IBM(R) Security Access Manager for Web, Patch 7.0.0-ISS-SAM-IF0024 README
===============================================================================

(C) Copyright International Business Machines Corporation 2015. All rights
reserved. U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  Tuesday, 10 May 2016
-------------------------------------------------------------------------------

    CONTENTS

    1.0 ABOUT THIS PATCH
       1.1 Patch contents
       1.2 Architectures
       1.3 Patches superseded
       1.4 Dependencies
       1.5 Important Notice


    2.0 APARS AND DEFECTS FIXED
       2.1 Problems fixed by patch 7.0.0-ISS-SAM-IF0024
       2.2 Problems fixed by patch 7.0.0-ISS-SAM-IF0023
       2.3 Problems fixed by patch 7.0.0-ISS-SAM-IF0022
       2.4 Problems fixed by patch 7.0.0-ISS-SAM-IF0021
       2.5 Problems fixed by patch 7.0.0-ISS-SAM-IF0019
       2.6 Problems fixed by patch 7.0.0-ISS-SAM-FP0018
       2.7 Problems fixed by patch 7.0.0-ISS-SAM-FP0015
       2.8 Problems fixed by patch 7.0.0-ISS-SAM-FP0012
       2.9 Problems fixed by patch 7.0.0-ISS-SAM-FP0010
       2.10 Problems fixed by patch 7.0.0-ISS-SAM-FP0008
       2.11 Problems fixed by patch 7.0.0-ISS-SAM-FP0005
       2.12 Problems fixed by patch 7.0.0-ISS-SAM-FP0003
       2.13 Problems fixed by patch 7.0.0-ISS-SAM-FP0002
       2.14 Problems fixed by patch 7.0.0-ISS-SAM-FP0001


    3.0 BEFORE INSTALLING THIS PATCH
       3.1 Back up Security Access Manager data
       3.2 Upgrade GSKit to Version 8.0.50.64 or later


    4.0 INSTALLING THIS PATCH


    5.0 UNINSTALLING THIS PATCH


    6.0 AFTER INSTALLING THIS PATCH


    7.0 DOCUMENTATION UPDATES
       7.1 SSL-V2-ENABLE ATTRIBUTE NOT DOCUMENTED (IV37756)
       7.2 UNDO THE NEGATIVE VALUE WORKAROUNDS (IV37013)
       7.3 ISAM 2-SYSTEM UPGRADE FAILS WHEN OBFUSCATED FILE IS MISSING (IV44180)
       7.4 WHEN IMPORTING ACTIVE DIRECTORY GROUP, THE NAME OF THE ISAM GROUP 
           MUST BE SAME AS sAMACCOUNTNAME (IV48007)
       7.5 DOCUMENTATION SHOULD NOT SHOW OPTIONS TO SPECIFY ENCRYPTION SEED AND 
           SALT FOR IDSIMIGR COMMAND (IV47078)
       7.6 RDJAPI DOESN'T ALLOW FOR ESCAPING THE "*" ASTERISK (IV43899)
       5.7 IRA ENVIRONMENT VARIABLES DO NOT TAKE PRECEDENCE OVER THEIR
	   [LDAP] STANZA SETTINGS (IV55360)
       7.8 INSTALL_ISAM.SH DOES NOT INSTALL CONFIGURE_ISAM.SH FOR WPM (IV60752)
       7.9 ACL name now is restricted 8192 characters long (118749)
       7.10 WPM DOESN'T TRIM THE SPACE CHARACTER AT THE BEGINNING OF THE DN (IV68411)
       7.11 CANNOT CREATE USER WITH "=" IN USER ID (IV69878)

       

    8.0 SOFTWARE LIMITATIONS
   

    9.0 KNOWN PROBLEMS AND WORKAROUNDS


   10.0 NOTICES
       10.1 Trademarks


*****************************************************************************
*****************************************************************************

1.0 ABOUT THIS PATCH
--------------------
 This patch package requires an update to GsKit 8.0.50.64 or later.



1.1 Patch contents

 This patch package contains:

    - This README file



1.2 Architectures

 This patch package applies to the following architectures:


 Platform                                 Patch
 ------------                             ------------------------------

 AIX 6.1 POWER System                     - None
 AIX 7.1 POWER System                     - None
 

________________________________________________________________________ 


 Solaris 10 SPARC                         - Update 10
 Solaris 11 SPARC                         - None


________________________________________________________________________ 


 Red Hat Enterprise Linux (RHEL)
        5 Advanced Platform x86-64        - None
        Server 6 x86-64                   - None

 SUSE Linux Enterprise Server (SLES)
        10 x86-64                         - None
        11 x86-64                         - None


 ________________________________________________________________________ 


 Red Hat Enterprise Linux (RHEL)
        Server 6 System z                 - None
        5 Advanced Platform System z      - None

 SUSE Linux Enterprise Server (SLES)
        10 System z                       - None
        11 System z                       - None


 ________________________________________________________________________ 


 Windows Server 2008                      - None
     Enterprise Edition x86-64
     Standard Edition x86-64

