Assign write permissions to the catalog authorization role:

1. In Windows Explorer, move to the directory where you installed the catalog Web service, for example, <drive>:\Inetpub\Wwwroot\CatalogWebService\.
   
   
2. In the <Catalog Web service name> folder, right-click the XML file CatalogAuthorizationStore.xml, and then click Properties.
   
   
3. In the CatalogAuthorizationStore.xml Properties dialog box, on the Security tab, click Add.
   
   

   Note
   If you are using Windows Vista, in the CatalogAuthorizationStore.xml Properties dialog box, on the Security tab, click Edit. In the User Access Control dialog box, click Continue. In the Permissions for CatalogAuthorizationStore dialog box, click Add.

4. In the Select Users, Computers, or Groups dialog box, in the Enter the object names to select box, type <computer name>\RunTimeUser, and then click OK.
   
   
5. In the CatalogAuthorizationStore.xml Properties dialog box, in the Group or user names box, select the RunTimeUser account.
   
   
6. In the Permissions for RunTimeUser box, select Write in the Allow column (Read & Execute and Read should already be selected in the Allow column), and then click OK.
   
   

Assign write permissions to the Temporary ASP.NET folder:

1. In Windows Explorer, move to the <drive>:\Windows\Microsoft.NET\Framework\v2.0.50727 (or <drive:>\WinNT\Microsoft.NET\Framework\v2.0.50727, whichever is appropriate) folder.
   
   
2. Right-click Temporary ASP.NET Files, and then click Properties.
   
   
3. In the Temporary ASP.NET Files Properties dialog box, on the Security tab, click Add.
   
   
4. In the Enter the object names to select box, type <domain or computer name>\RunTimeUser, and then click OK.
   
   
5. In the Temporary ASP.NET Files Properties dialog box, in the Groups or user names box, select the RunTimeUser account.
   
   
6. In the Permissions for RunTimeUser box, select Write in the Allow column (Read & Execute and Read should already be selected in the Allow column), and then click OK.
   
   
7. In the Security dialog box, click Yes.
   
   

Assign write permissions to the Windows Temporary folder:

1. In Windows Explorer, move to the <drive>:\Windows (or <drive>:\WinNT, whichever is appropriate) folder.
   
   
2. Right-click Temp, and then click Properties.
   
   
3. In the Temp Properties dialog box, on the Security tab, click Add.
   
   
4. In the Enter the object names to select box, type <domain or computer name>\RunTimeUser, and then click OK.
   
   
5. In the Temp Properties dialog box, in the Groups or user names box, select the RunTimeUser account.
   
   
6. In the Permissions for RunTimeUser box, select Write in the Allow column (Read & Execute, List Folder Contents, and Read should already be selected in the Allow column), and then click OK.
   
   
7. In the Security dialog box, click Yes.
   
   

Click Start, click Run, type azman.msc, and then click OK.

In the Authorization Manager screen, right-click Authorization Manager, and then click Open Authorization Store.

In the Open Authorization Store dialog box, verify that the XML file option is selected, and then click Browse to locate the authorization store for the Web service. For example, the catalog authorization store XML file is located at <drive>:\Inetpub\Wwwroot\CatalogWebService.

Select <authorization store name>.xml, and then click Open.

In the Open Authorization Store dialog box, click OK.

Expand the authorization store to \<authorization store name>.xml\<System name>\Role Assignments\<Role name>. For example, \CatalogAuthorizationStore.xml\CatalogandInventorySystem\Role Assignments\CatalogAdministrator.

Right-click <Role name>, and then click Assign Windows Users and Groups.

In the Select Users, Computers, or Groups dialog box, in the Enter the object names to select box, type your user account. Click Check Names. Click OK.

Repeat steps 7 and 8 for each user you want to have access to a Commerce Server Business Management application.

Repeat steps 2 through 9 for each authorization role in each Web service authorization store.

