File:   5.0.0.14-ISS-TIM-IF0056.README for ITIM 5.0 using IBM WebSphere Application Server.
Date:   May 21, 2012

Interim fix 5.0.0.14-ISS-TIM-IF0056 for APARs IV17339, IV17343, IV17408, IV19495, IV19872, IV20559, and IV20657.
Components:
        WebSphere update installer package for ITIM as needed for WebSphere Application Server V6.1.

General Description:
Contains accumulated fixes for problems encountered in IBM Tivoli Identity Manager (ITIM) Version 5.0.
The APAR numbers for all fixes included are listed under "Problems Fixed". Refer to the specific APAR descriptions for more detail.
This and other featured documents for IBM Tivoli Identity Manager can be found at:
    http://www.ibm.com/software/sysmgmt/products/support/IBMTivoliIdentityManager.html

   Problems Fixed:

    APAR:    IV17339
    Symptom: When there are entities that satisfy the SearchFilter's filter, and if some have the display attribute ("Attribute" parameter defined for search widget on the "Design Form") undefined, then a blank row is displayed on the UI after clicking on the "Search" button of search filter widget.
    
    APAR:    IV17343
    Symptom: When using the ITIM Self Service UI, if a form field is defined as a SearchFilter with a given <Object Class> and <Filter>, then the search result will contain entries which don't satisfy the filter (objectclass=<Object Class>).

    APAR:    IV17408
    Symptom: When a suspend/restore person operation is fired from the ITIM UI, the erlaststatuschangedate attribute is updated.  However when the person status is changed via an HRFeed (by modifying the value of the erpersonstatus attribute), that attribute of the Person object remains unchanged.
    Note:    The erlaststatuschangedate attribute will be updated only when "Use Workflow" option is enabled on the corresponding HR feed service.

    APAR:    IV19495    ROUTE OF IZ67458
    Symptom: When requesting the access for a person who does not already have an account of the service related to the access, the entity-type level operation workflow is invoked instead of the expected entity-level workflow.
    Note:    The following steps need to be followed to resolve this issue:
             1. Connect to the directory server instance with the help of any ldap client.
             2. Navigate to the entry for the requestAccess operation (erglobalid=00000000000000000063,ou=operations,ou=itim,ou=<tenantID>,<root suffix>)
             3. The erxml attribute of this operation has one STATIC_OPERATION tags as follows:
             <tags>
                <STATIC_OPERATION ENTITY_TYPE="Account" ENTITY_REF="account"/>
             </tags>

             Replace these tags with the following :
             <tags>
                <STATIC_OPERATION ENTITY_TYPE="Account" ENTITY_EXP='WorkflowRuntimeContext.getDataValue("account")'/>
             </tags>

             Please change the tenantID and root suffix according to your system configuration.

    APAR:    IV19872
    Symptom: If you assign an access owner using the ITIM V 5.0 GUI through Manage Services > Define an Access > Access Information panel, you will not be able to delete (or clear) it afterwards.

    APAR:    IV20559
    Symptom: Documentation Update
             Need to document the ITIM behavior when varchar2 data type for Oracle is used.
    Note:    The following update will be posted in a future revision of the ITIM Infocenter in the section of "Known Limitations, problems and workarounds".
             The action text specified on any manual activity node (approval and RFI) is stored in the DESCRIPTION column of the WORKITEM table. This column is defined to be of type varchar2(4000) for Oracle database. The ITIM Varchar2 column uses the Byte semantics as the default NLS_LENGTH_SEMANTICS value in Oracle is Byte, unless specified explicitly as a Char. So when ITIM tries to insert a value that is more than 4000 bytes in the DESCRIPTION column of the WORKITEM table, an error ORA-01461 is thrown. Since the maximum limit of varchar2 data type in Oracle is 4000 bytes, the size of this column cannot be increased. This is a known limitation when Oracle is used for the ITIM Database. 

             The workaround is to avoid crossing the limit of 4000 bytes for this column. Since ITIM internally uses around 50 bytes, a user can specify a maximum of around 3950 bytes of action text. The number of characters that can be specified (in action text) depends on the character set from which the characters are used. ITIM internally uses UTF-8 encoding, so the maximum length of description depends on the number of bytes used by UTF-8 to store those characters. 

