IBM(R) Security Access Manager for Web, Patch 7.0.0-ISS-SAM-FP0003 README
===============================================================================

(C) Copyright International Business Machines Corporation 2013. All rights
reserved. U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  Wednesday, 01 January 2014
-------------------------------------------------------------------------------

    CONTENTS

    1.0 ABOUT THIS PATCH
       1.1 Patch contents
       1.2 Architectures
       1.3 Patches superseded
       1.4 Dependencies


    2.0 APARS AND DEFECTS FIXED
       2.1 Problems fixed by patch 7.0.0-ISS-SAM-FP0003
       2.2 Problems fixed by patch 7.0.0-ISS-SAM-FP0002
       2.3 Problems fixed by patch 7.0.0-ISS-SAM-FP0001


    3.0 BEFORE INSTALLING THIS PATCH
       3.1 Back up Security Access Manager data
       3.2 Upgrade GSKit to Version 8.0.50.13 or later



    4.0 INSTALLING THIS PATCH
       4.1 Installing this patch on an AIX(R), Linux(R), or Solaris(R) system
       4.2 Installing this patch on a Windows(R) system
       4.3 Installing Language patch


    5.0 UNINSTALLING THIS PATCH


    6.0 AFTER INSTALLING THIS PATCH
       6.1 Verifying patch level
       6.2 Adding new components to a system


    7.0 DOCUMENTATION UPDATES
       7.1 SSL-V2-ENABLE ATTRIBUTE NOT DOCUMENTED (IV37756)
       7.2 UNDO THE NEGATIVE VALUE WORKAROUNDS (IV37013)
       7.3 ISAM 2-SYSTEM UPGRADE FAILS WHEN OBFUSCATED FILE IS MISSING (IV44180)
       7.4 WHEN IMPORTING ACTIVE DIRECTORY GROUP, THE NAME OF THE ISAM GROUP 
           MUST BE SAME AS sAMACCOUNTNAME (IV48007)
       7.5 DOCUMENTATION SHOULD NOT SHOW OPTIONS TO SPECIFY ENCRYPTION SEED AND 
           SALT FOR IDSIMIGR COMMAND (IV47078)
       7.6 RDJAPI DOESN'T ALLOW FOR ESCAPING THE "*" ASTERISK (IV43899)

       

    8.0 SOFTWARE LIMITATIONS
   

    9.0 KNOWN PROBLEMS AND WORKAROUNDS


   10.0 NOTICES
       10.1 Trademarks


*****************************************************************************
*****************************************************************************

1.0 ABOUT THIS PATCH
--------------------
 This patch package contains fixes for problems in Security Access Manager
 software. This patch requires that Security Access Manager, Version 7.0
 already be installed and configured successfully.



1.1 Patch contents

 This patch package contains:

    - This README file
    - Updated patch packaging for Security Access Manager software.



1.2 Architectures

 This patch package applies to the following architectures:


 Platform                                 Patch
 ------------                             ------------------------------

 AIX 6.1 POWER System                     - None
 AIX 7.1 POWER System                     - None
 

________________________________________________________________________ 


 Solaris 10 SPARC                         - Update 10
 Solaris 11 SPARC                         - None


________________________________________________________________________ 


 Red Hat Enterprise Linux (RHEL)
        5 Advanced Platform x86-64        - None
        Server 6 x86-64                   - None

 SUSE Linux Enterprise Server (SLES)
        10 x86-64                         - None
        11 x86-64                         - None


 ________________________________________________________________________ 


 Red Hat Enterprise Linux (RHEL)
        Server 6 System z                 - None
        5 Advanced Platform System z      - None

 SUSE Linux Enterprise Server (SLES)
        10 System z                       - None
        11 System z                       - None


 ________________________________________________________________________ 


 Windows Server 2008                      - None
     Enterprise Edition x86-64
     Standard Edition x86-64

 Windows Server 2008 R2                   - None
     Enterprise Edition x86-64
     Standard Edition x86-64


 ________________________________________________________________________ 

 Additional Certifications:


 Windows Server 2012 Standard edition

 WebSphere 8.5 and DB2 10.1             ISAM 700 with Fix Pack 02 or later
					for following components only:
					PDJRTE    (PD Java Runtime)
					PDWPM     (PD Web Portal Manager)

 OSDB certification for ISAM 7.0 with WAS8.5 and DB2 10.1 on:
          -Windows  Server2008 R2 (64 bit)
          -AIX 6.1 (64 bit)
          -RHEL 6.2 (64 bit)

 ________________________________________________________________________ 

 Additional Registry Certifications:


 Active Directory 2012

 OpenLDAP 2.4.33


 ________________________________________________________________________ 
 
 Deprecations:

 The use of CARS (Common Auditing and Reporting Service) is now
 deprecated.  Future releases of TAM will not support this service.


 ________________________________________________________________________ 


1.3 Patches superseded

 Patches superseded by this patch:

   None.


1.4 Dependencies

 IBM Security Access Manager for Web, Version 7.0
 IBM Security Utilities
 GSKit Version 8.0.50.13



2.0 APARS AND DEFECTS FIXED
---------------------------
 Because patches are cumulative, this patch corrects all the problems
 outlined in the following sections.


