Checking for Incompatibilities between Version 12.3 and 21.0

DB Service Agent with TLS/SSL

Components that use WebSockets and TLS/SSL - that is, the Java-based Agents, Windows and UNIX Agents, the Java API, AWI and the Proxy - can only connect to the AE if there is a trusted certificate installed on the host where they are running.

Note: Remember that the Java API version must match the Automation Engine version.

Make sure that you have installed the IBM XL C++ Runtime, V16.1 system libraries (libc++, xlC.aix61, xlC).

For detailed information on how to install the package, please refer to the official IBM C and C++ compilers documentation.

The [SSL] section including the keyStore and keyStorePwd parameters as well as the cpSelection and cpName parameters in the [GLOBAL] section of the INI file of the Proxy have been removed.

Also, since the Proxy now connects to the JCP, the JCP selection is defined in the [JCPLIST] section of the INI file and not the [CP_LIST], which has also been removed. For more information, see Connecting to a Communication Process.

• SAP Netweaver 7.50 SPS0 or SPS1: In this case, you have to implement the SAP note 2069317. Otherwise, the Agent produces the error java.security.InvalidKeyException: PublicKey algorithm not implemented: ECPublicKey.

• Cryptography provider version (IAIK) is 5.2 or lower: In this case, you must store trusted certificates in the cacerts file of the JVM. For more information, see SAP note 1877723.

  In SAP systems in which executables are replicated with sapcpe, make sure to do the changes in the central SAP JVM directory and not only in the instance-specific directories. Otherwise, your changes are overwritten any time the SAP system is restarted.

• Cryptography provider version (IAIK) is 5.2 or higher: In this case, you can configure the trusted certificate path in the configuration (INI) file of the Agent. For more information, see Agent JMX

LDAP service must be available for the login.

Also, to use the Synchronize button in the User object for manual synchronization, a Login object must be assigned.

In previous versions, the last valid LDAP password was saved in the AE DB to enable a login even if the service was not available at the time.

The user passwords saved were also used for the synchronization available in the User object.

This previous behavior is seen as a security issue and is therefore no longer supported.

If the LDAP service is not available, the access is denied.

The Synchronize button in the User object no longer works without a SYNC_LOGIN object defined and assigned in variable UC_LDAP_XXXX

Make sure that the LDAP service is available when the LDAP connection is used in the User settings.

To use the Synchronize button, make sure you specify a Login object with LDAP credentials and assign it using the SYNC_LOGIN key of the UC_LDAP_XXX variable. For more information, see UC_LDAP_EXAMPLE - LDAP Connection Variable.

JWPs can have explicit roles and the periodic tasks (performance management, telemetry) should only be performed by one JWP.

During ZDU, there is a switch from the old to the new JWP. This could lead to two JWPs performing periodic tasks, which may cause some issues.

ZDU is not possible from versions prior to the following:

• 12.1.8
• 12.2.6
• 12.3.3

For versions 12.1 to 12.3, use the latest service pack before carrying out a ZDU.

Upgrade the RA Agents to their latest version:

• RA.BusinessObjects 4.2.*

• RA.Hadoop 2.1.*

• RA.HyperionEPMA 1.3.*

• RA.HyperionESSBASE 1.2.*

• RA.HyperionFDMEE 1.3.*

• RA.HyperionFM 1.3.*

• RA.HyperionPlanning 1.2.*

• RA.Informatica 5.3.*

• RA.JD.Edwards 2.2.*

• RA.Oracle.EBS 4.4.*

• RA.Oracle.ERP.Cloud 1.1.*

• RA.Oracle.Retail 2.2.*

• RA.Web.Service.REST 4.6.*

• RA.Web.Service.SOAP 4.6.*

• RA.Banner 4.0.*

• RA.FTP 4.1.*

• RA.Avaloq 4.0.*

General DB change

Note: Information and the checking instructions apply to all versions, between your existing installation and the latest you want to upgrade to, respectively.

• Check and adapt relevant SQL/SQLI/SQLJOBS objects accordingly
• Check and adapt relevant DB queries used in external tools/programs

Check JxP availability

This change relates to higher reliability of an AE system and transparency about system availability.

The system internally checks if the minimum number of java-based processes (JCP, JWP, REST, JWP) required to log into the system or to perform operations in AWI is available.

If the minimum number of java-based processes required is not available when logging into the system, the login is refused and a notification is displayed.

If they are not available during AWI operations, the user gets a notification. To log off, stop further user activities and inform your administrator.

Lucene indexing is done by the JWP with the role IDX. The search still goes through the JCP in v.12.3.

Note: In version 12.3, the JCP was used partly to provide a REST endpoint for the Automation Engine.

You can use the Centralized Agent Upgrade (CAU) to upgrade supported Agents to their respective TLS/SSL (21.0) version.

In an on-premises installation, the INI file of the respective Agents are patched automatically, and the certificates are added as well.

In an on-premises installation, no action is required.

If you migrate to an AAKE system, remember that the JCP by default uses a generated, self-signed certificate within the Kubernetes cluster. The TLS/SSL Agents do not connect to the JCP directly, but to an HTTPS load balancer for which a certificate is required, see Connecting to AWI, the JCP and REST Processes Using an Ingress.

You can use the CAU_INCLUDE_SERVER_CERTIFICATES parameter in the UC_SYSTEM_SETTINGS to stop the AE from automatically adding the JCP certificate during CAU. For more information ,see CAU_INCLUDE_SERVER_CERTIFICATES.

This parameter defines if the Windows Messenger uses a secure (TLS/SSL) or non-secure connection to connect to the Agent.

If the parameter is set to 1, the job messenger uses a non-secure connection to the Windows Agent over localhost (127.0.0.1) only.

You can state default tablespaces provided for Automic Automation and AAKE as alternative ones.

If you used cloud-hosted databases and do not have the permissions required to create or rename a tablespace, state them as alternative ones.

In Automic Automation you can do so in the DBLoad utility user interface while loading the database or using the command line interface, see AE DB Load (UCYBDBLD.EXE).

In AAKE you set them in the values.yaml file, see Configuring Container-Based Systems.

In the Automic Automation Kubernetes Edition, the CyberArk AIM client used for the integration cannot communicate with an Automation Engine in a cluster.

In the Automic Automation Kubernetes Edition, the CAPAM A2A client used for the integration cannot communicate with an Automation Engine in a cluster.

In Automic Automation Kubernetes Edition, the Helm plugin handles the upgrade.

The Automic Automation Kubernetes Edition does not support the Kerberos Key Distribution Center (KDC) protocol.

The SAML implementation for the Automic Automation Kubernetes Edition is different than the one for an on-premises installation.

If SAML is not enabled and configure correctly for AAKE it will not work.

The LDAP implementation for the Automic Automation Kubernetes Edition is different than the one for an on-premises installation.

In addition to enabling and configuring LDAP in your system, AAKE requires a Kubernetes secret for the LDAP server and the corresponding certificate before the installation.

Create a Kubernetes secret with the corresponding LDAP server certificate before the installation, see Setting Up LDAP for Automic Automation Kubernetes Edition.