 Windows Server 2008 R2                   - None
     Enterprise Edition x86-64
     Standard Edition x86-64

 Windows Server 2012 R2                   - None

 ________________________________________________________________________ 

 Additional Certifications:


 Windows Server 2012 Standard edition

 WebSphere 8.5 and DB2 10.1             ISAM 700 with Fix Pack 02 or later
					for following components only:
					PDJRTE    (PD Java Runtime)
					PDWPM     (PD Web Portal Manager)

 OSDB certification for ISAM 7.0 with WAS 8.5.0.2 and DB2 10.1 on:
          -Windows  Server2008 R2 (64 bit)
          -AIX 6.1 (64 bit)
          -RHEL 6.2 (64 bit)

 ________________________________________________________________________ 

 Additional Registry Certifications:


 Active Directory 2012

 OpenLDAP 2.4.33


 ________________________________________________________________________ 
 
 Deprecations:

 The use of CARS (Common Auditing and Reporting Service) is now
 deprecated.  Future releases of TAM will not support this service.


 ________________________________________________________________________ 


1.3 Patches superseded

 Patches superseded by this patch:


   7.0.0-ISS-SAM-IF0023
   7.0.0-ISS-SAM-IF0022
   7.0.0-ISS-SAM-FP0018
   7.0.0-ISS-SAM-FP0015
   7.0.0-ISS-SAM-FP0012
   7.0.0-ISS-SAM-FP0010
   7.0.0-ISS-SAM-FP0008
   7.0.0-ISS-SAM-FP0005
   7.0.0-ISS-SAM-FP0003
   7.0.0-ISS-SAM-FP0002
   7.0.0-ISS-SAM-FP0001

1.4 Dependencies

 IBM Security Access Manager for Web, Version 7.0 with patch 7.0.0-ISS-SAM-IF0022
 IBM Security Utilities
 GSKit Version 8.0.50.63


2.0 APARS AND DEFECTS FIXED
---------------------------
 Because patches are cumulative, this patch corrects all the problems
 outlined in the following sections.

2.1 Problems fixed by patch 7.0.0-ISS-SAM-IF0024

 APAR IV84593
 Symptom: Updating GSKIT to version 8.0.50.64 to resolve identified issues

 APAR IV84594
 Symptom: Java update required to resolve identified issues

 APAR IV84606
 Symptom: Kerberos update required to resolve identified issues


2.2 Problems fixed by patch 7.0.0-ISS-SAM-IF0023

 APAR IV83497
 Symptom: Upgrade IBM GSKit to version 8.0.50.59


2.3 Problems fixed by patch 7.0.0-ISS-SAM-IF0022

 APAR IV81893
 Symptom: UPGRADE JAVA TO INCLUDE SLOTH FIX.

 APAR IV81893
 Symptom: UPGRADE JAVA TO INCLUDE QUARTERLY UPDATES.

 APAR IV81901
 Symptom: UPGRADE JAVA TO INCLUDE WINDOWS INSTALLER ISSUE.


2.4 Problems fixed by patch 7.0.0-ISS-SAM-IF0021

 APAR IV80988
 Symptom: Upgrade of GSkit to latest available version to resolve reported issues.


2.5 Problems fixed by patch 7.0.0-ISS-SAM-IF0019

 APAR IV78807
 Symptom: Allow WebSEAL to support HTTP Strict Transport Security

2.6 Problems fixed by patch 7.0.0-ISS-SAM-FP0018

 APAR IV72852
 Symptom: pdbackup using pdinfo .lst does not complete when language packs are
          installed

 APAR IV73153
 Symptom: TAM updates for the Bar Mitzvah security issue.

 APAR IV73779
 Symptom: ISAM700 Using URI for CRL checking causes GSKit to result
          in GSK_HTTPCLN_ERR_CONTENT_TOO_BIG_ERROR

 APAR IV74442
 Symptom: password valid false overrides time of day restritions

 APAR IV75368
 Symptom: certificate validation failing for certificates containing plus
          characters

 APAR IV76848
 Symptom: upgrading IBM GSKit to version 8.0.50.47

 APAR IV76844
 Symptom: Upgrading Java SDK 6.0 service refresh 16 fixpack 7 for
          IBM Java runtime technology

 APAR IV75303
 Symptom: Upgrading Java to include April 2015 updates

 APAR IV75327
 Symptom: Upgrading IBM GSKit to resolve malformed ECParameters security issues


2.7 Problems fixed by patch 7.0.0-ISS-SAM-FP0015

 APAR: IV26894
 Symptom: TAM JAVA certs not refreshed automatically

 APAR: IV69480
 Symptom: ISAM 7.0 CHGPWD can corrupt .sth file

 APAR: IV69349
 Symptom: login failure can occur with 2'nd and 3'rd alternative logins

