File:   5.1.0.10-ISS-TIM-IF0038.README for ITIM 5.1 using IBM WebSphere Application Server.
Date:   May 29, 2012

Interim fix 5.1.0.10-ISS-TIM-IF0038 for APARs IV18149, IV19715, IV19692, IV19801, IV20225, IV20282, IV20283, IV21114, IV21331, IV21839, IV21840, IV21841 and IV21842.

Components:
        WebSphere update installer package for ITIM as needed for WebSphere Application Server V6.1 or 7.0.

General Description:
Contains accumulated fixes for problems encountered in IBM Tivoli Identity Manager (ITIM) Version 5.1.
The APAR numbers for all fixes included are listed under "Problems Fixed".  Refer to the specific APAR descriptions for more detail.
This and other featured documents for IBM Tivoli Identity Manager can be found at:
    http://www.ibm.com/software/sysmgmt/products/support/IBMTivoliIdentityManager.html

    Problems Fixed:

        APAR:    IV18149
        Symptom: When configuring the Global Policy Enforcement, if you select Alert, and then click Continue. You may receive the following error on the ITIM UI:
                        com.ibm.itim.apps.ApplicationException: CTGIMF007E The specified object cannot be found in the directory server. The object might have been moved or deleted before your request completed.

        APAR:    IV19715
        Symptom: When a non-admin authorized user submits a draft change to an existing provisioning policy, the operation fails with a CTGIMS009E authorization error.

        APAR:    IV19692
        Symptom: When a role is specified as the role owner, the notification mail for the role does not show the ITIM URL in the "View Changes" section.  However, when the role owner is a person, the correct ITIM URL is displayed in the notification mail.

        APAR:    IV19801        ROUTE OF IV11169        R58723
        Symptom: The javascript method PersonSearch.searchByFilter() is not closing LDAP connections.  It may result in WebSphere crashing with an OutOfMemory (OOM) error.

        APAR:    IV20225
        Symptom: The ITIM Fixpack installation overwrites the db2jcc.jar and the db2jcc_license_cu.jar files.  There is no documentation to advise customers the best way to update these drivers.
                 Documentation Update:
                 The update will be posted in a future revision of the Infocenter.
                 Please refer to the IV20225.pdf file, included in this maintenance package for this information if you need to update jdbc drivers.

        APAR:    IV20282
        Symptom: Documentation Update:
                 Wrong column name documented in the RECERTIFICATIONLOG table.
                 The following update will be posted in a future revision of the Infocenter.
        Note:    The section 2.7.1, which describes the RECERTIFICATIONLOG table schema, in the "Database and Directory Server Schema Reference" guide incorrectly states the name of the second to the last column as RECERT_SUMMARY. The correct name of the column is RESULT_SUMMARY. The "Database and Directory Server Schema Reference" guide in the InfoCenter will be updated in a future revision to show the correct column name.

        APAR:    IV20283
        Symptom: The Quick Start Guide for ITIM 5.1 should state that TCR is optional.
        Note:    The IBM Tivoli Identity Manager V5.1 QuickStart Guide, CF249ML and CZ45KML will be updated in a future revision to show the following correction indicating that TCR server installation is optional.
                 Step 6: Optionally install and configure your Tivoli Common Reporting Server
                 Install Tivoli Common Reporting Server, as described in the following link:
                 http://publib.boulder.ibm.com/infocenter/tivihelp/v3r1/index.jsp?topic=/com.ibm.tivoli.tcr.doc/tcr_welcome.html

        APAR:    IV21114
        Symptom: The title bar width of Activity Owners table is narrower than expected.           

        APAR:    IV21331
        Symptom: Informational Message Update
                 The instructional messages for scheduling a lifecycle rule or LCR in Configure System > Manage Life Cycle Rules > Define Schedule is wrong.  
                 The actual execution time, however, is run according to the ITIM server TZ.
        Note:    The corrections will be made in a future Release of ITIM.  An explanation/correction is stated below.
                 When defining the schedule for Lifecycle Rule via Configure System > Manage Life Cycle Rules > Define Schedule, the screen shows the message that "All times are on the Pacific Standard Time time-zone".  This message is incorrect if the timezone of the server running ITIM is not Pacific Standard Time. The Lifecycle Rule always gets scheduled on the server's timezone and not on the Pacific Standard Time zone.  So all times displayed on this page are on the ITIM server's time zone. This is true even in case when the client browser and server are on different timezones.  This instructional message will be corrected in a future version of ITIM.

