You should apply the one-hop upgrade one-off patch (OIM bundle patch 12.2.1.4.210428) after completing the installation and configuration of Oracle Identity Manager 12c (12.2.1.4).

1. Install and configure Oracle Identity Manager 12c (12.2.1.4) on the same or on a different machine.

   See Installing the Oracle Identity Governance Software in Installing and Configuring Oracle Identity and Access Management.

   Note:

   The settings in the User Messaging Service (UMS) Email Driver present in 11g (11.1.2.3) will not be migrated as part of the one-hop upgrade process. If required, you have to configure the UMS Email Driver after installing the 12c (12.2.1.4) software. See Configuring the User Messaging Drivers in Administering Oracle Identity Governance.
2. Tune the newly installed Oracle Identity Manager 12c (12.2.1.4) setup as per the required load. Improperly tuned servers may fail to start correctly after the upgrade. For information on tuning, see Oracle Identity Governance Performance Tuning and Performance Tuning Guidelines and Diagnostics Collection for Oracle Identity Manager (OIM) (Doc ID 1539554.1)
3. The Upgrade Assistant requires read-write access to the 11g domain. If you have chosen to install OIG 12c on a machine which does not have read-write access to the 11g domain home, copy over the 11g domain home to a writable location on the machine that hosts the OIG 12c setup. Provide this new location when you perform schema upgrade by using the Upgrade Assistant.

   Note:

   If you are using localhost as the host name in the 11g datasources, you need to change all localhost references to the actual hostname on the 11g setup first. You can use the cloning utility to change the references. See Doc ID 2621548.1 and refer the section titled 'Update Hostname in configuration files in DOMAIN_HOME and MDS' of the Migration Document.
4. Apply the latest Stack Patch Bundle (SPB) using OPatch, on the 12c (12.2.1.4) binaries. See Doc ID 2657920.1.

Run the pre-upgrade report utility before you begin the upgrade process for Oracle Identity Manager, and address all of the issues using the solution provided in the report.

The pre-upgrade report utility analyzes your existing Oracle Identity Manager environment, and provides information about the mandatory prerequisites that you must complete before you begin the upgrade.

• Obtaining the Pre-Upgrade Report Utility
  Download the pre-upgrade report utility for Oracle Identity Manager from Oracle Technology Network (OTN).
• Generating the Pre-Upgrade Report
  Generate the pre-upgrade report before you start the upgrade process for Oracle Identity Manager, and resolve any issues listed in the report.
• Analyzing the Pre-Upgrade Report
  After you generate the pre-upgrade report for Oracle Identity Manager, review each of the reports, and perform all of the tasks described in them. If you do not perform the mandatory tasks described in the report, the upgrade might fail.

Ensure that the encrypted data from 11g (11.1.2.3) OIG is read correctly after the upgrade to 12c (12.2.1.4) OIG. The exported keys will be required by the oneHopUpgrade tool to complete the upgrade process.

1. Export the OPSS encryption key from the Oracle Identity Manager 11g (11.1.2.3) setup.
   1. Create a directory with read/write permissions. This location (<LOCATION_TO_EXPORT_KEY>) will be used in the exportEncryptionKey WLST command.
   2. Navigate to the <11g_(11.1.2.3_ORACLE_HOME>/oracle_common/common/bin location and launch the wlst.sh script.
   3. Execute the exportEncryptionKey WLST command in the offline mode.

      exportEncryptionKey('<11gR2PS3_DOMAIN_HOME>/config/fmwconfig/jps-config.xml', '<LOCATION_TO_EXPORT_KEY>', '<YOUR_OWN_PASSWORD_OF_EXPORTED_KEY>')

      For example:

      exportEncryptionKey('/u01/app/fmw/user_projects/domains/oim_domain/config/fmwconfig/jps-config.xml', '/scratch/opss/', '<password>')

      Note:

      Choose a password of your choice while invoking the exportEncryptionKey WLST offline command. You should provide the same password when you rewire the domain. See Rewiring the Domain.
2. Create a directory with read/write permissions in the 12c (12.2.1.4) setup location. You will use this location for the 11g (11.2.1.3)_files_path_with_rw_permission property in the oneHop.properties file in a later step.
3. Copy the exported encryption key files (<LOCATION_TO_EXPORT_KEY>/*) and <11g (11.2.1.3)_DOMAIN_HOME>/config/fmwconfig/.xldatabasekey from the 11g (11.1.2.3) setup location to the directory that you created in step 2 in the 12c (12.2.1.4) setup location.

