Oracle Waveset 8.1.1 Release Notes

Chapter 5 Installation and Upgrade Notes

This section provides information related to installing or updating Oracle Waveset. The information is organized as follows:

Oracle Waveset Upgrade Paths

This section provides information about the upgrade paths that you should follow when upgrading to Oracle Waveset 8.1.1.

Determining Your Upgrade Path

Use the following table to determine the upgrade path you must follow when upgrading to a newer version of Oracle Waveset.

In the left-most column find the version of Sun Identity Manager that you currently have installed.
In the top row find the version of the software that you want to upgrade to (the target version).
Find the intersection between your currently installed version and the target version.

The intersection specifies the upgrade path you must follow.

Figure 5–1 Oracle Waveset Upgrade Path Matrix

Find the intersection between your currently installed
version and the target version. The intersection specifies the upgrade path
you must follow.

To determine your upgrade path, find the intersection between the version that you currently have installed and the version that you want to upgrade to. For example, if you currently have version 7.1.1 installed and you want to upgrade to version 8.1.1, you first need to install version 8.1 followed by version 8.1.1.

Note –

For information about skip-level upgrades, see Chapter 6, Skip-Level Upgrade Considerations, in Oracle Waveset 8.1.1 Upgrade.
When upgrading Oracle Waveset, you do not have to install Updates (formerly called Service Packs or SPs) within a major release to upgrade to the next major release. For example, when upgrading from Sun Identity Manager 5.0 to 6.0, you do not have to install any of the 5.0 Service Packs.
Updates for a major release are cumulative. After upgrading to the major release, you can install the latest Update without having to install all of the Updates (or Service Packs) for that release. For example, if you upgraded to Sun Identity Manager 5.0, installing SP6 gives you all of the functionality provided in SP1 through SP5.
Sun Identity Manager Installation Pack 2005Q4M3 (version 6.0) was a major release. If you are upgrading from a pre-6.0 version of Identity Manager, Identity Auditor, or Sun Identity Manager Service Provider, you must upgrade to Sun Identity Manager Installation Pack 2005Q4M3 before advancing to later releases.

Upgrade Notes

This section contains information and known issues related to upgrading to Oracle Waveset 8.1.1 from Sun Identity Manager versions 6.0, 7.0, 7.1, 7.1.1, 8.0, and 8.1.

The information in this section is organized as follows:

Before you Begin

Be aware of the following information before starting the upgrade process:

See Oracle Waveset 8.1.1 Upgrade for comprehensive upgrade instructions.
If you upgrade your JDK or JRE, you must use a JDK or JRE supplied by the same vendor as your previous JDK. For example, do not install a Sun JDK if previously you were using a JDK from IBM. If you mix JDKs from different vendors, data encrypted under a previous JDK cannot be read by a JDK from another vendor. (ID-17800)
Upgrade Identity Manager in the following order:
1. Upgrade all Identity Manager server instances and Gateway instances
2. Upgrade all PasswordSync instances
The 8.1.1 version of Oracle Waveset server provides limited, temporary support for older versions of PasswordSync. This support is provided so that older versions of Identity Manager can continue to run while you upgrade your PasswordSync instances. All instances of PasswordSync should be updated to the same version as the Oracle Waveset server as soon as possible.
When uninstalling PasswordSync, use the add/modify programs feature from the Windows Control Panel to ensure correct removal. You must reboot after uninstalling.

When installing PasswordSync, use the appropriate binary file for the operating system on which you are installing. The binary for 32-bit Windows is called IdmPwSync_x86.msi and the binary for 64-bit Windows is called IdmPwSync_x64.msi. After each PasswordSync installation you must reboot.
Be sure to use only one Oracle Waveset server to import update.xml.
During an upgrade, only one Oracle Waveset/Sun Identity Manager server should be running. If you start any other Oracle Waveset servers during the upgrade, you must stop and restart those servers before making them available. Note that changes to RepositoryConfiguration do not affect an Oracle Waveset server until you restart that server.
If the upgrade process fails to log in with the default configurator account and password, the log file logs the error, but does not log anything after the error. (ID-18929)

The update.xml file is imported during the upgrade process. The import attempts to log in as configurator with the default password. If the login fails, an error is displayed, and the upgrade program prompts you for the correct login information. If you provide the correct information, the upgrade continues. When looking through the log file for the upgrade process, you can see the error message when the default log in fails, but you do not see any further information about the upgrade in the log file. This issue does not affect the upgrade, only the log file.
If your current Identity Manager installation has a large amount of custom work, consider contacting Professional Services for assistance with planning and executing your upgrade.
When running Oracle Waveset on multiple physical servers, the servers' system clocks must be synchronized. Each Oracle Waveset server regularly issues a timestamped “heartbeat” to the Oracle Waveset repository. If any server observes that another server's heartbeat is too old (by default five minutes), then it will mark that server as “recovered” and mark all tasks currently executing on that server as terminated. Proper Oracle Waveset operation requires that all server clocks be synchronized to within five minutes of each other, and preferably within one minute. (ID-22418)

Upgrade Notes if you are Upgrading From Version 6.0

If planning a skip-level upgrade, be sure to also review the upgrade notes in the following sections. Upgrade notes for subsequent versions of Identity Manager also apply to your upgrade.

