This chapter describes how to patch your existing Oracle Identity and Access Management 11.1.1.3.0 installation to 11.1.1.5.0. It also describes how to migrate your existing configuration from 11.1.1.3.0 to 11.1.1.5.0.
This chapter contains the following sections:
Section 6.2, "Updating Oracle Identity Manager 11.1.1.3.0 to 11.1.1.5.0"
Section 6.3, "Updating Oracle Access Manager 11.1.1.3.0 to 11.1.1.5.0"
Section 6.4, "Updating Oracle Adaptive Access Manager 11.1.1.3.0 to 11.1.1.5.0"
Section 6.5, "Updating Oracle Identity Navigator 11.1.1.3.0 to 11.1.1.5.0"
Note:
You must patch your Oracle Identity and Access Management products in the order listed above. For example, Oracle Identity Manager must be patched before Oracle Access Manager.Section 6.6, "Patching Oracle Identity and Access Management in a Clustered Environment"
If you have a version of Oracle Identity Management that is earlier than 11g, you must upgrade your software and the patching instructions in this chapter are not applicable. For upgrade instructions, see the Oracle Fusion Middleware Upgrade Guide for Oracle Identity Management.
This section discusses the following topics:
Section 6.1.4, "Patching Oracle WebLogic Server 10.3.3. to 10.3.5"
Section 6.1.6, "Patching Oracle Identity and Access Management 11.1.1.3.0 to 11.1.1.5.0"
Ensure that the following versions of Oracle Fusion Middleware software are installed on your machine before moving from Oracle Identity and Access Management 11.1.1.3.0 to Oracle Identity and Access Management 11.1.1.5.0:
Oracle WebLogic Server 11g (10.3.3)
Oracle SOA Suite 11.1.1.3.0 (required for Oracle Identity Manager only)
Oracle Identity and Access Management 11g Release 1 (11.1.1.3.0)
Read the following before you start moving from Oracle Identity and Access Management 11.1.1.3.0 to 11.1.1.5.0
This chapter describes how to patch an existing Oracle Identity and Access Management 11.1.1.3.0 installation to Oracle Identity and Access Management 11.1.1.5.0. If you are installing Oracle Identity and Access Management (11.1.1.5.0) for the first time, refer to the "Installing Oracle Identity and Access Management (11.1.1.5.0)" topic in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management.
By completing the procedure in this chapter, your existing 11.1.1.3.0 Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Identity Navigator are patched to their 11.1.1.5.0 versions. In addition, the following components are installed:
Oracle Adaptive Access Manager (Offline)
Oracle Entitlements Server
When you are patching Oracle Access Manager from 11.1.1.3.0 to 11.1.1.5.0, Oracle Access Manager will be patched. In addition, Oracle Secure Token Service will be installed. For more information, see Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager with Oracle Security Token Service.
Before you begin patching, you should back up your Oracle Fusion Middleware environment. For more information, see "Backing Up Your Environment" in the Oracle Fusion Middleware Administrator's Guide.
Perform the following steps to patch your existing Oracle WebLogic Server 10.3.3 to 10.3.5 by using the WebLogic Server Upgrade installer.
Download the Upgrade installer from My Oracle Support.
For instructions, see "Downloading an Upgrade Installer From My Oracle Support" in Oracle Fusion Middleware Installation Guide for Oracle WebLogic Server.
Run the Upgrade installer in graphical mode to patch your WebLogic Server.
For instructions, see "Running the Upgrade Installer in Graphical Mode" in Oracle Fusion Middleware Installation Guide for Oracle WebLogic Server.
Note:
After patching Oracle WebLogic Server to 10.3.5, an additional JDK directory can be seen in the Middleware home. The patch does not remove the existing JDK from the Oracle WebLogic Server 10.3.3 installation.If you want to run the Upgrade installer in silent mode (for example, you have an environment where you need to patch multiple instances of Oracle WebLogic Server), see the instructions in "Running the Installation Program in Silent Mode" in Oracle Fusion Middleware Installation Guide for Oracle WebLogic Server.
If you have Oracle Identity Manager installed, you must patch Oracle SOA Suite 11.1.1.3.0 to Oracle SOA Suite 11.1.1.5.0.
