--- title: "Rolling upgrade scenario: Three OneSpan Authentication Server instances using individual databases" slug: "oas-ag-rolling-upgrade-scenario-three-onespan-authentication-server-instances-using-individual-databases-3-28" updated: 2025-07-04T10:04:17Z published: 2025-07-07T13:30:26Z canonical: "docs.onespan.com/oas-ag-rolling-upgrade-scenario-three-onespan-authentication-server-instances-using-individual-databases-3-28" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Rolling upgrade scenario: Three OneSpan Authentication Server instances using individual databases ## About this scenario This scenario describes an environment with the following setup: - There are three OneSpan Authentication Server instances: server A, server B, and server C. - Each OneSpan Authentication Server instance has its own database. - User load is distributed evenly between all OneSpan Authentication Server instances using a third-party solution. - Two-way replication is enabled between all instances to ensure consistency of data across databases ![Rolling upgrade scenario: Three servers using individual databases and replication](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.png) Figure: Rolling upgrade scenario: Three servers using individual databases and replication The servers will be upgraded in the following order: 1. Server A 2. Server B 3. Server C > Do not modify the configuration of the servers, or perform authenticator or user administration, during the rolling upgrade. > > We recommend that you carefully consider the security implications of this procedure (as mentioned above). ## Before you begin - Verify that you have addressed the different usability and user load issues related to a rolling upgrade (see [General considerations](/sec/docs/oas-ag-rolling-upgrades-3-28#general-considerations)). - In this scenario you will be requested to configure, break, and restore replication between different OneSpan Authentication Server instances. For more information about replication during rolling upgrades, see [Replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication). > Although this scenario allows live upgrading with minimal service degradation, you need to take certain security considerations into account. During this upgrade, there is a window in which OTP replay attacks are possible. > > Problem > > A window for a replay attack opens when one server has been upgraded and is handling authentication requests, but is not yet replicating to other servers. In the scenario above, a replay attack is made possible. A user may authenticate first on server A, then replay the exact same authentication on server B or server C. > > Specifically, replay attacks are possible from step 12 until 24 in the upgrade process described below. > > Workaround > > If the replay attack window is not acceptable and the total load is low enough to be handled on one server, you can move all load to server A in step 12 and continue with the upgrade as specified. This makes steps 13 and 24 unnecessary; all other steps remain valid. ## Walkthrough: Performing a rolling upgrade on three servers with individual databases Performing a rolling upgrade on servers with individual databases Upgrade Server A 1. Remove the load from server A. 2. Break replication from server B to server A. 3. Break replication from server C to server A. 4. Wait until the replication queue on server A is empty. You should now be in this situation: ![Rolling upgrade scenario: Breaking replication from other servers to server A](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_A1.png) Figure: Rolling upgrade scenario: Breaking replication from other servers to server A 5. Stop the OneSpan Authentication Server service on server A. 6. [Break replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server A to server B. 7. [Break replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server A to server C. ![Rolling upgrade scenario: Breaking replication from server A to other servers](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_A2.png) Figure: Rolling upgrade scenario: Breaking replication from server A to other servers 8. Upgrade OneSpan Authentication Server on server A. 9. [Restore replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server B to server A. 10. [Restore replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server C to server A. ![Rolling upgrade scenario: Restoring replication from other servers to server A](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_A.Done.png) Figure: Rolling upgrade scenario: Restoring replication from other servers to server A 11. Wait until the replication queues on servers B and server C to server A are empty. 12. Restore the load on server A. ![Rolling upgrade scenario: Restoring user load to server A](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Security_issue.png) Figure: Rolling upgrade scenario: Restoring user load to server A Upgrade Server B 1. Remove the load on server B. 2. [Break replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server C to server B. ![Rolling upgrade scenario: Breaking replication from server C to server B](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_B1.png) Figure: Rolling upgrade scenario: Breaking replication from server C to server B 3. Wait until the replication queue on server B is empty. 4. Stop the OneSpan Authentication Server service on server B. 5. [Break replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server B to server A. 6. [Break replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server B to server C. ![Rolling upgrade scenario: Breaking replication from server B to other servers](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_B2.png) Figure: Rolling upgrade scenario: Breaking replication from server B to other servers 7. Upgrade OneSpan Authentication Server on server B. 8. [Restore replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server A to server B. 9. [Restore replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server B to server A. ![Rolling upgrade scenario: Restoring replication from server B to server A](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_B.Done.png) Figure: Rolling upgrade scenario: Restoring replication from server B to server A 10. Wait until the replication queue on server A towards server B is empty. 11. Restore load on server B. ![Rolling upgrade scenario: Restoring user load on server B](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_B.Done2.png) Figure: Rolling upgrade scenario: Restoring user load on server B Upgrade Server C 1. Remove load on server C. 2. Wait until the replication queue on server C to server A is empty. ![Rolling upgrade scenario: Removing user load on server C](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_C1.png) Figure: Rolling upgrade scenario: Removing user load on server C 3. Stop the OneSpan Authentication Server service on server C. 4. [Break replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server C to server A. ![Rolling upgrade scenario: Breaking replication from server C to server A](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_C2.png) Figure: Rolling upgrade scenario: Breaking replication from server C to server A 5. Upgrade OneSpan Authentication Server on server C. 6. [Restore replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server A to server C. 7. [Restore replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server B to server C ![Rolling upgrade scenario: Restoring replication from other servers to server C](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_C.Done.png) Figure: Rolling upgrade scenario: Restoring replication from other servers to server C 8. [Restore replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server C to server A. 9. [Restore replication](/sec/docs/oas-ag-rolling-upgrades-3-28#replication) from server C to server B. 10. Wait until the replication queues on server A and server B to server C are empty. ![Rolling upgrade scenario: Restoring replication from server C to other servers](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/3SRV_Individual_DB.Upgrade_C3.png) Figure: Rolling upgrade scenario: Restoring replication from server C to other servers 11. Restore load to server C.