If you are upgrading from an Identity Manager version 6.x installation and you want to start using the new Oracle Waveset end-user pages, you must manually change the system configuration ui.web.user.showMenu to true for the horizontal navigation bar to display. (ID-14901)

Also, if you want the new end-user dashboard to display on the end-user home page, you must manually change the end-user form mapping for Form Type endUserMenu. Go to Configure > Form and Process Mapping > for Form Type ’endUserMenu’. Change the Form Name Mapped To to be End User Dashboard.

You should also update the mapping for Form Type endUserWorkItemListExt. Change the Form Name Mapped To to be End User Approvals List.
If you are upgrading from version 6.0 and using LocalFiles, you must export all of your data before upgrading and then re-import the data after doing a clean installation of 8.1. (ID-15366)

Upgrade Notes if you are Upgrading From Version 7.0

If planning a skip-level upgrade, be sure to also review the upgrade notes in the following sections. Upgrade notes for subsequent versions of Identity Manager also apply to your upgrade.

If you are upgrading from version 7.0 and using LocalFiles, you must export all of your data before upgrading and then re-import the data after doing a clean installation of 8.1. (ID-15366)
There may be ItemNotFound Exceptions in the upgrade log due to Identity Manager Service Provider Edition (SPE) objects being renamed to Identity Manager Service Provider. (ID-18860)
If your installation contains a Remedy resource, you must place Remedy API libraries in the directory where the Gateway is installed. These libraries can be found on the Remedy server.

Table 5–1 Remedy API Libraries


Remedy 4.x and 5.x	Remedy 6.3	Remedy 7.0
`arapiXX.dll` `arrpcXX.dll` `arutlXX.dll` where `XX` matches the version of Remedy. For example, `arapi45.dll` on Remedy 4.5.	`arapi63.dll` `arrpc63.dll` `arutl63.dll` `icudt20.dll` `icuin20.dll` `icuuc20.dll`	`arapi70.dll` `arrpc70.dll` `arutl70.dll` `icudt32.dll` `icuin32.dll` `icuuc32.dll`

Upgrade Notes if you are Upgrading From Version 7.1

If planning a skip-level upgrade, be sure to also review the upgrade notes in the following sections. Upgrade notes for subsequent versions of Identity Manager also apply to your upgrade.

As of version 7.1.1, Sun Identity Manager User Extended Attributes fully support multi-valued attributes. (ID-14863)

Note –
You can add a multi-valued user extended attribute to the accounts list table, and it will render the list without error. However, attempting to sort on that column will yield the following error:
```
java.lang.ClassCastException: java.util.ArrayList
```
An attribute condition that refers to a multi-valued extended attribute will evaluate correctly for a user object only after that user object has been re-serialized. If you want such an attribute condition to evaluate correctly for all user objects, then you must re-serialize all user objects. See Refreshing User Objects in the following section for instructions.

Refreshing User Objects

Certain types of changes require an administrator to refresh all User objects. For example, you must refresh all User objects when you change the inline attributes for Type.USER in RepositoryConfiguration. Whenever you mark an attribute as queryable or summary in the IDMSchemaConfiguration object, you must refresh all User objects for the change to affect older, unmodified objects. The same logic applies when a new version of Identity Manager or Oracle Waveset adds a new attribute, or when a new version of Identity Manager or Oracle Waveset changes the values of an existing attribute— the upgrade process or an administrator must refresh all User objects for the change to affect older, unmodified objects.

There are three ways to reserialize existing users:

Modify an individual User object during normal operations.

For example, opening a user account through the user interface and saving it with or without modifications.

Disadvantage: This method is time-consuming, and the administrator must be meticulous to ensure all existing users are reserialized.
Use the lh refreshType utility to reserialize all users. The refreshType utility’s output is a refreshed list of users.

lh console

refreshType User

Disadvantage: Because the refreshType utility runs in the foreground and not the background, this process can be time-consuming. If you have a lot of users, reserializing them all takes a long time.
Use the Deferred Task Scanner.

Note –
Before running the Deferred Task Scanner process, you must edit the System Configuration object using the Sun Identity Manager Integrated Development Environment (IDE) or some other method.

