1. Upgrading Oracle Identity Manager
  2. Pre-Upgrade Requirements

2 Pre-Upgrade Requirements

Before you begin to upgrade Oracle Identity Manager 12c (12.2.1.3.0), you must perform pre-upgrade tasks such as backing up, cloning your current environment, and verifying that your system meets certified requirements.

Oracle Fusion Middleware Pre-Upgrade Checklist

Perform the tasks in this checklist before you begin any upgrade to ensure you have a successful upgrade and limited downtime.

Upgrades are performed while the servers are down. This checklist identifies important and often time-consuming pre-upgrade tasks that you can perform before the upgrade to limit your downtime. The more preparation you do before you begin the upgrade process, the less time you will spend offline.

Note:

The pre-upgrade procedures you perform will depend on the configuration of your existing system, the components you are upgrading, and the environment you want to create at the end of the upgrade and configuration process. Complete only those tasks that apply to your configurations or use cases.

Ensure that Oracle Identity Manager and Oracle Access Manager are in different domains. If they are in the same domain, then you need to separate them into multiple domains. For more information, see Separating Oracle Identity Management Applications Into Multiple Domains.

Table 2-1 Tasks to Perform Before You Upgrade to Oracle Fusion Middleware 12c

Task Description

Required

Create a complete backup of your existing environment.

Back up all system-critical files, including the Oracle home, Middleware home, and databases that contain any schemas that are to be upgraded. If the upgrade fails, you must restore your pre-upgrade environment and begin the upgrade again.

See Creating a Complete Backup.

Optional

Clone your production environment to use as an upgrade testing platform.

In addition to creating a complete backup of your system files, Oracle strongly recommends that you clone your production environment. This environment can be used to test the upgrade.

See Cloning Your Environment for Testing.

Required

Verify that you are installing and upgrading your product on a supported hardware and software configuration.

Caution: Do not attempt an upgrade if you are unable to use the latest supported operating system. As with all supported configurations, failure to comply with these requirements may cause your upgrade to fail.

Verify that your hardware and software configurations (including operating systems) are supported by the latest certifications and requirements. Also make sure to use a supported JDK version before you install the 12c product distributions.

Oracle recommends that: you verify this information right before you start the upgrade as the certification requirements are frequently updated.

Note:
  • Ensure that you have applied the latest patches to your components before you upgrade.
  • Upgrade a component at a time, be it an Oracle Component or a dependent component. For example. Do not upgrade OUD, OIM, OAM, the operating system, the database, and the hardware all at the same time.

See Verifying Certification and System Requirements.

Required for 32–bit Operating Systems Only

Migrate to a 64-bit operating system before you upgrade.

This is required only if you are currently running an unsupported 32–bit operating system.

See Migrating from a 32-Bit to a 64-Bit Operating System.

Optional

Update security policy files if you are using enhanced encryption (AES 256).

Some of the security algorithms used in Fusion Middleware 12c require additional policy files for the JDK.

If you plan to use enhanced encryption, such as AES 256, Oracle recommends that you apply the latest required policy files to the JDK before you upgrade.

See Updating Policy Files when Using Enhanced Encryption (AES 256).

Optional

Purge any outdated or unused data before you upgrade.

To optimize performance, Oracle strongly recommends that you purge data and objects that will not be used in the upgraded environment.

See Purging Unused Data.

Optional

Create a Non-SYSDBA user to run the Upgrade Assistant.

Oracle recommends that you create the FMW user to run Upgrade Assistant. User FMW can run the Upgrade Assistant without system administration privileges.

See Creating a Non-SYSDBA User to Run the Upgrade Assistant

Optional

Review the list of available schemas.

Query the schema version registry to view schema information.

See Identifying Existing Schemas Available for Upgrade.

Required

Update the database parameters.

See Updating Database Parameters for Oracle Identity Manager.

Required

Updating Connectors for Oracle Identity Manager.

See Updating Connectors for Oracle Identity Manager.

Optional

Shut down all the local and remote Node Managers before starting the upgrade process.

See Shutting Down the Node Managers.

Required

Run the pre-upgrade report utility.

See Generating and Analyzing Pre-Upgrade Report for Oracle Identity Manager

Parent topic: Pre-Upgrade Requirements

Creating a Complete Backup

Before you start an upgrade, back up all system-critical files, including the Oracle home, Middleware home, and databases that host your Oracle Fusion Middleware schemas.

The backup must include the SYSTEM.SCHEMA_VERSION_REGISTRY$ table so that you can restore the contents back to its pre-upgrade state if the upgrade fails.