2.1 Problems fixed by patch 7.0.0-ISS-SAM-FP0003

 APAR IV37416
 Symptom: Problem using RSA token authentication on Windows platform

 APAR IV52357
 Symptom: Memory leak under certain conditions when using Active Directory
          as registry

 APAR IV42380
 Symptom: Certain pdadmin commands do not work after installing the
          Japanese Language Pack

 APAR IV53471
 Symptom: When enable-last-login=yes in the WebSEAL configuration file, 
          WebSEAL behaves as if cache-return-registry-id=yes

 APAR IV53463
 Symptom: Memory leak under certain conditions when using Active Directory
          as registry

 APAR IV44093
 Symptom: pdconfig crash on Windows during migration

 APAR IV44180
 Symptom: pdconfig failure during migration when missing ivmgrd.conf.obf
          file

 APAR IV53501
 Symptom: Group import failure under certain conditions when using Java
          admin api

 APAR IV46684
 Symptom: PDContext call not returning when pdmgrd is not running

 APAR IV53473
 Symptom: Command "amuvu -dilmt" returns invalid month

 APAR IV53477
 Symptom: Webseal memory leak under rare load conditions

 APAR IV53528
 Symptom: Threading issues when using PD.jar in WebSphere

 APAR IV50334
 Symptom: Server stability fix for extensive scaling.

2.2 Problems fixed by patch 7.0.0-ISS-SAM-FP0002

 APAR IV50049
 Symptom: Improve WebSEAL integration with RBA 

 APAR IV50137
 Symptom: During Java API certificate refresh on Windows, the KS file 
          cannot be restored if the disk is full.

 APAR IV50138
 Symptom:  Improve error checking and recovery for internal certificates
           when they reach half life.

 APAR IV44180
 Symptom:  DOCUMENTATION UPDATE REGADING ISAM 2-SYSTEM UPGRADE 
           FAILS WHEN OBFUSCATED FILE IS MISSING 

 APAR IV48007
 Symptom:  DOCUMENTATION UPDATE REGADING WHEN IMPORTING ACTIVE DIRECTORY GROUP, 
           THE NAME OF THE ISAM GROUP MUST BE SAME AS sAMACCOUNTNAME

2.3 Problems fixed by patch 7.0.0-ISS-SAM-FP0001

 APAR IV37767
 Symptom: LD_PRELOAD SHOULD BE REPLACED WITH LD_PRELOAD_32 FOR SOLARIS
          ENVIRONMENT.
          In Solaris, if LD_PRELOAD_32 is set in the environment then
          it ignores LD_PRELOAD, so pdweb_script should be updated and
          occurrences of LD_PRELOAD should be replaced with LD_PRELOAD_32.

 APAR IV37751
 Symptom: TRACE ADMIN FOR STATS GET LEAKS MEMORY.
          WebSEAL process memory increases, when running pdadmin command
          "stats get" for WebSEAL.

          For example:
              pdadmin -a <user> -p <pw> server task <serverName> stats get
              pdadmin -a <user> -p <pw> server task <serverName> stats reset


 APAR IV37754
 Symptom: CAN NOT USE NUMBERS FOR DOMAIN NAME ON WINDOWS.
          On Windows, numbers cannot be used in the Management Domain Name.

 APAR IV37748
 Symptom: LDAP_DECODING_ERROR ENCOUNTERED IN ITDS PROXY/CLIENT.
          When Security Access Manager is configured using IBM Directory
          Proxy Server and "enhanced-pwd-policy=yes", Security Access Manager
          fails to parse the IBM Directory password control information
          received from the backend IBM Directory Server.

 APAR IV36491
 Symptom: WPM ACL MEMBERSHIP TAB FOR USER AND GROUP BIDI ISSUE

          In WPM user and group properties, the ACL membership tab has a
          bidirectional language issue for the following columns:
              Attached to the Objects
              Permissions

          Data in these columns is unreadable because its natural text direction
          is left to right (LTR), but the data displays right to left (RTL).

          LTR direction and left alignment should be enforced for the two
          columns. Data should display exactly the same for both English and 
          bidirectional languages.

 APAR IV36659
 Symptom: WPM POLICY ACCOUNT EXPIRATION MONTH MISSING HEBREW TRANSLATION

          In the account expiration date section of the WPM user properties
          policy tab, the month drop-down box is not translated in Hebrew for
          the months of April, August, and December.
  
 APAR IV36708
 Symptom: Can't configure Security Access Manager Runtime on Active Directory 
          with SSL if the non-SSL port is unavailable.
          If a user has somehow disabled the LDAP non-SSL port (normally 389) 
          for Active Directory, the configuration of the Runtime will fail since 
          it was attempting to contact Active Directory using the non-SSL port.
  
 APAR IV36745
 Symptom: PROBLEM WITH SSL HANDSHAKE IN IBM SECURITY ACCESS MANAGER 7 WITH
          GSKIT 8
          When resuming an SSL session, a data corruption occurs and the
          handshake fails. This failure can happen in several ways showing
          different errors in the WebSEAL logs.  In a network trace, this
          failure can be see as a handshake that fails, with an alert from the
          server and with an alert from the client (two ways).

          For example the following errors might be seen in the logs:

          Case 1:

          <date> 0x38AD54BA webseald WARNING wiv ssl SSLConnection.cpp
          2036 0x<thread> DPWIV1210W Function call, gsk_secure_soc_init,
          failed error:  0000019f GSK_ERROR_BAD_PEER.

