IdentityMesh Installer

The IdentityMesh MSI packages all server-side components into a single installer with selectable features. A separate MSI ships each Relay Agent.

Prerequisites

• .NET 8 Desktop Runtime x64 (windowsdesktop-runtime-8.0-win-x64)
• ASP.NET Core 10 Runtime x64 (aspnetcore-runtime-10.0-win-x64)
• SQL Server (local or remote, Windows auth recommended)
• IIS (optional, for the Admin Portal hosting)

The installer detects missing .NET runtimes and blocks installation with a descriptive error message including the download URL.

The MSI and all bundled binaries are Authenticode-signed.

MSI Features

The installer presents a feature selection dialog during Custom install.

Default install directory: C:\Program Files\IdentityMesh\

All features are children of MainFeature — they appear as a single product entry in Add/Remove Programs.

Install Wizard

The installer wizard collects configuration through the following flow:

1. Welcome — Product intro.
2. Folder — Install directory selection.
3. Customize — Feature selection (SyncEngine, AdminAPI, AdminUI).
4. SQL Configuration — SQL Server instance, database name, and Admin Portal IIS port (shown only when AdminUI is selected).
5. Service Accounts — Separate accounts for Sync Engine and Admin API. Supports domain accounts, gMSA (suffix $, no password), or blank for Local System.
6. Role Group Mapping — AD security groups for Admin, Operator, and Viewer roles. Pre-populated with DOMAIN\IdentityMesh-Admins, DOMAIN\IdentityMesh-Operators, DOMAIN\IdentityMesh-Viewers using the detected domain. Optional — leave blank to skip.
7. Verify Ready — Summary before install.

Install Behavior

msiexec /i IdentityMesh-1.0.26077.msi

1. Files are installed to the selected features’ directories.
2. Windows services are registered (SyncEngine and/or AdminAPI).
3. DbSetup.exe runs automatically after install (NOT Installed condition).

DbSetup Steps

Logs: %TEMP%\IdentityMesh.DbSetup.log (also copied to APPDIR\sql\dbsetup.log).

Windows Services

Services are configured with the account and password entered during install. If no account is specified, services run as LocalSystem. gMSA accounts (ending with $) are supported — password is left empty.

IIS Site

When AdminUI is selected, DbSetup creates an IIS site:

• Site name: IdentityMesh Admin Portal
• Physical path: APPDIR\ui\
• Port: Configured during install (default: 4200)
• Requires: IIS installed with appcmd.exe

If IIS is not installed, DbSetup logs a warning and skips. The UI files can be hosted manually on any web server.

Role Group Mapping

The installer writes AD group mappings to api\appsettings.json:

{
  "IdentityMesh": {
    "SqlConnectionString": "...",
    "Roles": {
      "Admin": "DOMAIN\\IdentityMesh-Admins",
      "Operator": "DOMAIN\\IdentityMesh-Operators",
      "Viewer": "DOMAIN\\IdentityMesh-Viewers"
    }
  }
}

See authentication.md for how roles and permissions resolve at request time.

MSI Properties

Properties available for silent install (msiexec /i ... PROPERTY=value):

UpgradeCode

The MSI UpgradeCode is stable across versions to support in-place upgrades:

{8A4E2C6D-F1B3-4A5E-9D7C-2E8F0B6A4C1D}

Do not change this unless forking or creating a separate product.

Files