IBM Tivoli Security Policy Manager 7.1.0-TIV-ITSPM-FP0001 and 7.1.0-TIV-ITRTSS-FP0001 Readme

Readme file for: IBM® Tivoli® Security Policy Manager
Product/Component Release: 7.1.0
Update Name: Fix Pack 1
Fix ID: 7.1.0-TIV-ITSPM-FP0001
Fix ID: 7.1.0-TIV-ITRTSS-FP0001
Publication date: 16 November 2010
Last modified date: 16 November 2010

Alerts

Denial of Service Security Exposure with Java JRE/JDK:

Description:
This Security Alert addresses security issue CVE-2010-4476 (Java Runtime Environment hangs when converting "2.2250738585072012e-308" to a binary floating-point number), which is a vulnerability in the Java Runtime Environment component.
Before updating TSPM/RTSS with this Fix Pack, update the JRE/JDK to mitigate the above mentioned Security Exposure.
This include all verisons of JRE/JDK that got installed in the system either via TSPM/RTSS or TIP/TCR (eWAS).
Please note that the update process for eWAS (that comes with TIP/TCR) is same as regular WAS update.
Use the following link to update the appropriate version of your JRE/JDK via WebSphere Application Server update:

Java Security Exposure (CVE-2010-4476) Flash for WebSphere Application Server (WSAS)

WAS Update Installer (WUI) may needed to be installed first which can be found at the following location: WebSphere Update Installer (WUI)

Downloading the Fix Pack

Download and extract the fix pack files from the Customer Support FTP site or website.

About this task

Tivoli Security Policy Manager Fix Pack 7.1.0.1 consists of two separate compressed files. One file contains the policy manager packages. The other file contains the runtime security services packages. Download the compressed files that apply to your deployment.

Table 1. Fix pack packages and compressed files
Package	Fix Pack compressed file
Tivoli Security Policy Manager	7.1.0-TIV-ITSPM-FP0001.zip
Tivoli Security Policy Manager Software Development Kit	7.1.0-TIV-ITSPM-FP0001.zip
Runtime Security Services Server	7.1.0-TIV-ITRTSS-FP0001.zip
Runtime Security Services Client
Runtime Security Services Software Development Kit

Procedure

Access either the FTP site or website:
- FTP site:
  Policy manager components:
```
ftp://ftp.software.ibm.com/software/tivoli_support/patches/patches_7.1.0/7.1.0-TIV-ITSPM-FP0001/
```
  Runtime security services components:
```
ftp://ftp.software.ibm.com/software/tivoli_support/patches/patches_7.1.0/7.1.0-TIV-ITRTSS-FP0001/
```
- Website:
  1. Go to the IBM Tivoli Security Policy Manager Support website.
  2. Locate and download the Fix Pack compressed files:
    1. Click Download.
    2. In the Search field, enter the policy manager Fix Pack identifier:
```
7.1.0-TIV-ITSPM-FP0001
```
    3. Download the compressed file.
    4. In the Search field, enter the runtime security services Fix Pack identifier:
```
7.1.0-TIV-ITRTSS-FP0001
```
    5. Download the compressed file.
Extract the compressed files.
Each compressed file contains packages of files. Extract the file or files that have the packages you want to install. Make note of the directory where you downloaded each compressed file.

Known Issues

Known issues with the fix pack are documented in this topic. You can also query the tech notes database on the Customer Support website.

There are known issues with the Installation Manager application:

The rollback feature of Installation Manager does not present a graphical user interface for entering required configuration settings such as passwords. If you do not manually supply the necessary passwords, Installation Manager presents the following error:
```
Error during "pre-install configure" phase:
java.lang.ExceptionInitializerError
```
This fix pack information center contains instructions for manually editing the necessary configuration files. See Rolling back Fix Pack 7.1.0.1.
The rollback feature of Installation Manager does not preserve response files that an administrator creates for the Tivoli Security Policy Manager configuration utility. The fix pack information center contains instructions for manually preserving these files. See Rolling back the policy manager package.
Do not install both IBM Tivoli Runtime Security Services Server Version 7.1.0.1 and IBM Tivoli Runtime Security Services Software Development Kit 7.1.0.1 in the same Installation Manager session. If you attempt to do so, the following message might be displayed:
```
Packages IBM Tivoli Runtime Security Services Server 7.1.0.1 and IBM Tivoli Runtime Security Services Software Development Kit 7.1.0.1 cannot coexist in the same package group
```
If this message is displayed, install each package in a separate Installation Manager session.

Known problems and limitations about Tivoli Security Policy Manager are documented in the form of tech notes on the IBM Software Support website at

http://www.ibm.com/software/tivoli/support/security-policy-mgr/

As limitations and problems are discovered and resolved, the IBM Software Support team updates the knowledge base. By searching the knowledge base, you can quickly find workarounds or solutions to problems that you experience. The following link sends a customized query to the live Support knowledge base for Tivoli Security Policy Manager:

http://www.ibm.com/support/search.wss?tc=SSNGTE&rs=3554&rank=8&atrn=SWVersion&atrv=7.1&dc=DB520+DB560

To create your own query, go to the Advanced search page on the IBM Software Support website.

