How To

How do I check what patches are installed for ForgeRock products?

Last updated Nov 2, 2020

The purpose of this article is to provide details for checking what patches are installed for AM/OpenAM, DS/OpenDJ, IDM/OpenIDM and IG/OpenIG.

2 readers recommend this article

Overview

This article provides details for checking what patches are installed by product:

AM/OpenAM
Policy Agents
DS/OpenDJ
IDM/OpenIDM
IG/OpenIG

You can also use the patchinfo utility in AM/OpenAM and IG/OpenIG as detailed in How do I use the patchinfo utility to check what patches are installed for AM/OpenAM (All versions) or IG/OpenIG (All versions)?

Checking for patches in AM/OpenAM

Providing you have unzipped your patches directly in the openam directory as recommended, you can check what patches are installed as follows:

$ cd /path/to/tomcat/webapps/openam/WEB-INF $ ls README.* README.1.12345 README.201901

Where each README represents a set of installed patches. READMEs are named to indicate either the ticket number where the patch was given (README.1.12345) or the security advisory ID (README.201901).

Embedded DS/OpenDJ

You can check what patches are installed using the status -V command as follows:

$ cd /path/to/openam/opends/bin $ ./status -V ForgeRock Directory Services 6.5.2+OPENDJ-1234,OPENDJ-5678 Build 20200519141638

Any installed patches will be listed after the product name and version as an issue tracker ID (JIRA).

Checking for patches in Agents

You can check the debug log to see what patch version you have installed, for example:

###################################################### # OpenAM Web Agent # # Version: 4.1.0-27 # # Revision: 39e5be3 # # Container: IIS 7.5, 8.x WINNT 32/64bit/WINNT # # Build date: Nov 2 2017 13:42:43 # ######################################################

For Web Agents, you can also check the version using the agentadmin --v command as follows:

$ ./agentadmin --v OpenAM Web Agent for Apache Server 2.4.x 64bit Version: 5.6.2.0 Revision: 2f0b6af Build machine: 980b10999d8c Build date: Nov 1 2019 15:16:53

Checking for patches in DS/OpenDJ

You can check what patches are installed using the status -V command as follows:

$ cd /path/to/ds/bin $ ./status -V ForgeRock Directory Services 6.5.2+OPENDJ-1234,OPENDJ-5678 Build 20200519141638

Any installed patches will be listed after the product name and version as an issue tracker ID (JIRA).

Checking for patches in IDM/OpenIDM

You can check what patches are installed using the PS command when running IDM/OpenIDM interactively, for example:

ps START LEVEL 12 ID State Level Name [ 0] [Active ] [ 0] System Bundle (5.6.10) [ 1] [Active ] [ 1] OpenIDM System Bundle (6.5.0.1) [ 2] [Active ] [ 2] Apache Felix Log Service (1.0.1) [ 3] [Resolved ] [ 3] OpenIDM fragment for jetty security (6.5.0.1) ... [ 8] [Active ] [ 4] OpenIDM Repository Bundle - JDBC (6.5.0.1-OPENIDM-1234-5678) ...

Any installed patches will be listed after a product bundle as an issue tracker ID (JIRA). Patches only apply to a bundle (not the whole product), so you will need to check all bundles for patches, focusing on any that start OpenIDM, ForgeRock or OpenICF. You can search for version-JIRA_prefix and version.JIRA_prefix to easily find the patched bundles, for example:

(6.5.0.1-OPENIDM (6.5.0.1-OPENICF (6.5.0.1-CREST

Checking the End-User UI Version (IDM 6.5 and later)

Note

The End-User UI version that's included with IDM 6.5 and later is independent of the IDM version. Please ensure to include the End-User UI version details when raising a ticket with Support. You can find the complete list of End-User UI versions and associated IDM releases in Where can I find source code for IDM/OpenIDM (All versions) (Using the End-User UI source code).

When raising a support ticket, you should include the End-User UI version details included in the following file:

$ /path/to/idm/ui/enduser/COMMITHASH

This is the version of the End-User UI you are currently using.

Checking for patches in IG/OpenIG

Providing you have unzipped your patches directly in the top-level IG/OpenIG WAR directory as recommended, you can check what patches are installed as follows:

$ cd /path/to/jetty/webapps/root/WEB-INF $ ls README.* README.1.12345 README.201606

Where each README represents a set of installed patches. READMEs are named to indicate either the ticket number where the patch was given (README.1.12345) or the security advisory ID (README.201606).

Related Training

N/A

Related Issue Tracker IDs

OPENAM-2651 (Formalized patching mechanism)