What Are the Accounts and Groups to Create?

Article
11/12/2009

For the latest version of Commerce Server 2007 Help, see the Microsoft Web site.

This topic provides a summary of the user accounts and groups that you create. In a multi-computer deployment, Commerce Server accounts and user groups must be created on the domain controller. In a single-server deployment, you can create these accounts and groups on the computer where Commerce Server is installed. For the internal/test and development environments, create the same accounts and groups that you create for the data domain in the production environment.

See the following sections for the account and group requirements for each of these areas:

Commerce Server User and Service Accounts
Commerce Server Groups and Account Assignments
Additional User Groups for Granular Security
SQL Server Database Instances, Accounts, and Role User Mappings

Commerce Server User and Service Accounts

The following table lists the accounts that you create or that are created when you install prerequisite software. You must create the <CS Direct Mailer User>,<CS Installer>,<CS Staging User>, CSLOB, and RunTimeUser accounts before you install Commerce Server. Registering ASP.NET 2.0 as the default framework creates the ASP.NET account. Post-installation, you create SQL Server Login accounts and associate the user accounts together with Windows user groups.

For information about registering ASP.NET as the default framework, see "Install Prerequisite Software" in the "Commerce Server 2007 Installation and Configuration Guide" at https://go.microsoft.com/fwlink/?LinkId=57268.

Account Name	Description	Windows User Group	SQL Server Login Account
<CS Direct Mailer User>	Account of person who manages the Direct Mailer service.	not applicable	not applicable
<CS Installer>	Account of person logged on to install and configure Commerce Server.	Administrator, CatalogAdminGroup, MarketingAdminGroup, OrdersAdminGroup, ProfilesAdminGroup	not applicable
<CS Staging User>	Account of person who manages Commerce Server Staging.	not applicable	<CS Staging User>
ASPNET	Account that is used for running the ASP.NET worker process (aspnet_wp.exe) .	not applicable	ASPNET
BizTalkAdmin	BizTalk Server Administrator identity.	Administrators, BizTalk Server Administrators, BizTalk Server Operators	not applicable
BizTalkSvc	BizTalk Server service identity.	BizTalk Application Users, BizTalk Isolated Host Users, IIS_WPG or IIS_IUSRS, SQLServer2005NotificationServicesUser, SSO Administrators	BizTalkSvc
CLUSvc	Cluster service identity. Create only for clustered instances of SQL Server on the data tier domain controller only.	not applicable	not applicable
CSDMSvc	Commerce Server Direct Mailer service identity.	DML_SG	CSDMSvc
CSHealthMonitorSvc	Commerce Server Health Monitoring service identity. Create on the domain controller only.	not applicable	CSHealthMonitorSvc
CSLOB	Commerce Server Adapters identity.	not applicable	not applicable
CSStageSvc	Commerce Server Staging (CSS) service identity.	CSS_SG, CSS Administrators, CSS Operators	CSStageSvc
DTSImport	Data transformation services import identity.	not applicable	not applicable
MOMSvc	Microsoft Operations Manager (MOM) service identity.	not applicable	not applicable
RunTimeUser	Anonymous user identity (IIS account for Commerce Server).	IIS_WPG (on Windows Server 2003) or IIS_IUSRS (on Windows Server 2008)	RunTimeUser
SQLSvc	SQL Server service identity.	not applicable	not applicable

It is highly recommended that you create each of these accounts by using the following requirements for strong passwords:

Passwords must be at least six (6) characters long.
Passwords may not contain your user name or any part of your full name.
Passwords must contain characters that are uppercase letters, lowercase letters, numbers, and non-alphanumeric characters (such as punctuation symbols).

Commerce Server Groups and Account Assignments

Commerce Server Administrator Groups

You create four administrator groups summarized in the following table. These represent the minimum number of groups to define. You should create distinct user groups based on your business needs. You then assign these groups to authorization roles through the Authorization Manager. For more information, see Authorizing Users and Groups to Access Web Services.

User group	Description	Accounts to assign
CatalogAdminGroup	Administrator group for the Catalog and Inventory Web services.	<CS Installer>, Business User Accounts
MarketingAdminGroup	Administrator group for the Marketing Web services.	<CS Installer>, Business User Accounts
OrdersAdminGroup	Administrator group for the Orders Web services.	<CS Installer>, Business User Accounts
ProfilesAdminGroup	Administrator group for the Profiles Web services.	<CS Installer>, Business User Accounts

For a production deployment, you will want to define more groups in order to take full advantage of the role assignment roles available. For descriptions about each predefined role, see the next section.