Note:

The Upgrade Assistant Prerequisites screen prompts you to acknowledge that backups have been performed before you proceed with the actual upgrade. However, the Upgrade Assistant does not verify that a backup has been created.
See:
  • Backing Up the Schema Version Registry Table
    Your system backup must include the SYSTEM.SCHEMA_VERSION_REGISTRY$ table or the FMWREGISTRY.SCHEMA_VERSION_REGISTRY$ table.
  • Maintaining Customized Domain and Environment Settings
    If you have modified any domain-generated, server startup scripts, or configuration files in your pre-upgrade environment, it is important to note that these changes are overwritten during the installation, domain upgrade, and reconfiguration operations. Save your customized files to a shared library location so that you can continue to use them after the upgrade.

Parent topic: Pre-Upgrade Requirements

Backing Up the Schema Version Registry Table

Your system backup must include the SYSTEM.SCHEMA_VERSION_REGISTRY$ table or the FMWREGISTRY.SCHEMA_VERSION_REGISTRY$ table.

Each Fusion Middleware schema has a row in the SYSTEM.SCHEMA_VERSION_REGISTRY$ table. If you run the Upgrade Assistant to update an existing schema and it does not succeed, you must restore the original schema before you can try again. Before you run the Upgrade Assistant, make sure you back up your existing database schemas and the schema version registry.

Note:

Before you upgrade a schema using the Upgrade Assistant, you must perform a complete database backup. During the upgrade, you are required to acknowledge that backups have been performed.

Parent topic: Creating a Complete Backup

Maintaining Customized Domain and Environment Settings

If you have modified any domain-generated, server startup scripts, or configuration files in your pre-upgrade environment, it is important to note that these changes are overwritten during the installation, domain upgrade, and reconfiguration operations. Save your customized files to a shared library location so that you can continue to use them after the upgrade.

Every domain installation includes dynamically-generated domain and server startup scripts, such as setDomainEnv. These files are replaced by newer versions during the installation and upgrade process. To maintain your custom domain-level environment settings, Oracle recommends that you create a separate file to store the custom domain information before you upgrade, instead of modifying the scripts directly.

For example, if you want to customize server startup parameters that apply to all servers in a domain, you can create a file called setUserOverrides.cmd (Windows) or setUserOverrides.sh (UNIX) and configure it to add custom libraries to the WebLogic Server classpath, specify additional command-line options for running the servers, or specify additional environment variables. When using the pack and unpack commands, any custom settings that you add to this file are preserved during the domain upgrade operation and are carried over to the remote servers.

The following example illustrates startup customizations in a setUserOverrides file:
# add custom libraries to the WebLogic Server system claspath
  if [ "${POST_CLASSPATH}" != "" ] ; then
    POST_CLASSPATH="${POST_CLASSPATH}${CLASSPATHSEP}${HOME}/foo/fooBar.jar"
    export POST_CLASSPATH
  else
    POST_CLASSPATH="${HOME}/foo/fooBar.jar"
    export POST_CLASSPATH
  fi
 
# specify additional java command-line options for servers
JAVA_OPTIONS="${JAVA_OPTIONS}  -Dcustom.property.key=custom.value"

If the setUserOverrides file exists during a server startup, the file is included in the startup sequence and any overrides contained within this file take effect. You must store the setUserOverrides file in the DOMAIN_HOME/bin directory.

Note:

If you are unable to create the setUserOverrides script before an upgrade, you need to reapply your settings as described in Re-apply Customizations to Startup Scripts in Upgrading Oracle WebLogic Server.

Parent topic: Creating a Complete Backup

Creating a Separate Business Intelligence Publisher Installation

Oracle Identity Manager 11g includes an embedded Oracle BI Publisher implementation used for producing Oracle Identity Management Reports. In Oracle Identity and Access Management 12c (12.2.1.3.0), Oracle recommends you to use a dedicated Oracle Business Intelligence (BI) Publisher installation.

When you upgrade to Oracle Identity and Access Management 12c (12.2.1.3.0), the embedded BI Publisher is removed. You will need to migrate your reports to a standalone Oracle BI Publisher.

For more information, see the following guides:

Parent topic: Pre-Upgrade Requirements

Upgrading Oracle HTTP Server

If your deployment of Oracle Identity and Access Management sits behind Oracle HTTP Server through which requests are sent to Oracle Identity Governance, then consider upgrading Oracle HTTP Server.

For instructions, see Upgrading Oracle HTTP Server.

Parent topic: Pre-Upgrade Requirements

Cloning Your Environment for Testing

Create a copy of your actual environment, upgrade the cloned environment, verify that the upgraded components work as expected, and only then upgrade your environment.

Cloning your environment for testing is recommended, but not required.

Upgrades cannot be reversed. In most cases, if an error occurs, you must stop the upgrade and restore the entire environment from backup and begin the upgrade process from the beginning.

Note:

It is beyond the scope of this document to describe the cloning procedures for all components and operating systems. Cloning procedures are component and operating system-specific. At a high level, you install the pre-upgrade version of your component domain on a test machine, create the required schemas using the Repository Creation Utility (RCU), and perform the upgrade.
Additional benefits of running an upgrade in a cloned environment include the following:

  • Uncover and correct any upgrade issues.

