Installation and Upgrade Guide Advanced Authentication Server. Version 6.1

Transcription

1 Installation and Upgrade Guide Advanced Authentication Server Version 6.1

2 Legal Notices For information about legal notices, trademarks, disclaimers, warranties, export and other use restrictions, U.S. Government rights, patent policy, and FIPS compliance, see Copyright 2018 NetIQ Corporation, a Micro Focus company. All Rights Reserved.

3 Contents About NetIQ Corporation 5 About this Book 7 1 Advanced Authentication Overview 9 How Is Advanced Authentication Better Than Other Solutions Key Features Advanced Authentication Server Components Administration Portal Self-Service Portal Helpdesk Portal Reporting Portal Architecture Basic Architecture Enterprise Level Architecture Enterprise Architecture With A Load Balancer Terminologies Authentication Method Authentication Chain Authentication Event Endpoint Tenant System Requirements 17 3 Installing Advanced Authentication 19 Obtaining Advanced Authentication Downloading the Full Version Downloading the Trial Version Installing Advanced Authentication Deploying Advanced Authentication on Amazon Web Services Prerequisites Assumptions Installing Advanced Authentication Helm Chart on Amazon EKS Deploying Advanced Authentication on Azure Kubernetes Services Prerequisites Assumptions Installing Advanced Authentication Helm Chart on Azure Kubernetes Services Upgrading Advanced Authentication Appliance 25 Adding a Field Patch to the Appliance Performing an Online Update Performing an Online Update Through Console Performing a Product Upgrade Upgrading Advanced Authentication Appliance 6.0 to Contents 3

4 5 Migrating Advanced Authentication from Version Troubleshooting 33 Viewing the Logs Managing Systemd Services Enabling SSH for Appliance Unable to Open the Advanced Authentication Portals After Upgrade Contents

5 About NetIQ Corporation We are a global, enterprise software company, with a focus on the three persistent challenges in your environment: Change, complexity and risk and how we can help you control them. Our Viewpoint Adapting to change and managing complexity and risk are nothing new In fact, of all the challenges you face, these are perhaps the most prominent variables that deny you the control you need to securely measure, monitor, and manage your physical, virtual, and cloud computing environments. Enabling critical business services, better and faster We believe that providing as much control as possible to IT organizations is the only way to enable timelier and cost effective delivery of services. Persistent pressures like change and complexity will only continue to increase as organizations continue to change and the technologies needed to manage them become inherently more complex. Our Philosophy Selling intelligent solutions, not just software In order to provide reliable control, we first make sure we understand the real-world scenarios in which IT organizations like yours operate day in and day out. That's the only way we can develop practical, intelligent IT solutions that successfully yield proven, measurable results. And that's so much more rewarding than simply selling software. Driving your success is our passion We place your success at the heart of how we do business. From product inception to deployment, we understand that you need IT solutions that work well and integrate seamlessly with your existing investments; you need ongoing support and training post-deployment; and you need someone that is truly easy to work with for a change. Ultimately, when you succeed, we all succeed. Our Solutions Identity & Access Governance Access Management Security Management Systems & Application Management Workload Management Service Management About NetIQ Corporation 5

6 Contacting Sales Support For questions about products, pricing, and capabilities, contact your local partner. If you cannot contact your partner, contact our Sales Support team. Worldwide: United States and Canada: Web Site: Contacting Technical Support For specific product issues, contact our Technical Support team. Worldwide: North and South America: Europe, Middle East, and Africa: +353 (0) Web Site: Contacting Documentation Support Our goal is to provide documentation that meets your needs. The documentation for this product is available on the NetIQ Web site in HTML and PDF formats on a page that does not require you to log in. If you have suggestions for documentation improvements, click Add Comment at the bottom of any page in the HTML version of the documentation posted at You can also Documentation-Feedback@netiq.com. We value your input and look forward to hearing from you. Contacting the Online User Community NetIQ Communities, the NetIQ online community, is a collaborative network connecting you to your peers and NetIQ experts. By providing more immediate information, useful links to helpful resources, and access to NetIQ experts, NetIQ Communities helps ensure you are mastering the knowledge you need to realize the full potential of IT investments upon which you rely. For more information, visit community.netiq.com. 6 About NetIQ Corporation

7 About this Book This Installation guide is intended for system administrators and describes the procedure of installing, configuring, and upgrading the Advanced Authentication server appliance. Intended Audience This book provides information for audience responsible for understanding administration concepts and implementing a secure, distributed administration model. About this Book 7

