Restrict Square 9 Identity Manager To Only Accept Local Connections

Owned by Sam Sebastian
Apr 04, 2024
2 min read

If you are using a 3rd party SCIM integration you cannot restrict S9IM in this manner. SCIM requires that remote servers be able to access the S9IM API interface

Please reach out to Square 9 Support for assistance if you are unsure of how to make these changes, if you have a split server environment or if you are unsure if your environment is using a SCIM configuration.

By default the Square 9 Identity Manager (S9IM) will accept connections from any network interface. By updating the configuration file it can be restricted to accept connections from a single network device. This may be preferable for Single Server environments where it is not needed for S9IM to be widely accessible. We’ll go through the steps to restrict S9IM to only accept connections via localhost.

Update the S9IM config file

To restrict it to only accept local connections it needs to be set to 127.0.0.1. Using localhost will result in the port opening on the LAN but the interface will not work as expected

The S9IM configuration file is found at the path below. Inside the file you’ll find a HostListener key/value pair, update the value portion accordingly as desired.

C:\Program Files\Square 9 Softworks\Identity Manager\Config\Square9.IdentityManager.exe.appSettings.config

<add key="HostListener" value="http://127.0.0.1:8080" />

Under the default configuration you should not have to make any other changes. The default configuration has Square9API/Square9CaptureAPI communicating with http://localhost:8080/api/ which will still be accessible with the configuration change made. See the section at the bottom if you think you're having issues related to this change.

Restart the Square 9 Identity Manager Service

Open the Windows Services interface (services.msc) and restart the S9IM service, which should be listed as Square 9 Identity Manager.

Update the Square9API/Square9CaptureAPI web.config files

Both files will have the same line that needs to be updated, often you’ll find it split over two lines for readability.

<add key="urn:square9:identitymanager:apiconnector:configuration:baseurl" value="http://localhost:8080/api/" />

Update this value in the config files below to match the new address in your S9IM config file. The changes made to this file are loaded dynamically, simply saving the file should have the changes applied.

  • Default Locations:

    • C:\inetpub\wwwroot\Square9API\web.config

    • C:\inetpub\wwwroot\Square9CaptureAPI\web.config