          <date> 0x38CF07E9 webseald WARNINGwwa jct RemoteJunction.cpp
          1799 0x<thread> DPWWA2025W IBM Security Access Manager WebSEAL
          has lost contact with junction server:  <junction host>

          Case 2:

          <date> 0x38AD54BA webseald WARNING wiv ssl SSLConnection.cpp
          2036 0x<thread> DPWIV1210W Function call, gsk_secure_soc_init,
          failed error:  0000019a GSK_ERROR_BAD_MESSAGE.
 
          <date> 0x38CF07E9 webseald WARNING wwa jct RemoteJunction.cpp
          1799 0x<thread> DPWWA2025W IBM Security Access Manager WebSEAL
          has lost contact with junction server:  <junction host>
 
          Case 3:
          <date> 0x38AD54BA webseald WARNING wiv ssl SSLConnection.cpp
          2036 0x<thread> DPWIV1210W Function call, gsk_secure_soc_init,
          failed error:  000001a4 GSK_ERROR_SOCKET_CLOSED.

          <date> 0x38CF07E9 webseald WARNING wwa jct RemoteJunction.cpp
          1799 0x<thread> DPWWA2025W IBM Security Access Manager WebSEAL
          has lost contact with junction server:  <junction host>

          This issue is fixed with GSKit Version 8.0.50.13

 APAR IV36821
 Symptom: ILMT Tag file changes from ILMT team review
          If the amuvu tool is run on a Windows system, and the -dilmt 
          parameter is passed, the <InstanceID> entry in the output 
          ILMT tag uses backslash \ path separator characters instead 
          of front slash / path separator characters.

 APAR IV36822
 Symptom: "poldown" script has the wrong variable name.
          In a Policy Server HA environment, if the standby policy server goes
          down, the poldown script fails and leaves the environment in a
          state where all IBM Security Access Manager servers are stopped.
          Also, the pd.conf configuration file is incorrect for the
          master-host, boot-start-ivmgrd, and boot-start-ivacld entries.
          
 APAR IV36823
 Symptom: Certificate refresh can fail with an exception.
          When the Security Access Manager client certificate is automatically
          refreshed, the refresh can fail with the exception:
          [java.lang.IllegalStateException:
          [
          HPDMG0162E   ASN1 decode error {0} occurred.  The certificate buffer
          received is invalid and cannot be decoded.
          ]

 APAR IV36827
 Symptom: The Security Access Manager Java(R) API certificate auto refresh fails
          if 1 day from end of life. 
          When using a Java Runtime that supports the new form of the method 
          com.ibm.security.certclient.PkEeCertReqFactory.newCertRequest(),
          if the automatic certificate is enabled and the certificate 
          to be refreshed is less than 1 day from expiring, the Security Access
          Manager Java API application fails and throws the following exception:
          com.ibm.security.certclient.base.PkRejectionException

 APAR IV36828
 Symptom: The pdversion command shows the incorrect fix pack number on Linux
          The output of the pdversion command on Red Hat Enterprise Linux 6 has
          the wrong fix pack number.  For example:
            Security Access Manager Runtime              7.0.0.08664
            Security Access Manager Policy Server        7.0.0.08664
          Note the extra 8664 after the Fix Pack number 0 in this case.

 APAR IV36831
 Description: A new tool, amuvu, is introduced in IBM Security Access Manager 
          for Web.  This tool allows an Administrator to retrieve a count of 
          users in an LDAP registry. For syntax information, see the IBM 
          Security Access Manager for Web Command Reference in the IBM
          Security Access Manager for Web Information Center.

 APAR IV37009
 Symptom: Memory related stability fix.

 Feature 113339
 Symptom: Certificate refresh Error Handling
          Additional checks are added to ensure that before an attempt is 
          made to refresh a certificate that the system is in a state that 
          would allow that refresh to occur.  Checks are added for conditions 
          like, out of disk space.
          
3.0 BEFORE INSTALLING THIS PATCH
--------------------------------
 Before installing this patch, review the following prerequisites and
 dependencies.



3.1 Back up Security Access Manager data

 Before applying any maintenance, be sure to back up your system.  Use
 the pdbackup command provided with the Security Access Manager product
 to back up Security Access Manager-specific data. Documentation for the
 pdbackup command is located in the "IBM Security Access Manager for Web,
 Version 7.0, Command Reference".

 The patch installation for the PDRTE component installs the pd_start script
 as pd_start.fixpack.  This name prevents your current pd_start script from
 being overwritten during the installation.  If you are installing the fix pack
 on an AIX, Linux, or Solaris system or you have customized your pd_start
 script, consider making a backup copy of the pd_start script before you
 install the fix pack.  Depending on your use of the script, consider merging
 the content of your customized script with the content of the pd_start.fixpack
 script.

3.2 Upgrade GSKit to Version 8.0.50.13

 Note:
 IBM Global Security Toolkit (GSKit) version 7.0.4.33 and higher supports
 RFC 5746 (TLS Renegotiation Indication Extension). Therefore, the security
 exposure CVE-2009-3555 (TLS/SSL Protocol Vulnerability) is not applicable 
 to these versions of GSKit. 

 Upgrade the IBM Global Security Toolkit (GSKit) to version 8.0.50.13
 before installing the Tivoli Access Manager packages in this patch. 

 The updated GSKit installation packages may be downloaded at the URL:

 http://www-933.ibm.com/support/fixcentral/swg/quickorder?parent=ibm~Tivoli&product=ibm/Tivoli/IBM+Global+
 Security+Kit&release=8.0.50.13&platform=All&function=all&source=fc 
 
 Instructions for installing GSKit may be found in the IBM Tivoli Access Manager
 for e-business Installation Guide, under the section "Reference information > 
 Installing prerequisite products".