 APAR: IV69878
 Symptom: cannot create user with "=" in userid

 APAR: IV71062
 Symptom: unnecessary memory consumption in ISAM 700

 APAR: IV72935
 Symptom: Webseal/SMS-related stability fix

 APAR  IV73149	
 Symptom:  "Bar Mitzvah" vulnerability ( CVE-2015-2808 ) fixes


2.8 Problems fixed by patch 7.0.0-ISS-SAM-FP0012

 APAR: IV68415
 Symptom: WebSphere Portal 8 configuration task  "ConfigEngine.sh
          validapte-pdadmin-connection" fails when using PD.jar

 APAR: IV68411
 Symptom: WPM doesn't trim the space character at the beginning of the DN

 APAR IV70922
 Symptom : GSKit vulnerable to FREAK (Ephemeral RSA vulnerability)
	   This issue is fixed in GSKit Version 8.0.50.41

 APAR IV70910	
 Sympton: MIT Kerberos Upgrade

 APAR IV70891
 Symptom : Poodle v2 - TLS padding vulnerability affecting GSKit consumers
           This issue is fixed in GSKit Version 8.0.50.41. After upgrading to
           GSKit Version 8.0.50.41 or latter, if any connection issues
           are encountered in the deployment, then set the following
           GSKit environment varaible system wide to turn off the fix
           and restart all Access Manager processes:

  	   GSK_STRICTCHECK_CBCPADBYTES = GSK_FALSE

           Note that the default value for this variable is GSK_TRUE.


2.9 Problems fixed by patch 7.0.0-ISS-SAM-FP0010

 APAR: IV64911
 Symptom: JAVA SDK update required

 APAR: IV65013
 Symptom: Config option for failover cookie name

 APAR: IV58975
 Symptom: FIXPACK TIVSECUTIL INSTALLATION BREAKS INSTALL PATH


2.10 Problems fixed by patch 7.0.0-ISS-SAM-FP0008

 APAR IV59638
 Symptom: Policy Server and Webseal fail to start after configuring CARS

 APAR IV61692
 Symptom: Cannot activate trace on Policy Server in pdadmin with non-
          default TAM domain

 APAR IV51500
 Symptom: Log timestamp offset wrong by one hour in message log

 APAR IV56677
 Symptom: Webseal log files not accessible from LMI or Webservice

 APAR IV56691
 Symptom: Webseal stability fix under certain conditions using AD-LDAP

 APAR IV56846
 Symptom: Memory leak under rare conditions

 APAR IV60055
 Symptom: Automatic certificate refresh failure

 APAR IV60365
 Symptom: Webseal does not start with remote Syslogd enabled

 APAR IV61511
 Symptom: Pdmgrd audit log sometimes contains "0x00" (null) instead
          of "0x0a" (linefeed)

 APAR IV62845
 Symtom: Need to provide ldap timeout options for Java Registry Direct APIs


2.11 Problems fixed by patch 7.0.0-ISS-SAM-FP0005

 APAR IV58960
 Symptom: ISAM Registry Direct Java API does not allow escaping of any
          special character present in user ID

 APAR IV50296
 Symptom: WPM does not handle space in the file path specifying fsso.conf
          file

 APAR IV58962
 Symptom: AuthznRule not bypassed by when "R" action set on ACL under
          certain migration scenarios

2.12 Problems fixed by patch 7.0.0-ISS-SAM-FP0003

 APAR IV37416
 Symptom: Problem using RSA token authentication on Windows platform

 APAR IV52357
 Symptom: Memory leak under certain conditions when using Active Directory
          as registry

 APAR IV42380
 Symptom: Certain pdadmin commands do not work after installing the
          Japanese Language Pack

 APAR IV53471
 Symptom: When enable-last-login=yes in the WebSEAL configuration file, 
          WebSEAL behaves as if cache-return-registry-id=yes

 APAR IV53463
 Symptom: Memory leak under certain conditions when using Active Directory
          as registry

 APAR IV44093
 Symptom: pdconfig crash on Windows during migration

 APAR IV44180
 Symptom: pdconfig failure during migration when missing ivmgrd.conf.obf
          file

 APAR IV53501
 Symptom: Group import failure under certain conditions when using Java
          admin api

 APAR IV46684
 Symptom: PDContext call not returning when pdmgrd is not running

 APAR IV53473
 Symptom: Command "amuvu -dilmt" returns invalid month

 APAR IV53477
 Symptom: Webseal memory leak under rare load conditions

 APAR IV53528
 Symptom: Threading issues when using PD.jar in WebSphere

 APAR IV50334
 Symptom: Server stability fix for extensive scaling.

2.13 Problems fixed by patch 7.0.0-ISS-SAM-FP0002

 APAR IV50049
 Symptom: Improve WebSEAL integration with RBA 

 APAR IV50137
 Symptom: During Java API certificate refresh on Windows, the KS file 
          cannot be restored if the disk is full.

 APAR IV50138
 Symptom:  Improve error checking and recovery for internal certificates
           when they reach half life.