Note:
Only Oracle Identity Manager requires Oracle SOA Suite 11g (11.1.1.5.0). This step is required because Oracle Identity Manager uses process workflows in Oracle SOA Suite to manage request approvals.For instructions, see Chapter 3, "Applying the Latest Oracle Fusion Middleware Patch Set". In addition to the general patching tasks described in this chapter, make sure you also perform the tasks in Section 3.8.6, "Post-Patching Tasks for Oracle SOA Suite".
Patching Oracle Identity and Access Management 11.1.1.3.0 to 11.1.1.5.0 involves the following steps:
Download the Oracle Identity and Access Management 11.1.1.5.0 Patch Set Installer. See the instructions in Section 3.5.2, "Download the Installer".
Run the Oracle Identity and Access Management 11.1.1.5.0 Patch Set Installer from your local system. For instructions, see Section 3.5.3, "Start the Installer".
Follow the instructions in Section 3.6, "Patch Set Installer Instructions" to navigate through the Patch Set Installer screens and patch your Oracle Identity and Access Management software.
Note:
On the Specify Installation Location screen, You must specify the location of the same Middleware home that contains Oracle Identity and Access Management 11.1.1.3.0 components. You must also specify the same Oracle home that was created in the Oracle Identity and Access Management 11.1.1.3.0 installation. This directory will be referred to as the IAM home (IAM_Home) for the remainder of this document.
For more information about these directories, see "Oracle Fusion Middleware Directory Structure and Concepts" in the Oracle Fusion Middleware Installation Planning Guide.
To update Oracle Identity Manager 11.1.1.3.0 to 11.1.1.5.0, complete the steps in both Section 6.2.1, "Instructions for Updating Oracle Identity Manager" and Section 6.2.2, "Configuring Oracle Identity Manager Design Console".
Additionally, if you have enabled LDAP Sync in the Oracle Identity Manager 11.1.1.3.0 environment and the LDAP server is configured to enable referential integrity, see Section 6.2.3, "Setting System Properties for LDAP Sync and Referential Integrity".
Back up the Oracle Identity Manager 11.1.1.3.0 schema, the MDS schema, the Oracle Identity Manager 11.1.1.3.0 domain, and your Oracle Identity Manager and Oracle SOA Suite binaries.
Note:
If your application includes any UI customizations, ensure that you back up such customizations before updating Oracle Identity Manager 11.1.1.3.0 to 11.1.1.5.0. After the update, you should redo the customizations.Note:
All of the default 11.1.1.3.0 Event Handlers will be overwritten during the update; make sure that you back up all of the Event Handlers that come with the original product. You can export the Event Handlers from MDS through the MDS export utility (IAM_11.1.1.3.0_Home/server/bin/weblogicExportMetadata.sh). This back up can be used to redo any customization related to the default Event Handlers after updating Oracle Identity Manager.
For more information about the MDS export utility, see "Using the Export Utility" in Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager.
Close all requests that are in pending state.
Any requests that are pending and not closed prior to upgrade may fail and may need to be resubmitted. A request is in pending state if the status is NOT one of "Request Closed", "Request Completed", "Request Withdrawn", "Request Failed" "Template Approval Rejected", "Request Approval Rejected", "Operation Approval Rejected", "Request Partially Failed", or "Request Completed with Errors".
To find all pending requests using the Administration Console:
Log in to the Advanced Administration Console as a user with "Request Administrators" role.
Run an advanced search for requests with the top level operator "Any" and with conditions "Request Status Not equals" with all of the statuses listed above.
Note:
This search cannot be limited to (or combined with) a specific request type.To find all pending requests using SQL, use the following command:
select request_id, request_status from request
where request_status not in ('Request Closed', 'Request Completed',
'Request Withdrawn', 'Request Failed',
'Template Approval Rejected',
'Request Approval Rejected',
'Operation Approval Rejected',
'Request Partially Failed',
'Request Completed with Errors');
Shut down the following servers running in the domain:
Administration Server for both Oracle Identity Manager and Oracle SOA Suite.
All Managed Servers for Oracle Identity Manager and Oracle SOA Suite.
