Avaya Identity Engines Release Notes Software Release 9.0

Transcription

1 Avaya Identity Engines Release Ntes Sftware Release Release Summary Dcument Versin: v1.0 Dcument Date: March 2014 Purpse: Identity Engines (IDE) sftware majr release t intrduce new Features, Enhancements, and t address custmer fund sftware issues. 2. Imprtant Ntes befre Installing this Release Avaya prvides the Identity Engines Ignitin Server as a cmplete Virtual Appliance. D nt install r uninstall any sftware cmpnents n this Virtual Appliance unless Avaya specifically prvides the sftware and/r instructs yu t d s. D nt mdify the cnfiguratin r the prperties f any sftware cmpnents f the Ignitin Server VM (including VMware Tls) unless Avaya dcumentatin and/r persnnel specifically instruct yu t d s. Avaya des nt supprt any deviatin frm these guidelines. Avaya des nt supprt upgrading the VMware Tls in the Ignitin Server VMware VM. If yu have already updated the VMware tls r unsure, stp the prcess and fllw the prcedure given belw. Take a backup f cnfiguratin frm yur existing VM Deply a fresh new Ignitin Server using the OVA supplied by Avaya Install the necessary licenses. Yu may need t btain new licenses in case yu have created a new instance f the Ignitin Server(s). Restre the cnfiguratin Identity Engines Sftware Upgrade Requirements Identity Engines release requires deplyment f a fresh new Ignitin Server OVA. Upgrade frm release 8.0.x t is nt available as the hardware system requirements fr release have changed cmpared t previus release(s). If yu are running release 8.0.x and wuld like t migrate t 9.0, take a cnfiguratin backup frm 8.0.x, deply a new 9.0 VM and perfrm a cnfiguratin restre n the VM. Yu will have t btain new licenses fr release Saved Cnfiguratin File Cmpatibility In rder t maximize cnfiguratin cmpatibility during upgrade, Identity Engines Ignitin Server release 9.0des nt supprt perfrming cnfiguratin restre frm release prir t 8.0.x. 3. Platfrms Supprted Avaya Inc. Issue (March 2014) Page 1 f 13

2 VMware vsphere versin 5.0 VMware vsphere versin 5.1 IMPORTANT NOTE: Nte that VMware vmtin, VMware Player and VMware Wrkstatin are nt supprted and cannt be used in cnjunctin with the Ignitin Server. 4. Installatin File Names fr Identity Engines Release 9.0 File Name Mdule r File Type Cmments AIEIS_RHEL_6_3_LINUX- VM_09_00_00_025816_x86_64.va GuestManagerInstaller exe DashbardInstaller exe SSOServicePrviderAgent zip SSOServicePrviderAgent tar.gz Ignitin Server OVA files fr vsphere 5.x envirnment Guest Manager Installer Dashbard Installer Service Prvider Agent Package Ignitin Server Release 9.0. Used fr fresh install f Ignitin Server. N upgrade package available. Bug Fixes and cmpatibility with Ignitin Server Release 9.0 Dashbard Installer Release 9.0 cmpatible with Ignitin Server Release 9.0 Service Prvider applicatin and cnfiguratin utility fr Identity Engines Webbased SSO File Names f Identity Engines Release 8.x that are cmpatible fr deplyment in cnjunctin with Identity Engines Release File Name Mdule r File Type Cmments AdminCnsleInstaller exe AccessPrtal_ _022931_x86_32.mf AccessPrtal_ _022931_x86_32.vf AccessPrtal_ _022931_x86_32.vmdk CASE Manager Installer Access Prtal OVF files fr vsphere 4.x and 5.x CASE Manager release 1.0 is cmpatible with Ignitin Server Release 9.0 Access Prtal Release 1.0 is cmpatible with Ignitin Server Release 9.0 System Requirements Sftware System Requirements Cmments Ignitin Server VMware ESXi versins 5.0 r 5.1 Installatin n a VMware ESXi server is dne using an OVA file which already incrprates the OS Red Hat Enterprise Linux. The VM requires a x86_64 capable envirnment Minimum 4 CPUs Minimum 4 GB f memry Minimum 260 GB available disk strage (thin prvisining is allwed) Minimum 1 physical NIC (preferably 3 NICs) Avaya Inc. Issue (March 2014) Page 2 f 13

