRules feature is configured on an Active Directory source. Refer to Before/After Scripts for IQService.

GMSAPasswordData

Used to retrieve clear-text gMSA passwords from Active Directory. Refer to Using gMSA as a Service Account.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.