Release Notes › Policy Server Release Notes › Installation and Upgrade Considerations

Installation and Upgrade Considerations

Upgrade Information Page

In addition to the SiteMinder Upgrade Guide, CA Support Online includes valuable upgrade information. For more information, see the CA r12.5 Upgrade Information page.

Java Virtual Machine Installation Error on Solaris can be Ignored (149886)

Symptom:

You are doing a console mode installation of a SiteMinder product on a Solaris platform. The following error message displays: "Unable to install the Java Virtual Machine included with this installer."

Solution:

Ignore this error message. The error is a third-party issue and it has no functional impact.

Administrative UI and Internet Explorer 9 (149209)

If you are using Internet Explorer (IE) 9 to view the Administrative UI, run the Administrative UI in compatibility mode to submit the forms.

Installation Media Names

The following tables identify the installation executables for the following SiteMinder components:

• Documentation
• Policy Server
• Administrative UI
• Report Server

Note: Information appears by platform. For more information about supported operating systems, see the r12.5 SiteMinder Platform Support Matrix on the Technical Support site.

Documentation

The SiteMinder bookshelf is available on the Support site. The bookshelf does not require an installer. For more information, see Locate the Bookshelf.

Policy Server

cr

Specifies the cumulative release number. The base r12.5 release does not include a cumulative release number.

Important! If you are running this wizard on Windows Server 2008, run the executable file with administrator permissions. Use these permissions even if you are logged in to the system as an administrator. For more information, see the release notes for your SiteMinder component.

Administrative UI

cr

Specifies the cumulative release number. The base r12.5 release does not include a cumulative release number.

Important! If you are running this wizard on Windows Server 2008, run the executable file with administrator permissions. Use these permissions even if you are logged in to the system as an administrator. For more information, see the release notes for your SiteMinder component.

Report Server

cr

Specifies the cumulative release number. The base r12.5 release does not include a cumulative release number.

Important! If you are running this wizard on Windows Server 2008, run the executable file with administrator permissions. Use these permissions even if you are logged in to the system as an administrator. For more information, see the release notes for your SiteMinder component.

More information:

Locate the Platform Support Matrix

Password Policy Message and Active Directory

If you are upgrading to r12.5, the Password Services forms credential collector can present a password change message that users are not familiar with. If the following criteria are met, Active Directory users receive the password reuse message:

• The DisallowForceLogin registry key is enabled.

  Note: For more information, see the Policy Server Configuration Guide.

• An Active Directory user directory is bound to a password policy.
• The SiteMinder password policy is not tracking password history.
• The Active Directory service is tracking password history and reuse.

This message states that a password change failed because an old password cannot be reused as new.

You can customize the password reuse message using the FCC properties template (smpwservicesUS–EN.properties). The template is located in web_agent_home\samples\forms.

web_agent_home

Specifies the web agent installation path.

Customized Password Change Messages

If Password Services is customized to send authentication failure messages based on SiteMinder authentication reason codes, we recommend that you verify that your implementation handles all password message values (PasswordMsg) that the SiteMinder SDK defines.

Password Services error handling is enhanced to:

• Better distinguish error codes that a user store returns for an authentication failure.
• Return a distinct SiteMinder authentication reason code.

This enhancement can result in users receiving messages that they are unfamiliar with.

More information:

Password Services and User Store Error Handling

Certificate Revocation List Issuer

If you are upgrading to r12.5 and a CRL is stored in an LDAP directory service, consider the following items:

• SiteMinder no longer requires that the issuer of the CRL is the same CA that issued the corresponding root certificate.
• SiteMinder no longer performs this check. This behavior is consistent with the requirements for a text–based CRL.

Deprecated SiteMinder Key Tool Options

If you are using key tool options in automated scripts, consider that the following options are deprecated:

• createDB

  This option is not being replaced and does not work with the accessLegacyKS argument. If a script uses this option:

  • The option executes to maintain backwards compatibility, but does not create a smkeydatabase.
  • A message states that the option is deprecated.

  Note: If a script also attempts to verify that a smkeydatabase was created successfully, the script fails. A smkeydatabase directory does not exist in an r12.5 Policy Server installation.

• deleteDB

  This option is deprecated. The removeAllCertificateData replaces this option. If a script uses the deleteDB option:

  • The option executes to maintain backwards compatibility. All certificate data in the certificate data store, not a smkeydatabase, is removed.
  • A message states that the option is deprecated.
• changePassword

  This option is not being replaced. If a script uses this option:

  • The option executes to maintain backwards compatibility, but does not change a password.
  • A message states that the option is deprecated.

Upgrading a Policy Store

In previous releases, you used the smobjimport utility to import an upgrade SiteMinder data interchange format (smdif) file. Importing an upgrade file, instead of the smpolicy file (smpolicy.smdif), prevented existing default objects that were modified from being overwritten.

This release no longer requires an upgrade file. You use the XPSInstall utility to import the smpolicy.xml file. When you import this file as part of an upgrade, it does not overwrite existing default objects that were modified.

Note: For more information about upgrading a policy store, see the SiteMinder Upgrade Guide.

Considerations for Upgrading r6.x to r12.x

If your Policy Server and policy store are operating in mixed-mode during an upgrade to r12.5, the following error message appears when you start the Policy Server:

[8114/21][Fri Oct 15 2010 09:10:26][CA.XPS:LDAP0014][ERROR] Error occurred during "Modify" for
xpsParameter=CA.XPS::$PolicyStoreID,ou=XPS,ou=policysvr4,ou=siteminder,ou=netegrity,dc=PSRoot",text: Object
class violation

[8114/21][Fri Oct 15 2010 09:10:26][CA.XPS:XPSIO024][ERROR] Save Policy Store ID failed.

This message is expected behavior and does not affect the SiteMinder environment.

This message occurs because the r6.x policy store is not upgraded. Part of the upgrade process includes importing the policy store data definitions. The error appears in the SiteMinder Policy Server log because the data definitions are not available in the policy store.

Considerations for Existing LDAP User Directory Connections Over SSL

Configuring an LDAP user directory connection over SSL requires that you configure SiteMinder to use your certificate database files.

The Policy Server requires that the certificate database files be in the Netscape cert8.db file format. Use the Mozilla Network Security Services (NSS) certutil application installed with the Policy Server to convert existing cert7.db certificate database files to cert8.db format.

Note: The following procedure details the specific options and arguments to complete the task. For a complete list of the NSS utility options and arguments, refer to the Mozilla documentation on the NSS project page.

Important! Before running a SiteMinder utility or executable on Windows Server 2008, open the command-line window with administrator permissions. Open the command-line window this way, even if your account has administrator privileges.

To convert the certificate database file

1. From a command prompt, navigate to the Policy Server installation bin directory.

   Example: C:\Program Files\CA\SiteMinder\bin

   Note: Windows has a native certutil utility. Verify that you are working from the Policy Server bin directory, or you can inadvertently run the Windows certutil utility.

2. Enter the following command:

   certutil  -L  -d certificate_database_directory [-p prefix_name]  -X
   

   -d certificate_database_directory

   Specifies the directory that contains the certificate database files to convert.

   -p prefix_name

   (Optional) Specifies any prefix used when creating the existing cert7.db file (for example, my_cert7.db).

   Certutil converts the existing cert7.db file to cert8.db format.