Updating to version 3.20.0

Configuration stored in the database

From this version onward, most settings that used to live in config.properties are stored in the database.

What to expect when upgrading

On the first startup after upgrading to this version, migrating settings from the file to the database is automatic:

• RAC/M Identity copies config.properties to config.properties.old, writes the migrated values to the database, then removes those entries from config.properties.
• If config.properties.old already exists, the migration does not run: the existing backup must not be overwritten (resolve this before restarting—for example by renaming or archiving the old .old file).

What stays in config.properties

The following properties remain in config.properties. Those marked (optional) may be omitted if the default values are acceptable.

Data sources — for each prefix datasource.config, datasource.data, and datasource.workflow:

• {prefix}.driver, {prefix}.url, {prefix}.username, {prefix}.password
• (optional) {prefix}.timeBetweenEvictionRunsMillis, {prefix}.testWhileIdle, {prefix}.validationQuery, {prefix}.validationQueryTimeout, {prefix}.maxTotal, {prefix}.maxWaitMillis, {prefix}.maxConnLifetimeMillis, {prefix}.testOnBorrow, {prefix}.minEvictableIdleTimeMillis

Web server (SSL / Jetty)

• webserver.ssl, webserver.ssl.protocol_excludes, webserver.ssl.protocol, webserver.ssl.cypher_excludes
• webserver.ssl.keystore, webserver.ssl.keystore.password, webserver.ssl.trustore, webserver.ssl.trustore.password
• (optional) webserver.ssl.port, webserver.kerberos.display.sso

Outbound email (SMTP / OAuth2 in file)

• mail.server.host, mail.server.port, mail.server.user, mail.server.timeout.ms, mail.server.retry.count
• (optional) mail.auth.protocol, mail.server.starttls.enable, mail.server.password, mail.oauth2.token.url, mail.oauth2.client.id, mail.oauth2.client.secret, mail.oauth2.scopes

ICF

• icf.folder, run.icf.server, icf.server.keystore.password, icf.server.truststore.path, icf.server.truststore.password
• (optional) icf.server.port, icf.server.start.wait.millis

Connector / C2 queues (property map prefixes)

• Prefixes: c2.app.category., c2.app.reqtype., c2.appGroup.category., c2.appGroup.reqtype.
• Single properties: mail.admin.c2, c2.queue.id
• (optional) mail.provisioning.c2RequesterUsedAsSender, mail.request.automatic.provisioning.account.notification, mail.request.automatic.provisioning.profile.notification

Per-server bootstrap (sequences / workflow engine)

These keys stay in config.properties because each application server in a cluster may need a different value. Changing them requires a server restart.

• (optional) scheduler.enable — when true, automatic sequences run on this server (default true). Shown under Configuration → Global configurations.
• (optional) workflow.engine.enable — when true, this server processes scheduled workflow reminders and escalations (default true). Shown under Configuration → Global configurations (Task / Workflow panel). In a high-availability deployment, set this to true on only one server so reminder and escalation emails are not sent twice. The actionable task-assignment notification is always sent, on whichever server created the task, regardless of this setting.
• (optional) workflow.deadline.reload.interval.seconds — how often the server that runs the workflow engine re-scans the shared workflow database for task deadlines created by other servers, so their reminders are still delivered (default 60). Used only when workflow.engine.enable is true. Shown under Configuration → Global configurations (Task / Workflow panel, when the workflow engine is enabled). Absent from the shipped configuration file; add it there to override the default.

All other parameters, once migrated to the database, are no longer read from config.properties.

RSA Authentication Manager connector

The RSA Authentication Manager ICF connector (rsa-8.4) is no longer included in the default RAC/M Identity distribution.

If you use this connector:

• Keep the existing JAR under [Install directory]/server/ICF/server/connectors when upgrading, or
• Obtain the connector from OKIOK support and install it as described in Adding the connector files to the solution.

See RSA Authentication Manager for configuration details.

LDAP and Active Directory connector

This version ships a new version of the LDAP connector (3.0.0), replacing the 1.x versions distributed with earlier releases of RAC/M Identity. The 1.x versions are no longer supported: use version 3.0.0 or later.

What to expect when upgrading

The update installs the new version of the connector, but it does not remove the older ones and does not change connectors that are already configured. As long as an LDAP or Active Directory ICF connector does not use version 3.0.0 or later, or as long as the 1.x files remain installed, its imports may fail.

Note

The problem does not necessarily appear on the first attempt. An import that returns only a small number of entries may complete normally, while an import of a large directory stops partway through: the sequence ends in error after three attempts and only part of the entries have been processed. Validating on a sparsely populated test directory can therefore give the impression that everything works.

Steps to follow:

1. Under CONFIGURATION → ICF Connectors, create a new connector for each LDAP or Active Directory connector, selecting version 3.0.0 or later in the Type field (the connector type cannot be changed on an existing, saved connector), then point the relevant tasks at the new connector.
2. Remove the older version files (connector-ldap-okiok-1.*.jar) from the [Install directory]/server/ICF/server/connectors directory.
3. Restart the ICF server.
4. Run a full import again and confirm that the number of processed entries matches the contents of the directory.

See LDAP for configuration details.