Access Manager prior to 3.1 SP2 should be first upgraded to 3.1 SP2 before upgrading to 3.1 SP3. For more information on upgrading to 3.1 SP2, see Upgrading from Access Manager 3.1 to 3.1 SP2 and Upgrading from Access Manager 3.1 SP1 to 3.1 SP2 in the Novell Access Manager 3.1 SP2 Installation Guide. For upgrading Access Manager SP2 to 3.1 SP3, you need to upgrade the components in the following order:
Administration Console
Identity Servers
Access Gateways
SSL VPN Servers
IMPORTANT:The J2EE agents upgrade is not supported.
While you are upgrading the components, be aware of the following:
You should not use any of the new SP3 features until all of your components are upgraded to SP3. For example, the IDP SP Brokering functionality, which has been introduced in Access Manager SP3.
You must upgrade the components to 3.1 SP3 before you can migrate the components to a new operating system. See Section 9.3, Migrating to Newer Operating Systems.
Back up the customized Tomcat files on your Access Manager components.
If you have customized the tomcat5.conf file or the server.xml file, back up these files before upgrading. These files are overwritten during the upgrade process.
If you are upgrading from Access Manager 3.1 SP2 and you have configured the Identity Server to send attributes to the Access Gateway, decide on an upgrade strategy for a potential issue.
If any of the attributes you are sending have empty values, users cannot authenticate until you have upgraded all your Identity Servers and Access Gateways to SP3 or you have disabled the sending of attributes until you have upgraded all components. For more information about this issue, see TID 7005475.
After you upgrade all the Access Gateway Appliances, you need to make a configuration change, then update the Access Gateways before using the features for SP3.
(Conditional) The location of the keystores on the Administration Console for the Embedded Service Provider of the Access Gateway Appliance changed in Access Manager 3.0.1. If you installed the Access Gateway Appliance with Access Manager 3.0 and upgraded it to 3.1 SP3, the keystores are in the old location. The SLES 9 Access Gateway Appliance works with the keystores in either the old or the new location. However, when you migrate your SLES 9 Access Gateway Appliances to SLES 11, the SLES 11 Access Gateway Appliance ceases to function because it cannot find the Embedded Service Provider keystores. The upgrade script automatically cleans up the keystores for you. After the upgrade, the keystores are in the new location.