8 8 About this Book

9 1 1Advanced Authentication Overview Advanced Authentication is a multi-factor authentication solution that enables you to protect your sensitive data by using a more advanced way of authentication on top of the typical username and password authentication. With Advanced Authentication, you can authenticate on diverse platforms by using different types of authenticators such as Fingerprint, Card, and OTP. Advanced Authentication provides a single authentication framework that ensures secure access to all your devices with minimal administration. Authentication comprises of the following three factors: Something that you know such as password, PIN, and security questions. Something that you have such as smartcard, token, and mobile phone. Something that you are such as biometrics (fingerprint or iris). You can achieve multi-factor or strong authentication by using any two factors out of this list. For example, multi-factor authentication can include combination of a password and a token or a smartcard and a fingerprint. This section contains the following topics: How Is Advanced Authentication Better Than Other Solutions on page 9 Key Features on page 9 Advanced Authentication Server Components on page 10 Architecture on page 12 Terminologies on page 16 How Is Advanced Authentication Better Than Other Solutions Advanced Authentication leverages the needs of users to authenticate on different platforms with different needs. The following points explain how Advanced Authentication is different from other solutions: Works on multiple platforms such as Windows, Mac OS X, Linux and so on. Supports multi-site configurations that helps organizations to distribute the authentication globally. Key Features Multi-factor Authentication: The solution provides a flexibility of combining more than twenty authentication methods to create authentication chains. You can assign these chains to different events to use the specific authentication chains for different kinds of endpoints. Supports Multiple Repositories: Advanced Authentication supports Active Directory, Active Directory Lightweight Domain Services, NetIQ edirectory, and other RFC 2037 and RFC 2037 bis compliant LDAP repositories. Advanced Authentication Overview 9

10 Supports Distributed Environments: Advanced Authentication works on geographically distributed environments containing high loads. Multitenancy: A single Advanced Authentication solution can support multiple tenants to serve multiple customers with different environments. Supports Multiple Platforms: Advanced Authentication works on various platforms such as Windows, Linux, and Mac OS. Helpdesk: Advanced Authentication provides a separate role of Helpdesk or Security officer. A user with Helpdesk or Security Officer role can manage authenticators for the end users through the Helpdesk portal. Supports the RADIUS Server: Advanced Authentication Server contains a built-in RADIUS server to provide strong authentication for third-party RADIUS clients. Also, it can act as a RADIUS client for the third-party RADIUS servers. Supports ADFS 3 and 4, OAuth 2.0, and SAML 2.0: Advanced Authentication integrates with Active Directory Federation Services, OAuth 2.0, and SAML 2.0. This enables you to perform strong authentication for the users who need to access the third-party consumer applications. Reporting: Advance Authentication provides the Reporting portal that enables you to access different security reports. You can also create customized reports based on your requirement. Syslog support: Advanced Authentication provides the central logging server that can be used for log forwarding. You can configure the solution to forward logs to an external Syslog server. FIPS Compliant Encryption: Advanced Authentication adheres to Federal Information Processing Standard (FIPS) Supports Localization: Advanced Authentication supports several languages such as Arabic, Chinese, Dutch, and Danish. Advanced Authentication Server Components Advanced Authentication server comprises of the following components: Administration Portal For more information, see Administration Portal on page 10 Self-Service Portal For more information, see Self-Service Portal on page 11 Helpdesk Portal For more information, see Helpdesk Portal on page 11 Reporting Portal For more information, see Reporting Portal on page 11 Administration Portal Administration Portal is a centralized portal that helps you to configure and manage various authentication settings such as methods, events, and so on. You can also configure various policies that are required for authentication. You can perform the following tasks: Add repositories: A repository is a database that stores users information. For example: An organization, Digital Airlines contains an Active Directory that stores all of the user s information such as username, telephone, address, and so on. Administrator can add this Active Directory to Advanced Authentication solution to help different departments in the organization such as the 10 Advanced Authentication Overview