3 Access Prtal Ignitin Dashbard Guest Manager CASE Manager Analytics Avaya Flare Avaya System Manager Service Prvider VMware ESXi versins 4.0* r 4.1* r 5.0 r 5.1 Installatin n a VMware ESXi server is dne using an OVF file which already incrprates the OS FreeBSD. Windws XP sp3 (32 bit)** Windws 7 (32 bit r 64 bit) Windws 8 (32 bit r 64 bit) Windws Server 2003 (32 bit r 64 bit) *** Windws Server 2008 (32 bit r 64 bit) **** Windws XP sp3 (32 bit) ** Windws 7 (32 bit r 64 bit) Windws 8 (32 bit r 64 bit) Windws Server 2003 (32 bit r 64 bit) *** Windws Server 2008 (32 bit r 64 bit) **** Windws XP sp3 (32 bit)** Windws Server 2003 (32 bit) *** Windws Server 2008 (32 bit and 64 bit) **** Micrsft IE versin 6.0 r later Firefx versin 1.5 r later Windws XP sp3 (32-bit)***** Windws Server 2003 (32-bit)****** Windws Server 2008 (32-bit)******* Windws must have NTFS file system partitin Micrsft IE Brwser Firefx Brwser Avaya Flare fr ipad release 1.2 Avaya SMGR release 6.2 FP3 Apache Tmcat 6.X 3 Lgical NIC cards VMware lists n its site supprted hardware platfrms fr ESXi: The VM requires 32-bit capable envirnment Minimum 2 CPUs Minimum 2 GB f memry Minimum 10 GB available disk strage Minimum 2 physical NIC (preferably 3 NICs). VMware lists n its site supprted hardware platfrms fr ESXi: Minimum 2GB RAM memry Minimum 2GB RAM memry Minimum 2GB RAM memry Minimum CPU 2+ GHz prcessr Minimum 2GB f memry Minimum 3GB available drive strage The hard drive space requirement abve is nly fr the installed applicatin. Be sure t increase the hard drive space based n strage requirements fr data lgs and level f applicatin usage. Cmpatible with Identity Engines R9.0 SSO Cmpatible with Identity Engines R9.0 SSO Cmpatible with Identity Engines R9.0 SSO Any servlet cntainer cmpliant with the Servlet API specificatins versin 2.4 r higher will wrk, like Tmcat 6.x, JBss r Websphere Ntes fr Identity Engines OVA/OVF VMware ESXi versins * R9.0 is last release t supprt Access Prtal n ESX 4.x versins Ntes fr Dashbard/CASE Manager/Guest Manager Windws versins ** R9.0 is last release t supprt Dashbard/CASE Manager/Guest Manager n Windws XP versins *** R9.0 is last release t supprt Dashbard/CASE Manager/Guest Manager n Windws 2003 versins **** R9.0 is last release t supprt Dashbard/CASE Manager/Guest Manager n Windws bit Avaya Inc. Issue (March 2014) Page 3 f 13

4 Ntes fr Analytics Windws versins ***** IDE R9.0 is last release t supprt Analytics n Windws XP versins ****** IDE R9.0 is last release t supprt Analytics R8.0.0/8.0.1 n Windws 2003 (32-bit) ******* IDE R9.0 is last release t supprt Analytics R8.0.0/8.0.1 n Windws 2008 (32-bit) Please nte that Analytics with supprt fr current Windws versins is planned 5. Versin f Previus Releases Identity Engines Sftware Versin 8.0.2, Release Date May, Cmpatibility Identity Engines Ignitin Server Release 9.0 sftware can nly be managed with Avaya Ignitin Dashbard Release Changes in This Release New features in This Release Enterprise-Level Administratin The Enterprise Level Administratin f Identity Engines Ignitin Server ffers mre granularities in terms f the administratin. The Enterprise Administratin intrduces RBAC apprach t IDE. By assciating a rle t a user, IDE can qualify different types f administratrs and map them t the functinality that is pertinent t their administratin interest fr a given IDE instance. As f nw there is nly ne lgin accunt t the IDE. The user f this accunt is the equivalent f a super-user n Dashbard. This accunt has n restrictins with regards t cnfiguratin r mnitring f the IDE. As netwrk administratin grws in cmplexity there becmes an increasing need t limit r define the capabilities f specific types f administratrs fr an IDE Server. There are fur pre-defined rles fr Dashbard Administratin System Administratr Cnfiguratin Administratr Truble Shting Administratr Mnitring Administratr One admin can fcus n system mnitring while anther can fcus n system management (upgrading images, saving cnfiguratins, etc). This apprach creates bundaries fr administratrs t wrk autnmusly frm ne anther. It will als prevent admins frm tuching parts f the system that they may nt be truly interested in. Identity Engines Single-Sign-On (SSO) With the Single-Sign-On (SSO) feature, IDE becmes a full-fledged Identity Management System that nt nly cntrls the netwrk access fr a user but als prvides granular plicy based access cntrl t the resurces (applicatin servers) cntained within an enterprise netwrk. Prprietary identity requirements, cmplex passwrd plicies, frgtten passwrds, and high help desk csts fr passwrd resets are just a few f the sign-n challenges fr mdern enterprises. With IDE SSO architecture, enterprises can enable ubiquitus SSO fr users. This nt nly simplifies secure access, but als results in lwer peratinal csts fr enterprises, leading t strnger enterprise security. Identity Engines SSO prvides standards based SSO capabilities and allws varius applicatin servers (sites) t make infrmed authrizatin decisins fr individual access f prtected nline resurces in a privacy- preserving manner Avaya Inc. Issue (March 2014) Page 4 f 13

