AutoUpgrade Patching – From Zero to Hero – Part 2: MOS Credentials

In this blog post series AutoUpgrade Patching – From Zero to Hero – Part 2: MOS Credentials will be our topic for today. If you are tired of going through MOS notes over and over again to identify the most important fixes and fetch them, you need to automate it. But in order to automate the download, you need to infuse your MOS credentials into the AutoUpgrade keystore. Let’s do this together now.

Create directories

Before we really start, you should define a few directories at first. In my case, I copied the newest version of AutoUpgrade into /Users/mdietric/TEMP/AU. You need to adjust the directory based on your structure, needs and operating system.

I create the following structure:

/Users/mdietric/TEMP/AU
├── keystore
├── logs
└── patches

I used:

cd TEMP

mkdir AU AU/patches AU/keystore AU/logs

and I copied autoupgrade.jar into /Users/mdietric/TEMP/AU subdirectory.

Our first config file

In order to continue you need to create your first AutoUpgrade config file. I will cover all the various options later but for now we are going to keep it simple. Use any text editor which doesn’t add ^M characters like some of the MS Windows tools do. Or, you simply copy/paste this one below and adjust the paths to your setup.

# get_patches.cfg
#

global.global_log_dir=/Users/mdietric/TEMP/AU/logs
global.keystore=/Users/mdietric/TEMP/AU/keystore
global.folder=/Users/mdietric/TEMP/AU/patches

patch1.target_version=19
patch1.patch=AU

I store this file in the same directory where I stored AutoUpgrade, and I name it get_patches.cfg.

You find the parameters above:

• global_log_dir
  This points to the log directory. While you could leave this at a default, I rather prefer having it point to one of my directories I created beforehand.
• keystore
  You need this parameter to point to a subdirectory where AutoUpgrade will create the wallet/keystore into.
• folder
  Here, you define the directory where AutoUpgrade will download all patches into. It can hold multiple versions of patches for multiple OS versions.

All three parameters use a prefix “global” which means they will apply to all subsequent groups of parameters. Individual parameters identify themselves with a prefix you can choose freely. Mine here is “patch1“, and we will add different prefixes later.

• target_version
  We need to define a version of the patches we are planning to download. This is mandatory, even though AutoUpgrade does not have any relationship with the release. You always use the newest AutoUpgrade for everything on every platform. Still, this parameter is required.
• patch
  In the most important parameter you decide which patches you are going to download. We will add more options later in the following blog posts. But for now, let’s keep the example from my previous “Part 1” blog post and download AutoUpgrade only.

AutoUpgrade needs your MOS credentials

If you are going to use AutoUpgrade to automate your patching it will need your MOS credentials to be able to download patches unattended. In case you wonder whether you will need any sort of Two/Multi-Factor Authentication, the answer is “No”. We are going to use the same token mechanism Enterprise Manager is using for the patch downloads when we fetch patches from MOS.

Therefore, let us start and add your MOS credentials into the AutoUpgrade SEPS (Secure External Password Store).

Call AutoUpgrade to load your MOS credentials:

java -jar autoupgrade.jar -load_password -patch -config get_patches.cfg

Then, at first, you’ll be asked to specify a password to protect the keystore/wallet. This isn’t your MOS password, and it needs to have at least 8 characters, an uppercase character and a number if I remember correctly.

Processing config file ...

Starting AutoUpgrade Patching Password Loader - Type help for available options
Creating new AutoUpgrade Patching keystore - Password required
Enter password:   
Enter password again:   
AutoUpgrade Patching keystore was successfully created

Now the keystore is built and ready to take your MOS credentials. Those of you who know AutoUpgrade will also recognize that the prompt has been changed from the usual UPG> to MOS>.

MOS> add -user Mike.Dietrich@oracle.com
Enter your secret/Password: 
Re-enter your secret/Password:

If you want to check whether your credentials have been received, and whether they work, use the following command:

MOS> list
My Oracle Support (MOS) - Credentials Loaded - Connection Successful

Oracle Update Advisor service - Connection Successful

This checks the connectivity to MOS and to the OUA (Oracle Update Advisor) where AutoUpgrade will download Gold Images from.

Finally, use the exit command to save the credentials and alter the keystore to be auto-login.

MOS> exit

Save the AutoUpgrade Patching keystore before exiting [YES|NO] ? YES
Select auto-login mode for the AutoUpgrade Patching keystore [YES|NO|SHARED]: YES

AutoUpgrade Patching Password Loader finished - Exiting AutoUpgrade Patching

Especially the auto-login mode is very important.

Summary

In this blog post we created a few directories, we built our first simple config file and we infused our MOS credentials into the Secure External Password Store in AutoUpgrade.

Once you did all the above, you are ready now to download patches with just one click, and especially without checking for patch numbers and MOS notes beforehand.

The following files have been created:

.
├── autoupgrade.jar
├── get_patches.cfg
├── keystore
│   ├── apikey
│   ├── cwallet.sso
│   ├── cwallet.sso.lck
│   ├── ewallet.p12
│   └── ewallet.p12.lck
├── logs
│   └── cfgtoollogs
└── patches

Under the keystore directory you will find the wallets.

For Oracle Employees

Since some of you mailed or slacked me, you easily can use the same – and no passwordless or MFA needed. But you need your SSO password which you still have. If you can’t remember, you may need to ping your manager to create a bypass code to refresh your SSO password since OIM requires the “current” password to be used in order to change it.

But if you remember it, it is very simple:

• User is your SSO user, e.g. Hugo.Mayer@oracle.com
• Password is your SSO password, e.g. SecretIsMyPasswordYouKnow9876=?

That’s it.

Further Links and Information

AutoUpgrade Patching Blog Post Series

• Part 1: AutoUpgrade Patching – Download and Version Check
• Part 2: AutoUpgrade Patching – MOS Credentials
• Part 3: AutoUpgrade Patching – Download Patches
• Part 4: AutoUpgrade Patching – Download Examples

Additional Links

• AutoUpgrade Download from oracle.com
• Static link to fetch AutoUpgrade
• MOS Note: KB123450 AutoUpgrade

Virtual Classroom Seminars

• Episode 21: One-Button Patching with AutoUpgrade – Easing every DBA’s life
• Episode 27: Patch Smarter, not Harder – Oracle Database Patching with AutoUpgrade
• Episode 28: Patch Smarter, not Harder – Microsoft Windows Special Patching Edition

To be continued …

–Mike