Make sure you have patched your Oracle SOA Suite software to the latest version, as described in Section 6.1.5, "Patching Oracle SOA Suite 11.1.1.3.0 to 11.1.1.5.0 (Oracle Identity Manager Users Only)".
Run the Oracle Identity and Access Management 11g Release 1 (11.1.1.5.0) Patch Set Installer to patch your existing IAM_11.1.1.3.0_Home to the IAM_Home for Oracle Identity and Access Management 11.1.1.5.0, as described in Section 6.1.6, "Patching Oracle Identity and Access Management 11.1.1.3.0 to 11.1.1.5.0".
Run Patch Set Assistant (located in the bin directory inside the OIM_HOME) to update the following schema:
prefix_OIM: Oracle Identity Manager schema
Chapter 4, "Updating Your Schemas with Patch Set Assistant" contains information about using the Patch Set Assistant:
See Section 4.5.3, "Command Line Syntax" for the command line syntax.
See Section 4.5.5, "Sample Commands" for some sample commands.
Run Patch Set Assistant (located in the bin directory inside the SOA_HOME) to update the following schemas:
prefix_MDS: MDS schema
prefix_SOAINFRA: SOA Infrastructure schema
Note:
You must run the Patch Set Assistant once for each schema. Because of dependencies, you should run the Patch Set Assistant to update theprefix_MDS schema first, then run it a second time to update the prefix_SOAINFRA schema.Chapter 4, "Updating Your Schemas with Patch Set Assistant" contains information about using the Patch Set Assistant:
See Section 4.5.3, "Command Line Syntax" for the command line syntax.
See Section 4.5.5, "Sample Commands" for some sample commands.
Start the Administration Server and the SOA Managed Server.
Update Oracle Identity Manager mid-tier using the standalone utility as follows:
Set the following environment variables:
MW_HOME, WL_HOME, JAVA_HOME, OIM_HOME, and SOA_HOME
Where MW_HOME is the Middleware home that contains Oracle Identity Manager 11.1.1.5.0, WL_HOME is the WebLogic Server home directory, JAVA_HOME is the location of the JDK included in the installer, OIM_HOME is the location of IAM_11.1.1.5.0_Home directory, and SOA_HOME is the Oracle home directory for the SOA suite 11.1.1.5.0 installed on the machine.
Below are some sample values for your reference:
Table 6-1 Sample Environment variable Values
| Variable | Sample Value (UNIX operating systems) |
|---|---|
|
|
UNIX: Windows: |
|
|
UNIX: Windows: |
|
|
Windows: |
|
|
Windows: |
|
|
Windows: |
Create a directory for reporting and logging; you will be asked to specify this directory when you run the standalone utility.
From your present working directory, navigate to the IAM_11.1.1.5.0_Home/server/bin directory.
Run DW2PS1Upgrade.sh (on UNIX) or DW2PS1Upgrade.bat (on Windows).
Enter the following input values, when prompted:
Table 6-2 Input Required by Midtier Update Script
| Field/Input | Description |
|---|---|
|
|
Enter the WebLogic Server location ( |
|
|
Enter the absolute path to the Middleware home. |
|
|
Enter the absolute path to the |
|
|
Enter the path to the OIM domain. |
|
|
Enter the path to the directory (specified in Step b) where a report should be generated. |
|
|
Enter the connection string for the database that contains the OIM schema. |
|
|
Enter the OIM schema user name. |
|
|
Enter the OIM schema password. |
|
|
Enter the connection string for the database that contains the MDS schema. |
|
|
Enter the MDS schema user name. |
|
|
Enter the MDS schema password. |
|
|
Enter the host name of the machine where SOA Server is running. |
|
|
Enter the SOA server port. |
|
|
Enter the SOA server user name. |
|
|
Enter the SOA server password. |
|
|
Enter the Administration Server user name. |
|
|
Enter the Administration Server user password. |
Check the summary report for upgrade status printed on the terminal and proceed only if all the features are shown as successfully upgraded. A sample summary report is shown below:
************************************** Summary Report ************************************** Feature ID :Upgraded DW2PS1UPG.Scheduler:Y DW2PS1UPG.OES:Y DW2PS1UPG.OIMConfig:Y DW2PS1UPG.MDSNSUpdate:Y DW2PS1UPG.DBEncryption:Y ************************************** Upgrade Successful.OIM Server can be started ***************************************
You must see the OIM Server can be started message before you continue.
