1. Installation and Upgrade Guide (On Premise)

Upgrade Identity Server

Version: 9.0

Encrypted Communication with SQL Server

Note

Applicable only to upgrades from Identity Server versions prior to 8.x.

Starting from version 8.0, Sitecore Identity Server requires encrypted communication with SQL Server by default. This change is due to the adoption of a newer version of Microsoft.Data.SqlClient that enforces stricter security measures, as described in Microsoft’s Breaking changes in EF Core 7.0 article.

Before installing Sitecore Identity Server or upgrading to the newest version, ensure the following steps are completed:

  1. Configure an encryption certificate for the SQL Server: A valid encryption certificate must be installed and configured on SQL Server to support encrypted communication. For more information, refer to Microsoft’s Configure SQL Server Database Engine for encrypting connections article.

  2. Ensure the certificate is trusted on the server hosting Sitecore Identity Server

  3. [Optional] Enforce Sitecore Identity Server to use an encrypted connection to SQL Server. Update the connection string of the security database for Sitecore Identity Server to add the following parameters:

    Encrypt=true;TrustServerCertificate=false;

    For example:

    <ConnectionString>Data Source=.;Initial Catalog=Sitecore.Core;User ID=coreuser;Password=Test12345;Encrypt=true;TrustServerCertificate=false;</ConnectionString>

    This configuration ensures encrypted communication with SQL Server while enforcing strict certificate validation.

Alternative Configuration: SQL Server-Generated Self-Signed Certificates

To simplify the installation process for a non-production deployment, you can skip configuring an encryption certificate for SQL Server. If the certificate is not explicitly configured, SQL Server automatically generates a self-signed certificate (fallback certificate) at startup and uses it for encryption. This approach is not recommended for production environments.

To accommodate this configuration in Sitecore Identity Server, choose one of the following approaches:

  1. To disable encryption, update the connection string of the security database to include:

    ...;Encrypt=false;

  2. Enable encryption but disable certificate trust validation. Update the connection string of the security database to include:  

    ...;Encrypt=true;TrustServerCertificate=true;

Upgrade the database

Upgrade the security database before you install the latest version of Sitecore Identity Server.

To upgrade the security database:

  1. Unpack the Sitecore.IdentityServer.UpgradeScripts.9.0.zip file.
  2. Run the CMS_security_IdentityServer.sql script on the security database.

The database upgrade script contains the changes applied to the security database. It modifies tables to support new versions of dependent software.

Note

This step applies when you are upgrading Identity Server in an existing Sitecore XP deployment. It may also apply in a new installation of Sitecore XP and Identity Server. For example, a new installation of Sitecore XP 10.3.0 or 10.5.0 includes (bundles) the installation of an older Identity Server version by default, requiring you to upgrade the security database for Identity Server 9.0.

Starting with Sitecore XP 10.3.3 and 10.4.1, Identity Server 9.0 will be installed by default with the Sitecore XP installation.

Install Sitecore Identity Server

To install Sitecore Identity Server:

  1. Create a folder, for example c:\resourcefiles.

  2. Unpack the IdentityServer Deployment Configuration 9.0.zip file and copy the extracted files to the c:\resourcefiles folder.

  3. Copy the Sitecore.IdentityServer.9.0.X.scwdp.zip file to the c:\resourcefiles folder.

    The folder should now contain the following items:

    • createcert.json
    • IdentityServer.json
    • Install-IdentityServer.ps1
    • Sitecore.IdentityServer.9.0.X.scwdp.zip

  4. Save a copy of your Sitecore license file in the c:\resourcefiles folder as license.xml.

  5. Edit the Install-IdentityServer.ps1 file, and update the following parameters:

    • $prefix - Optional. Use the name of the CM instance, it is used for the URL of the Identity Server.
    • $CMurl - Optional. Update or leave the default value.
    • $IdentityServer - Update or leave the default value, the URL of the Identity Server.
    • $ClientSecret - Must be the same as the sitecoreidentity.secret key that you use in the …\App_Config\ConnectionStrings.config file on the CM instance.
    • $SqlServer - The name of the SQL server.
    • $SqlAdminUser - The name of the SQL server admin.
    • $SqlAdminPassword - The SQL server admin password.
    • $PSScriptRoot - Optional. Update this parameter if you use a folder with another name. Default value = c:\resourcefiles
    • $SitePhysicalRoot - Optional. Update this parameter if you use a folder with another name. Default value = C:\inetpub\wwwroot
    • $wdpFileName - Optional. Use the default value. Default value = Sitecore.IdentityServer.*.scwdp.zip

  6. Open PowerShell as an administrator, go to the c:\resourcefiles folder, and run the following cmdlet:

    .\Install-IdentityServer.ps1
If you have suggestions for improving this article, let us know!