Complete Post-Upgrade Tasks

Oracle upgrades your Oracle Integration Generation 2 development instances first. Complete all post-upgrade tasks within three days of the upgrade date, so that you can report any issues. Oracle upgrades your production instances about two weeks after your development instances.

Completing post-upgrade tasks is critical to make sure users can access the new instance, data going to and from integrations can be sent through the firewall, and integrations work as expected.

If you experience any issues after the upgrade, enter a service request (SR) on My Oracle Support or troubleshoot the issues. See Troubleshoot Upgrade Issues.

Note

You'll see your stopped Oracle Integration Generation 2 instance in the Oracle Cloud Infrastructure Console for a period of time after the upgrade. Do not update, start, or delete this instance. Oracle removes it on your behalf when it is no longer needed.

Make sure the upgrade has completed before starting these tasks. See What to Do During Upgrade.

Summary of Post-Upgrade Tasks

Impact	When	Tasks to complete
Ensure access to the instance	Immediately after upgrade	Check the new Oracle Integration 3 instance Update the IAM policy with the new OCID Configure an IAM policy for Visual Builder Get the URL for the new instance and share it
Ensure connectivity	Immediately after upgrade	Complete network rules configuration Upload new identity certificates for connections Regain connectivity with agents that weren't upgraded File Server: add the File Server IP address to your internal firewall allowlist Complete this task within one week after upgrade. File Server: update integrations and SFTP clients to use the new IP and port values Complete this task within one week after upgrade.
Ensure integrations work	Immediately after upgrade	Change Oracle Integration built-in API calls from Basic Authentication to OAuth Check integrations if you selected Ignore activation failures or Ignore start schedule failures Take care of any requests that were rejected during the upgrade downtime
Complete Process Automation post-upgrade tasks	Immediately after upgrade	Complete Post-Upgrade Tasks for Process Automation
Complete post-upgrade verification	Within two weeks of upgrade	Follow Your Organization's Verification Procedures

Ensure Access to the Instance

Task	Who	When	Tasks to complete
Check the new Oracle Integration 3 instance	Administrator	Immediately after upgrade	Sign in to your Oracle Integration 3 instance using your existing credentials. Use your existing Oracle Integration Generation 2 bookmark (which redirects to the new URL) or use the new URL for the Oracle Integration 3 instance. See Access an Oracle Integration Instance. The upgrade completed if the interface looks like this: The upgrade is still in progress if: You sign in and a page indicates that the service is unavailable. You sign in and the user interface looks like this:
Update the IAM policy with the new OCID	IAM policy administrator	Immediately after upgrade	If your organization restricted access to the Oracle Integration Generation 2 instance based on the instance's Oracle Cloud ID (OCID), update the IAM policy to point to the new Oracle Integration 3 instance OCID. Caution: Users won't be able to sign in to Oracle Integration 3 until you update the OCID in the IAM policy. Sign in to Oracle Cloud Infrastructure Console. Get the new OCID value for the Oracle Integration 3 instance. See Viewing Instance Details. Update the OCID in your IAM policy. For instructions on updating the statements in an existing policy, see Using the Console in the Oracle Cloud Infrastructure documentation.
Configure an IAM policy for Visual Builder	Administrator	Immediately after upgrade	If you used Visual Builder in Oracle Integration Generation 2, you need to configure an IAM policy for Visual Builder in Oracle Integration 3. See Set the IAM Policy for Managing the Visual Builder Instance.
Get the URL for the new instance and share it	Administrator	Immediately after upgrade	Get the URL for the new Oracle Integration 3 instance and share it with everyone who needs it. Existing bookmarks also redirect to the new URL, but you want to make sure everyone has the new URL. This is in the following format: `https://design.integration.region.ocp.oraclecloud.com/?integrationInstance=query_parameter_repersenting_instance` To get the new URL: Sign in to the Oracle Cloud Infrastructure Console. Open the navigation menu and click Developer Services. Under Application Integration, click Integration. Click the name of the new Oracle Integration 3 instance. To the right of the Service console URL field, click Copy. Share the URL with anyone who needs it.

