IBM(R) Tivoli(R) Access Manager Plug-in for Web Servers, Patch 6.1.1-ISS-WPI-FP0003 README
==========================================================================================

 (C) Copyright International Business Machines Corporation 2011. All rights 
 reserved.
 U.S. Government Users Restricted Rights -- Use, duplication or
 disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  13 December 2013


    CONTENTS

    1.0 ABOUT THIS PATCH
        1.1 Patch contents
        1.2 Architectures
        1.3 Patches superseded
        1.4 Dependencies
    2.0 APARS AND DEFECTS FIXED
        2.1 Problems fixed by patch 6.1.1-ISS-WPI-FP0003
	    2.2 Problems fixed by patch 6.1.1-TIV-WPI-FP0002
	    2.3 Problems fixed by patch 6.1.1-TIV-WPI-FP0001
    3.0 INSTALLING THIS PATCH
        3.1 Back up Tivoli Access Manager data
        3.2 Installing this patch on AIX systems
        3.3 Installing this patch on Sun Solaris Operating Environment systems
        3.4 Installing this patch on Linux systems
        3.5 Installing this patch on Microsoft Windows systems
    4.0 UNINSTALLING THIS PATCH
    5.0 VERIFYING THE PATCH LEVEL
    6.0 DOCUMENTATION UPDATES
    7.0 SOFTWARE LIMITATIONS
    8.0 TROUBLESHOOTING		  
    9.0 NOTICES
        9.1 Trademarks


1.0 ABOUT THIS PATCH
--------------------

This patch package contains fixes for problems in IBM Tivoli Access Manager
Plug-in for Web Servers. This patch requires that IBM Tivoli Access Manager 
Plug-in for Web Servers version 6.1.1 and Tivoli Access Manager Version 6.1.1
are already installed. 


1.1 Patch contents

This patch package contains:

- This README file
- Update patch packaging


1.2 Architectures

This patch package applies to the following architectures:

    IBM AIX 5.2, 5.3 and 6.1 WPARs
    Sun Solaris Operating Environment 2.9 and 2.10, and Solaris 10 Zones
    SuSE Linux Enterprise Server 9, 10 and 11 on x86
    SuSE Linux Enterprise Server 9, 10 and 11 on System z
    Red Hat Enterprise Linux 4.0 and 5.0 on x86/x64
    Red Hat Enterprise Linux 4.0 and 5.0 on System z
    Microsoft Windows 2003 and 2008 Enterprise Server 


1.3 Patches superseded

6.1.1-TIV-WPI-FP0002
6.1.1-TIV-WPI-FP0001

1.4 Dependencies

IBM Tivoli Access Manager Base version 6.1.1
IBM Tivoli Access Manager Web Security Runtime version 6.1.1
IBM Tivoli Access Manager Plug-in for Web Servers version 6.1.1

Tivoli Access Manager Base fixpacks available as a separate download.
Tivoli Access Manager Web Security Runtime fixpacks are part of the WebSEAL Fix Pack.


2.0 APARS AND DEFECTS FIXED

Because patches are cumulative, this patch corrects all the problems
outlined in the following sections.

2.1 Problems Fixes by Patch 6.1.1-ISS-WPI-FP0003


    APAR:  IV21665  
    Symptom: When using web-server-authn as the authentication module
             the users login experience is inconsistent with reauth
             requests being encountered.

    APAR:  IV24959
    Symptom: When amwebpi is using IIS 7 or 7.5, an authenticated user
             cannot access a file with a space character in its name.
             When using Basic Authentication, the user gets repeated
             prompts to login. For Forms Based Authentication, a bad
             request is returned on the initial login.

    APAR:  IV18342
    Symptom: Upgrading from amwebpi 6.0.0.x to the 6.1.1 fails due to 
             a missing registry key.

    APAR:  IV43163
    Symptom: Upgrading from 6.1.1.1 to Fix Pack two fails due to
             incorrectly registry key being set. 

    APAR:  IV30628
    Symptom: When WebSEAL has pre-510-compatible-tokens set as "true"
             and it is using WebPI as a ECSSO MAS Server, it cannot 
             decode the vouch-for token. WebSEAL logs message 
             "DPWWA1975W Unable to decode Vouch-For Token".  WebPI
             provides a "pre-410-compatible-tokens" config option
             item; however it is missing the "pre-510-compatible-tokens" 
             config option item.

    APAR:  IV43909
    Symptom: Users are redirected to the change password page on
             successful login. 

    APAR:  IV33180
    Symptom: Single Sign-on fails with the error "DPWNS1054E Invalid
             session ID" and "DPWWA1122W Corrupted session cookie:
             PD-H-SESSION-ID."

