> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/getting-started-guide/prepare-your-lab.md). # Prepare your lab What to provision before installing: VM sizing, the Active Directory test area, and the service account. **Goal:** two VMs, a scoped AD test area, a service account, and all installers downloaded — so the install itself is uninterrupted.\ **Time:** 45–60 minutes (excluding VM provisioning). ## The OpenIAM host (Linux) | Requirement | Value | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | OS | Rocky Linux 9 or AlmaLinux 9, x86\_64 | | CPU / RAM / disk | 8 vCPU · **48 GB RAM** · **80 GB free on `/`** (non-production minimums; the installer checks RAM and disk and refuses to run below them) | | Swap | **Must be disabled.** The installer exits if `swapon --show` returns anything. Disable with `swapoff -a` and comment out swap lines in `/etc/fstab` | | Network | Internet access (downloads dependencies during init); a DNS name (e.g. `openiam.poc.example.com`) — required later for HTTPS and federation. Inbound TCP **5672** must be open for the Windows connector — the installer only opens 80/443, so plan to run `firewall-cmd --permanent --add-port=5672/tcp && firewall-cmd --reload` ([Install the AD connector](/getting-started-guide/lifecycle/install-ad-connector.md) reminds you) | | Time sync | NTP active (`chronyd`) — SAML assertions and one-time passcodes are clock-skew sensitive; keep the Windows host synced too (`w32tm /query /status`) | | Access | root (or full sudo) | A production install has higher minimums (200 GB disk, 64 GB RAM) — this guide uses the non-production profile. **Why 48 GB?** This single VM runs the entire enterprise stack self-contained: all OpenIAM services plus RabbitMQ, Vault, Cassandra/JanusGraph, OpenSearch, Redis, MariaDB, and optional monitoring — the same components a production deployment distributes across nodes. The installer enforces the minimums because undersized evaluations fail in misleading ways; don't try to defeat the check. A significantly smaller footprint is under active engineering — check the release notes of versions after 2026.7.1 for reduced minimums. ## The connector host (Windows) | Requirement | Value | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------ | | OS | Windows Server 2016 / 2019 / 2022 / 2025 | | Sizing | 2 vCPU · 8 GB RAM · 60 GB disk (demo profile) | | Domain | Joined to the test AD domain (recommended; a non-domain-joined server also works if it can reach a domain controller) | | .NET | .NET Framework 4.8 (the installer refuses to run without it) | | PowerShell | 5.1 (included in Windows Server 2016+) | | **RSAT AD module** | The connector hard-requires the ActiveDirectory PowerShell module. Install it now: `Install-WindowsFeature RSAT-AD-PowerShell` | | Network | Outbound TCP **5672** to the OpenIAM host (RabbitMQ); reachability to a domain controller (AD Web Services, TCP 9389) | SQL CE 4.0 SP1 is also required for connector logging — the installer detects and installs it automatically if missing. ## Active Directory test area Create a dedicated, disposable OU tree. Everything in this guide reads from and writes to this subtree only. {% code overflow="wrap" %} ```powershell New-ADOrganizationalUnit -Name "OpenIAM-POC" -Path "DC=yourdomain,DC=local" New-ADOrganizationalUnit -Name "Users" -Path "OU=OpenIAM-POC,DC=yourdomain,DC=local" New-ADOrganizationalUnit -Name "Groups" -Path "OU=OpenIAM-POC,DC=yourdomain,DC=local" New-ADOrganizationalUnit -Name "Provisioned" -Path "OU=OpenIAM-POC,DC=yourdomain,DC=local" ``` {% endcode %} Populate it with test data — around 10 users (give some of them `Manager` links) and 5 groups with memberships. Never point this POC at production OUs. ## Service account Create an AD account (e.g. `svc-openiam`) and delegate rights **on the POC OU only**, using the Delegation of Control wizard in Active Directory Users and Computers (right-click the OU → Delegate Control): create/delete user objects, modify user and group properties, reset passwords, enable/disable accounts. Do not use a Domain Admin account — part of what the POC proves is that OpenIAM works with least-privilege access.
The Active Directory Delegation of Control wizard on the Tasks to Delegate step, with the five account and group tasks ticked and the Group Policy tasks left clear
See **Connector Configuration → Active Directory (PowerShell)** at [docs.openiam.com](https://docs.openiam.com) for the full permission discussion. ## Downloads Register at [openiam.com](https://www.openiam.com) — registration gives you access to the release download area and to the support portal. No license key is entered during installation; your evaluation entitlement is handled through the portal, so once you can reach the URLs below you have everything the installer needs. On the Linux host: {% code overflow="wrap" %} ```bash cd /usr/src curl -O https://download.openiam.com/release/enterprise/2026.7.1/rpm/openiam-2026.7.1.noarch.x86_64.rpm curl -O https://download.openiam.com/release/enterprise/2026.7.1/rpm/openiam-2026.7.1.noarch.x86_64.rpm.sha512 sha512sum -c openiam-2026.7.1.noarch.x86_64.rpm.sha512 ``` {% endcode %} On the Windows host: {% code overflow="wrap" %} ```powershell Invoke-WebRequest https://download.openiam.com/release/enterprise/2026.7.1/connectors/connector_AD_v5.exe -OutFile connector_AD_v5.exe Invoke-WebRequest https://download.openiam.com/release/enterprise/2026.7.1/connectors/connector_AD_v5.exe.sha512 -OutFile connector_AD_v5.exe.sha512 # Compare the hashes programmatically: $expected = (Get-Content connector_AD_v5.exe.sha512).Split(' ')[0].Trim().ToLower() $actual = (Get-FileHash connector_AD_v5.exe -Algorithm SHA512).Hash.ToLower() if ($actual -eq $expected) { "Checksum OK" } else { "CHECKSUM MISMATCH - do not install" } ``` {% endcode %} Also have ready: the TLS certificate and key for your OpenIAM DNS name, plus the CA bundle ([Enable HTTPS](/getting-started-guide/enable-https.md) lists lab-friendly ways to get one if you don't have it yet). ## Values worksheet Record these now; later pages reference them by name. | Name | Example | Yours | | ------------------------------ | ----------------------------------------------------------------------------------------------------------- | ----- | | OpenIAM host DNS name | `openiam.poc.example.com` | | | Database choice | MariaDB (local) or PostgreSQL (pre-provisioned) | | | RabbitMQ password | `passwd00` (unless changed in [Verify health and log in](/getting-started-guide/verify-and-first-login.md)) | | | AD domain | `yourdomain.local` | | | POC OU DN | `OU=OpenIAM-POC,DC=yourdomain,DC=local` | | | Service account | `yourdomain\svc-openiam` | | | Connector name (no whitespace) | `ADPOC` | | | Test user in AD | `jsmith` | | ## You know this worked when… {% hint style="success" %} Both VMs meet the sizing table, `swapon --show` prints nothing on the Linux host, `Get-Module -ListAvailable ActiveDirectory` returns the module on the Windows host, both sha512 checks pass, and your POC OU contains test users and groups. {% endhint %} Next: [Install OpenIAM from RPM](/getting-started-guide/install-openiam-rpm.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/getting-started-guide/prepare-your-lab.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.