Skip to content

Manual upgrade from or to 3.1.1 with OpenDJ#


This guide explains how to upgrade the Gluu Server (SP 2) or (SP 3) to 3.1.1 and keep OpenDJ in the server. This guide assumes an Ubuntu operating system. For other operating systems some commands may change.

Upgrade Process#

Note: "x" represents the version (sp2/sp3)

1. Install 2.4.4 SP2/SP3

2. Log into CE 2.4.4 SP2/SP3 and install it

service gluu-server-2.4.4.x start
service gluu-server-2.4.4.x login
cd /install/community-edition-setup/
3. Exit and Stop 2.4.4.x SP2/SP3
service gluu-server-2.4.4.x stop
4. Disable 2.4.4 SP2/SP3 service auto startup
/usr/sbin/update-rc.d -f gluu-server-2.4.4.x disable

For CentOS6.x: - Disable 'gluuserver-2.4.4.x' from startup: chkconfig gluu-server-2.4.4.x off - Check the status of service in init: chkconfig --list | grep gluu-server-2.4.4.x

5. Install 3.1.1 rpm/deb, do not run setup script.

6. Backup OpenDJ,, salt from 2.4.4 SP2/SP3 and copy it into 3.1.1

cd /opt/gluu-server-2.4.4.x/opt
tar -czf opendj.tar.gz opendj
cp opendj.tar.gz /opt/gluu-server-3.1.1/opt/

cp /opt/gluu-server-2.4.4.x/opt/apache-tomcat-7.0.65/conf/ /opt/gluu-server-3.1.1/tmp
cp /opt/gluu-server-2.4.4.x/opt/apache-tomcat-7.0.65/conf/salt /opt/gluu-server-3.1.1/tmp
7. Log into CE 3.1.1 and run setup script
service gluu-server-3.1.1 start
service gluu-server-3.1.1 login
cd /install/community-edition-setup/
8. Verify if installed services are up

9. Stop OpenLDAP and all installed services

service oxauth stop
service identity stop
service solserver stop
10. Disable OpenLDAP
/usr/sbin/update-rc.d -f solserver disable

For CentOS6.x - Disable in startup: chkconfig solserver off - Check the status in init: chkconfig --list | grep solserver

11. Restore OpenDJ from 2.4.4 SP2/SP3

cd /opendj
rm -rf opendj
tar -xzf opendj.tar.gz
chown -R ldap:ldap opendj
12. Update OpenDJ java settings
/bin/su ldap -c "export OPENDJ_JAVA_HOME=/opt/jre; /opt/opendj/bin/dsjavaproperties"

For CentOS6.x: Perform below operations are user 'ldap'

  • Add jre location in '' ( location: /opt/opendj/config ):

  • Run command: export OPENDJ_JAVA_HOME=/opt/jre

  • Run command: /opt/opendj/bin/dsjavaproperties

13. Create OpenDJ init script

export OPENDJ_JAVA_HOME=/opt/jre; /opt/opendj/bin/create-rc-script --outputFile /etc/init.d/opendj --userName ldap
/usr/sbin/update-rc.d -f opendj enable

For CentOS6.x:

As root, run command: export OPENDJ_JAVA_HOME=/opt/jre; /opt/opendj/bin/create-rc-script --outputFile /etc/init.d/opendj --userName ldap

Add OpenDJ service in startup: chkconfig opendj on

Check the status of OpenDJ service: chkconfig --list | grep opendj

14. Update LDAP schema

cp -f /install/community-edition-setup/static/opendj/deprecated/101-ox.ldif /opt/opendj/config/schema/
15. In 3.1.1 user custom attributes objectClass is gluuCustomPerson. It's defined in /opt/opendj/config/schema/77-customAttributes.ldif

We need to add into it definition custom attributes from 2.4.4 SP2/SP3 /opt/opendj/config/schema/100-user.ldif. Old custom attributes objectClass is based on orgInum. Example: ox-6657268F7461C8CE000150DA8011-oid

16. Start OpenDJ

service opendj start

17. Verify startup messages in OpenDJ logs: /opt/opendj/logs/server.out and /opt/opendj/logs/errors

18. Restore and salt from CE 2.4.4 SP2/SP3

cd /etc/gluu/conf
mv salt salt.3.1.1
mv /tmp/ .
mv /tmp/salt .
chown -R root:gluu /etc/gluu/conf
19. Start CE servces
service oxauth start
service identity start

20. Verify if installed services are up

21. Update oxTrust JSON configuration - We need to update personObjectClassTypes, personObjectClassDisplayNames and personCustomObjectClass.

In 3.1.1 these properties have next default values:

personObjectClassTypes = gluuCustomPerson, gluuPerson, eduPerson
personObjectClassDisplayNames = gluuCustomPerson, gluuPerson, eduPerson
personCustomObjectClass = gluuCustomPerson
- We need to update ldifStore, velocityLog. In 3.1.1 these properties have next default values: ldifStore = /var/ox/identity/removed velocityLog = /opt/gluu/jetty/identity/logs/velocity.log

  • If you are using SAML, you have to modify couple of sections as well:
    • Add Shibv3 Root Directory location: "shibboleth3FederationRootDir":"/opt/shibboleth-federation", [ This configuration goes in between of "photoRepositoryCount... and ""velocityLog"... ]
    • Couple of other declarations: [ This configuration lies in between of "scimTestModeAccessToken..." and "clientWhiteList..." ] "shibbolethVersion":"v3", "shibboleth3IdpRootDir":"/opt/shibboleth-idp", "shibboleth3SpConfDir":"/opt/shibboleth-idp/sp", "organizationName":"Gluu Inc.", "idp3SigningCert":"/etc/certs/idp-signing.crt", "idp3EncryptionCert":"/etc/certs/idp-encryption.crt",

22. Update oxTrust CacheRefesh snapshotFolder. New snapshotFolder = /var/ox/identity/cr-snapshots


1. If in 2.4.4 SP2/SP3 environment SCIM was enabled we need to do the following: - Fill new properties: scimUmaClientId, scimUmaClientKeyId, scimUmaResourceId, scimUmaScope, scimUmaClientKeyStoreFile, scimUmaClientKeyStorePassword -- These properties have the same values as before, but in 3.1.1 we added prefix "scim" to all of them. - Copy /etc/certs/scim-rs.jks from 2.4.4 SP2/SP3 into 3.1.1