  • Practice completing an end-to-end upgrade.

  • Understand the upgrade performance and how purge scripts can help.

  • Understand the time required to complete the upgrade.

  • Understand the database resource usage (such as temporary tablespace; Program Global Area (PGA) , and so on).

Note:

You can run the pre-upgrade Readiness Check on the cloned environment to help identify potential upgrade issues with your data, but you must perform a complete test upgrade on a cloned environment to ensure a successful upgrade.

For instructions to perform a cloned upgrade, see Performing an Out-of-Place Cloned Upgrade of Oracle Identity Manager.

Parent topic: Pre-Upgrade Requirements

Verifying Certification and System Requirements

Review the certification matrix and system requirements documents to verify that your environment meets the necessary requirements for installation.

Note:

When checking the certification, system requirements, and interoperability information, be sure to check specifically for any 32-bit or 64-bit system requirements. It is important for you to download software specifically designed for the 32-bit or 64-bit environment, explicitly.

Parent topic: Pre-Upgrade Requirements

Verify Your Environment Meets Certification Requirements

Oracle has tested and verified the performance of your product on all certified systems and environments. Make sure that you are installing your product on a supported hardware and software configuration.

Whenever new certifications occur, they are added to the appropriate certification document right away. New certifications can occur at any time, and for this reason the certification documents are kept outside of the documentation libraries and are available on Oracle Technical Resources. See the Certification Matrix for 12c (12.2.1.3.0).

Parent topic: Verifying Certification and System Requirements

Verify System Requirements and Specifications

It is important to verify that the system requirements such as disk space, available memory, specific platform packages and patches, and other operating system-specific items are met.

Use the Oracle Fusion Middleware System Requirements and Specifications document to verify that the requirements of the certification are met. For example, if the Certification Matrix for 12c (12.2.1.3.0) indicates that your product is certified for installation on 64-Bit Oracle Linux 7, verify that your Oracle Linux 7 system has met the required minimum specifications such as disk space, available memory, specific platform packages and patches, and other operating system-specific items. This document is updated as needed and resides outside of the documentation libraries on the Oracle Technical Resources.

Note:

When you install the Oracle Fusion Middleware Release 12c software in preparation for upgrade, you should use the same user account that you used to install and configure the existing, pre-upgrade Oracle Fusion Middleware software. On UNIX operating systems, this ensures that the proper owner and group is applied to new Oracle Fusion Middleware 12c files and directories.

If you are running a 32–bit environment, you will need to perform an additional set of steps:

Parent topic: Verifying Certification and System Requirements

Migrating from a 32-Bit to a 64-Bit Operating System

If you have a 32–bit operating system, then you must migrate your 32-bit environment to a 64-bit software environment before you upgrade.

Make sure to validate the migration to ensure all your Oracle Fusion Middleware 11g software is working properly on the 64-bit machine, and only then perform the upgrade to Oracle Fusion Middleware 12c.

In these tasks, host refers to the 32-bit source machine and target refers to the new 64-bit target machine.

Note:

These steps assume that your database is located on a separate host and will not be moved.
Upgrading an operating system typically involves the following:

Caution:

These steps are provided as an example of the operating system upgrade process and may or may not include all of the procedures you must perform to update your specific operating system. Consult your operating system's upgrade documentation for more information.

Parent topic: Verify System Requirements and Specifications

Procure the Hardware That Supports the Upgrade's 64-bit Software Requirement

Make sure that you have supported target hardware in place before you begin the upgrade process.

Stop All Processes

Before upgrading, you must stop all processes, including Managed Servers, the Administration Server, and Node Manager, if they are started on the host.

Note:

Ensure that the Database is up and running, during the upgrade.

Step 1: Stop the Managed Servers

Depending on the method you followed to start the managed servers, follow one of the following methods to stop the WebLogic Managed Server:

Method 1: To stop a WebLogic Server Managed Server by using the Weblogic Console:
  • Log into Weblogic console as a weblogic Admin.
  • Go to Servers > Control tab.
  • Select the required managed server.
  • Click Shutdown.
Method 2: To stop a WebLogic Server Managed Server using node manager, run the following commands:
wls:/offline>nmConnect('nodemanager_username','nodemanager_password',
            'AdminServerHostName','5556','domain_name',
            'DOMAIN_HOME')

wls:/offline>nmKill('ManagedServerName')

Step 2: Stop the Administration Server

When you stop the Administration Server, you also stop the processes running in the Administration Server, including the WebLogic Server Administration Console and Fusion Middleware Control.