2.2 Problems Fixes by Patch 6.1.1-TIV-WPI-FP0002

    APAR:  IV07137
    Symptom: When web-server-auth or NTLM are configured in processing a
             response without a host header, plugin process (w3wp.exe)
             consumes large amounts of CPU and becomes unstable.  IIS may kill
             the plugin process which is running in the Default Application
             Pool because it times out in responding as a result.

2.3 Problems Fixes by Patch 6.1.1-TIV-WPI-FP0001

    APAR:  IZ93354
    Symptom: The organization unit (OU) part is removed from the subject DN
             of client x509 certificates presented to WebPI by the Apache 
             Web server.



3.0 INSTALLING THIS PATCH
-------------------------

3.1 Back up Tivoli Access Manager data

Before applying any maintenance, be sure to back up your system.
Use the 'pdbackup' command provided with the Tivoli Access Manager 
product to back up Tivoli Access Manager-specific data.  Documentation
for the 'pdbackup' command can be found in the 'IBM Tivoli Access Manager 
Command Reference'.


3.2 Installing this patch on AIX systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory. For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the plug-in process:
     /opt/pdwebpi/sbin/pdwebpi_start stop
	 
  4. Stop the host Web server.

  5. At the command prompt, enter the following:

      installp -a -g -X -d $PATCH <package>

	where <package> is one of the following:

       PD.WPI
       PD.WPIIHS
	   PD.WPIiPlanet

  6. Restart the plug-in processes:

       /opt/pdwebpi/sbin/pdwebpi_start start	
     
  7. Restart the host Web server
  

3.3 Installing this patch on Sun Solaris Operating Environment systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.
     
  3. Stop the Plug-in process:

         /opt/pdwebpi/sbin/pdwebpi_start stop
	
  4. Stop the host Web server.

  5. At the command prompt, enter the following:

     cd $PATCH
     patchadd <package>
     
     where <package> is one of the following:

        PDWPI000611-03
        PDWPIAPA000611-03
        PDWPIIPL000611-03
        PDWPIIHS000611-03

  6. Restart the Plug-in processes:

	 /opt/pdwebpi/sbin/pdwebpi_start start
 
  7. Restart the host Web server
  

3.4 Installing this patch on Linux systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the Plug-in process:

         /opt/pdwebpi/sbin/pdwebpi_start stop

  4.  Stop the host Web server. 

  5. At the command prompt, enter the following:

       cd $PATCH
       rpm -U <patchname>

       where <patchname> is one of the following:

           PDWPI-Apache-6.1.1-3.s390.rpm
           PDWPI-IHS-6.1.1-3.s390.rpm
           PDWPI-PD-6.1.1-3.s390.rpm
           PDWPI-IHS-6.1.1-3.i386.rpm
           PDWPI-PD-6.1.1-3.i386.rpm

  6. Restart the Plug-in processes:

	 /opt/pdwebpi/sbin/pdwebpi_start start

  7. Restart the host Web server.


3.5 Installing this patch on Microsoft Windows Systems

  1. Log in to the Windows system as the Administrator.

      Shut down the Plug-in services:
        a. From the Control Panel, click 'Services'.
 	     click 'Access Manager Plug-in for Web Servers' > 'Stop'.
        b. Confirm your action by clicking 'Yes'.
        c. Stop the IIS server using the Internet Services Manager.   
         
   2. Go to the patch directory and run the install command:

        %PATCH%\PolicyDirector\Disk Images\Disk 1\PDWebPI\Disk Images\Disk 1\Setup.exe

      Note: If for any reason you have to reboot your system to
      complete this installation (for example, to overcome a
      shared DLLs problem), you might subsequently encounter a
      problem running the Web Portal Manager to access the console.
      If this happens, confirm that the WebSphere service is
      running. The WebSphere service is installed in manual startup
      mode and might not be running after a reboot.

   3. Restart the Web plug-in:

      From the Windows desktop:
         a. Click 'Access Manager Plug-in for Web Servers' -> 'Start'.
         b. Start the IIS server using the Internet Services Manager.


4.0 UNINSTALLING THIS PATCH
---------------------------

NOTE:  Uninstallation is not available on Microsoft Windows systems.

If the Tivoli Access Manager product is distributed over multiple machines,
uninstall this patch on those systems in the reverse order as it was applied.

To remove the patch on UNIX systems, perform the following steps.