5 The IDE SSO architecture prvides tw SSO wrkflws t take int accunt different mdes f client access: Web-based SSO targeted fr brwser-based client access r thin clients ECP-based SSO targeted fr thick clients r intelligent clients Identity Engines SSO cnsists f the fllwing architectural cmpnents. Identity Prvider The Identity Assertin Prvider (IdP) is an authenticatin mdule that authenticates the user within a security realm and then issues a security tken, which can be used by the client t get access t prtected resurces within that security realm withut having t authenticate again. An IdP is hsted n the Ignitin Server as a licensable service. This IdP uses all f the IDE Ignitin Server s capabilities t enfrce XACML-based plicies and integratin with varius directry services. Realm Mapper In Avaya Aura envirnment, Aura lgin credentials are different frm Enterprise credentials and hence d nt directly supprt Single-Sign-On. Realm Mapper service running n the Ignitin Server prvides mapping between user s enterprise credentials and their Aura identity. Aura services first cntact the Ignitin Server Realm Mapper fr validating user s enterprise credentials and then use the respnse frm Realm Mapper t validate the Aura credentials autmatically withut the user being prmpted fr Aura credentials. Nte: In Release 9.0, Aura Flare Experience 1.2 fr ipad supprts IDE SSO capabilities. Service Prvider Service Prvider is an entity that prtects applicatin services. It intercepts access requests and redirects the user t IdP fr validating the credentials. Upn successful authenticatin, Service Prvider gets an assertin frm the IdP and then uses it t grant access t the user based n the lcal plicies. Identity Engines Release includes a Service Prvider package that can be integrated with Enterprise s web applicatins fr SSO supprt. This Service Prvider can wrk with any Web Server that cmplies t Servlet API specificatin versin 2.4 r higher, like Apache Tmcat 6.x, JBss etc. Identity Engines supprts the fllwing authenticatin methds fr Single-Sign-On: Kerbers based authenticatin using SPNEGO fr dmain jined devices Basic authenticatin Frm-based Lgin fr brwsers Nte: Kerbers based Single-Sign-On authenticatin is limited t Micrsft Active Directry envirnments in IDE Release 9.0. Licensing Requirements fr SSO feature Single-Sign-On (SSO) is a licensed feature. Users must install the Ignitin Aura SSO license (als knwn as SAML license) t enable the Identity Engines SSO feature supprt n the Ignitin Server. The Ignitin Aura SSO license requires at a minimum an Identity Engines Ignitin Server Base license f any size (fr example: Ignitin Server Base LITE, SMALL r LARGE license). A single Identity Engines Aura SSO license is required fr either a standalne deplyment f the Ignitin Server r a High Availability (HA) deplyment f a pair f Ignitin Servers. Avaya Prduct Licensing and Delivery System (PLDS) supprt Avaya Identity Engines currently supprts the KeyCde Retrieval System (KRS) based licensing mdel. Starting with Identity Engines Release 9.0, Identity Engines supprts the Avaya PLDS licensing mdel in additin t KRS Avaya Inc. Issue (March 2014) Page 5 f 13