 APAR IV44180
 Symptom:  DOCUMENTATION UPDATE REGADING ISAM 2-SYSTEM UPGRADE 
           FAILS WHEN OBFUSCATED FILE IS MISSING 

 APAR IV48007
 Symptom:  DOCUMENTATION UPDATE REGADING WHEN IMPORTING ACTIVE DIRECTORY GROUP, 
           THE NAME OF THE ISAM GROUP MUST BE SAME AS sAMACCOUNTNAME

2.14 Problems fixed by patch 7.0.0-ISS-SAM-FP0001

 APAR IV37767
 Symptom: LD_PRELOAD SHOULD BE REPLACED WITH LD_PRELOAD_32 FOR SOLARIS
          ENVIRONMENT.
          In Solaris, if LD_PRELOAD_32 is set in the environment then
          it ignores LD_PRELOAD, so pdweb_script should be updated and
          occurrences of LD_PRELOAD should be replaced with LD_PRELOAD_32.

 APAR IV37751
 Symptom: TRACE ADMIN FOR STATS GET LEAKS MEMORY.
          WebSEAL process memory increases, when running pdadmin command
          "stats get" for WebSEAL.

          For example:
              pdadmin -a <user> -p <pw> server task <serverName> stats get
              pdadmin -a <user> -p <pw> server task <serverName> stats reset


 APAR IV37754
 Symptom: CAN NOT USE NUMBERS FOR DOMAIN NAME ON WINDOWS.
          On Windows, numbers cannot be used in the Management Domain Name.

 APAR IV37748
 Symptom: LDAP_DECODING_ERROR ENCOUNTERED IN ITDS PROXY/CLIENT.
          When Security Access Manager is configured using IBM Directory
          Proxy Server and "enhanced-pwd-policy=yes", Security Access Manager
          fails to parse the IBM Directory password control information
          received from the backend IBM Directory Server.

 APAR IV36491
 Symptom: WPM ACL MEMBERSHIP TAB FOR USER AND GROUP BIDI ISSUE

          In WPM user and group properties, the ACL membership tab has a
          bidirectional language issue for the following columns:
              Attached to the Objects
              Permissions

          Data in these columns is unreadable because its natural text direction
          is left to right (LTR), but the data displays right to left (RTL).

          LTR direction and left alignment should be enforced for the two
          columns. Data should display exactly the same for both English and 
          bidirectional languages.

 APAR IV36659
 Symptom: WPM POLICY ACCOUNT EXPIRATION MONTH MISSING HEBREW TRANSLATION

          In the account expiration date section of the WPM user properties
          policy tab, the month drop-down box is not translated in Hebrew for
          the months of April, August, and December.
  
 APAR IV36708
 Symptom: Can't configure Security Access Manager Runtime on Active Directory 
          with SSL if the non-SSL port is unavailable.
          If a user has somehow disabled the LDAP non-SSL port (normally 389) 
          for Active Directory, the configuration of the Runtime will fail since 
          it was attempting to contact Active Directory using the non-SSL port.
  
 APAR IV36745
 Symptom: PROBLEM WITH SSL HANDSHAKE IN IBM SECURITY ACCESS MANAGER 7 WITH
          GSKIT 8
          When resuming an SSL session, a data corruption occurs and the
          handshake fails. This failure can happen in several ways showing
          different errors in the WebSEAL logs.  In a network trace, this
          failure can be see as a handshake that fails, with an alert from the
          server and with an alert from the client (two ways).

          For example the following errors might be seen in the logs:

          Case 1:

          <date> 0x38AD54BA webseald WARNING wiv ssl SSLConnection.cpp
          2036 0x<thread> DPWIV1210W Function call, gsk_secure_soc_init,
          failed error:  0000019f GSK_ERROR_BAD_PEER.

          <date> 0x38CF07E9 webseald WARNINGwwa jct RemoteJunction.cpp
          1799 0x<thread> DPWWA2025W IBM Security Access Manager WebSEAL
          has lost contact with junction server:  <junction host>

          Case 2:

          <date> 0x38AD54BA webseald WARNING wiv ssl SSLConnection.cpp
          2036 0x<thread> DPWIV1210W Function call, gsk_secure_soc_init,
          failed error:  0000019a GSK_ERROR_BAD_MESSAGE.
 
          <date> 0x38CF07E9 webseald WARNING wwa jct RemoteJunction.cpp
          1799 0x<thread> DPWWA2025W IBM Security Access Manager WebSEAL
          has lost contact with junction server:  <junction host>
 
          Case 3:
          <date> 0x38AD54BA webseald WARNING wiv ssl SSLConnection.cpp
          2036 0x<thread> DPWIV1210W Function call, gsk_secure_soc_init,
          failed error:  000001a4 GSK_ERROR_SOCKET_CLOSED.

          <date> 0x38CF07E9 webseald WARNING wwa jct RemoteJunction.cpp
          1799 0x<thread> DPWWA2025W IBM Security Access Manager WebSEAL
          has lost contact with junction server:  <junction host>

          This issue is fixed with GSKit Version 8.0.50.55

 APAR IV36821
 Symptom: ILMT Tag file changes from ILMT team review
          If the amuvu tool is run on a Windows system, and the -dilmt 
          parameter is passed, the <InstanceID> entry in the output 
          ILMT tag uses backslash \ path separator characters instead 
          of front slash / path separator characters.