    APAR:    IV20657    ROUTE OF IV07596
    Symptom: You may get poor performance when opening the Add/Modify Person form when there are a large number of attributes.  For example, for a custom person entity with about 850 attributes (arranged in a form with about 30 tabs), can take about 8 seconds or longer to open the form.             
    
   Old Problems Fixed from prior Interim Fixes:
   
    APAR:    IV13308    ROUTE OF IZ86063
    Symptom: When the same label is defined for two distinct attributes within an RFI node it is possible to select the two attributes in the list of attributes to be gathered, but every time the RFI is ended (with the OK button) and re-opened, the label which was originally displayed twice, is displayed a duplicate number of times (4, 8, 16, etc).
    Note:    You must ensure that the attributes used in RFI do not have the exact same labels in $ITIM_HOME/data/CustomLabels.properties file and $ITIM_HOME/data/CustomLabels_<language code>.properties file.

    APAR:    IV14543    ROUTE OF IZ88865
    Symptom: The RMI dispatcher receives loadAL() even if <DISPATCHERPARAMETER NAME="ALFILESYSTEMPATH"> is defined.

    APAR:    IV16000
    Symptom: When <ITIMURL forcedurl="enduser"/> script is used in a workorder notification template and the workorder node has the "wait for completion" flag set, ITIM does not append the activity id details in the link.

    APAR:    IV16602    ROUTE OF IV10248
    Symptom: During a TDI reconciliation, the search Assembly Line can be removed from the cache and this action does not result in a failed reconciliation.

Architecture(s): Windows, Solaris, AIX, HPUX, and Linux.

Fixes superseded: ITIM 5.0 Interim Fix 5.0.0.14-ISS-TIM-IF0055.

Dependencies: ITIM 5.0 Fixpack 5.0.0.14-ISS-TIM-FP0014.

Database Changes: NONE

JMS (Java Messaging Service) Changes: NONE

LDAP Changes: NONE

Files Replaced or Added or Modified by this Interim fix:

    ITIM ear, home, and updi files   (embedded inside the *.pak file)

Patch Contents:
  - This README file
  - 5.0.0.14-ISS-TIM-IF0056.pak

MD5 Checksums:
    269469c6da676724c2e5b66b1a538a23    5.0.0.14-ISS-TIM-IF0056.zip
    40dd87c51fd3d8ce3bdb3f2e4e859666    5.0.0.14-ISS-TIM-IF0056.pak

Applying the Patch:

    1) Extract the Interim Fix zip file to a temporary directory on your hard drive:

          # jar xvf 5.0.0.14-ISS-TIM-IF0056.zip

       NOTE:  You may also use any unzip equivalent to unpack the zip file.
              Back-level versions of jar, FastJar or PKZIP may report errors.  Use the jar executable supplied with java or another zip utility to uncompress the file.

    2) Copy the file(s) to the appropriate directory.  The following is a typical example.  Yours may be different.
       /opt/IBM/WebSphere/UpdateInstaller/maintenance/

NOTE: *************************************************************************
       Always BACKUP your old files in a safe place in case an unforeseen event occurs.  It is recommended to backup ITIM_HOME/data directory.  Especially, be sure to backup any configuration files you may have modified such as properties or xml files.
NOTE: *************************************************************************
       When performing this Interim Fix installation on a slower system the deployment could take a long time.
       We have seen times in the 30 minute range.  It is recommended to extend the WebSphere SOAP Request Timeout value from 180 to 1800 seconds or higher as needed.
       Configuration file:
          WAS_HOME/profiles/PROFILE_NAME/properties/soap.client.props
       Property to change:
          com.ibm.SOAP.requestTimeout=1800
          NOTE: com.ibm.SOAP.requestTimeout=0   will provide an infinite timeout.

       If you encounter a timeout problem you may see the following entries in the update installer logs:
        WASX7017E: Exception received while running file
        "/opt/IBM/itim/properties/version/nif/config/install/was/updateEar.py";
        exception information: com.ibm.websphere.management.exception.ConfigServiceException
        com.ibm.websphere.management.exception.ConnectorException
        org.apache.soap.SOAPException: [SOAPException: faultCode=SOAP-ENV:Client; msg=Read timed out;
        targetException=java.net.SocketTimeoutException: Read timed out]

        You may also see other errors indicating an error during the deployment of the ear.
NOTE: *************************************************************************
       You must use the WebSphere Update Installer Version V6.1.0.13 or newer.  You may download the latest version and get more information about the WebSphere Update Installer here:
       http://www.ibm.com/support/docview.wss?rs=180&uid=swg24012718
NOTE: *************************************************************************
      Interim Fix Installation procedure

       NOTE***  For Installing on a Cluster:
       Perform the  procedure starting at step 2 first on the NDM and then on every node in the cluster.
       Do not perform Step 1. on a Cluster.
       Before starting Fixpack Installation on cluster:
       A. Ensure all node agents are up and can communicate with the NDM.
       B. Ensure ITIM application cluster and ITIM Messaging cluster are stopped.
       C. If the DM node and a cluster member are in the same host, perform this procedure only once.
       NOTE***  For Installing on a Cluster end.
       1. Stop WebSphere using your normal procedures, e.g.
                $WAS_HOME/profiles/AppSrv01/bin/stopServer.sh server1
                Or if you wish to submit userid and password when WAS admin security is used:
                $WAS_HOME/profiles/AppSrv01/bin/stopServer.sh server1 -username xxxx -password yyyy
           Proceed to step 2, only after the stop confirmation is displayed.

       2.  Execute the WebSphere Update Installer, e.g.
                 /opt/IBM/WebSphere/UpdateInstaller/update.sh
                 C:\Program Files\IBM\WebSphere\UpdateInstaller\update.bat

       3. When the update installer asks for Product Selection, specify your ITIM_HOME directory, typically, /opt/IBM/itim.  Later steps will prompt for the location of the fix deliverable (.pak file).  When you go forward in the update installer panels, you should see the Interim Fix listed in the "Available Maintenance Package to Install" panel.

       4. Select the Next Button and confirm in the next panel by selecting the Next button.

       5. After the Maintenance Installation is complete, you may exit the Update Installer.

       6. Perform the COMMON TASKS listed below these instructions.

       7. After you are done with the COMMON TASKS, then:

       8. You may now begin using ITIM.  The Update Installer automatically restarts the WebSphere AppServer.

NOTE: *********************************************************************************
       The following are COMMON TASKS that you need to perform prior to restarting the AppServer or Cluster.
NOTE: *********************************************************************************

      1. REQUIRED: Additional steps for all Interim Fixes.
             After applying this fix you must clear the java plugin cache for the changes to take effect. The plugin cache has to be cleared on every machine from which you access ITIM applets in a browser. The steps differ for each version of java plugin installed.
             Execute the following steps to clear the Java Plug-in cache for the JRE Version 1.5.x.
             A. On a Windows box, click Start > Control Panel and double-click the Java icon in the control panel.The Java Control Panel appears.
                If you are on a unix box, you can launch the java control panel by running the 
                <JRE installation directory>/bin/ControlPanel or 
                <JRE installation directory>/bin/JavaPluginControlPanel program. On some systems 
                you can also load the Control Panel applet with a web browser by running 
                <JRE installation directory>/ControlPanel.html.
             B. Click Settings under Temporary Internet Files. The Temporary Files Settings dialog box appears.
             C. Click Delete Files. The Delete Temporary Files dialog box appears.
                There are three options on this window to clear the cache.
                a. Delete Files
                b. View Applications
                c. View Applets
             D. Click OK on Delete Temporary Files window. 
                Note: This deletes all the Downloaded Applications and Applets from the cache.
             E. Click OK on Temporary Files Settings window.
                Note: If you want to delete a specific application and applet from the cache, click on View Application and View Applet options respectively.

             Execute the following steps to clear the Java Plug-in cache for the JRE Version 
                1.4.x.
             A. On a Windows box, click Start > Control Panel and double-click the Java icon in the control panel.The Java Control Panel appears.
                If you are on a unix box, you can launch the java control panel by running the 
                <JRE installation directory>/bin/ControlPanel or 
                <JRE installation directory>/bin/JavaPluginControlPanel program. On some systems 
                you can also load the Control Panel applet with a web browser by running 
                <JRE installation directory>/ControlPanel.html.
             B. Click on the Cache tab.
             C. Click on the Clear button.
             D. Click OK to confirm and exit.

       END OF COMMON TASKS
End of Readme
