Oracle Identity Manager 11gR2-PS2 Hands-on Workshop Tech Deep Dive Upgrade

Transcription

1 <Insert Picture Here> Oracle Identity Manager 11gR2-PS2 Hands-on Workshop Tech Deep Dive Upgrade Principal Product Manager, Oracle Identity Governance

2 This document is for informational purposes. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle. This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. This document and information contained herein may not be disclosed, copied, reproduced or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

3 Agenda One Hop Upgrade Overview Upgrade Concepts Upgrade Design One Hop Upgrade Process Major vs Minor vs Websphere Upgrades Cluster Upgrades Pre Upgrade Considerations Pre Upgrade Report Back up and Recovery Cross Platform Upgrade

4 One Hop Upgrade Overview Oracle Identity Management (OIM) One Hop Upgrade being released for the customers to directly upgrade to Latest Release from any source. For the release séquence R1, R2, R3,..Rn-1, Rn in chronological order, if the customer on release R1 wants to upgrade to release Rn. Advantage : Hop-By-Hop Upgrade : With the Hop by Hop Upgrade Model, Upgrade Path would be R1 R2, R2 R3,. Rn -1 Rn Direct Upgrade : With the One Hop Upgrade Model, Upgrade Path would be R1 Rn. Following Upgrade Paths will be supported by One Hop Upgrade OIM R1PS1 OIM Rn [WLS] OIM R1PS2 OIM Rn [WLS] [NON FA] OIM R2 OIM Rn [WLS] OIM R2PS1 OIM Rn [WLS,WAS] OIM 9x OIM Rn [WLS,WAS]

5 Upgrade Design PRE Upgrade Report Rx Ry Binaries (OIM HOME, SOA HOME) Binaries (OIM HOME, SOA HOME) Schemas : OIM, MDS SOAINFRA, ORASDPM Schema Upgrade Mid Tier Upgrade Schemas: OIM, MDS SOAINFRA, ORASDPM OPSS Middle Ware Middle Ware Post Upgrade Steps and Verification

6

7 Cluster Upgrade NODE-1 T1 Admin Server, OIM Server, SOA Server T2 Admin Server NODE-2 T1 T2 OIM Server, SOA Server OIM Server, SOA Server UPGRADE STEPS Binary Upgrade Configuring Domain with DB Policy Store Schema Upgrade Upgrading Oracle Identity Management Schemas Using Patch Set Assistant Mid Tier Upgrade Starting the Administration Server and SOA Managed Server Upgrading Oracle Identity Manager Middle Tier MDS patching UPGRADE STEPS Binary Upgrade Pack domain from Node1 Unpack the same on Node2

8 PRE UPGRADE CONSIDERATIONS

9 PRE UPGRADE CONSIDERATIONS Upgrade Path Supported Execution of Pre-Upgrade Utility Analysis of Pre Upgrade Reports Back-up and Restore

10 Execution of Pre Upgrade Utility List of Steps Download the pending transaction report utility, as described in the note at Edit preupgrade_report_input.properties file to provide values for parameters. Set the following environment Variables. JAVA_HOME (Note: JAVA_HOME version should be 1.6 or above). MW_HOME. OIM_HOME. Note: For 9x source version setting MW_HOME and OIM_HOME not required. Invoke generatepreupgradereport.sh on UNIX, or generatepreupgradereport.bat on Windows, and provide the following details. After invoking the utility the following details need to be given at the command prompt: OIM Schema Password. MDS Schema Password. DBA Schema Password.

11 Analysis of Pre Upgrade Reports Report Name APPROVALPOLICYPreUpgradeReport.html Report Description This report lists the request approval policies that has a rule defined on the non existing template AUTHORIZATIONPOLICYPreUpgradeReport.html OIM uses a new authorization framework that does not use the authorization policies created in OIM X. Therefore, all of the authorization policies created in OIM X are invalid in this release. CYCLIC_GROUP_MEMBERSHIP_CHKPreUpgradeReport.html EVENT_HANDLERPreUpgradeReport.html ORACLE_TEXTPreUpgradeReport.html PROVISIONINGPreUpgradeReport.html The report includes a list of cyclic groups and instructions to remove cyclic dependency. It is mandatory to remove all cyclic dependencies running in the OIM environment. This report captures all user customizations related to Event Handler in OIM Oracle TEXT is a mandatory RDBMS component for OIM Check this report to ensure that the component exists in your database installation. This report lists entities that are based on the following: Each resource object must have a process form associated with it. Lists the resources that do not have a process form. Resource objects must have an attribute of field type ITResource set in the process form. Lists the ITResources without the ITResource field type in their respective Process Form. Resource Objects that have multiple ITResource Lookup fields in the process form must set the ITResource Type property to true for at least one of the attributes. Lists the Resource Objects that you do not have the ITResource Type property set. Access Policies without ITResource value set in default policy data. REQUESTPreUpgradeReport.html This report lists any necessary actions and invalid requests. Note : The report should be clean as far as possible but it's ok to leave behind some items like unprocessed requests etc. With a known fact that they won't be processed.

