Date: Jun 22, 2017

FIX PACK: 5.2.2.1-ISS-SIGI-IF0002.README

This is the upgrade path to IGI 5.2.2 Interim Fix 2 for current customers who are using IBM Security Identity Governance and Intelligence v5.2.2.1.  
This README has been generated to provide key information to upgrade to v5.2.2.1 IF0002 from v5.2.2.1  Product Release Notes will not be generated.


NOTICE:
The current documentation in Knowledge Center for IBM Security Identity Manager is located at:
http://www-01.ibm.com/support/knowledgecenter/SSGHJR_5.2.2/com.ibm.igi.doc/kc-homepage.html


COMPONENTS:
An Appliance Interim Fix for IBM Security Identity Governance and Intelligence.


MULTIPLE SECURITY VULNERABILITIES FIXED in v5.2.2.1 IF0002.
For more information view the IBM Product Security Incident Response Team blog at:
http://www.ibm.com/blogs/PSIRT
Customers are encouraged to sign up for product notifications at My Notifications:
http://www-01.ibm.com/software/support/einfo.html


DEPENDENCIES:
You must have IBM Security Identity Governance and Intelligence v5.2.2.1 product installed, configured, and working.


FIX CONTENTS:
5.2.2.1-ISS-IGI-IF0002.README
5.2.2.1-ISS-IGI-IF0002.fixpack
DBUpdate.zip

MD5 CHECKSUMS:
6a135e83f76502ea85519bd3bded757a	5.2.2.1-ISS-IGI-IF0002.fixpack
1800438b8be088823892a2676c4a147b 	DBUpdate.zip


								 

List of APARS

IV94957	NOT SET THE FIELD LAST_CERT_TIME ON REVIEWED EMPLOYMENT.   
IV95237	RIGHTS LIST, IN ACCESS REQUEST, LIMITED TO ABOUT 100 ELEMENTS 
IV95317	ACCESS RISK CONTROLS DASHBOARD COUNTS  IS INCORRECT 
IV95482	ROLE PROCESSING GETS "CODE [721] ERROR DETAIL: OBJECT_NOT_FOUND  -JOBUNIT-"
IV95596	UNEXPECTED OBJECT_NOT_FOUND ERROR WITH  IUSER.ADDENTITLEMENTNODEFHIERGROUP                  
IV95640	TEST REPORT IN IGI SHOWS INCORRECT DATA
IV95644	CAN NOT SYNCHRONIZE CLUSTER MEMBER NODE 
IV95851	ACTIVITIES BY ENTITLEMENT REPORT EMPTY IN IGI 5.2.2 
IV95859	IGI MODIFY LABELS NOT EDITABLE
IV95945	ISSUE SAVING RULE FLOW VALUE ON USERS TAB OF CERTIFICATION DATASET
IV96035	UNABLE TO AUTHORIZE REQUEST ON IGI USING POSTGRESQL DB 
IV96358	UPDATING A USER ATTRIBUTES FAILS VIA LOAD
IV96401	OWNER IS MISSING ON ACCESS REQUEST ADD
IV97082	IGI - THE "DELETE ALL FILTERED" OPTION OF MONITOR TAB IS NOT  QUEUE SPECIFIC                                            
IV97134	UNABLE TO SEE VALUE OF USER_ERC CUSTOMIZED ATTRIBUTE IN USER MODIFY      
IV97136	DELETE ALL FILTERED OPERATION ON "IN ORG UNIT EVENTS" DOES NOT WORK
IV97247	CLICKING ON APPROVE ALL/REVOKE ALL  DOES NOT MAKE A CHANGE TO THE UI TO INDICATE THE BUTTON CLICK WORK.
IV97260	WRONG TITLE IN CONFIRMATION POPUP AFTER SUBMIT SELF SERVICE OPERATION 

