2.5 Updating the Identity Manager Components on Windows

This service pack includes a Identity_Manager_4.8.2_Windows.iso file for updating the Identity Manager components on Windows platforms.

NOTE:If Identity Manager Engine is installed on the same server as Identity Applications or Identity Reporting, then the Identity Applications or the Identity Reporting update process will restart the Identity Vault (eDirectory) service.

2.5.1 Updating the Identity Vault

  1. Download and mount the Identity_Manager_4.8.2_Windows.iso file.

  2. Navigate to the <ISO mounted location>\IdentityManagerServer\eDirectory directory and run the eDirectory_923_Windows_x86_64.exe file.

    NOTE:The Identity Vault update process restarts the Identity Vault (eDirectory) server.

    Tree Name

    Verify the tree name for Identity Vault.

    Server FDN

    Verify the server FDN.

    Tree Admin

    Specify an administrator name for Identity Vault in NCP or dot format.

    Admin Password

    Specify the administrator password.

  3. In the Install Location field, verify the location where Identity Vault is installed.

  4. In the DIB Location field, verify the location where the DIB files are located.

  5. Select the NICI check box.

  6. Click Upgrade.

2.5.2 Updating the Identity Manager Server Components

This section describes how to update Identity Manager Server Components:

  1. Download and mount the Identity_Manager_4.8.2_Windows.iso file from the download site.

  2. Stop the Identity Vault and Remote Loader instances.

    (Conditonal) This step is applicable only if you are upgrading Remote Loader.

    1. Stop all Remote Loader instances.

    2. Close Remote Loader console.

    3. Stop all drivers.

    4. Stop the Identity Vault.

  3. Update the components using the interactive or silent mode:.

    • Interactive: Perform the following steps to upgrade Identity Manager Server components using interactive mode:

      1. Navigate to the <ISO mounted location>\IdentityManagerServer directory.

      2. Run install.exe file.

      3. Select the component that you want to update from the list and click Next.

        To update the Identity Manager Engine, select Identity Manager Engine.

        To update the 32-bit Remote Loader, select 32-Bit Remote Loader Service.

        To update the 64-bit Remote Loader, select 64-Bit Remote Loader Service.

        To update the .NET Remote Loader, select .NET Remote Loader Service.

        To update the Fanout Agent, select Fanout Agent.

        To update the iManager, select iManager.

      4. In the Pre-Installation Summary page click Install.

    • Silent: Perform the following steps to upgrade the Identity Manager Server components using silent mode:

      1. Navigate to the <ISO mounted location>\IdentityManagerServer\response-file directory.

      2. Copy the install.properties file to a different location.

      3. Edit the install.properties file and set the value of the components as appropriate.

        To update Identity Manager Engine, set the value of NETIQ_UPGRADE_ENGINE to True.

        To update the Remote Loader (root and non-root), set the value of NETIQ_UPGRADE_REMOTE_LOADER to True.

        To update the 32-bit Remote Loader, set the value of NETIQ_UPGRADE_REMOTE_LOADER_32 to True.

        To update the 64-bit Remote Loader, set the value of NETIQ_UPGRADE_REMOTE_LOADER_64 to True.

        To update the Fanout Agent, set the value of NETIQ_UPGRADE_FANOUT_AGENT to True.

        To update the iManager, set the value of NETIQ_UPGRADE_iManager to True.

      4. In the command prompt, run the following command:

        install.exe -i silent -f <absolute path of install.properties>

2.5.3 Updating the Identity Applications

(Conditional) Delete or take a back-up of the existing logs from the <install_directory>\IDM\apps\tomcat\logs directory.

  1. Download and mount the Identity_Manager_4.8.2_Windows.iso file from the download site.

  2. Navigate to the <ISO mounted location>\IdentityApplications directory.

  3. Perform one of the following actions:

    GUI: install.exe

    Silent: In the command prompt, go to the <ISO mounted location>\IdentityApplications location and run install.exe -i silent

    The Identity Applications update program will update User Application, OSP, SSPR, Tomcat, and JRE.

  4. For GUI, on the Introduction page, click Next.

  5. Review the Deployed Applications page, then click Next.

    This page lists the currently installed components with their versions.

  6. On the Available Patches page, click Next.

    This page lists the available updates for the installed components.

  7. Review the required disk space and available disk space for installation in the Pre-Install Summary page, then click Install.

    The installation process might take some time to complete.

    Before applying the service pack, the installation process automatically stops the Tomcat service.

    The process also creates a back-up of the current configuration for the installed components.

    In case, the installation reports any warnings or errors, see the logs from the Service Pack Installation/Logs directory.

