NetIQ Access Manager 5.0 Installation and Upgrade Guide

NetIQ Access Manager 5.0 Installation and Upgrade Guide

Planning Your Access Manager Environment

Deployment Models

Access Manager Versus Access Manager Appliance

Network Requirements

System Requirements

Recommended Installation Scenarios

Basic Setup

High Availability Configuration with Load Balancing

Deploying Access Manager on Public Cloud

Deploying on AWS EC2

Deploying on Microsoft Azure

Installing Access Manager Components in NAT Environments

Network Prerequisites

Network Setup Flow Chart

Installing Access Manager Components in NAT Environments

Configuring Network Address Translation

Setting Up Firewalls

Restricted Ports

Sample Configurations

Using Certificates for Secure Communication

Protecting an Identity Server Through Access Gateway

Installing Access Manager Components on On-Premises Servers

Installing Administration Console

Installing Administration Console

Prerequisites for Installing Administration Console

Installation Procedure

Configuring the Administration Console Firewall

Logging In to Administration Console

Enabling Administration Console for Multiple Network Interface Cards

Installing Identity Server

Prerequisites for Installing Identity Server

Installing Identity Server

Verifying Identity Server Installation

Translating Identity Server Configuration Port

Configuring a Simple Redirect Script

Configuring iptables for Multiple Components

Installing Access Gateway

Feature Comparison of Different Types of Access Gateways

Installing Access Gateway Appliance

Prerequisites for Installing Access Gateway Appliance

Installing Access Gateway Appliance

Configuring Access Gateway Appliance

Installing Access Gateway Service

Prerequisites for Installing Access Gateway Service

Installation Procedure

Verifying Access Gateway Installation

Installing Analytics Server

Installing Packages and Dependent RPMs on RHEL for Access Manager

Uninstalling Components

Uninstalling Identity Server

Deleting Identity Server References

Uninstalling Identity Server

Reinstalling an Identity Server to a New Hard Drive

Uninstalling Access Gateway

Uninstalling Administration Console

Restoring a Failed Secondary Console

Uninstalling Analytics Server Service

Uninstalling Access Manager Containers

Uninstalling the Analytics Server Containers

Installing Access Manager Components on Cloud

Deploying Access Manager on Microsoft Azure

Prerequisites for Deploying Access Manager on Microsoft Azure

Deployment Procedure

Creating Azure Services

Creating and Deploying Virtual Machines

Configuring Network Security Groups

Changing the Private IP Address from Dynamic to Static

Installing Access Manager

(Optional) Azure Load Balancer

Creating a Load Balancer

Configuring a Load Balancer

Deploying Access Manager on Amazon Web Services EC2

Prerequisites for Deploying Access Manager on AWS

Deployment Procedure

Creating AWS EC2 Services

Creating and Deploying Instances

Installing Access Manager

(Optional) Creating an AWS EC2 Load Balancer

Auto Scaling Access Manager on AWS

Monitoring Access Manager in AWS Using CloudWatch

Deploying Access Manager in Multiple AWS Regions

Installing Access Manager Containers

Planning Access Manager Container Deployment

What Is Docker and Why Should You Use It

Basic Terminologies of Kubernetes

Kubernetes Keywords and Their Usage in Access Manager

Helm Charts

Planning your Access Manager Deployment on Kubernetes

Deployment Considerations

Protecting Access Manager Secrets

Conditions for Creating Administrator Username and Password

Installing Ingress

Configuring Ingress

Limitations of Docker Deployment

Deploying Access Manager on On-Premises Linux Servers

Prerequisites for Deploying Access Manager Containers on On-Premises Linux Servers

Deploying Access Manager Containers on On-Premises Linux Servers

Deploying Analytics Server Containers on On-Premises Linux Servers

Label Nodes

Deploying Access Manager Containers on AWS

Prerequisites for Deploying Access Manager Containers on AWS

Deploying Access Manager Containers on AWS

Deploying Analytics Server Containers on AWS

Deploying Access Manager Containers on Azure Kubernetes Services

Prerequisites for Deploying Access Manager Containers on Azure Kubernetes Services

Deploying Access Manager Containers on Azure Kubernetes Services

Deploying Analytics Server Containers on Azure Kubernetes Services

Scaling Access Manager Components

Scaling Identity Server

Scaling Access Gateway

Upgrading or Migrating Access Manager

Prerequisites for Upgrading or Migrating Access Manager

Maintaining Customized JSP Files for Identity Server

Using Customized JSP Pages from Access Manager 4.1 or Prior

Using Customized JSP Pages from Access Manager 4.1 or Prior and Enabling the New Access Manager Portal