IV96206	SYSROUTE IV96203	THE ACCESS REQUEST FOR A SINGLE USER SHOWS ONLY 100 ENTRIES AND ALL IN ONE PAGE.
IV95642	SYSROUTE IV94671	ACCESS REQUEST: REQUEST WITH STATE "FAILED COMPLETITION"
IV95880	SYSROUTE IV95876	SYSTEM ERROR WHEN ADDING OR REMOVING RESOURCES FOR DELEGATED ENTITLEMENTS
IV96625	SYSROUTE IV96624	PROBLEM ON DISMISS ROLE ACTION 
IV96636	SYSROUTE IV96631	SESSION OVERLAPPING ON ADMIN USER 
IV96959	SYSROUTE IV96957	IGI WIN AD TARGET RECONCILIATION HANG 


Defects:

163203  AGC - Funct column size in Feedback table
163188 	ARC: disable order for the column mitigation in user risk violation
163187 	ARCS: Some data tracks remain on db after sap system removal
163096 	AC - Signoff Optimization 	Luca Zinni
163074 	ILC - Reconciliation on AD does not remove deleted account
162848 	AGC > Hierarchy "simple, single value + user id hierarchy" does not work correctly.
162831 	AGC - Missing localization for assignable right description
162760 	AGC - The certification campaign is for an Account Dataset, With Account not accessed since set in Advanced settings.
162226 	ERC - SQLH object not available in ERC post/pre mapping rules
161717 	ARM - Wrong info audited when a delegated user authorize a request
161333 	EMAIL - Unable to send email when in the to filed are present a lot of addresses
161320 	AGC -  Error in the EVENT_TARGET/ADD_PERMISSION rule if the entitlement (ext role) is not yet present in the system
160551 	AC - Close campaign error in Oracle env
160549 	PD - Error in Modify User workflow
160494 	AC - Campaign error using a template with white a black list populated or a rule
160253 	AGC - IGroup.removeFromNoDefHierGroup issue
160239 	AGC - NullPointerException using IUser.removeEntitlementNotDefHier 
160233 	ARM - Redirect and execute action doesn't work from Daily Work (Code [407] Error Detail: User not authorized for any operation.)
160082 	AGC - User group info not reported if user belong to multiple groups in the same hierarchy
158561 	AGC - Hierarchy build with code longer than 128 char 
163292	AGC - User description field overwritten when the user details change
163316	ILC - Cannot remove last child external role

INSTALLING THIS FIX PACK

To install this fix pack, proceed as indicated in the link below:
https://www.ibm.com/support/knowledgecenter/SSGHJR_5.2.2/com.ibm.igi.doc/installing/tsk/t_installing_fix_pack.html
At the end of the installation process, no message is provided and the GUI restart, so the page must be refreshed.
Restart the VA when the page has been refreshed.

UPDATE DB	
Before updating the DB stop the all servers from the Server Control section in the Virtual Appliance. 
They can be restarted when the DB upgrade procedure ends.

UPDATE PostgreSQL DB contents

If you are using the PostgreSQL internal database, it is recommended to use external PostgreSQL utilities to make a backup of the data before you run the upgrade.

The data base is updated with the VA. No action is required. 

UPDATE Oracle DB content

Before proceeding with DB contents updates, it is recommended to make a backup of the DB.

Before you begin:

- You must have the Oracle Client installed.
- You must know the common database parameters such as the IP address, server port, and SID.

The following tags are used to customize the ISIG database installation

Tags	   | Description
----------------------------------------------------
IGISID     | Oracle Database instance name (SID)
----------------------------------------------------
DBServer   | Oracle Server IP address or DNS name
----------------------------------------------------
DBPort     | Oracle listener port
----------------------------------------------------

Procedure

1.	Configure the tnsnames.ora file. 

	a.	Log in with root privileges. 
	sudo su -

	b.	Switch to the oracle user. 
	sudo su oracle

	c.	Browse to the tnsnames.ora file. For example, oracle_home/db/network/admin 

	d.	Edit the file in a text editor. For example, vi

	e.	If the network instance is not configured correctly, add the following section: 
	
	<IGISID> =
	(DESCRIPTION =
	(ADDRESS_LIST =
	(ADDRESS = (PROTOCOL = TCP)(HOST = <DBserver>)(PORT = <DBport>)))
	(CONNECT_DATA =(SERVICE_NAME = <IGISID>)))

	f.	Check that the configuration is working by connecting to the database with the following command: 
	sqlplus system/<password>@<IGISID>


