Apply ActivID AS Updates

The update process for both hot fixes and service packs is the same.

Prerequisites

• Download the software update package delivery (RPM and associated files) from the ActivID Customer Portal or from the Advantage HID Partner Portal.

• The ActivID AS software update script (<ACTIVID_HOME>/ActivID_AS/bin/updateSoftware.sh) should be launched as an authorized user account.
Note: If the authorized user account is not root, then a user with the necessary permissions should be configured in the system sudoers

• Make sure the following third-party software is installed:

  • xdelta

  • rpm

  • cpio

  • zip

Install the HID Global Signature Public Key

Each ActivID AS RPM package is signed with a PGP key to verify their integrity and origin.

The hot fixes or service packs might require installing the latest HID Global Code Signing key.

You should install the HID Global Code Signing key on the Unix host so that the ActivID AS software update script is able to verify ActivID AS RPM packages.

For further information, go to the HID Security Center at https://www.hidglobal.com/security-center.

1. Get the HID Global Code Signing keys using one of the following methods:

   • (Recommended) From the HID Global Security Center at https://www.hidglobal.com/security-center/keys
   • From a public web site, such as https://pgp.mit.edu, using the <Key Name> as the "Search String" to extract a key.
   Note: The availability of the keys might vary from one site to another.
   • From the HID-Global-Code-Signing folder on the ActivID AS 8.4 Service Pack delivery disk.

   The following table lists all the keys that are currently available.

   ActivID AS Version	Key Name	Short Key ID	Full Key ID	Fingerprint
   8.1	HID Global Code Signing (DIDS1701001)	560E7824	0xC2BFB923560E7824	7F5E 3AFF DC86 0305 64BF BD14 C2BF B923 560E 7824
   8.1.1	HID Global Code Signing (DIDS1802002)	79FFF219	0xA1CE717E79FFF219	BC71 0383 6C7E DC8F 2094 6B19 A1CE 717E 79FF F219
   8.2/8.3	HID Global Code Signing (DIDS1811002)	9DFFAE6D	0xB703782E9DFFAE6D	6CCD ADB4 7CB6 CBF1 0C94 3474 B703 782E 9DFF AE6D
   8.4	HID Global Code Signing  (DIDS1912001)	AE11FC7F	0x2CAF27EEAE11FC7F	952D 053D 9716 2D7A BD24 4C5C 2CAF 27EE AE11 FC7F

2. Then on all the nodes in your deployment and for each key:

1. Copy the key file to the local system.
2. In a terminal window, import the key file in the local RPM database using the following command:

Copy

rpm --import <key file name>

3. Verify that HID Global Code Signing key is correctly installed using the following command:

Copy

rpm -qa gpg-pubkey*

You can manually verify the ActivID AS RPM package signatures using the following command:

rpm -K <rpm-filename>

Or

rpm -K *.rpm

It should display the following:

<rpm name>: sha1 pgp md5 OK

Other useful commands are:

rpm -qa gpg-pubkey*

rpm –qi <key name>

rpm –ev <key name>

Apply a Hot Fix Update

1. Verify the required prerequisites.
2. Download the software update package delivery to the ActivID AS host.

   It can be copied anywhere on the file system where the authorized user account has access.

3. Make sure the expected HID Global Signature Public Key is installed.
4. Make sure the expected ActivID Authentication Server version is already installed using the following command:

Copy

<ACTIVID_HOME>/ActivID_AS/bin/updateSoftware.sh -v

5. If specified in the update release notes, apply any third-party updates.
6. As root (or an authorized user account), run the updateSoftware.sh script to install the hot fix RPM using the following command:

Copy

<ACTIVID_HOME>/ActivID_AS/bin/updateSoftware.sh <OPTION>

Where following possible values for <OPTION> are:

<OPTION>	Description
-p <rpm file path>	Install the hot fix .rpm file provided by <rpm file path> value. Apply the following on each ActivID AS customizable configuration file found in the file system: If it is a properties file, merge it with the updated version available in the hot fix. If it is not a properties file, back it up (add the ‘.rpmsave’ suffix to the file name) and install the new one found in the hot fix (a manual merge is required). If required, in the <ACTIVID_HOME>/ActivID_AS/deploy folder, re-generate the WAR/EAR files that need to be redeployed on the application server. Provide details about the hot fix installation in the log files located in the home/ftadmin/softupdate/logs folder.
-v	Display information about ActivID AS installation.
-g	Re-generate the ActivID AS applications WAR/EAR files in the <ACTIVID_HOME>/ActivID_AS/deploy folder.

