Upgrading from ActivID CMS 5.13 or Higher

Important:
Read this section before upgrading to ActivID CMS 6.5 from a previous version.

ActivID CMS 6.5 only supports upgrades from ActivID CMS 5.13 or higher. If you intend to upgrade from an earlier version, you will first need to upgrade to ActivID CMS 5.13 or higher. For details, refer to the relevant ActivID CMS documentation.

Note:

  • The installer backs up the existing ActivID CMS folder to the Backup folder under the existing Credential Management System folder. Any files that differ from the standard ones are kept.

  • Starting with CMS 6.5, most private files (previously found in the settings/Private Files directory) have been removed, and are now protected in signed .jar files. This includes all the standard device profiles, and most internal CMS configuration files, including some obsolete configuration files.

    Reminder: Device profiles can be overridden by adding new profiles and saving them in the %PROGRAMDATA%\HID Global\Credential Management System\Shared Files\services\custom folder. This includes any changes to the ATR2Product.properties file: you can store a modified version of this file in %PROGRAMDATA%\HID Global\Credential Management System\Shared Files\services\custom\batch\ATR2Product.properties (see the Important note in Supported Cards and Devices for details). (You can contact HID Global Technical Support to obtain a copy of the ATR2Product.properties file if needed.)

  • If you had created any additional files (for example, additional plugins), they will be restored automatically.

  • A log file listing the differences between the previously installed settings files and the new installation settings is generated at the end of installation.

  • After an upgrade of CMS, the CMS extension in Edge or Chrome may not work correctly. In this case, cleaning the browser cache could solve the issue.

Upgrade Prerequisites

Upgrade to ActivID CMS 6.5

ActivID CMS 6.5 only supports upgrades from ActivID CMS 5.13 or higher. The ActivID CMS upgrade includes a database upgrade.

Important:
Starting with version 6.3, ActivID CMS no longer supports the Verizon UniCERT certificate authority. If you are using this certificate authority with a previous version of ActivID CMS, you will no longer be able to use it when you upgrade to ActivID CMS 6.3 or higher.

Depending on how CMS is installed, one of two different procedures have to be followed:

  • Typical Installation: When CMS was installed following the typical installation procedure, the database upgrade takes place automatically. Follow the steps in Upgrade Using Setup.

  • Custom Installation: When CMS was installed following the custom installation procedure, with only the server component installed, the database needs to be manually updated beforehand. Follow the steps in Manual Upgrade.

    Important:
    The URLs for the ActivID Operator Portal and User Portal, as well as for the HID CMS Operator Portal and Self-Service Portal must be added as Trusted Sites in the user’s browser.
    Note: If you want to upgrade to ActivID CMS with its latest hotfix in one operation, refer to Install ActivID CMS with a Hotfix.
    Note: The upgrade procedure described applies to an ActivID CMS installation on Microsoft SQL Server and Oracle databases. However, the screenshots in this procedure were taken on ActivID CMS installed with Microsoft SQL Server, using SQL Server authentication.

  1. Run the HID Credential Management System.msi program in the ActivID CMS 6.5 distribution.

    Note: The program name has changed with respect to previous versions ("HID Credential Management System" instead of "ActivID Credential Management System").

  2. Go through the wizard until the Upgrade page appears:

    HID Credential Management System Upgrade Welcome dialog box with a Next button and a Cancel button (highlighted) in the bottom right corner

  3. Click Next.

    The Database Server Information page appears:

    HID Credential Management System Database Server Information dialog box where you can enter the Database Owner Password

    The Database Server Type and Database Server are preset based on the detected database used with the previous ActivID CMS version and cannot be changed. Depending on the authentication mode (Windows vs. SQL Server), some of the fields on this page may differ.

  1. Enter the database passwords:

    • Under Database Administrator Credentials, enter the Login Name and the Database Administrator Password.

    • Under Database Owner Password, enter the Password for the Microsoft SQL Server or the Oracle database owner accounts used by ActivID CMS to connect to the database server. (This is the password you defined when installing your previous version of ActivID CMS.)

  2. Click Next.

    The Web Server Configuration page appears:

    HID Credential Management System Web Server Configuration dialog box where you can enter the Password for the CMS Server User Account

  3. Under CMS Server user account, enter the password for the user account defined during the setup of your previous ActivID CMS installation. The account needs to have a "Log on as a service privilege". See Required Account Types and Privileges and Setting Up “Log On as a Service” Privilege for more details.

  4. Click Next. The Security Key Management page appears:

    HID Credential Management System Security Key Management dialog box where you can enter the Password for the security key as well as the Library File and Operator PIN for the HSM

  5. In the Password field, enter the ActivID CMS Security Key Password defined during the previous ActivID CMS installation.

    This is the Security Key Password you want to set for your ActivID CMS system. The Security Key Password protects a cipher key that encrypts the sensitive fields in the six ActivID CMS databases. This password is required to start the ActivID CMS portal.

  6. If the Hardware Security Module option was selected in the initial installation, you can browse for the appropriate HSM Library File. Then, enter the HSM PIN in the Operator PIN field. If you selected No (for the HSM option), then a warning message appears when you click Next.

