Service Accounts¶

The Windows accounts that run the MetaMiner services, the BusinessObjects account that MetaMiner pulls with, and the database accounts, with least-privilege guidance for each.

Windows service accounts¶

MetaMiner installs these Windows services on the MetaMiner Server host:

Service name	Component	Default logon account
`metaminer`	MetaMiner Server	Local System
`MetaMinerWebApps`	Web Apps (web console back end)	Set by the installer
`InfolytikPostgres`	Embedded MetaMiner Database, when used	Set by the installer

TODO: confirm the logon account of InfolytikPostgres and MetaMinerWebApps

Check sc qc InfolytikPostgres and sc qc MetaMinerWebApps on a fresh install and fill in the table.

Local System works for a single server that keeps all files on local disks. Use a dedicated domain service account when:

the backup, versions or report validation folder is on a network share (UNC path). Local System cannot authenticate to most shares;
your policy forbids Local System for application services.

Use a dedicated account for the MetaMiner Server¶

Create a domain account, for example CORP\svc-metaminer, with a strong password that does not expire, or a managed service account.
Give it Modify on the MetaMiner install folder (C:\Program Files\Infolytik\MetaMiner\server\) and on the backup, versions and report validation folders.
Give it Log on as a service on the MetaMiner Server host.
Do not make it a local or domain administrator.
In Services, open metaminer, go to Log On, select This account, and enter the account.
Grant the same account read access to the MetaMiner Server SSL key folder, if you use one.
Restart the service.

Upgrades keep a custom logon account on the metaminer service.

The account is not used to log on to BusinessObjects

The Windows service account runs the process and reaches files. BusinessObjects access uses the account configured for each environment in MMA, or each user's own account when BusinessObjects user logon is REQUIRED.

BusinessObjects pull account¶

Each environment has a BusinessObjects account that MetaMiner uses for pulls and, by default, for MetaMiner Client actions. See Accounts and Permissions for the full requirements.

Requirement	Why
Access to the Public Folders root	Environment validation fails without it
Direct member of the BusinessObjects Administrators group (recommended)	MMA warns otherwise. MetaMiner pulls only what the account can see, so a restricted account gives incomplete metadata
Not set to change password at next logon	Pulls cannot log on

Least-privilege practice for this account:

Create one dedicated account per environment, for example svc_metaminer. Do not use a person's account or the built-in Administrator.
Use a strong password and rotate it under your policy. Update it in MMA after each change.
Exclude it from audit reports where needed with Preferences > Settings > Audit > Audit User Exclusion.
To keep changes in BusinessObjects attributable to people, set BusinessObjects user logon to REQUIRED. MMC actions then run as each user instead of this account. See BusinessObjects User Logon.
Grant MetaMiner write permissions (Paste, Delete, Import and so on) only to the roles that need them. See Permissions Reference.

The optional test user of an environment is used for report previews and similar checks. Give it the rights of a typical business user, not administrator rights.

Database accounts¶

Account	Used by	Guidance
MMDB account in Configure MMDB	MetaMiner Server	Owns the MetaMiner schemas. Use a strong password. On an external PostgreSQL server, have your DBA create it and keep it for MetaMiner only
`readonly` role	Alerts and Pulse	Maintained by MetaMiner. Do not grant it write rights
`mq_reader`, `mq_reader_all`	Meta Query on the web	Maintained by MetaMiner. Read only, with connection and time limits
Your reporting logins	Tools that read the MMDB	Create them as members of `readonly`. See Direct MMDB Access
Audit and CMS database accounts	Audit pulls and repository queries	Read-only accounts on those databases are enough