Installing the fix pack

Choose to either update an existing Version 7.1.0 installation with the fix pack files or to install both the Version 7.1.0 files and the fix pack files.

Choose your deployment scenario:

Adding the Fix Pack 7.1.0.1 files to a Version 7.1.0 deployment that is already installed, configured, and operational.
Use the Installation Manager application Update feature. Follow the instructions in Updating Version 7.1.0 with Fix Pack 7.1.0.1.

Note:

You can update policy administration components that are deployed on a stand-alone server. Prior to this Fix Pack, Tivoli Security Policy Manager did not support deployment of policy administration components into a WebSphere cluster. This means that the update procedure cannot be used on prior cluster deployments. If you want to deploy the policy administration components to a WebSphere cluster, you must complete a new installation.
Creating a new deployment by installing the files for both Version 7.1.0.0 and Fix Pack 7.1.0.1.
Use the Installation Manager Install feature to install, in one session, the files for both 7.1.0 and 7.1.0.1.

This Readme file does not contain instructions for installing and configuring both Version 7.1.0 and Fix Pack 7.1.0.1. To create a new deployment, you must follow instructions on the Tivoli Security Policy Manager information center. See Installing Version 7.1.0 and Fix Pack 7.1.0.1

Updating Version 7.1.0 with Fix Pack 7.1.0.1

You can update a Tivoli Security Policy Manager 7.1.0 deployment with the files in Fix Pack 7.1.0.1.

About this task

Use the Installation Manager application to add the Fix Pack packages. The Installation Manager graphical user interface includes an Update icon. When you click this icon, Installation Manager runs a wizard that leads you through the required steps. During the update, you can specify values for the same configuration properties that you set when you installed Version 7.1.0.

Installation Manager presents the current values for each configuration property.
Installation Manager does not display values for passwords. You must enter any required passwords, such as the administrative user password.
Review each property, and ensure that it is correct. Modify any property that must change.

Procedure

Identify the packages and features that you want to update.

Table 2. Tivoli Security Policy Manager packages and features
Package	Features
Tivoli Security Policy Manager	Tivoli Policy Platform
	Tivoli Security Policy Manager server
	Tivoli Security Policy Manager administration console
	Tivoli Integrated Portal console
	Tivoli Security Policy Manager configuration utility
Tivoli Security Policy Manager SDK	Software Development Kit and Samples
Runtime Security Services Server	Authorization Service
Runtime Security Services Client	Authorization Service Runtime
	Policy Management Administration Agent
	Web Services Application Enforcement
Runtime Security Services SDK	Software Development Kit and Samples
Runtime Security Services SDK	Portal Application Enforcement Software Development Kit

Complete the instructions for the package that you want to update.
- Updating policy administration components
  Note:
  
  This Fix Pack introduces support for deploying policy administration components into a WebSphere cluster. This means that there are no prior cluster deployments to update. You can update policy administration components that are deployed on a stand-alone WebSphere Application Server. To install policy administration components in a WebSphere cluster, complete a new installation. See Tivoli Security Policy Manager in a clustered WebSphere Application Server environment.
- Updating the Tivoli runtime security services server
- Updating the Tivoli runtime security services client
- Updating the Tivoli Security Policy Manager software development kit
- Updating the Runtime Security Services software development kit
Verify success by reviewing the Installation Manager log files.
Use the Installation Manager log viewer:
- If you have completed an installation, go to the Installation Manager landing page and click File -> View Log.
- If you have already closed Installation Manager, or have installed another product after Tivoli Security Policy Manager, click File -> View Installation History. Select the package installation that you want to view. For example, Tivoli Security Policy Manager. Then click View Log.

Updating policy administration components

You can update the policy administration components using the fix pack installation files that are downloaded from the Customer Support website. The policy administration components include the policy manager server, configuration tool, and policy manager console.

About this task

Note:

This Fix Pack introduces support for deploying policy administration components into a WebSphere cluster. This means that there are no prior cluster deployments to update. You can update policy administration components that are deployed on a stand-alone WebSphere Application Server. To install policy administration components in a WebSphere cluster, complete a new installation. See Tivoli Security Policy Manager in a clustered WebSphere Application Server environment.

