Release Notes for Oracle Insurance Gateway Patch 3.21.3.0.4

This document contains the release notes for Oracle Insurance Gateway Patch 3.21.3.0.4.

Version compatibility: Oracle Insurance Gateway Release 3.21.3.x is only compatible with other Oracle Health Insurance applications release version 3.21.3.x unless explicitly stated otherwise.

In accordance with the OHI error correction policy (Document 1494031.1 on My Oracle Support), error correction support will be provided for this release and the previous two releases.

Enhancements

ID	Summary	Description	Included in Patch
NXT-21416	Use Vault as alternative secrets store with WebLogic deployments	Next to Fusion Middleware / WebLogic Oracle Platform Security Services (OPSS), OHI applications also support HashiCorp Vault as alternative secrets store. See the Installation Guide for details.
OIG-2218	Reduce the number of REST clients	With this enhancement, the rest-client ID used for rest destination will be the destination code instead of the <integration_code>-<integration-step-code> leading to more optimal use of costly rest-client objects.

Summary

Description

Included in Patch

NXT-21416

Use Vault as alternative secrets store with WebLogic deployments

Next to Fusion Middleware / WebLogic Oracle Platform Security Services (OPSS), OHI applications also support HashiCorp Vault as alternative secrets store. See the Installation Guide for details.

OIG-2218

Reduce the number of REST clients

With this enhancement, the rest-client ID used for rest destination will be the destination code instead of the <integration_code>-<integration-step-code> leading to more optimal use of costly rest-client objects.

Upgrade Steps for Installation

To perform the upgrade, perform the following steps:

Perform any pre-upgrade steps.
Stop all the managed nodes running the .existing version of the application.
Perform any pre-undeploy steps.
Undeploy the existing version of the application.
Back up the database.
Perform any post-undeploy steps.
Unpack the release bundle into a directory that we refer to as OHI_ROOT from now on.
Change Installation Configuration: In <OHI_ROOT>/util/install, make a copy of ohi_install.cfg.template and name it ohi_install.cfg.
Edit ohi_install.cfg to contain your specific database connection data and other configuration settings. The settings are explained in the file itself.
Make sure NO connections are present to the database using the OHI_xxx_USER account (where xxx is the abbreviation of the application)
Run the Upgrade script:
1. Open a command window and browse to <OHI_ROOT>/util/install.
2. Run the upgrade by executing ./ohi-update.sh .
Make the required changes to the ohi properties file
Perform any post-upgrade steps
Start WebLogic application server
Deploy the Application
Perform any post-deploy steps

Additional Upgrade Steps for Installation

The following phases are defined:

pre-upgrade: Application is still running
pre-undeploy: Application is stopped, but not undeployed.
post-undeploy: Application is undeployed. Database is backed up
post-upgrade: Released upgrade script has run.
post-deploy: New application is deployed and is up and running.

Stage: pre-upgrade

Action: execute the following query to find future duplicates

select usrs.login_name
,      dupes.alias
from   ohi_users usrs
,      ohi_user_preferences uspr
,      (select uspr_id
        ,      alias
        from   ohi_bookmarks
        group  by uspr_id
        ,      alias
        having count(*) > 1
       ) dupes
where  uspr.id = dupes.uspr_id
and    usrs.id = uspr.usrs_id

This query lists bookmark aliases per user that have more than one occurrence and will violate the new unique contraint. Update the alias of the violations such that there are no more duplicates

Configuration Properties

Ref	Action	Subject	Description
NXT-21416	Added	ohi.vault.environment.identifier	To distinguish secrets on a per OHI application instance basis
NXT-21416	Added	ohi.secure.secrets.store	The type of store the OHI application uses for secrets
NXT-21416	Added	ohi.vault.kv.secrets.engine	By default, OHI applications assume that Vault’s Key-Value secrets engine is enabled at root path "secret"
NXT-21416	Added	ohi.vault.address	Vault address. Must use HTTPS
NXT-21416	Added	ohi.vault.namespace	OHI specific Vault namespace section, under the path determined by properties ohi.vault.kv.secrets.engine/ohi.vault.namespace to look for secrets
NXT-21416	Added	ohi.vault.token	Vault token
NXT-21416	Added	ohi.vault.clientpem.url	Resource URL to Vault Client pem
NXT-21416	Added	ohi.vault.pem.url	Resource URL to Vault pem
NXT-21416	Added	ohi.vault.clientkeypem.url	Resource URL to Vault Client Key pem

Ref

Action

Subject

Description

NXT-21416

Added

ohi.vault.environment.identifier

To distinguish secrets on a per OHI application instance basis

NXT-21416

Added

ohi.secure.secrets.store

The type of store the OHI application uses for secrets

NXT-21416

Added

ohi.vault.kv.secrets.engine

By default, OHI applications assume that Vault’s Key-Value secrets engine is enabled at root path "secret"

NXT-21416

Added

ohi.vault.address

Vault address. Must use HTTPS

NXT-21416

Added

ohi.vault.namespace

OHI specific Vault namespace section, under the path determined by properties ohi.vault.kv.secrets.engine/ohi.vault.namespace to look for secrets

NXT-21416

Added

ohi.vault.token

Vault token

NXT-21416

Added

ohi.vault.clientpem.url

Resource URL to Vault Client pem

NXT-21416

Added

ohi.vault.pem.url

Resource URL to Vault pem

NXT-21416

Added

ohi.vault.clientkeypem.url

Resource URL to Vault Client Key pem