4.0 INSTALLING THIS PATCH
-------------------------
 NOTE: Before installing this patch, be sure that you have reviewed the
 prerequisites and have completed the backup procedure in section 3.0,
 "BEFORE INSTALLING THIS PATCH".

 NOTE: About IBM Security Utilities:
 This 7.0.0-ISS-SAM-FP0003 Patch includes "IBM Security Utilities"
 Patch 7.0.0-ISS-TIVSEC-FP0003.
 If your system already has "IBM Security Utilities Patch 03" i.e.
 7.0.0-ISS-TIVSEC-FP0003 installed, then you do not need to install it
 again from this image.


 If the Security Access Manager product is distributed over multiple machines,
 this patch must be applied to all Security Access Manager systems within a
 secure domain.

 The patch images for Windows platforms are self-extracting executables.
 For AIX, Linux, and Solaris platforms, the patch image is a compressed tar 
 file that can be untarred by a command like the following:

 zcat Compressed-Patch-tar-Image | tar -xvf -

 This README assumes that $PATCH (or %PATCH% for Windows) is the path to
 your temporary directory.



4.1 Installing this patch on an AIX, Linux, or Solaris system

 NOTE: 
 Before applying the PD.WPM patch, Web Portal Manager (WPM) must first be
 unconfigured. After applying the patch, reconfigure WPM.

 The fix pack installer for Security Access Manager Runtime for Java(R)
 attempts to update the existing PD.jar file in each configured JVM with
 the updated PD.jar file delivered with this fix pack. In some cases, such
 as when the installer cannot locate the Java Virtual Machine (JVM), the
 copy operation fails. In this case, the installer log will contain a message
 asking the administrator to ensure JVM is in the path and then to run the
 pdjrteupg utility manually to copy PD.jar to the configured JVMs.

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory. For the purpose of this 
     README, assume that the symbol $PATCH points to this temporary directory.

  3. Stop the Security Access Manager processes.

     a. Stop the processes associated with Tivoli Manager for Operating
         Systems, if that product is installed:

         rc.osseal stop

     b. Stop the processes associated with Tivoli Access Manager for
         Business Integration, if that product is installed.

     c. Stop the Security Access Manager Base and WebSEAL processes:

         /opt/PolicyDirector/bin/pd_start stop

  4. At the command prompt, enter the following command to install the patch:


     On AIX systems:

        - installp -a -g -X -d $PATCH <package>

          where <package> is one of the following:

          TivSec.Utl   Specifies the IBM Security Utilities
          PD.RTE       Specifies the Security Access Manager Runtime
          PD.Mgr       Specifies the Security Access Manager Policy Server
          PD.MgrPrxy   Specifies the Security Access Manager Policy Proxy Server
          PD.Acld      Specifies the Security Access Manager Authorization Server
          PD.AuthADK   Specifies the Security Access Manager ADK
          PDJ.rte      Specifies the Security Access Manager Java Runtime Env.
          PD.WPM       Specifies the Security Access Manager Web Portal Manager



     On Linux systems:

        - rpm -U <patchname>

          where <patchname> is one of the following:

             Linux on x86-64

                TivSecUtl-TivSec-7.0.0-3.x86_64.rpm
                PDRTE-PD-7.0.0-3.x86_64.rpm
                PDMgr-PD-7.0.0-3.x86_64.rpm
                PDMgrPrxy-PD-7.0.0-3.x86_64.rpm
                PDAcld-PD-7.0.0-3.x86_64.rpm
                PDAuthADK-PD-7.0.0-3.x86_64.rpm
                PDJrte-PD-7.0.0-3.x86_64.rpm
                PDWPM-PD-7.0.0-3.x86_64.rpm

             Linux on System z

                TivSecUtl-TivSec-7.0.0-3.s390x.rpm
                PDRTE-PD-7.0.0-3.s390x.rpm
                PDMgr-PD-7.0.0-3.s390x.rpm
                PDMgrPrxy-PD-7.0.0-3.s390x.rpm
                PDAcld-PD-7.0.0-3.s390x.rpm
                PDAuthADK-PD-7.0.0-3.s390x.rpm
                PDJrte-PD-7.0.0-3.s390x.rpm
                PDWPM-PD-7.0.0-3.s390x.rpm



     On Solaris SPARC Operating Environment systems
                  
        For Solaris SPARC 10:
        - cd $PATCH

            patchadd -t -G <patch-pkg>

            Note: If an error occurs (for example, "The -t or -C options cannot
                be used with -G option"), while installing the patch on Solaris
                10 with zones, use the following command:

              /usr/lib/patch/patchadd -G <patch-pkg>

              where <patch-pkg> is one of the following in the patch-pkg column:

                <patch-pkg>                           <package>
                ---------------------------           ---------
                TIVSECUTL000700-03        TivSecUtl
                PDRTE000700-03               PDRTE
                PDMGR000700-03               PDMgr
                PDMGRPRXY000700-03           PDMgrPrxy
                PDACLD000700-03              PDAcld
                PDAUTHADK000700-03           PDAuthADK
                PDWPM000700-03               PDWPM
                PDJRTE000700-03              PDJrte

        For Solaris SPARC 11:
        - cd $PATCH

              cd  <patch-pkg>
              where <patch-pkg> is one of the following in the patch-pkg column:

                <patch-pkg>                           <package>
                ---------------------------           ---------
                TIVSECUTL000700-03        TivSecUtl
                PDRTE000700-03               PDRTE
                PDMGR000700-03               PDMgr
                PDMGRPRXY000700-03           PDMgrPrxy
                PDACLD000700-03              PDAcld
                PDAUTHADK000700-03           PDAuthADK
                PDWPM000700-03               PDWPM
                PDJRTE000700-03              PDJrte
                
               pkgadd -G -d . <package>
               where <package> is the corresponding package listed above in the
               patch-pkg directory.  

