File:   4.5.1-TIV-TIM-BEA-IF0084.README For ITIM 4.5.1 using BEA WebLogic Application Server.
Date:   September 21, 2007

Interim fix 4.5.1-TIV-TIM-BEA-IF0084 for APARs IZ01333, IZ01683, IZ02434, and IZ03291. 

Components:
       enroleall.jar for all supported platforms for BEA Weblogic Appserver
       enroleejb.jar for all supported platforms for BEA Weblogic Appserver
       itim_client.jar for all supported platforms for BEA Weblogic Appserver
       provisionOrderedAccounts.ldif for all supported platforms for BEA Weblogic Appserver
General Description:

This Interim fix provides fixes for APARs IZ01333, IZ01683, IZ02434, and IZ03291. 

  Problems Fixed:
  
    APAR:    IZ01333
    Symptom: Deadlock occurs occasionally when trying to display AUDIT LOG in View Pending Requests.
    Note:*** Execute the additional steps listed in step 4 in the 'Applying the Patch' 
             section at the end of the README.

    APAR:    IZ01683
    Symptom: Sometimes ITIM fails to show the To-Do list due to CORBA NO_MEMORY error.
  
    APAR:    IZ02434
    Symptom: Documentation Update:
             The ITIM Tuning Guide will be updated with the following information:
             The DB2 Lock Timeout value needs to be greater than or equal to the WebSphere 
             Total Transaction Lifetime Timeout value.
  
    APAR:    IZ03291
    Symptom: The javascript object, PersonSearch, doesn't work in a provisioning policy entitlement. 
             You may get:
             CTGIME203E The following script interpreter error occurred.
             Error: Runtime error global variable 'PersonSearch' does not have a value detected at 
             line 1 in string starting with: 'var ps = new PersonSearch();'...
             OR
             You get a NullPointerException, if the following is added into the fesiextensions.properties 
             file:
             fesi.extension.ProvisioningPolicy=com.ibm.itim.fesiextensions.PersonModelExtension
                
  Old Problems Fixed:
  
    APAR:    IY98669
    Symptom: Attributes cannot be read through the ITIM GUI because of the lack of permission 
             (or the presence of an explicit denial) due to the current ACIs set, but are visible 
             in the HTML source of the GUI page.

    Note:    If attribute "eruid" has read/write permissions denied (very rare case),
             then the value of "eruid" will be visible in HTML source (hidden) as this value 
             is required for account user id duplication and compliance check. All other 
             attributes with read/write permissions denied will not be visible in HTML source code.
  
    APAR:    IY99313
    Symptom: Problem with .* for group membership.  When policy specifies group membership as 
             excluded with a regular expression of .*, recons with policy checking will not 
             correct the case where an account has had a single group added to it outside of 
             ITIM.   If two or more groups were added outside of ITIM, policy enforcement 
             successfully removes the groups from the account.  Group Parameters Reported:  
             (Value: .*,  Enforcement: Excluded, Expression Type: Regular Expression).
  
    APAR:    IZ00592
    Symptom: When ITIM has to perform a multiple provisioning of services for a given person 
             (for example as result of an enforcement of a policy including several automatic 
             entitlements) it always provisions the services in a sequential way, as if the 
             services prerequisite was: S_1 <-- S_2 <-- S_3

             Problem occurs when using automatic provisioning if services have prerequisites.
             When provisioning services, if provisioning the S_j service fails, provisioning of 
             the S_i service doesn't begin (with j<i).
    Note:    Execute the additional steps given at the end of the README.

    APAR:    IZ01569
    Symptom: Searches using ITIM UI or APIs that include (!(erisdeleted=Y)) filter can be resource 
             intensive (in LDAP processing). This component is required to exclude entries from
             under the 'ou=recycleBin,ou=itim,<tenant_dn>' folder, from being included in search
             results. This filter component is appended, only when objects are searched with the
             search base set to the tenant. For example, the search filter to retrieve all accounts 
             (ITIM and remote accounts) owned by a person, includes this filter component.
    Note:    To address this issue, a new property 'enrole.recyclebin.enable' has been introduced, 
             which can be configured in <ITIM_HOME>\data\enRole.properties file. 

             If this property is set to 'true', ITIM managed objects, like persons, deleted using 
             ITIM UI or API will be copied to the Recycle Bin folder in the Directory Server.

