6 Upgrading Your Oracle Identity Federation Environment

6.2.1 Verifying that the Database Meets the Minimum Requirements for the Oracle Identity Federation Schema

Before performing any installation you should read the system requirements and certification documentation to ensure that your environment meets the minimum installation requirements for the products you are installing.

For more information, refer to "System Requirements and Prerequisites" in the Oracle Fusion Middleware Installation Planning Guide.

6.2.2 Running the Repository Creation Utility in Preparation for Upgrading Oracle Identity Federation

To run the Repository Creation Utility to install the Oracle Identity Federation schema in the database, refer to the following resources:

• Oracle Fusion Middleware Installation Guide for Oracle Identity Management

• Oracle Fusion Middleware Repository Creation Utility User's Guide.

After you start the Repository Creation Utility, follow the instructions on the Repository Creation Utility screens to connect to the database and create the required schemas.

During the installation of the schema, note the following:

• On the Select Componts screen, be sure to select the Oracle Identity Federation schema.

• No other schemas are required unless you plan to use this database for installing other Oracle Fusion Middleware 11g components.

6.3.1 Task 3a: Install the Oracle WebLogic Server Software and Create the Middleware Home

To install Oracle WebLogic Server and create the middleware home, refer to "Installing Oracle WebLogic Server" in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

For more information about the Middleware home, see "Understanding Oracle Fusion Middleware Concepts" in the Oracle Fusion Middleware Administrator's Guide.

6.3.2 Task 3b: Install and Configure Oracle Identity Federation 11g in Preparation for Upgrade

Installing and configuring Oracle Identity Federation in preparation for an upgrade is similar to any other 11g installation. Later, you use the Oracle Fusion Middleware Upgrade Assistant to copy configuration information from the 10g environment to the new 11g environment.

To install and configure Oracle Identity Federation, in preparation for upgrade:

1. Locate the Oracle Identity Management CD–ROM.

   Alternatively, you can download and unpack the installation kit from the Oracle Technology Network (OTN):

   http://www.oracle.com/technology/
   

2. If you are installing from the CD–ROM, then navigate to the root directory of the CD–ROM.

   Or, if you downloaded and unpacked the software from the Oracle Technology Network, then change directory to the Disk1 directory in the location where you unpacked the software.

3. Start Oracle Universal Installer:

   On UNIX systems, enter the following command:

   ./runInstaller
   

   On Windows systems, double-click the setup.exe file.

4. Follow the instructions in the installer to install Oracle Identity Federation.

   Refer to the Oracle Fusion Middleware Installation Guide for Oracle Identity Management or click Help for general information about the prerequisites and prompts required during an Oracle Identity Federation installation.

5. When the installation and configuration is complete, exit from the Oracle Identity Management installation and configuration tool.

6.3.3 Task 3c: Create an Oracle HTTP Server Instance and Link It to Oracle Identity Federation 11g

For specific instructions, refer to "Create and Manage Oracle HTTP Server" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

6.4.1 Task 4a: Start the Upgrade Assistant for an Oracle Identity Federation Upgrade

To start the Upgrade Assistant using the graphical user interface:

1. Change directory the ORACLE_HOME/bin directory of the Oracle Fusion Middleware installation.

2. Enter the following command to start the Upgrade Assistant.

   On UNIX system:

   ./ua
   

   On Windows systems:

   ua.bat
   

   The Upgrade Assistant displays the Welcome screen as shown in Figure 6-1

   Figure 6-1 Upgrade Assistant Welcome Screen

   
   Description of "Figure 6-1 Upgrade Assistant Welcome Screen"
   
   

3. Click Next to display the Select Operation screen (Figure 6-2).

   The options available in the Upgrade Assistant are specific to the Oracle home from which it started. When you start Upgrade Assistant from an Oracle Application Server Identity Management Oracle home, the options shown on the Select Operation screen are the valid options for an Oracle Application Server Identity Management Oracle home.

   Figure 6-2 Upgrade Assistant Select Operation Screen for an Oracle Identity Federation Upgrade

   
   Description of "Figure 6-2 Upgrade Assistant Select Operation Screen for an Oracle Identity Federation Upgrade"
   
   

6.4.2 Task 4b: Upgrade Oracle Identity Federation

When you upgrade Oracle Identity Federation, the Upgrade Assistant upgrades the configuration files in the Oracle Identity Federation middle tier.

To upgrade Oracle Identity Federation when they reside in the same Oracle instance:

1. Start the Upgrade Assistant as described in Task 4a: Start the Upgrade Assistant for an Oracle Identity Federation Upgrade.

2. Select Upgrade Identity Management Instance on the Select Operation screen (Figure 6-2).

3. Refer to Table 6-1 for a description of the Upgrade Assistant screens that require input from you during an Oracle Identity Federation upgrade.

4. After the Specify Upgrade Options screen, the Upgrade Assistant performs the following tasks and provides the progress on each task:

   • Examines the components and schemas to be upgraded and verifies that they can be upgraded successfully.

   • Provides a summary of the components to be upgraded so you can verify that Upgrade Assistant is upgrading the components and schemas you expect.