  5. Restart the Security Access Manager processes:

     /opt/PolicyDirector/bin/pd_start start

  6. Restart the processes associated with other Tivoli Access Manager
     products that were stopped in step 3.


 4.2 Installing this patch on a Windows system

     NOTE: 
     Before applying the PD.WPM patch, Web Portal Manager (WPM) must first be
     unconfigured. After applying the patch, reconfigure WPM.

     The fix pack installer for Security Access Manager Runtime for Java
     attempts to update the existing PD.jar file in each configured JVM with
     the updated PD.jar file delivered with this fix pack. In some cases, such
     as when the installer cannot locate the Java Virtual Machine (JVM), the
     copy operation fails. In this case, the installer log will contain a
     message asking the administrator to ensure JVM is in the path and then
     to run the pdjrteupg utility manually to copy PD.jar to the configured
     JVMs.

  1. Log in to the Windows system as the Administrator.

  2. Stop all Security Access Manager services.
     If the Web plug-in is being used:
        a. Click:
           Start->Settings->Control Panel->Administrative Tools->Services
           Right-click Security Access Manager Plug-in Servers,
           and then click Stop.
        b. To confirm your action, click Yes.
        c. Stop the IIS server using the Internet Services Manager.
           From the Windows Desktop, click:
           Start->Settings->Control Panel->Administrative Tools->Services,
           right-click the service name, and then click Stop.
           Repeat this for each Security Access Manager service.

  3. Unpack the self-extracting archive into a temporary directory. 
     The archive will extract files to a sub-folder named 7.0.0-ISS-SAM-FP0003.
     For the purpose of this README, assume that %PATCH% points to this 
     temporary directory, including the 7.0.0-ISS-SAM-FP0003 sub-folder.

  4. Change to the patch directory: 

     cd %PATCH%

     For each component to apply service to, run the following command:

     <component directory>/Disk Images/Disk1/setup.exe

     List of component directory names:
          TivSecUtl
          PDRTE
          PDMGR
          PDPROXY
          PDAcld
          PDAuthADK
          PDJRTE
          PDWPM

  5. Restart Security Access Manager services, including the Security Access
     Manager Policy Server and Authorization Server:

     From the Windows Desktop, click:
     Start -> Settings -> Control Panel -> Administrative Tools -> Services,
     right-click the service name, and then click Start.
     Repeat this for each Security Access Manager service.

     If the Web Plug-in is being used:
       a. Click Security Access Manager Plug-in Servers -> Start.
       b. Start the IIS server using the Internet Services Manager.

  6. Restart the processes associated with other Security Access Manager
     products that were stopped in step 2.

 4.3 Installing Language patch

    Note:
    Tivoli Access Manager for eBusiness 7.0.0 fix pack 02 added new messages
    and updated existing ones. The English messages are already included in
    the patch 7.0.0-ISS-SAM-FP0002. Translations for other languages must be
    installed separately from this patch: 7.0.0.2-ISS-TAM-LANGPK

    For supported UNIX platform, the package for patch 6.1.1.7-ISS-TAM-LANGPK
    is called 7.0.0.2-ISS-TAM-LANGPK.tar and for Windows, it is called
    7.0.0.2-ISS-TAM-LANGPK-WIN.zip

    Download the patch from the same location where the patch 7.0.0-ISS-SAM-FP0002
    is downloaded. Unzip the patch in a temporary directory. The archive contains the
    following two jar files:

        pdrte_lp_setup.jar
        pdjrte_lp_setup.jar


   Ensure that the IBM Java Runtime 1.5.0 SR5 is available in the command execution path
   (or prefix the command with the JRE directory)


   To install with a wizard, run the following command:

        java  -jar  language_package.jar

   To install in console mode, run the following command:

        java  -jar  language_package.jar -console


    Where language_package.jar is the name of the language package to install:

    pdjrte_lp_setup.jar
        Installs language packages for Access Manager Runtime for Java.

    pdrte_lp_setup.jar
        Installs language packages for Access Manager Runtime.


    For detailed installation instructions, consult the "Installation Guide",
    Chapter 2. "Internationalization" section: "Installing language support
    packages for Tivoli Access Manager"





5.0 UNINSTALLING THIS PATCH
---------------------------

 NOTE:  Uninstallation is not available on Microsoft Windows systems.

 If the Security Access Manager product is distributed over multiple
 machines, uninstall this patch on those systems in the reverse order that
 it was applied.

 To remove the patch on AIX, Linux, and Solaris systems, perform the following 
 steps.