When the process is complete, the script lists the:

• ActivID AS applications that should be re-deployed.

• Configuration files that should be merged manually.

7. Update your security domains with the latest dataset using the following command as ftadmin:

Copy

ACTIVID_HOME/ActivID_AS/bin/manageDomains.sh -u

Important: If your deployment has multiple ActivID AS server nodes, apply this step on only one of the nodes.

8. Based on the software update script output, re-deploy the updated ActivID AS applications on the application server and merge any configuration files.
9. If specified in the update release notes, restart the ActivID AS applications.

Important: If your deployment has multiple ActivID AS server nodes, apply this step on all the nodes.

10. Apply any required customization available with the new version of the software (see the release notes provided with the update and Customizing Your Authentication Server).

Apply a Service Pack Update

1. ONLY if specified in the update release notes, stop all the ActivID AS applications.

This will cause a short interruption of services.

Important: If your deployment has multiple ActivID AS server nodes, apply this step on all the nodes.

2. If specified in the update release notes, apply the database schema changes on your database host.
3. On each ActivID AS node:
   1. Verify the required prerequisites.
   2. Download the software update package delivery to the ActivID AS host.

      It can be copied anywhere on the file system where the authorized user account has access.

   3. Make sure the expected HID Global Signature Public Key is installed.
   4. Make sure the expected ActivID Authentication Server version is already installed using the following command:

Copy

<ACTIVID_HOME>/ActivID_AS/bin/updateSoftware.sh -v

4. If specified in the update release notes, apply any third-party updates.
5. As root (or an authorized user account), run the updateSoftware.sh script to install the service pack RPM using the following command:

Copy

<ACTIVID_HOME>/ActivID_AS/bin/updateSoftware.sh <OPTION>

Where following possible values for <OPTION> are:

<OPTION>	Description
-p <rpm file path>	Install the service pack .rpm file provided by <rpm file path> value. Apply the following on each ActivID AS customizable configuration file found in the file system: If it is a properties file, merge it with the updated version available in the service pack. If it is not a properties file, back it up (add the ‘.rpmsave’ suffix to the file name) and install the new one found in the service pack (a manual merge is required). If required, in the <ACTIVID_HOME>/ActivID_AS/deploy folder, re-generate the WAR/EAR files that need to be redeployed on the application server. Provide details about the service pack installation in the log files located in the home/ftadmin/softupdate/logs folder.
-v	Display information about ActivID AS installation.
-g	Re-generate the ActivID AS applications WAR/EAR files in the <ACTIVID_HOME>/ActivID_AS/deploy folder.

Note: For service packs, the RPM file is provided in the ActivID-Service-Pack folder on the ActivID AS Service Pack delivery disk.

When the process is complete, the script lists the:

• ActivID AS applications that should be re-deployed.

• Configuration files that should be merged manually.

6. Update your security domains with the latest dataset using the following command as ftadmin:

Copy

ACTIVID_HOME/ActivID_AS/bin/manageDomains.sh -u

Important: If your deployment has multiple ActivID AS server nodes, apply this step on only one of the nodes.

7. Based on the software update script output, re-deploy the updated ActivID AS applications on the application server and merge any configuration files.
8. If specified in the update release notes, restart the ActivID AS applications.

Important: If your deployment has multiple ActivID AS server nodes, apply this step on all the nodes.

9. Apply any required customization available with the new version of the software (see the release notes provided with the update and Customizing Your Authentication Server).