Vulnerabilities need JDK upgrade in CA Access Gateway (SPS) and Policy Server

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign-On
• SITEMINDER

Issue/Introduction

JDK needs to be upgraded from lower versions to higher supported versions for Access Gateway (SPS) and Policy Server due to security vulnerabilities.

Resolution

When modifying a file, per best practice, it's recommended to back up the original file.

Policy Server JDK upgrade, follow the below steps:

On Windows:

1. Stop the Policy Server;
2. Change the SYSTEM environment variable NETE_JRE_ROOT to the new path where the new JDK version is installed, by replacing the old location;
3. Change the SYSTEM environment variable NETE_JAVA_PATH to the new path where the new JDK version is installed, by replacing the old location;
4. Start the Policy Server;

  It is recommended to reboot the machine to ensure all the environment variables are set.

On Linux:

1. Stop the Policy Server;
2. In file
   
   /{home_policy_server}/ca_ps_env.ksh
   
   Change the value of NETE_JRE_ROOT to the new path where the new JDK version is installed, by replacing the old location;
   
   
3. Start the Policy Server;

Access Gateway (SPS) JDK upgrade, follow the below steps:

1. Stop the CA Access Gateway (SPS);
2. Modify environment variables:
   
   On Windows:
   
   Modify NETE_SPS_JAVA_HOME=<location of new JDK path>, by replacing the old location in the file 
   
   \{home_sps}\proxy-engine\conf\SmSpsProxyEngine.properties
   
   Modify SPS_JAVA_HOME=<location of new JDK path>, by replacing the old location in the file
   
   \{home_sps}\ca_sps_env.bat
   
   On Linux:
   
   Modify SPS_JAVA_HOME=<location of new JDK path>, by replacing the old location in the file
   
   /{home_sps}/ca_sps_env.sh;
   
   
3. Start the CA Access Gateway (SPS);