 APAR IV36822
 Symptom: "poldown" script has the wrong variable name.
          In a Policy Server HA environment, if the standby policy server goes
          down, the poldown script fails and leaves the environment in a
          state where all IBM Security Access Manager servers are stopped.
          Also, the pd.conf configuration file is incorrect for the
          master-host, boot-start-ivmgrd, and boot-start-ivacld entries.
          
 APAR IV36823
 Symptom: Certificate refresh can fail with an exception.
          When the Security Access Manager client certificate is automatically
          refreshed, the refresh can fail with the exception:
          [java.lang.IllegalStateException:
          [
          HPDMG0162E   ASN1 decode error {0} occurred.  The certificate buffer
          received is invalid and cannot be decoded.
          ]

 APAR IV36827
 Symptom: The Security Access Manager Java(R) API certificate auto refresh fails
          if 1 day from end of life. 
          When using a Java Runtime that supports the new form of the method 
          com.ibm.security.certclient.PkEeCertReqFactory.newCertRequest(),
          if the automatic certificate is enabled and the certificate 
          to be refreshed is less than 1 day from expiring, the Security Access
          Manager Java API application fails and throws the following exception:
          com.ibm.security.certclient.base.PkRejectionException

 APAR IV36828
 Symptom: The pdversion command shows the incorrect fix pack number on Linux
          The output of the pdversion command on Red Hat Enterprise Linux 6 has
          the wrong fix pack number.  For example:
            Security Access Manager Runtime              7.0.0.08664
            Security Access Manager Policy Server        7.0.0.08664
          Note the extra 8664 after the Fix Pack number 0 in this case.

 APAR IV36831
 Description: A new tool, amuvu, is introduced in IBM Security Access Manager 
          for Web.  This tool allows an Administrator to retrieve a count of 
          users in an LDAP registry. For syntax information, see the IBM 
          Security Access Manager for Web Command Reference in the IBM
          Security Access Manager for Web Information Center.

 APAR IV37009
 Symptom: Memory related stability fix.

 Feature 113339
 Symptom: Certificate refresh Error Handling
          Additional checks are added to ensure that before an attempt is 
          made to refresh a certificate that the system is in a state that 
          would allow that refresh to occur.  Checks are added for conditions 
          like, out of disk space.
          
3.0 BEFORE INSTALLING THIS PATCH
--------------------------------
 Before installing this patch, review the following prerequisites and
 dependencies.



3.1 Back up Security Access Manager data

 Before applying any maintenance, be sure to back up your system.  Use
 the pdbackup command provided with the Security Access Manager product
 to back up Security Access Manager-specific data. Documentation for the
 pdbackup command is located in the "IBM Security Access Manager for Web,
 Version 7.0, Command Reference".

 The patch installation for the PDRTE component installs the pd_start script
 as pd_start.fixpack.  This name prevents your current pd_start script from
 being overwritten during the installation.  If you are installing the fix pack
 on an AIX, Linux, or Solaris system or you have customized your pd_start
 script, consider making a backup copy of the pd_start script before you
 install the fix pack.  Depending on your use of the script, consider merging
 the content of your customized script with the content of the pd_start.fixpack
 script.

3.2 Upgrade GSKit to Version 8.0.50.59

 Note:
 IBM Global Security Toolkit (GSKit) version 7.0.4.33 and higher supports
 RFC 5746 (TLS Renegotiation Indication Extension). Therefore, the security
 exposure CVE-2009-3555 (TLS/SSL Protocol Vulnerability) is not applicable 
 to these versions of GSKit. 

 Upgrade the IBM Global Security Toolkit (GSKit) to version 8.0.50.59. 

 The updated GSKit installation packages can be downloaded from Fix Central
 where this patch is located.
 
 Instructions for installing GSKit may be found in the IBM Tivoli Access Manager
 for e-business Installation Guide, under the section "Reference information > 
 Installing prerequisite products".


4.0 INSTALLING THIS PATCH
-------------------------

   Please see section 3.2


5.0 UNINSTALLING THIS PATCH
---------------------------

   Please see section 3.2


6.0 AFTER INSTALLING THIS PATCH
-------------------------------
 
   Please see section 3.2


7.0 DOCUMENTATION UPDATES
-------------------------

 The product documentation for IBM Security Access Manager for Web, Version
 7.0, can be found at the following Web address (entered as one line):

 http://pic.dhe.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=%2Fcom.ibm.isam.doc_70%2Fwelcome.html


7.1 SSL-V2-ENABLE ATTRIBUTE NOT DOCUMENTED (IV37756)

 In the Base Administration Guide the topic titled "ssl-v2-enabled" requires 
 an update.

 The correct [ssl] stanza entry is ssl-v2-enable.

 When you specify settings for SSL version 2, use ssl-v2-enable instead of 
 ssl-v2-enabled.


7.2 UNDO THE NEGATIVE VALUE WORKAROUNDS (IV37013)

 In the Command Reference, the topic titled "config modify" requires an update.

