What are the required accounts and groups to create?

This topic provides a summary of the user accounts and groups that you create. In a multi-computer deployment, Sitecore Commerce accounts and user groups must be created on the domain controller. In a single-server deployment, you can create these accounts and groups on the computer where Sitecore Commerce is installed. For the internal test and development environments, create the same accounts and groups that you create for the data domain in the production environment.

See the following sections for the account and group requirements for each of these areas:

• Commerce Server and Service Accounts
• Commerce Server Groups and Account Assignments
• Additional User Groups for Granular Security
• SQL Server Database Instances, Accounts, and Role User Mappings

Commerce Server User and Service Accounts

The following table lists the accounts that you create or that are created when you install prerequisite software. You must create the <CS Installer>, <CS Staging User>, CSLOB, and RunTimeUser accounts before you install Commerce Server. Post-installation, you create SQL Server Login accounts and associate the user accounts together with Windows user groups.

Commerce Server Groups and Account Assignments

Commerce Server Administrator Groups

Create the four administrator groups summarized in the following table. These represent the minimum number of groups to define. You should create distinct user groups based on your business needs. You then assign these groups to authorization roles through the Authorization Manager. For more information, see Authorizing Users and Groups to Access Web Services.

For a production deployment, you will want to define more groups in order to take full advantage of the role assignment roles available. For descriptions about each predefined role, see the next section.

Commerce Server Web Services and Account and Application Pool Assignments

Commerce Server installs the Web services when you unpack a site, and selects the Web services to install. Each Commerce Server Web service requires definition of a Windows user account, Windows user group, SQL Server login account, and application pool. The following table summarizes the default names Commerce Server and the installation guide use. You create the Windows user accounts before you unpack a site, and you create the SQL Server login accounts and application pools after you unpack the site.

For each site that you unpack, we recommend that you create unique Web service account names, SQL Server login account names, Windows user groups, and application pools. You can share application pools, but we do not recommend this action.

Web Service Administrator Role Assignments

The following table lists the Web services and their corresponding authorization stores and administrator roles. You must assign each Web service account to its corresponding authorization role.

After you assign write permissions to the authorization stores, in order to perform any operation in the Business Management applications, you assign users to the administrator roles for each Web service. By adding <CS Installer> to each administrator role, you can open and use each Business Management application.

BizTalk Adapters Role Assignments

The following table lists the role assignments to which CSLOB, the BizTalk adapters identity, must be added.

Additional User Groups for Granular Security

The following sections summarize the various authorization roles that are predefined for the Commerce Server systems. For each authorization role of interest, create an associated user group on the domain controller. You can then add business user accounts to the user group.

• Catalog and Inventory Systems
• Marketing System
• Orders System
• Profiles System

For each user group you create, you must assign the groups to authorization roles through the Authorization Manager. For more information, see Authorizing Users and Groups to Access Web Services.

Catalog and Inventory Systems

The following table describes the predefined authorization roles for the Catalog System and the Inventory System.

Marketing System

The following table describes the predefined authorization roles for the Marketing System.

Orders System

The following table describes the predefined authorization roles for the Orders System.

Profiles System

The following table describes the predefined authorization roles for the Profiles System.

Users of the scope-level roles have access only to the profile type within the scope name. For example, members of the ProfileWriter_BusinessManager role in the UserObject scope have access to the UserObject profile definition only. You must add users to each scope-level role individually.

SQL Server Database Instances, Accounts, and Role User Mappings

SQL Server Database Instances Created for Commerce Server

The following table summarizes the Commerce Server databases and default database names that Commerce Server and the installation guide use.

SQL Database Account, Database, and Database Role User Mapping

The following table lists the accounts on the computers that are running SQL Server that you must add to the specified roles. By default, the database names start with StarterSite. However, you might have specified different database names when you unpacked your site.