    For example, C:\NetIQ\IDM\apps\Identity_Apps_4.8.2.0_Install\Logs. You must fix the issues and manually restart the Tomcat service.

  8. Start the Tomcat service.

  9. (Optional) To verify that the service pack has been successfully applied, launch the upgraded components and check the component versions.

  10. Clear your browser cache before accessing Identity Applications.

NOTE:To modify any settings in the configuration update utility, launch configupdate.bat from the <install_directory>\IDM\apps\configupdate directory.

2.5.4 Updating Identity Reporting

(Conditional) Delete or take a back-up of the existing logs from the <install_directory>\IDM\apps\tomcat\logs directory.

  1. Download and mount the Identity_Manager_4.8.2_Windows.iso file.

  2. Navigate to the <ISO mounted location>\IdentityReporting directory.

  3. Perform following steps:

    Silent: In the command prompt, go to the <ISO mounted location>\IdentityReporting location and run install.exe -i silent

    GUI: In the IdentityReporting directory, double-click on install.exe

  4. For GUI, on the Introduction page, click Next.

  5. Review the Deployed Applications page, then click Next.

    This page lists the currently installed components with their versions.

  6. On the Available Updates page, click Next.

    This page lists the available updates for the installed components.

  7. On the Pre-Installation Summary page, click Install.

  8. Start the Tomcat service.

  9. Clear your browser cache before accessing Identity Reporting.

NOTE:To modify any settings in the configuration update utility, launch configupdate.bat from the <install_directory>\IDM\apps\configupdate directory.

2.5.5 Post-Update Tasks

Perform the following actions after applying this service pack.

Extending the Identity Vault Schema

(Conditional) This section does not apply if you have already upgraded to 4.8.1 and extended the Identity Vault Schema.

This section applies if you want to extend the Identity Vault schema for the Resource Weightage feature.

To extend the Identity Vault schema, perform the following steps:

  1. Log in to the server where you want to extend the Identity Vault schema.

  2. Create a new file in your preferred directory.

    For example, create nrf-extensions.sch file in the C:\Temp directory.

  3. Open the nrf-extensions.sch file and add the following content:

    --
-- The nrfResourceWeightage attribute contained by nrfResource object class specifies the weightage of
-- resource object which is used for assignment/revocation based on priority
--
NDSSchemaExtensions DEFINITIONS ::=
BEGIN
"nrfResourceWeightage" ATTRIBUTE ::=
{
                Operation                           ADD,
                Flags                                      {DS_SYNC_IMMEDIATE, DS_SINGLE_VALUED_ATTR},
                SyntaxID                              SYN_INTEGER,                
                ASN1ObjID                         {2 16 840 1 113719 1 33 4 174}
}


"nrfResource" OBJECT-CLASS ::=
{
    Operation   MODIFY,
    MayContain  {"nrfResourceWeightage"}
}
END

  4. Navigate to the C:\NetIQ\eDirectory\ directory.

  5. Run the following command to extend the schema:

    ice -l <schema_update_log> -C -a -S SCH -f <file that you created in step 2> -D LDAP -s <eDirectory DNS name/IP> -p <LDAP port> -d <eDirectory_admin_dn> -w <eDirectory_admin_password>

    where,

    -C -a updates the destination schema.

    -f indicates the schema file (sch).

    -p indicates the port number of the LDAP server. The default port is 389. For secure communication, use port 636. Secure communication needs an SSL Certificate.

    -L indicates a file in DER format containing a server key used for SSL authentication.

    -s indicates the DNS name or IP address of the LDAP server.

    For example,

    ice -l schemaupdate.log -C -a -S SCH -f C:\Temp\nrf-extensions.sch -D LDAP -s idmorg.com -p 636 -d cn=admin,ou=idm,o=microfocus -w password -L cert.der

  6. Update the Role and Resource Service Driver to 4.8.2. For more information, refer to the section Update Driver Packages.

  7. Restart the Identity Vault.

Update Driver Packages

NOTE:Before updating driver packages to 4.8.2, ensure that you have the Identity Applications latest version.

Once the Identity Application is updated to latest version, you can now update Role and Resource Service Driver (RRSD) to 4.8.2. For more information on updating RRSD, see NetIQ Identity Manager Role and Resource Service Driver 4.8.2 Readme.

2.5.6 Updating the PostgreSQL Database

(Conditional) This service pack has the same version of PostgreSQL as in Identity Manager 4.8.1. You can skip updating PostgreSQL if version 12.2 is already installed.