 To specify a negative value, end the option with a dash (-) and specify the
 value with a dash before it. For example:
 
 config modify keyvalue append /opt/pdweb/etc/webseald-default.conf content-mime-types */* -  -1
 
 In this example, the value */* = -1 is added to the [content-mime-types]
 stanza. Without the dash (-) after */*, the -1 would be read as an option
 instead of a value and an error would be returned.


7.3 ISAM 2-SYSTEM UPGRADE FAILS WHEN OBFUSCATED FILE IS MISSING (IV44180)

 ISAM 2-System Policy Server upgrade to ISAM700 might fail if the existing 
 TAM Policy Server does not have ivmgrd.conf.obf file that is referred to 
 by ivmgrd.conf file.

 Very earlier releases of TAM did not utilize obfuscation, as such, if a 
 Customer had started with one of those earlier TAM Policy Server and kept 
 on upgrading to e.g. TAM610, it is possible that this current 610 Policy 
 Server may not have ivmgrd.conf.obf file which contains the obfuscated 
 password referred to by the "bind-pwd" entry in the 
 [ldap] stanza of ivmgrd.conf file.

 In a situation like that, before starting the upgrade process of the 
 existing Policy Server, it is recommened to generate the ivmgrd.conf.obf 
 file manually and then follow the ISAM700 upgrade guide.

 Follow these steps to generate ivmgrd.conf.obf file:

 a) Before doing anything else, make a backup of the entire "etc" directory 
   i.e. "C:\Program Files\Tivoli\Policy Director\etc" 

 b) Note the value of "bind-pwd" in ivmgrd.conf file in [ldap] stanza, after
    noting the value, remove the line containing "bind-pwd" from ivmgrd.conf
    file i.e.

    pdadmin -l config show \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" ldap bind-pwd

    pdadmin -l config modify remove \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" ldap bind-pwd

    Type the whole command in a single line ( backslash "\" means it is a
    continuation of a line )


 c) Now, obfuscate the password using the following command:

    pdadmin -l config modify keyvalue set -obfuscate \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" \
     ldap bind-pwd <xxxxx>
    
    Type the whole command in a single line ( backslash "\" means it is a 
    continuation of a line ) and replace <xxxxx> with the value that was 
    noted in step b) above for "bind-pwd"

 d) Verify that value of "bind-pwd" got obfuscated using the command:

    pdadmin -l config show \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" ldap bind-pwd

    Type the whole command in a single line ( backslash "\" means it is a
    continuation of a line )

    This command should show the value of "bind-pwd" that was used in step c)

    Also make sure that a ivmgrd.conf.obf file was created in

    "C:\Program Files\Tivoli\Policy Director\etc" directory, and that a
    "file" entry was added to the [configuration-database] stanza:

    pdadmin -l config show \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" file configuration-database


 e) Re-start the Policy Server and make sure that you can login using
    "sec_master" and try to perform some basic task to verify functionalities 
    to make sure that the Policy Server is working properly.
 
 f) Now follow the ISAM700 Upgrade Guide as usual.

7.4 WHEN IMPORTING ACTIVE DIRECTORY GROUP, THE NAME OF THE ISAM GROUP 
    MUST BE SAME AS SAMACCOUNTNAME (IV48007)

 When ISAM is configured with Active Directory as registry and an existing
 Active Directory group is being imported into ISAM, the ISAM group name
 must be same as the sAMAccountName of the group in Active Directory, 
 otherwise importation of that group may fail with message indicating
 "Group is not defined in the Registry".


7.5 DOCUMENTATION SHOULD NOT SHOW OPTIONS TO SPECIFY ENCRYPTION SEED AND 
    SALT FOR IDSIMIGR COMMAND (IV47078)

 IBM Security Access Manager for Web Version 7.0, Upgrade Guide, section:
 "Appendix: Upgrade utilities", command "idsimigr" mistakenly included invalid 
 options "-e" and "-g", and omitted valid options "-G" and "-w".
 The corrected Syntax and Description of Parameters of the command are below:

  Usage: idsimigr [-I instance_name [-u backup_dir] [-p port]
            [-s secure_port] [-a adm_port] [-c adm_secureport] [-t db_instance]
            [-i ipaddress] [-l inst_location] [-r description] [-G group_name]
            [-w user_password] [-d debug_level] [-b output_file] 
            [-q] [-n]] | -v | -?
  Parameters:

   -?                Displays the usage.