To stop the Administration Server, use the stopWebLogic script:

  • (UNIX) DOMAIN_HOME/bin/stopWebLogic.sh

  • (Windows) DOMAIN_HOME\bin\stopWebLogic.cmd

When prompted, enter your user name, password, and the URL of the Administration Server.

Step 3: Stop Node Manager

To stop Node Manager, close the command shell in which it is running.

Alternatively, after having set the nodemanager.properties attribute QuitEnabled to true (the default is false), you can use WLST to connect to Node Manager and shut it down. See stopNodeManager in WLST Command Reference for WebLogic Server.

Back Up All Files from the 32-bit Host Machine

Make sure that you have created a complete backup of your entire 11g deployment before you begin the upgrade process. These files can be used if there is an issue during the migration and you have to restart the process.

Note:

If the upgrade from 32-bit to 64-bit takes place on the same machine, there is a risk of corrupting the source environment if the upgrade fails.

See Backing Up Your Environment in Oracle Fusion Middleware Administrator's Guide.

During the upgrade you must have access to the contents of the following:

  • 11g_DOMAIN_HOME

  • 11g/nodemanager directory located in 11g_ORACLE_HOME/wlserver/common/

Some of the backup and recovery procedures described in Backing Up Your Environment in Oracle Fusion Middleware Administrator's Guide are product-specific. Do not proceed with the upgrade until you have a complete backup.

Set Up the Target 64-bit Machine with the 11g Host Name and IP Address

The host name and IP address of the target machine must be made identical to the host. This requires you to change the IP address and name of the source machine or decommission the source machine to avoid conflicts in the network.

The process of changing an IP address and host name vary by operating system. Consult your operating system's administration documentation for more information.

Restore the 11g Backup from 32-bit Host to 64-bit Host

Restore the files you backed from the 32-bit host using the same directory structure that was used in 11g. The directory structure on the target machine must be identical to the structure of the host machine.

See Recovering Your Environment in Oracle Fusion Middleware Administrator's Guide.

Install the 12c Product Distributions on the Target Machine

Oracle recommends an out-of-place approach for upgrade. Therefore, you must install the 12c product distributions in a new Oracle home on the target machine.

For instructions, see Performing an Out-of-Place Upgrade of Oracle Identity Manager.

Upgrade the Target 64-bit Environment Using the Standard Upgrade Procedure

After installing the product on the target machine, you must upgrade each product component individually using an Upgrade Utility specified in the component-specific upgrade guide and complete any post-upgrade tasks.

For an in-place upgrade, see In-Place Upgrade of Oracle Identity Manager.

For an out-of-place upgrade, see Performing an Out-of-Place Upgrade of Oracle Identity Manager.

If you are upgrading additional components, see the component-specific upgrade guide.

Note:

The Node Manager upgrade procedure requires access to the original Node Manager files. Use the 11g Node Manger files that you backed up from the 32-bit source machine as part of Back Up All Files from the 32-bit Host Machine.

Verify That the Database Hosting Oracle Fusion Middleware is Supported

You must have a supported Oracle database configured with the required schemas before you run Oracle Fusion Middleware 12c.

Review the Fusion Middleware database requirements before starting the upgrade to ensure that the database hosting Oracle Fusion Middleware is supported and has sufficient space to perform an upgrade. See the Certification Matrix for 12c (12.2.1.3.0).

Note:

If your database version is no longer supported, you must upgrade to a supported version before starting an upgrade. See Upgrading and Preparing Your Oracle Databases for 12c in Planning an Upgrade of Oracle Fusion Middleware.

Parent topic: Verifying Certification and System Requirements

Verify That the JDK Is Certified for This Release of Oracle Fusion Middleware

At the time this document was published, the certified JDK for 12c (12.2.1.3.0) was 1.8.0_131.

Refer to the Oracle Fusion Middleware Supported System Configurations information on the Oracle Technical Resources to verify that the JDK you are using is supported.

If your JDK is not supported, or you do not have a JDK installed, you must download the required Java SE JDK, from the following website:
http://www.oracle.com/technetwork/java/javase/downloads/index.html

Make sure that the JDK is installed outside of the Oracle home. The Oracle Universal Installer validates that the designated Oracle home directory is empty, and the install does not progress until an empty directory is specified. If you install JDK under Oracle home, you may experience issues in future operations. Therefore, Oracle recommends that you use install the JDK in the following directory: /home/oracle/products/jdk.

Parent topic: Verifying Certification and System Requirements

Updating Policy Files when Using Enhanced Encryption (AES 256)

If you plan to use enhanced encryption, such as Advanced Encryption Standard (AES 256), in your upgraded environment, Oracle recommends that you apply the latest required policy files to the JDK before you upgrade.

The Java platform defines a set of APIs spanning major security areas, including cryptography, public key infrastructure, authentication, secure communication, and access control. These APIs allow developers to easily integrate security mechanisms into their application code.