   • Provides a progress screen so you can see the status of the upgrade as it proceeds.

   • Alerts you of any errors or problems that occur during the upgrade.

     See Also:

     "Troubleshooting Your Upgrade" in the Oracle Fusion Middleware Upgrade Planning Guide for specific instructions for troubleshooting problems that occur while running the Upgrade Assistant

   • Displays the End of Upgrade screen, which confirms that the upgrade was complete.

5. Exit the Upgrade Assistant.

6.5.1 Integrating Oracle Identity Federation 11g with Oracle Access Manager 10g

If you were previously using Oracle Identity Federation 10g with Oracle Access Manager, you can use the following procedure to configure Oracle Identity Federation 11g so it can work successfully with your existing Oracle Access Manager 10g software.

Note that the steps described here are based on the instructions available in the section, "Deploying Oracle Identity Federation with Oracle Access Manager" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

To use Oracle Identity Federation 11g with Oracle Access Manager 10g:

1. Upgrade to Oracle Identity Federation 11g using the instructions in the previous sections of this chapter.

   Specifically, be sure you have installed and configured Oracle Identity Federation 11g and that you have used the Upgrade Assistant to upgrade the Oracle Identity Federation instance to 11g.

2. Optionally, use Oracle Access Manager 10g as the authentication engine for Oracle Identity Federation 11g.

   For specific instructions, refer to "Integrate Oracle Access Manager as an Authentication Engine" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

3. Optionally, integrate Oracle Access Manager 10g as an SP integration module.

   For specific instructions, refer to "Integrate Oracle Access Manager as an SP Integration Module" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

4. Optionally, configure Oracle Access Manager 10g so that protected resources are using the new Oracle Identity Federation 11g authentication schemes.

   To perform this task, use the instructions that help you verify the proper integration of Oracle Access Manager by allowing Oracle Identity Federation 11g to create policy objects and authentication schemes in Oracle Access Manager.

   These instructions are located in the section, "Integrate Oracle Identity Federation with Oracle Access Manager" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

5. When the integration with Oracle Access Manager is complete, delete any old access gates, authentication schemes, and policies for Oracle Identity Federation 10g from Oracle Access Manager 10g.

   For more information, refer to the Oracle Access Manager documentation in the Oracle Identity Management 10g (10.1.4) documentation library, which is available on the Oracle Technology Network (OTN):

   http://www.oracle.com/technology/documentation
   

6.5.2 Using a Custom Authentication Engine or Custom SP Engine with Oracle Identity Federation 11g

If your Oracle Identity Federation 10g instance is integrated with a custom authentication engine, then use the information in the following sections to configure the custom authentication engine with Oracle Identity Federation 11g:

• Modifying the Authentication Engine Code

• Modifying the SP Engine Code

• Changes to the Logout Service for Authentication or SP Engines

• Deploying the Authentication or SP Engine

• Creating the Authentication Engine in Oracle Identity Federation 11g

• Creating the SP Engine in Oracle Identity Federation 11g

oracle.security.fed.authn.authnmech

request.getAttribute(“oracle.security.fed.authn.authnmech”)

oracle:fed:authentication:password-protected

oracle.security.fed.authn.refid

request.getAttribute("oracle.security.fed.authn.refid") 

request.setAttribute(“oracle.security.sso.sasso.uid”, userID)

request.setAttribute(“oracle.security.fed.authn.userid”. userID);

http://SP_HOST_NAME:SP_PORT/fed/sp/initiatesso 

6.5.3 Reconfiguring Oracle Single Sign-On Server After Upgrade to Work with Oracle Identity Federation 11g

If you are using Oracle Single Sign-On with Oracle Identity Federation 10g, then after you upgrade to Oracle Identity Federation 11g, you must reconfigure Oracle Single Sign-On.

This step is necessary because the values required for the SASSOAuthnUrl and SASSOLogoutUrl properfies have changed for Oracle Identity Federation 11g.

For more information, see "Configuring Single Sign-On" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

6.5.4 About Backwards Compatibility for ShareID Service URLs

Oracle Identity Federation 10g, as well as SHAREid/COREid Federation 2.x, provided service URLs for its SAML 1.x and WS-Federation protocol support, which were different from the SAML 2.0 and Liberty 1.x service URLs.

These URLs have been modified in the 11g Oracle Identity Federation server for consistency with the SAML 2.0 and Liberty 1.x service URLs. This means that customers upgrading to Oracle Identity Federation 11g, who use SAML 1.x or WS-Federation, will need to inform their partner providers of the new single sign-on service URLs.

To ease that transition, Oracle Identity Federation 11g provides a separate module that allows backwards compatibility with the SHAREid service URLs. This module is an installable J2EE application that is deployed alongside Oracle Identity Federation, which will handle requests for the ShareID/Oracle Identity Federation 10g service URLs and redirect or forward them to the corresponding Oracle Identity Federation 11g service URLs.