11 IT, finance, HR, and Engineering departments to authenticate based on their requirements. For more information about how to add repositories, see Adding a Repository in the Advanced Authentication - Administration guide. Configure methods: A method or an authenticator helps to confirm the identification of a user (or in some cases, a machine) that is trying to log on or access resources. You can configure the required settings for the appropriate methods depending on the requirement by each department. For more information about how to configure methods, see Configuring Methods in the Advanced Authentication - Administration guide. Create chains: A chain is a combination of methods. Users must authenticate with all the methods in a chain. For example, a chain with Fingerprint and Card method can be applicable for the IT department and a chain with Smartphone, LDAP Password, and HOTP is applicable for the Engineering department. For more information about how to create chains, see Creating a Chain in the Advanced Authentication - Administration guide. Configure events: An event is triggered by an external device or application that needs to perform authentication such as a Windows machine, a RADIUS client, a third party client and so on. After creating the chain, Administrator maps the chain to an appropriate event. For more information about how to configure events, see Configuring Events in the Advanced Authentication - Administration guide. Map endpoints: An endpoint is a device on which you can authenticate. Endpoints can be computers, Laptops, tablets, and so on. For more information about how to configure endpoints, see Managing Endpoints in the Advanced Authentication - Administration guide. Configure policies: An administrator can manage policies that are specific to users, devices, or locations to control a user s authentication. In Advanced Authentication, you can manage the policies in a centralized policy editor. For more information about how to configure policies, see Configuring Policies in the Advanced Authentication - Administration guide. Self-Service Portal The Self-Service Portal allows users to manage the available authentication methods. This portal consists of Enrolled authenticators and Add authenticator. The Enrolled authenticators section displays all the methods that users have enrolled. The Add authenticator section displays additional methods available for enrollment. You must configure and enable the Authenticators Management Event event to enable users to access the Self-Service portal. For more information on Self-Service portal, see Advanced Authentication- User guide. Helpdesk Portal The Helpdesk Portal allows the helpdesk administrators to enroll and manage the authentication methods for users. Helpdesk administrators can also link authenticators of a user to help authenticate to another user s account. For more information on Helpdesk portal, see the Advanced Authentication- Helpdesk Administrator guide. Reporting Portal The Reporting Portal allows you to create or customize security reports that provide information about user authentication. It also helps you understand the processor and memory loads. For more information on Reporting portal, see Reporting Advanced Authentication - Administration guide. Advanced Authentication Overview 11

12 Architecture Advanced Authentication architecture is based on the following three levels of architecture: Basic Architecture For more information, see Basic Architecture on page 12 Enterprise Level Architecture For more information, see Enterprise Level Architecture on page 13 Enterprise Architecture With A Load Balancer For more information, see Enterprise Architecture With A Load Balancer on page 15 Basic Architecture The basic architecture of Advanced Authentication is a simple configuration that requires only one Advanced Authentication server. An Advanced Authentication server is connected to a directory such as Active Directory Domain Services, NetIQ edirectory, Active Directory Lightweight Directory Service or other compliant LDAP directories. An Event Endpoint can be Windows, Linux or Mac OS X machine, NetIQ Access Manager, NetIQ CloudAccess, or RADIUS Client to authenticate through the RADIUS Server that is built-in the Advanced Authentication Server. For a complete list of supported events, see Configuring Events in the Advanced Authentication - Administration guide. 12 Advanced Authentication Overview

13 Enterprise Level Architecture In the enterprise level architecture of Advanced Authentication, you can create several sites for different geographical locations. For example, the Figure 1-1 on page 13 displays two Advanced Authentication sites, Site A and Site B. Figure 1-1 Enterprise Level Architecture Site A: The first site that is created for headquarters in New York. The first Advanced Authentication server of site A contains the Global Master and Registrar roles. This server contains a master database and it can be used to register new sites and servers. Site B: Another site created for the office in London. The structure of site B is similar to site A. The Global Master in another site has the DB Master role. DB servers interact with the DB Master. DB Server provides a database that is used for backup and fail-over. You can create a maximum of two DB servers per site. When the Global Master is unavailable, the DB server responds to the database requests. When the Global Master becomes available again, the DB server synchronizes with the Global Master and the Global Master becomes the primary point of contact for database requests again. Endpoints interact with Global Master or DB Master servers. When these servers are not available, they interact with DB servers. NOTE: DB servers connect to each other directly. If the Global Master is down, the DB servers will replicate. A Global Master must have a connection to each of the LDAP servers. Hence in a data center with Global Master, you must have LDAP servers for all the used domains. Advanced Authentication Overview 13

14 Master servers do not initiate a connection to the DB servers. Master servers initiate connection to Master servers only. DB servers initiate connection to the DB Master of the same site and Registrar only. IMPORTANT: Ensure to take regular snapshots or to clone the primary site to protect from any hardware issues or any other accidental failures. It is recommended to do it each time after you change the configuration of repositories, methods, chains, events and policies, or add or remove servers in the cluster. You can convert DB server of primary site to Global Master. This requires corresponding DNS changes. Nothing can be done if Global Master and all slaves are lost. 14 Advanced Authentication Overview

15 Enterprise Architecture With A Load Balancer The enterprise architecture with a load balancer contains web servers and load balancers along with the components in Enterprise Level Architecture. Figure 1-2 on page 15 illustrates the Enterprise architecture with a load balancer. Figure 1-2 Enterprise Architecture with Load Balancer Web Servers: Web server does not contain a database. It responds to the authentication requests and connects to Global Master. You need more web servers to serve more workload. NOTE: It is not recommended to deploy more than 5-6 web servers per site. Load Balancer: A load balancer provides an ability to serve authentication requests from External Endpoints. A load balancer is a third-party component. It must be configured to interact with Web servers. Advanced Authentication Overview 15