6 The Avaya Prduct Licensing and Delivery System (Avaya PLDS) prvides custmers, Business Partners, distributrs, and Avaya Assciates with easy-t-use self-service tls fr managing asset entitlements and electrnic delivery f sftware-related licenses. Using PLDS, yu can perfrm activities such as license activatin, license de-activatin, license re-hst, and sftware dwnlads. Fr a perid f time, Identity Engines will supprt the dual licensing t accmmdate current install base custmers wh d nt have yet access t the Avaya PLDS system. Other Enhancements Identity Ruting based n Machine Names In machine authenticatin, a PC will prvide its machine name as identity. A machine name des nt include realm inf and therefre identity ruting based n realm des nt apply. In a multi-dmain envirnment, machine authenticatin has t rely n fall-thrugh mechanism t find apprpriate directry service if there are multiple directry services. Identity ruting based n machine name prvides a direct guide t the directry service that will efficiently prcess machine authenticatin. If the machine name itself is cnstructed including the machine name and the realm, Identity Engines Identity Ruting plicy can nw be cnfigured t lk fr realm infrmatin in the username attribute and rute t the apprpriate Directry service. SHA-2 based Certificates Avaya Identity Engines nw ships the default self-signed certificates based n the SHA256 signature algrithm. If the user restres 8.0.x cnfiguratin, then bth SHA128 and the new SHA256 certificates will c-exist. SHA256 bit ciphers are als added t the cipher list that can be selected in the authenticatin plicy. OPERATIONAL NOTE: Ignitin Server R9.0 has new default server certificates based n SHA256 algrithm Dashbard includes apprpriate rt CA t cnnect with the Ignitin Server Dashbard cannt build the keystre frm previus installatin if ne already exists n the PC that Dashbard is running n Take the fllwing actins and delete the keystre manually by deleting the fllwing directries Win XP -- C:\Dcuments and Settings\<user id>\applicatin Data\Avaya\security Win 7 -- C:\Users\<user id>\appdata\raming\avaya\security Win 8 -- C:\Users\<user id>\appdata\raming\avaya\security Nte that these flders may be hidden flders Hierarchical Certificates In a hierarchical certificate authrity setup, certificate issuing CAs stay nline and issue user certificate. The rt CA is kept ffline t avid cmprmise. It is als the certificate issuing CA that may revke user certificates and publish CRLs. Starting frm this release, CRL check can be perfrmed at the certificate issuing CA level as well as at the rt CA level, depending n cnfiguratin via CLI. Authrizatin Plicy based n User Certificate Attributes In TLS-based user authenticatin, the supplicant will prvide user certificate t Identity Engine. Certificate attributes such as cmmn name, lcality, rganizatin, rganizatin unit, state, cuntry cde, and culd be used in authrizatin plicy. Enhanced Grup cache supprt Fr LDAP based directry services (including Active Directry), the Ignitin Server maintains an internal cache f the grup hierarchies and attributes schemas f the directry services Avaya Inc. Issue (March 2014) Page 6 f 13

7 IDE release nw allws disabling this caching by clearing the Enable Grup Caching check bx. By default, Ignitin Server lks fr grups starting at the Directry Rt DN. This behavir can be changed by specifying Grup Search Base DNs. This is useful in case f huge AD deplyments, where starting at the rt DN can take up a substantial amunt f time. In additin the Re-sync Duratin fr the grup cache is custmizable nw. The range is between 1 t 168 hurs. The cache is autmatically refreshed based n this setting. Supprt t retain licenses acrss restre With IDE releases prir t 9.0.0, while perfrming restre f backup cnfiguratin, any licenses that users may have installed n the system will be verwritten by the licenses in the backup file. If the backup was frm anther VM, the license data in the backup will nt be applicable t this nde. After restre, user wuld have t re-install the new license. With IDE Release 9.0, users can nw chse whether t retain existing licenses during restre r verwrite the existing licenses with the data frm backup file. A new ptin License cnfiguratin is nw included in the restre dialg which will determine whether t restre the license r keep the existing licenses Prblems Reslved in This Release Wrk item Number wi wi wi / wi / wi wi wi wi Descriptin Ignitin Dashbard still shws includes DST calculatin when running in Mscw Time zne. Ignitin Dashbard 9.0 nw ships with JRE 7 update 45 which has fixes fr Mscw DST changes While installing 8.0.X dashbard n Windws 7 with UAC enabled machine, there is n lgs flder. Frm release 9.0, the Dashbard lgs flder will be created in C:\Users\<user>\AppData\Raming\Avaya\lgs\ Ignitin Dashbard flder In HA setup, multiple issues were seen in previus releases. Sme f the issues were, - Secndary nde was stuck in "Synching Cnfig while creating HA, - Failed t sync the fllwing n nde <x.x.x.x.