For information on how to set up this application, see "Setting up Backwards Compatibility for Oracle Identity Federation 10g and ShareID service URLs" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

6.5.5 Upgrading Oracle Identity Federation SSL Configuration

If you are using a shareId keystore for SSL support in Oracle Virtual Directory 10g, then the Upgrade Assistant automatically imports the keystore into Oracle Identity Federation 10g.

If the SSL identity and trust keystores you use in Oracle Virtual Directory 10g are stored in the following location, then there are no additional tasks to perform:

ORACLE_HOME/fed/shareid/oblix/config /keystore

However, if the keystores are stored in any other location, then you must perform the following tasks:

1. Copy the identify and trust keystores to a subdirectory inside the following directory:

   WLS_HOME/user_projects/domains/domain_name/servers/server_name/stage/OIF
   

2. Configure Oracle WebLogic Server to point to the new keystore location, as follows:

   1. Log in to the Oracle WebLogic Server Administration Console and select Environment, then Servers.

   2. Select the server for which you want to set up SSL.

   3. In the Keystores section, select Custom Identity and Custom Trust.

   4. In the Identity section, fill in the properties as follows:

      Custom Identity Keystore: location_of_keystore_containing_SSL_private key_and_certificate

      Custom Identity Keystore type: jks

      Custom Identity Keystore Passphrase: storepassword

   5. In the Trust section, fill in properties as follows:

      Custom Identity Keystore: location_of_keystore_containing_the_trusted certificate_entries

      Custom Identity Keystore type: jks

      Custom Identity Keystore Passphrase: storepassword

6.5.6 Setting Oracle Identity Federation System Properties After Upgrade

If you configured Oracle Identity Federation 10g by setting system properties, then you will have to manually configure those properties in the upgraded Oracle Identity Federation 11g instance. The Upgrade Assistant does not apply these settings to your 11g instance.

Table 6-4 lists the system properties that are not upgraded and explains how to set the equivalent properties in Oracle Identity Federation 11g. In many cases, the instructions refer to Oracle Enterprise Manager Fusion Middleware Control, the Oracle WebLogic Server Administration Console, or the WebLogic Scripting Tool (WLST), which are used to manage Oracle Fusion Middleware11g components.

For more information, see "Overview of Oracle Fusion Middleware Administration Tools" in the Oracle Fusion Middleware Administrator's Guide.

Note that these properties are documented in Section 9.3, "Managing Oracle Identity Federation Performance," in the Oracle Identity Federation Administrator's Guide for 10g (10.1.4.0.1). This document can be found in the Oracle Application Server 10g (10.1.4.0.1) documentation library on the Oracle Technology Network (OTN):

http://www.oracle.com/technology/documentation/

setConfigProperty('authnengines', 'ldaphaenabled', 
      'true', 'boolean')

setConfigProperty('datastore', 'userldaphaenabled', 
      'true', 'boolean')

setConfigProperty('datastore', 'fedldaphaenabled', 
     'true', 'boolean') 

6.5.7 Additional Oracle Identity Federation Post-Upgrade Tasks

The following additional post-upgrade tasks should be performed after upgrading to Oracle Identity Federation 11g, in addition to those described in the Oracle Fusion Middleware Upgrade Guide for Oracle Identity Management:

• If you are have configured Oracle Identity Federation 10g to use the SAML 1.x/WS-FED protocol, then after you upgrade to Oracle Identity Federation 11g, you must set a default single sign-on identity provider.

  For more information, see "Configuring Service Providers" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

• Export the Identity Provider self-signed certificate to the service provider

  The procedure you use to perform this task varies, depending on whether your service provider is a 10g or 11g service provider:

  • If you are using a 10g service provider, then refer to "Exporting the IdP's self-signed certificate to the SP" in the Oracle Identity Federation Administrator's Guide in the Oracle Application Server 10g (10.1.4.0.1) documentation library on the Oracle Technology Network (OTN):

    http://www.oracle.com/technology/documentation/
    

  • If you are using an 11g service provider, then refer to "Set Up Single Sign-On for SAML 1.x and WS-Federation" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

• If you are using an 11g Identity Provider and a 10g service provider, and you are using the SAML 1.x/WS-FED protocol, then you configure the 10g service provider.

  Specifically, for the 10g service provider, you must change the "Signing Certificate Subject DN" and "Signing Certificate Issuer DN" to 11g IdP format, which is of the form "CN=<host> Signing Certificate".

  For more information, see "Configure This Domain as a Source/Identity Provider" in the Oracle Identity Federation Administrator's Guide in the Oracle Application Server 10g (10.1.4.0.1) documentation library on the Oracle Technology Network (OTN).

• Enable "Send Signed Assertion" in Oracle Identity Federation 10g, or disable "Require Signed Assertions" in Oracle Identity Federation 11g.

  This task is necessary because in 10g, signed assertions are disabled by default, and in 11g, signed assertions are enabled by default.

  Depending whether you perform this task in 10g or 11g, refer to one the following:

  • "Configuring Service Providers" in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Federation.

  • Section 6.5.5, "Add Assertion Profile" in the Oracle Identity Federation Administrator's Guide in the Oracle Application Server 10g (10.1.4.0.1) documentation library on the Oracle Technology Network (OTN).