File:   4.6.0-TIV-TIM-FP0074.README
Date:   June 27, 2007

Fixpack 4.6.0-TIV-TIM-FP0074 for APARs IZ21463, IZ21808, IZ21948, IZ22015, IZ22310, IZ22868, IZ22283, IZ22992, 
IZ25555, IZ25556, IZ25558, IZ16544, IZ16886, IZ16968, IZ17600, IZ17621, IZ17601, IZ17974, IZ18929, IZ19681, IZ20436,
IZ19638, IZ19605, IZ20157, IZ20243, IZ20451, IZ20733, IZ21500, IZ21510, and IZ22090.

Components:  As needed for IBM WebSphere.

General Description:

This Fixpack provides fixes for APARs IZ21463, IZ21808, IZ21948, IZ22015, IZ22310, IZ22868, IZ22283, IZ22992, 
IZ25555, IZ25556, IZ25558, IZ16544, IZ16886, IZ16968, IZ17600, IZ17621, IZ17601, IZ17974, IZ18929, IZ19681, IZ20436,
IZ19638, IZ19605, IZ20157, IZ20243, IZ20451, IZ20733, IZ21500, IZ21510, and IZ22090.

  New Problems Fixed in the ITIM Self Service Application Since the last Fixpack:

  *** NEW as of June 29, 2007 ***
  ITIM Server has now added a new OPTIONAL Self Service UI Application. For additional information, please 
  see the README.txt that can be found in $ITIM_HOME/extensions/SelfServiceUI/README.txt.
  *** NEW ***
   
    APAR:    IZ25555    32206
    Symptom: NEW FUNCTION, Enhancement:
             Enhancement to Show Change Password Account List by Default.
    Note:    The following new properties have been introduced in $ITIM_HOME/data/SelfServiceUI.properties
             file :
             1. ui.view.accounts.expandedbydefault
                The property indicates whether the accounts affected twistie state on the change
                password page should be expanded or collapsed (true|false) by default.Set the value of
                ui.view.accounts.expandedbydefault to 'true' to expand the Accounts affected Twistie.
                The default value of this property is 'false'.

             2. ui.select.all.accounts
                This property indicates whether all the accounts under account twistie are to be selected
                or not by default.Valid values are:
                1.all: To select all the accounts under account twistie.
                2.none: To select none of the accounts under account twistie.
                3.default: To retain the default behavior. 
                The default value of this property is 'default'.
   
    APAR:    IZ25556    32208
    Symptom: NEW FUNCTION, Enhancement:
             Enhancement to provide an option to Mask Challenge Responses.
    Note:    The following new property has been introduced in $ITIM-HOME/data/SelfServiceUI.properties
             file :
               ui.challengeResponse.showAnswers
             This property determines whether the answers to challenge response questions will be treated
             as obscured passwords or clear text in the UI of Forgot Password screen and challenge response
             question/answer definition screen. The default value of this property is 'true'.
             
  New Problems Fixed:
   
    APAR:    IZ21463
    Symptom: The Size parameter for Listbox(es) is not saved by the form designer and also not used during the
             display of account forms.
   
    APAR:    IZ21808
    Symptom: Java script tags placed in the Group email topic field in the notification tab of an approval node are not 
             evaluated.
    Note:    A new property 'enrole.workflow.notification.groupEmailTopic.evaluatejavascript' has been
             introduced in $ITIM_HOME/data/enRole.properties file. The value of this property decides
             whether the Group Email Topic field can contain dynamic content. If this field is set to 
             true then dynamic content evaluation will be performed.
             The default value of this property is 'false'.
             
    APAR:    IZ21948
    Symptom: If boolean custom attributes are defined and set to "TRUE" for a custom Person, these attributes should not 
             become unset by an Admin.  However, they should be shown as Checkboxes in a Person Form so they can be defined 
             as ReadOnly Access to these attributes.  But, when an Admin creates a new Person, this gets unset and the 
             attributes are shown as "FALSE".  If he tries to submit the request he gets the popup:
                "You are not authorized to perform this operation."
   
    APAR:    IZ22015
    Symptom: The example, itim_expi in Self Care, fails when Challenge/Response requires fewer questions than defined.
   
    APAR:    IZ22310
    Symptom: When importing an RMI-based profile that contains German umlaut characters in any component of the defined 
             Assembly Lines, ITIM correctly installs it, but any service operation requiring one of the affected Assembly
             Lines fails.
    Note:    A new property 'enrole.remoteservices.assemblyline.encodeusingUTF8' has been introduced
             in $ITIM_HOME/data/enRole.properties file. The value of this property decides whether the assemblyline 
             to be sent to ITDI should be encoded using 'UTF-8' format or not. If this property has a value set
             to true, then only the UTF-8 encoding will be used. In all other cases platform default encoding 
             will be used. UTF-8 encoding should be used when the assembly line contains special characters such 
             as German umlauts.
   
    APAR:    IZ22868
    Symptom: Need to provide a parameter option for disable/enable "Provisioning Parameter List" in Provisioning 
             Policy's entitlements, for use of "Advanced Provisioning Parameter List".
    Note:    A new property 'enrole.ui.entitlement.showStandardParams' has been introduced in
             $ITIM_HOME/data/ui.properties file. The value of this property decides whether to 
             to turn on/off Entitlement Provisioning Parameter List (Standard View). If this property
             is defined and has been set to false, then Entitlement Provisioning Parameter
             List (Standard View) will not be shown.
             The default value of this property is 'true'. This property will not be applicable in future 
             releases of ITIM.
   
    APAR:    IZ22283
    Symptom: Case mistmatch on erRoles DN value does not enforce policy correctly upon removal from a role.
   
    APAR:    IZ22992
    Symptom: If a service name has more than 100 characters, then the approval activity defined within
             the entitlement workflow for this service gets stuck in pending state.
   
    APAR:    IZ25558    32486
    Symptom: The text corresponding to 'cancel' hyperlink is getting trimmed on the Approval request page in the 
             To Do List item with single approval request.
    Note:*** After applying this Fixpack, it is recommended that the user does a hard-refresh (Ctrl+F5) 
             on the browser window, so as to enforce the new version of java script files immediately.


  Old Problems Fixed in the ITIM Self Service Application since Fixpack 4.6.0-TIV-TIM-FP0068 :
  
    APAR:    IZ17601
    Symptom: When changing the password in the Self Service UI, pressing the 'OK' button more 
             than once during the period of time until the "Request Submitted" screen appears leads to
             problems, such as:
                - two successful "Account Change Password" requests (even with password history)
                - one successful and one unsuccessful "Account Change Password" requests 
                (with password history)
                - an "HTTP 500 - Page not found" along with only one "Account Change Password" request
                - an Exception along with no "Account Change Password" requests at all.
    Note:*** After applying this Fixpack, it is recommended that the user does a hard-refresh (Ctrl+F5) 
             on the browser window, so as to enforce the new version of java script files immediately.
  
    APAR:    IZ19638
    Symptom: Incorrect German translation for Password History and Reversed History Length.

  Old Problems Fixed since Fixpack 4.6.0-TIV-TIM-FP0068 :

    APAR:    IZ19605
    Symptom: Documentation Update:
             Sample EmptyNotificationFactory.java code does not work properly with pendingwork and 
             workorder notifications.
    Note:    Please refer $ITIM_HOME/extensions/APAR_Doc/IZ19605.pdf to see the document update.

    APAR:    IZ20157
    Symptom: "Time of action (Approve/Reject)" column isn't listed correctly in "Approvals and Rejections" 
             report.
    Note:    Any customizations made to the out of box : 'Approvals and Rejections' report 
             prior to Fixpack upgrade will need to be redone after the upgrade. 
             If crystal reports have been configured, then the crystal report 'Approvals and Rejections' 
             will need to be reconfigured by importing the updated report template in file :
             'Approvals and Rejections.rpt' located in the $ITIM_HOME/extensions/examples/reports/crystal 
             directory, after the Fixpack upgrade.

    APAR:    IZ20243
    Symptom: The Audit Events report contains duplicate Authentication category entries in the output for
             any TIM account authentication for persons that have multiple accounts with same user ID.

    APAR:    IZ20451
    Symptom: Java script sections are truncated in Firefox browser when viewing the 'standard' view of 
             parameters in an entitlement.

    APAR:    IZ20733
    Symptom: Getting "java.security.InvalidParameterException: Invalid class name exception"
             when invoking the runRecon API using service of type IDI Data Feed.

    APAR:    IZ21500
    Symptom: If a user inadvertently enters an agent password on the service form with a trailing space, it will
             result in a 'Test Communication' is successful.However after saving the service form, subsequent
             provisioning operations fail with authentication errors because the trailing space was saved.

