Configuring IBM Controller Disclosure Management

Configure IBM Controller Disclosure Management Server by creating the required database login, setting the required environment variables, and initializing secrets before starting the service.

1. On the SQL Server instance, connect using a SQL Server administrator account and create a dedicated login for IBM Controller Disclosure Management.
   1. Create the login in the master database:

      USE [master];
      CREATE LOGIN [ibmdmuser] WITH PASSWORD = N'<password>';

      Replace <password> with a strong password that meets your organization's password policy.

   2. Map the login to a database user in master:

      CREATE USER [ibmdmuser] FOR LOGIN [ibmdmuser];

      Note: This mapping is required for the CREATE ANY DATABASE permission to function correctly.
   3. Grant the minimum required server-level permissions to the login:

      GRANT VIEW ANY DATABASE TO [ibmdmuser];
      GRANT CONNECT ANY DATABASE TO [ibmdmuser];
      GRANT SELECT ALL USER SECURABLES TO [ibmdmuser];
      GRANT CREATE ANY DATABASE TO [ibmdmuser];

      Table 1. Minimum required SQL Server permissions

      Permission	Purpose
      VIEW ANY DATABASE	Allows the login to see all databases on the SQL Server instance.
      CONNECT ANY DATABASE	Allows the login to connect to all databases on the instance.
      SELECT ALL USER SECURABLES	Grants read-only access across all user databases.
      CREATE ANY DATABASE	Allows IBM Controller Disclosure Management to create its application database during initial setup.

      Note: These permissions represent the minimum access required for IBM Controller Disclosure Management to operate. Do not grant sysadmin or other elevated server roles to this login in a production environment.
2. On the IBM Controller Disclosure Management Server, open the server environment file at the following location:

   <installdir>/wlp/usr/servers/ibmdm/server.env

3. In server.env, set the following environment variables:

   Table 2. Required server.env variables

   Variable	Description
   DB_CONNECTION_STRING	The JDBC connection string for the application database. For example: jdbc:sqlserver://server:1433;databaseName=ibmdm;encrypt=true;trustServerCertificate=false
   DB_USER_NAME	The username of the dedicated database login created in the previous step. For example: ibmdmuser
   DB_PASSWORD	The password for the database login. Use an encrypted value managed through the Secret Manager.
   OIDC_ISSUER_URI	The issuer URI of your OIDC provider. Obtain this value from your OIDC provider application registration.
   OIDC_CLIENT_ID	The client ID assigned to IBM Controller Disclosure Management in your OIDC provider application registration.
   OIDC_CLIENT_SECRET	The client secret assigned to IBM Controller Disclosure Management in your OIDC provider application registration.
   OIDC_REDIRECT_URI	The redirect URI registered in your OIDC provider for IBM Controller Disclosure Management. This must match the redirect URI configured in the OIDC provider exactly.

   Important: Store sensitive values such as DB_PASSWORD and OIDC_CLIENT_SECRET in encrypted form using the Secret Manager. Do not store plain-text credentials in server.env.
4. Save server.env.
5. Run the secrets initialization script to encrypt and register the credentials with the Secret Manager:

   init-secrets.ps1

   Note: Run this script from the IBM Controller Disclosure Management installation directory with administrator privileges.