To identify potential issues with the upgrade, Oracle recommends that you run a readiness check from the 12c (12.2.1.4) setup on the 11g (11.1.2.3) domain. Be aware that the readiness check may not be able to discover all potential issues with your upgrade. An upgrade may still fail, even if the readiness check reports success.

• About Running a Pre-Upgrade Readiness Check
  You can run the Upgrade Assistant in -readiness mode to detect issues before you perform the actual upgrade. You can run the readiness check in GUI mode using the Upgrade Assistant or in silent mode using a response file.
• Starting the Upgrade Assistant in Readiness Mode
  Use the -readiness parameter to start the Upgrade Assistant in readiness mode.
• Performing a Readiness Check with the Upgrade Assistant
  Navigate through the screens in the Upgrade Assistant to complete the pre-upgrade readiness check.
• Understanding the Readiness Report
  After performing a readiness check for your domain, review the report to determine whether you need to take any action for a successful upgrade.

Before you run the Upgrade Assistant to upgrade the schemas, you must shut down all the processes and servers in the 11g OIG domain, including the Administration Server, Node Manager (if you have configured Node Manager), and all Managed Servers.

Before starting the updgrade process, clean the /tmp folder on all the Oracle Identity Governance 12c (12.2.1.4) machine(s).

When you execute the oneHopUpgrade.sh script, it wires the upgraded schemas of the OIM 11g (11.1.2.3.0) setup with the newly installed domain and Oracle Home of the OIM 12c (12.2.1.4) setup.

1. Stop the OIM, SOA Managed Servers, and Node Manager (if configured) of the 12c (12.2.1.4) domain. Ensure that only Database and Administrator server are up and running. At this stage, the reference is to the 11g (11.1.2.3) database that is now upgraded to 12c (12.2.1.4).
2. Navigate to the <12c (12.2.1.4)_ORACLE_HOME>/idm/server/upgrade/oneHopUpgrade location.
3. Fill the values for the various properties in the oneHop.properties file.