        APAR:    IV21839        ROUTE OF IV11837        R57200
        Symptom: Passwords are logged in clear text with DEBUG_MAX set for logging in the ui.
        Note:    In addition to this fix, there are some methods in ITIM that store password information in the session. To prevent these session values from getting printed in the logs, please add the property "ideSessionValues" with the value set to true in the Websphere webcontainer settings for the Application server. Please execute the following steps.
                        1. In the WAS Admin Console, navigate to Application servers > serverName”
                        2. Under Container Settings click Web Container Settings > Web Container”
                        3. Under Additional Properties, click on Custom Properties
                        4. Add a new property with name "HideSessionValues" and set the value to "true". Save it and restart Websphere.

        APAR:    IV21840        ROUTE OF IV12348        R57201
        Symptom: When using the View Requests -> View All Requests page, and the user selects "Requested For user" as additional search criteria and performs an advanced search, a CTGIMU556E error may be displayed on the ITIM ui and the ITIM trace log reports the following exception:
                 <exception>
                 <![CDATA[java.lang.NullPointerException
                 at
                 com.ibm.itim.dataservices.model.domain.PersonSearch.searchByFilter(PersonSearch.java:363)

        APAR:    IV21841        ROUTE OF IV12705        R57202
        Symptom: When the form element for a service profile account attribute is defined through a search filter with the 'source attribute' different from the 'attribute' definition, and the attribute is enforced in a provisioning policy, the entilement parameters page shows the source attribute's value of the defining entity instead of the attribute's value.

        APAR:    IV21842        ROUTE OF IV20599        R60259
        Symptom: Documentation Update
                 Need to document the ITIM behavior when varchar2 data type for Oracle is used.
        Note:    The following update will be posted in a future revision of the ITIM Infocenter in the section of "Known Limitations, problems and workarounds".
                 The action text specified on any manual activity node (approval and RFI) is stored in the DESCRIPTION column of WORKITEM table. This column is defined to be of type varchar2(4000) for Oracle database. ITIM's Varchar2 column uses the Byte semantics as the default NLS_LENGTH_SEMANTICS value in Oracle is Byte, unless specified explicitly as a Char. So when ITIM tries to insert a value that is more than 4000 bytes in the DESCRIPTION column of WORKITEM table, an error ORA-01461 is thrown. Since the maximum limit of varchar2 data type in Oracle is 4000 bytes, the size of this column cannot be increased. This is a known limitation when Oracle is used as an ITIM Database.
                 The workaround is to avoid crossing the limit of 4000 bytes for this column. Since ITIM internally uses around 50 bytes, a user can specify a maximum of around 3950 bytes of action text. The number of characters that can be specified (in action text) depends on the character set from which the characters are used. ITIM internally uses UTF-8 encoding, so the maximum length of description depends on the number of bytes used by UTF-8 to store those characters.

    Old Problems Fixed from prior Interim Fixes:

        APAR:    IV14929
        Symptom: The deletion of an account owned by a Person who owns a large number of accounts uses a lot of memory.  If simulataneous delete operations are fired, this action may lead to an Out Of Memory condition, OOM.

        APAR:    IV15455
        Symptom: After upgrading from ITIM 4.6, the Date Widget will change the date even if the attribute displayed is not changed.  The Date Widget Alternative Date in ITIM 5.1 resets the hour to 12:00 GMT (even if the date attribute is not changed) when changing the person.

        APAR:    IV15616
        Symptom: ITIM is expected to log the service and account name in the ITIM log whenever the password change fails with an InvalidPasswordException.  The current DEBUG_MIN level message does not show the exact service and account name for which the password change operation failed if there are multiple accounts for the user.

        APAR:    IV15897
        Symptom: ITIM Server may hang during startup when the server startup services and the workflowQueue messages get processed simultaneously.

        APAR:    IV16021
        Symptom: If password synch is enabled and the password SelfPasswordManager.changeExpiredPassword() API is used, or while trying to change the expired password from the ITIM UI, ITIM logs unnecessary ApplicationException entries in the trace.log.  Although this doesn't cause any issues on the functionality, the logs gets flooded with ApplicationException entries.

        APAR:    IV16095
        Symptom: On pages where a link expands to show an item (tables, etc.), the user needs to be given an indication that the page has changed.  A sighted user can see the difference but a non-sighted user would not be able to tell the change has occured.
        Note:    The issue is fixed by adding the "aria-expanded" attribute to indicate the state of the twisty.  The fix will work on screen readers that recognize the “aria-expanded” attribute, for example JAWS (version 12.x and higher).  The fix will not work on earlier versions of JAWS and on other screen readers that do not recognize this attribute.

        APAR:    IV16790
        Symptom: When the size of an attribute configured as a listbox is set to 30 on the person form and READ_ONLY_ON_MODIFY is set for the same attribute, then the listbox does not appear correctly on the Change User page.  It reverts to the default size.

