General Prerequisites

Upgrading To Include Oracle Universal Authenticator

Push Notification for Android Devices

The following section is only relevant if you are upgrading from any release prior to June 24 and are already using Push Notifications. If you are already using the June 24 release or not using Push Notifications, you can ignore this section.

Preparing the Environment for Upgrade

1. Take a backup of the existing installOAA.properties in case you need to rollback the upgrade:

   cd <NFS_CONFIG_PATH>
   cp installOAA.properties installOAA.properties.<release-date>

2. In the <NFS_LOG_PATH>/status.info make sure SNAPSHOTIMPORT=true.

   Note:

   This is a very important step. If this value is false make sure you change it to true, otherwise your OAA snapshot will be overwritten during the upgrade!
3. Download and extract the latest OAA installation files to the installation host as per Obtaining the Installation Software.

   Note:

   When you unzip the file it will create the oaa-install directory, for example $UPGRADE_WORKDIR/oaa-install. This directory will be used in the steps that follow.
4. Find the name of the existing OAA Management container:

   kubectl get pods -n <namespace> | grep oaamgmt

   For example:

   kubectl get pods -n oaans | grep oaamgmt

   The output will look similar to the following:

   oaamgmt-oaa-mgmt-bf6d5c88-29lrn           1/1     Running   0          64d

5. Copy the installOAA.properties for the current deployment to the $UPGRADE_WORKDIR/oaa-install directory:

   kubectl cp <namespace>/<oaamgmt-pod>:/u01/oracle/scripts/settings/installOAA.properties $UPGRADE_WORKDIR/oaa-install/installOAA.properties

   For example:

   kubectl cp oaans/oaamgmt-oaa-mgmt-bf6d5c88-29lrn:/u01/oracle/scripts/settings/installOAA.properties $UPGRADE_WORKDIR/oaa-install/installOAA.properties

6. Edit the $UPGRADE_WORKDIR/oaa-install/installOAA.properties and change the install.global.image.tag to the image tag for the latest release.

   Note:

   You can find the correct value for install.global.image.tag in the $UPGRADE_WORKDIR/oaa-install/installOAA.properties.template.
7. If you haven't previously installed OUA and want to upgrade your installation to include OUA, you must edit the $UPGRADE_WORKDIR/oaa-install/installOAA.properties and change the following:
   • common.deployment.mode=OUA
   • install.global.drssapikey=drssapikeytobesetduringinstallation

     Note:

     Change drssapikeytobesetduringinstallation to a value of your choice.
   • Set the following parameters:
     • oua.tapAgentName=OAM-OUA-TAP
     • oua.tapAgentFilePass=<OUA_TAPFILE_PASSWORD>
     • oua.tapAgentFileLocation=<OUA_TAPFILE_LOCATION>
     • oua.oamRuntimeEndpoint=<WEB_HOST>

     Note:

     See Configuration Checkpoint for more details.
8. Add the following new section:

   
   ##################################### OAA Configuration ###########################################
   oaa.tapAgentName=<OAA_TAP_PARTNER_NAME>
   oaa.tapAgentFilePass=<OAA_TAP_FILE_PASS>
   oaa.tapAgentFileLocation=<LOCAL_PATH>/<LOCAL_TAP_AGENT_FILE>
   oaa.authFactors=ChallengeEmail,ChallengeSMS,ChallengeOMATOTP,ChallengeYubicoOTP,ChallengeOMAPUSH,ChallengeFIDO2
   ####################################################################################################

   Administrators should be aware of the following:
   • If you have previously integrated OAM with OAA as per Integrate Oracle Access Management with Oracle Advanced Authentication, then:
     • oaa.tapAgentName must be set to the name of the OAA TAP Partner for your existing deployment. The name can be found by referencing the tutorial above.
     • If the OAA TAP Partner is found during the upgrade then the oaa.tapAgentFilePass, oaa.tapAgentFileLocation, and oaa.authFactors are ignored. However, they must be set to either the default values listed above, or you can copy your TAP Partner keystore to a local directory on the <INSTALL_HOST> and set the parameters correctly.
   • If you have not previously integrated OAM with OAA you should follow the Registering OAA as a TAP Partner in OAM section in Registering OAM TAP Partners, and set the parameters accordingly.
9. If you are upgrading from a release prior to June 24 and have Push notifications for Android configured, you must edit the $UPGRADE_WORKDIR/oaa-install/installOAA.properties file and update the common.deployment.push.gcmjsonfile parameter to point at the service-account.json file downloaded earlier:

   common.deployment.push.gcmjsonfile=/u01/oracle/service/store/oaa/ChallengeOMAPUSH/gcm/service-account.json

   Note:

   /u01/oracle/service/store/oaa/ChallengeOMAPUSH/gcm/service-account.json is the internal mapping to <NFS_VAULT_PATH>/ChallengeOMAPUSH/gcm/service-account.json.
10. Add the following new section to the installOAA.properties. For details on these parameters see Creating Users and Groups in the LDAP Store:

    
    ##################################### LDAP configuration #########################################
    ldap.server=<LDAP_SERVER>
    ldap.username=<LDAP_ADMIN_USER>
    ldap.password=<LDAP_ADMIN_PWD>
    ldap.oaaAdminUser=cn=oaaadmin,<LDAP_USER_SEARCHBASE>
    ldap.adminRole=cn=OAA-Admin-Role,<LDAP_GROUP_SEARCHBASE>
    ldap.userRole=cn=OAA-App-User,cn=<LDAP_GROUP_SEARCHBASE>
    ldap.oaaAdminUserPwd=<password>
    ldap.addExistingUsers=no

11. Ensure that the OAA Management helm chart (oaamgmt) is visible by running the following command:

    helm ls -n <namespace> | grep oaamgmt

    For example:

    helm ls -n oaans | grep oaamgmt

    The output should look similar to the following:

    oaamgmt   oaans   1   <DATE> <TIME> +0000 UTC deployed   oaa-mgmt-1.0.0-12.2.1.4.1-<TAG>   0.1.0