Upgrade from PRIME 3.11 to PRIME 3.12

Upgraded PRIME to 3.12, see Upgrade PRIME.

The SAML implementation has been revised and significant changes have been done to simplify the configuration.

For that reason, there is no automated upgrade path for an existing SAML configuration. SAML authentication profiles from previous releases have to be deleted and re-configured when upgrading to 3.12.

For details on how to configure SAML in PRIME 3.12, see chapters "Configure SAML SSO Core Object profile" and "Configure SAML SSO LDAP profile" in Set up authentication profile.

With PRIME 3.12 the latest major release of Nexus Certificate Manager (CM), version 8.1, is supported. With CM 8, several changes have been done in the integration interfaces. A downgrade to older CM versions just by replacing corresponding CMSDK files, is no longer possible. It is therefore highly recommend to upgrade CM to version 8.1. If you cannot upgrade immediately, there is a backport patch to CM version 7.18.1. See separate instructions that are delivered with the patch for details.

All PRIME PKI connectors have been moved to the internal connector architecture. This was done already with the previous PRIME release. Therefore the old "External CA Connector" interface is no longer needed and it has been removed in the PRIME Designer configuration.

If you still have a PKI connected via this interface, you need to switch to the corresponding internal PRIME connector instead.

As part of external PKI connector cleanup, the old "trustserver" functionality has been changed. "trustserver" was used in early PRIME projects to store sensitive data (like PIN and PUK) in Nexus Certificate Manager. Since sensitive data now can be encrypted also in PRIME, the trustserver functionality is only kept for compatibility reasons for existing PRIME installations.

Therefore the standalone usage of "trustserver" is no longer supported. Only the "combined" approach (new secrets are stored in PRIME internally, fallback is to check trustserver) can be used with PRIME 3.12.

In earlier releases, this functionality required nexus_cm.properties configuration in PRIME Designer, PRIME Explorer and PRIME Tenant. The current implementation requires a trustserver.properties available in all three applications. But only PRIME Explorer needs a working configuration, see an example file below. In PRIME Designer and PRIME Tenant, the file can be empty.

# config for trustserver
cmConnectorConfigName=InternalCMConnector
caTokenProcedureStoreSecret=handleCardsSecrets
caTokenProcedureRecovery=TP_RecoverKey
caTokenProcedureImportCert=Import_MyCertificate
certificateManagerIssuerIdentifier=CN=CM DEV Issuing CA, O=CM DEV, C=DE

Cleanup and restructuring has been done in engineSignEncrypt.xml:

1. Remove these entries from the file, as they are obsolete. You can also leave them as they are, as they will have no effect.
   1. PasswordDescriptor
   2. SecretFields01
   3. signCertZipConfg
2. Update these renamed entries in the file:
   1. Replace "PasswordDescriptor02" with "EncryptedFields".
   2. Replace "JWTDescriptor" with "SelfServiceJWTSigner".
3. Duplicate the "SignVerifyDescriptor".

1. In the first copy, replace "SignVerifyDescriptor" with "ObjectHistorySigner" (if you have multiple entries of SignVerifyDescriptor, use the one with the highest "key" attribute).
2. In the second copy, replace "SignVerifyDescriptor" with "ConfigZipSigner".
3. Optionally two different keys can be used for "ConfigZipSigner" and "ObjectHistorySigner".

See Sign and encrypt engine for more information. Also, see the updated engineSignEncrypt.xml in the PRIME 3.12 delivery for further information.

The Groovy Script Engine has been updated from version 2.4 to version 3.0. Some Interfaces have changed or have been deprecated in Groovy 3.0. This might cause that custom Groovy scripts are failing after the update.

Please check the corresponding release notes or change logs to verify if your custom scripts are affected and adapt your scripts if necessary.

All standard service tasks are found here: Standard service tasks.

New standard service tasks for PRIME 3.12

• Cert: Create ACME pre-registration order
• Cert: Extract Certificate Attributes
• Process: Load values of SystemProperties into process map
• Process: Validate a value in the Process Map against a regular expression

Updated standard service tasks for PRIME 3.12

• Cert: Extract Pkcs#10 Attributes From Request
• Cert: Request & Recover PKCS#12 Soft Token
• Core Objects: Create Relation
• Core Objects: Drop Relation
• Personal Messaging: Create Key on Personal Mobile
• Personal Messaging: Install Certificates on Personal Mobile
• Personal Messaging: Create Key on Virtual Smart Card
• Personal Messaging: Install Certificates on Virtual Smart Card

Updated standard service tasks not related to the 3.12 release

• Process: Assert Uniqueness Task
• Process: Execute Search Task

For PRIME 3.12.4, these standard service tasks are updated, and the value for the parameter storagePriority is changed from TPM to VSC:

• Personal Messaging: Create Key on Virtual Smart Card
• Personal Messaging: Install Certificates on Virtual Smart Card

Both tasks are used in the standard workflow Creation of virtual smartcard (Id: PcmSubProcCreationOfVSC), used in the module Digital Id.

1. After uploading the module Digital Id into PRIME Designer, go to Home > Process Import.
2. Search for the process name Creation of virtual smartcard or the process id PcmSubProcCreationOfVSC and double-click on it to open it.
3. Under Attributes you see the two service tasks. Click Edit on the first task.
4. Change the parameter storagePriority to VSC.
5. Do the same for the other service task.
6. Click Save.

The cron user requires a tenant ID again.

1. Set cronUsername, cronPassword and cronTenantId in system.properties for Identity Manager Operator accordingly. See List of Identity Manager system properties.

The cron user requires a tenant ID again.

1. Set cronUsername, cronPassword and cronTenantId in system.properties for Identity Manager Operator accordingly. See List of Identity Manager system properties.

• Upgrade Identity Manager
• Smart ID Identity Manager
• Contact Nexus