Procedure

Start Installation Manager.
AIX®, Linux®, Linux on System z®, or Solaris
1. Open a command-line window and navigate to the directory containing Installation Manager.
  The default installation directory is:
```
/opt/IBM/InstallationManager/eclipse
```
2. Start the program.
```
IBMIM
```
Windows®

Click Start -> All Programs -> IBM Installation Manager -> IBM Installation Manager.
Click File -> Preferences.
Configure a repository connection. This step specifies the location of the fix pack installation files.
1. Click Add Repository.
2. Browse to directory containing the extracted files from the archive file.
3. Locate the repository configuration file. For example, if you extracted the Fix Pack files on a Windows system in C:\Temp:
```
C:\Temp\policy\delta_7101\repository.config
```
4. Click OK to add the location as a repository.
5. Optionally, click Test Connections. Verify that you get the message:
```
All repositories are connected
```
6. Verify also that the Tivoli Security Policy Manager 7.1.0 repository occurs in the repository before the Fix Pack repository. This ordering ensures that Installation Manager installs the Fix Pack files last.
7. Click OK again.
Note:

Depending on your network configuration, you also might need to configure proxy settings or adjust your firewall settings.
Click Update.
The Update Packages panel displays package groups. The TSPM package group is highlighted. Click Next.
On the Update Packages panel, select the Version 7.1.0.1 package under Tivoli Security Policy Manager 7.1.0.0. Click Next.
After reading the license agreement:
- To continue the installation, select I accept the terms in the license agreement and click Next.
- To cancel the installation, select I do not accept the terms in the license agreement and click Cancel.
Installation Manager displays a list of installed components. Each installed component is selected. These components will be updated. Verify that the list is correct and click Next.
Components can include:
- Policy manager server
- Policy manager console
- Configuration tool
Confirm the values in the Connection Details panel and click Next.
Installation Manger displays current values for:

SOAP port

Specifies the port value that is used by WebSphere® Application Server for SOAP communications.

Security enabled

Specifies whether communication with WebSphere Application Server occurs only over secure connections.
Note:

Clear Security enabled only if instructed to do so by IBM Support personnel.
If you are updating the policy manager server, specify the necessary passwords on the Security Details panel. Verify that the supplied values for the other properties are correct. Click Next.
Supply a password for the administrative user and for the truststore. If your deployment uses the keystore, supply a password for it.

Note:

If your deployment does not have security enabled, you cannot specify these values.

Administrative user name

Required. Specifies the user name of the administrator that is managing the WebSphere Application Server instance. The default value is wasadmin.

Administrative user password

Required. Specifies the password for the WebSphere Application Server administrator.

Truststore location

Required. Specifies the fully qualified path and name of the truststore for WebSphere Application Server.

Truststore password

Required. Specifies the password for the truststore.

Keystore location

Optional. Specifies the keystore location used by the WebSphere server to establish a secure connection with the installation program. If you are using the default keystore, the location is blank.

Keystore password

Optional. Specifies the password for the keystore if a location was specified.
In the Queried WebSphere Server Information panel, verify that the listed values are correct for the WebSphere Application Server instance and perform one of the following actions:
- If the information is correct, click Next.
- If this information is not correct, an error is displayed indicating that the data could not be confirmed with WebSphere Application Server:
  1. Exit and restart Installation Manager. Click Cancel -> File -> Exit.
    Note:
    
    Do not use Back to return to the data-entry panel.
  2. You do not have to reenter the repository information. Continue with Step 4.
In the Server Or Cluster To Deploy panel, select the WebSphere environment where you are updating the product components. Click Next.
If you are updating the policy manager console, specify the password in the Tivoli Integrated Portal Install Details panel. Confirm that the other values are correct. Click Next.
User name

Specifies the name of the administrator for the console. The default value is tipadmin.

User password

Specifies a password for the administrator.

Verify user password

Specifies the password again for verification.

Console HTTP port

Specifies the port number to be used for connecting to the console using a web browser or accept the default. The default port number is 16310.

Location to install Tivoli Integrated Portal (TIP)
Specifies the fully qualified name of the directory where the Tivoli Integrated Portal is installed.
The default installation directory is:
AIX, Linux, Linux on System z, or Solaris
/opt/IBM/tivoli/tip
Windows
C:\Program Files\tivoli\tip
Review the summary information and click Update. Installation Manager starts gathering files.
Click Finish to complete the installation.
Exit Installation Manager.
Click File -> Exit.

What to do next

Complete the following steps to refresh the WebSphere OSGi cache:

