Basic installation

KCM Repository database

KCM installation requires a database for KCM Repository.

Multiple KCM instances cannot use the same database for KCM Repository. If you plan to deploy multiple KCM instances, make sure you have a dedicated database prepared for each of them.

Whenever you use an Oracle or an SQL Server database for KCM Repository, you must supply an ODBC Connection String. A 64-bit ODBC driver is required.

To prepare the database, follow the steps below:

1. Create an empty database or make sure one exists on the database server.
2. For SQL Server database, consider the following:
   • If the database is not installed locally, Microsoft SQL Server Command Line Utilities have to be installed on the KCM server.

     64-bit DBMS drivers are not supported for DID connections. These drivers must be configured as the 32-bit DBMS drivers.

   • Database must be created with case-insensitive collation.
   • TCP/IP protocol for SQL Server must be enabled.
   • SQL Server authentication mode must be set to Mixed mode (both SQL Server and Windows Authentication).
   • Default authentication method is SQL Server authentication. SQL Server account for database access must satisfy the following conditions:

     • database owner role

       If you have reasons not to assign this role, use the approach described in the Additional restriction of SQL Server account permissions section below.

     • dbo schema

   • To enable Windows authentication, leave out the database user and password parameters, and if needed add Integrated Security=True to the connection string.
3. For Oracle database, consider the following:

   • Minimum table space available for KCM Repository database is 60 MB.

   • 64-bit DSN configuration is required.

   • Oracle Client versions 11.02.00.01 and 11.02.00.02 are not supported for use with KCM Repository.
   • The Oracle user you plan to use for database access should have the following privileges:

     • Create Session

     • Create Table

   When creating a user in Oracle, do not use lowercase characters in a quoted user identifier. When logging on to Oracle, KCM extends the connection with a user identifier without quotes. This causes Oracle to interpret the user name as uppercase.

   For example, if you create KCM_USER in Oracle, KCM will be able to log in with this user, but if you create Kcm_User, KCM will not be able to log in, because Kcm_User is automatically interpreted as KCM_USER, and that user does not exist.

Batch & Output Management databases

Adding Batch & Output Management to the installation requires two additional databases:

• A database for the B&OM Repository
• A database for the runtime information

1. Databases must be created manually, with case-insensitive collation.
2. Databases must be empty.
3. Two user accounts for database access. They must be specified with the OutputManagement!RepositoryDatabaseUser and OutputManagement!RuntimeDatabaseUser deployment parameters.
4. In case of using SQL Server, both accounts must satisfy the following conditions:
   • database owner role
   • ALTER_TRACE privilege
5. For Oracle databases, both accounts must have the following privileges:
   • CREATE SESSION
   • CREATE TABLE
   • ALTER SESSION
   • CREATE VIEW
   • CREATE PROCEDURE
   • CREATE SEQUENCE
6. In addition, the user account for the B&OM Repository database (specified with the OutputManagement!RepositoryDatabaseUser parameter) must have the following privileges:
   • CREATE TYPE
   • CREATE TRIGGER
   • EXECUTE ON DBMS_LOCK
   • EXECUTE ON DBMS_LOB
   • EXECUTE ON DBMS_OUTPUT
   • EXECUTE ON CTX_DDL

Additional restriction of SQL Server account permissions

You can avoid assigning the database owner role to the SQL Server account by setting the Instance!ContinueInstallationOnFailedDatabaseCheck to true. In this case, the SQL server account needs to have the following permissions:

• for database:
  • connect
  • create table
• for created tables on schema level:
  • select
  • insert, update, delete
  • alter

To run KCM, you only need the connect, select, insert, update, and delete permissions.

The create table and alter permissions are required during installation, upgrade, when you add a new instance, and when you run the cvc.exe tool.

Database access check

KCM performs a check on the database access, using the provided database connection string and database user and password. It checks the database access settings before starting the actual execution of various tools. This check is limited and might erroneously show messages about missing permissions. To override this check, use the Instance!ContinueInstallationOnFailedDatabaseCheck=true parameter to indicate that execution should continue even when the check returns a negative result. This does not override the check on an empty database and partner customer registration.

Windows accounts

The account used to run Install.exe must be included in the local Administrators group on the target server.

Prepare the following Windows user accounts:

• User account for KCM Windows services and B&OM services. This can be a local account or a domain account. It requires:
  1. Membership in the local Administrators group.
  2. Logon as a service right.
• User account for KCM web applications. This can be a local account or a domain account. It requires:
  1. Logon as a service right.
  2. Read & execute permission on the Tomcat installation folder.
  3. Read permissions on the SSL certificate file for the Contract Manager.

The installation will automatically create the KCM Designer Administrator account. You can change its password as described in the Change your password topic in KCM Designer Help.