    APAR:    IZ21510
    Symptom: Documentation Update:
             ACI filter is not working correctly when a user creates a new account.  Under certain conditions 
             a user may be able to select a service for which no permission is granted.
    Note:    If an ACI contains a filter which defines the scope of its target entities, then, on 'ADD' operation,
             the authorization engine will ignore the filter present in the ACI and consider it as a wildcard 
             filter while displaying the form for that particular entity and evaluate the applicability of the
             target filter only on the actual submission of the request.

    APAR:    IZ22090
    Symptom: No results are returned when calling ProcessManager.getActiveProcesses(DistinguishedName tenant).

    APAR:    IZ17974
    Symptom: During the approval or rejection of an Approval Activity, if the workflow is large, 
             the buttons for approve or reject are still available during processing and 
             can be pressed again.
    Note:*** After applying this Fixpack, it is recommended that the user does a hard-refresh (Ctrl+F5) 
             on the browser window, so as to enforce the new version of java script files immediately.

    APAR:    IZ18929
    Symptom: Emails get aggregated as part of the Post Office function, even though the "Use Group Email Topic" 
             checkbox is not checked for Approval (or RFI) notification.

    APAR:    IZ19681
    Symptom: AE IZ14555 Fix completion.
             When using Oracle for the ITIM DB and running the Self Service UI after installing FP68 you will 
             get an error "CTGIMU252E", on the home page of SSUI after login.

    APAR:    IZ20436
    Symptom: Documentation Update:
             Custom code using the methods addValue(), setValue() etc from com.ibm.itim.common.AttributeValue 
             class fails to perform expected operation in some scenarios after applying FP 48 or later Fixpacks.
    Note:    Please follow the instructions mentioned in step 23 in the 'COMMON TASKS' section at the end of 
             the README.
   
    APAR:    IZ16544
    Symptom: Out of Memory when doing a Provisioning Policy preview, due to caching of all of the 
             information for the preview.
    Note:    In order to control the memory consumption during a Provisioning Policy preview operation,
             three new properties have been added to the $ITIM-HOME/data/enrolepolicies.properties file
             which are as follows -
             a. policy.policiescache.size - specifies the number of provisioning policies to be cached in
                memory for one preview request.
             b. policy.roledncache.size - specifies the number of role Distinguished Names to be cached
                in memory for one preview request.
             c. policy.servicedncache.size - specifies the number of service Distinguished Names to be 
                cached in memory for one preview request.
             All these properties default to a value 100, but can be optionally configured if required.
   
    APAR:    IZ16886
    Symptom: Audit Data will not be displayed if the data includes the word, "object". In these cases, 
             the ITIM GUI shows an empty (blank) audit information.
   
    APAR:    IZ16968
    Symptom: You will get javax.naming.InvalidNameException while running ldapClean if a "/" (backslash)
             is included in the ITIM account name to be removed.
   
    APAR:    IZ17600
    Symptom: Poor performance when doing ACI evaluations of AdminDomainAdministrator, BusinessPartnerSponsor, 
             PersonAccount, PersonRole, and Supervisor relationships.

   
    APAR:    IZ17621
    Symptom: If the Lifecycle rules filter is not specified with the correct syntax, the wrong LDAP filter 
             gets generated which may lead to unexpected results.
    Note:    The System expression syntax has been changed to support the relational operators '=' 
             and '~='.
             Currently the documentation in the help reads as follows:
             <snip>
               System expressions consist of an attribute name, a relational operator ( <= or >= ),
               a dollar sign ( $ ) followed by a curly brace ( { ) immediately followed by the system.date
               keywords, then a plus or minus arithmetic operator ( +/- ) followed by a number in days, 
               then a right curly brace ( } ) to close the expression. 

               (gmtattributename [ <= | => ] ${system.date [ + | - ] days}) 
             </snip>

             It will be updated in a future release as follows:
             <snip>
               System expressions consist of an attribute name, a relational operator ( =, ~=, <= or >= ), 
               a dollar sign ( $ ) followed by a curly brace ( { ) immediately followed by the system.date 
               keywords, then a plus or minus arithmetic operator ( +/- ) followed by a number in days, 
               then a right curly brace ( } )to close the expression. 

               (gmtattributename [ = | ~= | <= | >= ] ${system.date [ + | - ] days})
             </snip>
  
  Old Problems Fixed in the ITIM Self Service UI Application in the last Fixpack and prior :

    APAR:    IZ16009
    Symptom: The new Self Service UI included in ITIM 4.6.0 FP61 has a misspelled password rule;
             The "Minimum numeric characters" password rule is misspelled.  The word minimum is 
             misspelled as "Mininum".

    APAR:    IZ10057
    Symptom: Account delete in SSUI throws error CTGIMU001E, You do not have authority 
             to view and confirm deletion for this account.
  
    APAR:    IZ11281
    Symptom: Regular expression field on password policy rule is not displayed when using the SSUI.
  
    APAR:    IZ13143    27847
    Symptom: NEW FUNCTION ENHANCEMENT
             The SSUI login page is not customizable.
             The login page will use the same customization strategy as the Main application pages for 
             the Self Service User Interface. 
    Note *** If you have customized the look and feel of the SSUI application, then please follow the
             step below before applying this Interim Fix :
              Take the backup of the all the files changed under the path -
               <WAS_HOME>/installedApps/<nodeName>/ITIM_Self_Service.ear/itim_self_service.war/custom/
             After applying the Interim Fix redo all the customization changes by merging the changes
             with the new version of files located under the following directory -
               <WAS_HOME>/installedApps/<nodeName>/ITIM_Self_Service.ear/itim_self_service.war/custom/
               
    APAR:    IZ08287    SSUI
    Symptom: A user is not able to request a new account using Self Service GUI and receives :
                CTGIMV807E This form contains a non-compliant value that must be corrected; however, you do 
                not have permissions to edit the field. Please contact your system administrator. 
             This works fine in the regular ITIM GUI.

    APAR:    IZ09096    SSUI
    Symptom: ITIM Self Service UI in German does not display certain German characters correctly.

    APAR:    IZ02475    SSUI
    Symptom: Error CTGIMV037E when attempting to modify a RACF account using SelfService UI.

    APAR:    IZ05732    SSUI
    Symptom: Challenge response questions are not listed in the order in which they where entered
             in the SelfService UI.  The questions are displayed in the correct order on the ITIM GUI.

    APAR:    IZ06377    SSUI
    Symptom: When in the SelfService UI using the German Language, some error messages are displayed 
             in English.

    APAR:    IZ06378    SSUI
    Symptom: When in the SelfService UI using the German Language, some screens are displayed in 
             mixed languages. (German and English)

    APAR:    IZ06472    SSUI
    Symptom: When in the SelfService UI using the German Language, the password rules are displayed 
             in English.

    APAR:    IZ06552    SSUI
    Symptom: A Listbox or a Dropdown control configured as "Search Filter" type and their 
             "Source Attribute" field set to value "dn" for any attribute on a person form, does not
             function correctly on the SelfService UI.

    APAR:    IZ05490    SSUI    29138
    Symptom: SSUI Internal code changes to make SelfServiceUI 4.6 code compatible with the ITIM 4.6 codebase. 
             Functions from ITIM 4.6 code base are referenced in SelfServiceUI 4.6 code, so a change
             in the prototype of these functions in ITIM 4.6 code base, necessitated a change in 
             SelfServiceUI 4.6 code also.

    APAR:    IZ05491    SSUI    29527 
    Symptom: NEW FUNCTION
             SSUI Internal changes for German translation enablement.

    APAR:    IY99328    SSUI
    Symptom: SSUI CTGIMV808E error, when attempting to view disallowed account in Self Service UI.
   
    APAR:    IZ15155
    Symptom: When running the Operation Report for Operations: "Modify Provisioning Policy" for last 
             month, with data synced, it doesn't produce data.
    Note:    Any customizations made to the out of box : 'Operation' report prior to Fixpack upgrade
             will need to be redone after the upgrade. 
             If crystal reports has been configured, then the crystal 'Operation' report will need 
             to be reconfigured by importing the updated report template in file : 'Operation.rpt' 
             located in the <ITIM_HOME>/extensions/examples/reports/crystal directory, after the 
             Fixpack upgrade.

    APAR:    IZ16583
    Symptom: When using an MS SQL ITIM Database and providing the enrole user a password for dbConfig 
             with a plus ("+") sign in it you get an error.