12 Pre Upgrade Report Relevance's Report Name (in index) Actual Name Is Relevant for 9x. Is Relevant for R1PS1 Is Relevant for R1PS2 Is Relevant for R2 Is Relevant for R2PS1 Comment Installation Status of Mandatory Database Components ORACLE_MANDATORY_COMPONENT_CHKPreUpgradeReport.html yes yes yes yes yes List of invalid Password Policies PasswordPolicyPreUpgradeReport yes yes yes yes yes Prerequisites for Online Purge ORACLE_ONLINE_PURGEPreUpgradeReport yes yes yes yes yes Existence based on query output Pending Audit Tasks AUDITPreUpgradeReport yes No no no No Pending Recon Events RECONPreUpgradeReport yes No no no No Pending Approval Tasks REQUESTPreUpgradeReport yes No no no No Pending Offline Provisioning Tasks JMSPreUpgradeReport yes No no no No OSI Data Upgrade Utility Status OSIPreUpgradeReport yes No no no No List of cyclic groups in LDAP directory CYCLIC_GROUP_MEMBERSHIP_CHKPreUpgradeReport yes No no no No List of potential app instance creation issues PROVISIONINGPreUpgradeReport yes No no no No Installation Status of UDF UDFPreUpgradeReport No yes yes yes yes Status of Mandatory deletion of OIM Authenticator Jar(s) WLSMBEANPreUpgradeReport No yes yes yes yes List of invalid approval policies APPROVALPOLICYPreUpgradeReport No yes yes no No List of Requests affected REQUESTPreUpgradeReport No yes yes no No List of Invalid Request Data PROVISIONINGBYREQUESTPreUpgradeReport No yes yes no No Event Handlers affected during upgrade EVENT_HANDLERPreUpgradeReport No yes yes yes No Domain Reassociation report DomainReassocAuthorization No yes yes yes yes Challenge Questions report ChallengeQuesPreUpgradeReport No yes yes yes yes List of cyclic groups in LDAP directory CYCLIC_GROUP_MEMBERSHIP_CHKPreUpgradeReport No yes yes no yes List of potential app instance creation issues PROVISIONINGPreUpgradeReport No yes yes no yes Certification Report CertificationUpgradeReport No No no no yes

13 Back-up and Restore OIM Upgrade recommends back-up of MW_HOME directory, including the Oracle Home directories inside Middleware Home Domain Home directory OIM schemas MDS schema ORASDPM schema SOAINFRA schemas Please follow the Back-Up and Restore Document at

14 Upgrade Process

15 Upgrade Process Steps Binary Upgrade Upgrading Oracle WebLogic Server Upgrading Oracle SOA Suite Used by OIM Upgrading Oracle Identity Manager 11g Release 2 (11.1.2) Configuring Domain with DB Policy Store Creating Oracle Platform Security Services Schema Extending OIM Component Domains with OPSS Template Upgrading Oracle Platform Security Services Configuring OPSS Security Store Schema Upgrade Upgrading Oracle Identity Management Schemas Using Patch Set Assistant Mid Tier Upgrade Starting the Administration Server and SOA Managed Server Upgrading Oracle Identity Manager Middle Tier Restart Administration, SOA Managed Server MDS patching Start OIM Managed Server OIM Metadata is upgraded to latest release Design Console Upgrade Remote Manager Upgrade

16 Binary Upgrade Weblogic Upgrade Tool Weblogic Upgrade Script OIM Binary Upgrade Tool OIM Rn Installer SOA Binary Upgrade Tool SOA Rn Installer

17 Pre-requisites Tool Oracle Text must be installed No Cyclic dependency in the User Groups Patch Set Assistant (PSA Minor Upgrade) Upgrade Assistant (UA Major Upgrade) Dependent Schemas MDS SOA Invoking PSA (Minor Upgrade) Go to $MW_HOME/oracle_common/bin invoke psa (Linux) or psa.bat (windows) Invoking UA (Major Upgrade) Go to $MW_HOME/bin Invoke UA (Linux) or ua.bat (windows) Schema Upgrade Salient Features of Schema Upgrade Pre Check if any of the pre-requisites does not meet, PSA fails. Re-enterant Dependent Schemas (MDS,SOA) are upgraded first

18 Configuring Domain with DB based Policy Store Model in PS1 File Based Policy Store OPSS policies resided in domain (fmwconfig/system-jazn.xml) Model R2 Onwards DB based policy store How Upgrade deals with it? New OPSS schema is created using RCU Domain is extended for the new schema Run Configure Policy Store To change the domain configuration to use db-based policy store. To seed the policies into the db-based policy store