Search for ’refreshOfType’ and remove the attributes for ’2005Q4M3refreshOfTypeUserIsComplete’ and ’2005Q4M3refreshOfTypeUserUpperBound’.

After editing the System Configuration object, you must import that object to repository for your changes to be present.

Disadvantage: This method causes the next Deferred Task Scanner run to take a long time because it examines and rewrites almost every User object. However, subsequent Deferred Task Scanner runs should execute at normal speed and duration.

Upgrade Notes if you are Upgrading From Version 7.1.1

If planning a skip-level upgrade, be sure to also review the upgrade notes in the following sections. Upgrade notes for subsequent versions of Identity Manager also apply to your upgrade.

If you are using an Oracle repository, the Sun Identity Manager 8.0 and 8.1 and Oracle Waveset repository DDL uses data types that are not properly handled by older Oracle JDBC drivers. The JDBC drivers in ojdbc14.jar do not properly read all of the columns in the log table.

You must upgrade to the ojdbc5.jar for JDK 5 drivers for Oracle Waveset to work properly.
Upgrading automatically converts the User Extended Attributes object and QueryableAttrNames and SummaryAttrNames elements of the UserUIConfig object into the IDM Schema Configuration object. (ID-17784)

The sample update.xml script contains an import command that invokes IDMSchemaConfigurationUpdater to convert legacy user schema configuration objects. Successful conversion of legacy user schema configuration objects performs the following:
- Creates within IDM Schema Configuration an IDMObjectClassAttribute element for each extended attribute name from User Extended Attributes.
- Flags as ”summary’ any IDMObjectClassAttribute that corresponds to each value from the SummaryAttrNames element within UserUIConfig.
- Flags as ”queryable’ any IDMObjectClassAttribute that corresponds to each value from the QueryableAttrNames element within UserUIConfig.
- Empties the SummaryAttrNames element within UserUIConfig.
- Empties the QueryableAttrNames element within UserUIConfig.
- Renames any extended attribute named objectClass to spml2ObjectClass. Starting in version 8.0, legacy attributes named objectClass conflict with a core attribute in the Identity Manager schema.
Identity Manager 8.0 dedicated some new tables for Roles objects. You must use the sample scripts provided in the db_scripts directory to make the schema changes, create the new table structures, and move your existing data.

Tip –
- Before updating the repository database table definitions, make a full backup of your repository tables.
- Refer to the db_scripts/upgradeto8.0from71.DBMSName script for more information.
Be careful when you edit the super role field in the Role form because the super role itself may be a nested role. The super roles and subroles fields indicate a nesting of roles and their associated resources or resource groups. When applied to a user, the super role includes the resources associated with any designated subrole. The super role field is displayed to indicate the roles that include the displayed role.

During the upgrade process, Oracle Waveset analyzes all roles on the system and then updates any missing subroles and super roles links using the RoleUpdater class.

To check and upgrade roles outside of the upgrade process, you can import the new RoleUpdater configuration object that is provided in sample/forms/RoleUpdater.xml.

For example:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Waveset PUBLIC 'waveset.dtd' 'waveset.dtd'>
<Waveset>
  <ImportCommand class='com.waveset.session.RoleUpdater' >
    <Map>
      <MapEntry key='verbose' value='true' />
      <MapEntry key='noupdate' value='false' />
      <MapEntry key='nofixsubrolelinks' value='false' />
    </Map>
  </ImportCommand>
</Waveset>

Where:

verbose: Provides verbose output when updating roles. Specify false to enable a silent update of roles.
noupdate: Determines whether the roles are updated. Specify false to get a report that only lists which roles will be updated.
nofixsubrolelinks: Determines whether super roles are updated with missing subrole links. This value is set to false by default and links will be repaired.

Administrators who need to view or edit the Oracle Waveset schema for Users or Roles must be in the IDM Schema Configuration AdminGroup and must have the IDM Schema Configuration capability.
The SPML 2.0 implementation in Oracle Waveset changed in Sun Identity Manager 8.0. In previous releases, the SPML objectclass attribute used in SPML messages was mapped directly to the objectclass attribute of Identity Manager User objects. The objectclass attribute is now mapped internally to the spml2ObjectClass attribute and is used internally for other purposes.

During the upgrade process the objectclass attribute value is automatically renamed for existing users. If your SPML 2.0 configuration contains forms that reference the objectclass attribute, you must manually change those references to spml2ObjectClass.