Commerce Server Site and Account and Application Pool Assignments

The following table summarizes the default names for the accounts and application pool that you create when you unpack a Commerce Server site.

Default name	Windows service account	SQL Server login account	Application pool
StarterSite	RunTimeUser	RunTimeUser	StarterSiteAppPool
CSharpSite	RunTimeUser	RunTimeUser	CSharpSiteAppPool

Commerce Server Web Services and Account and Application Pool Assignments

Commerce Server installs the Web services when you unpack a site, and selects the Web services to install. Each Commerce Server Web service requires definition of a Windows user account, Windows user group, SQL Server login account, and application pool. The following table summarizes the default names Commerce Server and the installation guide use. You create the Windows user accounts before you unpack a site, and you create the SQL Server login accounts and application pools after you unpack the site.

Commerce Server Web service	Default name	Windows user account	Windows user group	SQL Server login account	Application pool
Catalog	CatalogWebService	CatalogWebSvc	CatalogAdminGroup, IIS_WPG or IIS_IUSRS	CatalogWebSvc	CatalogWebSvcAppPool
Marketing	MarketingWebService	MarketingWebSvc	MarketingAdminGroup, IIS_WPG or IIS_IUSRS	MarketingWebSvc	MarketingWebSvcAppPool
Orders	OrdersWebService	OrdersWebSvc	OrdersAdminGroup, IIS_WPG or IIS_IUSRS	OrdersWebSvc	OrdersWebSvcAppPool
Profiles	ProfilesWebService	ProfilesWebSvc	ProfilesAdminGroup, IIS_WPG or IIS_IUSRS	ProfilesWebSvc	ProfilesWebSvcAppPool

For each site that you unpack, we recommend that you create unique Web service account names, SQL Server login account names, Windows user groups, and application pools. You can share application pools, but we do not recommend this action.

Note

When installing and configuring Commerce Server 2007 Developer Edition on Windows XP (32bit), you cannot create additional application pools. For development, you can use the default application pool.

Web Service Administrator Role Assignments

The following table lists the Web services and their corresponding authorization stores and administrator roles. You must assign each Web service account to its corresponding authorization role.

Authorization Store	Role	Account Assignments
CatalogAuthorizationStore.xml	Administrator	CatalogWebSvc, <CS Installer>
MarketingAuthorizationStore.xml	MarketingAdministrator	MarketingWebSvc, <CS Installer>
OrdersAuthorizationStore.xml	OrdersAdministrator	OrdersWebSvc, <CS Installer>
ProfilesAuthorizationStore.xml	ProfileAdministrator	ProfilesWebSvc, <CS Installer>

After you assign write permissions to the authorization stores, in order to perform any operation in the Business Management applications, you assign users to the administrator roles for each Web service. By adding <CS Installer> to each administrator role, you can open and use each Business Management application.

BizTalk Adapters Role Assignments

The following table lists the role assignments to which CSLOB, the BizTalk adapters identity, must be added.

Authorization store	Role	Description
CatalogAuthorizationStore	CatalogAdministrator	Gives the catalog adapter permission to import catalog changes and export catalogs.
CatalogAuthorizationStore	InventoryAdministrator	Gives the inventory adapter permission to import inventory catalog changes and export inventory catalogs.
OrdersAuthorizationStore	OrdersAdapter	Enables the orders adapter to perform all basic functions, such as Update Purchase Order, Save Purchase Order, Accept Basket, Orders Query, and Orders Export.
ProfilesAuthorizationStore	UserObject, ProfileWriter_Adapter	Enables the profiles adapter to update profile objects when it uses the following operations: Profile Delete, Profile Update, Profile Import, Profile Query, and Profile Export.

Commerce Server Health Monitoring Service Role Assignments

For Commerce Server to monitor the Web services, you must grant the Commerce Server Health Monitoring service permissions to view each service. The following table lists the role assignments you assign to the CSHealthMonitorSvc account.

Authorization store	Role
CatalogAuthorizationStore.xml	CatalogViewer
MarketingAuthorizationStore.xml	MarketingViewer
OrdersAuthorizationStore.xml	OrdersViewer
ProfilesAuthorizationStore.xml	ProfileAdministrator

Additional User Groups for Granular Security

The following sections summarize the various authorization roles that are predefined for the Commerce Server systems. For each authorization role of interest, create an associated user group on the domain controller. You can then add business user accounts to the user group.

