Updates on requirement to identify Oracle Java installations before 11/30 deadline

Departments, colleges, and other U organizations are required identify any tool or system that uses Oracle Java no later than November 30, 2020, and system administrators must migrate to alternative no-cost/low-cost Java products for in-house and vendor-provided software as soon as possible prior to May 22, 2021.

The U’s Oracle Java Community of Practice (CoP) has established a subchannel in Microsoft Teams with resources to help system administrators meet the November deadline.

CoP member Everett Pilling, senior web software developer in the School of Medicine, has developed Windows scripts, available in Teams, to run independently or within existing tools to help identify Java installations. Richard Glaser, IT manager at Marriott Library, has published a set of Mac scripts.

“The scripts are designed to help in these discovery efforts,” said Sylvia Jessen, IT director at the School of Medicine and CoP chair.

In March 2019, UIT notified the U community of the change to Oracle's historically-free Java support, maintenance, and licensing model. In May 2019, the university purchased a one-time, 12-month subscription license as a stopgap measure. The extension covered Oracle Java products used by main campus, Health Sciences, and University of Utah Health organizations through May 2020, at which point it was renewed for a second year. Due to the significant expense, the license will not be renewed again.

Departments that use unsupported versions of Oracle Java that are critical to their systems must submit an online request (authentication required) with the U’s Information Security Office to evaluate potential security risks and, if needed, put mitigation measures in place.

Jessen said it’s up to each group to report, discover, and mitigate its own installations. This UIT Knowledge Base article, in addition to information provided in the Teams subchannel, include alternative Java solutions. Please note, these lists are not all-inclusive. System administrators are encouraged to reach out to or participate in the CoP if they have questions.

Organizations may also contact Oracle for information about obtaining their own Java licensing.

In the meantime, system administrators should report their migration plans, licensing efforts, and status to Jill Brinton, associate director for UIT’s Project Management Office. They also should join the U’s enterprise license, which grants them access to the U’s Oracle Java support portal where they may download software and patches (OSL software store; authentication required).

Brad Millett, associate director of Strategic Infrastructure Initiatives in the U's Chief Technology Officer organization, emphasized the scope of this endeavor.

“All software in use at the university that leverages Java at the server or client level will be affected by this change, and must be assessed to ensure legal and security compliance going forward,” Millett said.

Additional resources

• UIT public emails:
  • 05-07-2020
  • 06-25-2019
  • 03-01-2019
• Node 4 article
• This Week @theU article
• Brown Bag presentation (in Box, authentication required)

 

Node 4 Search