===============================================================================
Maintenance for Sterling External Authentication Server (SEAS) 2.4.3.0 iFix 2
===============================================================================

This cumulative maintenance archive includes fixes for the issues listed below.

Contents:
   I.   HIPER (High Impact PERvasive) Fixes / Fixes Requiring Action
   II.  Summary of Fixes by Patch/APAR (Latest iFix / FixPack first)
   III. Detailed Description of Fixes

===============================================================================
I. HIPER (High Impact PERvasive) Fixes / Fixes Requiring Action
===============================================================================

In iFix01 (July 2016):

  None

===============================================================================
II. Summary of Fixes by iFix / FixPack /APAR (Latest iFix / FixPack first)
===============================================================================

===============================================================================
Fixes for SEAS 2.4.3.0 IFix 2, Build 89 (December 2016)
===============================================================================

  DEFECT   / APAR

  No Defect/IT17228 (CM,Engine,  - Upgraded SSP Engine, CM, and PS to IBM
                     PS)           JRE 1.7 SR9FP50 for latest security patches

  RTC508170/          - Allow token validation for CEUNIX

  RTC510283/RFE468574 - Allow SEAS to verify Hostnames

  RTC511666/IT17151   - Unable to invoke iKeyman on Solaris 10.

  RTC513984/          - Enhancement to allow silent Installs for SEAS

  RTC514318/IT17374   - SSH Public Key authentication through IBM SEAS fails due
                       to trailing blank spaces

  RTC516324/          - SEAS does not start if passphrase contains “&” character

  RTC519864/IT17988  - 2 ciphers missing from SEAS supported ciphersuites list

===============================================================================
Fixes for SEAS 2.4.3.0 IFix 1, Build 74 (July 2016)
===============================================================================

  DEFECT   / APAR

  RTC507060/ no APAR  - NumberFormatException during ip address conversion
  
  RTC498507/ no APAR  - The '-' character is not allowed in the username for 
                        SEAS system users
                       
===============================================================================
III. Detailed Description of Fixes (in Defect ascending order)
===============================================================================

  RTC507060/ no APAR  - NumberFormatException during ip address conversion.
  
			Resolution: Changed the logic to avoid the 
                        NumberFormatException.
  
  
  RTC498507/ no APAR  - The '-' character is not allowed in the username for 
                        SEAS system users
						
			Resolution: The SEAS username validation logic has been
                        modified to allow hyphens in system user names.

  No Defect/IT17228  - Upgrade SEAS to IBM JRE 1.7 SR9FP50 for latest security
                       patches

      This JRE includes the quarterly Java security patches through July 2016.
      See http://www.ibm.com/support/docview.wss?uid=swg21991287 for details.

  RTC508170/         - Allow token validation for CEUNIX
  
      Enhancement to allow CEUNIX to do token validation using the password 
      field.

  RTC510283/RFE468574 - Allow SEAS to verify Hostnames

      There was no mechanism to perform DNS checks during certificate 
      validation through SEAS

      Resolution: IBM SEAS has been modified to allow for DNS hostname checking
      during certificate validation. When the "Check hostname DNS" field is 
      enabled in SEAS, the user IP address will be matched with information in 
      the user certificate's SAN or certificate CN.

  RTC511666/IT17151  - Unable to invoke iKeyman on Solaris 10.

      The IBM hybrid JRE on Solaris delivers ikeyman as a call to the native
      Java with a class to execute.  However, if the JAVA_HOME doesn't point
      to the IBM JRE, it gets "Could not find or load main class
      com.ibm.gsk.ikeyman.Ikeyman"

      Resolution: Corrected Solaris installers for SEAS, SSP, SSP_CM and PS
      to modify jre/bin/ikeyman so that it always invokes the installed IBM JRE.

  RTC513984/         - Enhancement to allow silent Installs for SEAS

      InstallAnywhere Silent Install is a feature which allows for automated
      installs without questions and answers from the console.  It can be used
      for repetitive installs at Customer sites.  The administrator first does
      the product install in "record" mode which builds an installation
      properties file for subsequent silent installs in "replay" mode.

      The SSP Engine, CM, PS, and SEAS have all been updated to allow silent
      installs.

  RTC514318/IT17374  - SSH Public Key authentication through IBM SEAS fails due 
                       to trailing blank spaces

      Resolution: Added logic to trim retrieved SSH PUBLIC key from the LDAP
      before using them in the SSH PUBLIC KEY authentication process.

  RTC516324/         - SEAS does not start if passphrase contains “&” character
  
      If the SEAS passphrase is changed to include an ampersand "&" character,
      the system will not start.  Gets
        Startup did not succeed. Terminating: com.sterlingcommerce.hadrian.
        common.xml.XmlParsingException: Error on line 4: The entity name must
        immediately follow the '&' in the entity reference.

      Resolution: Escaped the system password field with the CDATA tag so that
      the xml converter will work properly

  RTC519864/IT17988  - 2 ciphers missing from SEAS supported ciphersuites list

      The ciphers TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and 
      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 were not included as supported 
      cipher suites for TLSv1.2.
      
      Resolution: Added these ciphers into ssl_tls_ciphers.properties so that
      they show up on a SEASCipherConfigTool.sh -c protocol=TLSV1.2 command.