What are the required accounts and groups to create?

In a multi-computer deployment, Sitecore Commerce accounts and user groups must be created on the domain controller. In a single-server deployment, you can create these accounts and groups on the computer where Sitecore Commerce is installed. For the internal test and development environments, create the same accounts and groups that you create for the data domain in the production environment.

See the following sections for the account and group requirements for each of these areas:

• Commerce Server User and Service Accounts
• Commerce Server Groups and Account Assignments
• Additional User Groups for Granular Security
• SQL Server Database Instances, Accounts, and Role User Mappings

Commerce Server User and Service Accounts:

The following table lists the accounts that are created or that you create when you install the prerequisite software. You must create the <CS Installer>, <CS Staging User>, CSLOB, and RunTimeUser accounts before you install Commerce Server. After installation, you will create SQL Server Login accounts, and associate the user accounts with Windows user groups.

Commerce Server Groups and Account Assignments:

Commerce Server Administrator Groups

Create the four administrator groups that are listed in the following table. These are the minimum number of groups to define. Create separate user groups based on your business needs, and then assign those groups to authorization roles through the Authorization Manager. For more information, see Authorizing Users and Groups to Access Web Services.

Commerce Server Web Application Accounts:

Use the Service user accounts for the Sitecore Commerce web applications to perform the following tasks:

• To run Internet Information Services (IIS) application pools.
• To help secure folders.
• To establish anonymous access to the Web site.
• To access the Commerce Server databases.

Commerce Server creates the Web applications when you unpack a Commerce Server site, such as the SolutionStorefrontSite, and select the Web services that you want to install. Each Commerce Server Web application requires the definition of a Windows user account and a Windows user group.

Create the following accounts and user groups on the data tier domain controller, and make assignments before or after you install Commerce Server. Also create the RunTimeUser account on the Data tier domain controller. The following table lists the default names that are used in this deployment guide:

For a production deployment, you will want to define more groups so you can take full advantage of the role assignment roles available. For descriptions about each predefined role, see following section.

Commerce Server Web Services and Account and Application Pool Assignments:

When you unpack a site, Commerce Server selects and installs the Web services. Each Commerce Server Web service requires the definition of a Windows user account, Windows user group, SQL Server login account, and an application pool. Create the Windows user accounts before you unpack a site, and create the SQL Server login accounts and application pools after you unpack the site. The following table lists the default names that are used by Commerce Server and in this deployment guide:

It is recommended that you create unique Web service account names, SQL Server login account names, Windows user groups, and application pools for each site you unpack. You can share application pools, but it is not recommended.

Users of the scope-level roles only have access to the profile type within the scope name. For example, members of the ProfileWriter_BusinessManager role in the UserObject scope only have access to the UserObject profile definition. You must add users to each scope-level role individually.

SQL Server Database Instances, Accounts, and Role User Mappings:

SQL Server Database Instances Created for Commerce Server

The following table lists the Commerce Server databases and default database names that are used by Commerce Server and in this installation guide: