+

Search Tips   |   Advanced Search

Migrate with ISAM for authentication enabled on multiple nodes

When Security Access Manager (ISAM) security is configured for our existing environment and security is enabled for multiple nodes, we can migrate to WebSphere Application Server, v9.0. Profiles must be migrated using the migration tools to migrate product configurations.

Do not restart the WAS v9.0 server until after performing the following procedure. The migration tools omit some files that enable the server to start correctly. After migrating your profiles, additional steps are required when ISAM security is configured. For WAS v8.0 and later, hosts ISAM specific files under the %WAS_HOME%/tivoli/tam directory. In previous versions, these files were hosted under the %WAS_HOME%/java/jre/ hierarchy.

%WASX% is installation root of the source WAS product. %WAS8% is the installation root of the target WAS product (the v8.0 installation root). Migration in a multi-node environment involves migrating individual nodes, starting with the deployment manager. The following procedure discuss both the overall migration steps and the host-specific migration steps.


Migrate WAS with ISAM

  1. For the overall migration steps, do the following:

    1. On the deployment manager (host1) perform the host specific migration as described in the following steps.
    2. Start the deployment manager.

    3. For each of the application server node/hosts (such as host2, host3 and so on), do the following:

      • Perform the host specific migration steps as described in step 2.

      • Start the node-agent and associated application server on the respective host.

  2. For the host specific migration steps, do the following:

    1. Copy the following files from the source location to the target location:

      Source Location Target Location
      %WASX%\java\jre\PDPerm.properties %WAS8%\tivoli\tam\PDPerm.properties
      %WASX%\java\jre\lib\security\PdPerm.ks (if found) %WAS8%\tivoli\tam\lib\security\PdPerm.ks
      %WASX%\java\jre\lib\PdPerm.ks (if found) %WAS8%\tivoli\tam\PdPerm.ks
      %WASX%\java\jre\PolicyDirector\PDCA.ks %WAS8%\tivoli\tam\PolicyDirector\PDCA.ks
      %WASX%\java\jre\PolicyDirector\PD.properties %WAS8%\tivoli\tam\PolicyDirector\PD.properties
      %WASX%\java\jre\PolicyDirector\etc\pdjrte_paths %WAS8%\tivoli\tam\PolicyDirector\etc\pdjrte_paths
      %WASX%\java\jre\PolicyDirector\etc\pdjrte_mapping %WAS8%\tivoli\tam\PolicyDirector\etc\pdjrte_mapping

    2. Edit the PD.properties file, and change the following configuration settings: 
      appsvr-plcysvrs=null\:0:\:1
config_type=standalone
      Make the appropriate changes to point to your ISAM Policy Server, for example:

        appsvr-plcysvrs=pdmgrd.test.gc.au.ibm.com\:7135\:1
        config_type=full

    3. Edit the following four files on the target system and make sure that all of the path references are corrected:

      • %WAS8%/tivoli/tam/PdPerm.properties
      • %WAS8%/tivoli/tam/PolicyDirector/PD.properties
      • %WAS8%/tivoli/tam/PolicyDirector/etc/pdjrte_paths
      • %WAS8%/tivoli/tam/PolicyDirector/etc/pdjrte_mapping

      When we correct the paths in order:

      1. Ensure that all references from %WASX%/java/jre/PolicyDirector are changed to %WAS8%/tivoli/tam/PolicyDirector.

      2. Ensure that all references (in the PdPerm.properties file) from the%WASX%/java/jre/[security]/PdPerm.ks file are changed to %WAS8%/tivoli/tam/pdPerm.ks.

      3. Ensure that all remaining references from %WASX%/java/jre are changed to %WAS8%/java/jre.

      4. Edit the %WAS8%/tivoli/tam/PolicyDirector/etc/pdjrte_mapping file. It contains the JRE->JRE mapping: %WAS8%/java/jre=%WAS8%/java/jre.

        Change this mapping to JRE->tivoli/tam: %WAS8%/java/jre=%WAS8%/tivoli/tam.

  3. (iSeries) On the deployment manager (Host1), copy the profile_root1/PolicyDirector directory and it's contents to profile_root2/PolicyDirector.

    1. From an IBM i command line, type STRQSH and press Enter.

    2. Type cp -R profile_root1/PolicyDirector profile_root2 and press Enter.

  4. (iSeries) On the deployment manager, copy the key file of the profile being migrated to the version 6.1 profile. The location of the key file is defined in profile_root1/PolicyDirector/PdPerm.properties. For this example:

    • The PdPerm.properties file contains pdcert-url=file\:/QIBM/UserData/WebAS51/ND/Dmgr01/etc/Dmgr01.kdb..
    • /QIBM/UserData/WebAS51/ND/Dmgr01 is the root directory of a v6.1 profile.

    1. From an IBM i command line type STRQSH and press Enter.

    2. Type cp /QIBM/UserData/WebAS51/ND/Dmgr01/etc/Dmgr01.kdb profile_root2/etc/Dmgr01.kdb and press Enter.

  5. (iSeries) On the deployment manager, edit the property values in profile_root2/PolicyDirector/PdPerm.properties and in profile_root2/PolicyDirector/Pd.properties to replace occurrences of profile_root1 with profile_root2 in the file path name values.

  6. (iSeries) Start the WAS appservers deployment manager.

  7. (iSeries) On Host2, copy the profile_root1/PolicyDirector directory and it's contents to profile_root2/PolicyDirector.

    1. From an IBM i command line, type STRQSH and press Enter.

    2. Type cp -R profile_root1/PolicyDirector profile_root2 and press Enter.

  8. (iSeries) On Host2, copy the key file of the profile being migrated to the version 6.1 profile. The location of the key file is defined in profile_root1/PolicyDirector/PdPerm.properties. For this example:

    • The PdPerm.properties file contains pdcert-url=file\:/QIBM/UserData/WebAS51/Base/AppSvr1/etc/AppSvr1.kdb.
    • /QIBM/UserData/WebAS51/Base/AppSvr1 is the root directory of a v6.1 profile.

    1. From an IBM i command line type STRQSH and press Enter.

    2. Type cp /QIBM/UserData/WebAS51/Base/AppSvr1/etc/AppSvr1.kdb profile_root2/etc/AppSvr1.kdb and press Enter.

  9. (iSeries) On Host2, edit the property values in profile_root2/PolicyDirector/PdPerm.properties and in profile_root2/PolicyDirector/Pd.properties to replace occurrences of profile_root1 with profile_root2 in the file path name values.

  10. (iSeries) On Host2, start the node agent and its associated application server.

  11. (iSeries) On Host3, copy the profile_root1/PolicyDirector directory and it's contents to profile_root2/PolicyDirector.

    1. From an IBM i command line, type STRQSH and press Enter.

    2. Type cp -R profile_root1/PolicyDirector profile_root2 and press Enter.

  12. (iSeries) On Host3, copy the key file of the profile being migrated to the version 6.1 profile. The location of the key file is defined in profile_root1/PolicyDirector/PdPerm.properties. For this example:

    • The PdPerm.properties file contains pdcert-url=file\:/QIBM/UserData/WebAS51/Base/AppSvr1/etc/AppSvr1.kdb.
    • /QIBM/UserData/WebAS51/Base/AppSvr1 is the root directory of a v6.1 profile.

    1. From an IBM i command line type STRQSH and press Enter.

    2. Type cp /QIBM/UserData/WebAS51/Base/AppSvr1/etc/AppSvr1.kdb profile_root2/etc/AppSvr1.kdb and press Enter.

  13. (iSeries) On Host3, edit the property values in profile_root2/PolicyDirector/PdPerm.properties and in profile_root2/PolicyDirector/Pd.properties to replace occurrences of profile_root1 with profile_root2 in the file path name values.

  14. (iSeries) On Host3, start the node agent and its associated application server.


What to do next

Also see Migrating with ISAM for authentication enabled on a single node for more information.

  • Migrate with ISAM for authentication enabled on a single node
  • Migrate, coexist, and interoperate - Security considerations