   Table 7-6 List of properties in the oneHop.properties File

   Sl. No.	Property Name	Description	Sample Value
   1	domain_home	The newly installed 12c (12.2.1.4) WebLogic Domain Home location.	/u01/mw_12cps4/user_projects/domains/oim_domain
   2	admin_server_host	The host name of the newly installed 12c (12.2.1.4) WebLogic domain’s Administration server.	example.com
   3	admin_server_port	The port number of the newly installed 12c (12.2.1.4) WebLogic domain’s Administration server.	7001
   4	admin_server_user	The username of the newly installed 12c (12.2.1.4) WebLogic domain’s Administrator.	weblogic
   5	ORACLE_HOME	The newly installed 12c (12.2.1.4) Oracle Home location.	/u01/mw_12cps4
   6	JAVA_HOME	Java 8 home.	/u01/java/1.8.0-211-12-190401.1.8.0.211.12/jdk1.8.0_211
   7	12csp4_opss_data_source_name	Name of a new OPSS data source which will be created as part of the domain wiring step and value is populated OOTB. Note: This data source will be used for OPSS DB connections after the one-hop upgrade process.	OPSSDataSourceUpgrade
   8	12csp4_opss_jndi_name	JNDI Name of a new OPSS data source which will be created as part of domain wiring step and value is populate OOTB.	jdbc/OpssDSUpgrade
   9	DATASOURCES1	Username of the upgraded 11g (11.1.2.3.0) OIM schema to 12c (12.2.1.4). Note: Customer should not change the name of the data source populated OOTB for all the data source properties. For example: ApplicationDB, EDNLocalTxDataSource, WLSSchemaDataSource, and so on.	DATASOURCES1 = name:ApplicationDB user: DEV_OIM
   10	DATASOURCES2	Username of the upgraded 11g (11.1.2.3.0) SOAINFRA schema to 12c (12.2.1.4).	DATASOURCES2 = name:EDNLocalTxDataSource user: DEV_SOAINFRA
   11	DATASOURCES3	Username of the upgraded 11g (11.1.2.3.0) MDS schema to 12c (12.2.1.4).	DATASOURCES3 = name:mds-oim user: DEV_MDS
   12	DATASOURCES4	Username of the upgraded 11g (11.1.2.3.0) OPSS schema to 12c (12.2.1.4).	DATASOURCES4 = name:opss-data-source user: DEV_OPSS
   13	DATASOURCES5	Username of the newly created STB schema during the schema upgrade to 12c (12.2.1.4).	DATASOURCES5 = name:LocalSvcTblDataSource user: DEV_STB
   14	DATASOURCES6	Username of the newly created IAU_APPEND schema during the schema upgrade to 12c (12.2.1.4).	DATASOURCES6 = name:opss-audit-DBDS user: DEV_IAU_APPEND
   15	DATASOURCES7	Username of the newly created WLS schema during the schema upgrade to 12c (12.2.1.4).	DATASOURCES7 = name:WLSSchemaDataSource user: DEV_WLS
   16	DATASOURCES8	Username of the newly created IAU_VIEWER schema during the schema upgrade to 12c (12.2.1.4).	DATASOURCES8 = name:opss-audit-viewDS user: DEV_IAU_VIEWER
   17	DATASOURCES9	Username of the upgraded 11g (11.1.2.3.0) ORASDPM schema to 12c (12.2.1.4).	DATASOURCES9 = name:OraSDPMDataSource user: DEV_ORASDPM
   18	11gr2ps3_files_path_with_rw_permission	The location for the 11g (11.1.2.3.0) OPSS schema's exported encryption key files from the 11g (11.1.2.3.0) setup, that is, files ewallet.p12 and ewallet.p12.lck. This location should also include the <11g_(11.1.2.3_DOMAIN_HOME>/config/fmwconfig/.xldatabasekey file. This location should have read-write permissions.	/u01/onehop/files_from_11g
   19	11gr2sp3_db_url	JDBC URL of the upgraded 11g (11.1.2.3.0) DB schemas to 12c (12.2.1.4).	jdbc:oracle:thin:@example11g.com:1521:oimdb
   20	11g_OPSS_domain_farm_name	This value is present in the <11g_(11.1.2.3.0)_DOMAIN_HOME>/config/fmwconfig/jps-config.xml file under <propertySet name="props.db.1"> as the value of the oracle.security.jps.farm.name property. For example, if the value of this property is cn=IAM, then the OPSS domain is IAM.	IAM
   21	11g_OPSS_jpsroot	This is the OPSS LDAP root user of the 11g (11.1.2.3.0) setup's domain. This value is present in the <11g_(11.1.2.3.0)_DOMAIN_HOME>/config/fmwconfig/jps-config.xml file under <propertySet name="props.db.1"> as the value of the oracle.security.jps.ldap.root.name property. For example, if the value of this property is cn=jpsroot, the OPSS LDAP root user will be cn=jpsroot.	cn=jpsroot
   22	noOfRetries_for_admin_server_ping	This property represents the number of times the domain rewiring utility will try to ping the 12c (12.2.1.4) domain’s Administration server during the restart phase. If you comment this property as "OOTB", it uses the default value of 10. To increase the value, uncomment the property.	10
   23	waitTime_to_stop_admin_server_inMinutes	This property represents the time in minutes for which the domain rewiring utility will wait for the 12c (12.2.1.4) domain’s Administration server to stop after issuing the stop command. OOTB value is 5 minutes.	5

4. Invoke the oneHopUpgrade.sh script from the same directory location.
5. At runtime, provide the following passwords:
   • A password and confirm password for new wallet creation.

     Note:

     You can provide the wallet password using the -p option also while invoking the oneHopUpgrade.sh script.

     For example:

     sh oneHopUpgrade.sh -p <WALLET_PWD>

     If you provide the wallet password using the -p option, you will not be asked for the wallet 'Password' and 'Confirm Password' during runtime. However, this option is not secure because it displays the confidential information such as wallet password in plain text. Therefore, Oracle recommends that you provide the wallet password during runtime when asked.

   • The admin credentials of 12c (12.2.1.4) setup.
   • The passwords for all the upgraded schemas such as OIM, SOAINFRA, UMS, MDS, OPSS, STB, WLS, IAU_VIEWER, IAU_APPEND, and so on.
   • The keystore and key passwords for .xldatabasekey of the 11g (11.1.2.3) setup and .xldatabasekey of the 12c (12.2.1.4) setup.
   • The password (YOUR_OWN_PASSWORD_OF_EXPORTED_KEY) that was used to export the OPSS encryption key on the 11g (11.1.2.3) setup.
   The log files will be created with timestamp, in the <11gr2ps3_files_path_with_rw_permission>/logs location specified in the oneHop.properties file. This location will also contain the following files:

   • data/TaskDetails.csv file which stores the status of each sub-step of the domain wiring process for re-entrant purposes.
   • data/oneHopUpgradeResponse.prop file, which stores all the static inputs/data required to run the domain rewiring utility again. The utility is run in either the same environment after restoration or on the setup which has exactly the same environment-specific values.
   • data/wallet/ewallet.p12 and data/wallet/ewallet.p12.lck wallet files, which store secure data such as passwords. The response file and wallet files are always used in pairs.

