Release Notes: AEM 6.2 Oak Cumulative Fix Pack

Oak Cumulative Fix Packs

Fixes for the Oak repository are delivered via Oak Cumulative Fix Packs (OCFP) which are fully supported, similarly to standard Cumulative Fix Packs. An Oak Cumulative Fix Pack is self-dependant (no dependencies). You need not worry about finding/resolving dependencies.

Install the latest cumulative fix pack for your AEM version to keep your deployment up-to-date.

If necessary, a diagnostic build on top of the latest OCFP can be made available for validation purpose before the official availability of the next OCFP. The precondition is that you have the latest OCFP running. A diagnostic build only provide the same level quality assurance as a hot fix, therefore it doesn't provide as much  quality assurance as a cumulative fix pack, service pack, or product release. All official Oak fixes are released as OCFP which comes with the full support.

For more information on CFP and other types of releases, see Maintenance Release Vehicle.

Installation instructions

Pre-deployment Procedure for Oak 1.4.8 and higher versions

The Oak Cumulative Fix Pack 1.4.8 (and beyond) contains index definitions. Before deploying the Oak 1.4.8+ CFP, it is recommended  to follow the below pre-deployment procedure for preparing the corresponding index during a maintenance window, as indexing can be resource-intensive. This is a one-off procedure (no need to apply it again if you've already done it when applying a previous Oak CFP having a version >= 1.4.8).

Important: for building indices, Oak setting - limit should be set to a higher value, for example, 200000. This also requires enough heap. 

1. Install the index definition package NPR-14064, which contains index definitions with async re-index (it should not build new index right away).
2. For Mongo: stop all AEM instances except for 1.
3. Visit this url:
   
4. /system/console/jmx/org.apache.jackrabbit.oak%3Aname%3Dasync%2Ctype%3DPropertyIndexAsyncReindex
   
5. Invoke startPropertyIndexAsyncReindex() to start indexing.
6. Monitor the log files for this log message:
   22.02.2017 11:34:32.602 *INFO* [aysnc-index-update-async-reindex] org.apache.jackrabbit.oak.plugins.index.AsyncIndexUpdate [async-reindex] Reindexing completed for indexes: [/oak:index/externalId*(0), /oak:index/externalPrincipalNames*(0), /oak:index/repMembers*(51)] in 1.085 s
   
7. Verify that indices have been built successfully by checking following properties updated
   • reindexCount=1
   • async="async-reindex" would be deleted (with this the index would  switch back to synchronous indexing)
8. This should be checked for these 3 indices (can also check that following query has no results: //element(*, oak:QueryIndexDefinition)[@async = "async-reindex"]
   • /oak:index/repMembers
   • /oak:index/externalPrincipalNames
   • /oak:index/externalId
9. Note: index build can be stopped.  Go to this url:
   /system/console/jmx/org.apache.jackrabbit.oak%3Aname%3Dasync%2Ctype%3DIndexStats

During the process of async reindexing, a repository checkpoint is created. Once the indexing task has completed, it must be released as described below, to ensure smooth Revision Garbage Collection later on:

1. First, open the CheckpointManager MBean:
   MongoMK -
   /system/console/jmx/org.apache.jackrabbit.oak%3Aname%3DDocument+node+store+
   checkpoint+management%2Ctype%3DCheckpointManger
   
2. TarMK -
   /system/console/jmx/org.apache.jackrabbit.oak%3Aname%3DSegment+node+store+
   checkpoint+management%2Ctype%3DCheckpointManger
3. Invoke the listCheckpoints() operation,
4. Find the checkpoint row with the "name=async-reindex" property,
5. Copy its id value to the clipboard
   On MongoMK it will look similar to this: r1234567aaaa-0-1
   On TarMK it will look similar to this: 6eac07d0-fe27-4d16-82f8-6d5da4cefd67
6. Then open the releaseCheckpoint() operation,
7. Paste the copied id as p1 and click "Invoke",
8. This step will release the checkpoint.
   

Oak Cumulative Fix Pack installation

0. Make sure that you have a backup of the data 1. Go to 'Tools' and doubleclick on 'Packages' to open the CQ Package Manager 2. Upload and Install the hotfix package 3. Restart AEM   In case this patch needs to be deployed in context of an upgrade to AEM 6.2 use the following steps:
0. Make sure that you have a backup of the data 1. Prepare the source instance as documented and shut down 2. Unpack the AEM 6.2 Quickstart (java-jar quickstart.jar -unpack) 3. Unpack the Hotfix Package to a temporary location 4. Move /jcr_root/libs/system/install/* to /crx-quickstart/install 5. Move /jcr_root/libs/system/install/crx3/* to /crx-quickstart/install/15 6. Move on with the upgrade as documented  

Available Oak Cumulative Fix Packs

Oak 1.4.24

Oak 1.4.23

Oak 1.4.22

Oak 1.4.21

Oak 1.4.20

Oak 1.4.19

Oak 1.4.18

Oak 1.4.17

Oak 1.4.16

Oak 1.4.15

Oak 1.4.14

Oak 1.4.13

Oak 1.4.12

Oak 1.4.11

Oak 1.4.10

Oak 1.4.9

Oak 1.4.8

Oak 1.4.7

Important Note

Oak 1.4.7 introduces a change in synchronization behavior of external group memberships (for example, from LDAP):

Mapping an external group to an existing local group is no longer possible. The local group needs to be created by the IDP sync process and also cannot be shared with other external IDPs anymore.

This is required to ensure boundaries between locally established group memberships and external ones, as well as to ensure boundariesbetween multiple IDPs.

The tie to an IDP is done via the now fully protected "rep: externalId" property on groups and users. For details and migration solutions see: https://issues.apache.org/jira/browse/OAK-4397

Oak 1.4.6

Known issues

• For versions prior to Oak 1.4.5, due to a known issue (OAK-4538, addressed in Oak 1.4.5), it may happen that AEM cannot be gracefully stopped and in this case the termination of the jvm process needs to be forced.
• If you are using Oak LDAP integration, then after applying the latest Oak hotfix, LDAP user sync will not longer work.  To fix this, go to /system/console/configMgr and update your "LDAP Identity Provider" configuration's "Custom Attributes" property.  Update the property with all LDAP attributes used in the Sync configuration.  For example, these properties might be: cn, sn, givenName, mail

Helpful resources

• AEM 6.2 release notes
• AEM product page
• AEM 6.2 documentation
• Subscribe to Adobe Priority Product Updates