34.4 Troubleshooting Upgrade-related Issues

The following table lists the issues you might encounter and the suggested actions for working on these issues. If the problem persists, contact your OpenText representative.

Issue	Suggested Actions
After upgrading OpenText Identity Manager to 24.4 (v4.10), iManager no longer works if installed with other components. When you try to launch a previously installed version, iManager displays a blank page.	Install and use OpenText Identity Console in place of iManager. However, if you want to continue using iManager after upgrading OpenText Identity Manager to version 24.4 (v4.10), ensure that: iManager is installed on a standalone server. The server has a supported version of Java. For example, iManager 3.2.6.0200 on Java JDK 1.0.8 Update 342 in Identity Manager 4.8.6 Perform the following steps to reuse the old Java files: Create a new directory using the following command: mkdir -p /opt/novell/iManager/java_iman Copy the existing Java files of iManager to the new directory: cp -r /opt/netiq/common/jre/ /opt/novell/iManager/java_iman To change the ownership to the new directory, run the following command: chown -R novlwww:novlwww /opt/novell/iManager/java_iman Navigate to /etc/opt/novell/tomcat9/ and update the JAVA_HOME and JRE_HOME with the new Java path in the tomcat9.conf file. Restart Tomcat using the following comment: rcnovell-tomcat9 restart
During the Identity Applications component upgrade, if you choose the write to file option for creating database schema, the installer creates empty databaseschema.sql and wfedatabaseschema.sql files. Because these files are empty, you cannot use them to create database schema after the upgrade is complete.	Download the appropriate database jar file on your application server from a third-party website for your Identity Applications database. Install it on a separate system or a server along with Identity Applications. When the installer prompts you to enter the Identity Applications and Workflow Engine database JDBC jar file path during Identity Applications update, specify the location of the installed database jar file.
When upgrading OpenText Identity Manager to version 24.4 (v4.10) on a server running RHEL 8.x or RHEL 9.x (where x is the version supported in 4.10), OSP fails to start due to a database connection issue. It typically happens when the random key generation process takes longer than expected while the OSP is getting deployed. As a result, Tomcat services also fail to start.	Modify the following lines in the java.security file at the /opt/netiq/common/jre/conf/security location and restart Tomcat: NOTE:Before applying the workaround, refer to the RHEL documentation for more information about random number generators. Replace securerandom.source=file:/dev/random with securerandom.source=file:/dev/./urandom Replace securerandom.strongAlgorithms=NativePRNGBlocking:SUN with securerandom.strongAlgorithms=SHA1PRNG:SUN
While upgrading OpenText Identity Manager Engine on Open Enterprise Server (OES) 24.2, the following error is reported in idmupgrade.log: [SEVERE]: Could not connect to the server Exception: Connect ErrorLDAPException: I/O Exception on host <IP_address>, port <port_number> Connect Error java.net.SocketException: Connection or outbound has closed	Ignore this error. It does not cause any functionality loss.
OpenText Identity Manager authorizes and securely communicates with its components using digital certificates. The Identity Vault certificates must be imported into the idm.jks and tomcat.ks keystore files. However, when attempting to access Identity Applications after importing the certificates, you might hit the following error: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not determine revocation status. The certificates are validated by checking the Certificate Revocation Lists (CRLs) specified by the CRL Distribution Point (CDP) field to determine whether the certificate has been revoked or not. The CRLDPs are available in both the root certificate and the intermediate certificates present in the keystore files tomcat.ks and idm.jks. Certificate revocation checking, however, is disabled by default. As a result, the PKIX trust manager is unable to determine the revocation status of the certificates.	To fix this issue, enable CRL distribution point checking by setting the -Dcom.sun.security.enableCRLDP property to true. To set the property, perform the following actions: Stop Tomcat. Go to the setenv.sh file located in the Tomcat's bin directory. For example, /opt/netiq/idm/apps/tomcat/bin/setenv.sh. Add the property -Dcom.sun.security.enableCRLDP=true in CATALINA_OPTS as: export CATALINA_OPTS="-Dcom.sun.security.enableCRLDP=true" Start Tomcat.
After upgrading OpenText Identity Manager, logging in to OpenText Identity Manager Dashboard is extremely slow for non-admin users. There is a significant delay in loading the Applications and the Dashboard pages. This issue occurs due to the nested group search, which is enabled by default. The application will look for the permissions inherited by the logged-in user via the nested group membership, regardless of whether there are any nested groups in the environment.	(Conditional) The following steps apply to Identity Manager 4.9: Log in to the server where Identity Applications is upgraded to 4.9 version. Navigate to the /opt/netiq/idm/apps/tomcat/conf/ location. Open the ism-configuration.properties file in a text editor. At the end of the file, add the following property: DirectoryService/realms/jndi/params/USE_NESTED_GROUPS=false Save the file and restart Tomcat.
