[#1103] Add upgrade step syncing missing ScriptingService sub-configurations

openam-core/src/main/resources/amUpgrade.properties

@@ -23,6 +23,7 @@
 #
 
 # Portions Copyrighted 2014-2016 Nomura Research Institute, Ltd
+# Portions Copyright 2026 3A Systems, LLC.
 
 report=OpenAM Upgrade Report%LF%=====================%LF%Created: %CREATED_DATE%%LF%%LF%Existing Version: %EXISTING_VERSION%%LF%New Version: %NEW_VERSION%%LF%%LF%
 upgrade.servicereport=Services Upgrade Report%LF%-----------------------%LF%%LF%New Services%LF%%LF%%NEW_SERVICES%%LF%%LF%Modified Services%LF%%LF%%MODIFIED_SERVICES%%LF%%LF%New Schemas%LF%%LF%%NEW_SCHEMAS%%LF%%LF%New Sub Schemas%LF%%LF%%NEW_SUB_SCHEMAS%%LF%%LF%Deleted Services%LF%%LF%%DELETED_SERVICES%%LF%%LF%
@@ -164,6 +165,11 @@ upgrade.scripting.global.settings=Scripting Global Settings modified ({0})
 upgrade.scripting.global.context=Settings for {0} moved to {1}
 upgrade.scripting.global.engine.start=Upgrading Global Engine Configuration for script context: {0}
 upgrade.scripting.global.script.start=Upgrading default script to global script: {0}
+# Scripting service sub-configurations upgrade
+upgrade.scripting.subconfigs.report=Scripting Service Configuration Report%LF%--------------------------------------%LF%%REPORT_DATA%%LF%
+upgrade.scripting.subconfigs=New Scripting Service configurations ({0})
+upgrade.scripting.subconfigs.new=New Scripting Service configuration: {0}
+upgrade.scripting.subconfigs.new.start=Adding Scripting Service configuration: {0}
 
 # Update Post Authentication Plugins upgrade
 upgrade.postauthenticationplugins.short=Post Authentication Plugin classes to upgrade

openam-server-only/src/main/webapp/WEB-INF/template/sms/serverupgrade.properties

@@ -21,6 +21,8 @@
 # your own identifying information:
 # "Portions Copyrighted [year] [name of copyright owner]"
 #
+# Portions Copyright 2026 3A Systems, LLC.
+#
 
 defaults.to.upgrade=com.iplanet.am.version,com.iplanet.am.console.deploymentDescriptor,com.iplanet.am.daemons,\
   com.iplanet.am.buildVersion,com.iplanet.am.buildRevision,com.iplanet.am.buildDate
@@ -36,13 +38,12 @@ upgrade.helper=iPlanetAMLoggingService=org.forgerock.openam.upgrade.helpers.Logg
   sunAMAuthOAuthService=org.forgerock.openam.upgrade.helpers.OAuth2AuthModuleUpgradeHelper,\
   iPlanetAMAuthScriptedService=org.forgerock.openam.upgrade.helpers.ScriptedAuthHelper,\
   iPlanetAMAuthDeviceIdMatchService=org.forgerock.openam.upgrade.helpers.ScriptedAuthHelper,\
+  ScriptingService=org.forgerock.openam.upgrade.helpers.ScriptingServiceHelper,\
   AuditService=org.forgerock.openam.upgrade.helpers.AuditUpgradeHelper,\
   iPlanetAMAuthOpenIdConnectService=org.forgerock.openam.upgrade.helpers.OpenIdConnectAuthModuleServiceHelper,\
   sunFAMSAML2Configuration=org.forgerock.openam.upgrade.helpers.SAML2ConfigHelper,\
   dashboardService=org.forgerock.openam.upgrade.helpers.DashboardServiceHelper,\
   MailServer=org.forgerock.openam.upgrade.helpers.MailServiceUpgradeHelper,\
   iPlanetAMAuthAuthenticatorOATHService=org.forgerock.openam.upgrade.helpers.AuthAuthenticatorOathHelper
 services.to.delete=iPlanetAMAuthSafeWordService,iPlanetAMAuthUnixService,sunFAMLibertyInteractionService,sunFAMLibertySecurityService
-  RestSecurity=org.forgerock.openam.upgrade.helpers.UserSelfServiceHelper
-services.to.delete=iPlanetAMAuthSafeWordService,iPlanetAMAuthUnixService,sunFAMLibertyInteractionService,sunFAMLibertySecurityService
 

openam-upgrade/src/main/java/org/forgerock/openam/upgrade/helpers/ScriptingServiceHelper.java