             If this property is set to 'false', the objects deleted using ITIM UI or APIs will no
             longer be copied to the Recycle Bin. This will result in the Recycle Bin being empty
             and so ITIM will no longer append '(!(erisdeleted=Y))' component to any of the 
             search filters.
             Before setting this property to 'false', all entries under 'ou=recycleBin,ou=itim,<tenant_dn>' 
             folder need to be removed from the directory server, to avoid deleted objects from being
             included in any search results using ITIM.

             If the property is undefined or has an invalid value, the value would be treated as'true'.
  
    APAR:    IY97929
    Symptom: Change password process aborts before sub-processes are completed.
    Note:    When changing password from ITIM UI during logon, if the password change
             operation does not complete within a minute, the user will be redirected
             back to the Login screen and a message will be displayed indicating that
             the password change request was submitted successfully.  At this time,  
             the user should wait for some period of time, about 10 minutes, and then 
             try to login with the new password.
  
    APAR:    IY98143
    Symptom: LDAP connection leaks resulting from mishandled error cases in customization.
             Failed ServiceSearch or DirectoryObjectSearch calls may result in leaked
             LDAP connections. LDAP connection reference held may have also prevented the
             JVM from utilizing garbage collection to clean-up these leaked connections.
  
    APAR:    IY95666
    Symptom: Custom report column header not translated with CustomLabels.properties.
  
    APAR:    IY96217
    Symptom: When attempting to run any default report, you get the following error:
                ORA-01424: MISSING OR ILLEGAL CHARACTER FOLLOWING THE ESCAPE CHARACTER
             This ran fine under Oracle 9i; the problem only happens with Oracle 10g.
             This may also occur when trying to define a report or define schema.
  
    APAR:    IY96266
    Symptom: RFI node placed before CreatePerson node for add operation on inetOrgPerson 
             object causes NullPointerException.
      
    APAR:    IY96524
    Symptom: When clicking on the [...] button of the Subprocess properties in the 
             Workflow Designer, a popup dialog reports RemoteException.  
             The itim.log shows:
                java.lang.NullPointerException

    APAR:    IY92952
    Symptom: Remove autocommit code entries from ITIM Reporting component.
    
    APAR:    IY93925
    Symptom: The password sync servlet doesn't correctly handle passwords including non-ascii characters.
             The non-ascii characters get corrupted. 
  
    APAR:    IY92526
    Symptom: The API WorkflowProcessEntity.getProcessContext() method always throws 
             "UnsupportedOperationException" exception.
  
    APAR:    IY93035
    Symptom: Too many instances of java.util.MissingResourceException are logged to Weblogic's 
             myserver.log unnecessarily when a form contains a read-only attribute of type 
             checkbox without a value.
  
    APAR:    IY93223
    Symptom: ITIM doesn't enforce the policy correctly for NON-COMPLIANT accounts belonging to
             hosted service during a RECON.
  
    APAR:    IY93409
    Symptom: When submitting a request to create a person in ITIM when the person's name contains 
             a large number of extended ASCII characters, the request will fail to get created in 
             the ITIM database.


Architecture(s): Windows, Solaris, AIX, and HPUX.
                                                  
Fixes Superseded:  ITIM Interim Fixes 4.5.1-TIV-TIM-IF0079, 4.5.1-TIV-TIM-IF0080,4.5.1-TIV-TIM-IF0081, 
4.5.1-TIV-TIM-IF0082, and 4.5.1-TIV-TIM-IF0083.

Dependencies: ITIM Fixpack 4.5.1-TIV-TIM-FP0078.

Database Changes: NONE.

JMS (Java Messaging Service) Changes: NONE

LDAP Changes: OPTIONAL changes to update process definition of ITIM operation 
              'provisionOrderedAccounts', required when a service is a prerequisite
              service of two or more services.
              Reference APAR IZ00592.