On the design-time computer that is running SQL Server, click Start, point to All Programs, point to Microsoft SQL Server, and then click Enterprise Manager.

In SQL Server Enterprise Manager, expand Microsoft SQL Servers, expand SQL Server Group, expand <servername>, and then expand Security.

Create the SQL Login accounts:

1. Right-click Logins and select New Login.
   
   
2. In the Login – New dialog box, click the Search button.
   
   
3. In the Select User or Group dialog box, enter the local RunTimeUser account and then click OK.
   
   
4. Repeats steps 3a through 3c to create the ASPNET account.
   
   
5. Verify that the following SQL Login accounts now appear under Logins:
   
   

   <computer name>\ASPNET <computer name>\RunTimeUser

Define the ASPNET account login properties:

1. In the right pane, right-click the <computer name>\ASPNET account, and then click Properties.
   
   
2. In the SQL Server Login Properties <account name> dialog box, on the Database Access tab, in the top box, select the MSCS_Admin database.
   
   
3. In the bottom box, check the db_datareader role and then click OK.
   
   

Define the RunTimeUser account login properties:

1. In the right pane, right-click the <computer name>\RunTimeUser account, and then click Properties.
   
   
2. In the SQL Server Login Properties <account name> dialog box, on the Database Access tab, in the top box, select a database in the following list and check the roles indicated.
   
   

   Database	SQL Server 2000 Roles
   MSCS_Admin	admin_reader_role
   MSCS_CatalogScratch	db_owner
   <siteName>_Marketing	mktg_dataManager_role, mktg_MarketingService_role, mktg_promoCodeGenerator_role, mktg_runtime_role,
   <siteName>_MarketingLists	db_datareader, db_owner
   <siteName>_ProductCatalog	ctlg_catalogReaderRole, db_owner, Inventory_RuntimeRole
   <siteName>_Profiles	Profile_Reader, Profile_Runtime, Profile_Schema_Manager, Profile_Schema_Reader
   <siteName>_TransactionConfig	Orders_Management, Orders_Runtime
   <siteName>_Transactions	Orders_Management, Orders_Runtime

3. Repeat step 5b until all the required roles are associated with the specified databases, and then click OK.
   
   

On the design-time computer that is running SQL Server, click Start, point to All Programs, point to Microsoft SQL Server 2005, and then click SQL Server Management Studio.

In the Connect to Server dialog box, click Connect.

In SQL Server Management Studio, expand <servername>, expand Security, expand Logins.

Create the SQL Login accounts:

1. Right-click Logins and select New Login.
   
   
2. In the Login – New dialog box, click Search.
   
   
3. In the Select User or Group dialog box, enter the local RunTimeUser account and then click OK.
   
   
4. Repeats steps 4a through 4c to create the ASPNET account.
   
   
5. Verify that the following SQL Login accounts now appear under Logins:
   
   

   <computer name>\ ASPNET <computer name>\ RunTimeUser

Define the ASPNET account login properties:

1. Right-click the <computer name>\ASPNET account, and then click Properties.
   
   
2. In the Login Properties <account name> dialog box, in the left pane, click User Mapping.
   
   
3. In the right pane, in the Users mapped to this login box, in the Map column, select the MSCS_Admin database.
   
   
4. In the Database role membership for <database name> box, select the check box for the db_datareader role, and then click OK.
   
   

Define the RunTimeUser account login properties:

1. Right-click the <computer name>\RunTimeUser account, and then click Properties.
   
   
2. In the Login Properties <account name> dialog box, in the left pane, click User Mapping.
   
   
3. In the right pane, in the Users mapped to this login box, in the Map column, select the check box for the appropriate database. Role assignments must be made to the following databases:
   
   