19 Mid Tier Upgrade Pre-requisites OIM Schema Upgrade complete Admin Server and SOA Server started Tool Stand Alone Utility OIMUpgrade.sh (Linux) /OIMUpgrade.bat (Windows) Location <MW_HOME>/Oracle_IDM1/server/bin Mode to run MT Upgrade Using Property File Salient features of MT Upgrade Pre-Check MT fails if any of the pre-requisite is not met Re-enternant in nature Feature Upgrade Reports Selective Feature Upgrade Possible

20 MDS patching Pre Requisites Schema Upgrade complete Responsibility Patches the Rn OIM Metadata in MDS while preserving the User Customizations E.g New task definitions in /db/task.xml Tool MDS Listeners Triggered during deployment of metadata.ear Salient Features MDS Patching Report. Event Handler Customizations needs to be done post-upgrade In place validation for binary-schema upgrade EAR Name Deployment Name EAR location Protected oim_ee_metadata.ear OIMAppMetadata $ORACLE_OIM_HOME/server/apps/ oim_ee_metadata.ear metadata.ear OIMMetadata $ORACLE_OIM_HOME/server/apps/metadat a.ear No Yes

21 Post Upgrade Steps

22 Post Upgrade Manual Steps S. No POST-UPGRADE STEPS Comments 9X WLS R1x WLS R2x WLS 1 Creating sysadmin Key manually create the sysadmin key using OEM N Y N 2 Running the Entitlement List Schedule For using catalog features Y Y N 3 Running the Entitlement Assignments Schedule Job ensure that the existing entitlement grants are shown properly in the My Entitlements tab Y N N 4 Running the Evaluate User Policies Scheduled Task to start provisioning based on access policy Y Y N 5 Running Catalog Synchronization To provosion AppInstance Y Y N 6 UMS Notification Provider To use the new notification provider Y Y N 7 Upgrading User UDF several features like user creation, role creation, and self registration request where UDFs are involved fails Y Y N 8 Upgrading Application Instances creates the UI Forms and Datasets for the Application Instances, and seeds to MDS Y Y N 9 Redeploying XIMDD Y Y N 10 Redeploying SPML-DSML required only if the DSML web services for AD Password Sync were deployed Y Y N 11 Customizing Event Handlers re-customize after Upgrade.Use a new file for customization to preserve the in upgrade Y Y N 12 Recompiling Adapters Y N N 13 Rewriting Prepopulate Adapters Y N N 14 Disabling User Login No longer mandatory attribute Y N N 15 Upgrading Oracle Identity Management Reports Y Y Y 16 Creating New SOA Composites Y N N 17 Upgrading SOA Composites manually upgrade OOTB composites and custom composites built before upgrading N Y N 18 Targetting JRFWSAsyncJmsModule to Oracle Identity Manager Server If you wish to use async webservices for SoD integration N N Y 19 Configuring Auto-Approval for Self-Registration Disabled after upgrade Y N N 20 Authorization Policy Changes Pre-upgrade custom Authorization Policies must be assigned new administrator roles in relation to User Administration, Role Administration, or Help Desk. N Y N 21 Generating an Audit Snapshot Y N N 22 Enabling Audit Y N N 23 Creating Password Policies a default password policy will be seeded at the TOP organization. As a result, any password policy rules created using the older Y y N password policy model in Oracle Identity Manager 9.1.x.x environment will not be supported. The upgrade utility does not migrate the password policies of Oracle Identity Manager 9.1.x.x 24 Impact of Removing Approver-Only Attribute in Request Data Set manually add LDAP Sync Validation Handler, remove RDN pre-process handler N Y N 25 Provisioning OIM Login Modules Under WebLogic Server Library Directory N Y N 26 Reconfiguring Lookup Based UDF Field If UDF of type lookup or dropdown as outputtext field exists N N Y 27 Creating PeopleSoft Enterprise HRMS Reconciliation Profile If you have PeopleSoft connector N Y Y 28 Reviewing OIM Data Purge Job Parameters the OIM Data Purge Job will be seeded in enabled stateby upgrade which will purge platform data with a retention period of 1 day for complete orchestration. To enable purge of request, reconciliation, and provisioning task, you must revisit the OIM Data Purge Job parameters Y Y Y 29 Reviewing Performance Tuning Recommendations Y Y Y

23 Post Upgrade Verification Use the following URL in a web browser to verify that Oracle Identity Manager is running: where <oim.example.com> is the path of the administration console. <oim_port> is the port number. Use Fusion Middleware Control to verify that Oracle Identity Manager and any other Oracle Identity Management components are running in the Oracle Fusion Middleware environment. Install the Diagnostic Dashboard and run the following tests: Oracle Database Connectivity Check Account Lock Status Data Encryption Key Verification JMS Messaging Verification SOA-Oracle Identity Manager Configuration Check SPML Web Service Test OWSM setup Test SPML to Oracle Identity Manager request invocation SPML attributes to Oracle Identity Manager attributes Username Test

24

25