Files Replaced or Added or Modified by this Interim fix :

    <ITIM_HOME>/lib/enroleall.jar
    <BEA_HOME>/user_projects/itim/applications/enroleejb.jar
    <ITIM_HOME>/lib/itim_client.jar

Patch Contents:
  - This README file
  - enroleall.jar 
  - enroleejb.jar
  - itim_client.jar
  - provisionOrderedAccounts.ldif

MD5 Checksums:
652e674e1f25db7b5af2e5aadd2da876  4.5.1-TIV-TIM-BEA-IF0084.zip
284b7b401ddfa395094d3b3adbd485ff  provisionOrderedAccounts.ldif

IN THE SINGLE DIRECTORY

MD5 Checksums:

128cef5a29d3a491ef7812f03c6582ed  enroleall.jar
52e7131ab63f7326a2eef34d7047f60e  enroleejb.jar
27b71c1afc94f9a961f669d4ef5d1d05  itim_client.jar

IN THE CLUSTER DIRECTORY

MD5 Checksums:

4ff5d0f1f234cd205ead6261dcb9524f  enroleall.jar
3455ba1ea84a66c8b5e77f88f062dd95  enroleejb.jar
f7fbe5c6b14d291830b0b5ea45887cd9  itim_client.jar

Applying the Patch:

    1) Extract the Interim Fix zip file to a temporary directory on your hard drive:
      
          # jar xvf 4.5.1-TIV-TIM-BEA-IF0084.zip

       NOTE:  You may also use any unzip equivalent to unpack the zip file.
              Back-level versions of jar, FastJar or PKZIP may report errors. 
              Use the jar executable supplied with java or another zip utility 
              to uncompress the file.
       
    2) Copy the files to the appropriate directories.
    
       You will now need to copy the files to the appropriate directories.
       Always BACKUP your old files in a safe place in case an unforseen 
       event occurs.
       
       The enroleall.jar is installed in:
       <ITIM_HOME>/lib/ directory
     
       The enroleejb.jar is installed in:
       <BEA_HOME>/user_projects/itim/applications/ directory
       
       Replace itim_client.jar in: 
       <ITIM_HOME>/lib/

       *NOTE*
       In a cluster deployment, these steps must be done for each 
         node of the cluster.  Make sure you use the files found in the "Cluster"
         Directory in the 4.5.1-TIV-TIM-BEA-IF0084.zip package.
           
       a. Stop the Application server.
       
       b. Copy the enroleall.jar file to:

         <ITIM_HOME>/lib/  directory
        
       c. Copy the enroleejb.jar file to:

         <BEA_HOME>/user_projects/itim/applications/  directory

       d. Copy the itim_client.jar to:
      
         <ITIM_HOME>/lib/ directory

    3). OPTIONAL: Additional step for IZ00592.
           The process definition of the operation 'provisionOrderedAccounts' needs to be
           updated, to enable requests that are independent of the failed request to be 
           started. The requests dependent on a service, will be executed serially 
           one after another, and not simultaneously.

           Steps for modifying the definition in directory server:

           1. Connect to directory server that contains the itim data using any LDAP client.
              Ensure that the connected user has the permissions to modify LDAP entries.

           2. Before importing the provisionOrderedAccounts.ldif file, change the dn in the 
              file appropriately.
              Current dn is,
                 dn: erglobalid=00000000000000000008, ou=operations, ou=itim, ou=IBM, DC=COM
              Here the tenant is 'IBM' and root suffix is 'DC=COM'.
              Change these to appropriate tenant and root suffix.

           3. Import the provisionOrderedAccounts.ldif file. Make sure that while importing
              the mode is update, as it updates the attribute 'erxml' for process definition, 
              erglobalid=00000000000000000008,ou=operations,ou=itim,ou=<tenant>,<root suffix>.

    4). OPTIONAL: Additional step for IZ01333.
           A new property 'enrole.auditlog.readuncommitted.enable' has been introduced in
           <ITIM_HOME>/data/enRole.properties file. The value of this property decides if
           uncommitted reads are allowed when displaying the 'Audit Log' of a pending or
           completed workflow process. This APAR change allows uncommitted reads when displaying 
           the 'Audit Log', when this property has a value set to 'true'. Otherwise, the
           ITIM processing remains as previously, that is; uncommitted reads will be disabled.
           This property should be enabled only if deadlocks have been encountered when viewing
           the 'Audit Log' of a pending process, preventing the pending process to complete 
           successfully.

           To set this property, follow the steps below.
           1. Open <ITIM_HOME>/data/enRole.properties file in any text editor.
           2. Add the new property 'enrole.auditlog.readuncommitted.enable' and set it's 
              value to 'true'. After doing this the last line of enRole.properties file 
              would look like this:
              enrole.auditlog.readuncommitted.enable=true
           3. Save the file and quit the editor.

           Note : This property is only applicable when the database used by ITIM is DB2.

    5) Start ITIM.
       # cd <ITIM_HOME>
       # sh ./itim.sh start
       
End of Readme
