Server roles determine what EmpowerID jobs (back-end processes) and Web services are enabled on a particular server. EmpowerID categorizes server roles in the following way:

• All-in-One Server — The server role runs all front-end Web services and back-end processes. This role is designed to be used if you have a small environment with only one EmpowerID server.

• Application Server — This server role runs all back-end processes, known as Jobs in EmpowerID. By default it does not run any Web services.

  Attribute Flow - Directory Change Processor Job —Job hosted by the Worker Role service that takes the attribute changes from the attribute inbox that were discovered during inventory and processes them using the attribute flow rules to update the Person object. Changes to the Person object can then lead to changes being pushed to the attribute outbox that will flow to other systems. This job is scheduled per Account Store. Account Lockout Detection Job — Job hosted by the Worker Role service that detects locked out user accounts. Account Password Reset Inbox — Job hosted by the Worker Role service that performs the offline password resets. Windows Service and AppPool Account Password Sync — Job hosted by the Worker Role service that synchronizes account password resets for accounts used by Windows Services and IIS App Pools. Attestation Policy Compiler — Synchronizes account password resets for accounts used by Windows Services and IIS App Pools. Attestation Processor — Not used - placeholder for customization. Database Archiving Rule Processor — Job hosted by the Worker Role service that performs database archiving rules and processes. Dynamic Hierarchy Generation Job — Job hosted by the Worker Role service that calculates which groups should be provisioned or deprovisioned in group hierarchy policies. Dynamic Hierarchy Membership Inbox Processor Job — Job hosted by the Worker Role service that syncs the group membership for each group in the grou hierarchy membership inbox. Dynamic Hierarchy Membership Recalculation Job — Job hosted by the Worker Role service that calculates which groups in group hierarchy policies should have their membership refreshed. Dynamic Hierarchy Provision Inbox Processor — Job hosted by the Worker Role service that calculates which groups should be provisioned or deprovisioned in group hierarchy policies. Group Membership Queue Processor Job — Job hosted by the Worker Role service that batch processes changes to group memberships. Group Membership Reconciliation Job — Job hosted by the Worker Role service that evaluates the current "as is" membership of groups versus the "should be" state of who should be a member based upon dynamic RBAC assignments of the "Member" Resource Role in EmpowerID. This job is scheduled per Resource System or Account Store. Inventory Job — Job hosted by the Worker Role service that claims inventory jobs for Resource Systems and Accounts stores on a scheduled basis and calls the inventory method for that system. For Account Stores, the inventory process is responsible for populating the attribute inbox and also it can run the initial Person provision process using the same Join and Provision Rule logic used by the Account Inbox One by One or Account Inbox Bulk permanent workflow. The actual implementation of how to inventory each system will be specific to the type of system and the implementation in its connector. This job is scheduled per Resource System or Account Store. Office 365 Batch Processor — Job hosted by the Worker Role service that performs the batch processing for Exchange Online Office365 actions. Permanent Workflow Job — Job hosted by the Worker Role service that ensure permanent EmpowerID workflows are kept in a continuously running state. Person Default Attributes Reinforcement Job — Job hosted by the Worker Role service that is responsible for making sure people have the mandatory attributes assigned by policy. It will also populate the outbox so accounts owned by the person are updated. RBAC Maintenance Job — Job hosted by the Worker Role service to calculate RBAC assignments. RBAC Security Compiler Job — Job hosted by the Worker Role service that is responsible for building the Location and Business Role trees. It also calculates the location of resource location and which security delegations will affect them. This job MUST run in only ONE server. RBAC Security Person Business Role Compiler Job — Job hosted by the Worker Role service that is responsible for calculating what business roles and locations a person will have based on all possible assignments. Resource Entitlement Inbox Processor Job — Job hosted by the Worker Role service that performs the actions specified by the Resource Entitlement Inbox entries (Provision, Deprovision, etc.). Resource Entitlement Recalculation Job - Job hosted by the Worker Role service that evaluates the current "as is" status of Resource Entitlement policies (RETs) versus the "should be" state. This entails determining what Accounts, Home Folders, Exchange Mailboxes, etc… people currently own versus what they should own by policy. The delta to normalize what they have with what they should have is written to the Resource Entitlement Inbox as a series of actions to be performed (Provision, Disable, Move, De-provision). Resource Role Reconciliation Job — Job hosted by the Worker Role service that manages the membership of EmpowerID Resource Role groups (RRGs). It determines who should currently be a member of those RRGs and then modifies the membership to match. This job is scheduled per Resource System or Account Store. Search Tag Compilation — Job hosted by the Worker Role service that evaluates and prepares the tags needed for tag searching in EmpowerID, it calculates implicit tagging. Rights Enforcement Job — Job hosted by the Worker Role service that adds or removes native permissions for resources in external systems based on the current state of RBAC delegations. The actual granting or revoking of rights for external systems can result in calls to other agents (e.g., the Exchange Agent) in order to complete the action. This job is scheduled per Resource System or Account Store. Rights Inventory Job — Job hosted by the Worker Role service that inventories native permissions for external system resources. The actual inventory of rights for the external system in question can result in calls to other agents (e.g., SharePoint Agent) in order to complete the action. Risk Factor and Stats Recalculation Job — Job hosted by the Worker Role service that is responsible for calculating the risk factor score for all EmpowerID actor types. Role and Location Compiler — Job hosted by the Worker Role service that is responsible for determining a person's roles and locations from external data. Role and Location Processor — Job hosted by the Worker Role service that is responsible for assigning roles and locations to a person, as determined by the compiler from external data. Separation Of Duties Policy Compiler — Job hosted by the Worker Role service that evaluates separation of duties policies to discover violations and creates Separation of Duties (SoD) Violation tasks. Separation Of Duties Violation Processor — Job hosted by the Worker Role service that performs default configured actions in response to SoD Violation tasks. Set Compiler Job — Job hosted by the Worker Role service that evaluates saved searches or Sets against connected Account Stores. The results of these compiled search can be used for query-based assignment of Person objects to Business Roles and Locations.