16 NOTE: To view an example of configuring a load balancer for an Advanced Authentication cluster, see Installing a Load Balancer for Advanced Authentication Cluster in the Advanced Authentication - Administration guide. Terminologies Authentication Method on page 16 Authentication Chain on page 16 Authentication Event on page 16 Endpoint on page 16 Tenant on page 16 Authentication Method An authentication method verifies the identity of an individual who wants to access data, resources, or applications. Validating that identity establishes a trust relationship for further interactions. Authentication Chain An authentication chain is a combination of authentication methods. A user must pass all methods in the chain to be successfully authenticated. For example, if you create a chain with LDAP Password and SMS, a user must first specify the LDAP Password. If the password is correct, the system sends an SMS with a One-Time-Password (OTP) to the user s mobile. The user must specify the correct OTP to be authenticated. You can create chains with multiple methods that are applicable for highly secure environments. You can create authentication chains for specific group of users in the repositories. Authentication Event An authentication event is triggered by an external device or application that needs to perform authentication. It can be triggered by a RADIUS Client (Citrix Netscaler, Cisco VPN, Juniper VPN and so on) or an API request. Each event can be configured with one or more authentication chains that enables a user to authenticate. Endpoint An endpoint is a device on which you can authenticate. Endpoints can be computers, Laptops, tablets, Smartphones, and so on. Tenant A tenant is a company with a group of users sharing common access with specific privileges. In Advanced Authentication, tenants have the privileges to customize some of the configuration settings. 16 Advanced Authentication Overview

17 2 2System Requirements IMPORTANT: The appliance is based on the SUSE Linux Enterprise Server 12 Service Pack 3 operating system. For system requirements of client components and plug-ins, see the related documentation. The following table lists the minimum and recommended requirements to deploy the Advanced Authentication appliance. Component Requirements Virtual Systems Hyper-V Server 2016 VMware ESX 5.5 or later Memory Minimum requirement: 4 GB of RAM Recommended requirement: 8 GB of RAM Hard disk space Minimum requirement: 40 GB Recommended requirement: 60 GB CPU Minimum requirement: 2 Cores CPU Recommended requirement: 8 Cores CPU Processor must support SSE 4.2 instructions. For more information about how to check whether the CPU supports SSE 4.2 instructions, see Verifying SSE 4.2 Instructions on CPU. Browsers Microsoft Internet Explorer 11 Microsoft Edge 20.0 and later Google Chrome 65 and later Mozilla Firefox 58 and later Safari 11 and later IP Ports LDAP Repositories Ensure that the default ports for the Advanced Authentication appliance are open in your firewall. For more information, see Configuring the Firewall ( advanced-authentication-61/server-administrator-guide/data/ firewall.html). Microsoft Active Directory Directory Services Microsoft Active Directory Lightweight Directory Services NetIQ edirectory OpenLDAP OpenDJ Microsoft SQL Server 2016 System Requirements 17

18 Verifying SSE 4.2 Instructions on CPU To check whether your CPU supports the SSE 4.2 instructions, run the following command: grep -q sse4_2 /proc/cpuinfo && echo "SSE 4.2 supported" echo "SSE 4.2 not supported" If your CPU supports SSE 4.2, the command returns a message SSE 4.2 supported. 18 System Requirements

19 3 3Installing Advanced Authentication This chapter guides you through the process of installing the components and framework required for Advanced Authentication. Obtaining Advanced Authentication on page 19 Installing Advanced Authentication on page 20 Deploying Advanced Authentication on Amazon Web Services on page 21 Deploying Advanced Authentication on Azure Kubernetes Services on page 22 Obtaining Advanced Authentication Advanced Authentication is available in two types: a trial version and a full version. You can access the different version in different locations. Downloading the Full Version on page 19 Downloading the Trial Version on page 19 Downloading the Full Version You must have purchased Advanced Authentication to access the full version of the product. To buy a full version of Advanced Authentication, see How to Buy. The activation code is in the Customer Center where you download the software. For more information, see Customer Center Frequently Asked Questions. To access a full version of Advanced Authentication: 1 Log in to the Customer Center. 2 Click Software. 3 In the Entitled Software tab, click the appropriate version of Advanced Authentication to download. To deploy the Advanced Authentication server, unpack the file advancedauthappliance-x86_64- x.x-xxx.zip. Downloading the Trial Version A trial version of Advanced Authentication can also be provided to allow you to see how the product works. To download the trial version: 1 Access the Download page at 2 Click the Find Trial Download link. 3 Scroll down to find Advanced Authentication, then click Download. 4 Specify your information to receive an with the download link. Installing Advanced Authentication 19

