AnsweredAssumed Answered

RSA Auth Manager 8.1 to 8.3 upgrade path questions

Question asked by Lane Frazier on Mar 26, 2018
Latest reply on Jan 4, 2019 by Kevin Douglas

Like • Show 0 Likes0
Comment • 5

We currently run RSA Authentication Manager 8.1 Service Pack 1 patch 3 - Primary and 2 (remote) replicas with a Web Tier. The Primary and Replicas are appliances.

Looking to upgrade. Can someone elaborate on the upgrade path including web tier updates

From what I can tell the path would be from 8.1 SP1 P3 ==> 8.2==>8.2 Service Pack 1===>8.3

I need some clarification on this.

Questions I have:

We run on physical appliances....do I need to be concerned about hardware requirements to do this. Can someone explain to me what commands I might run from the OS that would tell me what I have now so that I can check

I know certain patch levels require a uninstall and re-install of the web tier as well. Does this have to be done after each upgrade or can it be done after the whole process is done.

From what I have read we have to do the primary and each replica...so in my case that at least 3 appliances times 3 upgrades and a one or more web tier uninstall and re-install

We want to upgrade to a sha-256 cert....when would this be ordered and done?....generate on the Primary after we completed the last upgrade to 8.3 ?

Do my existing hard and soft token's that I have on the 8.1 SP1 P3 system move over and act the same expiration date wise? Or do we have to order different tokens if we want to take advantage of extending the expiration dates on tokens

Thanks for your help on this...have never updated this system and it looks like its going to be involved

4 people also have this question

Outcomes

5 Replies

Jeff Shurtliff Apr 25, 2018 10:00 AM
Mark Correct
Correct Answer
Hi Lane,

I have moved this thread to the RSA SecurID Access so that you can get an answer to your question.

You can post future questions and discussions directly to that community by clicking on the Ask a Question or Start a Discussion button on the RSA SecurID Access page.

Thanks,
Jeff
Like • Show 0 Likes0
Actions
Edward Davis Apr 26, 2018 8:53 AM
Mark Correct
Correct Answer
We run on physical appliances....do I need to be concerned about hardware requirements to do this. Can someone explain to me what commands I might run from the OS that would tell me what I have now so that I can check

a) if it runs 8.1 now, it will run 8.3
b) as root, run
dmidecode

I know certain patch levels require a uninstall and re-install of the web tier as well. Does this have to be done after each upgrade or can it be done after the whole process is done.

c) you can wait until patching is all over, then uninstall, and reinstall the 8.3 web tier.

From what I have read we have to do the primary and each replica...so in my case that at least 3 appliances times 3 upgrades and a one or more web tier uninstall and re-install

d) yes, for each patch...do primary first, then replica(s), then verify replication is normal, then proceed
to next patch level

We want to upgrade to a sha-256 cert....when would this be ordered and done?....generate on the Primary after we completed the last upgrade to 8.3 ?

e) you can do it anytime once you are above 8.1 sp1 patch 13.
do it before you uninstall and reinstall the web tier to save some time on that

refer to the regen-internal-ca command [ ./rsautil manage-ssl-cert --regen-internal-ca]
To upgrade the certificates, you must run the utility on the primary instance and each replica instance.
If your deployment includes a web tier, you must re-install the web tier and re-enable the virtual host.
You must generate and distribute new configuration files to any IPv4/IPv6 authentication agents or custom agents that were created with the RSA Authentication Agent API 8.5 or later for C or the RSA Authentication Agent API 8.5 or later for Java.
You might also need to add the new certificates to the list of trusted CAs for your web browser and to any Authentication Manager administrative SDK connections

Do my existing hard and soft token's that I have on the 8.1 SP1 P3 system move over and act the same expiration date wise? Or do we have to order different tokens if we want to take advantage of extending the expiration dates on tokens

f) yes. Hard tokens do not change at all.
Software tokens change on 8.2 and up and can now be 'extendable' if two things are true:
1-it was distributed from 8.2 or higher and
2-is currently assigned then
3-token can be extended and inherit the lifetime of another non-expired unassigned software token.

Tokens on end user devices today, will have the normal expire date.
You can re-distribute the same token to the same user when your primary is 8.2 or higher, and now it will have an expire date of 2035 on the end user device, and in the security console it will have a normal expire date. Now these can be extended by inheriting the expire date of new tokens you install, saving the end user from needing to reinstall each expiration cycle. But the token on the end user device must have been distributed from 8.2 or higher for them to be 'extendable'.
Like • Show 0 Likes0
Actions
- Fernando Portillo @ Edward Davis on Jan 4, 2019 1:27 PM
  Mark Correct
  Correct Answer
  Hello,
  
  Our organization is also in the path to upgrade the RSA Authentication Manager from 8.1 to 8.3 following the upgrade path mentioned above. We do have an additional requirement/concern in regards to the upgrade. Do the RSA Authentication Agent and the SDConf.rec need to be updated after the upgrade? Currently, we utilize the RSA Authentication Agent in combination to LogMeIn and would like to avoid if possible having to re-deploy the RSA Authentication Agents.
  
  Any advise would be much appreciated!
  
  Best regards,
  Like • Show 0 Likes0
  Actions
  - Jay Guillette @ Fernando Portillo on Jan 4, 2019 1:43 PM
    Mark Correct
    Correct Answer
    No, any and all agents that worked with AM 8.1 will work when the servers are upgraded to AM 8.3 - or later, e.g. 8.4
    No need to replace or update sdconf.rec, which basically points to the primary (and replicas if it was generated after an auto-rebalance).
    1 person found this helpful
    Like • Show 1 Like1
    Actions
    - Kevin Douglas @ Jay Guillette on Jan 4, 2019 3:46 PM
      Mark Correct
      Correct Answer
      All agents will work on 8.3 but 8.4 has a restriction as follows.
      Note: RSA Authentication Manager 8.4 supports RSA Authentication Agent 7.3 or later for Microsoft Windows.
      8.4 Release Notes
      Like • Show 1 Like1
      Actions

RSA Auth Manager 8.1 to 8.3 upgrade path questions

Outcomes

Related Content

Recommended Content