Some of the security algorithms used in Fusion Middleware 12c (12.2.1.3.0) require additional policy files for the JDK. See Java Cryptography Architecture Oracle Providers Documentation.

Note:

If you attempt to use enhanced encryption without applying these policy files to the JDK before you begin the upgrade, the upgrade can fail and you must restore the entire pre-upgrade environment and start the upgrade from the beginning.

Parent topic: Pre-Upgrade Requirements

Purging Unused Data

Purging unused data and maintaining a purging methodology before an upgrade can optimize the upgrade process.

Some components have automated purge scripts. If you are using purge scripts, wait until the purge is complete before starting the upgrade process. The upgrade may fail if the purge scripts are running while using the Upgrade Assistant to upgrade your schemas.

For more information, see Using the Archival and Purge Utilities for Controlling Data Growth.

Note:

In large systems with plenty of data, archiving/purging may take a long time. Oracle strongly recommends not to run the archival/purge scripts in parallel to improve performance.

Parent topic: Pre-Upgrade Requirements

Creating a Non-SYSDBA User to Run the Upgrade Assistant

Oracle recommends that you create a non-SYSDBA user called FMW to run the Upgrade Assistant. This user has the privileges required to modify schemas, but does not have full administrator privileges.

SYSDBA is an administrative privilege that is required to perform high-level administrative operations such as creating, starting up, shutting down, backing up, or recovering the database. The SYSDBA system privilege is for a fully empowered database administrator. When you connect with the SYSDBA privilege, you connect with a default schema and not with the schema that is generally associated with your user name. For SYSDBA, this schema is SYS. Access to a default schema can be a very powerful privilege. For example, when you connect as user SYS, you have unlimited privileges on data dictionary tables. Therefore, Oracle recommends that you create a non-SYSDBA user to upgrade the schemas. The privileges listed below must be granted to user FMW before starting the Upgrade Assistant.

Notes:

The non-SYSDBA user FMW is created solely for the purpose of running the Upgrade Assistant. After this step is complete, drop the FMW user. Note that privileges required for running the Upgrade Assistant may change from release to release. 
By default, the v$xatrans$ table does not exist. You must run the XAVIEW.SQL script to create this table before creating the user. Moreover, the grant select privilege on the v$xatrans$ table is required only by Oracle Identity Governance . If you do not require Oracle Identity Governance for configuration, or if you do not have the v$xatrans$ table, then remove the following line from the script: 
   grant select on v$xatrans$ to FMW with grant option;
In the example below, <password> is the password that you set for the FMW user. When granting privileges, make sure that you specify your actual password.
create user FMW identified by <password>;
grant dba to FMW;
grant execute on DBMS_LOB to FMW with grant option;
grant execute on DBMS_OUTPUT to FMW with grant option;
grant execute on DBMS_STATS to FMW with grant option;
grant execute on sys.dbms_aqadm to FMW with grant option;
grant execute on sys.dbms_aqin to FMW with grant option;
grant execute on sys.dbms_aqjms to FMW with grant option;
grant execute on sys.dbms_aq to FMW with grant option;
grant execute on utl_file to FMW with grant option;
grant execute on dbms_lock to FMW with grant option;
grant select on sys.V_$INSTANCE to FMW with grant option;
grant select on sys.GV_$INSTANCE to FMW with grant option;
grant select on sys.V_$SESSION to FMW with grant option;
grant select on sys.GV_$SESSION to FMW with grant option;
grant select on dba_scheduler_jobs to FMW with grant option;
grant select on dba_scheduler_job_run_details to FMW with grant option;
grant select on dba_scheduler_running_jobs to FMW with grant option;
grant select on dba_aq_agents to FMW with grant option;
grant execute on sys.DBMS_SHARED_POOL to FMW with grant option;
grant select on dba_2pc_pending to FMW with grant option;
grant select on dba_pending_transactions to FMW with grant option;
grant execute on DBMS_FLASHBACK to FMW with grant option;
grant execute on dbms_crypto to FMW with grant option;
grant execute on DBMS_REPUTIL to FMW with grant option;
grant execute on dbms_job to FMW with grant option;
grant select on pending_trans$ to FMW with grant option;
grant select on dba_scheduler_job_classes to fmw with grant option;
grant select on SYS.DBA_DATA_FILES to FMW with grant option;
grant select on SYS.V_$ASM_DISKGROUP to FMW with grant option;
grant select on v$xatrans$ to FMW with grant option;
grant execute on sys.dbms_system to FMW with grant option;
grant execute on DBMS_SCHEDULER to FMW with grant option;
grant select on dba_data_files to FMW with grant option;
grant execute on UTL_RAW to FMW with grant option;
grant execute on DBMS_XMLDOM to FMW with grant option;
grant execute on DBMS_APPLICATION_INFO to FMW with grant option;
grant execute on DBMS_UTILITY to FMW with grant option;
grant execute on DBMS_SESSION to FMW with grant option;
grant execute on DBMS_METADATA to FMW with grant option;
grant execute on DBMS_XMLGEN to FMW with grant option;
grant execute on DBMS_DATAPUMP to FMW with grant option;
grant execute on DBMS_MVIEW to FMW with grant option;
grant select on ALL_ENCRYPTED_COLUMNS to FMW with grant option;
grant select on dba_queue_subscribers to FMW with grant option; 
grant execute on SYS.DBMS_ASSERT to FMW with grant option;
grant select on dba_subscr_registrations to FMW with grant option;
grant manage scheduler to FMW;