2.	After this procedure, extract the DBupdate.zip archive into your directory [EXTRACTION_DIR]

3.  Change the permissions of the [EXTRACTION_DIR] with the command chmod -R 777 [EXTRACTION_DIR] if you want to produce a log file with the update procedure>> 

4.	After the extraction, you can see this hierarchy of folders: [EXTRACTION_DIR]/dbupdate/

5.  If you didn't change the default IGI schema password jump to step 8 otherwhise go to step 7

6.  Change directory to [EXTRACTION_DIR]/dbupdate/oracle/IGI_5.2.2_CUMULATIVE/COMMON/

7.	Edit the 01-COMMON.sql and set the DEFINE IDEAS_SCHEMA_DEF_PASS key with the correct value. Then save the file.
    
8.  Change directory to [EXTRACTION_DIR]/dbupdate/oracle/IGI_5.2.2_CUMULATIVE/ and run, using the oracle userid, the script cumulative_patch.sql  as below


		sqlplus system/<PASSWORD>@<IGISID> @cumulative_patch.sql

    Verify into the created log files if the db updates were successfully executed


NOTE:
  ERROR at line xx:
	ORA-20200: CONNECTOR ALREADY EXISTS! 
	ORA-06512: at line yy".

 errors could be present in the log files and are expected.


UPDATE DB2 DB content


Before proceeding with DB contents updates, it is recommended to make a backup of the DB.

Before you begin:

- You must have the DB2 Client installed.
- You must know the common database parameters such as the IP address, server port and database name.

The following tags are used to customize the ISIG database installation

Tags           | Description
-------------------------------------------------------------
DBServer       | DB2 Server IP address or DNS name
-------------------------------------------------------------
DBPort         | DB2 instance port
-------------------------------------------------------------
IGI_DB         | DB2 database name
-------------------------------------------------------------
INSTANCE_OWNER | DB2 instance owner of the database instance
-------------------------------------------------------------
PASSWORD       | DB2 instance owner password
-------------------------------------------------------------
FQ_IGI_DB      | <DBServer>:<DBPort>/<IGI_DB>
-------------------------------------------------------------

Procedure

1.	Check the connection to the database with the following command: 
	clpplus -nw <INSTANCE_OWNER>/<INSTANCE_OWNER_PASSWORD>@<FQ_IGI_DB>

2.	After this procedure, extract the DBupdate.zip archive into your directory [EXTRACTION_DIR]

3.  Change the permissions of the [EXTRACTION_DIR] with the command chmod -R 777 [EXTRACTION_DIR] if you want to produce a log file with the update procedure>>

4.	After the extraction, you can see this hierarchy of folders: [EXTRACTION_DIR]/dbupdate/

5.  If you didn't change the default IGI schema password jump to step 8 otherwhise go to step 6

6.  Change directory to [EXTRACTION_DIR]/dbupdate/db2/IGI_5.2.2_CUMULATIVE/COMMON/

7.	Edit the 01-COMMON.sql and set the DEFINE IDEAS_SCHEMA_DEF_PASS key with the correct value. Then save the file.

8.  Change directory to [EXTRACTION_DIR]/dbupdate/db2/IGI_5.2.2_CUMULATIVE/ and modify the login.sql file by setting the appropriate connection string. See the following string:

DEFINE IGI_DB = xxx.xxx.xxx.xxx:yyyyy/zzz

xxx.xxx.xxx.xxx - DB2 Server IP address or DNS name aka <DBServer>
yyyyy           - DB2 instance port aka <DBPort>
zzz             - DB2 Database name aka <IGI_DB>

9.	Run the script cumulative_patch.sql using the instance_owner userid as below

		clpplus -nw <INSTANCE_OWNER>/<PASSWORD>@<DBServer>:<DBPort>/<IGI_DB> @cumulative_patch.sql

	Verify into the created log files if the db updates were successfully executed

NOTE:
  SQL0438N  Application raised error or warning with diagnostic text: "CONNECTOR
 ALREADY EXISTS!".

 errors could be present in the log files and are expected.
 

	
SOFTWARE LIMITATIONS

N.A.



NOTICES

Trademarks

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.

