Pre-installation guide - Next Gen Identity Server

Next Gen Identity Server should not be deployed during EA except for customers participating in the beta program.

The Next Gen Identity Server is an OAuth2/OpenID Connect authentication and authorization service. It is built on Duende IdentityServer 7. It runs as an ASP.NET Core 10 application hosted under IIS. It manages user authentication for Relativity Server environments. This guide covers what you must verify, configure, and provision. Complete these steps before running the installer.

For EA, install the Next Gen Identity Server once per environment on the Identity Server host. See Product Overview for the full topology statement.

System requirements

The Next Gen Identity Server requires the system configuration as per https://help.relativity.com/Server2026/Content/Installing_and_Upgrading/System_requirements/System_requirements.htm

The installer does not download prerequisites. The following must be pre-installed on the Identity Server host before running the installer:

.NET 10 SDK - verify with dotnet --list-sdks; expect at least one 10.0.x entry.
ASP.NET Core Hosting Bundle for .NET 10 - verify with dotnet --list-runtimes; expect a Microsoft.AspNetCore.App 10.0.x entry.

Stage both downloads on the Identity Server host before running the installer.

Prerequisites

Complete all of the following checks before running the installer.

Install the Next Gen Identity Server on the Identity Server host. This server is separate from the Relativity web application server. Do not install it on the SQL Server host or the Relativity primary server.

.NET

Verify that .NET 10 is correctly installed.

Confirm .NET 10 is installed by running:
Copy
```
dotnet --list-sdks
dotnet --list-runtimes
```
Expected: at least one 10.0.x SDK entry and a Microsoft.AspNetCore.App 10.0.x runtime entry.

IIS

Verify the following IIS requirements.

IIS is installed and the Default Web Site exists and is running.
Confirm that the Application Development feature set is enabled. ASP.NET Core hosting requires the ASP.NET Core Module for IIS.
There is no existing IIS application at path /RIS under Default Web Site.
There is no existing IIS application pool named Identity.

SQL Server / database

Verify the following SQL Server requirements.

The EDDS database exists on a reachable SQL Server instance.
TCP port 1433 is open between the Next Gen Identity Server and the SQL Server host. For named instances, open the named instance port as well.
The Procuro script has been applied to the EDDS database. The installer requires two objects it does not create itself: [eddsdbo].[DeploymentLogs] and [eddsdbo].[SaveDeploymentLog]. To verify, run the following query against the EDDS database:
Copy
```
SELECT * FROM sys.procedures WHERE name = 'SaveDeploymentLog'
```
If the query returns no results, contact Relativity Support to apply the Procuro script before proceeding.

Relativity SecretStore

Confirm the following before installation:

Relativity SecretStore is accessible from the Next Gen Identity Server.

Service account

A Windows domain or local account is available to run the Identity IIS application pool. Use the Relativity Service Account (RSA) - this is the same account used for other Relativity server roles and is the recommended choice.
If you use a different account, it must be a valid, non-expired domain or local account.
The installer validates the account and automatically grants the Log on as a service right. Use DOMAIN\username format for domain accounts, or .\username for a local account.

Network and firewall

Verify the following network and firewall requirements.

Port	Protocol	Direction	Purpose
1433	TCP	Outbound	SQL Server (EDDS database)
443	HTTPS	Inbound	Browser access to the Next Gen Identity Server
8200	HTTP	Outbound	OpenTelemetry Collector (OTLP endpoint - required only if Environment Watch is deployed)

All ports in the preceding table are open on the host-based and network firewalls.
For named SQL Server instances, the named-instance port is also open.

Port 8200 (OTLP). This port is required only if Environment Watch is deployed in your environment.

Certificates

A valid TLS/HTTPS certificate is available with the following properties:
- Issued to: the fully qualified domain name (FQDN) that client browsers use to reach the Next Gen Identity Server - for example, identity.yourcompany.com.
- Issued by: your corporate CA or a public CA. Do not use the Relativity CA - it is not trusted by client browsers and causes TLS errors on sign-in.
- Installed in: the Local Computer > Personal (LocalMachine\My) certificate store on the Next Gen Identity Server host.
If a corporate CA issued your TLS certificate, import the CA root certificate into the Trusted Root Certification Authorities store on all client machines and servers that access the Next Gen Identity Server endpoint. Windows trusts public CA certificates by default.

Configuration before install

Complete the following configuration steps before running the installer.

1. Confirming IIS site bindings

The installer does not create or modify IIS site bindings. Confirm the following on Default Web Site before installation:

An HTTPS binding on port 443 exists on the Default Web Site.
The TLS certificate assigned to that binding is issued to the FQDN that client browsers use to reach the Next Gen Identity Server.

2. Confirming service account permissions

The installer creates C:\Program Files\Relativity Identity Service\ during installation. You do not need to create directories or grant permissions in advance.

Database details

The installer records each deployment in the EDDS database using two objects that the Procuro script creates. You do not create these objects. Your action is to confirm the Procuro script was applied before running the installer - use the SQL check in the SQL Server / database prerequisites section above.

Object	Name	Created by
Table	`[eddsdbo].[DeploymentLogs]`	Procuro script
Stored procedure	`[eddsdbo].[SaveDeploymentLog]`	Procuro script

If either object is missing, the installer completes the deployment but cannot write the deployment record. Contact Relativity Support to apply the Procuro script.

Known incompatibilities

The following configurations conflict with the Next Gen Identity Server installer.

Existing /RIS IIS application or Identity Application Pool: The installer attempts to create these resources. Remove or rename any pre-existing resources with those names before running the installer.
.NET versions below 10.0: The service targets .NET 10 exclusively. Older .NET or .NET Framework runtimes on the same IIS instance do not interfere. However, the Identity Application Pool must use no managed runtime (""). Do not configure it to use a .NET Framework version.
32-bit (x86) hosts: The installer and service are 64-bit only. They require a 64-bit OS and a 64-bit IIS application pool.