Stop the WebSphere Application Server for the policy manager.
See the stopping topics in the WebSphere® Application Server information center:
- WebSphere Application Server version 6.1 http://www14.software.ibm.com/webapp/wsbroker/redirect?version=pix&product=was-nd-dist
- WebSphere Application Server version 7.0 http://www14.software.ibm.com/webapp/wsbroker/redirect?version=compass&product=was-nd-dist
Run the OSGi configuration script to refresh the WebSphere OSGi cache.
- AIX, Linux, Linux on System z, or Solaris
```
WAS_HOME/profiles/profile_name/bin/osgiCfgInit.sh
```
- Windows
```
WAS_HOME\profiles\profile_name\bin\osgiCfgInit.bat
```
Start the WebSphere Application Server for the policy manager.
See the starting topics in the WebSphere® Application Server information center:
- WebSphere Application Server version 6.1 http://www14.software.ibm.com/webapp/wsbroker/redirect?version=pix&product=was-nd-dist
- WebSphere Application Server version 7.0 http://www14.software.ibm.com/webapp/wsbroker/redirect?version=compass&product=was-nd-dist
Stop and restart the server where the console (the Tivoli Integrated Portal component) is installed.
Windows:
Go to C:\Program Files\IBM\tivoli\tip\profiles\TIPProfile\bin
1. Stop the server with the following command:
  stopServer.bat -server1 -username adminname -password adminpassword
2. Start the server with the following command:
  startServer.bat server1
AIX, Linux, or Solaris
Go to /opt/IBM/tivoli/tip/profiles/TIPProfile/bin
1. Stop the server with the following command:
  stopServer.sh -server1 -username adminname -password adminpassword
2. Start the server with the following command:
  startServer.sh server1

Updating the Tivoli runtime security services server

You can update the Tivoli runtime security services server package using the fix pack installation files that are downloaded from the Customer Support website.

Procedure

Start Installation Manager.
If installing into a WebSphere cluster, start Installation Manager on the WebSphere Application Server deployment manager.
AIX, Linux, Linux on System z, or Solaris
1. Open a command-line window and navigate to the directory containing Installation Manager.
  The default installation directory is:
```
/opt/IBM/InstallationManager/eclipse
```
2. Start the program.
```
IBMIM
```
Windows

Click Start -> All Programs -> IBM Installation Manager -> IBM Installation Manager.
Click File -> Preferences.
Configure a repository connection. This step specifies the location of the fix pack installation files.
1. Click Add Repository.
2. Browse to directory containing the extracted files from the archive file.
3. Locate the repository configuration file. For example, if you extracted the Fix Pack files on a Windows system in C:\Temp:
```
C:\Temp\policy\delta_7101\repository.config
```
4. Click OK to add the location as a repository.
5. Optionally, click Test Connections. Verify that you get the message:
```
All repositories are connected
```
6. Verify also that the Tivoli Security Policy Manager 7.1.0 repository occurs in the repository before the Fix Pack repository. This ordering ensures that Installation Manager installs the Fix Pack files last.
7. Click OK again.
Note:

Depending on your network configuration, you also might need to configure proxy settings or adjust your firewall settings.
Click Update.
The Update Packages panel displays package groups. The RTSS package group is highlighted. Click Next.
On the Update Packages panel, select the Version 7.1.0.1 package under IBM Tivoli Runtime Security Services Server 7.1.0.0. Click Next.
After reading the license agreement:
- To continue the installation, select I accept the terms in the license agreement and click Next.
- To cancel the installation, select I do not accept the terms in the license agreement and click Cancel.
The Update Packages panel displays the features to update The Authorization Service package is highlighted. Click Next.
Confirm the values in the Connection Details panel and click Next.
Installation Manger displays current values for:

SOAP port

Specifies the port value that is used by WebSphere Application Server for SOAP communications.

Security enabled

Specifies whether communication with WebSphere Application Server occurs only over secure connections.
Note:

Clear Security enabled only if instructed to do so by IBM Support personnel.
Specify the necessary passwords on the Security Details panel. Verify that the supplied values for the other properties are correct. Click Next.
Supply a password for the administrative user and for the truststore. If your deployment uses the keystore, supply a password for it.

Note:

If your deployment does not have security enabled, you cannot specify these values.

Administrative user name

Required. Specifies the user name of the administrator that is managing the WebSphere Application Server instance. The default value is wasadmin.

Administrative user password

Required. Specifies the password for the WebSphere Application Server administrator.

Truststore location

Required. Specifies the fully qualified path and name of the truststore for WebSphere Application Server.

Truststore password

Required. Specifies the password for the truststore.

Keystore location

Optional. Specifies the keystore location used by the WebSphere server to establish a secure connection with the installation program. If you are using the default keystore, the location is blank.

Keystore password

Optional. Specifies the password for the keystore if a location was specified.
In the Queried WebSphere Server Information panel, verify that the listed values are correct for the WebSphere Application Server instance and perform one of the following actions:
Note:

If you are installing in a WebSphere cluster, the displayed text shows the correct cell name, but incorrectly shows the server name as one of the nodes.
- If the information is correct, click Next.
- If this information is not correct, an error is displayed indicating that the data could not be confirmed with WebSphere Application Server:
  1. Exit and restart Installation Manager. Click Cancel -> File -> Exit.
    Note:
    
    Do not use Back to return to the data-entry panel.
  2. You do not have to add the repositories to Installation Manager. Continue with Step 4.
In the Server Or Cluster To Deploy panel, select the WebSphere environment where you are installing the product components. Click Next.
Review the summary information and click Update to begin the installation.
Click Finish to complete the installation.
Exit Installation Manager.
Click File -> Exit.

