Certification Study Guide: IBM Tivoli Access Manager for e-business 6.0

Chapter 2. Planning 65

If you want your aznAPI application to have minimum downtime, you must

install a second Authorization Server to ensure that your aznAPI application

can continue to make authorization decisions during the upgrade process. To

install the second Authorization Server, follow these steps:

a. Install another instance of the Authorization Server on your application

host. It should be the same software version as the Authorization Server

that is running on your current Authorization Server, just running on a

different machine.

b. Edit your aznAPI application configuration file on the application host,

comment out the replica entry for the original Authorization Server, and

add a new replica line for the new Authorization Server.

c. Restart the aznAPI application on the application host and verify that it

functions properly.

Proceed with the normal upgrade of the aznAPI application that also requires

unconfiguration steps.

If you have a load balancer in front of the WebSEALs and you plan to

upgrade your WebSEAL on a server while users are trying to access the

system, you must isolate each WebSEAL server before you upgrade it. To do

this, change the port on which the WebSEAL server listens or configure your

load balancer so that it does not route traffic to the WebSEAL server.

5. After you have updated all your Tivoli Access Manager systems, if you

upgraded the Policy Server using the two system approach, retire the original

Policy Server after its data and the Tivoli Directory Server client and server

are successfully migrated to the 6.0 Policy Server system.

Use the pdmgr_ucf command to retire the original Policy Server.

2.7.1 Additional upgrade considerations

Any server that has Access Manager components installed requires the following

two software components:

򐂰 GSkit

򐂰 IBM Tivoli Directory Server 6.0 client

This is necessary even if your upgrade strategy keeps a previously supported

version of the IBM Tivoli Directory Server (for example 5.2) in production. You

Important: Do not unconfigure the original Policy Server or the new Policy

Server at any time during the upgrade process. Unconfiguration of the

original Policy Server or the new Policy Server will destroy critical data

needed by the Policy Server.