    APAR:    IZ16777    31769
    Symptom: Prior to this Fixpack ITIM always updates the index entries of the LDAP server during the 
             ITIM fixpack application, even though there may be no index change.  ITIM no longer updates
             the LDAP Indexes for iPlanet unless there is a required change/update in the indexes. 

    APAR:    IZ18521    32138
    Symptom: Documentation Update:
             A problem may occur while viewing SAP Role sub form if the CustomLabels.properties file of SAP 
             profile jar contains a non UTF-8 character after you have installed APAR IZ04801.   The SAP
             profile may contain non UTF-8 characters and the SAP Profile is expected to be changed in the
             future to avoid this issue.  Until the SAP profile is updated, the following instructions will 
             correct the problem.
             .
    Note:    In the SAP profile, the entry corresponding to custom label key 'saproleempty' is as stated below:

                 saproleempty=No Roles assigned to this account. Please click ‘Add’ to search for Role(s) to assign.

             In the above entry, the character ‘ is a non UTF-8 character and therefore, if the SAP profile is
             imported after applying FP68(APAR IZ04801), it would lead to a sub form rendering error in certain 
             scenarios.  To resolve this issue the following steps need to be executed:
             1.Extract the SAP profile jar to a temporary location.
             2.Open CustomLabels.properties file (present within the extracted folder) in any text editor.
             3.Edit the entry for 'saproleempty' by changing the value as follows :

                 saproleempty=No Roles assigned to this account. Please click "Add" to search for Role(s) to assign.

             4.Save the file and quit the editor.
             5.Recreate the SAP profile jar and import it into ITIM.
             An alternate solution would be to edit the above entry directly in the I18NMessages table
             of ITIM's database.

  Old Fixes included from previous Fixpacks :

    APAR:    IZ14948
    Symptom: Creation of a new person as a part of an HR feed operation on an ITIM server 
             (with application server security turned on) leads to 'ObjectNotFoundException' 
             filling up the logs.
   
    APAR:    IZ15356
    Symptom: Documentation Update:
             ACIS are not enforced when displaying an Admin Domain in an RFI.
    Note:    The Infocenter will be updated in a future release to contain the following information:
             When a custom field is added to an ITIM template, such as the Person template, by using the 
             form designer, the search filter should not be used if ACI filtering is desired.  With the
             search filter, the ITIM "category" cannot be defined, and is set to "global".  When the 
             category is set to "global", the search result is not filtered through ACIs by design.  The
             user should use the "search control" which allows to set the category to achieve the proper
             result.
   
    APAR:    IZ15385
    Symptom: When running the "Individual Account by Role Report", if the Org Role that is selected is
             in the membership of multiple provisioning policies and these policies reference the same 
             services, then in the generated report you may see duplicate entries.
    Note:    Any customizations made to the out of box : 'Individual Account by Role Report' report 
             prior to Fixpack upgrade will need to be redone after the upgrade. 
             If crystal reports has been configured, then the crystal 'Individual Account by Role Report' 
             report will need to be reconfigured by importing the updated report template in file :
             'IndividualAccountsByRole.rpt' located in the <ITIM_HOME>/extensions/examples/reports/crystal 
             directory, after the Fixpack upgrade.

    APAR:    IZ16438
    Symptom: After installing ITIM Fixpack 4.6.0-TIV-TIM-FP0061, an Import of a profile removes the 
             German Umlaut characters.  

    APAR:    IZ17101    31914
    Symptom: When the JavaScript functions "process.auditEvent()" and "activity.auditEvent()" are used,
             the records written to the audit trail never receive a timestamp.
    Note:    The fix is applicable only for the requests which will be executed after applying this Interim Fix.

    APAR:    IZ11259
    Symptom: On assigning an Authorization Role to a SAP account, the value corresponding to the
             newly assigned Authorization Role present in the role attribute of the SAP account 
             entry in LDAP, contains a trailing space character.
    Note:    After applying this fix, the following behavior changes may be observed -
             1. On searching for SAP Authorization Roles in the SubForm window the search results
                will display the names of roles as they are stored in directory server along with 
                role delimiter character : "|". 
             2. The existing or newly assigned role names in the SubForm window may display an
                optional description following the name of the role. So the format will be as
                follows :-
                a. If the optional description is not present : <actualRoleName>
                b. If the optional description is present :     <actualRoleName>|<option field>

    APAR:    IZ13559
    Symptom: Enforcement type of a service attribute parameter containing multiline Java Script changes
             from 'Mandatory' to 'Default' when switching from 'Advanced Provisioning Parameter List'
             view to 'Provisioning Parameter List' view and back to the 'Advanced' view of a provisioning
             policy entitlement.
    
    APAR:    IZ13673
    Symptom: Documentation Update:
             The ITIM documentation shows that the summary code for a timed out process is set to ST. 
             However it seems to be set to SF  which is Failed process summary code.
    Note:    A future revision of the ITIM Infocenter will be made to show:
             For an approval activity, if a Time out occurs, the Activity Result Summary Code is set
             to  SF  (i.e. FAILED) and if a participant resolution failure occurs, the Activity Result 
             Summary Code can take the following values:
             AA (i.e. Approved):If the request has been submitted by System Administrator, then 
                                the request is automatically approved by System administrator 
                                (even though it is not explicitly set as an escalation participant) 
                                and the result is set to 'Approved'.
    
             SF (i.e. FAILED) : If the request has been submitted by a non Admin user or if the escalation
                                participant is not defined at all, then the Approval activity terminates 
                                with result set to 'Failed'.
             Note that the second case holds true even when the requester is System Administrator. 
             If the property enrole.workflow.skipapprovalforrequester is set to true in enRole.properties 
             file and the requester is identified as one of the participant users, then the approval is 
             completely skipped and the Activity Result Summary Code is set to AA  (i.e. Approved).
             When an RFI activity times out or fails due to participant resolution failure, the 
             Activity Result Summary Code is set to  'SF'  i.e., FAILED (for both cases).

    APAR:    IZ13946
    Symptom: JavaDoc for ProcessManager.getActiveProcesses(String type) method needs additional explanation.
    Note:    The name of the input parameter has been changed from 'type' to 'definitionId' to reflect the
             functionality.
             Java documentation for the method ProcessManager.getActiveProcesses(String definitionId) has 
             been updated to reflect the following information:
             <snip>
              Returns the active processes of the given definition id in the workflow engine.

              Parameters :
               definitionId - Definition id of the processes to retrieve. Definition id uniquely identifies a 
               workflow design or definition.
               It can have the following values :

                a. Value of the 'erglobalid' attribute of an operation entry stored in the directory server under
                   'ou=operations' folder. For example, the definitionId value "00000000000000000009" represents 
                   the workflow design of the default person add operation entry stored under 'ou=operations,
                   ou=itim,ou=<tenant>' with the value of it's erglobalid attribute as "00000000000000000009" in 
                   the directory server.
 
                b. String constant in the property names with prefix 'enrole.workflow.' defined in the file 
                   <ITIM_HOME>\data\enroleworkflow.properties. For example, for a definitionId say "RC" the file
                   enroleworkflow.properties will have an entry such as the following -
                     enrole.workflow.RC=reconciliation.xml.
                   The enroleworkflow.properties file usually contains string constants for system processes like
                   reconciliation. 

                c. Value of the 'erglobalid' attribute of an entitlement workflow entry stored in the directory 
                   server under 'ou=workflow' folder. 

              Returns :
               Collection of WorkflowProcessEntities representing active processes i.e. processes having state 
               as 'R','I' or 'S' of the given definition id. 
             <snip>

    APAR:    IZ14244
    Symptom: When using the ITIM API, PersonMO.getData() to get the person data that has to be changed and
             if read access is not allowed for org role, then the modify person operation fails with error:
               LDAP: error code 20 - Attribute Or Value Exists.

    APAR:    IZ14389
    Symptom: NullPointerException gets logged in the SystemOut.log and trace.log files when you select 
             an orphan account from the search results on the 'Orphan Accounts' page under the service
             menu.

    APAR:    IZ14391
    Symptom: Properties controlling log wrapping in enRoleLogging.properties are not being honored.
    Note:    The issue has been observed only on the Windows platforms where both enRole application and 
             optional SelfServiceUI application are installed and running. 
             Execute the additional steps listed in step 22 in the 'COMMON TASKS' section at the end of 
             the README 

    APAR:    IZ14555   31751
    Symptom: The ITIM API, WorkflowAssignmentMO.getData().getActivityParticipant() returns 'null' 
             even though the activity has a participant.
    
    APAR:    IZ14736
    Symptom: When running reconciliation against any adapter to update existing data, reconciliation process
             fails with ArrayIndexOutOfBoundsException if RDN of a supporting data entry contains a
             double quote character.
  