    The Library File refers to the HSM drivers that must be installed manually. Each HSM comes with its own installation program for installing the HSM drivers. For information about how to install the HSM drivers on the ActivID CMS server machine, refer to your HSM documentation.

    Note: With ActivID CMS, the required HSM drivers to be used are 64-bit drivers.

    The PIN protects the access to the keys stored in the HSM. You must specify the HSM Operator PIN that was set when you initialized the HSM with the Key Management System (not applicable for network HSMs).

    Note: For upgrade with an Entrust platform, a reconfiguration needs to be done in the entrust.ini file to use the achsmf.dll file located in (%SystemDir%\system32) since Entrust components are now using 64-bit HSM drivers. Refer to Configuring ActivID CMS for Use with Entrust Authority Security Manager for more information on the configuration of the entrust.ini file.

  7. Click Next.

    The Ready to Install the Program page appears:

    HID Credential Management System Ready to Install the Program dialog box with a Back button, an Upgrade button and a Cancel button (highlighted)

  8. Click Upgrade to start the upgrade process.

    Installing HID Credential Management System dialog box displaying a progress bar

    After the install is complete, the InstallShield Wizard Completed page appears:

    HID Credential Management System InstallShield Wizard Completed dialog box with the Finish button highlighted

  9. Click Finish.

  10. Reboot the Windows server for the changes to take effect.

    If attended startup mode was selected during setup, see Provide Passwords in Attended Startup Mode in order to start ActivID CMS.

The following procedure applies to an ActivID CMS installation on Microsoft SQL Server and Oracle databases. However, the screenshots in this procedure were taken on ActivID CMS installed with Microsoft SQL Server using SQL Server authentication. The procedure has two main steps:

  1. Upgrade the ActivID CMS database manually by using the script packaged with the product.

  2. Run the ActivID CMS installer to perform the software upgrade.

Before upgrading, be sure to refer to the release-note.txt file in the DBScripts folder of the ActivID CMS distribution for detailed instructions.

You can upgrade ActivID CMS using database scripts on:

  • Microsoft SQL Server using Windows authentication

    Note: To upgrade ActivID CMS with SQL in Windows authentication mode, you have to log in as User or Administrator of the domain; if you use a local account, you are not able to upgrade ActivID CMS.

  • Microsoft SQL Server using Mixed Mode authentication

  • Oracle Database 12c, 18c or 19c

Note: To perform this database upgrade in Windows authentication mode, you have to log in as User or Administrator of the domain.

  1. In the ActivID CMS distribution, go to the \DBScripts\sqlserver folder and copy all the files onto your hard disk.

  2. Right-click the hard-disk copy of the sqlserver-config.bat file, and then click Edit.

    Notepad window displaying the configurable part of the sqlserver-config.bat file

  3. Set the values for the following variables:

    • DB_INSTANCE (Set the ActivID CMS Database Server and Instance name)

    • CMS_AUTH_MODE (Set to "WindowsAuthMode")

    • CMS_NT_USR (Set the ActivID CMS database user’s NT username)

  4. Run the sqlserver-upgrade.bat file.

    Command prompt window running sqlserver-upgrade.bat file displaying various steps

  5. Run the sqlserver-populate.bat file.

    Command prompt window running sqlserver-populate.bat file displaying various steps

  1. In the ActivID CMS 6.5 distribution, go to: \DBScripts\sqlserver and copy all the files on your hard disk.

  2. Right-click the hard-disk copy of the file sqlserver-config.bat, and then click Edit.

  3. Set the values for the following variables:

    • DBA_USR

    • DBA_PWD

    • DB_INSTANCE

    • CMS_AUTH_MODE (Set to MixedAuthMode)

    • CMS_SQL_PWD

  4. Run the sqlserver-upgrade.bat file.

  5. Run the sqlserver-populate.bat file.

  1. On the ActivID CMS 6.5 distribution, go to: \DBScripts\oracle and copy all the files on your hard disk.

  2. Right-click oracle-config.bat, and then click Edit.

  3. Set the values for the following variables:

    • INPUT_DBA_USR

    • INPUT_DBA_PWD

    • INPUT_DATABASE_INSTANCE

    • INPUT_DBO_PWD

    • INPUT_DATAFILES_PATH

    • INPUT_INDEXFILES_PATH

  4. Define the password values in the oracle-config.bat file:

    • If the password contains a percent sign (pass%word), add an additional percent sign (pass%%word) to the password value.

    • If the password contains a > or < sign (pass>word), add a caret sign (^) before each > or < sign (pass^>word) to the password value.

  5. Run the oracle-upgrade.bat file. (Do not call the oracle-upgrade.bat file twice on the same ActivID CMS database because it installs the AIMSRQI database from zero.)

  6. Run the oracle-populate.bat file.

  7. Run the oracle-expimp-aimsrqi.bat file.

  8. Complete the upgrade by installing ActivID CMS 6.5 in custom installation mode without the database component. Follow the steps in Install the Server Components Only.