Verify the domain patching did not generate any errors.
Look for any error messages in the console. For example:
Error: addTemplate() failed. Do dumpStack() to see details.
Update Oracle Platform Security Services (OPSS) as follows:
Run the MW_HOME/oracle_common/common/bin/wlst.sh (on UNIX operating systems) or MW_HOME\oracle_common\common\bin\wlst.cmd (on Windows operating systems) command.
Connect to the Administration Server using the following command:
connect('weblogic_username', 'weblogic_password');
Run the following upgradeOpss WLST (online) command:
upgradeOpss(jpsConfig="existing_jps_config_file", jaznData="system_jazn_data_file")
Replace existing_jps_config_file with the full path to the location of the existing jps-config.xml file (usually DOMAIN_HOME/config/fmwconfig/jps-config.xml on UNIX operating systems or DOMAIN_HOME\config\fmwconfig\jps-config.xml on Windows operating systems.
Replace system_jazn_data_file with the full path to the location of the 11.1.1.5.0 system-jazn-data.xml file (usually MW_HOME/oracle_common/modules/oracle.jps_11.1.1/domain_config/system-jazn-data.xml on UNIX operating systems or MW_HOME\oracle_common\modules\oracle.jps_11.1.1\domain_config\system-jazn-data.xml on Windows operating systems).
Below is an example on a UNIX operating system:
upgradeOpss(jpsConfig=”DOMAIN_HOME/config/fmwconfig/jps-config.xml", jaznData="MW_HOME/oracle_common/modules/oracle.jps_11.1.1/domain_config/system-jazn-data.xml")
Note:
You may see error messages on the console when you run theupgradeOpss command. These errors can be safely ignored so long as there is some text indicating that your operation was completed successfully. For more information about the error messages, refer to the Oracle Fusion Middleware Release Notes.Re-start the Administration Server and the SOA Managed Server to apply your changes to the domain.
Run Oracle Identity Manager Managed Servers. In addition, navigate to the IAM_11.1.1.3.0_Home/server/logs directory to verify that the following directories are created after OIM 11.1.1.3.0 is updated to 11.1.1.5.0:
mergeDir
Report
sourceDir
targetDir
Access the OIM application by using the URL (http://host:port/oim).
Modify the RoleUserMembership.xml file as follows:
Export /db/identity/entity-definition/RoleUserMembership.xml from MDS schema.
For more information, see "Using the Export Utility" in Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager.
Add the following attribute definition:
<attribute name="request_key"> <type>string</type> <required>false</required> <searchable>false</searchable> <attribute-group>Basic</attribute-group> </attribute>
Import /db/identity/entity-definition/RoleUserMembership.xml back to the MDS schema.
Configure the Oracle Identity Manager Design Console, as described in Section 6.2.2, "Configuring Oracle Identity Manager Design Console".
The Oracle Identity Manager Design Console can be used to configure system settings that control the system-wide behavior of Oracle Identity Manager and affect its users. The Design Console allows you to perform user management, resource management, process management, and other administration and development tasks. For more information about the Design Console, see "Design Console Overview" in Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager.
Note:
Oracle Identity Manager Design Console must be installed inside a Middleware home. In addition, the Design Console must be outside the Oracle home where you installed Oracle Identity Manager (OIM_HOME). This means you must first run the Oracle WebLogic Server installer to create a new Middleware home before you install the Design Console.To install and configure the Design Console:
Make sure you have patched your environment to the latest version.
Make sure know the URL of your Oracle Identity Management server; you will be asked for this when you configure the Design Console.
Run the WebLogic Server installer to create a new Middleware home for the Design Console.
Run Oracle Identity and Access Management 11.1.1.5.0 Patch Set Installer and install the software, including the Design Console, in the new Middleware home. For example, if your existing Oracle Identity Management installation resides in MW_HOME1\Oracle_IDM1, you can install the Design Console in MW_HOME2\Oracle_IDM1).