What to do next

Verify that you can issue administration commands to the runtime security services server.
For example, you can use the administration console to verify that the runtime security services audit settings are visible.
Verify that you can distribute policy to a policy distribution target.
See the Tivoli Security Policy Manager Administration Guide for instructions on how to distribute policy.
Update the runtime security services clients.

Updating the Tivoli runtime security services client

You can update the Tivoli runtime security services package using the fix pack installation files that are downloaded from the Customer Support website.

Procedure

Start Installation Manager.
If installing into a WebSphere cluster, start Installation Manager on the WebSphere Application Server deployment manager.
AIX, Linux, Linux on System z, or Solaris
1. Open a command-line window and navigate to the directory containing Installation Manager.
  The default installation directory is:
```
/opt/IBM/InstallationManager/eclipse
```
2. Start the program.
```
IBMIM
```
Windows

Click Start -> All Programs -> IBM Installation Manager -> IBM Installation Manager.
Click File -> Preferences.
Configure a repository connection. This step specifies the location of the fix pack installation files.
1. Click Add Repository.
2. Browse to directory containing the extracted files from the archive file.
3. Locate the repository configuration file. For example, if you extracted the Fix Pack files on a Windows system in C:\Temp:
```
C:\Temp\policy\delta_7101\repository.config
```
4. Click OK to add the location as a repository.
5. Optionally, click Test Connections. Verify that you get the message:
```
All repositories are connected
```
6. Verify also that the Tivoli Security Policy Manager 7.1.0 repository occurs in the repository before the Fix Pack repository. This ordering ensures that Installation Manager installs the Fix Pack files last.
7. Click OK again.
Note:

Depending on your network configuration, you also might need to configure proxy settings or adjust your firewall settings.
Click Update.
The Update Packages panel displays package groups. Verify that the RTSSClient package group is selected. Click Next.
On the Update Packages panel, select the Version 7.1.0.1 package under IBM Tivoli Runtime Security Services Client 7.1.0.0. Click Next.
After reading the license agreement:
- To continue the installation, select I accept the terms in the license agreement and click Next.
- To cancel the installation, select I do not accept the terms in the license agreement and click Cancel.
The Update Packages panel displays the installed features to update. Verify that the required features Authorization Service Runtime and Policy Management Administration Agent are selected. If the optional feature Web Services Application Enforcement is installed, verify that it is selected. Click Next.
Confirm the values in the Connection Details panel and click Next.
Installation Manger displays current values for:

SOAP port

Specifies the port value that is used by WebSphere Application Server for SOAP communications.

Security enabled

Specifies whether communication with WebSphere Application Server occurs only over secure connections.
Note:

Clear Security enabled only if instructed to do so by IBM Support personnel.
Specify the necessary passwords on the Security Details panel. Verify that the supplied values for the other properties are correct. Click Next.
Supply a password for the administrative user and for the truststore. If your deployment uses the keystore, supply a password for it.

Note:

If your deployment does not have security enabled, you cannot specify these values.

Administrative user name

Required. Specifies the user name of the administrator that is managing the WebSphere Application Server instance. The default value is wasadmin.

Administrative user password

Required. Specifies the password for the WebSphere Application Server administrator.

Truststore location

Required. Specifies the fully qualified path and name of the truststore for WebSphere Application Server.

Truststore password

Required. Specifies the password for the truststore.

Keystore location

Optional. Specifies the keystore location used by the WebSphere server to establish a secure connection with the installation program. If you are using the default keystore, the location is blank.

Keystore password

Optional. Specifies the password for the keystore if a location was specified.
In the Queried WebSphere Server Information panel, verify that the listed values are correct for the WebSphere Application Server instance and perform one of the following actions:
Note:

If you are installing in a WebSphere cluster, the displayed text shows the correct cell name, but incorrectly shows the server name as one of the nodes.
- If the information is correct, click Next.
- If this information is not correct, an error is displayed indicating that the data could not be confirmed with WebSphere Application Server:
  1. Exit and restart Installation Manager. Click Cancel -> File -> Exit.
    Note:
    
    Do not use Back to return to the data-entry panel.
  2. You do not have to add the repositories to Installation Manager. Continue with Step 4.
In the Server Or Cluster To Deploy panel, select the WebSphere environment where you are installing the product components. Click Next.
Review the summary information and click Update to begin the installation.
Click Finish to complete the installation.
Exit Installation Manager.
Click File -> Exit.

What to do next

Update and verify the client configuration. Use the links below to complete the configuration. The links point to configuration tasks on the Tivoli Security Policy Manager information center.