    APAR:    IZ10930
    Symptom: After migration from ITIM 4.5.1 to ITIM 4.6, the 'Result Detail' field has been removed from 
             'Completed Requests -> Request Details' screen for the 'Enforce Policy For Person' activity.
    Note:    After applying this fix  'Result Detail' field will be shown for the activity 'Enforce Policy 
             For Person' in the audit log, only when execution of this activity has lead to one or more 
             accounts owned by the person becoming non-compliant.The fix is applicable to only those activities 
             which have been initiated after the application of this fix.

    APAR:    IZ11292
    Symptom: Documentation Update:
             Form Validation doesn't take place at higher level in RFI group of items, but it 
             does take place at lower level of RFI item.
    Note:    A future revision of the ITIM Infocenter will be made to show:
             Form Validation doesn't take place at a higher level; i.e. while submitting a group of two or 
             more RFI workitems, but it does take place at lower level when a single RFI form is opened 
             and submitted. This is because constraints are validated only when the form is displayed. 
             At the higher level the form is not displayed as we select multiple RFI items. Therefore 
             no validation is performed.
  
    APAR:    IZ12787
    Symptom: Custom ITIM API application on WAS 6.1, with security enabled, can't communicate to ITIM Server on 
             WAS 5.1 with security enabled on a different realm.

    APAR:    IZ13160
    Symptom: Error message found in dbupgrade.stdout:
             After upgrading ITIM Server from 4.6.0-TIV-TIM-FP0033 or a later version to 4.6.0-TIV-TIM-FP0061, 
             the following error message was found in dbupgrade.stdout:
               Exception in readDataFileIntoString (/opt/IBM/itim/config/rdbms/db2/464to465.dll): 
               java.io.FileNotFoundException:  /opt/IBM/itim/config/rdbms/db2/464to465.dll
    Note:    If you have upgraded ITIM from Fixpack 4.6.0-TIV-TIM-FP0033 or later version to 
             Fixpack 4.6.0-TIV-TIM-FP0061 and have not performed the steps mentioned for IZ13160 included in
             IF65 and if you need to use the enhancement provided in APAR IZ11297, Enhancement to support 
             Multiple Password-synch Agents, you must run the ddl commands provided in file 464to465.ddl 
             present under directory $ITIM_HOME/config/rdbms/<database-type>.

    APAR:    IZ13558
    Symptom: Exception received in custom password rule when attempting to retrieve owner attributes.
             When attempting to provision a new ITIM account for a person, get CTGIMO002E when trying 
             to set password.

    APAR:    IZ13671
    Symptom: Null Pointer Exception during account restore when ITIM database type is MicroSoft SQL.
             This exception may occur only when the database type is MicroSoft SQL and the property 
             'account.restore.password.suppress' is set to 'true' in enrole.properties and the 
             account restore request was retried after being deferred because the agent was not alive.
  
    APAR:    IZ13685
    Symptom: Documentation Update:
             The ITIM Database Schema documentation lists columns not present in database.
             In the ITIM V4.6 Database and Schema Reference the RECONCILIATION_INFO table lists 
             the Column Names ServiceDN, UserDN, and RECONTIME, but these columns do not exist. 
             Also the Operation column contains values which are not documented.
    Note:    Please refer $ITIM_HOME/extensions/APAR_Doc/IZ13685.pdf to see the document update.
  
    APAR:    IZ09510
    Symptom: Internal code fixes for provisioning policy code.  
             ProvisioningPolicyManager.modifyPolicy() throws AuthorizationException against 
             an ITIM administrator when only entitlement is modified.
  
    APAR:    IZ09932
    Symptom: When using MS SQL server DB, in the completed requests screen, the error detail pop-up 
             for a process completed with status of WARNING has a very slow response. 
    Note:    As a fix for the defect, the SQL query used in Error-display popup in 
             View Completed Requests section has been optimized for all databases.
  
    APAR:    IZ10789
    Symptom: The value set using error.setMessage() in a script node prior to returning the error
             from the node is not available on the General Tab of completed request when used in 
             person operation workflows.
  
    APAR:    IZ10988
    Symptom: Removing data from an attribute of one RFI changes the value of the same attribute in
             a subsequent RFI to the string : "null". 
  
    APAR:    IZ11238
    Symptom: When using an asynchronous service, such as UPA, in some scenarios ITIM considers the
             remote resource status as FAILED even though the resource is alive.
  
    APAR:    IZ12649
    Symptom: AE IZ07783 FIX COMPLETION.
             After installing ITIM Interim Fix 4.6.0-TIV-TIM-IF0062, RMI Adapters no longer work.
  
    APAR:    IZ13070    31468
    Symptom: Passivation issue due to usage of non-serializable members in a stateful session EJB of
             ITIM. This leads to error messages such as the one below to be logged in the AppServer
             logs :-
             <snip>
                [11/12/07 21:38:55:416 CST]  104995e StatefulSessi W CNTR0005W:
                      An enterprise bean could not be passivated: StatefulBeanO(BeanId
                             (enRole#wf_ejb.jar#wf_ejb.enroleejb.ListStoreManagerHome,11625f62a51),
                             state = PASSIVATING)
                com.ibm.ejs.container.activator.StatefulActivateOnceActivationStrategy@10f3668
                java.rmi.RemoteException: passivation failed; nested exception is:
                java.io.NotSerializableException:
                com.ibm.itim.workflow.model.type.ListStore
                at
                com.ibm.ejs.container.passivator.StatefulPassivator.passivate(StatefulPassivator.java:124)
             </snip>
  
    APAR:    IZ07783
    Symptom: The following message fills up the log, even at MIN level.
                <Trace Level="MIN">
                <Time Millis="1191353472587"> 2007.10.02
                15:31:12.587-04:00</Time>
                <Server Format="IP">prdai161</Server>
                <ProductId>CTGIM</ProductId>            
                <Component>com.ibm.itim.fesiextensions</Component>
                <ProductInstance>timpc1</ProductInstance>
                <LogText><![CDATA[No wrapper object available or wrapper is not
                necessary for the java object type java.lang.String]]></LogText>
                <Source FileName="com.ibm.itim.fesiextensions.DataMapper"
                Method="javaToScriptWrapper"/>
                <Thread>MessageListenerThreadPool : 632</Thread>
                </Trace> 
  
    APAR:    IZ08812
    Symptom: The property 'enrole.ui.timeoutURL' defined in $ITIM_HOME/data/ui.properties file is not 
             honored during session timeout from certain areas in ITIM GUI.
  
    APAR:    IZ09264
    Symptom: While deleting multiple accounts, ordered deprovision is run even when the prerequisite service 
             account is not selected for the deletion.
  
    APAR:    IZ11782      31448
    Symptom: A non-admin user can view the list of ITIM accounts which do not satisfy the ACI filter containing 
             non standard attributes like 'erhomepage'. However he can not view the details of the account and 
             cannot perform any operations on these accounts as the ACI filter is honored for these operations.

    APAR:    IZ07571
    Symptom: When a space is added at the end of an RMI URL, the TEST Service fails.

    APAR:    IZ08011
    Symptom: If you add or removes SAP Authorization Roles, the Start and End Dates of existing Roles 
             may also get changed.

    APAR:    IZ08157
    Symptom: The "Read-Only in Modify" property, enabled (through the form customization) on a given 
             account class attribute, is circumvented when an ITIM user trying to submit an account
             change that is not compliant with the prevalent provisioning policy presses the back button 
             in the non-compliance alerting panel and returns to the original account change form.

    APAR:    IZ08190
    Symptom: When using some single character RACF connect groups, for example name: A, ITIM appears to 
             be looking up any corresponding label for the character (in labels.properties) and displaying 
             the label, rather than the group name, when the RACF connect group subform is displayed.
             
             For example:  if the connect group name is "A"....ITIM looks up in labels.properties and 
             displays the group name as "Aborted" in the subform.

             If there is no corresponding label for the group name, the group name is displayed correctly 
             (example:  Z would be displayed as Z, since there is no Z value in labels.properties).

             But, they hit this issue with any of the one-character values in labels.properties 
             (A=Aborted, B=Bypassed, etc).

    APAR:    IZ08459 
    Symptom: When viewing provisioning policies, you may get the following error:
                "Server caught unhandled exception from servlet [ProvisioningPolicyListServlet]:
                com.ibm.dataservices.model.domain.AdminDomain"

    APAR:    IZ05783
    Symptom: When a TO DO item, Approval and Action request (email notification), is sent to a 
             Participant with no email address, the Approval request goes to the Participant and
             the Action request goes to the Escalation Participant.  Both the TO DO items, Approval
             and the Action requests, should go to the same Participant.