Maintaining Customized JSP Files for Access Gateway

Upgrading Administration Console

Upgrading Identity Server

Upgrading Identity Server

(Conditional) Upgrading the Database Schema for Risk Service

Upgrading Access Gateway

Upgrading Access Gateway Appliance

Upgrading from Access Gateway Appliance 4.4.x

Upgrading from Access Gateway Appliance 4.5.x

Upgrading from Access Gateway Appliance 5.0.x

Migrating Access Gateway Appliance

Prerequisites for Migrating Access Gateway Appliance

Upgrading from Access Gateway Appliance 5.0.x

Migrating Access Gateway Appliance

Upgrading Access Gateway Service

Prerequisites for Upgrading Access Gateway Service

To Upgrade Access Gateway Service

Upgrading Analytics Server

Upgrade Analytics Server Cluster

Upgrading Access Manager Containers

Upgrading Access Manager Containers

Upgrading Analytics Server Containers

Post Upgrade Considerations

Database Schema Changes for Risk Service

Configuration Files-specific Changes

Changes in Identity Server and Access Gateway Processes

Schema Changes of Attributes

Getting the Latest OpenSSL Updates for Access Manager

Installing or Updating Security Patches for Access Gateway Appliance

Updating Security Patches for Access Gateway Service

Upgrade Assistant

Migrating Access Manager from Windows to RHEL

Migrating Administration Console from Windows to RHEL

Prerequisites for Migrating Administration Console

Supported Migration Scenarios

Migrating Primary Administration Console

Migrating Secondary Administration Console

Migrating Identity Server from Windows to RHEL

Prerequisites for Migrating Identity Server

Supported Migration Scenario

Migrating Identity Server

Migrating Access Gateway from Windows to RHEL

Prerequisites for Migrating Access Gateway

Supported Migration Scenario

Migrating Access Gateway

Troubleshooting Installation and Upgrade

Troubleshooting Installation

Secondary Administration Console Installation Fails

(RHEL) The Health Status of Administration Console, Identity Server, and Access Gateway after Installation Is Not Green

Troubleshooting Identity Server Import and Installation

Importing Identity Server into Administration Console Fails

Reimporting Identity Server

Check the Installation Logs

Access Gateway Appliance Installation Fails Due to an XML Parser Error

Troubleshooting Access Gateway Import

Repairing an Import

Troubleshooting the Import Process

Troubleshooting Access Manager Container Deployment

Administration Console Pod Does Not Deploy in Azure Kubernetes Services

Checking the Status of Access Manager Resources

Debugging Pods

Unable to Use a Release Name

Kubernetes Gives Error Messages While Retrieving Information About Pods

Unable to Connect to the DNS Server

Performance and Stability Issues Because Swap is Enabled

Communication Between the Kubernetes Master Node and Worker Node Fails

Health Check of Access Gateway Activemq Fails

Troubleshooting Analytics Server

Dashboard Login Fails After Applying An External Signed Certificate to the Administration Console

Intermittent Issue With Cluster Configuration

Rsyslog Fails to Start After Access Manager Installation

Troubleshooting Upgrade

Access Gateway Throws a 403 Forbidden Page Error for a Resource Protected by a Form Fill Policy

Troubleshooting Administration Console Upgrade

Upgrade Hangs

Multiple IP Addresses

Certificate Command Failure

Upgrading Secondary Administration Console Fails with an Error

Issue in SSL Communication between Access Gateway and Web Applications

Customized Login Pages Are Missing After Upgrading Access Manager

The Email OTP JSP Page Does Not Render Properly on Internet Explorer 11

X509 Authentication Does Not Work and Throws HTTP 500 Error After Upgrade

Changes Required in server.xml for Apache Tomcat 8.5.51 after Upgrading to Access Manager 4.5 Service Pack 2

Access Gateway Fails to Start After Upgrading SLES 11 SP3 to SLES 12

Java Communication Channel Processes Run as Non-Root User After Upgrading to Access Manager 5.0

Rsyslog Fails to Start After Access Manager Upgrade

(Kubernetes) OSP/OAuth2-based Authentication Fails after Upgrading Access Manager

Troubleshooting Upgrade Assistant

An Issue with SLES Registration and Updates After Installing or Upgrading Access Manager

Configuring Administration Console Ports 9000 and 9001 to Listen on the Specified Address

Recommendations for Scaling Access Manager Components in Public Cloud

Scaling Up the Access Manager Nodes

Scaling Down the Access Manager Nodes

Denormalizing SQL Database