User guide - Next Gen Identity Server Installer

The Next Gen Identity Server Installer is a WiX-based bootstrap executable and underlying MSI. It deploys the Next Gen Identity Server as an IIS application under the Default Web Site. The Next Gen Identity Server is an ASP.NET Core 10 authentication service. It is built on Duende IdentityServer 7 and implements OAuth2/OpenID Connect.

This guide is for Relativity administrators. It covers the installation workflow, supported modes, and installer properties. It also covers the workflows you run immediately after installation.

Installation prerequisites

For EA, install the Next Gen Identity Server once per environment on the Identity Server host. See Product Overview for the full topology statement.

Have the following in place before launching the installer. The installer validates these at startup and displays a specific error if anything is missing - you will not need to guess what failed.

For the complete preparation checklist see Pre-Installation Guide.

Getting started - interactive mode

Use the interactive installer for first-time installs on a single server.

Step 1 - Copying the installer to the Identity Server host

Obtain Relativity.Server.IdentityService.Installer.exe and the accompanying .msi from your Relativity delivery package or the Relativity download portal. Place both files on the Identity Server host in a writable directory such as C:\Temp\IdentityServiceInstaller\. The path does not matter. The log file writes to the same directory.

Step 2 - Launching the installer

Open an elevated PowerShell or Command Prompt window (Run as Administrator). The installer requires administrative rights to write to protected directories. It also registers an IIS application pool and calls into the EDDS database.

cd C:\Temp\IdentityServiceInstaller
.\Relativity.Server.IdentityService.Installer.exe /log InstallLog.txt

Step 3 - Entering the primary SQL data source

The installer dialog prompts for the SQL Server instance hosting the EDDS database. Enter the instance in SERVER\INSTANCE format. For a custom port, use HOSTNAME,PORT format (for example, sqlhost,1435).

Fresh install: This field is mandatory.

Upgrade: The installer reads the existing value from Relativity Secret Store. Re-enter it only if the SQL Server instance has changed.

Step 4 - Providing service account credentials

The installer accepts any Windows domain or local account. The account must have the Log on as a service right. We recommend the Relativity Service Account (RSA) for consistency with the Relativity platform.

Fresh install: Enter the service account credentials. The credential fields are required.

Upgrade: Enter new credentials to update the service account. Leave the fields empty to keep the existing stored credentials.

The installer validates the credentials before writing any files. If the credentials are invalid, the install stops at this stage and displays an error.

Step 5 - Accepting the license agreement

The bundle UI presents a Welcome screen and an End User License Agreement. Read the agreement and select I agree to the Relativity Identity Service license terms. Click Install.

Step 6 - Updating the Identity Provider URL

The installer checks for an existing IdentityProviderURL in Relativity instance settings during installation.

If a URL exists, a dialog appears: An Identity Provider URL already exists: <current URL>. Do you want to update it to <new URL>?

• Click Yes if the hostname has changed.
• Click No when the hostname has not changed.

Step 7 - Finishing

When the Installation Successfully Completed screen appears, click Close.

If an error appears, see the Troubleshooting Guide for the diagnostic steps.

Proceed to Post-Installation Verification to confirm the deployment is healthy.

Common workflows

Use the following workflows based on your deployment scenario.

Fresh install scenarios

Use one of the following workflows for a fresh installation.

Workflow A: interactive install (default)

For first-time installs on a single server, use the bundle UI. It guides you through the data source, credentials, and license agreement.

.\Relativity.Server.IdentityService.Installer.exe /log InstallLog.txt

Workflow B: command-line install with parameters

For unattended or partially-attended deployments, pass MSI properties on the command line. The following table lists the most common properties:

.\Relativity.Server.IdentityService.Installer.exe `
    /log C:\Temp\InstallLog.txt `
    PRIMARYSQLDATASOURCE="sqlhost\EDDSINSTANCE001" `
    RELSERVICEACCOUNTUSERNAME="<username>" `
    RELSERVICEACCOUNTPASSWORD="<password>"

Workflow C: silent (unattended) install

For automated deployments, suppress the UI. Use /quiet (no UI) or /passive (progress bar only). Examples include configuration management tools and deployment runners.

.\Relativity.Server.IdentityService.Installer.exe /quiet /log C:\Temp\InstallLog.txt `
    PRIMARYSQLDATASOURCE="sqlhost\EDDSINSTANCE001" `
    RELSERVICEACCOUNTUSERNAME="<username>" `
    RELSERVICEACCOUNTPASSWORD="<password>"

The process exit code indicates the outcome:

Treat exit codes 0 and 3010 as success. Treat any other code as failure.

Upgrade scenarios

Use one of the following workflows to upgrade an existing installation.

Workflow D: upgrade (interactive mode)

Run a newer installer to upgrade the Next Gen Identity Server in place. The installer removes the previous version and installs the new one. Your existing configuration carries over automatically. You do not need to uninstall separately.

.\Relativity.Server.IdentityService.Installer.exe /log UpgradeLog.txt

To update SQL datasource and service account credentials, pass the following parameters on the command line:

.\Relativity.Server.IdentityService.Installer.exe /log UpgradeLog.txt `
    PRIMARYSQLDATASOURCE="sqlhost\EDDSINSTANCE001" `
    RELSERVICEACCOUNTUSERNAME="<username>" `
    RELSERVICEACCOUNTPASSWORD="<password>"

Workflow E: upgrade (silent mode)

Run a newer installer to upgrade the Next Gen Identity Server in place. The installer removes the previous version and installs the new one. Your existing configuration carries over automatically. You do not need to uninstall separately.

