Hmm, I even changed the port bindings to :8080 on default web Site and let it install the FIM CM components ...but the URL would not load...get a "ConnectionString property has not been initialized" So...how does one install FIM 2010 CM into an existing FIM 2010 Portal environment where the 'Default Web Site' is disabled? there does not seem to be a switch even in the unattend help that forces the installation inside the Sharepoint - 80 Site.

Hi, Can FIM 2010 CM be installed on the same server as FIM 2010? The installation wizard for CM keeps creating the 'CertificateManagement' directory in the 'Default Web Site' and not in the 'Sharepoint - 80' site. I have even tried renaming the 'Default Web Site' to something else and renaming the 'Sharepoint - 80' to 'Default Web Site' - but no luck. I have reviewed the unattended installation steps for FIM 2010 , but cannot find any references on how to do this. Please could someone shed some light on this, thank you

1. yes it can not sure what to do with FIM CM installer, but you can create FIM CM app. pool and virtual directory manually in the desired web site.

Hmm, I even let it install the FIM CM components into the 'Default Web Site' and changed the port bindings to :8080...but the URL would not load...get a "ConnectionString property has not been initialized" So...how does one install FIM 2010 CM into an existing FIM 2010 Portal environment where the 'Default Web Site' is disabled?

So potentially the only way I see this happening is that we bind the Default web Site to another port and start it, then install CM. But will the fact that we are changing the default port break something elsewhere?

i would NOT recommend doing that... One of the known issues is that you can't register spn for localhost for clmWebPool and Sharepoint apppoolThe FIM Password Reset Blog http://blogs.technet.com/aho/

Me neither... but if you will look into FIM 2010 RC1 vhd demo we had (all-in-one: dc, exchange, FIM + FIM CM) the answer will be "yes, FIM CM can be installed on the same server as FIM (sync+portal)".

OK, so can someone please point me to the actual Microsoft article that recommends separate installations? This way, we can keep our customers happy :-)

Ask yourself: if there will be only 1 website with 2 applications running different application pools under different accounts (as Anthony said), how would kerberos work then?

yep got Anthony's point. so there is NO legitimate way to install the CM site into the FIM Portal's 'Sharepoint - 80' Site then? Why is it so difficult to get a straight answer from MS?

it's not so difficult to get an official response from MS - just contact your TAM :) I will check that old .vhd to see how app pools are set up. Just curiuos for me how it used to work.

I installed FIM CM and FIM Portal on the same machine for demo purposes. To decide wheather or not this is a valid archictecture for production environemnts may depend on serveral criterias, such as performance, security issues, adminsitration aspects, etc. As far as I remember I performed the installation the following way: Install FIM CM on IIS Default Web Site limit Default Web Site Bindings to https/443 Install FIM Portal on SharePoint -80 IIS Site set Site Bindings to http/80 Something I didn't configure was to "https" the FIM portal site, but in general this should be possible too. Now the CLMAppPool application pool runs under the clmWebPool account. The ShortPoint-80 application runs under a different service account, let's say svcWSSApp (has to be configured in Sharepoint Central Administration) To solve the Kerberos constrained delegation issues I created two another DNS A records to access the FIM CM web site and the FIM Portal, such as A record <FIM hostname> <IP address of your FIM server> A record fimportal <IP address of your FIM server> A record pkiportal <IP address of your FIM server> then register the following SPNs svcWSSApp: HTTP/FIMPORTAL and HTTP/FIMPORTAL.<Domain> clmWebPool: HTTP/PKIPORTAL and HTTP/PKIPORTAL.<Domain> /Matthias