  1. Log in to the system as root.

  2. Stop the Security Access Manager processes.

     a. Stop the processes associated with Tivoli Access Manager for
        Operating Systems, if that product is installed:

        rc.osseal stop

     b. Stop the processes associated with Tivoli Access Manager for
        Business Integration, if that product is installed.

     c. Stop the Security Access Manager Base and WebSEAL processes:

        /opt/PolicyDirector/bin/pd_start stop


  3. At the prompt, enter the appropriate command below:

     On AIX, reject the applied patch:

       installp -r <package>

       where <package> is one of the following:

           PD.Mgr
           PD.MgrPrxy
           PD.Acld
           PD.AuthADK
           PD.WPM
           PDJ.rte
           PD.RTE
           TivSec.Utl

       Example:  installp -r PD.RTE


     On Linux, apply the previous patch level:

       rpm -U --oldpackage <old_package>

       where <old_package> is one of the following:

         Linux on x86

           PDMgr-PD-7.0.0-0.x86_64.rpm
           PDMgrPrxy-PD-7.0.0-0.x86_64.rpm
           PDAcld-PD-7.0.0-0.x86_64.rpm
           PDAuthADK-PD-7.0.0-0.x86_64.rpm
           PDWPM-PD-7.0.0-0.x86_64.rpm
           PDJrte-PD-7.0.0-0.x86_64.rpm
           PDRTE-PD-7.0.0-0.x86_64.rpm
           TivSecUtl-TivSec-7.0.0-0.x86_64.rpm

         Linux on System z

           PDMgr-PD-7.0.0-0.s390x.rpm
           PDMgrPrxy-PD-7.0.0-0.s390x.rpm
           PDAcld-PD-7.0.0-0.s390x.rpm
           PDAuthADK-PD-7.0.0-0.s390x.rpm
           PDWPM-PD-7.0.0-0.s390x.rpm
           PDJrte-PD-7.0.0-0.s390x.rpm
           PDRTE-PD-7.0.0-0.s390x.rpm
           TivSecUtl-TivSec-7.0.0-0.s390x.rpm


      On Solaris 10, remove the patch:

        patchrm  <package>

        where <package> is one of the following:

            PDMGR000700-03
            PDMGRPRXY000700-03
            PDACLD000700-03
            PDAUTHADK000700-03
            PDWPM000700-03
            PDJRTE000700-03
            PDRTE000700-03
            TIVSECUTL000700-03

         Example:  patchrm PDRTE000700-03
       
      On Solaris 11:
         Removal of just the patch is not possible on Solaris 11.  To restore a 
         Solaris 11 system to a previous level, do the following:
         a. Uninstall the packages that were updated using the uninstallation
            instructions in the IBM Security Access Manager for Web Installation
            Guide. 
         b. Install the GA version of the installation packages.
         c. Install the previous fix pack level, if any.
         d. If needed, restore any backups.         
        

  4. Restart the Security Access Manager processes:

     /opt/PolicyDirector/bin/pd_start start

  5. Restart the processes associated with other Tivoli Access Manager
     products that were stopped in step 2.



6.0 AFTER INSTALLING THIS PATCH
------------------------------
 Complete the following tasks after you have installed the patch.



6.1 Verifying patch level

 To verify the patch level of your Security Access Manager installation,
 do the following.

   On AIX:      lslpp -L PD\*

   On Solaris:  
       Solaris 10: showrev -p
       
       Solaris 11: pkgparam <package> PATCH
         where <package> is one of the following:
           TivSecUtl 
           PDRTE     
           PDMgr     
           PDMgrPrxy 
           PDAcld    
           PDAuthADK 
           PDWPM     
           PDJrte    
        
   On Linux:    rpm -q -i PDRTE-PD
       
   On Windows:  1. run 'regedit'
                2. find \HKEY_LOCAL_MACHINE\
                            SOFTWARE\
                               Tivoli\
                                  Policy Director Management Server\
                                    7.0.0\

 You also can use the pdversion command if the runtime package is installed.
 Note: The patch for the runtime package should be installed before using
 the pdversion command so that the proper patch version number
 is displayed.




6.2 Adding new components to a system

 To install a new component of Security Access Manager on an EXISTING
 machine in the Security Access Manager environment after this patch has
 been installed:

   1. Install the component using the IBM Security Access Manager for Web
      Version 7.0 installation media.

   2. After the new component is installed, reapply this patch to the system.



7.0 DOCUMENTATION UPDATES
-------------------------

 The product documentation for IBM Security Access Manager for Web, Version
 7.0, can be found at the following Web address (entered as one line):

 http://pic.dhe.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=%2Fcom.ibm.isam.doc_70%2Fwelcome.html


7.1 SSL-V2-ENABLE ATTRIBUTE NOT DOCUMENTED (IV37756)

 In the Base Administration Guide the topic titled "ssl-v2-enabled" requires 
 an update.

 The correct [ssl] stanza entry is ssl-v2-enable.

 When you specify settings for SSL version 2, use ssl-v2-enable instead of 
 ssl-v2-enabled.


7.2 UNDO THE NEGATIVE VALUE WORKAROUNDS (IV37013)

 In the Command Reference, the topic titled "config modify" requires an update.

 To specify a negative value, end the option with a dash (-) and specify the
 value with a dash before it. For example:
 
 config modify keyvalue append /opt/pdweb/etc/webseald-default.conf content-mime-types */* -  -1
 
 In this example, the value */* = -1 is added to the [content-mime-types]
 stanza. Without the dash (-) after */*, the -1 would be read as an option
 instead of a value and an error would be returned.


7.3 ISAM 2-SYSTEM UPGRADE FAILS WHEN OBFUSCATED FILE IS MISSING (IV44180)

 ISAM 2-System Policy Server upgrade to ISAM700 might fail if the existing 
 TAM Policy Server does not have ivmgrd.conf.obf file that is referred to 
 by ivmgrd.conf file.