  
  

• Default — This server role has no Jobs or Web services associated with it. When you install EmpowerID on a server, EmpowerID assigns this role to the server. This is to ensure that no Jobs or Web services run on a server not designated for those Jobs or Web services. Change this to the appropriate role for each EmpowerID server for that server to function as intended.

• Web Front-End — This server role runs all Web services. By default it does not run any back-end processes.

  Exchange Management Web Service - WCF web service hosted by Worker Role Windows Service that can execute any of the PowerShell cmdlets for managing Microsoft Exchange 2007 or greater. This service must be enabled on a machine loaded with the Exchange Management Console tools. LDAP Management Web Service - WCF web service hosted by IIS. This service must be enabled on a machine with connectivity to the LDAP directories that it manages. Lotus Notes Web Service - WCF web service hosted by IIS. This service must be enabled on a machine with Lotus Notes. Password Manager Web Service - WCF web service hosted by IIS specific for password management such as validation and also receives password change notification messages from the EmpowerID Password Change Detection Agent Window service. Pipeline Service Web Service - WCF web service hosted by IIS. This service must be enabled for BRE applications to function correctly and to receive system wide alerts and notifications. PowerShell Web Service - WCF web service hosted by IIS for executing any type of PowerShell cmdlets. This service will be used by workflows that execute PowerShell cmdlets. Applicable PowerShell snap-ins should be loaded on each server hosting this service. Service Bus Management Web Service - WCF web service hosted by IIS and provides a distributed WCF endpoint hosting facilities for integrating external resource systems and applications with the rest of the EmpowerID platform. The ESB Agent easily extends the life of existing legacy applications through the deployment of legacy application connectors developed in BPM Studio and deployed as WCF services on a ESB Agent. SharePoint Management Web Service - WCF web service hosted by IIS that can execute any of the SharePoint object model calls required for managing Microsoft SharePoint. Federation Server Web Service - WCF web service hosted by IIS. Provides a distributed Claim based STS for the EmpowerID platform. Windows Server Management Web Service - WCF web service hosted by IIS that can execute any of the local Windows server OS management actions required for shared folder creation or other system management tasks. This service must be enabled on a machine that is the intended target for management. Workflow Server Web Service - WCF web service hosted by IIS. Provides a secure service extension host to the workflow server.

  
  

To configure EmpowerID Server Roles

1. From the Navigation Sidebar of the EmpowerID Web interface, expand Admin > EmpowerID Servers and Settings and click EmpowerID Servers.
2. From the EmpowerID Server Details page, click the EmpowerID Servers tab and search for the server whose role you want to set.
3. Click the Edit button for that server.
   
   
   
   
4. In the dialog that appears, select the appropriate role for the server from the EmpowerID Server Role drop-down.
   
   
   
   
5. Click Save to save the role and close the dialog.