   -a adm_port       Specifies the port the directory administration server will 
                     listen on.
   -b output_file    Specifies the full path of a file in which to
                     redirect output. If this option is used in conjunction with
                     the -q option, only errors will be sent to the file.
                     If debugging is turned on, debug output will be sent
                     to this file also.
   -c adm_secureport Specifies the secure port the directory administration server 
                     will listen on.
   -d debug_level    Sets the debug level.
                     Use in conjunction with the ldtrc command.
   -G group_name     Specifies the name of primary group of the new user. This parameter is
                     required if the user is to be created. It is valid only on AIX, Linux,
                     and Solaris systems.
   -i ipaddress      Specifies the IP addresses to which the directory server
                     instance will bind.  If more than one is specified,
                     the comma separator is required with no spaces. Use
                     the key word 'all' to specify to use all available
                     IP addresses. All available IP addresses is assumed if
                     this option is not specified.
   -I instance_name  Specifies the name of the directory server
                     instance to create or migrate. The instance name must be an
                     existing user ID on the computer and must be no greater
                     than 8 characters in length.
   -l inst_location  The location to store the directory server instance's
                     configuration files and logs. On Windows systems, this option is
                     required and a drive letter must be specified. There must
                     be at least 30 MB free.
   -n                Run in no-prompt mode. All output is generated except for
                     messages requiring user interaction.
   -p port           The port of the directory server instance.
   -q                Run in quiet mode. All output is suppressed except for errors.
                     If the -d option is also specified, trace output
                     is not suppressed.
   -r description    A description of the directory server instance.
   -s secure_port    The secure port of the directory server instance.
   -t db_instance    DB2 database instance name. The database instance name
                     is also the DB2 instance owner ID. By default, the database
                     instance name is assumed to be the same as the directory
                     server instance owner ID.  If there is database instance
                     information in the backed up configuration file that is still valid
                     for the system, that information will be used instead.
   -u backup_dir     The directory where the schema and configuration
                     files to be migrated have been saved.
   -v                Prints the version information for this command.
   -w user_password  Password of the new user to be created.  This parameter is
                     required if the user is to be created.


7.6 RDJAPI DOESN'T ALLOW FOR ESCAPING THE "*" ASTERISK (IV43899)

 ISAM RDJAPI does not allow for escaping any special characters present in a
 user search filter. Use the following option in the properties file to turn
 on the ability to escape special characters like '*' present in the user ID:

   ldap.allow-quote-pattern = true


 The default value for this option is false.


7.7 IRA ENVIRONMENT VARIABLES DO NOT TAKE PRECEDENCE OVER THEIR
    [LDAP] STANZA SETTINGS (IV55360)

 IBM Security Access Manager for Web Version 7.0, Performance Tuning Guide,
 Chapter "Tuning Security Access Manager components", section "IRA cache 
 tuning information" mistakenly indicates that IRA environment variables,
 if they exist, take precedence over their counter parts in the [ldap] stanza 
 settings of the configuration file, actually it is other way around, it is
 the [ldap] stanza settings that take precedence over IRA environment variables.
 In addition, the following environment varialbles are completely ignored
 in favour of the values provided in the configuration file or a default
 value is used.

 Environment variable name     configuration key name   default value
 ===========================   ======================   =============
 IRA_CACHE_GROUP_MEMBERSHIP    cache-group-membership      TRUE
 IRA_CACHE_USER_VALID_FLAGS    cache-use-user-cache        TRUE
 IRA_CACHE_RETURN_REGISTRY_ID  cache-return-registry-id    FALSE
 

7.8 INSTALL_ISAM.SH DOES NOT INSTALL CONFIGURE_ISAM.SH FOR WPM (IV60752)

 IBM Security Access Manager for Web, Version 7.0, Installation Guide,
 chapter "Setting up a Web Portal Manager", section "Automating the 
 configuration of Web Portal Manager" instructs the execution of the 
 script called "configure_isam.{sh|cmd}" which may not be available as 
 that script is part of the "Security Access Manager Runtime" 
 (i.e. PDRTE) package which may or may not be already installed in the 
 system as installation command  "install_isam.{sh|cmd} -i WPM ......" 
 does not install PDRTE package by default.

 So "Security Access Manager Runtime" (i.e. PDRTE) package need to be 
 installed before configuration of WPM.
   

7.9 ACL name now is restricted 8192 characters long (118749)

  IBM Security Access Manager for Web Version 7.0, Administration Guide,
  Appendix D. User registry differences, section "Length of names"
  indicates that length of ACL name is unlimited.
  From now on, ACL name will be limited to 8192 characters long.

7.10 WPM DOESN'T TRIM THE SPACE CHARACTER AT THE BEGINNING OF THE DN (IV68411)

  By default, WPM does not remove the leading/trailing spaces present in the
  "Registry UID" i.e. ldapdn field of "Create User" panel while creating 
  a user using WPM. To remove any such inadvertent spaces present in the 
  "Registry UID" field, use the following option in the amconf.properties 
  file which is located in "<WAS_HOME>/AppServer/systemApps/isclite.ear/
  iscwpm.war/WEB-INF/classes" directory)
	
      [pdwpm]
         trimUserDN = true

  Default value for this option is "false".


7.11 CANNOT CREATE USER WITH "=" IN USER ID (IV69878)

  It is highly recommended not to use equal sign ('=') character in Access 
  Manager userID when Access Manager is configured against LDAP as User 
  Registry.
  It is already documented not to use equal sign ('=') character in UserID
  when Access Manager is configured using Active Directory as User Registry.
  For LDAP as User Registry, since equal sign ('=') character  was not explicitly 
  disallowed in prior releases, if an environment is upgraded to ISAM 700 from
  a prior version and there exist some userIDs which contain equal sign
  character, use the following option, in ldap.conf file, to have those userID 
  to work in ISAM 700:

    [ldap]
	equal-sign-in-userid-enabled = yes


  The default for this option is no/false.