    APAR:    IZ06467
    Symptom: Requests remain in pending status and never finish if an invalid enforcement is set 
             to "erservice" attribute in the advanced provisioning parameter list of a provisioning policy.
             
    APAR:    IZ06711
    Symptom: After a client adds a person to an org role and they review the results in the View Completed 
             Requests, drill down to the ModifyPerson operation, then enter it, then select the Data tab, 
             the value of "Role Changes" shows up the person name instead of the org role name.
    Note:    The 'Role Changes' field only shows names of dynamic roles added to or removed from the person
             as a result of a modify operation. If no dynamic role changes were found to be applicable
             after the person modification, this field will not be displayed in the Data tab. This defect
             fix does not affect old workflow processes.

    APAR:    IZ06712
    Symptom: During the Daylight Savings Time, when a reconciliation is run and then the reconciliation 
             statistics report is viewed, the date/time shown for the last reconciliation is off by one 
             hour.
             
    APAR:    IZ07364
    Symptom: AE FIX Completion for FP48.
             When the user submits a modify operation on a given account created for any RMI-dispatcher-based 
             service (that is a service based on the ITDI service provider), for each attribute <attr> being 
             modified the corresponding definition in the IWE to be passed to the RMI dispatcher has the 
             following definition:
                <attr>:replace:<attr-value>: op-code:undefined

             Prior to FP48, the definition shown below:
                <attr>:replace:<attr-value>: op-code:unchanged

             This causes a problem for adapters that rely on the value opcode to be set as "undefined".
             For example; with the i5OS adapter the attribute replacement is skipped.

    APAR:    IZ07590
    Symptom: FormValidationServlet fails if "Suggested Value" contains ampersand character.
    
    APAR:    IZ07741
    Symptom: The Cue Text (breadcrumb) doesn't change back to appropriate (Add | Modify Account/Person) after 
             touching an RFI.  It remains with the Cue Text from the RFI.

    APAR:    IZ05067
    Symptom: Participant look-up in Work Order hangs request indefinitely, if the subject account is an 
             orphan account, i.e. owner is null and the custom participant of the Work Order node is 
             of type 'REQUESTEE'.  Work Order and approval activities should fail participant look-up 
             when owner of subject account is null.

    APAR:    IZ05103
    Symptom: A  SAP role with a "/" character in the name results in problems trying to display the list 
             of SAP roles from the account form widget in the ITIM GUI. The search widget for the SAP 
             roles returns empty results and an ArrayIndexOutOfBoundsException is logged in the ITIM 
             trace.log file.

    APAR:    IZ05951
    Symptom: When the Virtual List View (VLV) is enabled by setting the following in enRole.properties :
                enrole.search.vlv.enable=true
                enrole.search.sss.enable=true
             the ITIM search function fails with NullPointerException.

    APAR:    IZ06252
    Symptom: Additional Information needed for APAR IZ03822.  If this step is not performed the functionality
             still works, but when a user selects the Process Type from the drop down box, he will not be able 
             to see the text 'Life Cycle Rule Execution', which was newly introduced, but would see only the 
             key 'process.type.lc'. To see the new text in the drop down box, perform steps 3 and 4 per below 
             instructions :-
                3. Add a new label by adding the following line:
                   'process.type.lc=Life Cycle Rule Execution'

                4. Save the file and quit the editor.
             Please refer the updated COMMON TASKS number 19 for APAR IZ03822 in this README file. The update 
             involved was replacing Step 3 in the 4.6.0-TIV-TIM-IF0056.README by the steps 3 and 4 listed
             above.

    APAR:    IZ06253
    Symptom: Documentation Update:
             Filter change to lifecycle rule doesn't take effect immediately when running it manually.
    Note:    The documentation for Lifecycle rule processing in ITIM Infocenter clearly states that 
             Lifecycle Rule operations can take an extended period of time to finish for the entire result 
             set returned from the evaluation of the lifecycle rule filter primarily due to the manual 
             workflow activities associated with the operation. 
             
             In addition to this, the following information will be added to ITIM Infocenter:
             The execution of the Lifecycle rules which are associated with profiles or categories, is 
             dependent on a property, 'enrole.profile.timeout', defined in $ITIM_HOME/data/enRole.properties 
             file, in minutes. So, even if the filter present in the lifecycle rule is modified and 
             executed manually, then it would take the previous filter the maximum  time of the refresh 
             interval to elapse (specified in minutes), for the above property.  Once this period is over, 
             the modified value for the filter is then used during Lifecycle execution.

    APAR:    IZ07146
    Symptom: Audit log data may be compromised by user sql injection.

    APAR:    IZ07359    30226 
    Symptom: Deadlock occurs occasionally when trying to display AUDIT LOG in View Pending Requests.
    Note:*** Execute the additional steps listed in step 21 in the 'COMMON TASKS' section at
             the end of the README.

    APAR:    IZ01769
    Symptom: You may get "LDAP error 16 - No such attribute" when removing an attribute of 
             an AD account.

    APAR:    IZ03822
    Symptom: You are not able to generate ITIM reports with Lifecycle information.
    Note:*** Execute the additional steps listed in step 19 in the COMMON TASKS section at the end 
             of the README.
    
    APAR:    IZ03983
    Symptom: ACIs defined for target 'All Accounts' and a non empty target filter don't evaluate correctly.

    APAR:    IZ04263
    Symptom: Multiple policies cause unexpected behavior and may get a NullPointerException. Need to be able 
             to configure multiple policies with same priority for the same Org Role membership and same 
             entitlements, and still be able to have their erTAM4Group scripts evaluate correctly.  

    APAR:    IZ04598
    Symptom: The following lines are incorrect in Labels.properties:
                gloablLDProcessName=Multiple Accounts Delete
                gloablLDProcessDesc=Multiple Accounts Delete Process
             They Should be:
                globalLDProcessName=Multiple Accounts Delete
                globalLDProcessDesc=Multiple Accounts Delete Process

             This causes the <RE> tags to fail in notice text where process.name or process.description are 
             passed in for replacement.
    Note:*** Execute the additional steps listed in step 20 in the COMMON TASKS section at the end 
             of the README.

    APAR:    IZ04801
    Symptom: Garbled/corrupted description stored in V3.modifiedschema when importing an adapter profile with 
             schema.dsml which contains attribute with DBCS(utf8) description.

    APAR:    IZ05063
    Symptom: In the customized person creation form, whenever we uncheck the "Never" checkbox of date field,
             a java script error message is displayed.

    APAR:    IZ05084
    Symptom: CTGIMI003E message isn't correctly displayed when Japanese is selected at logon time.

    APAR:    IZ05313
    Symptom: The ACI for BPPerson also affects Custom Person and regular Person.
  
    APAR:    IZ05801
    Symptom: Installer parsing error in com.ibm.CheckLdapLevel.checkLdap() when using Sun One iPlanet and
             installing an ITIM Fixpack.

    APAR:    IZ08836
    Symptom: When the Provisioning Policy is enforcing a Mandatory Attribute which is hidden on the Account 
             form, the manual account modification operation is not allowed through ITIM GUI.
             
    APAR:    IZ08837
    Symptom: ITIM doesn't save entity reference in post office XHTML.  Get error message:
                CTGIMC106E An error occurred while parsing the XHTML Body field value.
                The value entered for the XHTML Body contains an incorrect dynamic content tag.

    APAR:    IZ09232
    Symptom: When ITIM workflow process.resultDetail is split, trimmed and reconcatenated for long strings, 
             the spaces inside the string are also inadvertently trimmed.

    APAR:    IZ09258
    Symptom: NullPointerException is thrown during suspend operation on a disallowed account, when the suspend
             operation workflow is customized to modify the account and the Policy Enforcement of the service 
             is set to 'Alert'.
    Note:    NullPointerException has been fixed but the account modify operation on the disallowed account
             will throw an exception in this case to be consistent with the behavior when using ITIM UI to 
             modify a disallowed account.
    
    APAR:    IZ11297    26268
    Symptom: NF NEW FUNCTION
             Enhancement to support Multiple Password-synch Agents.
    Note:    The following new properties have been introduced in $ITIM_HOME/data/enRole.properties file :
             1. enrole.passwordsynch.enabledonresource
                This property when set to 'true' will enable this enhancement.
                The property indicates that a password change or restore request from ITIM may result in a 
                reverse password synch\ validation request from the plugin installed on resource. 
                The default value of this property is 'false'.

