Before upgrading

Before starting to upgrade, verify that the user running the installation process has the following authorization requirements:

UNIX™ and Linux™ operating systems

root access

Windows™ operating system

If you set the Windows User Account Control (UAC), your login account must be a member of the Windows™ Administrators group or domain administrators group with the right Act as Part of the Operating System.

You must run the installation as administrator.

If the HCL Workload Automation environment is configured in SSL mode, ensure one of the following conditions is met in the localopts file before you upgrade master domain manager, backup master domain manager, dynamic domain manager, or fault-tolerant agents to Version 10.1 Fix Pack 3 or later:

• the SSL Encryption Cipher parameter is set to TLSv1.2
• If the SSL Encryption Cipher parameter is not used, but one of the following parameters is used:
  • ssl tls12 cipher
  • ssl tls11 cipher
  • ssl tls10 cipher
  ensure the parameter is set to HIGH.

When upgrading to V10.1 Fix Pack 1 or later, a number of changes are performed in the server.xml file, by introducing new multiple <jwtBuilder> and <mpJwt> elements. These elements are used by HCL Workload Automation for the JWT functionality, and are identified by the following comments within the server.xml file:

<!-- Starting JWT Token configuration -->
<!-- JWT configuration for DA -->

To work around this problem, perform the following steps:

1. Update the <jwtBuilder> elements by modifying the keyAlias property to the correct value.
2. To verify the signature of a JWT received in a connection from another entity, WebSphere Application Server Liberty Base retrieves the public information associated to the certificate from the <WA_DATA>/usr/servers/engineServer/resources/security/TWSServerTrustFile.jks file. You can find the public information in the keyName=”${mp.jwt.trust.key}” property within the <mpJwt> elements. These elements use a variable which is declared within the new jwt_variables.xml file that is created in the overrides folder after the upgrade:

   <server description=”jwt_variables”>
   
        <variable name=”mp.jwt.trust.key” value=”twstrustkey”/>
   
   </server>

3. Also, add the public information only of the custom certificate in the TWSServerTrustFile.jks file, under that alias (overwriting the already existing one).
4. Alternatively, it is possible to add it as a new entry with a new label, but the jwt_variables.xml file should be updated accordingly. For more information, see Enabling API Key authentication after upgrading.
5. The agent must have the public information associated to the certificate used by the master domain manager when creating a new JWT. The reason for this is that also the agent needs to verify the signature of a JWT received from the master domain manager. Therefore, it is required to also add the public information only of the custom certificate of the master domain manager (the file that was added in the TWSServerTrustFile.jks file on the master domain manager) in the TWSClientKeyStore.kdb file of the agent.