        APAR:    IV16876
        Symptom: ObjectWrapperManager returns incorrect wrapper class, SimpleObjectWrapper, for GroupEntity when performing a DirectoryObjectSearch that returns SearchResults containing GroupEntity objects.  The ObjectWrapperManager should wrap the results using DirectoryObjectWrapper class, because GroupEntity is a subclass of DirectoryObjectEntity.  A similar issue is fixed for Group Directory object 

        APAR:    IV16879
        Symptom: You may get an exception in the trace.log file when selecting the checkbox next to a user in the Manage Users screen:
                     com.ibm.itim.apps.ApplicationException: CTGIMH055E There are no existing accounts for this person.  The accounts may be inactive, or access is denied, or the account does not require a password.

        APAR:    IV16999
        Symptom: The use of the enrole.workflow.notifyoption needs to be clarified, the present documentation is incorrect and contradictory.
        Note:    DOCUMENTATION UPDATE:
                 The following update will be posted in a future revision of the Infocenter.
                 <ITIM infocenter documentation>
                 enrole.workflow.notifyoption
                 This property key and value should be changed only by a qualified administrator.
                 Specifies the behavior of workflow email notifications. Values can be:
                 0 (NOTIFY_NONE) - No email notifications will be sent by ITIM when the workflow process completes.
                 1 (NOTIFY_REQUESTER) – When the workflow process completes, the process completion notification will be sent to requester and account email notifications will be sent to requestee for the following account requests:  New Account, New Password, Change Account, Deprovision Account, Suspend Account, Restore Account. 
                 For example, In the case of new account request, when the workflow process completes, process completion notification will be sent to requester and new account notification will be sent to the requestee.
                 Example (default):
                 enrole.workflow.notifyoption=1 
                 </ITIM infocenter documentation>
                 The above comments have also been incorporated in $ITIM_HOME/data/enRole.properties file.  A copy of enRole.properties file with this update has been provided along with this maintenance package as an example for your reference.

        APAR:    IV17162
        Symptom: While executing a custom report, the entity filter gets removed from the report query.  It appears that only cross entity filters are considered while generating the common ACI query.

        APAR:    IV17873
        Symptom: The "Service Owner" is missing as a workflow participant/escalation particiapnt type in all operational workflows.

        APAR:    IV19650
        Symptom: When the "pass-http-only-cookie-attr=yes" setting is enabled in the WebSEAL configuration file and Websphere is configured to set the HttpOnly attribute to JSESSIONID and PD-S-SESSION-ID cookies, then the applets in ITIM (such as workflow designer) do not work.
        Note:    DOCUMENTATION UPDATE:
                 The following update will be posted in a future revision of the Infocenter.
                 <ITIM infocenter documentation>
                 Limitation: This behavior is an existing limitation.  The use of pass-http-only-cookie-attr=yes in WebSEAL, when the HtttpOnly attribute is set to JSESSIONID and PD-S-SESSION-ID cookies in WebSphere, breaks applet support.  The cookie information cannot be supplied to the applet.  As a result the use of Tivoli Identity Manager applets through WebSEAL is forbidden.  When the setting is changed to "pass-http-only-cookie-attr=no", the applets works fine as the WEBSEAL will not pass HTTPOnly attribute in the cookie, which will allow the cookie information to be accessed from the applet.

        APAR:    IV19907    ROUTE OF IV10452    R55313
        Symptom: Problems exporting/importing Provisioning Policies containing Groups with Views due to an ITIM limitation that ITIM Views cannot be exported/imported, since Views are not stored in the ITIM LDAP but rather in the ITIM database.

        APAR:    IV19908    ROUTE OF IV16000    R56503
        Symptom: When <ITIMURL forcedurl="enduser"/> script is used in a workorder notification template and the workorder node has the "wait for completion" flag set, ITIM does not append the activity id details in the link.

Architecture(s): Windows, Solaris, AIX and Linux.

Fixes superseded: ITIM Interim Fix 5.1.0.10-ISS-TIM-IF0037.

Dependencies: ITIM 5.1 Fixpack 5.1.0.10-ISS-TIM-FP0010.