   1. Log in to the system as root.

   2. Stop the Plug-in process:

         /opt/pdwebpi/sbin/pdwebpi_start stop

   3. Stop the host Web server.

   4. At the command prompt, enter the following:

      On Solaris systems, remove the patch:

         patchrm  <package>

         where <package> is one of the following:
         
           PDWPI000611-03
           PDWPIAPA000611-03
           PDWPIIPL000611-03
           PDWPIIHS000611-03
      On Linux systems, apply the previous patch level:

         rpm -U --oldpackage <old_package>

      On AIX systems, use smit or smitty or from command line:
        installp -r -g -X <package>

	where <package> is one of the following:

           PD.WPI
           PD.WPIIHS
 	   PD.WPIiPlanet

   4. Restart the Plug-in processes:

          /opt/pdwebpi/sbin/pdwebpi_start start

   5. Restart the host Web server and the processes associated with
      other Tivoli Access Manager products stopped in step 2.


5.0 VERIFYING THE PATCH LEVEL
-----------------------------

To verify the patch level of your Tivoli Access Manager installation,
do the following. 

From a command line, run:

    UNIX/Linux:
	/opt/pdwebpi/bin/pdwpi-version

    Windows:
	c:\Program Files\Tivoli\PDWebPI\bin\pdwpi-version.exe

This will show the new fixpack version number.  The '-l' option will show 
the binary file versions installed.


6.0 DOCUMENTATION UPDATES
-------------------------

The product documentation for Tivoli Access Manager version 6.1.1 can be
found at the following Web address:
   
http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame.doc/welcome.htm

In this fixpack, support has been added for the Apache 2.2.x web server running on Red Hat Enterprise Linux 5 using the x86/x64 architecture.

7.0 SOFTWARE LIMITATIONS
------------------------

   None


8.0 TROUBLESHOOTING
-----------
Symptom 1: Installation of patches may fail if Sun patch 110934-10 is installed. 
           Doing a 'patchadd' on Solaris has a potential problem in that the 
           operating system can report that it requires an unusually large
           amount of disk space to perform the operation.

           Reference: http://seer.support.veritas.com/docs/252441.htm

Consider the following workaround options:

   1. Rename the space file. 

      For example:
      If installing the LA release of WebPI (Jan 2004)
   
      then do the following:
      
      mv /var/sadm/pkg/pdwebpi/install/space /var/sadm/pkg/pdwebpi/space.org

      Or for Sun OS 5.8,
   
   2. Upgrade to Sun pkgadd patch 110934-11 where Bug ID 4786593 is fixed.


9.0 NOTICES
-----------

This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this
document in other countries. Consult your local IBM representative for
information on the products and services currently available in your area. Any
reference to an IBM product, program, or service is not intended to state or
imply that only that IBM product, program, or service may be used. Any
functionally equivalent product, program, or service that does not infringe
any IBM intellectual property right may be used instead. However, it is the
user's responsibility to evaluate and verify the operation of any non-IBM
product, program, or service. IBM may have patents or pending patent
applications covering subject matter described in this document. The
furnishing of this document does not give you any license to these patents.
You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the
IBM Intellectual Property Department in your country or send inquiries, in
writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law: INTERNATIONAL
BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions; therefore, this statement may not
apply to you.

This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this
IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the
purpose of enabling: (i) the exchange of information between independently
created programs and other programs (including this one) and (ii) the mutual
use of the information that has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758
U.S.A.

Such information may be available, subject to appropriate terms and
conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer
Agreement, IBM International Program License Agreement or any equivalent
agreement between us.

Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments
may vary significantly. Some measurements may have been made on
development-level systems and there is no guarantee that these measurements
will be the same on generally available systems. Furthermore, some measurement
may have been estimated through extrapolation. Actual results may vary. Users
of this document should verify the applicable data for their specific
environment.

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.

All statements regarding IBM's future direction or intent are subject to
change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include
the names of individuals, companies, brands, and products. All of these names
are fictitious and any similarity to the names and addresses used by an actual
business enterprise is entirely coincidental.

9.1 Trademarks

IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, NetView, Tivoli Enterprise,
Tivoli Enterprise Console, and TME are trademarks or registered trademarks of
International Business Machines Corporation in the United States, other
countries, or both.

Lotus is a registered trademark of Lotus Development Corporation and
International Business Machines Corporation in the United States or other
countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
Microsoft Corporation in the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and
other countries.

C-bus is a trademark of Corollary, Inc. in the United States, other countries,
or both.

ActionMedia, LANDesk, MMX, Pentium, and ProShare are trademarks of Intel
Corporation in the United States, other countries, or both. For a complete
list of Intel trademarks, see
http://www.intel.com/sites/corporate/tradmarx.htm.

SET and the SET Logo are trademarks owned by SET Secure Electronic Transaction
LLC.

Java and all Java-based trademarks and logos are trademarks or registered
trademarks of Sun Microsystems, Inc. in the United States and other countries.

Other company, product, and service names may be trademarks or service marks
of others.



End of IBM Tivoli Access Manager Plug-in for Web Servers, Patch 6.1.1-ISS-WPI-FP0003 README