20 IMPORTANT: You must specify a valid address or you will not receive the that contains the link to download the trial version. 5 After you receive the , click the link and download the appropriate version for your environment. 6 (Conditional) Extract the compressed file for the appliance. Installing Advanced Authentication To install the Advanced Authentication server appliance, perform the following steps: 1 Ensure that your environment complies with the System Requirements. 2 Use the advancedauthappliance.x86_64-x.x.xxx.preload.iso file from the unpacked zip file. 3 Mount the Advanced Authentication installation ISO file and boot the machine. 4 Select Install advancedauthappliance option from the list. Other options available in the list are Boot from Hard Disk and Failsafe - - Install advnacedauthappliance. 5 Select Yes to delete all data in the SDA drive. 6 Select the appropriate language, read the license, and click Accept. 7 Use the following information to configure the appliance: root Password: Specify a password for the root user on the appliance. NTP Server: Specify a primary and secondary NTP server used to keep time on the appliance. Region and Time Zone: Select your region and time zone. Hostname and Networking options: Specify a hostname for the appliance, then select whether to use a Static IP address or DHCP. If you use a static IP address, you must specify the IP address, subnet mask, the gateway, and the DNS servers. 8 Click Finish and wait for the appliance initialization to complete. 9 After a prompt to login is displayed on the console, you must wait for 15 minutes. Even after the wait, if you are unable to access the Advanced Authentication portals then reboot the server. IMPORTANT: The time on Advanced Authentication servers must be synchronized with NTP servers. Ensure that the NTP port 123 (UDP) is open on your corporate firewalls to allow Advanced Authentication servers to sync time on the predefined NTP servers or specify your internal NTP servers. For more information on time setting, see Configuring Time Settings ( documentation/advanced-authentication-61/server-administrator-guide/data/time.html). NOTE: For information on migrating Advanced Authentication server from v5 to 6.1, see Migrating Advanced Authentication from Version 5. WARNING: When you log in to the console as root and run yast novell-vainit, it is strongly not recommended to select the Reboot or Shutdown option in the YaSTZ-novell-vainit installer. You will not be able to access the web user interface after shutting down or rebooting appliance and loading it again. 20 Installing Advanced Authentication

21 Deploying Advanced Authentication on Amazon Web Services The following sections illustrate how to deploy Advanced Authentication containers into a Kubernetes environment. You can install Advanced Authentication Appliance to a Kubernetes cluster by using the Helm charts. Prerequisites In addition to the system requirements of Advanced Authentication appliance, ensure that you have an administrative account on Amazon Elastic Container Service for Kubernetes (Amazon EKS). Assumptions The procedure in this section is based on the assumptions that you have completed the following tasks: Configured an Amazon EKS cluster. For more information about how to configure an Amazon EKS cluster, see Getting Started with Amazon EKS ( Installed kubectl and configured it to work with the Amazon EKS. For more information about installing and configuring kubectl, see install kubectl ( docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html) and configure kubectl ( docs.aws.amazon.com/eks/latest/userguide/configure-kubectl.html). Installed Helm (client) - Kubernetes package manager. For more information about how to install Helm client, see Helm quick start guide ( docs.helm.sh/using_helm/). Installing Advanced Authentication Helm Chart on Amazon EKS This section illustrates how to deploy Advanced Authentication Helm chart on Amazon EKS cluster. 1 Download the aaf-<version>-helm-chart.tgz file from the NetIQ Downloads ( dl.netiq.com). 2 Run the following commands to unpack the zip and tar files: unzip aaf-<version>-helm-chart.zip tar zxvf aaf-<version>.tgz 3 Run the following command to deploy three Advanced Authentication instance into the cluster: helm install --namespace aaf-test --name=aaf-test-1 -set lb.enabled=true./aaf/ helm install --namespace aaf-test --name=aaf-test-2 -set lb.enabled=true./aaf/ helm install --namespace aaf-test --name=aaf-test-3 -set lb.enabled=true./aaf/ 4 Run the following command to get the IP addresses that are assigned to each Advanced Authentication instance in the cluster: kubectl -n aaf-test get svc grep LoadBalancer Installing Advanced Authentication 21

