Install Querona

Make sure to review Requirements and compatibility and Installation prerequisites. It is assumed at this stage that prerequisite requirements are met.

Step 1. Start the installation by running the MSI package

Welcome window appears.

Click Next.

Step 2. Read the license text and if you agree, accept the license

You may install Querona only after you accept the license. If you agree click Next, otherwise click Cancel to abort the installation.

Step 3. Select destination folder and metabase hosting database engine

Note

We assume the selection of the MS SQL Server engine. If SqLite engine is selected, skip Step 4.

Step 4. Provide database server name

Note

The deployment of metadata databases to different servers is not supported by the installer. All databases need to be installed on the same machine.

Provide database server name you want to host Querona metabase and Spark metastore databases on.

Warning

Do not enter “(local)” alias for local Microsoft SQL Server database, because it will break configuration of Apache Spark. For local database always use localhost with optional instance name like localhost\myinstance.

Click Next.

Step 5. Provide configuration of the Windows service

Please choose the proper settings using the table below:

Domain	Account	Password	Description
NT AUTHORITY	NetworkService	not required (leave empty)	The NetworkService account is a predefined local account used by the service control manager. It has minimum privileges on the local computer and acts as the computer on the network. This account does not have a password, so any password information that you provide is ignored. A service that runs in the context of the NetworkService account presents the computer’s credentials to remote servers. By default, the remote token contains SIDs for the Everyone and Authenticated Users groups.
NT AUTHORITY	LocalService	not required (leave empty)	The LocalService account is a predefined local account used by the service control manager. It has minimum privileges on the local computer and presents anonymous credentials on the network. This account does not have a password, so any password information that you provide is ignored.
Machine name	<custom local user>	enter local user password	Local user account created on machine you install on.
Domain name	<custom domain user>	enter domain user password	Domain user account from your company domain.

Two scenarios are common for choosing the service account:

Scenario	Description
Local computer Network Service (NT AUTHORITY\NetworkService).	To authenticate using computer account pick NetworkService as service user name and NT AUTHORITY as NetBIOS domain name. A password is not required and ignored if entered.
Designated Active Directory user (NETBIOS_DOMAIN\user_name), for example CONTOSO\queronaSvc.	To authenticate using designated AD user, pick domain from the list or enter domain name manually, then enter the user name and provide password designated for the user name entered.

Click Next.

Service user name and password will be validated against Active Directory (AD) or local store respectively. In case you provide wrong credentials, an error message will be displayed:

Click Ok and correct credentials entered until validation passes.

Step 6. Set the administrator password

Name the administrator account and set its password; the account is used to sign in to the Administration Portal. On a new installation, Administrator login is the name the built-in administrator account gets (default admin): at most 128 characters, and not the name of a built-in role or of another built-in account (system, spark, BUILTIN\Administrators, public, sysadmin, securityadmin, dbcreator, datareader, viewer). Type the password twice: the fields are masked, so the confirmation is what catches a slip before the password is written to an account you would then be locked out of. The password is stored only as a salted hash; the value you type is never written to the install log, to any configuration file, or to the metabase in clear.

The password must:

• be at least 8 characters long;

• use at least three of: lower-case letters, upper-case letters, digits, symbols;

• not be trivially guessable. A single repeated character, a run such as 12345678, the login name, and anything built around words such as admin, querona or password are refused, including spellings that swap digits or symbols for letters, such as P@ssw0rd.

The same rules apply to a login and password supplied on the command line for an unattended installation.

On a new installation the password is required. New versus upgrade is decided by whether a metabase already exists, so any install over an existing metabase, including a reinstall after uninstalling, counts as an upgrade, and the current password is kept unless you tick Set the administrator password and enter a new one.

On an upgrade, Administrator login lists the accounts the installer can set a password on: the logins that authenticate with a password and are members of the sysadmin role, as found in the existing metabase. The built-in admin account can be renamed from the portal, so it is offered under its current name; a disabled account is listed with (disabled) after its name, and setting its password does not enable it. When no such account exists, because every administrator signs in with Windows authentication, the box stays unavailable and no password is changed.

An unattended installation names the account with the ADMIN_LOGIN property (default admin): on a new installation that is the name the built-in account gets; on an upgrade it must be an existing login, or the installation stops and the log names the logins it could have set. Renaming the account at install also re-owns the built-in schedules, which the installation creates under the administrator’s name.

Setting the password does not change the account’s second-factor enrolment: an account that requires a verification code keeps requiring one.

You can also change it later from the portal (see Setting a user’s password).

Step 7. Configure instance parameters

Provide custom TDS port, Web port, and Web SSL port, or accept the defaults. Installer will verify that designated network ports are available. If any of the port is in use, a warning will appear. Port availability check can be skipped by ticking the check box Skip network port “in use” check during installation.

Installer loads all certificates from the Local Machine certificate store, verifies them, and presents in a dropdown list. If a friendly name is available, it will be used in a drop down list along with the first twelve and last four characters from the certificate thumbprint. Otherwise, a certificate thumbprint will be presented in full. Certificates that passed the X.509 chain validation are marked as “VERIFIED”.

If you require Secure Sockets Layer (SSL) to be enabled, select certificate from the SSL settings dropdown list. If you do not select a certificate or select ‘None’, the SSL support will be disabled.

Warning

The selected certificate has to have a private key. We recommend to choose from the verified certificates. Certificates that do not pass verification may not work. In such a case, you may not be able to connect to Querona Administrative Portal over SSL even if installation is successful.

Click Next.

Step 8. Configure Spark

Provide custom Spark settings, or accept the defaults.

The following settings can be configured:

Setting	Description
Spark warehouse folder	Warehouse folder is the base directory where directories related to databases, tables go by default. Corresponds with Spark’s parameter spark.sql.warehouse.dir
Temporary “scratch” folder(s)	Folder or a comma-separated list of folders (can be on different disks) to use for “scratch” space in Spark. This should be on a fast, local disk(s) in your system.
Spark Web GUI port number	Port number where Spark will host its Web GUI. This GUI is available only from localhost and does not require authentication.

Click Next.

Step 9. In the confirmation dialog click Install and allow for privilege elevation

A progress windows will appear. Wait for the installation to finish.

When the installation completes successfully click Finish.

Log on as administrator

1. Launch Web Administrative portal by navigating to http://localhost, assuming you are logged on to Querona Windows server using Remote Desktop.

2. Provide administrative credentials to log in. By default, all users that belong to local Administrators group on a machine hosting Querona, have administrative privileges. If you want to logon using built-in credentials, use the default user/password: admin/admin. Default behavior and security settings can be changed using Querona Administrative Portal, as described in Configuration section.

3. Follow the steps described in Post-installation configuration section.