How To

How do I check what patches are installed for ForgeRock products?

Last updated Jan 27, 2020

The purpose of this article is to provide details for checking what patches are installed for AM/OpenAM, DS/OpenDJ, IDM/OpenIDM and IG/OpenIG.

1 reader recommends this article

Overview

This article provides details for checking what patches are installed by product:

AM/OpenAM
Policy Agents
DS/OpenDJ
IDM/OpenIDM
IG/OpenIG

You can also use the patchinfo utility in AM/OpenAM and IG/OpenIG as detailed in How do I use the patchinfo utility to check what patches are installed for AM/OpenAM (All versions) or IG/OpenIG (All versions)?

Checking for patches in AM/OpenAM

Providing you have unzipped your patches directly in the openam directory as recommended, you can check what patches are installed as follows:

$ cd /path/to/tomcat/webapps/openam/WEB-INF
$ ls README.*

README.1.12345    README.201608

Where each README represents a set of installed patches. READMEs are named to indicate either the ticket number where the patch was given (README.1.12345) or the security advisory ID (README.201608).

Embedded DS/OpenDJ

You can check what patches are installed using the status -V command as follows:

$ cd $HOME/[am_instance]/opends/bin
$ ./status -V

Wed Nov 29 11:27:09 MST 2017
ForgeRock Directory Services 5.5.0+OPENDJ-1234,OPENDJ-5678
Build 20171019141329

Any installed patches will be listed after the product name and version as an issue tracker ID (JIRA).

Checking for patches in Policy Agents

You can check the debug log to see what patch version you have installed, for example:

######################################################
 # OpenAM Web Agent                                   #
 # Version: 4.1.0-27                                  #
 # Revision: 39e5be3                                  #
 # Container: IIS 7.5, 8.x WINNT 32/64bit/WINNT       #
 # Build date: Nov  2 2017 13:42:43                   #
 ######################################################

For Web policy agents 4.x, you can also check the version using the agentadmin --v command as follows:

$ ./agentadmin --v

OpenAM Web Agent for Apache Server 2.2.x 64bit 
Version: 4.1.0-25 
Revision: 42ff535 
Build machine: delacroix 
Build date: Sep 15 2017 16:44:11

Checking for patches in DS/OpenDJ

You can check what patches are installed using the status -V command as follows:

$ cd /path/to/ds/bin
$ ./status -V

Wed Nov 29 11:27:09 MST 2017
ForgeRock Directory Services 5.5.0+OPENDJ-1234,OPENDJ-5678
Build 20171019141329

Any installed patches will be listed after the product name and version as an issue tracker ID (JIRA).

Checking for patches in IDM/OpenIDM

You can check what patches are installed using the PS command when running IDM/OpenIDM interactively, for example:

ps
START LEVEL 12
   ID   State         Level  Name
[   0] [Active     ] [    0] System Bundle (4.2.1)
[   1] [Resolved   ] [    1] javax.transaction API v.1.1 (3.1.1)
[   2] [Active     ] [    1] OpenIDM System Bundle (4.5.0)
...
[ 135] [Active     ] [   10] OpenIDM Core Bundle (4.5.0.OPENIDM-1234-5678)
...

Any installed patches will be listed after a product bundle as an issue tracker ID (JIRA). Patches only apply to a bundle (not the whole product), so you will need to check all bundles for patches, focusing on any that start OpenIDM, ForgeRock or OpenICF. You can search for version.JIRA_prefix to easily find the patched bundles, for example:

(4.5.0.OPENIDM
(4.5.0.OPENICF
(4.5.0.CREST

Checking for patches in IG/OpenIG

Providing you have unzipped your patches directly in the top-level IG/OpenIG WAR directory as recommended, you can check what patches are installed as follows:

$ cd /path/to/jetty/webapps/root/WEB-INF
$ ls README.*

README.1.12345    README.201606

Where each README represents a set of installed patches. READMEs are named to indicate either the ticket number where the patch was given (README.1.12345) or the security advisory ID (README.201606).

Related Training

N/A

Related Issue Tracker IDs

OPENAM-2651 (Formalized patching mechanism)