Run the configuration tool from the location where you installed the Design Console (for example, MW_HOME2/Oracle_IDM1/bin/config.sh on UNIX operating systems or MW_HOME2\Oracle_IDM1\bin\config.bat on Windows operating systems) and configure the Design Console.
Build and copy the wlfullclient.jar file as follows:
Go to the MW_HOME2/wlserver_10.3/server/lib (on UNIX operating systems) or MW_HOME2\wlserver_10.3\server\lib (on Windows operating systems) directory.
Set the JAVA_HOME environment variable and add the JAVA_HOME variable to the PATH environment variable.
For example, you can set the JAVA_HOME to the jdk160_21 directory inside the Middleware home.
Run the following command to build the wlfullclient.jar file.
On UNIX operating systems:
java -jar MW_HOME2/modules/com.bea.core.jarbuilder_1.6.0.1.jar
On Windows operating systems:
java -jar MW_HOME2\modules\com.bea.core.jarbuilder_1.6.0.1.jar
Copy the wlfullclient.jar file to the new IAM_Home where you installed the Design Console. For example:
On UNIX operating systems:
cp MW_HOME2/wlserver_10.3/server/lib/wlfullclient.jar MW_HOME2/Oracle_IDM1/designconsole/ext
On Windows operating systems:
cp MW_HOME2\wlserver_10.3\server\lib\wlfullclient.jar MW_HOME2\Oracle_IDM1\designconsole\ext
Backup and delete the old designconsole directory in your IAM_HOME (in the case of this example, MW_HOME1/Oracle_IDM1/designconsole on UNIX operating systems, or MW_HOME1\Oracle_IDM1\designconsole on Windows operating systems).
If you want to install the Design Console without having to install a new WebLogic Server and Oracle Identity and Access Management, you can also
If you have enabled LDAP Sync in the Oracle Identity Manager 11.1.1.3.0 environment and the LDAP server is configured to enable referential integrity, then you must set the system property XL.isReferentialIntegrityEnabled to TRUE in Oracle Identity Manager after updating to Oracle Identity Manager 11.1.1.5.0. The default value for this property is FALSE.
Note:
If your Oracle Identity Manager 11.1.1.3.0 installation was not configured with LDAP Sync enabled, then LDAP Sync is not enabled when you update to Oracle Identity Manager 11.1.1.5.0. After the update, if you wish to enable LDAP Sync, you must set up LDAP Sync, as described in the "Enabling LDAP Synchronization" topic in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.If your Oracle Identity Manager 11.1.1.3.0 installation was configured with LDAP Sync enabled, then the LDAP Sync configuration is retained after you update to Oracle Identity Manager 11.1.1.5.0. The update process does not alter your previous LDAP Sync configuration.
Before you update Oracle Access Manager, make sure the update of Oracle Identity Manager is complete as described in Section 6.2, "Updating Oracle Identity Manager 11.1.1.3.0 to 11.1.1.5.0".
Information about updating Oracle Access Manager 11.1.1.3.0 to 11.1.1.5.0 are located in the following support note on the http://support.oracle.com website:
Procedure to Update OAM 11.1.1.3.0 to OAM 11.1.1.5.0 (Doc ID 1318524.1)
To migrate Oracle Adaptive Access Manager 11.1.1.3.0 to 11.1.1.5.0, complete the following steps:
Shut down the Administration Server (the Administration Server for the domain that contains Oracle Adaptive Access Manager 11.1.1.3.0) and the Oracle Adaptive Access Manager Managed Servers.
Run the WebLogic Server Upgrade Installer to patch your WebLogic Server installation to the latest version (10.3.5), as described in Patching Oracle WebLogic Server 10.3.3. to 10.3.5.
Run the Oracle Identity and Access Management 11g Release 1 (11.1.1.5.0) Patch Set Installer to patch your existing Oracle Identity and Access Management 11.1.1.3.0 installation (IAM_Home) to Oracle Identity and Access Management 11.1.1.5.0, as described in Patching Oracle Identity and Access Management 11.1.1.3.0 to 11.1.1.5.0.
Run Patch Set Assistant to update the following schemas:
prefix_OAAM: Oracle Adaptive Access Manager schema
prefix_OAAM_PARTN: Oracle Adaptive Access Manager partition schema
prefix_MDS: AS Common schema
For instructions, see Chapter 4, "Updating Your Schemas with Patch Set Assistant".