> errr message n - Dashbard - Unable t update radius/sap/tacacs cnfiguratin errr message n Dashbard Release 9.0 nw prvides enhanced HA stability by upgrading the underlying platfrm which includes fixes t memry leaks seen during HA synchrnizatin peratins. Occasinally, disabling HA/Service prts frm Dashbard des nt update the actual physical prt status in the system crrectly. In release 9.0, event mechanism has been enhanced which nw reliably sends any cnfiguratin change event t all the listener prcess and the cnfiguratin is applied crrectly n the system. While restring large database in a HA setup, restre status n the 2nd nde may be stuck at syncing cnfig Release 9.0 nw prvides enhanced HA stability by upgrading the underlying platfrm which includes fixes t memry leaks seen during HA synchrnizatin peratins. Add display f GMT time n Dashbard nde status tab Ignitin Server always runs under GMT time zne. When the user is cnnected via Dashbard, the lgs are shwn with the time stamp cnverted t the lcal time zne. T make it mre clear t the user, Dashbard nw displays the time bth in GMT time Avaya Inc. Issue (March 2014) Page 7 f 13

8 wi wi wi wi wi wi wi wi wi zne as well as the lcal time zne n which the Dashbard is running under Cnfiguratin -> <nde> -> Status tab Add a new CLI cmmand t display the time f Ignitin Server Release 9.0 nw includes a new CLI cmmand shw time t display the current time f Ignitin Server which always runs under GMT time zne Special characters in the authrizatin plicy rule causes authenticatin failure A validatin has been added in release 9.0 which crrectly checks fr any special characters at the time f rule creatin Identity Engines admin passwrd cannt be ver 8 characters in release The maximum passwrd length has been changed t 36 characters and minimum t 5 characters in release 9.0 Add supprt fr new default vendr definitins Release 9.0 nw includes new Vendr/VSA definitins fr the fllwing vendrs: - Brcade - Aerhive Netwrks - Ruckus Wireless By default, Access Prtal MAC based authenticatin recgnized as user authenticatin Release 9.0 nw includes a new device template under Avaya->avaya-ignitin-accessprtal which has the right attribute definitins fr Access Prtal MAC authenticatin. Expired Guest Accunts with Delete upn expire setting enabled are nt cleared quickly The expired guest accunts purge interval is nw changed frm 7 days t 24 hurs in release 9.0 In large custmer deplyments with huge n. f AD grups, the grup cache peratin takes a lng time t cmplete and makes the system slw In sme custmer deplyments, they have huge n. f AD grups, but Ignitin Server desn t need t cache all the grups. Release 9.0 nw includes tw new enhancements t the grup cache behavir. - The grup cache nw be cmpletely turned ff r the cache interval can be cnfigured. - Als added a supprt t select base DN frm which the grup infrmatin is read as well as specify a grup search filter Create a Device Template n Ignitin Server fr anther Ignitin Server acting as a RADIUS Prxy In a Radius Prxy setup where Ignitin Server is acting as a frwarding prxy, it needs t be added as an authenticatr n the Remte Radius Server that may be anther Ignitin Server itself. This authenticatr can be defined with the device template as Avaya -> avaya-ignitin-server template Unreachable CRL link causes Certificate Manager t fail initialize prperly While adding a CRL, Ignitin Server will first check if the URL is reachable. If nt, adding f CRL itself will fail. Hwever, it s pssible that the CRL may becme unreachable after sme time r if the CRL infrmatin is taken frm a backup file whse link is nt available anymre. In this case, any unreachable CRL causes failure in Certificate Manager initializatin. This issue is nw fixed in release New Outstanding Issues Wrk item Number wi Descriptin When the cnnectin between Dashbard sys-admin sessin and Ignitin Server is lst, sys-admin cannt lgin t dashbard again With multi-administratrs supprt in 9.0, nly ne sys-admin user can lgin at any time. If the lgged in sys-admin has nt gracefully clsed the Dashbard sessin and the Avaya Inc. Issue (March 2014) Page 8 f 13

