Review the following considerations before beginning to upgrade the Identity Manager components:
You can upgrade the components only in the console mode. Silent upgrade is not supported.
You must upgrade one component at a time.
Identity Vault must be separately upgraded. This version supports eDirectory 9.2.8 and later.
If Identity Vault is configured on BTRFS file system, the upgrade process will not succeed. This version supports only Ext3, Ext4, and XFS file systems.
Ensure that there are no events in the cache file before you begin upgrading Identity Manager Engine. If your driver is using MapDB, ensure that your upgraded driver works correctly with the upgraded Engine. For more information, see Working with MapDB 3.0.9.
You must review the recommended server setup before upgrading the components. Identity Manager mandates that Identity Applications and OSP are installed on the same computer. However, Identity Reporting supports a locally or a remotely installed OSP.
Ensure that the Identity Applications, Identity Reporting, and the databases are uniformly configured with FQDN.
If you are using a supported version of Oracle or Microsoft SQL Server database, you must configure two database instances for Identity Applications to work correctly; Identity Applications (idmuserappdb) database and the Workflow (igaworkflowdb) database. Ensure that you configure the database instances on the same server.
If you are using NAM Reverse Proxy configuration with Identity Applications to load forms, you must utilize NAM 5.x version.
Starting with Identity Manager 4.9, the support for NetIQ SecretStore has been deprecated. After you upgrade to the latest UAD package and restart Tomcat, all existing email account passwords in the NetIQ SecretStore repository will automatically migrate to the notfSMTPMailPassword attribute. This password migration process is controlled by the com.netiq.idm.migrate.secretstore property, which is available in the ism-configuration.properties file. By default, this property is set to true. After the migration is complete, the property will automatically set back to false and will remain in this state.
The following considerations apply to Self Service Password Reset (SSPR):
If auditing is enabled on SSPR server with Syslog output format type as CEF, then you must uninstall the NetIQ Self Service Password Reset Collector from Sentinel Syslog server, else the Syslog server will not be able to parse the SSPR audit events.
SSPR supports both CEF and JSON output format type for auditing events. SSPR 4.7.0.1 will continue to support NetIQ Self Service Password Reset Collector for JSON output format type. If there are more than one SSPR servers connected to a single Sentinel Syslog server, then you must select only one format type for auditing events across all servers.
If SSPR is installed on a separate server, upgrade the component to latest version bundled in Identity Manager 4.9.
After you update Identity Manager to 4.9 version, SSPR is upgraded to 4.7.0.1 version which requires Universal CEF Collector for collecting auditing events in CEF format type.
NOTE:If you are enabling the SSPR auditing in CEF output format type for the first time, ensure that the NetIQ Self Service Password Reset Collector is not configured on the Sentinel Syslog server.