Extend the Oracle Adaptive Access Manager domain with the oracle.communications.client_template by running the Oracle Fusion Middleware Configuration Wizard as follows:
From the patched IAM_Home (11.1.1.5.0), run the Oracle Fusion Middleware Configuration Wizard (located at IAM_Home/common/bin/).
On the Welcome screen, select the Extend an existing WebLogic domain option. Click Next. The Select a WebLogic Domain Directory screen is displayed.
On the Select a WebLogic Domain Directory screen, select the domain that contains Oracle Adaptive Access Manager 11.1.1.3.0. Click Next. The Select Extension Source screen is displayed.
On the Select Extension Source screen, select the Extend my domain using an existing extension template option.
In the Template location field, click Browse, and select the following location:
IAM_Home/common/templates/applications/oracle.communications.client_template_11.1.1.jar
Continue by following the on-screen instructions. Select the Deployments and Services check box on the Select Optional Configuration screen. On the Target Deployments to Clusters or Servers screen, ensure that the oracle.sdp.client#11.1.1.@11.1.1 library is targeted to the oaam_server Managed Server in your domain or cluster.
Complete the domain extension process.
Start the Administration Server.
Perform this step only if you want to install Oracle Adaptive Access Manager Offline in your domain. Otherwise, skip this step.
Run IAM_HOME/common/bin/wlst.sh (on UNIX operating systems) or IAM_HOME\common\bin\wlst.cmd (on Windows operating systems).
Connect to the Administration Server using the following command:
connect('weblogic-username', 'weblogic-password');
Run the grantPermission WLST(online) command to create Oracle Adaptive Access Manager Offline Application grant to the out-of-the-box JPS common system-jazn-data.xml, as in the following example:
grantPermission(codeBaseURL="file:${domain.home}/servers/${weblogic.Name}/tmp/_WL_user/oaam_offline_11.1.1.3.0/-",
permClass="oracle.security.jps.service.credstore.CredentialAccessPermission",
permTarget="context=SYSTEM,
mapName=oaam,keyName=*"
,permActions="*")
Where
codeBaseURL= name of the grantee codebase URL.
permClass= class name of the permission being granted.
permTarget= target part of the permission that is being granted.
permActions= permission actions that are being granted.
The system-jazn-data.xml file is located in the DOMAIN_HOME/config/fmwconfig (on UNIX operating systems) or DOMAIN_HOME\config\fmwconfig (on Windows operating systems) directory.
Exit WLST.
From the patched IAM_Home (11.1.1.5.0), run the Oracle Fusion Middleware Configuration Wizard (located at IAM_Home/common/bin/).
On the Welcome screen, select the Extend an existing WebLogic domain option. Click Next. The Select a WebLogic Domain Directory screen is displayed.
On the Select a WebLogic Domain Directory screen, select the domain that contains Oracle Adaptive Access Manager 11.1.1.3.0. Click Next. The Select Extension Source screen is displayed.
On the Select Extension Source screen, select the Oracle Adaptive Access Manager Offline - 11.1.1.3.0 option.
Continue by following the on-screen instructions. Complete the domain extension process. The domain with Oracle Adaptive Access Manager is extended to support Oracle Adaptive Access Manager Offline.
Restart the Administration Server.
Undeploy and redeploy the oaam.extensions library through the WebLogic Server Administration Console as follows:
Log in to the WebLogic Server Administration Console.
Under Domain Structure, click Deployments. The Summary of Deployments page is displayed.
Select the oracle.oaam.extensions library, and click Delete.
Deploy the library by clicking Install. The Install Application Assistant page is displayed.
Select the following application to install:
IAM_Home/oaam/oaam_extensions/generic/oracle.oaam.extensions.war
Install this application as a library.
Select all Managed Servers hosting oaam_admin, oaam_server, and oaam_offline as the deployment targets for this application.
For Source Accessibility, select the I will make the deployment accessible from the following location option. This option sets the staging mode to nostage.
Complete the deployment of the library.
Start all Managed Servers hosting oaam_admin, oaam_offline, and oaam_server.