9 wi wi wi cnnectin between the Ignitin Server and the Dashbard sys-admin sessin is lst fr any reasn (like netwrk failure r the machine frm the Dashbard is running is shut dwn), anther sys-admin cannt lgin t the system. As a wrk arund, lgin t cnsle r pen an SSH cnnectin t Ignitin Server and run shw sessins cmmand Nte dwn the Id f the sessin entry fr sys-admin Run sessin delete id <id> t clear the stale sessin and the sys-admin can nw lgin t the Dashbard Nt able t assciate internal users with internal devices While adding internal users t the Ignitin Server, internal devices culd als be mapped t each user which can then be used in the authrizatin plicies. Hwever, this peratin althugh shws successful, the mapping is lst when we try t view the user details. As a wrk arund, the same assciatin can be mapped by assciating the internal device with the internal user. In a deplyment where Guest Manager and an Enterprise Web Server applicatin using the Identity Engines Service Prvider package fr SSO are installed n the same server, user nt able t add Guest Manager server cnfiguratin n the IDE Typically, Guest Manager applicatin which ships with its wn Tmcat Web Server will be deplyed n separate machines frm the Enterprise web applicatin servers. But if the user wants these tw applicatins t c-exist n the same Tmcat server, first deply the Guest Manager applicatin n the server and then deply yur Enterprise web applicatin and the Identity Engines Service Prvider package fr SSO next. After installing these applicatins, first cnfigure the Guest Manager server details first n the IDE and then add the Service Prvider details fr SSO. One nde IP address was truncated after breaking and creating HA multiple times frm Dashbard This issue is seen ccasinally after breaking and creating HA multiple times. This issue des nt affect any functinality. As a wrk arund, users can lgut and re-lgin t the Dashbard t fix the issue 7.3. New Knwn Limitatins Wrk item Number wi wi wi Descriptin In Frm-based SSO authenticatin where a client trying t access a prtected resurce is redirected t the Ignitin Server IdP, If IdP hstname cntains special character like underscre, IdP lgin page shws unspecified service prvider Underscre is nt cnsidered a valid character fr DNS hstname. Only fllwing characters are allwed fr DNS hstnames: Alphabets, Numeric, Hyphens IdP summary shws tw entries in HA even thugh SAML service is bund t VIP In HA, if DNS cnfiguratin is nt valid r nt reachable n either f the HA ndes, then SSO cnfiguratin will nt be valid. Nte: SSO feature requires a valid DNS cnfiguratin t be added t each IDE in HA which can then use it t reslve hstname t the interface IP address (r VIP) t which the SAML service is bund t. While restring large cnfiguratin, system takes additinal 4-5 minutes fr all the SSO services t cme up While restring large cnfig which cntains many Directry services and large grup cache infrmatin, Ignitin Server will try t establish cnnectivity with the Directry Avaya Inc. Issue (March 2014) Page 9 f 13

10 wi services fr grup cache and service accunt creatin. If any f these Directry services are unreachable, Ignitin Server will keep trying t cnnect t them until time ut. Eventually, the entire cnfiguratin will be laded and the applicatins will cme nline. Users can make use f System Health and Directry Service Status tabs until mnitr t make sure all the services are up and running After sessin timeut triggers frm Dashbard, sessin is nt cleared frm Ignitin Server side immediately. It will take 30sec t 1 minute t clear Each Dashbard cnnectin will have a sessin time ut after which the sessin is autmatically discnnected. Thugh the sessin is clsed frm the Dashbard, it ll take secnds fr the sessin t be cleared frm the Ignitin Server side. If any user tries t lgin within this shrt interval (30-60 secnds), the lgin will nt be allwed with an errr saying sessin already exists. Ignitin Server sessin cleanup prcess runs every 60 secnds t clear any timed ut sessins. 