             2. enrole.passwordsynch.toleranceperiod
                This property specifies the maximum duration in seconds between a password change request sent
                from ITIM to remote agent, and receiving a reverse password synch request from the plugin 
                installed on the remote resource.
                The default value set is 60 (in seconds).

             3. enrole.PasswordSynchStoreMonitor.heartbeat
                The value set to this property, in hours, specifies the password synch transaction monitor 
                heartbeat. 
                The default value set is 1 (in hour).

    APAR:    IZ11295    31209
    Symptom: A non administrator can view details of a process which was not submitted by him
    
    APAR:    IZ11298    30830
    Symptom: Remove the following published methods from the classes com.ibm.itim.apps.recon.ReconManager and
             com.ibm.itim.apps.recon.ReconUnitData :
                setServiceReconParams()
                getServiceReconParams()
             and deletion of the published class 'com.ibm.itim.apps.ejb.recon.ServiceReconParams'.
             These methods and the class were incorrectly added to the ReconManager API.
    Note:    The following steps are applicable only for the deployments which are being upgraded from Fix
             level IF32 or higher :
             The following files or classes are no longer supported and hence should be deleted manually to
             build the example.jar successfully :
             
             1. $ITIM_HOME/public/extensions/examples/apps/bin/win/setServiceReconParams.bat
             2. $ITIM_HOME/public/extensions/examples/apps/bin/unix/setServiceReconParams.sh
             3. $ITIM_HOME/public/extensions/examples/apps/src/examples/api/recon/SetServiceReconParams.java

    APAR:    IZ11300    30864
    Symptom: Enhanced LDAP Upgrade code to prevent OutOfMemory when upgrading systems with large ITDS deployments.
             
    APAR:    IZ11303    31208
    Symptom: When the 'enrole.search.windowsort.enable' property is set to 'true' in enrole.properties file 
             and a user navigates to -
                Person->Manage Accounts
             in ITIM UI and the number of accounts owned by the selected person exceeds the value of property
             'enrole.ui.maxSearchResults' defined in ui.properties file then the account list for the 
             selected person is not displayed on the UI.
    
    APAR:    IZ11304    31237
    Symptom: Code optimization to prevent performance degradation when refreshing the organization tree.

    APAR:    IZ02761
    Symptom: Installing ITIM fix pack changes WebSphere JVM settings back to defaults.

    APAR:    IZ03452
    Symptom: The context menu when editing an attribute is incorrectly placed at the top of the form designer.
    Note:    Execute the additional steps listed in step 10 in the COMMON TASKS section at
             the end of the README.

    APAR:    IZ04040
    Symptom: Documentation Update:
             Problem Description:  The following text will be changed in the ITIM Infocenter:
             EXCLUDED 
             Select EXCLUDED to specify that the attribute does not allow specific values. The disallowed values 
             must be defined in the Value text field. Defining an EXCLUDED attribute value allows all values 
             except those defined in the Value field. 
             From:
             DEFAULT, MANDATORY, and OPTIONAL enforcement types can be categorized as ALLOWED attributes. If an 
             attribute is not specified as one of the ALLOWED types, the attribute is implicitly excluded. 
             to:
             DEFAULT, MANDATORY, and OPTIONAL enforcement types can be categorized as ALLOWED attributes.  
             When there is an attribute defined as one of the ALLOWED types of MANDATORY or OPTIONAL, other 
             attributes not defined are implicitly excluded.
             
    APAR:    IZ04631
    Symptom: A Workflow with a call to AccountSearch.byUidAndService fails if a duplicate service entry exists 
             in the LDAP recycle bin.

    APAR:    IZ05049    29365
    Symptom: After upgrading to IF52, it is no longer possible to execute a data synchronization under 
             some circumstances.

    APAR:    IZ05492    28285
    Symptom: NullPointerException when calling the getContainers method of the ContainerManager with a null 
             argument for the parent.

    APAR:    IZ05494    29494
    Symptom: When some OutOfBox reports are run by non-admin user, the reports do not get generated.

    APAR:    IZ01107   
    Symptom: A Modified Label in an Account Form is not displayed in the Advanced Provisioning Parameter list.

    APAR:    IZ01112
    Symptom: Documentation Update:
             Problem Description: The LDAP Index Data on Sun One iPlanet Directory Server is lost after applying
             an ITIM Fixpack.
    Note:*** Execute the additional steps listed in step 13 in the COMMON TASKS section at the end 
             of the README.

    APAR:    IZ01338
    Symptom: The NEW_DATA field of PROCESSLOG DB table is no longer available for designing reports in ITIM. 
             It is not possible to design and run a custom report to include that information.
    Note:*** By default, columns of the following restricted data types :
             BLOB, CLOB, BINARY, VARBINARY, LONGVARBINARY and LONGVARCHAR 
             are not available when designing or executing custom reports. A new property, 
             'allowedRestrictedColumns' has been introduced in <ITIM-HOME>/data/reporttabledeny.properties, 
             which allows ITIM administrators to explicitly allow columns of restricted data types to be used 
             for designing and executing custom reports.
             Execute the additional steps listed in step 14 in the COMMON TASKS section at the end 
             of the README.

    APAR:    IZ01758
    Symptom: The threads spawned by ITIM Server during reconciliation are not killed and remain active until
             the Application Server is stopped.  This happens when the reconciliation activity has been 
             active for a duration that exceeds the "Max Duration" specified on the Reconciliation Unit, 
             and the process is prematurely aborted by an end user using ITIM GUI or API.

    APAR:    IZ01829
    Symptom: Documentation Update:
             Problem Description: ACIs for 'erRoles' attribute on a Person not working, unless Org Role ACI
             with 'Modify' permission granted is created.
    Note:    For modifying the 'erRoles' attribute of a person entity, i.e. to assign an Organizational Role 
             to a person or remove the person from an Organizational Role, an ITIM user should have all the 
             following permissions and operations granted by defining appropriate ACIs :
             1. 'Write' attribute permission for 'erRoles' attribute, of the person to be modified.
             2. 'MODIFY' operation on the person to be modified.
             3. 'MODIFY' operation for the Org Role, that is to be removed from or added to the person.

    APAR:    IZ01882
    Symptom: Documentation Update:
             Problem Description: Owners of disabled ITIM accounts still receive notification mails targeted to 
             them as participant of RFI, approval, etc.
    Note:    This behavior is by design. The intention behind this design was that an ITIM account may be 
             disabled when the user receives the notification mail, but may get activated before the escalation 
             time of the RFI or approval work item, and so can login to ITIM and take necessary action on the
             work item.

             To achieve the behavior of preventing notification mails from being sent to inactive user one may
             use the participant type: 'Custom'.  JavaScript for the 'Custom' participant type, can be coded to
             lookup and check the status of the ITIM Account of the designated participant person.  If the status
             is found to be inactive, an alternate participant (e.g. System Administrator), instead of the normal
             designated participant person, may be returned from the JavaScript code.
             Please refer $ITIM_HOME/extensions/APAR_Doc/IZ01882.zip for details on this workaround.

    APAR:    IZ02621
    Symptom: The ITIM API call, SearchMO.getResults(), returns two results less than the specified 'maxSize'
             (specified using SearchMO.setMaxSize()) if the number of results matching the search criteria 
             were more than 'maxSize'.

    APAR:    IZ02727
    Symptom: Documentation Update:
             Problem Description: Invalid references for enRoleAuthentication need to be removed from the
             properties file as well as the Infocenter.
    Note:    In the <ITIM-HOME>/data/enRoleAuthentication.properties file, the following changes will be made:
              1. The property 'enrole.authentication.provider.certificate' will be removed since it is not used.
              2. For the property 'enrole.authentication.requiredCredentials', the only valid choice is 'simple'
                 therefore the choice 'certificate' will be removed.
             The above changes are also applicable for the information provided in the Infocenter.

    APAR:    IZ02744
    Symptom: Line Feed is not recognized in Notification definition on RFI in Workflow.

    APAR:    IZ03326    28455
    Symptom: Searches using ITIM UI or APIs that include (!(erisdeleted=Y)) filter can be resource 
             intensive (in LDAP processing).  This component is required to exclude entries from
             under the 'ou=recycleBin,ou=itim,<tenant_dn>' folder, from being included in search
             results. This filter component is appended only when objects are searched with the
             search base set to the tenant. For example, the search filter to retrieve all accounts 
             (ITIM and remote accounts) owned by a person includes this filter component.
    Note:*** Execute the additional steps listed in step 15 in the COMMON TASKS section at the end 
             of the README.