22 NOTE: The Configuration Portal (port 9443) is not available for Kubernetes environment. The Managing the Appliance ( is only relevant for the appliance. Deploying Advanced Authentication on Azure Kubernetes Services The following sections illustrate the process of deploying Advanced Authentication containers into a Kubernetes cluster on Microsoft Azure. You can install Advanced Authentication Appliance to a Kubernetes cluster by using the Helm charts. Prerequisites In addition to the system requirements of Advanced Authentication appliance, ensure that you have an administrative account on Azure Kubernetes Services (AKS). Assumptions The procedure in this section is based on the assumptions that you have competed the following tasks: Configured a Microsoft AKS cluster. For more information about how to configure a Microsoft AKS cluster, see Get started tutorial ( Installed kubectl and configured it to work with Microsoft AKS. Installed Helm (client) - Kubernetes package manager. For more information about how to install Helm client, see Helm quick start guide ( docs.helm.sh/using_helm/). Installing Advanced Authentication Helm Chart on Azure Kubernetes Services This section illustrates how to deploy Advanced Authentication Helm chart on Microsoft AKS cluster. 1 Download the aaf-<version>-helm-chart.tgz file from the Netiq Downloads ( dl.netiq.com). 2 Run the following commands to unpack the zip and tar files: unzip aaf-<version>-helm-chart.zip tar zxvf aaf-<version>.tgz 3 Run the following command to deploy three Advanced Authentication instance into the cluster: helm install --namespace aaf-test --name=aaf-test-1 -set lb.enabled=true./aaf/ helm install --namespace aaf-test --name=aaf-test-2 -set lb.enabled=true./aaf/ helm install --namespace aaf-test --name=aaf-test-3 -set lb.enabled=true./aaf/ 22 Installing Advanced Authentication

23 4 Run the following command to get the IP addresses that are assigned to each Advanced Authentication instance in the cluster: kubectl -n aaf-test get svc grep LoadBalancer NOTE: The Configuration Portal (port 9443) is not available for Kubernetes environment. The Managing the Appliance ( is only relevant for the appliance. Installing Advanced Authentication 23

24 24 Installing Advanced Authentication

25 4 4Upgrading Advanced Authentication Appliance This section discusses how to upgrade Advanced Authentication appliance to the latest version through the Configuration console. To access the Configuration console, perform the following steps: 1 In a web browser, specify the DNS name or the IP address of the appliance with the port number For example: or 2 Specify root or vaadmin as the user name and specify the password for the appliance, then click Sign in. 3 Continue using the Appliance Configuration tools. Following are the different options to upgrade the appliance on the Configuration console: Adding a Field Patch to the Appliance on page 25 Performing an Online Update on page 26 Performing a Product Upgrade on page 28 Adding a Field Patch to the Appliance You can add patches provided by engineering in the Field Patch tab. A field patch is not a complete patch and must only be used until a complete patch is released. Perform the following steps to apply a field patch: 1 Disable all the other updates for the appliance or the field patch will be overwritten. 2 It is recommended to upgrade when the users activities are low. The period of upgrade must be reduced as the replication of databases that do not synchronize can break the DB servers. 3 Create snapshots for all the Advanced Authentication servers. 4 See Managing the Field Patch Updates on page 26 to apply a field patch. 5 Restart the server to complete the update. It may take up to 10 minutes to get the required services started. 6 Log in to the Advanced Authentication Administration portal on the upgraded server. 7 Click Cluster > Conflicts to resolve the conflicts. 8 Repeat steps Step 4 to Step 7 for DB servers and Step 4 to Step 6 for Web servers. Upgrading Advanced Authentication Appliance 25

26 The Patches are intended for specific bug fixes and security fixes for software that comes packaged by OpenSUSE and is maintained in the Main Updates repository. For more information, see OpenSUSE patch vs update ( Managing the Field Patch Updates 1 Log in to the Configuration Console as the vaadmin user. 2 Click Field Patch, then follow the prompts to install the patch update. 3 (Conditional) Install a downloaded patch update: 3a Download the Advanced Authentication patch update file from the Patch Finder website. 3b In the Install a Downloaded Patch section, click Browse. 4 (Conditional) Uninstall a patch update: You might not be able to uninstall some patch updates. 4a In the Patch Name column of the Field Patch list, select the patch update that you want to uninstall. 4b Click Uninstall Latest Patch. 5 (Conditional) Download a log file that includes details about the patch update installation. 5a Click Download Log File for the appropriate patch update. NOTE: Ensure that you disable online updates and automatic updates until you apply a full patch that contains the fix. Performing an Online Update Use the Online Update option to register for the online update service from the Customer Center ( You can install updates automatically or manually to update the appliance. For more information on the OpenSUSE online updates, see OpenSUSE patch vs update ( If you want to control the updates further, you can configure the appliance to get the updates from a local Subscription Management Tool (SMT). This allows you to download the updates to a single SMT server in your network and all other Advanced Authentication appliances receive their updates from this server. For more information, see Subscription Management Tool Guide. To obtain the proper credentials to use the SMT server, see Mirroring Credentials in the Subscription Management Tool Guide. To activate the Update Channel, you must obtain the key from the Customer Center. If the key is not available, contact the Customer Center through an . WARNING: Before performing the online update, ensure to add rules in the firewall to allow https traffic to the URLs such as docker.io, nu.novell.com and secure- For more information about configuring the firewall, see Configuring the Firewall ( firewall.html). To register for the Online Update Service: 1 Log in to the Configuration Console as the root user. 2 Click Online Update. 26 Upgrading Advanced Authentication Appliance