Database Changes: NONE

JMS (Java Messaging Service) Changes: NONE

LDAP Changes: NONE

Files Replaced or Added or Modified by this Interim fix:

    ITIM ear, home, and updi files   (embedded inside the *.pak file)

Patch Contents:
  - This README file
  - 5.1.0.10-ISS-TIM-IF0038.pak
  - enRole.properties
  - IV20225.pdf
 
MD5 Checksums:
  4a1da84f647e2581cad0f17cba25e7fd   5.1.0.10-ISS-TIM-IF0038.zip
  82f353a7994b6599f436219285fb9dd9   5.1.0.10-ISS-TIM-IF0038.pak
  4735e6c8da0289445a13578acb328c92   enRole.properties
  51dd7c904823e3ddcf0c83b4b2deb177   IV20225.pdf

 Applying the Patch:

    1) Extract the Interim Fix zip file to a temporary directory on your hard drive:

          # jar xvf 5.1.0.10-ISS-TIM-IF0038.zip

       NOTE:  You may also use any unzip equivalent to unpack the zip file.
              Back-level versions of jar, FastJar or PKZIP may report errors.  Use the jar executable supplied with java or another zip utility to uncompress the file.

    2) Copy the file(s) to the appropriate directory.  The following is a typical example.  Yours may be different.
       /opt/IBM/WebSphere/UpdateInstaller/maintenance/

NOTE: *************************************************************************
       Always BACKUP your old files in a safe place in case an unforeseen event occurs.  It is recommended to backup ITIM_HOME/data directory.  Especially, be sure to backup any configuration files you may have modified  such as properties or xml files.
NOTE: *************************************************************************
       When performing this Interim Fix installation on a slower system the deployment could take a long time.
       We have seen times in the 30 to 60 minute range or higher.  It is recommended to extend the WebSphere SOAP Request Timeout value from 180 to 1800 seconds or higher as needed.
       Configuration file:
          WAS_HOME/profiles/PROFILE_NAME/properties/soap.client.props
       Property to change:
          com.ibm.SOAP.requestTimeout=1800    (30 minutes)
          NOTE: com.ibm.SOAP.requestTimeout=0   will provide an infinite timeout.

       If you encounter a timeout problem you may see the following entries in the update installer logs:
        WASX7017E: Exception received while running file
        "/opt/IBM/itim/properties/version/nif/config/install/was/updateEar.py";
        exception information: com.ibm.websphere.management.exception.ConfigServiceException
        com.ibm.websphere.management.exception.ConnectorException
        org.apache.soap.SOAPException: [SOAPException: faultCode=SOAP-ENV:Client; msg=Read timed out;
        targetException=java.net.SocketTimeoutException: Read timed out]

        You may also see other errors indicating an error during the deployment of the ear.
NOTE: *************************************************************************
       You must use the WebSphere Update Installer Version V6.1.0.13 or newer.  You may download the latest version and get more information about the WebSphere Update Installer here:
       http://www.ibm.com/support/docview.wss?rs=180&uid=swg24012718
NOTE: *************************************************************************
      Interim Fix Installation procedure

       NOTE***  For Installing on a Cluster:
       Perform the  procedure starting at step 2 first on the NDM and then on every node in the cluster.
       Do not perform Step 1. on a Cluster.
       Before starting Fixpack Installation on cluster:
       A. Ensure all node agents are up and can communicate with the NDM.
       B. Ensure ITIM application cluster and ITIM Messaging cluster are stopped.
       C. If the DM node and a cluster member are in the same host, perform this procedure only once.
       NOTE***  For Installing on a Cluster end.
       1. Stop WebSphere using your normal procedures, e.g.
                $WAS_HOME/profiles/AppSrv01/bin/stopServer.sh server1
                Or if you wish to submit userid and password when WAS admin security is used:
                $WAS_HOME/profiles/AppSrv01/bin/stopServer.sh server1 -username xxxx -password yyyy
           Proceed to step 2, only after the stop confirmation is displayed.

       2.  Execute the WebSphere Update Installer, e.g.
                 /opt/IBM/WebSphere/UpdateInstaller/update.sh
                 C:\Program Files\IBM\WebSphere\UpdateInstaller\update.bat

       3. When the update installer asks for Product Selection, specify your ITIM_HOME directory, typically, /opt/IBM/itim.  Later steps will prompt for the location of the fix deliverable (.pak file).  When you go forward in the update installer panels, you should see the Interim Fix listed in the "Available Maintenance Package to Install" panel.

       4. Select the Next Button and confirm in the next panel by selecting the Next button.

       5. After the Maintenance Installation is complete, you may exit the Update Installer.

       6. Perform the COMMON TASKS listed below these instructions.

       7. After you are done with the COMMON TASKS, then:

       8. You may now begin using ITIM.  The Update Installer automatically restarts the WebSphere AppServer.

NOTE: *********************************************************************************
       The following are COMMON TASKS that you need to perform prior to restarting the AppServer or Cluster.
NOTE: *********************************************************************************
      NONE.
      END OF COMMON TASKS

End of Readme