After upgrading Identity Applications to 4.10 version from a prior version, the Form Renderer does not work as expected. This issue is observed when the default IDMProv deployment context is modified to a custom context.	To work around this issue, perform the following steps: Log in to the server where Identity Applications is upgraded to 4.9 version. Navigate to the /opt/netiq/idm/apps/sites directory. Edit the ServiceRegistry.json file. Modify the deployment context from IDMProv to the custom context that was specified prior to upgrade. Save the ServiceRegistry.json file. Navigate to the /opt/netiq/idm/apps/sites/forms/ directory. Edit the main.<version>.js file, where <version> is the randomly generated alphanumeric value. Modify the deployment context from IDMProv to the custom context that was specified prior to upgrade. Save the main.<version>.js file. Restart Tomcat.
After you upgrade OpenText Identity Manager in a distributed environment to 4.10 version, login to the Identity Applications fails. The following error message is displayed: Your login process did not complete successfully. Logging to the Identity Applications requires trust anchor certificates for establishing a secure connection between the Identity Applications and the OSP. A trust anchor certificate must include the Basic Constraints extension with the Subject Type set to CA. OpenText Identity Manager makes use of the property jdk.security.allowNonCaAnchor to validate the trust anchors in the certificate. By default, this property is set to false. Therefore, when the trust anchors are not found in the certificates, the connection between Identity Applications and OSP cannot be established and the login fails. You will notice the following exception in the idm-osp.log file: sun.security.validator.ValidatorException: TrustAnchor with subject "CN=*, L=, O=**" is not a CA certificate	To resolve this issue, you must satisfy either of the following conditions: Ensure that the certificates used to establish a secure connection between the Identity Applications and the OSP are trusted CA certificates with proper Basic Constraints extension. In case of self signed certificates and custom certificates that are trusted by the clients, you can change the property jdk.security.allowNonCaAnchor to allow non CA certificates without Basic Constraints extension. Perform the following actions to modify the Java security settings: Navigate to the /opt/netiq/common/jre/lib/security/java.security directory. Set the value of the property jdk.security.allowNonCaAnchor=true. Save the file.
After upgrading to Identity Applications 4.10 version, you are not able to open forms while requesting for permissions in the Identity Applications Dashboard.	To resolve this issue, manually restart the NGNIX and Golang services using the following commands: NGNIX: /opt/netiq/common/ngnix/ngnix Golang: /etc/init.d/netiq-golang.sh The Identity Applications uses the NGNIX service for rendering forms in the Identity Applications Dashboard.
After you upgrade Identity Reporting in a standard edition, the is_prov parameter in the configupdate.sh.properties is set to true. Since Identity Applications is not available in a standard edition, the value of this parameter must be set to false.	Manually set the is_prov parameter to false in the configupdate.sh.properties file.
Unable to re-run the OpenText Identity Manager engine installer if the prior upgrade of OpenText Identity Manager Engine fails. For example, if the 4.9 upgrade for OpenText Identity Manager Engine fails on the first attempt and you try upgrading OpenText Identity Manager Engine again, the upgrade process cannot be triggered.	Perform the following steps: Downgrade the OpenText Identity Manager engine to the previous version using the novell-DXMLengnx RPM. Upgrade OpenText Identity Manager engine.
After you upgrade OpenText Identity Manager, the following property is added to the ism-configuration.properties file: com.netiq.idm.osp.ldap.admin-dn = cn=admin,ou=sa,o=system	Comment out the property in the ism-configuration.properties file and restart Tomcat. It does not cause any functionality loss.
After you upgrade OpenText Identity Manager, the following SSPR property is added to the ism-configuration.properties file, even if you do not have SSPR in your deployment: com.netiq.sspr.redirect.url = https://___SSPR_IP___:___SSPR_TOMCAT_HTTPS_PORT___/sspr/public/oauth	Comment out the property in the ism-configuration.properties file and restart Tomcat. It does not cause any functionality loss.
After you upgrade OpenText Identity Manager, the ism-configuration.properties file populates some duplicate values of java.protocol.handler.pkgs property.	There is no loss of functionality. To resolve this issue, perform the following actions: Navigate to the ism-configuration.properties file located at /opt/netiq/idm/apps/tomcat/conf/directory. Modify the ism-configuration.properties file and remove the duplicate values of the java.protocol.handler.pkgs property. Save the file and restart Tomcat.
Unable to start Tomcat after OpenText Identity Manager upgrade. You will notice few exceptions in tomcat logs and a communication failure between the workflow engine and the Identity Vault.	Log in to OpenText Identity Console. Navigate to Certificate Management > Server Certificate Management. Select the SSL CertificateDNS check box and click Export. In the Certificates drop-down list, select the SSL CertificateDNS. Clear the Export private key check box. Ensure that the Export format is set to DER. Click OK > Save the exported certificate to download the certificate in your system. Log in to the Identity Applications server. Stop Tomcat. Navigate to opt/netiq/common/jre/bin directory and import the certificate to idm.jks file using the following command: opt/netiq/common/jre/bin/keytool -import -trustcacerts -alias <certificate_alias_name> -keystore /opt/netiq/idm/apps/tomcat/conf/idm.jks -file <certificate_file_downloaded> Restart Tomcat.