   Note:

   • In case of any failure in the domain rewiring process, depending on the nature of the failure, you can use one of the following options:
     • If you are able to resolve the issue without the need to restore the 12c (12.2.1.4) or the 11g setup, do not delete the logs folder created in the location passed through the <11gr2ps3_files_path_with_rw_permission> property of the oneHop.properties file. Reinvoke the oneHopUpgrade.sh script after resolving error.
     • If the failure requires you to restore the entire 12c (12.2.1.4) or the 11g setup, and execute the one-hop upgrade process again, you have to delete the logs/data/TaskDetails.csv file created in the location passed through the <11gr2ps3_files_path_with_rw_permission> property of the oneHop.properties file.

     Note:

     During a re-run of the domain wiring utility in either of the failure cases, the utility will ask for all the required passwords again.

     If a failure occurs after you provide all the required passwords while executing the domain rewiring utility, you can avoid entering all the required passwords again and instead use the response file and wallet files created during the first run. You can use these files only if the values in the oneHop.properties file and passwords are the same during the re-run (that is, all the setup details are the same as the first run when the error occurred). See Rewiring the Domain Using the Silent Mode.

   • The oneHopUpgrade.sh script uses the WLST commands internally to rewire the domain and prints the data on the console without parsing. Therefore, you can view the exact details of all exceptions in case errors are encountered during the process.

   After the successful execution of the above script, the 12c (12.2.1.4) domain is wired to the upgraded 11g schema. At this point, all the servers of 12c (12.2.1.4) domain are shut down.

• Rewiring the Domain Using the Silent Mode
  

After you upgrade Oracle Identity Manager, start the servers.

1. Start the following 12c (12.2.1.4) domain servers:

   Note:

   After the upgrade, for first boot, start the SOA and OIG Managed Servers manually from the command line by using the startup script, as shown in the examples below.

   From the terminal navigate to the 12c (12.2.1.4)_DOMAIN_HOME/bin location.

   • Start the Administration Server.
     For example:

     ./startWebLogic.sh

   • After the Administration Server come to a running state, start the Oracle SOA Suite Managed Server with the Administration Server URL, and the BPM property set to TRUE.
     For example:

     ./startManagedWebLogic.sh <soa_managed_server_name> t3://weblogic_admin_host:weblogic_admin_port -Dbpm.enabled=true

   • After the SOA Server comes to a running state and the soa-infra application is in the ACTIVE status, start the Oracle Identity Manager Managed Server with the Administration Server URL.
     For example:

     ./startManagedWebLogic.sh <oim_managed_server_name> t3://weblogic_admin_host:weblogic_admin_port

   During the start of the OIM Managed Server, bootstrap is initiated. After a successful bootstrap, the OIM Managed Server shuts down automatically.

2. Stop the SOA Managed server and the Administrator server manually after a successful bootstrap of OIM.
3. Restart the following 12c (12.2.1.4) domain servers:
   • Administrator server
   • SOA Managed server without BPM property -Dbpm.enabled
   • OIM Managed server

SOA composites have endpoint address URL for Web services. This URL can be a load balancer URL or a Web server URL. The type of URL depends on whether the application server is front-end with load balancer or Web server, or a single application server URL.

1. Log in to the 12c (12.2.1.4) Oracle Enterprise Manager by using the following URL:
   http://ADMIN_SERVER:ADMIN_PORT/em

   Note:

   Use the same administration credentials that was created during the installation and configuration of OIM 12c (12.2.1.4).
2. For a single node deployment, ensure that the SOA server is up and running. On the left pane, navigate to SOA, soa-infra(SOA_SERVER_NAME), and then then the Deployed Composites tab. You will see the list of SOA composites.

   Note:

   There can be multiple active versions of a composite. These steps are applicable to all versions deployed for a composite. Steps differ for different composites but are same for versions of the same composite.
3. Click the DefaultRequestApproval SOA composite.
4. In the Services and References section, click the CallbackService_2 link for Usage Type Reference.
5. Click the Properties tab, add the following URL as the value for the Endpoint Address property (this property value will be empty OOTB), and then click Apply.
   http://<OIM_HOST>:<OIM_PORT>/workflowservice/CallbackService

   Note:

   Provide the OIM Managed server host and port values of the 12c (12.2.1.4) setup.
6. Return to the DefaultRequestApproval composite details page.
7. In the Services and References section, click the RequestWSPartnerLink link for Usage Type Reference.
8. Click the Properties tab, add the following URL as the value for the Endpoint Address property (this property value will be empty OOTB), and then click Apply.
   http://<OIM_HOST>:<OIM_PORT>/workflowservice/RequestDataService
9. Repeat steps 4 to 8 for the following SOA composites:
   • DefaultOperationalApproval
   • ProvideInformation
   • RoleLCMApproval

