Post-upgrade tasks for IBM Business Process Manager V8.5.7 Cumulative Fix (CF) 2017.06 and CF2017.03

To autocorrect illegal XML characters during debugging, set the following parameter in your 100Custom.xml files for IBM Process Center and IBM Process Server in your deployment environment 

<server>
     <autocorrect-xml merge="replace">true</autocorrect-xml>
</server>

by following this procedure:

1. Stop the servers of your IBM BPM deployment environment.

2. Start the scripting client in disconnected mode as described in updateBPMConfig command.

3. Run the following commands:

wsadmin> AdminTask.updateBPMConfig( [ '-create', '/server' ] )

wsadmin> AdminTask.updateBPMConfig( [ '-create', '/server/autocorrect-xml', '-xNodeValue', 'true' ] )

wsadmin> AdminConfig.save()

4. Restart the servers of your IBM BPM environment.

You experience issues with performance of the web service server definition search algorithm

The fix changes the search algorithm from depth-first to breadth-first. To revert to a depth-first search, set the following parameter in your 100Custom.xml files for IBM Process Center and IBM Process Server in your deployment environment

<common>
     <webservices>
          <use-breadth-first-search-wsserver merge="replace">false</use-breadth-first-search-wsserver>
     </webservices>
</common>

by following this procedure:

1. Stop the servers of your IBM BPM deployment environment.

2. Start the scripting client in disconnected mode as described in updateBPMConfig command.

3. Run the following commands:

wsadmin> AdminTask.updateBPMConfig( [ '-create', '/common' ] )

wsadmin> AdminTask.updateBPMConfig( [ '-create', '/common/webservices' ] )

wsadmin> AdminTask.updateBPMConfig( [ '-create', '/common/webservices/use-breadth-first-search-wsserver', '-xNodeValue', 'false' ] )

wsadmin> AdminConfig.save()

4. Restart the servers of your IBM BPM environment.

Update the Hiring Sample:

1. Log in to Process Center with the IBM BPM administrative user ID.

2. Open the Hiring Sample (HSS) process app in the Designer.

3. On the Process App Settings page, find the Coach Designer Settings heading. Temporarily load another theme before you select the BPM Theme. When you switch to the BPM Theme, it compiles correctly.

a. Click Select and choose a theme, such as the SPARK UI Theme.

b. Click Select again and choose the BPM Theme.

Update permissions for the Discover BPM UI Sample:

1. Log in to Process Center with the IBM BPM administrative user ID.

2. Click the Discover BPM UI Sample (DBPMUIS) process app to view its snapshots.

3. Click the Manage item in the toolbar and click the Add Groups button.

4. In the Search for Names field, type tw_ and select tw_admins and tw_authors.

5. Click Add Selected.

6. In the Admin column, give both groups administrative authority for this process app.

JR56768
When you migrate instances, deleted groups and members are reinstated in the teams they were deleted from

To disable the synchronizing the data from the source snapshot, add the following to all the 100Custom.xml files for IBM Process Center and IBM Process Server in your deployment environment

<server>
     <instance-migration>
          <disable-team-sync merge="replace">true</disable-team-sync>
     </instance-migration>
</server>

by following this procedure:

1. Stop the servers of your IBM BPM deployment environment.

2. Start the scripting client in disconnected mode as described in updateBPMConfig command.

3. Run the following commands:

wsadmin> AdminTask.updateBPMConfig( [ '-create', '/server' ] )

wsadmin> AdminTask.updateBPMConfig( [ '-create', '/server/instance-migration' ] )

wsadmin> AdminTask.updateBPMConfig( [ '-create', '/server/instance-migration/disable-team-sync', '-xNodeValue', 'true' ] )

wsadmin> AdminConfig.save()

4. Restart the servers of your IBM BPM environment.

If you have programmatic clients that use non-secure HTTP to connect to IBM BPM and these clients cannot be modified immediately to use secure HTTPS or you plan to federate an IBM BPM V8.5.7.0 2017.03 server with IBM Process Federation Server by using the insecure quick start path, follow the appropriate procedure to re enable HTTP access: 

You have programmatic clients that use non-secure HTTP to connect to IBM BPM and these clients cannot be modified immediately to use secure HTTPS

In this case, you can re-enable HTTP access in IBM BPM temporarily by following these steps (assuming the name of your deployment environment is De1).

Note: If you follow these steps, you will revert to the state of IBM BPM 8.5.7 CF2016.12 and earlier versions of IBM BPM 8.5.

