Upgrading Autonomous Identity

On the deployer machine, back up the 2021.3.5 ~/autoid-config directory or move it to another location.

$ mv ~/autoid-config ~/backup-2021.3

Create a new ~/autoid-config directory.

$ mkdir ~/autoid-config

Copy your autoid_registry_key.json from your backup directory to ~/autoid-config.

Copy your original SSH key into the new directory.

$ cp ~/.ssh/id_rsa ~/autoid-config

Change the permission on the SSH key.

$ chmod 400 ~/autoid-config/id_rsa

Check if you can successfully SSH to the target server.

$ ssh autoid@<Target-IP-Address>

Last login: Tue Aug 15 18:19:14 2021

Stop the stack.

$ docker stack rm configuration-service consul-server consul-client nginx jas openldap selfservice swagger-ui ui api notebook

Removing service configuration-service_configuration-service
Removing service consul-server_consul-server
Removing service consul-client_consul-client
Removing service nginx_nginx
Removing service jas_jasnode
Removing service openldap
Removing service selfservice_selfservice
Removing service swagger-ui_swagger-ui
Removing service ui_zoran-ui
Removing service api_zoran-api
Nothing found in stack: notebook

Enter exit to end your SSH session.

From the deployer, repeat the restart Docker command:

$ sudo systemctl restart docker

On the deployer node, change to the ~/autoid-config directory.

$ cd ~/autoid-config

Log in to the ForgeRock Google Cloud Registry (gcr.io) using the registry key. The registry key is only available to ForgeRock Autonomous Identity customers. For specific instructions on obtaining the registry key, see How To Configure Service Credentials (Push Auth, Docker) in Backstage.

$ docker login -u _json_key -p "$(cat autoid_registry_key.json)" https://gcr.io/forgerock-autoid

Login Succeeded

Run the create-template command to generate the deployer.sh script wrapper and configuration files. Note that the command sets the configuration directory on the target node to /config. The --user parameter eliminates the need to use sudo while editing the hosts file and other configuration files.

$ docker run --user=$(id -u) -v ~/autoid-config:/config -it gcr.io/forgerock-autoid/deployer:2021.8.0 create-template

Configure your upgraded system by editing the ~/autoid-config/vars.yml , ~/autoid-config/hosts , and ~/autoid-config/vault.yml files on the deployer machine.

Download the images. This step downloads software dependencies needed for the deployment and places them in the autoid-packages directory. Make sure you are in the ~/autoid-config directory.

$ ./deployer.sh download-images

SSH to the target node.

Stop the Spark master and workers.

$ /opt/autoid/spark/spark-3.0.1-bin-hadoop2.7/sbin/stop-all.sh

Rename two log4j jar files in the /opt/autoid/elastic/opendistroforelasticsearch-1.9.0/lib folder. The upgrade installs an older version of the files, and another upgrade to the latest patch release installs the new version of these files.

$ cd /opt/autoid/elastic/opendistroforelasticsearch-1.9.0/lib/

$ sudo mv log4j-api-2.17.0.jar log4j-api-2.17.0.jar.bak

$ sudo mv log4j-core-2.17.0.jar log4j-core-2.17.0.jar.bak

Exit your SSH session.

Run the upgrade.

$ ./deployer.sh upgrade

SSH to the target server.

On the target server, edit the /opt/autoid/res/jas/docker-compose.yml and set the JAS_AUTH_ENABLED to true.

JAS_AUTH_ENABLED=true

Restart the JAS container.

$ docker stack rm jas

$ docker stack deploy -c /opt/autoid/res/jas/docker-compose.yml jas

Remove the nginx container.

$ docker stack rm nginx

Redeploy the stack.

$ docker stack deploy -c /opt/autoid/res/nginx/docker-compose.yml nginx

Log out and then log back in to Autonomous Identity.

Add a reference to the Autonomous Identity UI to your /etc/hosts or DNS server.

<Public IP Address> autoid-ui.forgerock.com

Redo the attribute mappings. See Set Attribute Mappings.

Then, run the analytics pipeline with a new role mining analytics step, analytics mine:

$ analytics ingest
$ analytics train
$ analytics mine
$ analytics predict-as-is
$ analytics predict-recommendation
$ analytics publish
$ analytics create-assignment-index