Local client mode:
- Standalone WebSphere Application Server deployment
  1. Deploying the client in local mode
  2. See Configuring a policy enforcement point in local mode
  3. Verify that you can issue administration commands to the runtime security services server.
    For example, you can use the administration console to verify that the runtime security services audit settings are visible.
  4. Verify that you can distribute policy to a policy distribution target.
    See the Tivoli Security Policy Manager Administration Guide for instructions on how to distribute policy.
- WebSphere Cluster deployments
  1. Deploying the client in local mode
  2. Configuring a policy enforcement point in local mode
  3. Verify that you can issue administration commands to the runtime security services server.
    For example, you can use the administration console to verify that the runtime security services audit settings are visible.
  4. Verify that you can distribute policy to a policy distribution target.
    See the Tivoli Security Policy Manager Administration Guide for instructions on how to distribute policy.
Remote client configuration and verification:
- Standalone WebSphere Application Server deployments
  1. Deploying the client in remote mode
  2. Configuring a policy enforcement point on the client in remote mode
  3. Configuring SSL for the runtime security services client in remote mode
  4. If you want to verify that a runtime security services client is configured correctly in remote mode, use your deployed application to verify that you get the appropriate permit and deny access decisions.
- Cluster deployments
  1. Deploying the client in remote mode
  2. Configuring a policy enforcement point on the client in remote mode
  3. Configuring SSL for the runtime security services client in remote mode
  4. If you want to verify that a runtime security services client is configured correctly in remote mode, use your deployed application to verify that you get the appropriate permit and deny access decisions.

Updating the Tivoli Security Policy Manager software development kit

You can update the Tivoli Security Policy Manager software development kit package with the fix pack installation files.

Procedure

Start Installation Manager.
If installing into a WebSphere cluster, start Installation Manager on the WebSphere Application Server deployment manager.
AIX, Linux, Linux on System z, or Solaris
1. Open a command-line window and navigate to the directory containing Installation Manager.
  The default installation directory is:
```
/opt/IBM/InstallationManager/eclipse
```
2. Start the program.
```
IBMIM
```
Windows

Click Start -> All Programs -> IBM Installation Manager -> IBM Installation Manager.
Click File -> Preferences.
Configure a repository connection. This step specifies the location of the fix pack installation files.
1. Click Add Repository.
2. Browse to directory containing the extracted files from the archive file.
3. Locate the repository configuration file. For example, if you extracted the Fix Pack files on a Windows system in C:\Temp:
```
C:\Temp\policy\delta_7101\repository.config
```
4. Click OK to add the location as a repository.
5. Optionally, click Test Connections. Verify that you get the message:
```
All repositories are connected
```
6. Verify also that the Tivoli Security Policy Manager 7.1.0 repository occurs in the repository before the Fix Pack repository. This ordering ensures that Installation Manager installs the Fix Pack files last.
7. Click OK again.
Note:

Depending on your network configuration, you also might need to configure proxy settings or adjust your firewall settings.
Click Update.
The Update Packages panel displays package groups. The TSPM package group is highlighted. Click Next.
On the Update Packages panel, select the Version 7.1.0.1 package under Tivoli Security Policy Manager 7.1.0.0. Click Next.
After reading the license agreement:
- To continue the installation, select I accept the terms in the license agreement and click Next.
- To cancel the installation, select I do not accept the terms in the license agreement and click Cancel.
The Update Packages panel highlights the Software Development Kit package. Confirm that the package is correct and click Next
Review the summary information and click Update to begin the installation.
Click Finish to complete the installation.
Exit Installation Manager.
Click File -> Exit.

Updating the Runtime Security Services software development kit

You can update the Runtime Security Services software development kit package by installing the fix pack installation files.

Procedure

Start Installation Manager.
If installing into a WebSphere cluster, start Installation Manager on the WebSphere Application Server deployment manager.
AIX, Linux, Linux on System z, or Solaris
1. Open a command-line window and navigate to the directory containing Installation Manager.
  The default installation directory is:
```
/opt/IBM/InstallationManager/eclipse
```
2. Start the program.
```
IBMIM
```
Windows

Click Start -> All Programs -> IBM Installation Manager -> IBM Installation Manager.
Click File -> Preferences.
Configure a repository connection. This step specifies the location of the fix pack installation files.
1. Click Add Repository.
2. Browse to directory containing the extracted files from the archive file.
3. Locate the repository configuration file. For example, if you extracted the Fix Pack files on a Windows system in C:\Temp:
```
C:\Temp\policy\delta_7101\repository.config
```
4. Click OK to add the location as a repository.
5. Optionally, click Test Connections. Verify that you get the message:
```
All repositories are connected
```
6. Verify also that the Tivoli Security Policy Manager 7.1.0 repository occurs in the repository before the Fix Pack repository. This ordering ensures that Installation Manager installs the Fix Pack files last.
7. Click OK again.
Note:

Depending on your network configuration, you also might need to configure proxy settings or adjust your firewall settings.
Click Update.
The Update Packages panel displays package groups. The RTSS package group is highlighted. Click Next.
On the Update Packages panel, select the Version 7.1.0.1 package under Runtime Security Services 7.1.0.0. Click Next.
After reading the license agreement:
- To continue the installation, select I accept the terms in the license agreement and click Next.
- To cancel the installation, select I do not accept the terms in the license agreement and click Cancel.
The Update Packages panel highlights the packages that are installed. This includes Software Development Kit package, and can include Software Development Kit and Samples and Portal Application Enforcement Software Development Kit. Confirm that the packages are correct and click Next.
Review the summary information and click Update to begin the installation.
Click Finish to complete the installation.
Exit Installation Manager.
Click File -> Exit.