27 3 If the Registration dialog does not open automatically, click the Register tab. 4 Select the Service Type: Local SMT (Proceed to Step 5.) Micro Focus Customer Center (Skip to Step 6.) 5 (Local SMT) Specify the following information for the SMT server, then continue with Step 7. Hostname such as smt.example.com (Optional) SSL certificate URL that communicates with the SMT server (Optional) Namespace path of the file or directory 6 (Micro Focus Customer Center) Specify the following information about the Customer Center ( account for this appliance: address of the account in Customer Center Activation key (the same Full License key that you used to activate the product). Perform the following steps to obtain the activation key: 1. Login to Micro Focus Customer Center ( 2. Click Software > Entitled Software > NetIQ Advanced Authentication > Keys. 3. Make a note of the applicable key. Allow data send (select any of the following) Hardware Profile Optional information 7 Click Register. Wait while the appliance registers with the service. 8 Click OK to dismiss the confirmation. After you have registered the appliance, you can view a list of the needed updates, or view a list of installed updates. You can use manual or automatic options to update the appliance. To perform other actions after registration: Update Now: Perform the following steps to install the downloaded updates: 1. It is recommended to upgrade when the users activities are low. The period of upgrade must be reduced as the replication of databases that do not synchronize can break the DB servers. 2. Create snapshots for all the Advanced Authentication servers. 3. Click Update Now to install the downloaded updates. 4. Restart the server to complete the update. It may take up to 10 minutes to get the required services started. 5. Log in to the Advanced Authentication Administration portal on the upgraded server. 6. Click Cluster > Conflicts to resolve the conflicts. 7. Repeat steps Step 3 to Step 6 for DB servers and Step 3 to Step 5 for Web servers. Schedule: Configure the type of updates to download and whether to automatically agree to the licenses. To schedule online update: 1. Click the Schedule tab. 2. Select a schedule for download updates (Manual, Daily, Weekly, Monthly). Upgrading Advanced Authentication Appliance 27

28 View Info: Click View Info to display a list of installed and downloaded software updates. Refresh: Click Refresh to reload the status of updates on the Appliance. Performing an Online Update Through Console You can perform an online update through console to install the SLES and Advanced Authentication appliance updates. To initialize the updates, perform the following steps: 1 (Optional) Run the following command to register as a root user: suse_register -a regcode-aauth=xxxxxxxxxxxx -a =user@example.com -L /tmp/ register.txt 2 Run the following command to add a SLES repository: zypper ar x86_64/ SLES 3 Run the following command to add Advanced Authentication appliance repository: zypper ar x86_64/ AAF 4 Run the following command to refresh the configured repositories: zypper refresh 5 Run the following command to updated all packages: zypper up NOTE: After adding and refreshing the repositories, you can also update the packages from the Appliance Configuration console > Online Update > Update Now instead of performing Step 5. Performing a Product Upgrade You can upgrade your appliance using the Product Upgrade option. For migrating from Advanced Authentication 5 to 6.1, see Migrating Advanced Authentication from Version 5 section. The Product Upgrade option is displayed only when you can use it to upgrade the service hosted on your appliance. Upgrading Advanced Authentication Appliance 6.0 to 6.1 While you upgrade Advanced Authentication appliance from version 6.0 to 6.1, consider the following recommendations: 1 Upgrade the appliance when the users activities are low. The period of upgrade must be reduced as the replication of databases that do not synchronize can break the DB servers. 2 Create snapshots for all the Advanced Authentication servers. 3 Switch to Online Update tab and apply all updates. 4 Switch to Product Upgrades tab and upgrade the appliance. 5 Restart the server to complete the update. It may take up to 10 minutes to get the required services started. 28 Upgrading Advanced Authentication Appliance

29 6 Log in to the Advanced Authentication Administration portal on the upgraded server. 7 Click Cluster > Conflicts to resolve the conflicts. 8 Repeat steps Step 4 to Step 7 for DB servers and Step 4 to Step 6 for Web servers. Upgrading Advanced Authentication Appliance 29

