000034167 - What to expect during an RSA SecurID Access Identity Router (IDR)/Cluster software update

Document created by RSA Customer Support Employee on Oct 20, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000034167
Applies ToRSA Product Set:  SecurID Access
RSA Product/Service Type:  Identity Router
IssueAs of the Fall 2016 SecurID Access release, on-premise Identity Router (IDR) updates are now managed by the customer as discussed in the documentation entitled Update Identity Router Software for a Cluster
This article describes what you can expect while performing an IDR Cluster software update.
  • Each IDR in a cluster will take approximately 10 to 30 minutes to update, depending on the performance of your VMware infrastructure.
  • During an update, the IDR's Platform > Identity Routers status will change from OUT_OF_DATE to DISTRESSED.  The status will change to ACTIVE when the update is complete.  You must refresh the page to see status changes.
  • During an update you cannot select Test or View Log from the Admin Console; nor can you access the IDR Setup Console (a/k/a the setup.jsp). 
  • If you have a high availability cluster with properly configured load balancer and session replication, users may see little or no impact during a software update.  Even with high availability, however, your load balancer needs to detect a pool member being down for some period of time before removing it from rotation, so some users may still be directed to a "down" (updating) IDR during that time, and see an error message.
  • If you have a single IDR environment, then all services will be down during the update.  End-users will need to log in again after the update is complete.
NotesIf an IDR is both OUT_OF_DATE and in DEBUG logging mode, the dashboard IDR update message and IDR list page (Platform > Identity Routers) status will be inconsistent.  If you refresh, the dashboard message may appear or disappear, and the IDR list page will alternate between showing OUT_OF_DATE or DEBUG.