Oracle Waveset does not replace the sample spml2.xml configuration file during an upgrade. If you used the spml2.xml configuration file as a starting point, be aware that this file contains a form with references to objectclass that you must change to spml2ObjectClass. Change the objectclass attribute in forms (where it is used internally), but do not change the objectclass attribute in the target schema (where the attribute is exposed externally).
When you upgrade Oracle Waveset, any custom code that calls UserUIConfig#getRepoIndexAttributes() must be removed or changed to call Type.USER#getInlineAttributeNames(). (ID-18051)

Importing update.xml converts the values from the UserUIConfig RepoIndexAttrs into values of XML attributes on the TypeDataStore element for Type.USER within the RepositoryConfiguration object. The update.xml file includes the UserUIConfigUpdater.xml file, which contains an import command that invokes UserUIConfigUpdater to convert RepoIndexAttrs. Conversion also sets a flag in SystemConfiguration that inhibits reconversion.

Any future changes to the inline attributes for Type.USER should be made by editing the RepositoryConfiguration object. If you change the inline attributes for Type.USER, you generally must refresh all Type.USER objects.

Note –
Changes to RepositoryConfiguration do not affect an Oracle Waveset server until you restart that server.

Upgrade Notes if you are Upgrading From Version 8.0

Sun Identity Manager 8.0 changed the display method of charts and graphs in reports. Reports created prior to version 8.0 display as expected in the version 8.0 release. These reports, however, will not display properly in Oracle Waveset 8.1.1. A deprecation notice regarding this issue appeared in the Sun Identity Manager Release Notes, Version 8.0 May 2008. (ID-17636)
Forms and workflows that use the SaveNoValidate action will need to be added to the new saveNoValidateAllowedFormsAndWorkflows list. (ID-19115)

Whitelist functionality added in Sun Identity Manager 8.1 checks forms and workflows that use the SaveNoValidate action against a list of IDs of form names. The saveNoValidateAllowedFormsAndWorkflows list is located in the security attribute in the System Configuration object. With this update, if the form name or owner ID is on the whitelist, the form or workflow can use the SaveNoValidate action. If the form name or the owner ID is not on the list, the form or workflow is processed using a Save action.

To obtain the IDs or form names for forms and workflows that use the SaveNoValidate action, check the system log or turn on trace level 4 for com.waveset.ui.util.GenericEditForm and submit any custom forms or workflows that use SaveNoValidate. A warning including the ID will be logged.

Note –
If you add a form name to the whitelist, be sure that the name attribute for the form is set, otherwise you will see the following error message:
```
SaveNoValidate on null processed as Save because it is not
 in the saveNoValidateAllowedFormsAndWorkflows list.
```

Upgrade Notes if you are Upgrading From Version 8.1

Review the Installation Notes if you are upgrading to Oracle Waveset on a 64–bit system.
The wfexternalpolicy.xml file has changed. If you previously customized your workflows for external policy checks, you may need to merge your workflows with the updated workflow. For details, see Oracle Identity Analytics / Oracle Waveset Integration. (ID-22104)
If you are running Oracle Waveset on the WebLogic application server, and either Oracle Waveset is integrated with Oracle Identity Analytics, or you are using the SAP Web Services adapter, then the Metro web service libraries need to be installed. For details, see Step 5: Install the Metro Libraries (optional) in Oracle Waveset Installation. (ID-22628)

Installation Notes

Note –

Refer to Oracle Waveset Installation for detailed product installation instructions.

On 64–bit AIX systems, the Oracle Waveset installer will halt with the error “attach to native process failed” if run using an IBM JVM supplied with either WebSphere 7.0 Fix Pack 5 (7.0.0.5) or Fix Pack 7 (7.0.0.7). To fix this issue, install Fix Pack 9.

Note that the os.arch=ppc property must be set when performing an upgrade installation of Oracle Waveset on 64–bit AIX systems. See the following bullet point for details. (ID-22285)
The Oracle Waveset installer may not run with a 64-bit JDK. (ID-18534)

Workarounds:
- Install manually.
- Use a 32-bit version JDK to run the installer.
- Set os.arch=ppc by setting JAVA_OPTS (used by the install script) to get through the install. For example,
  export JAVA_OPTS="-Dos.arch=ppc" install
- Or, if JAVA_OPTS already contains needed options:
  export JAVA_OPTS="$JAVA_OPTS -Dos.arch=ppc" install
When installing Oracle Waveset do not mix JDKs from different vendors . For example, if you are running Identity Manager using the IBM JDK on WebSphere, use the IBM JDK to install Identity Manager. Do not use JDKs from different vendors because data encrypted under one JDK cannot be read by a JDK from another vendor. (ID-17800)
When running Oracle Waveset on multiple physical servers, the servers' system clocks must be synchronized. Each Oracle Waveset server regularly issues a timestamped “heartbeat” to the Oracle Waveset repository. If any server observes that another server's heartbeat is too old (by default, five minutes), then it will mark that server as “recovered” and mark all tasks currently executing on that server as terminated. Proper Oracle Waveset operation requires that all server clocks be synchronized to within five minutes of each other, and preferably within one minute. (ID-22418)