   Database	SQL Server 2005 Roles
   MSCS_Admin	admin_reader_role
   MSCS_CatalogScratch	db_datareader, db_datawriter, db_ddladmin
   <siteName>_Marketing	db_ddladmin, mktg_MarketingService_role, mktg_promoCodeGenerator_role, mktg_runtime_role, mktg_staging_role
   <siteName>_MarketingLists	db_datareader, db_owner
   <siteName>_ProductCatalog	ctlg_catalogReaderRole, ctlg_CatalogWriterRole, db_datareader, db_datawriter, db_ddladmin, db_securityadmin, Inventory_ReaderRole, Inventory_RuntimeRole, Inventory_WriterRole
   <siteName>_Profiles	Profile_Reader, Profile_Runtime, Profile_Schema_Manager, Profile_Schema_Reader
   <siteName>_TransactionConfig	Orders_Management, Orders_Runtime
   <siteName>_Transactions	Orders_Management, Orders_Runtime

4. In the Database role membership for <database name> box, select the check boxes for the appropriate roles for the selected database.
   
   
5. Repeat steps 6c and 6d until all the required roles are associated with the specified databases, and then click OK.
   
   

In Internet Explorer, open http://go.microsoft.com/fwlink/?LinkID=59276.

On the Internet Information Services (IIS) 6.0 Resource Kit Tools page, click Download.

In the File Download dialog box, click Save.

In the Save As dialog box, move to the folder where you want to save the executable package and then click Save.

In the Download complete dialog box, click Close.

Click Start, click Run, type explorer, and then click OK. In Windows Explorer, move to the location where you saved the executable package, and then double-click iis60rkt.exe.

In the Open File - Security Warning dialog box, click Run.

On the Welcome to the InstallShield Wizard for the IIS 6.0 Resource Kit Tools page, click Next.

On the Microsoft Software License Terms page, read the terms of the license agreement. If you accept them, select I agree, and then click Next.

On the Customer Information page, correct, accept, or type your user name and organization, accept the default option to install this application for anyone who uses the computer (all users), and then click Next.

On the Setup Type page, accept the default Complete option and then click Next.

On the Start Copying Files page, click Next.

On the InstallShield Wizard Complete page, click Finish.

Click Start, point to Programs, point to IIS Resources, point to SelfSSL, and then click SelfSSL.

At the command prompt, type Selfssl.exe /T /V:100, and then press ENTER.

If you are prompted to replace the SSL settings for site 1, press Y, and then press ENTER.

The SelfSSL tool configures an SSL Certificate on the Default Web site that expires in 100 days.

Close the Command Prompt window.

Download and install the Aspnet_setreg.exe tool. To download this tool and for instructions on how to use it, see http://go.microsoft.com/fwlink/?LinkID=16728.

Encrypt the user name and password in the registry. For instructions about encrypting the user name and password, see http://go.microsoft.com/fwlink/?LinkID=16728.

Update the Web.config files for all Commerce Server Sites and Web Services. For instructions about configuring the Web.config files with the encrypted user name and password, see http://go.microsoft.com/fwlink/?LinkID=16728. When you have completed this step, you should have the following entry in the <system.web> sections of all Web.config files:

<identity impersonate="true" userName="registry:HKLM\SOFTWARE\MY_SECURE_APP\identity\ASPNET_SETREG,userName" password="registry:HKLM\SOFTWARE\MY_SECURE_APP\identity\ASPNET_SETREG,password" />

Give the ASPNET account read access to the registry key. For instructions about giving the ASPNET account read access to the registry key, see http://go.microsoft.com/fwlink/?LinkID=16728.

Because Data Warehouse is not supported on Windows XP, remove or comment the reference to it in your CSharpSite or StarterSite Web.config file. If you comment the reference, the resulting entry will look like this:

<!--<add name="CommerceDataWarehouseAuthenticationModule" type="Microsoft.CommerceServer.Runtime.CommerceDataWarehouseAuthenticationModule, Microsoft.CommerceServer.Runtime, Version=6.0.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>-->

Create an application pool for the Web applications:

1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
   
   

   Note
   If you are using Windows Vista, click Start, select Run, type InetMgr, and then click OK.