8. Upgrade prcedure Pre-upgrade Checklist fr Ignitin Server Nte that by design, users cannt upgrade an existing 8.0.x r earlier VM t VM using sftware upgrade prcedure Alternatively, existing cnfiguratin can be migrated t 9.0 using the backup & restre functinality. Restre f cnfiguratin data n release can nly be perfrmed frm the fllwing versins: Backup f 8.0.x cnfiguratin data If yu re running versin lder than 8.0.x and wuld like t upgrade t release, first perfrm an incremental upgrade t 8.0.x release and then use backup & restre functinality t migrate yur existing cnfiguratin t VM Please cntact Avaya supprt if yu will need temprary licenses fr IDE 8.0 fr this prcess f incremental migratin f yur cnfiguratin t IDE release IDE Release als includes a new Dashbard installer that must be installed. Ignitin Server cannt be managed frm any previus versins f Dashbard IDE Release includes new SHA256 based default certificates. If yu re installing the new Dashbard ver an existing Dashbard, yu ll ntice SSL validatin errrs that culd cause cnnectivity issues with the Ignitin Server. Dashbard keeps the cached keystre f these certificates at fllwing lcatins: Win XP C:\Dcuments and Settings\<user id>\applicatin Data\Avaya\security Win 7 C:\Users\<user id>\appdata\raming\avaya\security Win 8 C:\Users\<user id>\appdata\raming\avaya\security Delete these directries frm yur system befre launching the new Dashbard Nte that these flders may be hidden flders Avaya Inc. Issue (March 2014) Page 10 f 13

11 IDE Release als includes a new Guest Manager installer and must be installed. Ignitin Server Release is nt cmpatible with any previus versins f Guest Manager If yu re installing the new Guest Manager Release ver an existing Guest Manager, yu ll ntice SSL validatin errrs that culd cause cnnectivity issues with the Ignitin Server. Guest Manager keeps the cached keystre f this certificate and it cannt build a new keystre if ne already exists frm previus installatin. Delete the keystre manually by deleting the fllwing under Tmcat cnfiguratin: C:\Prgram Files\Apache Sftware Fundatin\Tmcat 6.0\cnf/idEngines\gm_ks N new upgrade sftware packages available fr Access Prtal, CASE Manager and Analytics applicatins. Existing 8.0.x release sftware cntinues t be cmpatible with release fr these applicatins. Users shuld never update VMware Tls r mdify the cnfiguratin r the prperties f Avaya prvided Virtual Appliances which include Ignitin Server. Avaya des nt supprt upgrading f VMware tls r any ther sftware cmpnents unless the upgrade package is prvided by Avaya. If yu have already updated VMware tls r unsure, stp the upgrade and fllw the prcedure given belw. Take a backup/snapsht f cnfiguratin frm yur existing VM s Deply a new Ignitin Server using the OVA Restre the cnfiguratin Install the necessary licenses Sftware Upgrade Prcedure There s n sftware upgrade f 8.0.x VM t release. If yu re running an existing 8.0.x deplyment and wuld like t migrate t release, fllw the instructins given belw: Take a backup f the plicy cnfiguratin data f yur 8.0.x VM Deply a new Ignitin Server 9.0 VM using the OVF Perfrm cnfiguratin restre f 8.0.x backup n the VM Obtain and install necessary 9.0 licenses 9. Dcumentatin Fr latest dcumentatin and fr details n ther knwn issues, please dwnlad the prduct dcumentatin available frm the Avaya Technical Supprt web site at: Avaya Inc. All Rights Reserved Avaya Inc. Issue (March 2014) Page 11 f 13

12 Ntice While reasnable effrts have been made t ensure that the infrmatin in this dcument is cmplete and accurate at the time f printing, Avaya assumes n liability fr any errrs. Avaya reserves the right t make changes and crrectins t the infrmatin in this dcument withut the bligatin t ntify any persn r rganizatin f such changes. Dcumentatin disclaimer Avaya shall nt be respnsible fr any mdificatins, additins, r deletins t the riginal published versin f this dcumentatin unless such mdificatins, additins, r deletins were perfrmed by Avaya. End User agree t indemnify and hld harmless Avaya, Avaya s agents, servants and emplyees against all claims, lawsuits, demands and judgments arising ut f, r in cnnectin with, subsequent mdificatins, additins r deletins t this dcumentatin, t the extent made by End User. Link disclaimer Avaya is nt respnsible fr the cntents r reliability f any linked Web sites referenced within this site