1. Shut down all the servers.

2. Go to the <install_root>/bin directory and run "wsadmin -conntype none -lang jython -profileName <dmgrProfile>". For IBM BPM Express, use the stand-alone server's profile.

3. Enter the following commands on the wsadmin prompt (where 'De1' is the name of your IBM BPM deployment environment):

wsadmin> print AdminTask.configureBPMTransportSecurity( [ '-de', 'De1', '-apps', '201612', '-transportSecurity', 'allowhttp'] )

wsadmin> print AdminTask.configureBPMTransportSecurity( [ '-de', 'De1', '-apps', 'productREST', '-transportSecurity', 'allowhttp'] )

wsadmin> AdminTask.configureSingleSignon('-requiresSSL false')

wsadmin> for server in AdminUtilities.convertToList(AdminTask.listServers('-serverType APPLICATION_SERVER')):

wsadmin>     for cookie in AdminUtilities.convertToList(AdminConfig.list('Cookie', server)):

Note: This line must be indented one space.

wsadmin>         AdminConfig.modify(cookie, [['secure','false']])

Note: This line must be indented two spaces.

wsadmin>

Note: This line is a required empty time to end the loop. Just press Enter.

wsadmin> AdminConfig.save()

wsadmin> exit

4. Restart all the servers.

After you updated your programmatic clients to use secure HTTPS to connect to IBM BPM, revert the temporary HTTP enablement by following these steps (assuming the name of your deployment environment is De1):

1. Shut down all the servers.

2. Go to the <install_root>/bin directory and run "wsadmin -conntype none -lang jython -profileName <dmgrProfile>". For IBM BPM Express, use the stand-alone server's profile.

3. Enter the following commands on the wsadmin prompt (where 'De1' is the name of your BPM deployment environment):

wsadmin> print AdminTask.configureBPMTransportSecurity( [ '-de', 'De1', '-apps', '201612', '-transportSecurity', 'httpsonly'] )

wsadmin> print AdminTask.configureBPMTransportSecurity( [ '-de', 'De1', '-apps', 'productREST', '-transportSecurity', 'httpsonly'] )

wsadmin> AdminTask.configureSingleSignon('-requiresSSL true')

wsadmin> for server in AdminUtilities.convertToList(AdminTask.listServers('-serverType APPLICATION_SERVER')):

wsadmin>     for cookie in AdminUtilities.convertToList(AdminConfig.list('Cookie', server)):

Note: This line must be indented one space.

wsadmin>         AdminConfig.modify(cookie, [['secure','true']])

Note: This line must be indented two spaces.

wsadmin>

Note: This line is a required empty time to end the loop. Just press Enter.

wsadmin> AdminConfig.save()

wsadmin> exit

4. Restart all the servers

You plan to federate an IBM BPM V8.5.7.0 2017.03 server with Process Federation Server by using the insecure quick start path

Re-enable HTTP access by switching Process Federation Server to secure production mode (see Roadmap for configuring Process Federation Server and federated environments). If this is not possible, you must re-enable insecure HTTP access to the REST APIs of the IBM BPM 8.5.7.0 2017.03 CF server by following these steps:

1. Shut down all the servers.

2. Go to the <install_root>/bin directory, run "wsadmin -conntype none -lang jython -profileName <dmgrProfile>". For IBM BPM Express, use the stand-alone server's profile.

3. Enter the following commands on the wsadmin prompt (where 'De1' is the name of your BPM deployment environment):

wsadmin> print AdminTask.configureBPMTransportSecurity( [ '-de', 'De1', '-apps', 'productREST', '-transportSecurity', 'allowhttp'] )

wsadmin> AdminConfig.save()

wsadmin> exit

4. Restart all the servers.

Remote host closed
connection during handshake when opening an SSL connection to certain services like the Blockchain/Hyperledger Bluemix service, even though the required signer certificates have been imported.

When you create an IBM BPM deployment environment after upgrading to CF2017.03, com.ibm.websphere.ssl.include.ECCiphers is set to true. When you upgrade an existing IBM BPM deployment environment, com.ibm.websphere.ssl.include.ECCiphers is set to false if it did not exist before the upgrade.

Important: Although this global security setting is optional, it is highly recommended that you change the setting from false to true manually to enable elliptic curve ciphers by default and enable more secure SSL connections. For more information, see com.ibm.websphere.ssl.include.ECCiphers.