Installation and Upgrade Guides › SiteMinder Upgrade Guide › Upgrading from CA SiteMinder® r12.x › Migration Considerations

Migration Considerations

If you are migrating from r12.x, consider the following before beginning the migration.

Administrative UI Upgrade Paths

Review the following upgrade considerations:

• You cannot upgrade the Administrative UI on an existing application server from versions before 12.5 to 12.52 SP1. Instead, complete the following steps:
  1. Uninstall the r12.x version of the Administrative UI.
  2. Install an application server that CA SiteMinder® supports.
  3. Install a new 12.52 SP1 Administrative UI.

  Note: For more information about installing the Administrative UI, see the Policy Server Installation Guide.

• You can upgrade the Administrative UI on an existing application server infrastructure only from version 12.5 to 12.52 SP1.
• You can upgrade the r12.x Administrative UI that uses the embedded version of JBoss to 12.52 SP1.

Note: For more information about upgrading the Administrative UI, read the instructions in How to Migrate from r12.x and Upgrade an r12.x Administrative UI.

Administrative UI Protection with SiteMinder

You can protect an 12.52 SP1 Administrative UI with CA SiteMinder®. Protecting the Administrative UI requires that you complete the following steps:

1. Configure an agent to work with a reverse proxy server.

   Note: For more information about configuring a reverse proxy server, see the Web Agent Configuration Guide.

2. Configure an external administrator store. You enable CA SiteMinder® authentication when you configure the store.

   Note: For more information about configuring an external administrator store, see the Policy Server Configuration Guide.

If you have configured an r12.x Administrative UI with an external administrator store and you want to enable CA SiteMinder® authentication, complete the following steps:

1. Configure an agent to work with a reverse proxy server.
2. Reconfigure the external administrator store with the required agent settings.

Important! The Administrative UI does not retain the settings when you reconfigure the store. Before you reconfigure the connection, we recommend that you view the connection and record the settings.

Single Sign–on

You can maintain single sign–on during the migration to 12.52 SP1. Consider the following items:

• An 12.52 SP1 Policy Server can communicate with an r12.x policy store and an r12.x key store.
• An 12.52 SP1 Policy Server can communicate with an r12.x session store.

Certificate Data Management

The certificate data store is replacing the CA SiteMinder® key database (smkeydatabase). If you have one or more smkeydatabases deployed in your environment, consider the following items:

• The certificate data store is collocated with the 12.52 SP1 policy store. A single certificate data store replaces the need for an individual smkeydatabase instance on each Policy Server host system.
• As part of a Policy Server upgrade, all smkeydatabase content is automatically backed up and migrated to the certificate data store.
• A 12.52 SP1 Policy Server can only communicate with a certificate data store. A 12.52 SP1 Policy Server and the respective local smkeydatabase do not operate in compatibility mode. However, all Policy Servers that have not been upgraded continue to communicate with their local version of the smkeydatabase.

  Important! If the migration of the smkeydatabase fails, do not return the Policy Server to the environment. Returning the Policy Server after a failed migration causes all transactions that require the certificate data to fail.

• Synchronize all smkeydatabase instances before beginning the migration. Synchronizing all instances helps avoid data collisions. Data collisions prevent a successful migration.
• All Policy Servers that share a common view into the same policy store have access to the same keys, certificates, and certificate revocation lists (CRL).
• The purpose of the certificate data store remains unchanged from the purpose of the smkeydatabase. This store makes the following available to the CA SiteMinder® environment:
  • Certificate authority (CA) certificates
  • Public and private keys
  • Certificate revocation lists
• You can continue to use the CA SiteMinder® key tool to manage the certificate data store. However, several options are deprecated.

  Note: For more information, see the Policy Server Release Notes.

• If a CRL is stored in an LDAP directory service, consider the following items:
  • CA SiteMinder® no longer requires that the issuer of the CRL is the same CA that issued the corresponding root certificate.
  • CA SiteMinder® no longer performs this check. This behavior is consistent with the requirements for a text–based CRL.

More information:

Synchronize Key Database Instances

Deprecated CA SiteMinder® Key Tool Options

Federation Integration

All Federation Security Services functionality available in an r12.x FSS Administrative UI has been moved to the Administrative UI. If you were managing a federated environment, this functionality is referred to as legacy federation.

The Administrative UI also includes partnership federation. This functionality is specific to the partnership–based federation that CA SiteMinder® Federation makes available.

Avoid Policy Store Corruption

To avoid possible policy store corruption, be sure that the server that is hosting policy store is configured to store objects in UTF-8 form.

Note: For more information about configuring your server to store objects in UTF-8 form, see your vendor–specific documentation.

Advanced Password Services

If you have deployed Advanced Password Services, a Policy Server upgrade retains all LANG (translation), CFG (configuration), and mail files. The default 12.52 SP1 versions of the files are installed to siteminder_home\samples.

siteminder_home

Specifies the Policy Server installation path.

CA SiteMinder® Integration with CA Arcot WebFort and CA Arcot RiskFort

If you integrated CA SiteMinder® Release 12.5 or earlier with CA Arcot WebFort and CA RiskFort using CA Arcot Adapter, and you want to upgrade CA SiteMinder® to 12.52 or later, perform the following steps:

1. Navigate to the AFM_HOME\conf directory.
2. Take a back-up of the adaptershim.ini file.
3. Upgrade CA SiteMinder®.
4. Copy the backed-up adaptershim.ini file in the ARCOT_HOME\conf directory.