Skip to content
English
  • There are no suggestions because the search field is empty.

Do I need to update SurePassID Authentication Server (SPAS) after upgrading Windows Server or SQL Server to 2025?

What changes need to be made if a SPAS server's OS and/or SQL are upgraded?

Usually, no. An in-place upgrade to Windows Server 2025 does not require SPAS configuration changes. An in-place SQL Server 2025 upgrade also requires no SPAS connection-string changes if the server and instance, database, and login details remain the same. Update SPAS only when the database connection details change.

Before you begin:

  • Identify whether SQL Server was upgraded in place or installed side by side, and determine which SQL instance SPAS should use.
  • Have the target SQL server or instance, database name, and authentication details available.
  • Back up the API Server appsettings.json and the MFAServer and SAML2/IDP web.config files before editing. These web.config files include an <appSecrets> section. If app secrets are maintained in a separate file in your deployment, back it up too.

Check whether SPAS needs changes:

  1. If only Windows Server was upgraded in place, leave the SPAS configuration unchanged.
  2. If SQL Server was upgraded in place from a supported source, compare the SPAS connection details with the upgraded instance. If the server and instance, database, and login details are unchanged, leave the connection strings unchanged.
  3. If SQL Server 2025 was installed side by side, identify the instance SPAS should use. The original instance can remain in use only if its SQL Server version is supported on that Windows Server version and the instance is operational. If SPAS will use the new instance, or the database, server, or login changed, update the applicable connection strings.

Update SPAS connection strings:

  1. Find the deployed configuration files for each SPAS component that connects to the database. An example installation root is C:\Program Files (x86)\SurePassID Corp\SurePassID Authentication Server 25.4; the version folder can differ.
  2. In the API Server appsettings.json, check ConnectionStrings.
  3. In the MFAServer and SAML2/IDP web.config files, check both <connectionStrings> and <appSecrets>. Update the corresponding SQL values in both sections when connection details change.
  4. Update only the values that changed: Data Source for the SQL server and instance, Initial Catalog for the database, and UID and PWD when SQL authentication is used. Leave unrelated settings unchanged.
  5. For example, if the SQL instance changes, replace Data Source=(local)\SQLEXPRESS with the new server and instance. A SQL-authentication connection string can look like Data Source=SQLHOST\INSTANCE;Initial Catalog=SPASDB;Integrated Security=False;UID=SPAS_USER;PWD=YOUR_SQL_PASSWORD;. Use your deployment's actual values; do not use the example credentials.
  6. Start or test the affected SPAS applications and confirm they can connect to the intended database.

Expected result:

Each affected SPAS application connects to the intended SQL Server instance and database. If the connection details did not change, no SPAS configuration edits are required.

If SPAS cannot connect:

  • Confirm Data Source identifies the intended SQL server and instance and Initial Catalog names the intended database.
  • If SQL authentication is used and the login changed, confirm the corresponding UID and PWD values are current.
  • For MFAServer and SAML2/IDP, compare the SQL values in both <connectionStrings> and <appSecrets>. If app secrets are stored separately, check that file as well.
  • Confirm that the SQL instance SPAS is configured to use is operational and, for an original instance retained after a side-by-side installation, supported on the Windows Server version.