@@ -0,0 +1,84 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2026 3A Systems, LLC.
+ */
+package org.forgerock.openam.upgrade.helpers;
+
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+
+import org.forgerock.openam.upgrade.UpgradeException;
+import org.w3c.dom.Node;
+
+import com.sun.identity.shared.xml.XMLUtils;
+import com.sun.identity.sm.AbstractUpgradeHelper;
+import com.sun.identity.sm.AttributeSchemaImpl;
+
+/**
+ * This upgrade helper keeps the script context choice values declared by the Scripting Service schema — the
+ * global {@code defaultScriptContext} attribute and the {@code context} attribute of the realm-level
+ * {@code scriptConfiguration} sub-schema — in sync with the service definition, so that script contexts
+ * introduced in later versions become available on upgraded instances. The administrator's configured default
+ * is preserved as long as it is still a valid choice.
+ */
+public class ScriptingServiceHelper extends AbstractUpgradeHelper {
+
+    private static final String DEFAULT_SCRIPT_CONTEXT = "defaultScriptContext";
+    private static final String SCRIPT_CONTEXT = "context";
+    private static final String CHOICE_VALUES = "ChoiceValues";
+    private static final String CHOICE_VALUE = "ChoiceValue";
+
+    /**
+     * Default constructor
+     */
+    public ScriptingServiceHelper() {
+        attributes.add(DEFAULT_SCRIPT_CONTEXT);
+        attributes.add(SCRIPT_CONTEXT);
+    }
+
+    @Override
+    public AttributeSchemaImpl upgradeAttribute(AttributeSchemaImpl attributeToUpgrade,
+            AttributeSchemaImpl attributeFromNewSchema) throws UpgradeException {
+
+        Set<String> newChoiceValues = getRawChoiceValues(attributeFromNewSchema);
+        if (getRawChoiceValues(attributeToUpgrade).equals(newChoiceValues)) {
+            return null;
+        }
+        // For Global attributes the administrator's configured value is persisted as the schema default, so
+        // carry it over instead of reverting to the default bundled in the service definition — unless that
+        // value is no longer a valid choice.
+        Set<String> existingDefaults = attributeToUpgrade.getDefaultValues();
+        if (existingDefaults.isEmpty() || !newChoiceValues.containsAll(existingDefaults)) {
+            return attributeFromNewSchema;
+        }
+        return updateDefaultValues(attributeFromNewSchema, existingDefaults);
+    }
+
+    /**
+     * Read the choice values from the raw attribute schema node. {@link AttributeSchemaImpl} only parses
+     * {@code <ChoiceValues>} for choice-typed attributes, while the service definition also declares them on
+     * the {@code type="single"} attribute {@code scriptConfiguration.context}.
+     */
+    private static Set<String> getRawChoiceValues(AttributeSchemaImpl attribute) {
+        Set<String> values = new HashSet<>();
+        Node choiceValuesNode = XMLUtils.getChildNode(attribute.getAttributeSchemaNode(), CHOICE_VALUES);
+        if (choiceValuesNode != null) {
+            for (Iterator it = XMLUtils.getChildNodes(choiceValuesNode, CHOICE_VALUE).iterator(); it.hasNext();) {
+                values.add(XMLUtils.getValueOfValueNode((Node) it.next()));
+            }
+        }
+        return values;
+    }
+}

openam-upgrade/src/main/java/org/forgerock/openam/upgrade/steps/UpgradeServiceUtils.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 package org.forgerock.openam.upgrade.steps;
@@ -59,7 +60,7 @@ private UpgradeServiceUtils() {}
      * @return A map of service name to the service DOM models.
      * @throws UpgradeException When the service XML cannot be loaded.
      */
-    static Map<String, Document> getServiceDefinitions(SSOToken token) throws UpgradeException {
+    public static Map<String, Document> getServiceDefinitions(SSOToken token) throws UpgradeException {
         List<String> serviceNames = new ArrayList<>();
         serviceNames.addAll(UpgradeUtils.getPropertyValues(SetupConstants.PROPERTY_FILENAME,
                 SetupConstants.SERVICE_NAMES));