.\Relativity.Server.IdentityService.Installer.exe /quiet /log UpgradeLog.txt

To update SQL datasource and service account credentials, pass the following parameters on the command line:

.\Relativity.Server.IdentityService.Installer.exe /quiet /log UpgradeLog.txt `
    PRIMARYSQLDATASOURCE="sqlhost\EDDSINSTANCE001" `
    RELSERVICEACCOUNTUSERNAME="<username>" `
    RELSERVICEACCOUNTPASSWORD="<password>"

The installer supports major upgrades within the same annual release line. For example: 26.0.x to 26.1.0. The installer does not support downgrades. To roll back, uninstall the newer version and install the older one.

Uninstall scenarios

The service supports two uninstallation modes: interactive and command-line.

Workflow F: uninstallation

Interactive mode

Run the installer bundle with the /uninstall flag to launch the uninstall UI:

.\Relativity.Server.IdentityService.Installer.exe /uninstall /log UninstallLog.txt

Command-line mode

To uninstall without a UI, add /quiet to suppress all prompts:

.\Relativity.Server.IdentityService.Installer.exe /uninstall /quiet /log UninstallLog.txt

Uninstalling the service removes the following files and resources:

• The install directory (C:\Program Files\Relativity Identity Service\).
• The Identity IIS application pool.
• The /RIS IIS application.

It writes a final record to [eddsdbo].[DeploymentLogs] with installation_status set to Uninstall Success. Uninstall does not modify EDDS database content.

Install verification

After the Installation Successfully Completed screen appears, confirm the deployment is healthy:

1. Open IIS Manager (press Win+R, type inetmgr, press Enter). Click Application Pools in the left panel and find Identity in the list.

   • Success: Status shows Started.
   • Failure: If the pool shows Stopped, see the Troubleshooting Guide.

2. In IIS Manager, expand Default Web Site in the left panel. Confirm RIS appears as a child application at C:\Program Files\Relativity Identity Service\.

   • Success:RIS is listed under Default Web Site.
   • Failure: If RIS is missing, see the Troubleshooting Guide.

3. Open a browser and go to https://[domainname]/RIS/Healthcheck.

   • Success: The page returns "status": "Healthy".
   • Failure: If the page does not load or returns an error, see the Troubleshooting Guide.

4. Go to https://[domainname]/RIS/Diagnostics.

   • Success: All components show as healthy.
   • Failure: If any component is unhealthy, see the Troubleshooting Guide.

5. Go to https://[domainname]/RIS/.well-known/openid-configuration.

   • Success: The page loads and displays configuration data for the Next Gen Identity Server.
   • Failure: If the page does not load, see the Troubleshooting Guide.

6. In Relativity, go to Instance Settings and find IdentityProviderURL. Confirm the value is https://[domainname]/RIS/.

   • Success: The value matches the Next Gen Identity Server URL.
   • Failure: If the value is missing or incorrect, update it to https://[domainname]/RIS/. Then restart IIS.

For the full verification matrix, see Post-Installation Verification.

FAQ

Do I need to stop IIS before running the installer?
No. The installer creates a new application pool and a new IIS application under the Default Web Site. Other applications running on IIS continue to serve traffic during the install. However, the installer requires an HTTPS binding on port 443 to exist on the Default Web Site - this binding is shared across all sites on the server. If you host other sites on a non-standard port or use SNI-based certificate bindings, contact Relativity Support before installing to confirm there are no conflicts.

Can I install the Next Gen Identity Server to a custom directory?
Yes. The default install directory is C:\Program Files\Relativity Identity Service\. In the interactive installer, the Options page includes an install path field. For silent installs, pass -variable:InstallFolder=<path> on the command line:

.\Relativity.Server.IdentityService.Installer.exe -variable:InstallFolder="D:\IdentityService" /log InstallLog.txt

We recommend the default path for consistency with Relativity documentation and support guidance.

What happens if a prerequisite check fails?
The installer halts before writing any files. It displays the specific failure and writes the detail to the log. For example: .NET 10 Hosting Bundle must be installed. Resolve the prerequisite and rerun.

Where are the installer logs?
Without /log, the bundle writes a log to %TEMP%\Relativity_Identity_Service_<timestamp>.log. The underlying MSI always logs verbosely to %TEMP%\MSI*.log. Always pass /log for production installs to control the log file location.

Can the installer be run on a server that already has an older Identity Service?
Yes - running a newer bundle performs an in-place major upgrade. The installer removes the prior version's files and installs the new version.

Does the installer modify the EDDS database schema?
No. Schema for [eddsdbo].[DeploymentLogs] and the [eddsdbo].[SaveDeploymentLog] stored procedure must be available before installation. The installer only inserts a row into the table through the stored procedure.

Why does the installer ask for a service account password?
The Next Gen Identity Server application pool runs under a configured Windows account. The application pool authenticates to SQL Server and Relativity SecretStore using Windows identity.

Can I run the installer over RDP?
Yes, including the interactive UI. Silent (/quiet) installs also work over WinRM or PsExec - useful for fleet deployment.

The healthcheck endpoint returns 503 right after install. What is causing this?
The Identity application pool may be stopped. Secret Store may not be configured. Secret Store may not have the EDDS credential or the PrimarySqlDataSource key. See the Troubleshooting Guide for the diagnostic flow.

Related documents

The following guides cover the complete Next Gen Identity Server deployment lifecycle.

• Pre-Installation Guide - environment preparation checklist.
• Post-Installation Verification - full verification matrix.
• Troubleshooting Guide - symptom / cause / resolution reference.