   Note:

   Repeat steps 4 to 8 for all versions of custom composites.
10. Repeat steps 4 and 5 for the following SOA composites:
    • DefaultRoleApproval
    • AutoApproval
    • BeneficiaryManagerApproval
    • RequesterManagerApproval
    • DefaultSODApproval
11. Return to the DefaultSODApproval composite details page.
12. In the Services and References section, click the SodCheckServicePortImplService link for Usage Type Reference.
13. Click the Properties tab, add the following URL as the value for the Endpoint Address property (this property value will be empty OOTB), and then click Apply.
    http://<OIM_HOST>:<OIM_PORT>/workflowservice/SodCheckServicePortImplService
14. Click the OAACGRoleAssignSODCheck SOA composite.
15. In the Services and References section, click the RoleSODService link for Usage Type Reference.
16. Click the Properties tab, add the following URL as the value for the Endpoint Address property (this property value will be empty OOTB), and then click Apply.
    http://<OIM_HOST>:<OIM_PORT>/workflowservice/OAACGRoleSODService
17. Click the IdentityAuditRemediation SOA composite.
18. In the Services and References section, click the IdentityAuditWSPartnerLink link for Usage Type Reference.
19. Click the Properties tab, add the following URL as the value for the Endpoint Address property (this property value will be empty OOTB), and then click Apply.
    http://<OIM_HOST>:<OIM_PORT>/workflowservice/IdentityAuditCallbackService
20. Click the DisconnectedProvisioning SOA composite.
21. In the Services and References section, click the ProvisioningCallbackService link for Usage Type Reference.
22. Click the Properties tab, add the following URL as the value for the Endpoint Address property (this property value will be empty OOTB), and then click Apply.
    http://<OIM_HOST>:<OIM_PORT>/provisioning-callback/ProvisioningCallbackService
23. Click the CertificationProcess SOA composite.
24. In the Services and References section, click the CertificationWSPartnerLink link for Usage Type Reference.
25. Click the Properties tab, add the following URL as the value for the Endpoint Address property (this property value will be empty OOTB), and then click Apply.
    http://<OIM_HOST>:<OIM_PORT>/workflowservice/CertificationCallbackService
26. Repeat steps 24 and 25 for the CertificationOverseerProcess SOA composite.
27. In Oracle Enterprise Manager Console, expand SOA Infrastructure, select SOA Administration, and then select Common Properties.
28. In the Server URLs section, check the values for Callback Server URL and Server URL. If these values are blank, no action required. If these values are pointing to the OIM 11g (11.1.2.3.0) setup, update them to the corresponding values of the OIM 12c (12.2.1.4) setup.
29. Restart all the servers after you update the end point address.

When you upgrade Oracle Identity Manager 11.1.2.3.0 to Oracle Identity Manager 12c (12.2.1.4.0), the embedded Oracle BI Publisher, present in the 11.1.2.3.0 deployment, is removed. Therefore, you must install and integrate a new standalone Oracle BI Publisher 12c (12.2.1.4.0) after the upgrade, for configuring the Oracle Identity Governance reports.

For more information about these system properties, see Table 18-2 of section Non-Default System Properties in Oracle Identity Governance in Administering Oracle Identity Governance.

Oracle recommends creating these system properties only if a legacy connector or an old custom code requires the legacy behavior.

Oracle recommends you to modify the Maximum Message Size from the default value of 10 MB to 100 MB. This value is used to replicate the session data across nodes.

You should perform this step for all the Managed servers and the Administration server.

1. Log in to the WebLogic Server Administration Console.
2. Navigate to Servers, select Protocols, and then click General.
3. Set the value of Maximum Message Size to 100 MB.

1. Open the $DOMAIN_HOME/bin/setDomainEnv.sh file in a text editor.
2. Locate the following code block:

   ALT_TYPES_DIR="${OIM_ORACLE_HOME}/server/loginmodule/wls,${OAM_ORACLE_HOME}/a
   gent/modules/oracle.oam.wlsagent_11.1.1,${ALT_TYPES_DIR}"
   export ALT_TYPES_DIR
   CLASS_CACHE="true"
   export CLASS_CACHE

3. Add the following lines at the end of the above code block:

   JAVA_OPTIONS="${JAVA_OPTIONS} -Dweblogic.oif.serialFilter=maxdepth=250"
   export JAVA_OPTIONS

4. Save and close the setDomainEnv.sh file.