 Very earlier releases of TAM did not utilize obfuscation, as such, if a 
 Customer had started with one of those earlier TAM Policy Server and kept 
 on upgrading to e.g. TAM610, it is possible that this current 610 Policy 
 Server may not have ivmgrd.conf.obf file which contains the obfuscated 
 password referred to by the "bind-pwd" entry in the 
 [ldap] stanza of ivmgrd.conf file.

 In a situation like that, before starting the upgrade process of the 
 existing Policy Server, it is recommened to generate the ivmgrd.conf.obf 
 file manually and then follow the ISAM700 upgrade guide.

 Follow these steps to generate ivmgrd.conf.obf file:

 a) Before doing anything else, make a backup of the entire "etc" directory 
   i.e. "C:\Program Files\Tivoli\Policy Director\etc" 

 b) Note the value of "bind-pwd" in ivmgrd.conf file in [ldap] stanza, after
    noting the value, remove the line containing "bind-pwd" from ivmgrd.conf
    file i.e.

    pdadmin -l config show \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" ldap bind-pwd

    pdadmin -l config modify remove \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" ldap bind-pwd

    Type the whole command in a single line ( backslash "\" means it is a
    continuation of a line )


 c) Now, obfuscate the password using the following command:

    pdadmin -l config modify keyvalue set -obfuscate \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" \
     ldap bind-pwd <xxxxx>
    
    Type the whole command in a single line ( backslash "\" means it is a 
    continuation of a line ) and replace <xxxxx> with the value that was 
    noted in step b) above for "bind-pwd"

 d) Verify that value of "bind-pwd" got obfuscated using the command:

    pdadmin -l config show \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" ldap bind-pwd

    Type the whole command in a single line ( backslash "\" means it is a
    continuation of a line )

    This command should show the value of "bind-pwd" that was used in step c)

    Also make sure that a ivmgrd.conf.obf file was created in

    "C:\Program Files\Tivoli\Policy Director\etc" directory, and that a
    "file" entry was added to the [configuration-database] stanza:

    pdadmin -l config show \
    "C:\Program Files\Tivoli\Policy Director\etc\ivmgrd.conf" file configuration-database


 e) Re-start the Policy Server and make sure that you can login using
    "sec_master" and try to perform some basic task to verify functionalities 
    to make sure that the Policy Server is working properly.
 
 f) Now follow the ISAM700 Upgrade Guide as usual.

7.4 WHEN IMPORTING ACTIVE DIRECTORY GROUP, THE NAME OF THE ISAM GROUP 
    MUST BE SAME AS SAMACCOUNTNAME (IV48007)

    When ISAM is configured with Active Directory as registry and an existing
    Active Directory group is being imported into ISAM, the ISAM group name
    must be same as the sAMAccountName of the group in Active Directory, 
    otherwise importation of that group may fail with message indicating
    "Group is not defined in the Registry".


7.5 DOCUMENTATION SHOULD NOT SHOW OPTIONS TO SPECIFY ENCRYPTION SEED AND 
    SALT FOR IDSIMIGR COMMAND (IV47078)

    IBM Security Access Manager for Web Version 7.0, Upgrade Guide, section:
    "Appendix: Upgrade utilities", command "idsimigr" mistakenly included invalid 
    options "-e" and "-g", and omitted valid options "-G" and "-w".
    The corrected Syntax and Description of Parameters of the command are below:

    Usage: idsimigr [-I instance_name [-u backup_dir] [-p port]
                [-s secure_port] [-a adm_port] [-c adm_secureport] [-t db_instance]
                [-i ipaddress] [-l inst_location] [-r description] [-G group_name]
                [-w user_password] [-d debug_level] [-b output_file] 
                [-q] [-n]] | -v | -?
    Parameters:

    -?                Displays the usage.

    -a adm_port       Specifies the port the directory administration server will 
                      listen on.
    -b output_file    Specifies the full path of a file in which to
                      redirect output. If this option is used in conjunction with
                      the -q option, only errors will be sent to the file.
                      If debugging is turned on, debug output will be sent
                      to this file also.
    -c adm_secureport Specifies the secure port the directory administration server 
                      will listen on.
    -d debug_level    Sets the debug level.
                      Use in conjunction with the ldtrc command.
    -G group_name     Specifies the name of primary group of the new user. This parameter is
                      required if the user is to be created. It is valid only on AIX, Linux,
                      and Solaris systems.
    -i ipaddress      Specifies the IP addresses to which the directory server
                      instance will bind.  If more than one is specified,
                      the comma separator is required with no spaces. Use
                      the key word 'all' to specify to use all available
                      IP addresses. All available IP addresses is assumed if
                      this option is not specified.
    -I instance_name  Specifies the name of the directory server
                      instance to create or migrate. The instance name must be an
                      existing user ID on the computer and must be no greater
                      than 8 characters in length.
    -l inst_location  The location to store the directory server instance's
                      configuration files and logs. On Windows systems, this option is
                      required and a drive letter must be specified. There must
                      be at least 30 MB free.
    -n                Run in no-prompt mode. All output is generated except for
                      messages requiring user interaction.
    -p port           The port of the directory server instance.
    -q                Run in quiet mode. All output is suppressed except for errors.
                      If the -d option is also specified, trace output
                      is not suppressed.
    -r description    A description of the directory server instance.
    -s secure_port    The secure port of the directory server instance.
    -t db_instance    DB2 database instance name. The database instance name
                      is also the DB2 instance owner ID. By default, the database
                      instance name is assumed to be the same as the directory
                      server instance owner ID.  If there is database instance
                      information in the backed up configuration file that is still valid
                      for the system, that information will be used instead.
    -u backup_dir     The directory where the schema and configuration
                      files to be migrated have been saved.
    -v                Prints the version information for this command.
    -w user_password  Password of the new user to be created.  This parameter is
                      required if the user is to be created.


