Installation and Upgrade Guides › SiteMinder Upgrade Guide › Upgrading from SiteMinder r6.x › How the r6.x Migration Works

How the r6.x Migration Works

To upgrade a SiteMinder deployment with multiple Policy Servers and Web Agents, remove one of the Policy Servers and Web Agents from the SiteMinder environment. While these components are being upgraded, the remaining Policy Servers and Web Agents continue to protect your resources.

Continue removing and upgrading SiteMinder components until all components are upgraded or operating in mixed–mode compatibility.

The following figures illustrate a simple r6.x environment and detail:

• The order in which existing components are upgraded.
• The order in which new components are installed.

Note: Each figure depicts a single policy store. This policy store includes the key store. Your environment can use separate policy and key stores.

1. In stage one, the r6.x policy store schema is extended.

   The existing r6.x policy store schema has not changed. The r12.5 migration requires that you extend the policy store schema for policy store for objects that r12.5 requires.

   If you have deployed a smkeydatabase, extend the policy store schema before upgrading your first Policy Server. Extending the schema prepares the policy store for the smkeydatabase migration to the certificate data store during a Policy Server upgrade. Extending the schema does not affect compatibility mode. The policy store continues to function as it did in r6.x.

   If you have not deployed a smkeydatabase, extend the schema as part of the policy store upgrade process.

2. In stage two, an r6.x Policy Server is upgraded to r12.5. The r12.5 Policy Server operates in compatibility mode. Consider the following items:
   • The r6.x Web Agents continue to communicate with the r12.5 Policy Server.
   • The r12.5 Policy Server continues to communicate with the r6.x policy and key store.
   • The r6.x Policy Server continues to communicate with the r6.x policy and key store. You can continue to use the r6.x Policy Server User Interface to administer the r6.x policy store through the r6.x Policy Server.
   • The Policy Server installer removes the Policy Server User Interface during the upgrade. The r12.5 Policy Server continues to provide access control and generates log files that contain auditing information. However, you cannot administer the r6.x policy store through r12.5 Policy Server until the Administrative UI is installed.
   • An r12.5 Policy Server can only communicate with an r12.5 certificate data store. If you are upgrading a legacy federation environment, the Policy Server installer attempts to migrate all existing smkeydatabase content to the certificate data store.

     Important! If the migration of the smkeydatabase fails, do not return the Policy Server to the environment. Returning the Policy Server after a failed migration causes all transactions that require the certificate data to fail.

3. In stage three, an r6.x Web Agent is upgraded to r12.5. Consider the following items:
   • The r6.x Web Agent continues to communicate with the r6.x and the r12.5 Policy Servers.
   • The r12.5 Web Agent only communicates with the r12.5 Policy Server.

     Note: You cannot configure a new r12.5 agent with an r12.5 Policy Server until the policy store is upgraded to r12.5.

4. In stage four, the remaining Policy Server is upgraded to r12.5. The r12.5 Policy Servers operate in compatibility mode with the r6.x policy and key store.

   Important! Although all Policy Servers continue to protect resources and you have access to the Policy Server Management Console, you cannot administer the Policy Servers. The Policy Server installer removed the Policy Server User Interface during the upgrade. You cannot manage policy information in the policy store until you have installed the r12.5 Administrative UI. Account for this time as you plan your migration.

   

5. In stage five, the r6.x policy and key store is upgraded to r12.5.
6. In stage six, the Administrative UI is installed and registered with a Policy Server. Consider the following items:
   • You can install the Administrative UI before upgrading the policy store. However, you cannot register the Administrative UI until the policy store is upgraded. Installing the Administrative UI before the policy store upgrade minimizes the amount of time the Administrative UI is unavailable to the policy store.
   • An r6.x Web Agent is illustrated as an example of mixed–mode compatibility.
7. (Optional) The final step, which is not illustrated, is to install and register a Report Server.

   Note: For more information about installing the Report Server, see the Policy Server Installation Guide.