I will definitely advice to do a "Separate system upgrade" as described here : https://www.ibm.com/docs/en/sig-and-i/10.0.0?topic=migrate-separate-system-upgrade-data-migration - that will mak it possible to exercise the upgrade until the process is smooth and you have thoroughly tested it. This way you can ensure very little downtime and risk as fallback is just to restart your existing environment if something goes wrong.
If you select this route a good trick is to ensure that the scheduler does not start when the ISIM server starts - this can be done by removing the scheduler from this line in enRoleStartup.properties
##%START_WAS%
####################
## IBM Websphere 5.0
####################
enrole.startup.names=Scheduler,PasswordExpiration,DataServices,PostOffice,ReconcilerCleanup,RemotePending,PolicyAnalysis,PasswordSynchStore,Monitoring,WebServices
# NOTE! NOTE! On App tier install of Functional Cluster:
# Uncomment the following line, and comment out the above line:
# enrole.startup.names=PasswordExpiration,DataServices,PostOffice,RemotePending
removing the scheduler will ensure that no outstanding reconciliations etc. are started by mistake. You should also ensure that the connectivity to systems are shutdown (SDI dispatchers and ISIM adapters) unless you specifically are testing them.
I will al so clearly recommend that you use IBM Technical Expert Labs or a trusted business partner to help you in this - that should meke the chance for a smooth migration a lot better...
HTH
HTH
------------------------------
Franz Wolfhagen
WW IAM Solution Engineer - Certified Consulting IT Specialist
IBM Security Expert Labs
------------------------------
Original Message:
Sent: Fri April 28, 2023 08:28 AM
From: Angela Cook
Subject: Is there an ISVG version thats no a VA?
I have performed the upgrade/migration from ISIM6 >> ISVG (Identity Manager) for a few customers. If I recall, it is NOT recommended to attempt the pmt (profile management) migration as documented in WAS docs (for ISIM anyway). In fact, I think I attempted the profile migration back in 2021 - unsuccessfully!! Maybe that works well for other apps or systems.
I just remember having lots of issues AND I think you have to be able to stop the old and start the new and that was not an option, especially considering ISIM was not even installed on the new systems yet. I do not recall all the details, but after speaking with L2, I just simply built the new cluster. I created the new WAS with the same cluster names for all. Also, make sure you check the lib path and the get the certs!!!!
The high level is that you build you WAS 9 systems, create the clusters, then tar/copy the opt/itim/data directory's from each 8.5 to each 9 system, then perform the upgrade with the new ISIM installer packages (in addition to the documented prereqs for middleware).
The major issue I had was with a custom application and WAS 9 java was compatible. The app owner needed to provide updated jars.
Java.lang.UnsupporteClassVersionEror] JVMCFRE003 bad major version class=com/xxxx/isimextensions/WorkflowApplicationExtension, offset=6
To see the SDK version available on the WAS server:
app_server_root/bin/managesdk.sh -listEnabledProfileAll -verbose
I also had issues with the Realm, but I have had the same issues each time. I think it is user error :) At any rate, after the installer finishes, it shows as a nonfatal error, and then reviewing/updating the realm in the WAS console, everything works fine.
------------------------------
Angela Cook
Original Message:
Sent: Thu April 27, 2023 10:31 AM
From: Alejandro Valente
Subject: Is there an ISVG version thats no a VA?
Thank you both for your answer.
Is there a special consideration if at the same time we have to upgrade WAS 8.5.5 to 9 ?
Because i saw mentions of migrating database and directory but not WAS. And in supported software i see that ISIM 6 doesnt support WAS 9 and ISVG 10 doesnt support 8.5
------------------------------
Alejandro Valente
Original Message:
Sent: Thu April 27, 2023 04:09 AM
From: Franz Wolfhagen
Subject: Is there an ISVG version thats no a VA?
Thanks for beating me answering this : -)
Let me be quite frank here - I will not recommend any ISIM 6 customers to "migrate" ti ISVG 10 IM VA - please stay on the SW version. All you need to do this is in the official documentation as pointed out by Stephen.
IIRC there should be a similar technote to the one showing the SW -> VA - but I have not been able to locate it - I have internally raised the question why this is actually the one that is promoted. Prsonally I do not understand we propose this but not vice versa (going from ISIM 7 to ISVG 10 IM SW) as this would make a lot more sense - but that is probably why I am a services person ;-)
I normally recommend the Separate system upgrade and data migration as the best and most flexible option.
IBM Technical Expert Labs can help you - we have done this many times over the last years and have handled even very complex migrations.
------------------------------
Franz Wolfhagen
WW IAM Solution Engineer - Certified Consulting IT Specialist
IBM Security Expert Labs
Original Message:
Sent: Thu April 27, 2023 03:01 AM
From: Stephen Swann
Subject: Is there an ISVG version thats no a VA?
Alejandro,
ISVG v10 is an umbrella term that ships with an entitlement to two products:
- Verify Governance (what was IGI - Identity Governance & Intelligence)
- Verify Governance Identity Manager (what was ISIM)
The Verify Governance (IGI) product is a Virtual Appliance only.
However, the Identity Manager product is provided in both Virtual Appliance and Software Install formats. Installers are provided for Windows, AIX and Linux. As such, upgrading from ISIM v6 should be relatively straightforward.
The eAssembly for IBM Security Verify Governance Lifecycle v10.0 for IBM Security Identity and Access Assurance 3.1.4 Multiplatform Multilingual contains the following package which should help: Identity Manager v10.0 Installer for Linux x86 for IBM Security Verify Governance v10.0 Multilingual.
Good luck with your upgrade.
------------------------------
Stephen Swann
Directory of Vision & Strategy
Madigan Solutions
Belfast
www.madigansolutions.com
Original Message:
Sent: Tue April 25, 2023 11:33 PM
From: Alejandro Valente
Subject: Is there an ISVG version thats no a VA?
Hello,
All the documentation that i found seems to be for a VA, is there no longer a software option?
And if there is, what are the steps to Upgrade from ISIM 6 to the new ISVG ?
Thank you for your time,
Regards
------------------------------
Alejandro Valente
------------------------------