12.3 Upgrading Procedure for Identity Governance

To upgrade Identity Governance and its core components:

1. Purge any unwanted data from the database before upgrading. For more information, see Identifying Purgeable Data in the Identity Governance User and Administration Guide.

2. (Optional) Run reports for any review run details you want to make available after the upgrade.

3. Launch the Identity Governance Configuration Utility in console mode, then issue the export-sql (or es) command to generate a SQL file that contains your current environment system properties. Move the file to another location, so you can compare it with a similar file you create after upgrading. For more information, see Section 14.1.3, Using the Identity Governance Configuration Utility.

4. Stop Identity Governance (and Apache Tomcat). For more information, see Section 3.4.3, Starting and Stopping Apache Tomcat.

5. (Conditional) If you are using PostgreSQL, back up and export your full Identity Governance data and confirm that you can restore it with no problems.

   Include all of the Identity Governance databases (default names). If you installed Identity Reporting, back up the Identity Reporting database (default name) as well.

   • igops

   • igarc (if upgrading from Identity Governance 3.5)

   • igdcs

   • igwf

   • igara

   • igrpt

   For more information, see the PostgreSQL Documentation for your version of PostgreSQL.

6. (Conditional) If you are using Oracle, perform the following steps:

   1. Back up the following schemas:

      • igops

      • igarc (if upgrading from Identity Governance 3.5)

      • igdcs

      • igwf

      • igara

      • igrpt

   2. (Conditional) If your Oracle database has virtual columns, run the following command to identify virtual columns:

      select distinct c.table_name, e.extension_name 
          from sys.user_tab_cols c 
            inner join sys.user_stat_extensions e on e.table_name = c.table_name
          where c.virtual_column = 'YES' and e.droppable = 'YES';

   3. (Conditional) If your Oracle database has virtual columns, run the following script, modified for your specific environment details, to drop extended statistics and virtual columns:

      declare
        v_owner varchar2(255);
        v_table varchar2(255);
        v_extension varchar2(32000);
      begin
        select SYS_CONTEXT('USERENV', 'SESSION_USER') into v_owner from DUAL;
        for rec in (
          select distinct c.table_name, dbms_lob.substr(e.extension, 32000, 1) as extension, 
          from sys.user_tab_cols c 
            inner join sys.user_stat_extensions e on e.table_name = c.table_name
          where c.virtual_column = 'YES' and e.droppable = 'YES'
        )
        loop
          v_table := rec.table_name;
          v_extension := rec.extension    execute immediate 'call dbms_stats.drop_extended_stats(:v_owner, ;
      :v_table, :v_extension)' using v_owner, v_table, v_extension;
        end loop;
      end;

   For more information, see the Oracle documentation for the version of Oracle you have.

7. (Conditional) If you are using MS SQL, back up the following databases:

   • igops

   • igarc (if upgrading from Identity Governance 3.5)

   • igdcs

   • igwf

   • igara

   • igrpt

   For more information, see the Microsoft SQL documentation.

8. Move your generated reports (pdf and csv files) from the Reporting home folder to a backup directory.

9. Perform the following steps to upgrade OSP:

   1. Move your trust store files to a backup location. The files are located in the following directories.

      • Linux:

        • /opt/netiq/idm/apps/osp/osp.pkcs12

        • /opt/netiq/idm/apps/osp/osp-truststore.pkcs12

        • /opt/netiq/idm/apps/tomcat/conf/apps-truststore.pkcs12

      • Windows:

        • \opt\netiq\idm\apps\osp\osp.pkcs12

        • \opt\netiq\idm\apps\osp\osp-truststore.pkcs12

        • \opt\netiq\idm\apps\tomcat\conf\apps-truststore.pkcs12

   2. Run the OSP upgrade installer.

10. Run the Identity Governance installer.

11. (Optional) Install the current version of Identity Reporting on the same server or a different server if needed. For more information, see Section 7.0, Installing Identity Reporting.

12. (Conditional) If you are upgrading in a Windows environment, reboot the Windows server.

13. Remove the localhost folder located in the /opt/netiq/idm/apps/tomcat/work/Catalina folder in Linux, or the C:\netiq\idm\apps\tomcat\work\Catalina folder in Windows.

14. (Conditional) Add the virtual columns back into the Oracle database. For more information, see Tips and Tricks Invisible Columns in Oracle Database 12c.

15. Delete all files and folders from the /opt/netiq/idm/apps/tomcat/temp folder in Linux, or from the C:\netiq\idm\apps\tomcat\temp folder in Windows.

16. Move existing logs to a backup location.

17. (Conditional) If you are integrated with an IDP (for example Access Manager), you can either:

    • Move the newly created trust store files (osp.pkcs12 and osp-truststore.pkcs12) to a different location, and then move the original trust store files (osp.pkcs12 and osp-truststore.pkcs12) back to the OSP installation folder, or

    • Update the IDP with the newly-created certificates.

18. Clear your internet browser cache and remove cookies.

19. Copy the generated pdf and csv report files to the location you specified during the installation.

20. Start Tomcat. For more information, see Section 3.4.3, Starting and Stopping Apache Tomcat.

21. (Conditional) Log in to Identity Governance to review any customized settings you have made to the user interface. Because of changed or additional element IDs and the different navigation settings, customizations you made to your previous environment might not work as expected. Adjust your customizations as needed.

22. (Conditional) If you are collecting identities from a source that supports change events, run the Identity Source Migration and Upgrade utility to convert your existing source to use change event processing. If you are already using a change event collector, you can also use the utility to upgrade the configuration. For more information, see Migrating an Identity Collector to a Change Event Identity Collector in the Identity Governance User and Administration Guide.

23. Publish the collected data again to populate the business roles and other items. For more information, see Publishing the Collected Data in the Identity Governance User and Administration Guide.

24. If needed, run the Identity Governance Configuration Utility to restore your values for Workflow Settings > Notification System. For more information, see Section 14.1.3, Using the Identity Governance Configuration Utility.

25. If needed, run the Identity Governance Configuration Utility with the -es option to get a list of system settings for your upgraded environment. Compare it to the list you generated before upgrading and restore any additional custom settings for your environment. For more information, see Section 14.1.3, Using the Identity Governance Configuration Utility.

26. If you used the Identity Governance Configuration Utility to make changes in Step 23 or Step 24, restart Tomcat for these changes to take effect.