  NOTE:
  Beware that some functionality may not work for users whose userID contains
  equal sign ('=') character.


8.0 SOFTWARE LIMITATIONS
------------------------

 None.



9.0 KNOWN PROBLEMS AND WORKAROUNDS
------------------------------------------------

 None.



10.0 NOTICES
 ------------
 This information was developed for products and services offered in the U.S.A.
 IBM may not offer the products, services, or features discussed in this
 document in other countries. Consult your local IBM representative for
 information on the products and services currently available in your area. Any
 reference to an IBM product, program, or service is not intended to state or
 imply that only that IBM product, program, or service may be used. Any
 functionally equivalent product, program, or service that does not infringe
 any IBM intellectual property right may be used instead. However, it is the
 user's responsibility to evaluate and verify the operation of any non-IBM
 product, program, or service. IBM may have patents or pending patent
 applications covering subject matter described in this document. The
 furnishing of this document does not give you any license to these patents.
 You can send license inquiries, in writing, to:
 
 IBM Director of Licensing
 IBM Corporation
 North Castle Drive
 Armonk, NY 10504-1785
 U.S.A.
 
 For license inquiries regarding double-byte (DBCS) information, contact the
 IBM Intellectual Property Department in your country or send inquiries, in
 writing, to:
 
 IBM World Trade Asia Corporation
 Licensing
 2-31 Roppongi 3-chome, Minato-ku
 Tokyo 106, Japan
 
 The following paragraph does not apply to the United Kingdom or any other
 country where such provisions are inconsistent with local law: INTERNATIONAL
 BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
 WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
 TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
 A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
 implied warranties in certain transactions; therefore, this statement may not
 apply to you.
 
 This information could include technical inaccuracies or typographical errors.
 Changes are periodically made to the information herein; these changes will be
 incorporated in new editions of the publication. IBM may make improvements
 and/or changes in the product(s) and/or the program(s) described in this
 publication at any time without notice.
 
 Any references in this information to non-IBM Web sites are provided for
 convenience only and do not in any manner serve as an endorsement of those Web
 sites. The materials at those Web sites are not part of the materials for this
 IBM product and use of those Web sites is at your own risk.
 
 IBM may use or distribute any of the information you supply in any way it
 believes appropriate without incurring any obligation to you.
 
 Licensees of this program who wish to have information about it for the
 purpose of enabling: (i) the exchange of information between independently
 created programs and other programs (including this one) and (ii) the mutual
 use of the information that has been exchanged, should contact:
 
 IBM Corporation
 2Z4A/101
 11400 Burnet Road
 Austin, TX 78758
 U.S.A.
 
 Such information may be available, subject to appropriate terms and
 conditions, including in some cases, payment of a fee.
 
 The licensed program described in this document and all licensed material
 available for it are provided by IBM under terms of the IBM Customer
 Agreement, IBM International Program License Agreement or any equivalent
 agreement between us.
 
 Any performance data contained herein was determined in a controlled
 environment. Therefore, the results obtained in other operating environments
 may vary significantly. Some measurements may have been made on
 development-level systems and there is no guarantee that these measurements
 will be the same on generally available systems. Furthermore, some measurement
 may have been estimated through extrapolation. Actual results may vary. Users
 of this document should verify the applicable data for their specific
 environment.
 
 Information concerning non-IBM products was obtained from the suppliers of
 those products, their published announcements or other publicly available
 sources. IBM has not tested those products and cannot confirm the accuracy of
 performance, compatibility or any other claims related to non-IBM products.
 Questions on the capabilities of non-IBM products should be addressed to the
 suppliers of those products.
 
 All statements regarding IBM's future direction or intent are subject to
 change or withdrawal without notice, and represent goals and objectives only.
 
 This information contains examples of data and reports used in daily business
 operations. To illustrate them as completely as possible, the examples include
 the names of individuals, companies, brands, and products. All of these names
 are fictitious and any similarity to the names and addresses used by an actual
 business enterprise is entirely coincidental.
 
 

10.1 Trademarks
 
 The following terms are trademarks or registered trademarks of International
 Business Machines Corporation in the United States, other countries, or both:
 
 AIX
 IBM
 IBM logo
 iSeries
 pSeries
 S/390
 Tivoli
 Tivoli logo
 xSeries
 
 Java and all Java-based trademarks and logos are trademarks or registered
 trademarks of Oracle and/or its affiliates.
 
 Linux is a registered trademark of Linus Torvalds in the United States, other
 countries, or both.

 Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
 Microsoft Corporation in the United States, other countries, or both.
 
 UNIX is a registered trademark of The Open Group in the United States and
 other countries.
 
 Other company, product, and service names may be trademarks or service marks
 of others.
 
 
 
 End of IBM Security Access Manager for Web, Patch 7.0.0-ISS-SAM-IF0024 README