r dcumentatin(s) prvided by Avaya. Avaya is nt respnsible fr the accuracy f any infrmatin, statement r cntent prvided n these sites and des nt necessarily endrse the prducts, services, r infrmatin described r ffered within them. Avaya des nt guarantee that these links will wrk all the time and has n cntrl ver the availability f the linked pages. Warranty Avaya prvides a limited warranty n this prduct. Refer t yur sales agreement t establish the terms f the limited warranty. In additin, Avaya s standard warranty language, as well as infrmatin regarding supprt fr this prduct, while under warranty, is available t Avaya custmers and ther parties thrugh the Avaya Supprt Web site: Please nte that if yu acquired the prduct frm an authrized reseller, the warranty is prvided t yu by said reseller and nt by Avaya. Licenses THE SOFTWARE LICENSE TERMS AVAILABLE ON THE AVAYA WEBSITE, ARE APPLICABLE TO ANYONE WHO DOWNLOADS, USES AND/OR INSTALLS AVAYA SOFTWARE, PURCHASED FROM AVAYA INC., ANY AVAYA AFFILIATE, OR AN AUTHORIZED AVAYA RESELLER (AS APPLICABLE) UNDER A COMMERCIAL AGREEMENT WITH AVAYA OR AN AUTHORIZED AVAYA RESELLER. UNLESS OTHERWISE AGREED TO BY AVAYA IN WRITING, AVAYA DOES NOT EXTEND THIS LICENSE IF THE SOFTWARE WAS OBTAINED FROM ANYONE OTHER THAN AVAYA, AN AVAYA AFFILIATE OR AN AVAYA AUTHORIZED RESELLER, AND AVAYA RESERVES THE RIGHT TO TAKE LEGAL ACTION AGAINST YOU AND ANYONE ELSE USING OR SELLING THE SOFTWARE WITHOUT A LICENSE. BY INSTALLING, DOWNLOADING OR USING THE SOFTWARE, OR AUTHORIZING OTHERS TO DO SO, YOU, ON BEHALF OF YOURSELF AND THE ENTITY FOR WHOM YOU ARE INSTALLING, DOWNLOADING OR USING THE SOFTWARE (HEREINAFTER REFERRED TO INTERCHANGEABLY AS YOU AND END USER ), AGREE TO THESE TERMS AND CONDITIONS AND CREATE A BINDING CONTRACT BETWEEN YOU AND AVAYA INC. OR THE APPLICABLE AVAYA AFFILIATE ( AVAYA ). Cpyright Except where expressly stated therwise, n use shuld be made f the Dcumentatin(s) and Prduct(s) prvided by Avaya. All cntent in this dcumentatin(s) and the prduct(s) prvided by Avaya including the selectin, arrangement and design f the cntent is wned either by Avaya r its licensrs and is prtected by cpyright and ther intellectual prperty laws including the sui generis rights relating t the prtectin f databases. Yu may nt mdify, cpy, reprduce, republish, uplad, pst, transmit r distribute in any way any cntent, in whle r in part, including any cde and sftware. Unauthrized reprductin, transmissin, disseminatin, strage, and r use withut the express written cnsent f Avaya can be a criminal, as well as a civil ffense under the applicable law. Third Party Cmpnents Certain sftware prgrams r prtins theref included in the Prduct may cntain sftware distributed under third party agreements ("Third Party Cmpnents"), which may cntain terms that expand r limit rights t use certain prtins f the Prduct ("Third Party Terms"). Infrmatin regarding distributed Linux OS surce cde (fr thse Prducts that have distributed the Linux OS surce cde), and identifying the cpyright hlders f the Third Party Cmpnents and the Third Party Terms that apply t them is available n the Avaya Supprt Web site: Trademarks The trademarks, lgs and service marks ( Marks ) displayed in this site, the dcumentatin(s) and prduct(s) prvided by Avaya are the registered r unregistered Marks f Avaya, its affiliates, r ther third parties. Users are nt permitted t use such Marks withut prir written cnsent frm Avaya r such third party which may wn the Mark. Nthing cntained in this site, the dcumentatin(s) and prduct(s) shuld be cnstrued as granting, by implicatin, estppel, r therwise, any license r right in and t the Marks withut the express written permissin f Avaya r the applicable third party. Avaya is a registered trademark f Avaya Inc. All ther trademarks are the prperty f their respective wners. Dwnlading dcuments Avaya Inc. Issue (March 2014) Page 12 f 13

13 Fr the mst current versins f dcumentatin, see the Avaya Supprt Web site: Cntact Avaya Supprt Avaya prvides a telephne number fr yu t use t reprt prblems r t ask questins abut yur prduct. The supprt telephne number is in the United States. Fr additinal supprt telephne numbers, see the Avaya Web site: Avaya Inc. Issue (March 2014) Page 13 f 13