Optional: If you have customized the jazn-data permissions of oaam_admin, you should back up these changes by using the OPSS WLST migrateSecurityStore command. For instructions, see the "Migrating with the Script migrateSecurityStore" topic in the Oracle Fusion Middleware Application Security Guide.
Redeploy oaam_admin, which overwrites the security policies of oaam_admin with the jazn-data.xml that is packaged in the Oracle Identity and Access Management 11.1.1.5.0 oaam_admin's ear. To do so, complete the following steps:
Ensure that the Managed Server hosting oaam_admin is up and running.
Log in to the WebLogic Server Administration Console.
Under Domain Structure, click Deployments. The Summary of Deployments page is displayed.
Select oaam_admin, and click Update.
Complete the redeployment steps.
Optional: If you had customized permissions for oaam_admin before migrating to Oracle Adaptive Access Manager 11.1.1.5.0, you must redo them after migrating to 11.1.1.5.0. You should use the backup that you took in Step 10. You can modify jazn-data.xml and use OPSS WLST commands.
To update Oracle Identity Navigator 11.1.1.3.0 to 11.1.1.5.0, complete the following steps:
On the machine where Oracle Identity Navigator 11.1.1.3.0 is installed, export the Oracle Identity Navigator metadata to an export directory using WLST as follows:
Run wlst.sh (located at IAM_Home/common/bin).
Connect to the Administration Server using the following command:
connect('weblogic-username', 'weblogic-password');
Run the following WLST (online) command:
exportMetadata(application='oinav',server='AdminServer',toLocation='export_directory')
export_directory is the directory where you want to export Oracle Identity Navigator metadata to.
Stop the WebLogic Administration Server (the Administration Server for the domain where Oracle Identity Manager is installed and configured) and the Oracle Identity Navigator Managed Server.
Run the WebLogic Server Upgrade Installer to patch your WebLogic Server installation to the latest version (10.3.5), as described in Patching Oracle WebLogic Server 10.3.3. to 10.3.5.
Run the Oracle Identity and Access Management 11g Release 1 (11.1.1.5.0) Patch Set Installer to patch your existing Oracle Identity and Access Management 11.1.1.3.0 installation (IAM_Home) to Oracle Identity and Access Management 11.1.1.5.0, as described in Patching Oracle Identity and Access Management 11.1.1.3.0 to 11.1.1.5.0.
After the patching is complete, start the WebLogic Administration Server (the Administration Server for the domain that contains Oracle Identity Navigator).
Log in to the WebLogic Server Administration Console.
Under Domain Structure, click Deployments. The Summary of Deployments page is displayed.
Select oinav, and click Update.
Alternatively, you can use the redeploy('oinav#11.1.1.3.0') WLST command to update the Oracle Identity Navigator application. Exit the WebLogic Server Administration Console.
Import Oracle Identity Navigator metadata by running the following WLST command:
importMetadata(application='oinav',server='AdminServer',fromLocation='export_directory')
export_directory is the directory where you previously exported Oracle Identity Navigator metadata to.
This section describes how to patch your existing Oracle Identity and Access Management 11.1.1.3.0 installation in a clustered environment to 11.1.1.5.0. The procedures in this section are based on a two node cluster as described below:
Node 1: Administration Server, OIM Managed Server, SOA Managed Server
Node 2: OIM Managed Server, SOA Managed Server
Any additional nodes in your cluster should be patched using the instructions in Section 6.6.2, "Upgrading Node 2".
If Node 1 and Node 2 do not share a disk, then the directory structure for each node's Middleware home, Oracle home, and Domain home are identical.
For more information about deploying Oracle Identity Management in an enterprise environment, refer to the Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management.
To upgrade Node 1 in the cluster, follow the instructions in Section 6.2, "Updating Oracle Identity Manager 11.1.1.3.0 to 11.1.1.5.0".
To upgrade Node 2 in the cluster, follow the instructions below:
Back up the Oracle Identity Manager 11.1.1.3.0 domain, and your Oracle Identity Manager and Oracle SOA Suite binaries.
Shut down all Managed Servers for Oracle Identity Manager and Oracle SOA Suite that are running in the domain.