IMPORTANT:In addition to the default capabilities offered by PostgreSQL 12.2, this service pack allows you to configure the PostgreSQL database with SSL (OpenSSL 1.0.2u built with FIPS) and without zlib. This service pack also bundles the PostgreSQL Contrib packages.

  1. Stop and disable the PostgreSQL service running on your server.

  2. Rename the postgres directory from C:\Netiq\IDM\apps.

    For example, rename postgres to postgressql_old.

  3. Remove the old PostgreSQL service by running the following command:

    sc delete <"postgres_service_name">

    For example, sc delete "NetIQ PostgreSQL"

  4. Download and mount the Identity_Manager_4.8.2_Windows.iso file.

  5. Navigate to the <ISO mounted location>\common\postgres directory and run the NetIQ_PostgreSQL.exe file. Select only PostgreSQL option during installation.

    NOTE:

    • Do not provide any database details in PostgreSQL details page. Ensure that Create database login account and Create empty database options are unchecked.

    • Ensure that you have Administrator privilege for the old and new PostgreSQL installation directories.

  6. Stop the newly installed PostgreSQL service (NetIQ PostgreSQL).

    Go to Services, search for <PostgreSQL version number> service, and stop the service.

    NOTE:Appropriate users can perform stop operations after providing valid authentication.

  7. Change the permissions for the newly installed PostgreSQL directory by performing the following actions:

    (Optional) If postgres user is not created, then perform the following steps to create a postgres user:

    1. Go to Control Panel > User Accounts > User Accounts > Manage Accounts.

    2. Click Add a user account.

    3. In the Add a User page, specify postgres as the user name and provide a password for the user.

    Provide permissions to postgres user to the existing and newly installed PostgreSQL directories:

    1. Right click the PostgreSQL directory and go to Properties > Security > Edit.

    2. Select Full Control for the user to provide complete permissions.

    3. Click Apply.

  8. Access the PostgreSQL directory as postgres user.

    1. Login to the server as postgres user.

      Before logging in, make sure that postgres can connect to the Windows server by verifying if a remote connection is allowed for this user.

    2. Delete the data directory from the new postgres install location.

      For example, C:\NetIQ\IDM\apps\postgres\data.

    3. Open a command prompt and set PGPASSWORD by using the following command:

      set PGPASSWORD=<your pg password>

    4. Change to the newly installed PostgreSQL directory.

      For example, C:\netiq\IDM\apps\postgresql\bin.

    5. Based on the encoding type that is set for the database, execute the following initdb commands as a postgres user from the bin directory.

      If the encoding type is set to UTF8, run the following command:

      initdb.exe -D <new_data_directory> -E <Encoding> UTF8 -U postgres

      For example, initdb.exe -D C:\NetIQ\IDM\apps\postgres\data -E UTF8 -U postgres

      If the encoding type is set to WIN1252, run the following command:

      initdb.exe -D <new_data_directory> -E <Encoding> WIN1252 -U postgres

      For example, initdb.exe -D C:\NetIQ\IDM\apps\postgres\data -E WIN1252 -U postgres

  9. Upgrade PostgreSQL from new PostgreSQL bin directory. Run the following command and click Enter:

    pg_upgrade.exe --old-datadir "C:\NetIQ\IDM\apps\postgres9.6.12\data" --new-datadir

    "C:\NetIQ\IDM\apps\postgres\data" --old-bindir

    "C:\NetIQ\IDM\apps\postgres9.6.12\bin" --new-bindir

    "C:\NetIQ\IDM\apps\postgres\bin"

    NOTE:

    • C:\NetIQ\IDM\apps\postgres9.6.12 refers to the postgressql_old directory created in step 2.

    • Ensure that you set the Method type from md5 to trust in the pg_hba.conf file for both old and new postgres directories (path: C:\NetIQ\idm\apps\postgres\data\ directory).

    • Change the old PostgreSQL directory according to the folder name.

  10. After successful upgrade, replace the pg_hba.conf and postgresql.conf files from the old postgres data directory to the new postgres data directory (C:\NetIQ\IDM\apps\postgres\data).

  11. Start the upgraded PostgreSQL database service.

    Go to Services, search for <PostgreSQL version number> service, that is NetIQ PostgreSQL and start the service.

    NOTE:Appropriate users can perform start operations after providing valid authentication.

  12. (Optional) Delete the old data files from the bin directory of the newly installed PostgreSQL service to ensure that the service does not start automatically.

    1. Log in as postgres user.

    2. Navigate to the bin directory and run analyze_new_cluster.bat and delete_old_cluster.bat files.

      For example,C:\NetIQ\IDM\apps\postgres\bin