Migration Instructions for Hybrid Tenants

Document ID : KB000010147
Last Modified Date : 14/02/2018
Show Technical Document Details

This document describes migrating hybrid Portal tenants to the new OpenShift toolchain.


Pre-migration Instructions

Upgrade Gateway to 9.2

Upgrade your Tenant Gateway to version 9.2. Refer to the CA API Gateway documentation ("Upgrade the Gateway") for instructions.

Remove ApiPortalIntegration.aar

Customers who have used CA API Gateway 9.0 at some point may still have an old ApiPortalIntegration.aar file. Ensure that Tenant Gateway does not have the file, as follows:

  1. Open a privileged shell on the Tenant Gateway.
  2. Navigate to /opt/SecureSpan/Gateway/runtime/modules/assertions.
  3. Delete ApiPortalIntegration.aar if it exists.

Upgrade OTK to 3.4

Customers using an older version of CA API Management OAuth Toolkit (OTK) must upgrade to 3.4. Refer to the CA API Management OAuth Toolkit - 3.4 ("Upgrade and Uninstall") for instructions. 

Note: Restart the Tenant Gateway after upgrading OTK. If you schedule the OTK upgrade well in advance of Portal migration, the following extra steps are required:

  • Reset the Portal (CA SaaS Ops will co-ordinate with you before they perform this step)
  • Re-enroll the Tenant Gateway (to be performed by you; refer to the "Re-enroll the Tenant Gateway" section in this document).

Post-migration Instructions

Before You Re-enroll the Tenant Gateway

  1. Remove "pssg" and "dssg" certificates:
    1. In the Gateway Policy Manager go to Tasks > Certificates, Keys and Secrets > Manage Certificates.
      01 Manage Certs.png 
    2. Select the certificates that have "pssg" and "dssg" in their name, and click Remove.
      02 pssg-tssg-certs.png
    3. Click Close.
  2. Remove the portal.bundle.version cluster property:
    1. Go to Tasks > Global Settings > Manage Cluster-Wide Properties.
      03 Manage Cluster-Wide Properties.png 
    2. Select the "portal.bundle.version" key and click Remove.
      04 portal-bundle-version.png
    3. Select the "portal.config.pssg.host" key and click Remove.
    4. Click Close.
  3. If you have SSO enabled:
    1. Save any customizations made to SSO Fragments.
    2. Remove the following SSO Policy and Fragments from the API Portal SSO folder: "API Portal SSO SAML Service", "API Portal SSO Configuration Fragment", "API Portal SSO SAML Request Service Fragment", and "API Portal SSO SAML Validation Service Fragment".
      05 SSO Policy and Fragments.png

Re-enroll the Tenant Gateway

  1. Login to the Portal and copy the new enrollment URL:
    1. For SSO enabled tenants, log in to <portal tenant url>/admin/login, or retrieve it from the <tenant id>-enroll-urls.csv file provided by CA SaaS Ops.
    2. For multicluster tenants, retrieve it from the <tenant id>-enroll-urls.csv file provided by CA SaaS Ops. Note: Each URL is designated to be enrolled by a specific Tenant Gateway. The NODE_ID value from the file should match the Tenant Gateway's portal.config.node.id cluster property.
  2. Login to the Tenant Gateway using Policy Manager.
  3. Go to Tasks > Extensions and Add-Ons > Enroll with Portal in Policy Manager.
    06 Enroll with Portal-menu.png 
  4. Enroll the Portal using the URL from step 1.
  5. For SSO enabled tenants, re-apply the customizations to new SSO policy fragments if necessary.
  6. Restart the Tenant Gateway.

Verify Migration was Successful

  1. Log in as admin to the Tenant Portal using the same URL as before the migration.
  2. Verify that the Dashboard page appears after you log in.
    07 Dashboard after migration.png
  3. Go to Portal navigation menu > Settings > API Proxy, and:
    1. Check if there are 4 columns on the API Proxy page: "API Proxy Name", "API Proxy URL", "Proxy Version", and "Actions".
      08 API Proxy Page.png
    2. Confirm that the proxy version for each enrolled Tenant Gateway is 9.2.
    3. Click View Details for each enrolled Tenant Gateway and confirm that the APIs, Apps and Account Plans are in sync.
      09 API Proxy Details.png
  4. Go to Portal navigation menu > Analytics and verify that API Hits and Application Hits do not have a "NO DATA" message.
  5. Go to Portal navigation menu > Business Reports and verify that the report or graph has loaded.
    10 Business Reports.png
  6. Go to Portal navigation menu > API Catalog: 
    1. Retrieve the name of an API. 
    2. Enter the API name in the Search box in the upper right corner. 
    3. Verify that the search results list the API.
  7. Enter "Home" in the Search box from any page, and verify that the search results lists the Home page.
  8. Go to Portal navigation menu > Content Management and verify that the Adobe CQ5 page opens in a new tab.
  9. Go to Portal navigation menu > Portal APIs: 
    1. Verify that the API Explorer page opens in a new tab. 
    2. Click on the "Please select an API" box and verify two APIs are listed: "Portal API (<TenantName>)" and "Portal Metrics API (<TenantName>)", where <TenantName> represents the part of the Portal domain preceding ".dev.ca.com".
      11 Portal APIs Page.png

If you have managed to perform all the steps successfully, then your migration was successful.