Hi Krishna, in addition to Rama's recommendation, I would like to share that we did opted in our migration strategy (suggested by Rama) to first replace our ISAM V7 PoC with ISAM V9 PoC while still running our federations for some time on ITFIM 6.2.2.
In addition, you still have 2 choices: migrate one fed at the time or instead all those feds behind a given PoC all at the same time. That depends on different factors namely the numbers of feds behind a PoC, the risk you can assume and how flexible your setup is in non-PROD to allow testing up the existing feds in isolated environment first with ISAM V9 federation module.
This question must be raised as if you plan to migrate one fed at the time, moving from let's say from /FIM junction (your existing ITFIM 6.2.2) to an hypothetical /isam junction (your new ISAM 9 Federation module setup), this will affect your fed URL that partners use to redirect/post SAML sign-on/sign-out requests. This means further you must coordinate with every one of them to make the change (both PoC and URL) on both ends at the same time not excluding the possibility of enforcing some URL rewriting from old to new ones to ensure old bookmarked fed URLs are not suddenly blocking your end-users out.
Some customers with relatively "low" number of feds behind a given PoC (10 or less) may opt to preserve their existing /FIM junction in place but redirect its traffic to ISAM 9 federation module all at once given that all of them can be tested at the same time. If well prepared, and all new federations configurations (keys, mapping rules, etc.) have all been pre-loaded ahead of time in ISAM 9 fed module appliances (presumably with Ansible playbooks with confidence building-up its way up in all your working non-PROD environments) then going live with ISAM 9 fed module in Production should not be as demanding or risky as it may look at first.
Thereafter, if you want to move away eventually from your "legacy" /FIM junction (connected to ISAM V9 fed module) , you can still plan it at some other time, one fed at the time. You could opt also that all your new feds will rely on your new /isam fed URI going forwards and then your number of legacy /FIM feds will shrink nicely over time.
What is your most important business driver here ? Moving out of ITFIM 6.2.2 rapidly because its EOS date has been reached out already, or else adopting new features from ISAM v9, etc …
So, lots to think in your migration planning.
But more importantly, we did have to make some little adjustments on our end in the ISAM PoC /FIM when we transferred it over from V7 to ISAM V9 federation module so make sure you can test everything out in a non-Production environment first.
Happy migration.
------------------------------
Sylvain Gilbert
------------------------------
Original Message:
Sent: Wed February 05, 2020 02:33 PM
From: Rama Yenumula
Subject: Calling TFIM customers
Hi Krishna, Both TFIM WebSphere runtime and ISAM Liberty Runtime run isolated. If you have separate entry points for POC (/fim and /isam) into sps, both runtimes can co-exist and ensures requests are going to correct federation runtime. If you have same POC for both TFIM and ISAM, then you could add both TFIM/ISAM runtime servers to junctions and control the backends using Server Offline.
server task instance_name-webseald-host_name offline [–i server_uuid] junction_point
Regards,
Rama
------------------------------
Rama Yenumula
Original Message:
Sent: Wed February 05, 2020 02:03 PM
From: Krishna Baddam
Subject: Calling TFIM customers
Is it possible for IFIM 6.2 and ISAM 9 federation run times coexist during migration. We want to migrate the IFIM 6.2 point of contact webseal to ISAM 9 and create the same junction /fed/sps. We would like to migrate the federations one at time. The migrated federation points to the new run time while the old federations still point to the old run time.
------------------------------
Krishna Baddam
Original Message:
Sent: Tue March 26, 2019 04:21 AM
From: Jon Harry
Subject: Calling TFIM customers
Hello everyone,
If you are still using Tivoli Federated Identity Manager, you are hopefully already aware that this product goes End Of Support in September this year.
The development team are asking anyone still using TFIM to complete a survey so they can better understand any reasons preventing migration to ISAM so that everyone can have a smooth transition.
The survey is linked from the following blog post:
https://www.ibm.com/blogs/security-identity-access/calling-all-ibm-tivoli-federated-identity-manager-customers/
Cheers... Jon.
------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------