If you are upgrading Oracle Identity Manager (OIM) schema, ensure that the FMW user has the following additional privileges:

grant execute on SYS.DBMS_FLASHBACK to fmw with grant option;
grant execute on sys.DBMS_SHARED_POOL to fmw with grant option;
grant execute on SYS.DBMS_XMLGEN to FMW with grant option;
grant execute on SYS.DBMS_DB_VERSION to FMW with grant option;
grant execute on SYS.DBMS_SCHEDULER to FMW with grant option;
grant execute on SYS.DBMS_SQL to FMW with grant option;
grant execute on SYS.DBMS_UTILITY to FMW with grant option;
grant ctxapp to FMW with admin option;
grant execute on SYS.DBMS_FLASHBACK TO FMW with grant option;
grant create MATERIALIZED VIEW to FMW with admin option;
grant all on SCHEMA_VERSION_REGISTRY TO FMW with grant option;
grant create SYNONYM to FMW with admin option;
grant execute on CTXSYS.CTX_ADM to FMW with grant option;
grant execute on CTXSYS.CTX_CLS TO FMW with grant option;
grant execute on CTXSYS.CTX_DDL TO FMW with grant option;
grant execute on CTXSYS.CTX_DOC TO FMW with grant option;
grant execute on CTXSYS.CTX_OUTPUT TO FMW with grant option;
grant execute on CTXSYS.CTX_QUERY TO FMW with grant option;
grant execute on CTXSYS.CTX_REPORT TO FMW with grant option;
grant execute on CTXSYS.CTX_THES TO FMW with grant option;
grant execute on CTXSYS.CTX_ULEXER TO FMW with grant option;
grant create JOB to FMW with admin option;

Parent topic: Pre-Upgrade Requirements

Identifying Existing Schemas Available for Upgrade

This optional task enables you to review the list of available schemas before you begin the upgrade by querying the schema version registry. The registry contains schema information such as version number, component name and ID, date of creation and modification, and custom prefix.

You can let the Upgrade Assistant upgrade all of the schemas in the domain, or you can select individual schemas to upgrade. To help decide, follow these steps to view a list of all the schemas that are available for an upgrade:

  1. If you are using an Oracle database, connect to the database by using an acount that has Oracle DBA privileges, and run the following from SQL*Plus:

    SET LINE 120
SET PAGESIZE 20
COLUMN MRC_NAME FORMAT A14
COLUMN COMP_ID FORMAT A20
COLUMN VERSION FORMAT A12
COLUMN STATUS FORMAT A9
COLUMN UPGRADED FORMAT A8
SELECT MRC_NAME, COMP_ID, OWNER, VERSION, STATUS, UPGRADED FROM SCHEMA_VERSION_REGISTRY ORDER BY VERSION, MRC_NAME, COMP_ID;

  2. Examine the report that is generated.

    If an upgrade is not needed for a schema, the schema_version_registry table retains the schema at its pre-upgrade version.

  3. Note the schema prefix name that was used for your existing schemas. If you are using RCU for creating new 12c schemas, use the same prefix.

Notes:

  • If you used an OID-based policy store in 11g, make sure to create a new OPSS schema before you perform the upgrade. After the upgrade, the OPSS schema remains an LDAP-based store.

  • You can only upgrade schemas for products that are available for upgrade in Oracle Fusion Middleware release 12c (12.2.1.3.0). Do not attempt to upgrade a domain that includes components that are not yet available for upgrade to 12c (12.2.1.3.0).

Parent topic: Pre-Upgrade Requirements

Updating Database Parameters for Oracle Identity Manager

You need to verify and update a few database parameters before upgrading the Oracle Identity Manager to 12c (12.2.1.3.0).

Complete the following steps:
  1. Connect to the database by using an account that has Oracle DBA privileges, and run the commands in this procedure from SQL*Plus.
  2. To verify the value for the database parameter max_string_size, run the following command:
    SQL> SELECT value FROM v$parameter WHERE name='max_string_size';
  3. If the value returned is:
    • STANDARD: Skip the rest of the steps in this procedure and go to the next procedure to continue with the upgrade.
    • EXTENDED: Continue with step 4.
  4. Login as an OIM database user and then run the following command to find columns with size more than 4000 characters:
    SQL> SELECT table_name, column_name, data_length FROM user_tab_columns WHERE data_length>4000;
  5. If any rows are listed, either trim the corresponding column data to 4000 characters or remove the rows.

