Introduction

This page includes useful information for the consideration of an environment specification and system recommendation for running Ubisecure Identity Server. Below you will find the currently supported software, actively tested browsers and hardware requirements and recommendations. All recommendations are based on an example reference environment of 100 000 active users with 100 logins per second as normal sustainable, non-impacting load.

These are not intended to highlight the minimum requirements but instead Ubisecure's recommendations in order to effectively run the Identity Server in a production environment.  Ubisecure performs release testing on a variety of environments for each release, using a combination of single and dual-node installations on Linux and Windows Server operating systems and with automated and manual regression testing performed by a variety of the listed supported browsers in their latest stable distribution. 

Your exact environment needs may need to be reviewed and altered depending on what types of workloads you run. Your workload is influenced for example by these factors (but not limited to):

• Active users having user account in Ubisecure Directory and CustomerID database

• Number of internal and external authentications 

• Number of requests to Identity Server APIs

• Number of interactions with CustomerID registration flows and Self-Service UI

Supported Browsers

Ubisecure Identity Server has been tested with the following desktop browsers

• Google Chrome

• Mozilla Firefox

• Safari

• Microsoft Edge

Supported Operating Systems

Ubisecure Identity Server supports a number of Linux distributions and Microsoft Windows Server

*) libxcrypt-compat package must be installed when using OpenLDAP on RHEL 9 based Linux distribution

Software Requirements

The following chapter lists the required software that is used to run Ubisecure Identity Server. Ubisecure lists the software that it uses internally to develop, test and operate Identity Server.

Java

Java 8 or 11 is required in order to run Ubisecure applications, including SSO, CustomerID and related components. Identity Server has been tested with the following Java builds. Releases from prior IDS 2022.1 (SSO 9.x.x and CustomerID 6.x.x) and later require a Java11 installation.are Java 8 based and are no longer supported by Ubisecure.

Customers are encouraged to update their installed Java version with the latest available patch release. The patch version noted in the table below was used at the time of release, but later Java patch versions will ensure the best available security levels are met. For example, Java 11 (11.0.14) was tested, but Java 11 (11.0.22) is available for customer use.

Databases

Ubisecure Directory

Ubisecure Directory requires an LDAP implementation. Identity Server supports the following LDAP implementations

Relational Databases

CustomerID and Accounting support the following Relational Databases

Redis

In high-performance deployments Ubisecure Identity Server uses Redis as a session storage. Identity Server has been tested with version 7.2.4. For more information, please refer to Use Redis with Identity ServerRedis Configuration - SSO.

Hardware recommendations

These hardware recommendations can easily sustain a deployment with 100 000 active users and 100 logins per second. Complex organisational structures or specific use cases may require the use of Redis to support session load and remove replication requirements from OpenLDAP or AD-LDS.

Storage

Identities

Ubisecure Identity Server uses two persistent data stores for storing identity related information; PostgreSQL and LDAP. The necessary storage size largely depends on the number of users, roles, organisations and custom attributes stored in the Ubisecure Identity Server.  

The following table lists the actual size of data on disk for a typical deployment storing users in 100 different organisations, including 5 roles for each organisation and 5 custom attributes for each user:

On average, each LDAP user account entry takes roughly a bit less than 10 kB whereas CustomerID database entry takes roughly 3 kB. Deployments that do not use Redis as a session storage, an additional 10 kB per single-sign-on session should be considered. The single-sign-on sessions are stored in Ubisecure Directory.

Accounting login events

In addition to identity data, as of IDS 2019.1 login events are collected into the Accounting Service database. The following table lists the actual size of data on disk for a system which contains roughly 100 000 monthly active users each able to select any of 10 configured authentication methods. Daily and monthly reports will require additional space depending on the complexity of the supported environment. The numbers shown in the table below should be used as an indication of the disk space required for the accounting service as of this release.

CPU

*) Currently Accounting is installed alongside SSO thus the processes share the same resources.

Memory

Ubisecure applications

For running the Identity Server applications, the following table lists the memory recommendations. 

For more information on memory configurations, please refer to

• CustomerID: Wildfly JVM settings reference

• SSO: Tomcat memory considerations

• PostgreSQL: PostgreSQL resource consumption

Redis memory considerations

When deploying Redis with Ubisecure Identity Server each single-sign-on session takes maximum of 10 kB of memory in Redis. In a typical Redis deployment (3 primary instances backed up by 3 secondary instances) this would mean

Note that the sessions are sharded shared between the three primary instances. For more information, please refer to How to use Redis with Identity ServerRedis Configuration - SSO.