Upgrade Identity Server

Prepare the Kubernetes specification files

Update the specification files to use Sitecore Identity Server 9.0.X.

Starting with Identity Server 8.0, the name of container image has been changed from sitecore-idX to sitecore-identity. Its tag is now aligned with the version of the Sitecore Identity Server itself, for example: sxp/sitecore-identity:8.0-ltsc2022

Encrypted Communication with SQL Server

Starting from version 8.0, Sitecore Identity Server requires encrypted communication with SQL Server by default. This change is due to the adoption of a newer version of Microsoft.Data.SqlClient that enforces stricter security measures, as described in Microsoft’s Breaking changes in EF Core 7.0 article.

Follow these steps to configure and implement an encryption certificate:

1. Obtain certificates for the encryption. Prepare three certificate files:

   • tls.crt - contains the public certificate that will be used by SQL Server for encryption.
   • tls.key - contains the private key that will be used by SQL Server for encryption.
   • root.crt - public certificate of the certification authority (CA) that issued the encryption certificates.

   These must meet specific requirements to be used with SQL Server. For more information, refer to the Certificate requirements for SQL Server article.

2. Configure an encryption certificate for the SQL Server deployment. For more information on how this can be achieved for the default SQL Server image, refer to Microsoft’s  Secure SQL Server Linux containers article.

3. Ensure the certificate is trusted in the Identity Server deployment. Mount the CA certificate that was used to issue the encryption certificate as a C:\certs\RootCA.crt file into the Identity Server container.

   For example, if the root.crt file is created as a secret with name global-authority, then the configuration should be updated in the k8s/<version>/<topology>/id.yaml file:

   ...  
       volumeMounts:  
       ...  
       - mountPath: C:\certs\RootCA.crt  
         name: global-authority  
         subPath: root.crt 
     ... 
     volumes:
     ...
     - name: global-authority  
       secret: 
         secretName: global-authority

4. [Optional] Enforce Sitecore Identity Server to use an encrypted connection to SQL Server. In the k8s/<version>/<topology>/id.yaml file, update the value of the Sitecore_Sitecore__IdentityServer__SitecoreMemberShipOptions__ConnectionString environment variable by appending the parameters: 

   ...;Encrypt=true;TrustServerCertificate=false;

Alternatively, it is possible to use default self-signed encryption certificates which SQL Server generates at startup if custom certificates are not provided. This may simplify the installation process for non-production deployments, but this approach is not recommended for production environments.

To accommodate this configuration in Sitecore Identity Server, it is sufficient to apply one of the following configuration changes to Kubernetes configuration:

1. To disable encryption: Update the value of the Sitecore_Sitecore__IdentityServer__SitecoreMemberShipOptions__ConnectionString environment variable by appending the parameter:

   ...;Encrypt=false;

2. Enable encryption but disable certificate trust validation. Update the value of the Sitecore_Sitecore__IdentityServer__SitecoreMemberShipOptions__ConnectionString environment variable by appending the parameter:     

   ...;Encrypt=true;TrustServerCertificate=true;

For Sitecore XP 10.0 only, if the non-production SQL Server image is used during deployment, the only available option is to use the default self-signed encryption certificates generated by SQL Server.

Run upgrade script on security database

To run the upgrade script on security database:

1. Unpack the Sitecore.IdentityServer.UpgradeScripts.9.0.zip file. The package contains a database upgrade script CMS_security_IdentityServer.sql. The script applies changes to the Core database that are required for Sitecore Identity Server 9.0.

2. Execute the upgrade scripts against the Core database used in the deployment. For example, it can be done in the following way:

   
   kubectl cp ./CMS_security_IdentityServer.sql <mssql pod>:/var/opt/mssql/
   kubectl exec -it <mssql pod> -- /opt/mssql-tools/bin/sqlcmd -S localhost -U <database username> -P "<database password>" -d <security database> -i /var/opt/mssql/CMS_security_IdentityServer.sql
   

For Sitecore XP 10.0, you should execute the upgrade scripts using a slightly different format, as follows:

kubectl cp ./CMS_security_IdentityServer.sql <mssql pod>:/CMS_security_IdentityServer.sql
kubectl exec -it <mssql pod> -- sqlcmd -S localhost -U <database username> -P '<database password>' -d <security database> -i C:\CMS_security_IdentityServer.sql

You should now be able to log in to the CM server and log out without any errors displayed.