30 30 Upgrading Advanced Authentication Appliance

31 5 5Migrating Advanced Authentication from Version 5 You cannot upgrade from Advanced Authentication 5.0 to 6.1. However, you can export the configurations of the database from Advanced Authentication 5.6 to 6.1. After you install Advanced Authentication 6.1, you can import all the configurations from 5.6. For example, to upgrade from Advanced Authentication 5.5 to 6.1, you must first upgrade from Advanced Authentication 5.5 to 5.6. Then, you must install 6.1 and import the configurations from 5.6. For information about how to export and import the configurations, see Exporting and Importing the Database in the Advanced Authentication - Administration guide. To migrate 5.0 to Advanced Authentication 6.1, perform the following steps: 1 Deploy the Advanced Authentication Global Master 6.1 server. For more information, see Configuring Global Master Server ( 2 Migrate the database. To do this, you must export the database in 5.6 and import the database in 6.1. For information about how to export and import the configurations, see Exporting and Importing the Database in the Advanced Authentication - Administration guide. NOTE: By default, for the existing customers, the first 6.1 server where the database is imported will be the new Global Master server (GMS) of the cluster. 3 Deploy other Advanced Authentication servers in the cluster. For more information about clustering, see Configuring a Cluster in the Advanced Authentication - Administration guide. 4 Reconfigure the third-party integrations to point them to the new server address. For example, Advanced Authentication integrates with ADFS through the SAML or OAuth event. After you migrate Advanced Authentication from 5.6 to 6.1, you must point all these third-party integrations to the new 6.1 server. 5 Create the _aav6 DNS service location records for the new servers of the 6.1 cluster. For more information about how to set the DNS records in Windows Client, see Setting DNS for Server Discovery in the Advanced Authentication - Windows Client guide. 6 Upgrade the client packages on the endpoints. NOTE It is recommended to upgrade a couple of Clients and perform the testing for a couple of days. Then upgrade the next portion of Clients and perform the testing for few more days. After this upgrade the rest of the Clients. Do not delete the _aaa service location records from DNS for the servers available in the 5.6 cluster unless all the endpoints are migrated Advanced Authentication to 6.1. Migrating Advanced Authentication from Version 5 31

32 32 Migrating Advanced Authentication from Version 5

33 6 6Troubleshooting This chapter contains the following sections: Viewing the Logs on page 33 Managing Systemd Services on page 33 Unable to Open the Advanced Authentication Portals After Upgrade on page 34 Viewing the Logs To view the logs of Advanced Authentication appliance docker, specify the following path: /var/lib/docker/volumes/aaf_aucore-logs/_data The /var/lib/docker/volumes/aaf_aucore-logs/_data contains logs related to aucore, replication, webauth, and so on. To view the processes running on docker, run the following command $ docker ps --format "{{.Names}}" Managing Systemd Services To start and stop the Systemd services, run the following commands: systemctl status aauth systemctl stop aauth systemctl start aauth Enabling SSH for Appliance To enable SSH for appliance, run the following commands: systemctl enable sshd.service systemctl start sshd.service lsof -i :22 (to check that the port is listening) NOTE: You can also perform these services in Accessing System Services ( documentation/advanced-authentication-61/server-administrator-guide/data/services.html) of the Configuration portal. Troubleshooting 33

34 Unable to Open the Advanced Authentication Portals After Upgrade Issue: After updating Advanced Authentication, if you are unable to open the Advanced Authentication portals except for the Configuration portal (:9443). This issue occurs when the docker bypasses the proxy settings. Workaround: As a solution, perform the following steps: 1 Run the command /opt/aauth/start to start the Advanced Authentication services manually. If an error message ERROR: Get request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) is displayed then proceed to step 3. 2 Check the firewall settings. The Advanced Authentication server must be able to access docker.io through the port 443 (HTTPS). For more information about the firewall settings, see Configuring the Firewall ( firewall.html). 3 Ensure the proxy settings are configured in YaST. For more information about the proxy settings, see Configuring the Proxy Settings ( network.html#t46ltypycv7a) 4 Navigate to the path /etc/systemd/system/docker.service.d. 5 Create a file http-proxy.conf and specify the following parameters: [Service] Environment="HTTP_PROXY=<proxy_URL>" Environment="NO_PROXY=<proxy_exception>" Environment="PROXY_USER=<username>:<password>" For example, [Service] Environment="HTTP_PROXY= Environment="NO_PROXY=.local,.company.com" Environment="PROXY_USER=proxuser:password" 6 Save the configuration file. 7 Restart the server. 34 Troubleshooting