    APAR:    IZ03979    28284
    Symptom: When using ITIM API OrganizationalContainerMO class, if you do a getSupervisor() call 
             and the organizational unit has no supervisor, you will get an ArrayIndexOutOfBound exception.

    APAR:    IY99084
    Symptom: When a person object in ITIM has a very large number of associated accounts, this can 
             lead to an out-of-memory condition in the JVM heap when accessing the accounts on the person.  
             Selecting "Manage Accounts" on the person that has a very large number of accounts consumes 
             a large amount of memory in the JVM heap to load all of the accounts information to display 
             in ITIM interface.
    Note:*** Execute the additional steps listed in step 16 in the COMMON TASKS section at the end 
             of the README.

    APAR:    IZ01588
    Symptom: During a DSMLv2 data feed a modify person request is submitted even if all of the changes 
             are redundant.  This causes the modify person operational workflow to be executed if the 
             "Use workflow" option of the DSMLv2 service is checked) with undesired effects (for example 
             the generation of useless approval requests, RFI, etc.). 
    Note:*** A new property 'remoteservices.hrfeed.ignoreModifyOnNoChange' has been introduced in 
             $ITIM_HOME/data/enRole.properties file. If this property is not defined or has a value set to 
             'true', then person modify requests during DSMLv2/IDI  feed will be ignored if all attribute
             changes are redundant. An attribute change is redundant if the new values and old values are 
             same, w.r.t the matching rules defined for the attribute syntaxes, in Directory Server. 
             If a customer wishes to revert back to the old functionality then they may set this
             property to 'false'.

    APAR:    IZ01596
    Symptom: During an export of data from a TIM 4.6, if the session is running on FireFox browser, you have 
             to explicitly click the Search button if you are searching for objects to export. If you just hit 
             the "enter" key, this does not get the expected results as it does when running a session on an IE 
             browser.  For example when searching for a service to export, when you hit the enter key in 
             FireFox, you will see the results of the service search, but only have the option to choose which
             services you want to delete. The ITIM GUI shows the list of matching services for the search in a 
             Service List with a Delete button.
    Note:*** After applying this Fixpack, it is recommended that the user do a hard-refresh (Ctrl+F5) on the
             browser window, so as to enforce the new version of java script files immediately.

    APAR:    IZ01768
    Symptom: When using a javascript and trying to get one character out of a string, if the field has more than
             one character, it works as expected.  If there is only one character, a numeric value is returned.
             This issue is seen only on ITIM Server running on Solaris box

    APAR:    IZ01799
    Symptom: If a provisioning policy is created at a third level of OU, (for example, on "ou=ou1_1,ou=ou1,ou=IBM"), 
             a deletion request remains in running status on View Pending Requests, and never completes.  However, 
             the policy gets removed from the policy list.
             The following error is logged in trace.log when the issue occurs,

                <Exception><![CDATA[javax.naming.NameNotFoundException: 
                [LDAP: error code 32 - No Such Object]; remaining name
                'ou=people,erglobalid=2216323744970600546,ou=orgChart, erglobalid=00000000000000000000,ou=stsc,dc=com'

    APAR:    IZ01823
    Symptom: When new groups are added in a workflow, only the last added groups within the group membership attribute 
             are displayed.

    APAR:    IZ01890
    Symptom: Fail to save password policy due to redundancy of ldapsearch filter that is issued for checking 
             if service instance in the policy has already another password policy defined for it. When a user 
             pushes the "Submit" button for adding two service instances into an existing password policy, where
             six service instances are already defined, and the two new service instances have another password
             policy defined for them, then the following error is displayed on the browser :
                Error Page
                Error message: com.ibm.itim.dataservices.JNDI_OPRATION_ERROR
                In trace.log, LDAP error 92 "LDAP_NOT_SUPPORTED" was logged.

    APAR:    IZ01901
    Symptom: ITIM API, SearchMO does not work as expected.  An Exception occurs, in the case of account searches, when 
             the return attributes, set on SearchMO, don't include owner and erservice.  

    APAR:    IZ01953
    Symptom: RFI offers the ability to set attribute values on "Access To Do List" while workflow is running.  Under 
             certain conditions, the original data is set instead of the new value entered on "Access To Do List".
                 
    APAR:    IZ02057
    Symptom: Documentation Update:
             This is a documentation update to the Infocenter.
    Note:    The following additional information will be added to ITIM Infocenter under 'Date control type' section.
             <snip>
             If we want to make it mandatory for the attribute value to definitely expire after a certain period of time,  
             this could be useful in order to enforce security or a deadline for some task, which cannot be skipped\avoided. 
             For example, we can draw an analogy from a scenario where we are setting a date for password expiry of accounts. 
             On certain agents, like for Windows Local Agent, we can check the option "password never expires" while creating
             an account. 

             But we could have a situation where we do not want such a privilege to be present even as an option, for example, 
             creating an Administrator account or any other highly privileged user account, for security reasons. Hence we 
             could use ‘Alternative Date’ control for such cases. 

             For default date, null\empty value for the attribute is interpreted as attribute "Never expires", and is 
             displayed on UI, with the "Never Expires" checkbox checked. 

             For alternate date, null\empty value in LDAP, will lead to displaying of current date on the UI.   

             It is recommended that the Form Templates be designed prior to data creation\population. In that case, a 
             null\empty value for an attribute which is configured as an Alternate Date control type, should ideally not occur. 
             </snip>

    APAR:    IZ02436
    Symptom: EJB validation fails when an ITIM API application is secured by WebSphere and different security realms 
             are being used for the API application server and the ITIM application server.

    APAR:    IZ03083    28256
    Symptom: After APAR IY95457 shipped in 4.6.0-TIV-TIM-IF0041, the summary table is not listed in the Recon statistics in 
             the report.  

    APAR:    IY98942
    Symptom: The generation of a custom report requested by a non-admin ITIM user fails with 
             an OutOfMemoryError.
    Note:*** After application of this Fixpack, a full data synchronization needs to be run.

             The root cause of the reported problem was due to a very large SQL query being formed 
             during report generation. The large SQL query was formed because of a large number of 
             different ACI filters defined in LDAP.

             This problem has been addressed by introducing a new feature of Runtime ACI evaluation 
             on the synchronized data. That is, ACIs from LDAP Directory Server will be directly used 
             to perform access check on synchronized data. 

             For this purpose a new property 'applyACIAtRuntime' has been introduced in
                <ITIM_HOME>\data\adhocreporting.properties file.
             The value 'true' set for this property will enable the feature of Runtime ACI evaluation
             on synchronized data. The default value is 'false'.

             When Runtime ACI evaluation is enabled by setting the above property value to true, 
             an in-memory ACI Filter attribute cache is maintained by the ITIM application. 
             This cache stores all attribute names used in ACI filters, for a particular entity. 
             The refresh interval of this cache is by default set to 60 minutes, for optimal performance. 
             This can be changed by changing value of another new property 'aciFilterRefreshInterval' 
             introduced in adhocreporting.properties file. The value specified for this property 
             defines the refresh interval in minutes.

             With the Runtime ACI evaluation feature enabled any changes to ACIs will take the same 
             time to take effect on the synchronized data in database, as it takes to take effect on 
             other entities in Directory Server, when accessing ITIM UI or API. This implies a data 
             synchronization is no longer required to be run, for ACI changes to take effect.
             There are two exceptional cases here:
             1.  If ACI filters are changed to include new attribute names, which were not mapped 
                 for a given entity, before the last run of data synchronization, then a data 
                 synchronization may need to be re-run.
             2.  If ACI filters are changed to include new attribute names, which were mapped for a 
                 given entity, before the last run of data synchronization, then a maximum of
                 value of the property 'aciFilterRefreshInterval' (specified in minutes), must expire,
                 for the changes to take effect. In this case however a data synchronization is not 
                 needed to be run.

             It is recommended to enable the Runtime ACI evaluation feature, if many ACIs with 
             different filter conditions have been defined in Directory Server, for an entity which 
             has also been mapped for data synchronization.

         *** Execute the additional steps listed in step 17 in the COMMON TASKS section at 
             the end of the README.

    APAR:    IZ01072
    Symptom: Reports do not work for non-admin accounts due to case sensitive comparison of 
             DNs stored in ITIM Database tables.
    Note:*** Execute the additional steps listed in step 18 in the COMMON TASKS section at
             the end of the README.

    APAR:    IZ01616
    Symptom: Delegated authorities can not be deleted. 

    APAR:    IY99624
    Symptom: The ACI filters on Provisioning Policy ACIs are not honored when deleting 
             provisioning policies.

