Web Services Security Guides › CA SiteMinder® Web Services Security Upgrade Guide › Upgrading from CA SOA Security Manager r12.1 SP3 › How to Migrate from SOA Security Manager r12.1 SP3 › How to Upgrade a SOA Security Manager r12.1 SP3 Policy Store

How to Upgrade a SOA Security Manager r12.1 SP3 Policy Store

Complete the following procedures to upgrade an r12.1 SP3 policy store to 12.52 SP1:

1. Stop all Policy Servers that are communicating with the policy store.
2. Import the policy store data definitions.
3. Import the default policy store objects.
4. If you configured policy objects related to generating SAML assertions using the FSS Administrative UI, run the XPS sweeper utility to complete the migration of your legacy federation objects.
5. Start all Policy Servers that are communicating with the policy store.

Stop all Policy Severs

Stopping all of the Policy Servers that are communicating with the policy store helps to prevent policy store corruption during the upgrade.

Follow these steps:

1. Log in to the Policy Server host system.
2. Complete one of the following steps:
   • (Windows)
     1. Open the Policy Server Management Console and click Stop.
     2. Click OK to close the console.
   • (UNIX) Use the following supplied script:

     install_path/siteminder/stop-all
     

     install_path

     Specifies the Policy Server installation path.

3. Repeat this procedure for each Policy Server that is communicating with the policy store.

Import the Policy Store Data Definitions

Importing the policy store data definitions defines the types of objects that can be created and stored in the policy store.

Follow these steps:

1. Open a command window and navigate to siteminder_home\xps\dd.

   siteminder_home

   Specifies the Policy Server installation path.

2. Run the following command:

   XPSDDInstall SmMaster.xdd
   

   XPSDDInstall

   Imports the required data definitions.

Import the Default Policy Store Objects

Importing the default policy store objects configures the policy store for use with the Administrative UI and the Policy Server.

Consider the following items:

• Be sure that you have write access to siteminer_home\bin. The import utility requires this permission to import the policy store objects.

  siteminder_home

  Specifies the Policy Server installation path.

• Before running a CA SiteMinder® utility or executable on Windows Server 2008, open the command line window with administrator permissions. Open the command line window this way, even if your account has administrator privileges. For more information, see the release notes for your CA SiteMinder® component.

Follow these steps:

1. Open a command window and navigate to siteminder_home\db.
2. Import one of the following files:
   • To import smpolicy.xml, run the following command:

     XPSImport smpolicy.xml -npass
     

   • To import smpolicy–secure.xml, run the following command:

     XPSImport smpolicy-secure.xml -npass
     

   Note: You use either file to configure a new policy store and upgrade an existing store. When imported as part of an upgrade, the file does not overwrite existing default objects that were modified. Both files include the default policy store objects. These objects include the default security settings in the default Agent Configuration Object (ACO) templates. The secure file provides more restrictive security settings.

   –npass

   Specifies that no passphrase is required. The default policy store objects do not contain encrypted data.

   The default policy store objects are imported.

Run the XPS Sweeper Utility

If you configured policy objects related to generating SAML assertions using the FSS Administrative UI, run the XPS sweeper utility (XPSSweeper) to complete the migration of these objects.

Follow these steps:

1. Log in to the Policy Server host system.
2. Run the following command to make available your legacy federation objects to the Administrative UI:

   XPSSweeper
   

   All legacy federation created using the FSS Administrative UI are available in the Administrative UI.

Start all Policy Servers

Starting all Policy Servers resumes communication between all of the Policy Servers and the upgraded policy store.

Follow these steps:

1. Log in to the Policy Server host system.
2. Complete one of the following steps:
   • (Windows)
     1. Open the Policy Server Management Console and click Start.
     2. Click OK to close the console.
   • (UNIX) Use the following supplied script:

     install_path/siteminder/start-all
     

     install_path

     Specifies the Policy Server installation path.

3. Repeat this procedure for each Policy Server that is communicating with the policy store.

The policy store is upgraded.