Skip to main content

Management server failover (WSFC)

External IDP

Last Updated: 1 minute read

When you install XProtect a single-server environment, Identity Provider configuration data is protected using the Data Protection API (DPAPI). 

In a failover cluster, this data is not shared, so you must ensure that the configuration is identical on all nodes.

  1. Import the server certificate to the Personal store for the user running the Management Server service.

  2. Grant the server certificate Read permissions.

  3. Ensure the root certificate that you used to create the server certificate is imported to the User certificates > Trusted Root Certification Authorities store.

  4. If using a self-signed certificate, add it to the Trusted Root Certificates Authorities store on your local computer.

  5. Retrieve the certificate thumbprint (see How to retrieve a certificate thumbprint)

  6. Edit appsettings.json under the Identity Provider install path Identity Provider ([Install path]\Milestone\XProtect Management Server\IIS\IDP).

  7. Add the certificate thumbprint under DataProtectionSettings:

    "DataProtectionSettings": {
  "ProtectKeysWithCertificate": {
    "Thumbprint": "[thumbprint]" 
  }
},

  8. Repeat on the remaining Management Server nodes.