Upgrade

Upgrade Password Reset while preserving customer configuration, policies, logout behavior, and rollback options.

Upgrade

Use this procedure to upgrade an existing Password Reset installation. Choose a product package whose included UI and runtime versions have been verified together; do not copy files into lib or replace the UI independently on a production installation.

Before the upgrade

Record the installed product version, UI version, custom JVM profile, public URL, and directory/IdP integration.
Back up customer configuration, overlays, translations, certificates, and any application-managed data according to your deployment procedure. Protect the backup as credential material.
Review the release notes and breaking changes. Stop the service before replacing an installation. Keep the previous complete package available for rollback.
Use the shared Linux, Windows, or container installation procedure. Customer data must remain outside package-owned application files.

Review configuration and branding

A legacy flat rules configuration still works. If migrating to rule_policies, remove rules, wrap the rule list in a named policy, and mark exactly one policy default: true. Update the IdP/session password_policy mapping when more than one policy is used. Do not assume that changing a built-in default changes an existing customer policy.
Preserve the authenticated logout action. Set logout_endpoint_url to the app's final page, normally /pwdreset/logged_out/, when using the bundled branded logout page. This is separate from logout_url, which initiates authentication logout. Existing customer values are not rewritten automatically.
Recheck CSS and language overrides against the new form layout. Information now follows the form on mobile. Delegated names are shown above the field, and Change user is in the user menu and completion view. Logo overrides should not inherit an unintended fixed width.
Keep LDAPS and HTTPS certificate validation enabled. The product's container includes its own JVM; verify the selected image rather than assuming the host's Java version is used.

Verify and roll back

With synthetic own and delegated accounts, test sign-in, displayed policy, failed and successful resets, a new directory sign-in, target scope, logout/session termination, the final page, customer branding, and desktop/mobile keyboard operation. Review CEF and scoped diagnostics without collecting passwords or assertions.

If verification fails, stop the new instance and restore the previous complete package together with the backed-up compatible customer configuration. Do not mix JARs or frontend files from different product versions. Document the failure and retest before returning the service to users.