Catalog and Inventory Systems
Marketing System
Orders System
Profiles System

For each user group you create, you must assign the groups to authorization roles through the Authorization Manager. For more information, see Authorizing Users and Groups to Access Web Services.

Note

A few features require permissions in more than one authorization store. For example, the authorization role must have Profiles Administrator and Catalog Viewer permissions to create credit card profiles.

Catalog and Inventory Systems

The following table describes the predefined authorization roles for the Catalog System and the Inventory System.

Role	Description
CatalogAdministrator	Members can manage the Catalog System.
CatalogViewer	Members have read access to the Catalog System.
CatalogManager	Members can manage all the catalogs in the Catalog System.
SchemaManager	Members can manage the catalog and inventory schema, including property, category, and product definitions.
CatalogSetsAdministrator	Members can manage all the catalog sets.
CatalogSetsViewer	Members can view all the catalog sets in the Catalog System.
InventoryAdministrator	Members can manage the Inventory System.
InventoryViewer	Members can view all the catalogs in the Inventory System.
InventorySynchronizationManager	Members can synchronize the run-time Inventory System with the management system.
Administrator	Members can manage the Catalog System and the Inventory System.

Marketing System

The following table describes the predefined authorization roles for the Marketing System.

Role	Description
MarketingAdministrator	Members have full access to every operation in the Marketing System.
MarketingApprover	Members can approve or reject marketing items, such as campaigns, discounts, and expressions.
MarketingAuthor	Members can create marketing-related items, including customers, campaigns, discounts, and expressions.
MarketingViewer	Members can view and search marketing items, including campaign event logs.
GlobalExpressionAuthor	Members can create, edit, and delete global expressions across multiple discounts.
RuntimeSiteManager	Members can refresh the Discounts and Advertisements caches of the run-time site.

Orders System

The following table describes the predefined authorization roles for the Orders System.

Role	Description
OrdersAdministrator	Members can manage data integrity and cleanup issues.
OrdersConfigurationEditor	Members can manage orders configuration data for the site.
OrdersViewer	Members have read access to view orders.
OrdersAdapter	Members can search orders for order processing and updates.

Profiles System

The following table describes the predefined authorization roles for the Profiles System.

Role	Description
ProfileAdministrator	Members have complete access to the Profiles System.
ProfileWriter_BusinessManager	Members of this scope-level role have access to the profile definition within the scope. There are six profile definitions: UserObject, Address, Organization, BlanketPO, CreditCard, and Currency.
ProfileWriter_CSR	Members of this scope-level role have access to the profile definition within the scope.
ProfileWriter_Adapter	Members of this scope-level role have access to the profile definition within the scope.

Users of the scope-level roles have access only to the profile type within the scope name. For example, members of the ProfileWriter_BusinessManager role in the UserObject scope have access to the UserObject profile definition only. You must add users to each scope-level role individually.

SQL Server Database Instances, Accounts, and Role User Mappings

SQL Server Database Instances Created for Commerce Server

The following table summarizes the Commerce Server databases and default database names that Commerce Server and the installation guide use.

Commerce Server SQL database instance	Default database name	How the database is created
CS Administration	MSCS_Admin	Created by the Commerce Server Configuration Wizard.
CS Catalog Scratch	MSCS_CatalogScratch	Created by unpacking the catalog site resource.
Direct Mailer	DirectMailer	Created by the Commerce Server Configuration Wizard.
Site Catalog	<site_name>_productcatalog	Created when you unpack the site resource.
Site Marketing	<site_name>_marketing	Created when you unpack the site resource.
Site Marketing List	<site_name>_marketing_lists	Created when you unpack the site resource.
Site Profiles	<site_name>_profiles	Created when you unpack the site resource.
Site Transaction Configuration	<site_name>_transactionconfig	Created when you unpack the site resource.
Site Transactions	<site_name>_transactions	Created when you unpack the site resource.

SQL Database Account, Database, and Database Role User Mapping

The following table lists the accounts on the computers that are running SQL Server that you must add to the specified roles. By default, the database names start with StarterSite. However, you might have specified different database names when you unpacked your site.