Ensure Connectivity

Task	Who	When	Tasks to complete
Complete network rules configuration	Network administrator	Prior to upgrade or immediately after upgrade	If any of your integration connections target an Oracle Cloud Infrastructure service that supports network rules, such as Oracle Cloud Infrastructure Object Storage or Oracle Autonomous Database, and you've enabled those rules, you must complete any network rules configuration, including adding the Oracle Integration Service VCN to the rule. Sign in to Oracle Cloud Infrastructure Console. Get the OCID value for the Oracle Integration 3 instance. See Viewing Instance Details. Follow the rules for your target service. For example, for Oracle Autonomous Database Serverless, see Configure Access Control Lists When You Provision or Clone an Instance in Using Oracle Autonomous Database Serverless. If the Oracle Cloud Infrastructure service you're accessing is in a different region than your Oracle Integration instance, allowlist the OIC Outbound IP address you collected when you updated your other allowlists prior to upgrade.
Upload new identity certificates for connections	Developer with connections that use identity certificates Only one person from your organization needs to perform these steps	Immediately after upgrade	Identity certificates establish client identity during two-way SSL communication. Connections that are based on the AS2 Adapter and the REST Adapter can use identity certificates. If your instance includes connections that use identity certificates, perform the following steps: Upload a new identity certificate. See Upload an SSL Certificate in Using Integrations in Oracle Integration 3. Test the connections that use the identity certificate so that their status changes from Draft to Configured. See Test the Connection in Using Integrations in Oracle Integration 3. Activate any integrations that use the connections. See Activate an Integration in Using Integrations in Oracle Integration 3.
Regain connectivity with agents that weren't upgraded	Developer with agents that weren't upgraded	Immediately after upgrade	Agents that were offline during upgrade or didn't meet upgrade requirements weren't upgraded. After upgrade, if you see a message stating that some agents didn't meet upgrade eligibility and weren't upgraded, perform the following steps. Prerequisites Ensure connectivity from your connectivity agents to Oracle Identity Cloud Service (IDCS) and Oracle Integration 3: You should have added the IDCS and Oracle Integration 3 IP addresses and URLs to your allowlists prior to upgrade, as described in Update Allowlists. Add the Oracle Integration 3 design-time IP address to your allowlists. Use the following command to get the design-time IP address, replacing `region` with the region from your Oracle Integration 3 URL: `nslookup design.integration.region.ocp.oraclecloud.com` To manually upgrade your agents and regain connectivity with them: Stop the connectivity agent. Make sure that the agent prerequisites are complete: Ensure that the connectivity agent is using JDK 17. If it isn't, set the `JAVA_HOME` and `PATH` environment variables to `JDK17`. Ensure that the agent is using the PKCS12 KeyStore. If it isn't, convert it using the following steps. On the server that hosts the connectivity agent, create a backup of the `keystore.jks` file, which is located in the following folder: `Agent_Install_Location/agenthome/agent/cert` Move the backup file to a different folder. Convert the JKS KeyStore to the PKCS12 KeyStore by running the following command from the command line: `keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.p12 -srcstoretype JKS -deststoretype PKCS12 -deststorepass changeit -srcstorepass changeit` Delete the `keystore.jks` file in the following location: `Agent_Install_Location/agenthome/agent/cert` Download the agent installer ZIP file from Oracle Integration 3. In the navigation pane, click Design, then Agents. Click Download, then Connectivity agent. Extract `oic_conn_agent_installer.zip` to a new directory on your connectivity agent server. Delete your existing connectivity agent `lib` folder under `Agent_Install_Location/agenthome/` and replace it with the `lib` folder from the ZIP file. Delete your existing `version` file under `Agent_Install_Location/agenthome/` and replace it with the `version` file from ZIP file. Delete your existing `connectivityagent.jar` file under `Agent_Install_Location` and replace it with the `connectivityagent.jar` file from ZIP file. Delete your existing `cpi_upgradeutility.jar` file under `Agent_Install_Location` and replace it with the `cpi_upgradeutility.jar` file from ZIP file. In Oracle Integration 3, on the Agents page, hover over the agent group, click Actions , then select Download config. This step downloads a preconfigured `InstallerProfile.cfg` file for the agent group. Delete your existing `InstallerProfile.cfg` file under `Agent_Install_Location` and replace it with the `InstallerProfile.cfg` file you downloaded in the previous step. Restart the connectivity agent by running the following command: `java -jar connectivityagent.jar` Reactivate the integrations that are in the upgraded agent group.
File Server: add the File Server IP address to your internal firewall allowlist	File Server administrator and developer	Within one week of upgrade	If your organization restricts the sites that internal resources can access, add the new File Server IP address to your internal firewall allowlist. The Oracle Integration Generation 2 IP address continues working for four months after the upgrade, and then Oracle retires them. However, Oracle recommends updating your firewall allowlist to use the new IP address now. That way, you don't risk forgetting to update the allowlist in the future. To get the File Server IP address: Sign in to Oracle Integration 3. In the navigation pane, click Settings, then File Server, then Settings. Under General, obtain the IP address for the File Server SFTP server.
File Server: update integrations and SFTP clients to use the new IP and port values	File Server administrator and developer	Within one week of upgrade	If you use File Server, update your integrations and SFTP clients so that they use the new IP and port values. The Oracle Integration Generation 2 IP and port values continue working for four months after the upgrade, and then Oracle retires them. However, Oracle recommends updating your integrations and SFTP clients to use the new values now. That way, you don't risk forgetting to update these values in the future. Sign in to Oracle Integration 3. In the navigation pane, click Settings, then File Server, then Settings. Under General, obtain the IP and port values for the File Server SFTP server. Update all integrations that call File Server so that they use the new IP and port values. Update all SFTP clients so that they use the new IP and port values.

Ensure Integrations Work

Task	Who	When	Details
Change Oracle Integration built-in API calls from Basic Authentication to OAuth	Developer	Prior to upgrade or immediately after upgrade	If you didn't already update your API calls to use OAuth while completing prerequisites or pre-upgrade tasks, do so immediately after upgrade. In Oracle Integration Generation 2, you could use Basic Authentication to use the Oracle Integration REST API and File Server REST API. In Oracle Integration 3, you must use OAuth. You need to update any clients, scripts, integrations, and commands that use the Oracle Integration REST API or the File Server REST API to connect using OAuth. For more information on authentication method support, see When is Basic Auth Supported in Oracle Integration 3. For details on using OAuth with the Oracle Integration REST API, see Security, Authentication, and Authorization, or with the File Server REST API, see Security, Authentication, and Authorization.
Check integrations if you selected Ignore activation failures or Ignore start schedule failures	Administrator	Immediately after upgrade	If you configured your upgrade settings to proceed with the upgrade even if Oracle couldn't activate an integration or restart a schedule, take the appropriate steps: If you selected Ignore activation failures, check the status of all your integrations, and activate integrations as needed. If you selected Ignore start schedule failures, check the schedules of your integrations, and manually start them if needed.
Take care of any requests that were rejected during the upgrade downtime	Designated team members	Immediately after upgrade	Oracle Integration rejected all requests that were sent during the upgrade downtime. If needed, take action on requests that any clients sent to Oracle Integration during the downtime.