When the automatic One Identity Manager tool update is detected on a workstation, the user is prompted to close all open programs. Updating starts after the user has closed all the programs.
Whether or not the users of One Identity Manager tools can decide when their own workstations are updated, is controlled by the Common | AutoUpdate | AllowOutOfTimeApps configuration parameter. This means:
-
Users have no way of intervening in the update if the configuration parameter is not set. The update is run immediately.
-
If the configuration parameter is set, the logged-in user is prompted with a message. Users can decide whether the One Identity Manager tools update takes place on their workstation straight away or at a later time.
NOTE: If users do not want to update immediately, they can continue working. The update begins the next time the program is started.
Automatic software update is the default method for updating the One Identity Manager Service on servers. However, the update method takes into account that it may be necessary to exclude certain servers from being updated automatically and to update them manually.
For every query of process steps, the One Identity Manager Service returns the current status of the software revision semaphore. If this value differs from the value in the database, the Job server is labeled as "updating" in the database and no more normal process steps are sent to it.
The Job server is updated depending on the procedure set in the Common | Autoupdate | ServiceUpdateType configuration parameter.
First, the start time of the last change is determined from the SoftwareRevision.viv file. A list is compiled of all files with additional information specifying whether each file is new or not. This list is evaluated on the Job server to be updated and another list is compiled specifying which files will be updated.
To do this, the service obtains an AutoUpdate process from the server. which loads the Update.zip file and the update process begins.
If updating with the new process cannot be completed because, for example, there is no direct connection to the database or an application server, the files are transfer by process steps in the Job queue (fallback). In this case, any existing update steps from the module library might not be run.
One Identity Manager Service is restarted if any one of the files has changed on the Job server. After the update is completed, the Job server label is reset in the database.
In principle, web applications support automatic software updates. However, a few web applications may require extra configuration to take part in automatic software updating.
The following permissions are required for automatic updating:
-
The user account for updating requires write permissions for the application directory.
-
The user account for updating requires the local security policy Log on as a batch job.
-
The user account running the application pool requires the Replace a process level token and Adjust memory quotas for a process local security policies.
Updating the web application requires restarting the application. The web application is restarted automatically by the web server when it has been idle for a defined length of time. This may take some time or be hindered by continuous user requests. Some web application offer you the option to restart manually.
NOTE: To update the Web Portal automatically, use a browser to connect to the http://<servername>/<application>/monitor runtime monitor and start the update of the web application.
If the web application update is identified, new files are copied from the database to a temporary directory on the server.
The application then loads the Update.zip file from the database or from the application server, which is unpacked in a temporary directory.
The Update.exe starts, waits until the web application process has shutdown, and copies the files from the temporary directory to the web application's directory.
Related topics
The following permissions are required for automatic software updating:
-
It is recommended that you apply full access permissions to the One Identity Manager installation directory for automatic updating of One Identity Manager tools.
-
The service's user account needs full access to the One Identity Manager Service installation directory in order to automatically update One Identity Manager.
To implement automatic software updating
-
Ensure that an update server is set up. This server ensures that the other servers are updated automatically.
-
The server must be entered in the database as a Job server with the server function Update server.
-
A One Identity Manager Service with direct access to the database must be installed and configured on the server.
-
In the Designer, check the Common | Autoupdate configuration parameter.
-
If the configuration parameter is set (default), One Identity Manager files that do not have the current revision status, are updated automatically.
-
If this configuration parameter is not set, no automatic update is performed.
-
Use the Common | AutoUpdate | AllowOutOfTimeApps configuration parameter to define whether the users of the One Identity Manager tools can decide when the update of their workstation takes place.
-
If this configuration parameter is set, users of One Identity Manager tools are prompted to decide whether they want to update now or later.
-
If this configuration parameter is not set, the One Identity Manager tools are updated immediately.
-
In the Common | Autoupdate | ServiceUpdateType configuration parameter, determine which procedure is used to update the One Identity Manager Service.
Table 20: Methods under to the configuration parameter Common | Autoupdate | ServiceUpdateType
|
Queue |
A process is queued in the Job queue that distributes the files. |
|
DB |
The files are reloaded directly from the database. Implement this procedure if all Job servers have a direct connection to the database. |
|
Auto |
All root servers are filled directly from the database. A process is set up in the Job queue for all leaf servers. For this process, the root servers must have a direct database connection. |
-
Web applications may require some individual configuration settings. Check the configuration settings.
Related topics