7.6 RDJAPI DOESN'T ALLOW FOR ESCAPING THE "*" ASTERISK (IV43899)

    ISAM RDJAPI does not allow for escaping any special characters present in a
    user search filter. Use the following option in the properties file to turn
    on the ability to escape special characters like '*' present in the user ID:

        ldap.allow-quote-pattern = true


    The default value for this option is false.



8.0 SOFTWARE LIMITATIONS
------------------------

 None.



9.0 KNOWN PROBLEMS AND WORKAROUNDS
------------------------------------------------

 None.



10.0 NOTICES
 ------------
 This information was developed for products and services offered in the U.S.A.
 IBM may not offer the products, services, or features discussed in this
 document in other countries. Consult your local IBM representative for
 information on the products and services currently available in your area. Any
 reference to an IBM product, program, or service is not intended to state or
 imply that only that IBM product, program, or service may be used. Any
 functionally equivalent product, program, or service that does not infringe
 any IBM intellectual property right may be used instead. However, it is the
 user's responsibility to evaluate and verify the operation of any non-IBM
 product, program, or service. IBM may have patents or pending patent
 applications covering subject matter described in this document. The
 furnishing of this document does not give you any license to these patents.
 You can send license inquiries, in writing, to:
 
 IBM Director of Licensing
 IBM Corporation
 North Castle Drive
 Armonk, NY 10504-1785
 U.S.A.
 
 For license inquiries regarding double-byte (DBCS) information, contact the
 IBM Intellectual Property Department in your country or send inquiries, in
 writing, to:
 
 IBM World Trade Asia Corporation
 Licensing
 2-31 Roppongi 3-chome, Minato-ku
 Tokyo 106, Japan
 
 The following paragraph does not apply to the United Kingdom or any other
 country where such provisions are inconsistent with local law: INTERNATIONAL
 BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
 WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
 TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
 A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
 implied warranties in certain transactions; therefore, this statement may not
 apply to you.
 
 This information could include technical inaccuracies or typographical errors.
 Changes are periodically made to the information herein; these changes will be
 incorporated in new editions of the publication. IBM may make improvements
 and/or changes in the product(s) and/or the program(s) described in this
 publication at any time without notice.
 
 Any references in this information to non-IBM Web sites are provided for
 convenience only and do not in any manner serve as an endorsement of those Web
 sites. The materials at those Web sites are not part of the materials for this
 IBM product and use of those Web sites is at your own risk.
 
 IBM may use or distribute any of the information you supply in any way it
 believes appropriate without incurring any obligation to you.
 
 Licensees of this program who wish to have information about it for the
 purpose of enabling: (i) the exchange of information between independently
 created programs and other programs (including this one) and (ii) the mutual
 use of the information that has been exchanged, should contact:
 
 IBM Corporation
 2Z4A/101
 11400 Burnet Road
 Austin, TX 78758
 U.S.A.
 
 Such information may be available, subject to appropriate terms and
 conditions, including in some cases, payment of a fee.
 
 The licensed program described in this document and all licensed material
 available for it are provided by IBM under terms of the IBM Customer
 Agreement, IBM International Program License Agreement or any equivalent
 agreement between us.
 
 Any performance data contained herein was determined in a controlled
 environment. Therefore, the results obtained in other operating environments
 may vary significantly. Some measurements may have been made on
 development-level systems and there is no guarantee that these measurements
 will be the same on generally available systems. Furthermore, some measurement
 may have been estimated through extrapolation. Actual results may vary. Users
 of this document should verify the applicable data for their specific
 environment.
 
 Information concerning non-IBM products was obtained from the suppliers of
 those products, their published announcements or other publicly available
 sources. IBM has not tested those products and cannot confirm the accuracy of
 performance, compatibility or any other claims related to non-IBM products.
 Questions on the capabilities of non-IBM products should be addressed to the
 suppliers of those products.
 
 All statements regarding IBM's future direction or intent are subject to
 change or withdrawal without notice, and represent goals and objectives only.
 
 This information contains examples of data and reports used in daily business
 operations. To illustrate them as completely as possible, the examples include
 the names of individuals, companies, brands, and products. All of these names
 are fictitious and any similarity to the names and addresses used by an actual
 business enterprise is entirely coincidental.
 
 

10.1 Trademarks
 
 The following terms are trademarks or registered trademarks of International
 Business Machines Corporation in the United States, other countries, or both:
 
 AIX
 IBM
 IBM logo
 iSeries
 pSeries
 S/390
 Tivoli
 Tivoli logo
 xSeries
 
 Java and all Java-based trademarks and logos are trademarks or registered
 trademarks of Oracle and/or its affiliates.
 
 Linux is a registered trademark of Linus Torvalds in the United States, other
 countries, or both.

 Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
 Microsoft Corporation in the United States, other countries, or both.
 
 UNIX is a registered trademark of The Open Group in the United States and
 other countries.
 
 Other company, product, and service names may be trademarks or service marks
 of others.
 
 
 
 End of IBM Security Access Manager for Web, Patch 7.0.0-ISS-SAM-FP0003 README
