Review the following considerations before beginning to upgrade the OpenText Identity Manager components:
Make sure to update all OpenText Identity Manager components to the latest version if running on the same server.
You can upgrade the components only in the console mode. Silent upgrade is not supported.
You must upgrade one component at a time.
Identity Vault must be separately upgraded. This version supports OpenText eDirectory 9.3.
If OpenText Identity Console and OpenText eDirectory coexists, ensure to upgrade OpenText Identity Console to latest version 1.9 before upgrading OpenText eDirectory to 9.3. For more information on upgrading the OpenText Identity Console, see Upgrading OpenText Identity Console.
If Identity Vault is configured on BTRFS file system, the upgrade process will not succeed. This version supports only Ext3, Ext4, and XFS file systems.
Ensure that there are no events in the cache file before you begin upgrading OpenText Identity Manager Engine. If your driver is using MapDB, ensure that your upgraded driver works correctly with the upgraded Engine. For more information, see Working with MapDB 3.0.9.
You must review the recommended server setup before upgrading the components. OpenText Identity Manager mandates that Identity Applications and OSP are installed on the same computer. However, Identity Reporting supports a locally or a remotely installed OSP.
Configuring Identity Applications and databases with the Fully Qualified Domain Name (FQDN) is recommended. However, for Identity Reporting, Only Hostname is supported.
If you are using a supported version of Oracle or Microsoft SQL Server database, you must configure two database instances for Identity Applications to work correctly; Identity Applications (idmuserappdb) database and the Workflow (igaworkflowdb) database. Ensure that you configure the database instances on the same server.
If you are using NAM Reverse Proxy configuration with Identity Applications to load forms, you must utilize NAM 5.x version.
Starting with Identity Manager 4.9, the support for SecretStore has been deprecated. After you upgrade to the latest UAD package and restart Tomcat, all existing email account passwords in the SecretStore repository will automatically migrate to the notfSMTPMailPassword attribute. This password migration process is controlled by the com.netiq.idm.migrate.secretstore property, which is available in the ism-configuration.properties file. By default, this property is set to true. After the migration is complete, the property will automatically set back to false and will remain in this state.
While upgrading from 4.9 to 4.10, user will not be prompted to enter master keystore password. It uses the previously stored password from ism-sensitive.properties file. However, while upgrading from 4.7.5 and 4.8.x to 4.10, user is prompted to enter the master keystore password (encrypt-keys.pkcs12). If you want to change or re-encrypt the password, see Storing Configupdate Ultity Password.
The following considerations apply to Self Service Password Reset (SSPR):
If auditing is enabled on SSPR server with Syslog output format type as CEF, then you must uninstall the Self Service Password Reset Collector from Sentinel Syslog server, else the Syslog server will not be able to parse the SSPR audit events.
SSPR supports both CEF and JSON output format type for auditing events. SSPR 4.8.0.1 will continue to support Self Service Password Reset Collector for JSON output format type. If there are more than one SSPR servers connected to a single Sentinel Syslog server, then you must select only one format type for auditing events across all servers.
If SSPR is installed on a separate server, upgrade the component to latest version bundled in OpenText Identity Manager 4.10.
After you update OpenText Identity Manager to 4.10 version, SSPR is upgraded to 4.8.0.1 version which requires Universal CEF Collector for collecting auditing events in CEF format type.
NOTE:If you are enabling the SSPR auditing in CEF output format type for the first time, ensure that the Self Service Password Reset Collector is not configured on the Sentinel Syslog server.