2. In Internet Information Services (IIS) Manager, expand <computername>, right-click Application Pools, point to New, and then click Application Pool.
   
   

   Note
   If you are using Windows Vista, in Internet Information Services (IIS) Manager, expand <computername>, right-click Application Pools, and select Add Application Pool.

3. In the Add New Application Pool dialog box, in the Application pool ID box, type the name of the Web site application pool (for example, CSAppPool), and then click OK.
   
   

   Note
   If you are using Windows Vista, in the Add New Application Pool dialog box, in the Name box, type the name of the Web site application pool (for example, CSAppPool), and then click OK.

Configure the application pool identity. The steps for Windows Vista are different. They follow the steps for Windows Server 2003 and Windows XP:

Windows Server 2003 and Windows XP:

1. Right-click the application pool that you created in step 1c, for example CSAppPool, or the default application pool, and then click Properties.
   
   
2. In the <Application pool> Properties dialog box, on the Identity tab, click Configurable.
   
   
3. Click Browse, and under Enter the object name to select, type the account name on which you want your worker process to run (<computer name>\RunTimeUser), and then click OK.
   
   
4. In the Password box, type the password associated with this account. If there is no password associated with the account, leave the Password box blank, and then click OK.
   
   
5. In the Confirm Password dialog box, retype the password, and then click OK.
   
   

Windows Vista:

1. Right-click the application pool that you created in step 1c, for example CSAppPool, or the default application pool, and then click Set Application Pool Defaults.
   
   
2. In the Application Pool Defaults dialog box, in the Process Model section, click the drop-down menu to the right of Identity. Select Specific User.
   
   
3. In the Application Pool Defaults dialog box, in the Process Model section, click the selection box to the right of Identity SpecificUserCredentials. In the Set Credentials dialog box, under User Name, type the account name on which you want your worker process to run (<computer name>\RunTimeUser).
   
   
4. In the Application Pool Defaults dialog box, under (General) select Classic from the drop-down to the right of Managed Pipeline Mode.
   
   
5. In the Password box, type the password associated with this account. If there is no password associated with the account, leave the Password box blank, and then click OK.
   
   
6. In the Confirm Password dialog box, retype the password, and then click OK.
   
   

Add the IIS worker process account to the IIS_WPG group:

1. On the desktop, right-click My Computer, and then click Manage.
   
   
2. In the Computer Management screen, under System Tools, expand Local Users and Groups, and then click Groups.
   
   
3. In the right pane, right-click the IIS_WPG group, and then click Add to Group.
   
   
4. In the IIS_WPG Properties dialog box, click Add.
   
   
5. In the Select User, Computers, or Groups dialog box, under Enter the object names to select box, type the account name on which you want your worker process to run (<computer name>\RunTimeUser), and then click OK.
   
   
6. In the IIS_WPG Properties dialog box, click OK.
   
   
7. Close the Computer Management screen.
   
   

Assign applications to the application pool:

1. In IIS Manager, expand Web Sites and then expand Default Web Site.
   
   
2. Right-click the Web site application under Default Web Site, for example CSharpSite, and then click Properties.
   
   

   Note
   If you are using Windows Vista, right-click the Web site application under Default Web Site, for example CSharpSite, and then click Advanced Settings. In the Advanced Settings dialog box, under Behavior, click the selection box to the right of Application Pool.

3. In the <Application> Properties dialog box, on the Virtual Directory tab, select the name of the corresponding application pool in the Application Pool box. For example, for CSharpSite, select the application pool CSAppPool.
   
   

   Note
   If you are using Windows Vista, In the Select Application Pool dialog box, select the name of the corresponding application pool in the Application Pool box. For example, for CSharpSite, select the application pool CSAppPool. Click OK. In the Advanced Settings dialog box, click OK.

4. Repeat step 4 for each Web service application under Default Web Site. Make sure that you complete this for the following applications:
   
   

   <siteName> CatalogWebService MarketingWebService OrdersWebService ProfilesWebService

5. Close IIS Manager.