    Note:

    If required, take backup of the listed rows in a new table.
  6. Reset all the columns sizes found in step 4 to 4000 characters.

    As an OIM database user, run the following command:

    SQL> ALTER TABLE <table_name> MODIFY <column_name> VARCHAR2(4000);
  7. On the columns whose length was modified to more than 4000 characters, drop any existing index.
  8. As an OIM database user, run the following command to verify that there no more columns with size more than 4000:
    SQL> SELECT table_name, column_name, data_length FROM user_tab_columns WHERE data_length>4000;
  9. If required, gather table and index stats for the identified columns.

For more information, see Monitoring Oracle Identity Governance Performance.

Parent topic: Pre-Upgrade Requirements

Updating Connectors for Oracle Identity Manager

Update the existing connectors if they are not supported for Oracle Identity Manager 12c (12.2.1.3.0).

Complete the following steps:
  1. Go to the Oracle Identity Manager Connectors Certification.
  2. By using the certification information table, verify if the existing connectors are supported for 12c (12.2.1.3.0).
  3. Are the existing connectors supported for 12c (12.2.1.3.0)?

Parent topic: Pre-Upgrade Requirements

Shutting Down the Node Managers

Ensure that you have shut down all the local and remote Node Managers before starting the upgrade process.

The Node Managers should remain shut down until you start the WebLogic Administration Server after completing the upgrade. When the WebLogic Administration Server is up and running, start the Node Managers, followed by the Managed Servers.

Parent topic: Pre-Upgrade Requirements

Generating and Analyzing Pre-Upgrade Report for Oracle Identity Manager

Run the pre-upgrade report utility before you begin the upgrade process for Oracle Identity Manager, and address all of the issues using the solution provided in the report.

The pre-upgrade report utility analyzes your existing Oracle Identity Manager environment, and provides information about the mandatory prerequisites that you must complete before you begin the upgrade.

Note:

It is important to address all of the issues listed in the pre-upgrade report before you proceed with the upgrade, as the upgrade might fail if the issues are not resolved.

Ensure that the Database and the 11.1.2.3.0 Oracle Identity Manager servers are up and running before you run the pre-upgrade report utility.

  • Obtaining the Pre-Upgrade Report Utility
    Download the pre-upgrade report utility for Oracle Identity Manager from Oracle Technology Network (OTN).
  • Generating the Pre-Upgrade Report
    Generate the pre-upgrade report before you start the upgrade process for Oracle Identity Manager and resolve any issues listed in the report.
  • Analyzing the Pre-Upgrade Report
    After you generate the pre-upgrade report for Oracle Identity Manager, review each of the reports, and perform all of the tasks described in them. If you do not perform the mandatory tasks described in the report, the upgrade might fail.

Parent topic: Pre-Upgrade Requirements

Obtaining the Pre-Upgrade Report Utility

Download the pre-upgrade report utility for Oracle Identity Manager from Oracle Technology Network (OTN).

The utility is available in a zip file named PreUpgradeReport.zip along with ReadMe.doc at the following location on My Oracle Support:

My Oracle Support document ID 2308933.1

The ReadMe.doc contains information about how to generate and analyze the pre-upgrade reports.

Parent topic: Generating and Analyzing Pre-Upgrade Report for Oracle Identity Manager

Generating the Pre-Upgrade Report

Generate the pre-upgrade report before you start the upgrade process for Oracle Identity Manager and resolve any issues listed in the report.

To generate the pre-upgrade report for Oracle Identity Manager, complete the following steps on your Administration server host machine:

  1. Create a directory at any location and extract the contents of PreUpgradeReport.zip in the new directory.
  2. Create a directory in which to generate the pre-upgrade reports. For example, create a directory named OIM_preupgrade_reports.
  3. Go to the directory where you extracted PreUpgradeReport.zip and open the preupgrade_report_input.properties file in a text editor. Update the properties file with the appropriate values for the parameters listed in Table 2-2

    Table 2-2 Parameters to be Specified in the preupgrade_report_input.properties File

    Parameter Description
    oim.mwhome Specify the absolute path to the Middleware home of the existing installation.

    For example: /Oracle/Middleware
    oim.oimhome Specify the absolute path to the existing OIM home.

    For example: /Oracle/Middleware/Oracle_IDM1
    oim.javahome Specify the absolute path to the Java home. Ensure that you point to JAVA 8.
    oim.wlshome Specify the absolute path to the WebLogic Server home.

    For example: /Oracle/Middleware/wlserver_10.3
    oim.domain Specify the absolute path to the Oracle Identity Manager domain home.

