IMPORTANT:Check the currently installed OpenText and Third Party applications to determine if OpenText eDirectory 9.3 is supported before upgrading your existing eDirectory environment. You can find out the current status for OpenText products in the TID 7003446 It is also highly recommended to back up OpenText eDirectory prior to any upgrades.
Because NTFS provides a safer transaction process than a FAT file system provides, you can install OpenText eDirectory only on an NTFS partition. Therefore, if you have only FAT file systems, do one of the following:
Create a new partition and format it as NTFS.
Use Disk Administrator. Refer to the Windows Server documentation for more information.
Convert an existing FAT file system to NTFS, using the CONVERT command.
Refer to the Windows Server documentation for more information.
If your server only has a FAT file system and you forget or overlook this process, the installation program prompts you to provide an NTFS partition.
(Conditional) NICI 3.3 and OpenText eDirectory 9.3 support key sizes up to 8192 bits for RSA encryption. If you want to use a 8K key size, every server must be upgraded to OpenText eDirectory 9.3. In addition, every workstation using the management utilities, for example, Identity Console, must have NICI 3.3 installed on it.
When you upgrade your Certificate Authority (CA) server to OpenText eDirectory 9.3, the key size will not change but will still be 2K. The only way to create a 8K key size is recreate the CA on an OpenText eDirectory 9.3 server. In addition, you would have to change the default from 2K to 8K for the key size, during the CA creation.
NOTE:The Windows Silent installer requires NICI 3.3 installed on the system.
Ensure to obtain 168-bit 3DES tree key for your OpenText eDirectory servers.
If you are upgrading to OpenText eDirectory 9.3, make sure you have the latest OpenText eDirectory patches installed on all non OpenText eDirectory 9.3 servers in the tree. You can get OpenText eDirectory patches from the OpenText Support Web site.
.NET Management Framework 4.0 or above is required.
Make sure you have the latest Windows Server Service Packs installed. The latest updated Windows Server Service Pack needs to be installed after the installation of the Windows SNMP service.
If you are upgrading from a previous version of OpenText eDirectory, it must be eDirectory 9.3.0 or later. For more information on determining the eDirectory version, see Determining the version of OpenText eDirectory.
(Conditional) If you are installing a secondary server into an existing tree as a non-administrator OpenText eDirectory user, ensure that you have the following rights:
Supervisor rights to the container the server is being installed into.
Supervisor rights to the partition where you want to add the server.
NOTE:This is required for adding the replica when the replica count is less than 3.
All Attributes rights: read, compare, and write rights over the W0.KAP.Security object and W1.KAP.Security object.
Entry rights: browse rights over Security container object.
All Attributes rights: read and compare rights over Security container object.
(Conditional) If the W1.KAP.Security object exists, all attributes rights: read, compare, and write rights over this object. For more information about the W1.KAP.Security object, see Creating an AES 256-Bit Tree Key in the NICI Administration Guide.
(Conditional) If you are installing a secondary server into an existing tree as a non-administrator user, ensure that at least one of the servers in the tree has the same or higher OpenText eDirectory version as that of the secondary being added as container admin. In case the secondary being added is of later version, then the schema needs to be extended by the admin of the tree before adding the secondary using container admin.
While configuring eDirectory, you must enable SLP services and an NCP port (the default is 524) in the firewall to allow the secondary server addition. The NCP port must be configured to allow both inbound and outbound traffic.
Additionally, you can enable the following service ports, based on your requirements:
LDAP clear text - 389
LDAP secured - 636
HTTP clear text - 8028
HTTP secured - 8030
If you have enabled user-defined ports, you must specify these ports while configuring OpenText eDirectory.
If you are installing OpenText eDirectory on a virtual machine having a DHCP address or on a physical or virtual machine in which SLP is not broadcast, ensure that the Directory Agent is configured in your network.
If you do not have the latest Platform Agent (PA) installed while upgrading to OpenText eDirectory 9.3, please run the Novell_Audit_PlatformAgent_Win64.exe file from the <C:\NetIQ\eDirectory\auditds/ location to install.
The OpenText eDirectory Management Toolbox (eMBox) lets you access all of the OpenText eDirectory back-end utilities remotely, as well as on the server. The command line client is a Java application. To run it, you must install the latest version of Oracle or Azul Java (1.8 or above). You must also ensure to upgrade any older version of Java by installing the patch upgrades available. Once you have the latest version of Java installed, export any of the following environment variables:
EDIR_JAVA_HOME
JAVA_HOME
JRE_HOME
NOTE:
If you are using any prior version of OpenText eDirectory 9.0 SP4, to run the command line client, you must have access to the Java Runtime Environment.
Installing Identity Manager 4.8.7 will upgrade Java dependent packages in OpenText eDirectory from JRE 8 to JRE 11.
To determine the version of OpenText eDirectory, follow one of the steps mentioned below:
Run iMonitor.
On the Agent Summary page, click Known Servers. Then under Servers Known to Database, click Known Servers. The Agent Revision column displays the internal build number for each server. For example, an Agent Revision number for eDirectory 9.3 might be 40301.00.
For information on running OpenText iMonitor, see Accessing OpenText iMonitor
in the OpenText™ eDirectory CE 24.4 (v9.3) Administration Guide.
Run NDSCons.exe.
In the Windows Control Panel, double-click OpenText eDirectory Services. In the Services column, select ds.dlm, then click Configure. The Agent tabs displays both the marketing string (for example, OpenText eDirectory 9.3) and the internal build number (for example, 40301.00).
View the properties of an ds.dlm file.
Right-click the .dlm file in Windows Explorer, then click the Version tab in the Properties dialog box. This will display the version number of the utility. The default location for ds.dlm files is C:\NetIQ\eDirectory.
Static IP address must be configured on the server for the OpenText eDirectory to perform efficiently. Configuring eDirectory on the servers with DHCP address can lead to unpredictable results.