How To

How do I check what patches are installed for ForgeRock products?

Last updated Sep 8, 2020

The purpose of this article is to provide details for checking what patches are installed for AM/OpenAM, DS/OpenDJ, IDM/OpenIDM and IG/OpenIG.

2 readers recommend this article

Overview

This article provides details for checking what patches are installed by product:

AM/OpenAM
Policy Agents
DS/OpenDJ
IDM/OpenIDM
IG/OpenIG

You can also use the patchinfo utility in AM/OpenAM and IG/OpenIG as detailed in How do I use the patchinfo utility to check what patches are installed for AM/OpenAM (All versions) or IG/OpenIG (All versions)?

Checking for patches in AM/OpenAM

Providing you have unzipped your patches directly in the openam directory as recommended, you can check what patches are installed as follows:

$ cd /path/to/tomcat/webapps/openam/WEB-INF
$ ls README.*

README.1.12345    README.201901

Where each README represents a set of installed patches. READMEs are named to indicate either the ticket number where the patch was given (README.1.12345) or the security advisory ID (README.201901).

Embedded DS/OpenDJ

You can check what patches are installed using the status -V command as follows:

$ cd /path/to/openam/opends/bin
$ ./status -V

ForgeRock Directory Services 6.5.2+OPENDJ-1234,OPENDJ-5678
Build 20200519141638

Any installed patches will be listed after the product name and version as an issue tracker ID (JIRA).

Checking for patches in Agents

You can check the debug log to see what patch version you have installed, for example:

######################################################
 # OpenAM Web Agent                                   #
 # Version: 4.1.0-27                                  #
 # Revision: 39e5be3                                  #
 # Container: IIS 7.5, 8.x WINNT 32/64bit/WINNT       #
 # Build date: Nov  2 2017 13:42:43                   #
 ######################################################

For Web Agents, you can also check the version using the agentadmin --v command as follows:

$ ./agentadmin --v

OpenAM Web Agent for Apache Server 2.4.x 64bit
 Version: 5.6.2.0
 Revision: 2f0b6af
 Build machine: 980b10999d8c
 Build date: Nov 1 2019 15:16:53

Checking for patches in DS/OpenDJ

You can check what patches are installed using the status -V command as follows:

$ cd /path/to/ds/bin
$ ./status -V

ForgeRock Directory Services 6.5.2+OPENDJ-1234,OPENDJ-5678
Build 20200519141638

Any installed patches will be listed after the product name and version as an issue tracker ID (JIRA).

Checking for patches in IDM/OpenIDM

You can check what patches are installed using the PS command when running IDM/OpenIDM interactively, for example:

ps
START LEVEL 12
 ID   State       Level  Name
[ 0] [Active  ] [ 0] System Bundle (5.6.10)
[ 1] [Active   ] [ 1] OpenIDM System Bundle (6.5.0.1)
[ 2] [Active   ] [ 2] Apache Felix Log Service (1.0.1)
[ 3] [Resolved  ] [ 3] OpenIDM fragment for jetty security (6.5.0.1)
...
[ 8] [Active   ] [ 4] OpenIDM Repository Bundle - JDBC (6.5.0.1-OPENIDM-1234-5678)
...

Any installed patches will be listed after a product bundle as an issue tracker ID (JIRA). Patches only apply to a bundle (not the whole product), so you will need to check all bundles for patches, focusing on any that start OpenIDM, ForgeRock or OpenICF. You can search for version-JIRA_prefix and version.JIRA_prefix to easily find the patched bundles, for example:

(6.5.0.1-OPENIDM
(6.5.0.1-OPENICF
(6.5.0.1-CREST

Checking for patches in IG/OpenIG

Providing you have unzipped your patches directly in the top-level IG/OpenIG WAR directory as recommended, you can check what patches are installed as follows:

$ cd /path/to/jetty/webapps/root/WEB-INF
$ ls README.*

README.1.12345    README.201606

Where each README represents a set of installed patches. READMEs are named to indicate either the ticket number where the patch was given (README.1.12345) or the security advisory ID (README.201606).

Related Training

N/A

Related Issue Tracker IDs

OPENAM-2651 (Formalized patching mechanism)