Rolling back or uninstalling fix pack files

Use Installation Manager to roll back or uninstall a set of software packages.

Installation Manager supports two different tasks for removing the Fix Pack files. You must choose which task you want to do.

The Installation Manager graphical user interface presents an icon for Roll back and an icon for Uninstall.

Roll back
Within one session, Installation Manager:
1. Saves the necessary configuration files.
2. Uninstalls the files for Fix Pack 7.1.0.1.
3. Installs the Version 7.1.0.0 files.
4. Places the saved configuration files back into the correct locations.
Uninstall
Within one Installation Manager session, uninstalls the files for both Version 7.1.0.0 and Fix Pack 7.1.0.1. You can remove files on a package or feature level.

Select the instructions appropriate for your deployment:

To roll back an installation, you must follow a set of instructions on the Tivoli Security Policy information center. These instructions guide you through the file rollback and component configuration steps that are needed to restore a fully functional Version 7.1.0 deployment. See Rolling back Fix Pack 7.1.0.1
To uninstall the fix pack files, without rolling back to a previous version, continue with the instructions in this Readme file.

Uninstalling both Fix Pack 7.1.0.1 and Version 7.1.0 files

Use Installation Manager to uninstall both the Fix Pack 7.1.0.1 files and the Version 7.1.0 files.

Before you begin

If you are uninstalling the Tivoli Security Policy Manager package, and have previously created a response file for the Tivoli Security Policy Manager configuration tool, and want to preserve the file for future use, save the response file before uninstalling the product.

If you created a response file for the Tivoli Security Policy Manager configuration tool in the /opt/IBM/TSPM directory hierarchy, back up the response file before you uninstall Tivoli Security Policy Manager. Place the backup files in a directory that is separate from the Tivoli Security Policy Manager installation directory.

About this task

You can use one Installation Manager uninstallation task to remove both the Fix Pack 7.1.0.1 files and Version 7.1.0 files. The Fix Pack has the same packages (components) and features as Version 7.1.0. The Installation Manager uninstallation process removes all files for the selected packages.

Procedure

Use the uninstallation process that is documented on the Tivoli Security Policy Manager information center. See Uninstalling Tivoli Security Policy Manager.
The uninstallation process on the information center applies to the fix pack files as well as to the Version 7.1.0 files. The information center describes both interactive and silent uninstallation mode. The information center topics describe the necessary unconfiguration and uninstallation steps for each of the product packages:
- Tivoli Security Policy Manager
- Tivoli Security Policy Manager Software Development Kit
- Runtime Security Services Server
- Runtime Security Services Client
- Runtime Security Services Software Development Kit
If you uninstalled the Tivoli Security Policy Manager policy manager component, you must refresh the WebSphere OSGi cache. Complete the following instructions:
1. Stop the WebSphere Application Server for the policy manager.
  See the stopping topics in the WebSphere® Application Server information center:
  - WebSphere Application Server version 6.1 http://www14.software.ibm.com/webapp/wsbroker/redirect?version=pix&product=was-nd-dist
  - WebSphere Application Server version 7.0 http://www14.software.ibm.com/webapp/wsbroker/redirect?version=compass&product=was-nd-dist
2. Run the OSGi configuration script to refresh the WebSphere OSGi cache.
  - AIX, Linux, Linux on System z, or Solaris
```
WAS_HOME/profiles/profile_name/bin/osgiCfgInit.sh
```
  - Windows
```
WAS_HOME\profiles\profile_name\bin\osgiCfgInit.bat
```
3. Start the WebSphere Application Server for the policy manager.
  See the starting topics in the WebSphere® Application Server information center:
  - WebSphere Application Server version 6.1 http://www14.software.ibm.com/webapp/wsbroker/redirect?version=pix&product=was-nd-dist
  - WebSphere Application Server version 7.0 http://www14.software.ibm.com/webapp/wsbroker/redirect?version=compass&product=was-nd-dist
4. Stop and restart the server where the console (the Tivoli Integrated Portal component) is installed.
  Windows:
  Go to C:\Program Files\IBM\tivoli\tip\profiles\TIPProfile\bin
  1. Stop the server with the following command:
    stopServer.bat -server1 -username adminname -password adminpassword
  2. Start the server with the following command:
    startServer.bat server1
  AIX, Linux, or Solaris
  Go to /opt/IBM/tivoli/tip/profiles/TIPProfile/bin
  1. Stop the server with the following command:
    stopServer.sh -server1 -username adminname -password adminpassword
  2. Start the server with the following command:
    startServer.sh server1
When you complete the uninstallation, you can optionally review the Installation Manager log files.
Use the Installation Manager log viewer:
- If you have just completed an uninstallation, go to the Installation Manager landing page and click File -> View Log .
- If you have already closed Installation Manager, start Installation Manger and click File -> View Installation History. Select the package uninstallation that you want to view. For example, Tivoli Security Policy Manager. Then click View Log.

