Updating to version 3.20.0

Configuration stored in the database

From this version onward, most settings that used to live in config.properties are stored in the database.

What to expect when upgrading

On the first startup after upgrading to this version, migrating settings from the file to the database is automatic:

• RAC/M Identity copies config.properties to config.properties.old, writes the migrated values to the database, then removes those entries from config.properties.
• If config.properties.old already exists, the migration does not run: the existing backup must not be overwritten (resolve this before restarting—for example by renaming or archiving the old .old file).

What stays in config.properties

The following properties remain in config.properties. Those marked (optional) may be omitted if the default values are acceptable.

Data sources — for each prefix datasource.config, datasource.data, and datasource.workflow:

• {prefix}.driver, {prefix}.url, {prefix}.username, {prefix}.password
• (optional) {prefix}.timeBetweenEvictionRunsMillis, {prefix}.testWhileIdle, {prefix}.validationQuery, {prefix}.validationQueryTimeout, {prefix}.maxTotal, {prefix}.maxWaitMillis, {prefix}.maxConnLifetimeMillis, {prefix}.testOnBorrow, {prefix}.minEvictableIdleTimeMillis

Web server (SSL / Jetty)

• webserver.ssl, webserver.ssl.protocol_excludes, webserver.ssl.protocol, webserver.ssl.cypher_excludes
• webserver.ssl.keystore, webserver.ssl.keystore.password, webserver.ssl.trustore, webserver.ssl.trustore.password
• (optional) webserver.ssl.port, webserver.kerberos.display.sso

Outbound email (SMTP / OAuth2 in file)

• mail.server.host, mail.server.port, mail.server.user, mail.server.timeout.ms, mail.server.retry.count
• (optional) mail.auth.protocol, mail.server.starttls.enable, mail.server.password, mail.oauth2.token.url, mail.oauth2.client.id, mail.oauth2.client.secret, mail.oauth2.scopes

ICF

• icf.folder, run.icf.server, icf.server.keystore.password, icf.server.truststore.path, icf.server.truststore.password
• (optional) icf.server.port, icf.server.start.wait.millis

Connector / C2 queues (property map prefixes)

• Prefixes: c2.app.category., c2.app.reqtype., c2.appGroup.category., c2.appGroup.reqtype.
• Single properties: mail.admin.c2, c2.queue.id
• (optional) mail.provisioning.c2RequesterUsedAsSender, mail.request.automatic.provisioning.account.notification, mail.request.automatic.provisioning.profile.notification

Per-server bootstrap (sequences / workflow engine)

These keys stay in config.properties because each application server in a cluster may need a different value. Changing them requires a server restart.

• (optional) scheduler.enable — when true, automatic sequences run on this server (default true). Shown under Configuration → Global configurations.
• (optional) workflow.engine.enable — when true, this server processes scheduled workflow reminders and escalations (default true). Shown under Configuration → Global configurations (Task / Workflow panel). In a high-availability deployment, set this to true on only one server so reminder and escalation emails are not sent twice. The actionable task-assignment notification is always sent, on whichever server created the task, regardless of this setting.
• (optional) workflow.deadline.reload.interval.seconds — how often the server that runs the workflow engine re-scans the shared workflow database for task deadlines created by other servers, so their reminders are still delivered (default 60). Used only when workflow.engine.enable is true. Shown under Configuration → Global configurations (Task / Workflow panel, when the workflow engine is enabled). Absent from the shipped configuration file; add it there to override the default.

All other parameters, once migrated to the database, are no longer read from config.properties.

RSA Authentication Manager connector

The RSA Authentication Manager ICF connector (rsa-8.4) is no longer included in the default RAC/M Identity distribution.

If you use this connector:

• Keep the existing JAR under [Install directory]/server/ICF/server/connectors when upgrading, or
• Obtain the connector from OKIOK support and install it as described in Adding the connector files to the solution.

See RSA Authentication Manager for configuration details.