24.3 Restoring the Access Manager Configuration

The restore script replaces the existing configurations in the configuration database with the configuration in the backup of the configuration store. It should be used to restore configuration data in one of the following scenarios:

  • An upgrade failed and you need to return to the configuration before the upgrade.

  • You want to return to the backed up configuration because the current modified configuration does not meet your needs.

If the primary Administration Console machine has failed, you have lost both the configuration and the configuration database. To recover from this scenario, you need to do more than restore the configuration.

For instructions, see Moving the Primary Administration Console to New Hardware.

The restore script cannot be used to move the Administration Console to a different platform, even if the new machine is configured to use the same IP address and DNS name. The backup files contains path information that is specific to the operating system. To move the Administration Console from Linux to Windows or Windows to Linux, you need to install a secondary Administration Console on the desired platform, then promote it to being the primary Administration Console. For instructions on this process, see Converting a Secondary Administration Console into a Primary Console.

The restoration steps are dependent upon whether the Administration Console is installed on its own machine or with other Access Manager components:

NOTE:Restore should be made on the same version that was used to take the backup.

24.3.1 Restoring the Configuration on a Standalone Administration Console

  1. Ensure that the .zip file created during the backup process is accessible.

  2. Log in as root.

  3. (Conditional) If you have modified the Tomcat password in the server.xml file on a Linux Administration Console, back up this file. This file is located in the following directory:

    /opt/novell/nam/adminconsole/conf

    The feature to modify this password was removed in Access Manager 3.0 SP3.

  4. Change to the utility directory.

    Linux: /opt/novell/devman/bin

    Windows Server 2012: \Program Files (x86)\Novell\bin

  5. Run the following command:

    Linux: ./amrestore.sh

    Windows: amrestore.bat

  6. Specify and confirm the Access Manager administration password.

  7. (Windows) Specify the path where the backup file is stored.

  8. Specify the name of the backup file. Do not include the .zip extension.

  9. Specify the private key encryption password, then press Enter.

    Confirm the private key encryption password, then press Enter.

  10. (Conditional) If you have modified the Tomcat password or any other configuration on the Linux machine:

    1. Modify the server.xml file with changes that you have made in the Tomcat directory.

      /opt/novell/nam/adminconsole/conf

    2. Restart Tomcat by running the following command:

      /etc/init.d/novell-ac restart OR rcnovell-ac restart

  11. (Windows) Reboot the machine.

  12. If you have a secondary Administration Console installed, reboot the machines.

  13. If any devices report certificate errors, you need to re-push the certificates.

    1. Click Troubleshooting > Certificates.

    2. Select the store that is reporting errors, then click Re-push certificates.

      You can select multiple stores at the same time.

    3. (Optional) To verify that the re-push of the certificates was successful, click Security > Command Status.

If you are restoring only the Administration Console, other components should still function properly after the restore.

24.3.2 Restoring the Configuration with an Identity Server on the Same Machine

Select the type of machine the Administration Console is installed on:

Linux

Whenever you run the amrestore.sh script, the Administration Console is restored as a standalone Administration Console. You must perform the steps described in Step 8 to restore your Identity Server into the configuration.

  1. Ensure that the .zip file created during the backup process is accessible.

  2. Log in as root.

  3. Change to the /opt/novell/devman/bin directory.

  4. Run the following command:

    ./amrestore.sh

  5. Specify the Access Manager administration user ID and password.

  6. Specify the name of the backup file. Do not include the .zip extension.

  7. Specify the private key encryption password, then press Enter.

    Confirm the private key encryption password, then press Enter.

  8. For the Identity Server, complete the following steps after the restore process is completed:

    1. Remove the Identity Server from the cluster configuration. See Removing a Server from a Cluster Configuration.

    2. Delete the Identity Server from the Administration Console. (See Managing a Cluster of the Identity Servers.)

    3. Uninstall the Identity Server. (See Uninstalling the Identity Server in the NetIQ Access Manager 4.2 Installation and Upgrade Guide.

      This is required if the Identity Server is installed on the machine. If you installed the Identity Server before running the amrestore.sh script, you need to uninstall the Identity Server.

    4. Install the Identity Server. (See Installing the Identity Server on Windows in the NetIQ Access Manager 4.2 Installation and Upgrade Guide.

    5. If you have customized login pages, error pages, messages, or configuration files, copy these files to the Identity Server.

    6. Reassign the Identity Server to the cluster configuration that it was removed from. (See Assigning an Identity Server to a Cluster Configuration.)

    7. Update the Identity Server.

  9. (Conditional) If any devices report certificate errors, you need to re-push the certificates.

    1. Click Troubleshooting > Certificates.

    2. Select the store that is reporting errors, then click Re-push certificates.

      You can select multiple stores at the same time.

    3. (Optional) To verify that the re-push of the certificates was successful, click Security > Command Status.

Windows

To perform a restore when an Administration Console and an Identity Server are installed on the same machine:

  1. Log in to as an administrator user.

  2. Run the Access Manager restore utility.

    1. From a command line, change to the utility directory:

      Windows Server 2012: \Program Files (x86)\Novell\bin directory.

    2. Specify amrestore.bat.

    3. Answer the prompts.

  3. Remove the Identity Server from the cluster configuration. (See Removing a Server from a Cluster Configuration.)

  4. Delete the Identity Server from the Administration Console. (See Managing a Cluster of the Identity Servers.)

  5. Install the Identity Server on the Administration Console. (See Installing the Identity Server on Windows in the NetIQ Access Manager 4.2 Installation and Upgrade Guide.

  6. If you have customized login pages, error pages, messages, or configuration files, copy these files to the Identity Server.

  7. Reassign the Identity Server to the cluster configuration that it was removed from. (See Assigning an Identity Server to a Cluster Configuration.)

  8. Update the Identity Server.