Fixes

The fix pack provides fixes for a number of the APARs.

Table 3. Fixes contained in Fix Pack 7.1.0.1
APAR	Problem summary
IZ80883	RTSS LOCAL MODE IS FAILING WITH J2EE ENFORCEMENT
IZ87160	NULLPOINTEREXCEPTION IN STS ATTRIBUTE FINDER WHEN PARSING RTSR
IZ77364	JAX-WS PEP DOES NOT ENFORCE SERVICES USING MESSAGE LEVEL AUTHENTICATION
IZ87161	JAXWS PEP SHOULD LOOK IN MESSAGE CONTEXT FOR SUBJECT
IZ87166	JAXWS PEP SHOULD FALL BACK TO RUN-AS SUBJECT
IZ83168	PROBLEM ATTACHING POLICY VIA CLASSIFICATION

Features

This fix pack contains new features. The new features are not enabled by default. You can enable the features you want to use.

Some of the new features are part of the runtime environment. These features are not enabled by default. To enable them, see: New features for the runtime environment

Other new features provide enhanced capabilities for configuration or customization. To deploy these features, see New features for deployment.

The new features are fully described on the Tivoli Security Policy information center. Click on the following links to access information on each new feature:

Importing multiple policies from the Policy Design tool
You can import multiple policies from a single file that was created by the Policy Design Tool.
Policy import for existing J2EE applications
Use the import wizard in the console to import the resources, policies, and roles of a J2EE application into Tivoli® Security Policy Manager.
Rediscovery of an existing service definition
Update the definition of a service that was previously imported, or discovered, by importing the service again. The service name must be the same.
Enhanced JDBC PIP chaining for policy evaluation
There are two types of enhanced policy information point (PIP) chaining you can use to evaluate a policy: standard and complex.
Web service parsing to message level
When you import or discover web services, Tivoli Security Policy Manager can parse down to the message level. You can then attach a message protection policy to a message.
Tivoli Security Policy Manager in a clustered WebSphere Application Server environment
You can install the Tivoli Security Policy Manager server in a clustered WebSphere Application Server environment.
IBM Tivoli Identity Manager reports
The fix pack includes a new report that integrates data from Tivoli Identity Manager and your Tivoli Security Policy Manager environment.
Software Development Kit
The Tivoli Security Policy Manager product offers two Software Development Kits (SDK). The Tivoli® Security Policy Manager Software Development Kit (SDK) includes the policy management API, API documentation, and sample programs. The runtime security services software development kit (SDK) includes the API documentation and sample programs.
Custom policy information points
You can use the runtime security services SDK to develop custom policy information points.

Notices

This information was developed for products and services offered in the U.S.A.

IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:

Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan Ltd.
1623-14, Shimotsuruma, Yamato-shi
Kanagawa 242-8502 Japan

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758
USA

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental.

Trademarks

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with the appropriate symbol (® or ™), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at http://www.ibm.com/legal/copytrade.shtml

Adobe, Acrobat, Portable Document Format (PDF), and PostScript are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, other countries, or both.

Intel, Intel Inside (logos), Itanium, MMX, and Pentium are trademarks of Intel Corporation in the United States, other countries, or both.

Linux is a trademark of Linus Torvalds in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Java logo Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.

Other company, product, or service names may be trademarks or service marks of others.

IBM Tivoli Security Policy Manager 7.1.0-TIV-ITSPM-FP0001 and 7.1.0-TIV-ITRTSS-FP0001 Readme

Contents

Abstract

Alerts

Denial of Service Security Exposure with Java JRE/JDK:

Downloading the Fix Pack

About this task

Procedure

Known Issues

Installing the fix pack

Updating Version 7.1.0 with Fix Pack 7.1.0.1

About this task

Procedure

Updating policy administration components

About this task

Procedure

What to do next

Updating the Tivoli runtime security services server

Procedure

What to do next

Updating the Tivoli runtime security services client

Procedure

What to do next

Updating the Tivoli Security Policy Manager software development kit

Procedure

Updating the Runtime Security Services software development kit

Procedure

Rolling back or uninstalling fix pack files

Uninstalling both Fix Pack 7.1.0.1 and Version 7.1.0 files

Before you begin

About this task

Procedure

Fixes

Features

Notices

Trademarks