Database Account	Database	SQL Server 2000 Roles	SQL Server 2005 Roles
ASPNET	MSCS_Admin	db_datareader	db_datareader
CatalogWebSvc	MSCS_Admin	admin_reader_role	admin_reader_role
	MSCS_CatalogScratch	db_owner	db_datareader, db_datawriter, db_ddladmin
	StarterSite_ProductCatalog	db_owner	ctlg_CatalogWriterRole, db_datareader, db_datawriter, db_ddladmin, db_securityadmin, Inventory_ReaderRole, Inventory_WriterRole
MarketingWebSvc	MSCS_Admin	admin_reader_role	admin_reader_role
	StarterSite_Marketing	mktg_MarketingService_role, mktg_promoCodeGenerator_role	mktg_MarketingService_role, mktg_promoCodeGenerator_role
	StarterSite_MarketingLists	db_owner	db_owner
	StarterSite_ProductCatalog	ctlg_catalogReaderRole	ctlg_catalogReaderRole
	StarterSite_Profiles	Profile_Reader, Profile_Schema_Reader	Profile_Reader, Profile_Schema_Reader
OrdersWebSvc	MSCS_Admin	admin_reader_role	admin_reader_role
	MSCS_CatalogScratch	db_owner	db_datareader, db_datawriter, db_ddladmin
	StarterSite_Marketing	mktg_runtime_role	db_ddladmin, mktg_runtime_role
	StarterSite_ProductCatalog	ctlg_catalogReaderRole, Inventory_ReaderRole	ctlg_catalogReaderRole, Inventory_ReaderRole
	StarterSite_Profiles	Profile_Reader, Profile_Schema_Reader	Profile_Reader, Profile_Schema_Reader
	StarterSite_TransactionConfig	Orders_Management	Orders_Management
	StarterSite_Transactions	Orders_Management, Orders_Runtime	Orders_Management, Orders_Runtime
ProfilesWebSvc	MSCS_Admin	admin_reader_role	admin_reader_role
	StarterSite_Profiles	Profile_Schema_Manager, Profile_Runtime	Profile_Schema_Manager, Profile_Runtime
RunTimeUser	MSCS_Admin	admin_reader_role	admin_reader_role
	MSCS_CatalogScratch	db_owner	db_datareader, db_datawriter, db_ddladmin
	StarterSite_Marketing	mktg_runtime_role	db_ddladmin, mktg_runtime_role
	StarterSite_MarketingLists	db_datareader	db_datareader
	StarterSite_ProductCatalog	ctlg_catalogReaderRole, Inventory_RuntimeRole	ctlg_catalogReaderRole, Inventory_RuntimeRole
	StarterSite_Profiles	Profile_Schema_Reader, Profile_Runtime	Profile_Schema_Reader, Profile_Runtime
	StarterSite_TransactionConfig	Orders_Runtime	Orders_Runtime
	StarterSite_Transactions	Orders_Runtime	Orders_Runtime
CSDMSvc	DirectMailer	db_owner	db_owner
	MSCS_Admin	admin_reader_role	admin_reader_role
	StarterSite_Marketing	mktg_directmailer_role	mktg_directmailer_role
	StarterSite_MarketingLists	db_owner	db_owner
	StarterSite_Profiles	Profile_Schema_Reader, Profile_Reader	Profile_Schema_Reader, Profile_Reader
CSHealthMonitorSvc	MSCS_Admin	admin_reader_role	admin_reader_role
CSStageSvc	MSCS_Admin	admin_reader_role	admin_reader_role
	MSCS_CatalogScratch	db_owner	db_datareader, db_datawriter, db_ddladmin
	StarterSite_Marketing	mktg_MarketingService_role, mktg_runtime_role, mktg_dataManager_role, mktg_promoCodeGenerator_role	db_ddladmin, mktg_staging_role
	StarterSite_MarketingLists	db_owner	db_datareader
	StarterSite_ProductCatalog	db_owner	ctlg_CatalogWriterRole, db_datareader, db_datawriter, db_ddladmin, db_securityadmin, Inventory_ReaderRole, Inventory_WriterRole
	StarterSite_Profiles	Profile_Schema_Manager	Profile_Schema_Manager
	StarterSite_TransactionConfig	Orders_Management	Orders_Management
<CS Staging User>	MSCS_Admin	db_datareader	db_datareader
	MSCS_CatalogScratch	db_datareader, db_datawriter, db_ddladmin	db_datareader, db_datawriter, db_ddladmin
	StarterSite_ProductCatalog	ctlg_CatalogReaderRole, Inventory_ReaderRole	ctlg_CatalogWriterRole, Inventory_ReaderRole