If your Oracle WebLogic Server, Oracle Identity Management, and Oracle SOA Suite binaries are NOT at a shared location, perform the following steps. Otherwise, skip to Step 4.
Patch Oracle WebLogic Server as described in Section 6.1.4, "Patching Oracle WebLogic Server 10.3.3. to 10.3.5".
Update your Oracle SOA Suite software as described in Section 6.1.5, "Patching Oracle SOA Suite 11.1.1.3.0 to 11.1.1.5.0 (Oracle Identity Manager Users Only)".
Update your Oracle Identity and Access Management software as described in Section 6.1.6, "Patching Oracle Identity and Access Management 11.1.1.3.0 to 11.1.1.5.0".
Run the following command to pack your domain on Node 1:
On UNIX operating systems:
cd MW_HOME/oracle_common/common/bin ./pack.sh -domain=OIM_Domain_Home -template=Domain_Configuration_Jar_Destination -template_name="template_nanme" -managed=true
On Windows operating systems:
cd MW_HOME\oracle_common\common\bin pack.cmd -domain=OIM_Domain_Home -template=Domain_Configuration_Jar_Destination -template_name="template_nanme" -managed=true
Replace OIM_Domain_Home with the full path to your OIM domain, Domain_Configuration_Jar_Destination with the full path to the location where you want to create your domain configuration .jar file, and template_name with the name of this domain configuration template.
Below is an example on UNIX operating systems:
./pack.sh -domain=/home/Oracle/Domains/11.1.1.3.0_OIMDomain -template=/home/Oracle/Data -template_name="OIM Domain" -managed=true
On Windows operating systems:
pack.cmd -domain=D:\Oracle\Domains\11.1.1.3.0_OIMDomain -template=D:\Oracle\Data -template_name="OIM Domain" -managed=true
Unpack the domain configuration information on Node 2.
On UNIX operating systems:
cd MW_HOME/oracle_common/common/bin ./unpack.sh -domain=OIM_Domain_Home -template=Domain_Configuration_Jar_Location -overwrite_domain=true
On Windows operating systems:
cd MW_HOME\oracle_common\common\bin pack.cmd -domain=OIM_Domain_Home -template=Domain_Configuration_Jar_Location -overwrite_domain=true
Replace OIM_Domain_Home with the full path to your OIM domain on Node 2, and Domain_Configuration_Jar_Location with the full path to the location where you want created your domain configuration .jar file on Node 1.
Below is an example on UNIX operating systems:
./unpack.sh -domain=/home/Oracle/Domains/11.1.1.3.0_OIMDomain -template=/home/Oracle/Data -overwrite_domain=true
On Windows operating systems:
pack.cmd -domain=D:\Oracle\Domains\11.1.1.3.0_OIMDomain -template=D:\Oracle\Data -overwrite_domain=true
Note:
The domain directory structures must be identical on both nodes.Go to the OIM_HOME/server/bin (on UNIX operating systems) or OIM_HOME\server\bin (on Windows operating systems) directory and edit the dwps1upgrade.properties file so that all properties EXCEPT for oim.ps1.soacomposite.patch are set to false.
Start the SOA Managed Server on Node 2. This is required to deploy SOA composites on Node 2.
Run the standalone utility as described in Step 9 in Section 6.2.1, "Instructions for Updating Oracle Identity Manager".
Check to see if any login module .jar files are found in the MW_HOME/wlsserver_10.3/server/lib/mbeantypes (on UNIX operating systems) or MW_HOME\wlsserver_10.3\server\lib\mbeantypes (on Windows operating systems) directory in your Release 11.1.1.3.0 environment. If there are no files, you can skip this step.
If there are, copy the following login module files from OIM_HOME/server/loginmodule/wls to MW_HOME/wlsserver_10.3/server/lib/mbeantypes (on UNIX operating systems) or from OIM_HOME\server\loginmodule\wls to MW_HOME\wlsserver_10.3\server\lib\mbeantypes (on Windows operating systems):
OIMAuthenticator.jar
oimmbean.jar
oimsigmbean.jar
oimsignaturembean.jar
Start the OIM Managed Server on Node 2.
Access the OIM application by using the URL (http://host:port/oim).