    For example: /Oracle/Middleware/user_projects/domains/IAMGovernanceDomain
    oim.oimhost Specify the hostname of Oracle Identity Manager.

    For example: oim.example.com
    oim.oimport Specify the port of the Oracle Identity Manager server.

    For example: 14000
    oim.username Specify the Oracle Identity Manager Admin username.

    For example: xelsysadm
    oim.targetVersion Specify the target version of the Oracle Identity Manager, that is, 12.2.1.3.0.
    oim.jdbcurl Specify the JDBC URL for Oracle Identity Manager in one of the following formats:

    host:port/service_name

    or

    host:port:sid
    oim.oimschemaowner Specify the name of the OIM schema owner.
    oim.mdsjdbcurl Specify the MDS JDBC URL in the one of the following formats:

    host:port/service_name

    or

    host:port:sid
    oim.mdsschemaowner Specify the name of the MDS schema owner.
    oim.databaseadminname Specify the user with DBA privilege. For example, FMW or sys as sysdba.
    oim.outputreportfolder Specify the absolute path to the directory where you want the reports to be generated (OIM_preupgrade_reports).Ensure that this directory has read and write permissions.
  4. Run the following command from the location where you extracted the contents of PreUpgradeReport.zip:
    • On UNIX:

      sh generatePreUpgradeReport.sh

    • On Windows:

      generatePreUpgradeReport.bat

  5. Provide the details when the following are prompted:
    • OIM Schema Password: Enter the password of the Oracle Identity Manager (OIM) schema.
    • MDS Schema Password: Enter the password of the Metadata Services (MDS) schema.
    • DBA Password: Enter the password of the Database Administrator.
    • OIM Admin Password: Enter the password of the Oracle Identity Manager Administrator.
  6. The reports are generated as HTML pages at the location you specified for the parameter oim.outputreportfolder in the preupgrade_report_input.properties file. The logs are stored in the log file preUpgradeReport<time>.log in the folder logs at the same location.

Parent topic: Generating and Analyzing Pre-Upgrade Report for Oracle Identity Manager

Analyzing the Pre-Upgrade Report

After you generate the pre-upgrade report for Oracle Identity Manager, review each of the reports, and perform all of the tasks described in them. If you do not perform the mandatory tasks described in the report, the upgrade might fail.

Table 2-3 Pre-Upgrade Reports Generated for Oracle Identity Manager

Report Name Description and Action Item

Status of OIM System Property — XL.AllowedBackURLs

This report provides the status of the system property related to setting the back URLs in Oracle Identity Manager.

Changes to SCIM-JWT in 12c

This report lists the new SCIM URLs published during 12c (12.2.1.3.0).

You must use the new URLs instead of the old ones.

Potential upgrade issues for User Defined Attributes

This report lists the potential issues with the User Defined Field (UDF) defined in Oracle Identity Manager 11.1.2.3.0 during upgrade.

Status of Mandatory Database Components

This report lists the installation status of the mandatory Database components which are required for upgrade.

Status of Mandatory deletion of OIM Authentication Jar(s)

This report lists the status of a few mandatory jars that need to be deleted before upgrade.

Full MDS Export of source environment

This report lists the details regarding the MDS backup taken prior to upgrade.

Customized Notification Templates status on source environment

This report lists customized out-of-the-box (OOTB) notification templates. These customizations will be overwritten with OOTB values during upgrade.

OIM-OMSS Integration Pre-Upgrade Report

This report gives the deprecation information about the Oracle Mobile Security Services (OMSS) with Oracle Identity Manager in 12c (12.2.1.3.0).

Status of Domain Configuration

This report lists the applications (if any) that are in stage mode.

Status of Mandatory DB Privilege

This report lists the missing mandatory database privileges that are required for upgrade.

Status of data associated with access policies

In 12c, access policies are associated with application instances instead of resource object. To handle the same, this report lists in-consistent data (if present) in the Oracle Identity Manager 11.1.2.3.0.

Authorization Policy backup of source environment

This report lists the details regarding the Oracle Identity Manager authorization policy backup taken prior to upgrade.

Information about Schedule Jobs against Schedule task named as OIM Data Purge Task on source environment

This report provides important information regarding one of the schedule tasks which will be available after upgrade.

Obsolete templates existence status on source environment

This report lists obsolete templates that are present in the source domain prior to upgrade.

Obsolete applications existence status on source environment

This report lists obsolete applications that are present in the source domain prior to upgrade.

soaOIMLookupDB data source status on source environment

This report lists non-transactional soaOIMLookupDB data sources in the source domain prior to upgrade.

Status of OIM default keystore in KSS on source environment

This report lists the OIM default keystore if it’s present in the KSS of the source domain prior to upgrade.

Parent topic: Generating and Analyzing Pre-Upgrade Report for Oracle Identity Manager