    APAR:    IY99660
    Symptom: Performance problems during creation of big PDF reports. Creating large PDF reports
             can "hang" the system showing 97 percent CPU usage during the PDF "rendering".  
    Note:    This fixes the problem of contiguous memory allocation, during PDF report generation
             and to some extent the total memory usage by zipping up the report contents.

             A new property 'pdfReportFragmentSize' has been introduced, which can be configured
             in <ITIM_HOME>\data\adhocreporting.properties file. The value of this property
             decides the number of records to be displayed in one PDF fragment.
 
             Another property 'pdfReportMaxFragments' has been introduced, which too can be
             configured in <ITIM_HOME>\data\adhocreporting.properties.
             The value of this property decides the maximum number of fragments to be displayed.

             ITIM need not be restarted, for the above two properties to take effect, instead it
             will take effect within a minute or so.

             When 'pdfReportFragmentSize' is configured to have a value greater than 0, the PDF
             report will be split into fragments, which are accessible using page links in a new
             window. The new window is split into two sections, the top and bottom :
             A The top section shows the PDF report data.
             B The bottom section displays page links. 
                 When "pdfReportMaxFragments" is defined and set to some value greater than 0, and
                 the displayed records are not a complete set of the data, this section also displays
                 the following error message -
                    "CTGIMS003W The search size exceeds the maximum of {<records displayed>} items.
                                The results have been truncated. {<total_number_of_records>} "
                 This is to address the requirement of APAR, to be able to check the actual number of
                 records for a report, without OOM.
                 Along with the page links a 'Done' link is available, which for optimal memory
                 usage, SHOULD be clicked on, to free up the user's session from storing the report 
                 data, when the logged-in user is done with viewing the report.

    APAR:    IY99826
    Symptom: Documentation Update:
             Canned Report "Approvals and Rejections" is currently working fine for Account 
             operations but does not return any data related to Person Operations, because the 
             Subject_service field of the PROCESS table is NULL for person operation.
             
    Note:    The "Approvals and Rejections" report is designed to display approval activities associated
             with account related requests only. However, if the customer requirement is to display 
             both account as well as person related Approval/Rejection activities, then the customer 
             can use HookedReport facility available in the ITIM Report Component. 
             Please see $ITIM_HOME/extensions/APAR_Doc/IY99826.zip for creating HookedReport.
             
    APAR:    IZ00923
    Symptom: Property entries in service.def file of profile are not being created correctly in ITIM 
             ldap during import of the profile
             
    APAR:    IZ01059
    Symptom: When using $LOCALE in WorkOrder node to display graphics in their email, In an 
             Approval node, $LOCALE results in a URL setting with "en" which is correct. 
             Example URL in email:

                <link type="text/css" title="Styles" rel="stylesheet"
                href="http://192.168.1.200:80/enrole/en/Styles.css" />

             In a WorkOrder node using the same URL reference $LOCALE is set to "en_US" 
             resulting in the following failed URL reference:

                <link type="text/css" title="Styles" rel="stylesheet"
                href="http://192.168.1.200:80/enrole/en_US/Styles.css" />

    APAR:    IZ01125
    Symptom: When configuring ITIM for SSO authentication with ITAM setting 
             enrole.authentication.idsEqual to false in the enRoleAuthentication.properties file 
             you may get message CTGIMM029E even if the user id provided in iv_user from WebSeal 
             is a proper mapping to an ITIM account.

    APAR:    IZ01602
    Symptom: Global compliance alert for RACF SSL Adapter connect Group widget does not allow the non compliant
             todo action item to complete. 
    Note:    This defect was due to special characters like the ampersand (&) character in attribute values.
             
    APAR:    IZ01654
    Symptom: Ampersand character in "Display Value" of dropdownbox attribute results in Parse error in view 
             approval request details.
             
    APAR:    IZ01763
    Symptom: RACF accounts are not processed during reconciliation due to NullPointerException on equals method.
             
    APAR:    IZ02355    27143
    Symptom: Policy join directive "intersection" is not working.

    APAR:    IY99416
    Symptom: Need better documentation about policy enforcement:
                1. When the error CREATE_ACCOUNT_IS_DISALLOWED is expected
                2. About alerts generated during policy enforcement

    Note:    A documentation guide is shipped along with this Fix Pack. Please unzip 
             $ITIM_HOME/extensions/APAR_Doc/IY99416.zip to a temporary location.

    APAR:    IY99813
    Symptom: Account was successfully created even though a JavaScript runtime error occurred 
             in Provisioning Parameter List while HR feeding.

    APAR:    IY99907
    Symptom: Compatibility issue on underscore including attribute name, which is defined in rule
             for dynamic role.

    APAR:    IZ00123
    Symptom: Popup message is displayed when trying to update a person attribute with write 
             access for self:
             "Removal of Dynamic Role(s) from person is not allowed by the system" 

    APAR:    IZ00148
    Symptom: Cannot resubmit failed compliance issues for correction.
             When the user selects them and submits for correction, nothing happens.

    APAR:    IZ00153
    Symptom: Compliance issues in UI do not match with their corresponding entries in LDAP.

    APAR:    IZ00195
    Symptom: The eruid and uid have same label ("User Id") in TAMCombo adapter (4.6.0).

    APAR:    IZ00318
    Symptom: While orphaning an account with more than one compliance issue, only one out of all 
             compliance alerts of a noncompliant account is removed.

    APAR:    IZ00322
    Symptom: Compliance alert group count in subject does not match the number of items inside the group.
             The outer group of compliance alert items may show 55 items, for example. However, inside 
             the group a smaller number of items may be seen.

    APAR:    IZ00880
    Symptom: Checkbox issues on Form Customization.
             1) Checkbox status on Form Customization does not correspond to data saved in LDAP.
             2) Checking a checkbox of an attribute also checks the same attribute for others.

    APAR:    IZ01021
    Symptom: Report links specified in the report.xml does not open since HEX characters are prepended 
             to the URL due to the presence of white spaces and new line chars in the report.xml.

    APAR:    IZ01074    26933
    Symptom: Audit Log does not show all sub processes of an activity and cannot correlate between 
             compliance issue selected for correction and the account modify sub process spawned.

    APAR:    IZ01187    25465
    Symptom: NEW FUNCTION:
             Provide ability to configure the behavior of Default Date field

    Note:    A new tag attribute for the optDateInput tag, 'isNeverRequired', has been introduced in
             formTemplate, to configure the default behavior of 'Default Date' widget. 
             A value "false" assigned to this tag attribute causes the 'Default Date' widget to display 
             the current date value by default. Other than "false", any other value will not change the
             current behavior (default) of the date widget.

             Please see $ITIM_HOME/extensions/APAR_Doc/IY99175.pdf for related information.
  
    APAR:    IY99194    Self Service UI
    Symptom: SSUI Option missing to access challenge/response functionality when TAM authentication is
             enabled in ITIM Self Service UI.

    APAR:    IZ00815    25528   Self Service UI
    Symptom: SSUI The value of the Description field in the Change Password page is incorrect. 
             It shows ITIM profile data instead of Description data.
  
    APAR:    IY96340    enroleagent.jar
    Symptom: IOException occurs while changing password with synchronized password enabled.
             You may get the following error message:
                IOException connecting to resource
                https://172.30.109.103:45580: CTGIMD813E An error occurred while connecting to an adapter. 
                The following error occurred.
                Error: null

    APAR:    IY97412
    Symptom: When multiple Compliance Alerts exist for the same Account, a checkbox is available to select 
             which Alert should be corrected. However when a single Alert is selected and 'Correct' is 
             chosen all of the Alerts are corrected.

    APAR:    IY97902
    Symptom: Unable to extend filter term for "Between Specific Dates" in View Pending/Completed Requests.
             The YEAR drop down list for "Between Specific Dates" contains 2010 as last entry.
    Note: ** Execute the additional steps listed in step 12 in the COMMON TASKS section at
             the end of the README.

    APAR:    IY99175    DOC Update
    Symptom: This is a DOCUMENTATION update
             Better documentation about new options in Date widget field and about Date Range constraint.
             Please see $ITIM_HOME/extensions/APAR_Doc/IY99175.pdf 

    APAR:    IY99198
    Symptom: The setProperty method in workflow results in only one group being returned and not any of the
             existing groups.

    APAR:    IY99208
    Symptom: Unable to provision accounts for users with ACI giving them permission to a group of users based 
             on a ACI filter if the filter contains a Relationship Expression.

    APAR:    IY99279
    Symptom: Defining a Date attribute as Date Format after changing the erxml entry in LDAP 
             to include a date before 1990, date before 1990 can be set. 
             However, in Personal Information on ITIM via GUI, the date is set to 1970, while in the 
             Directory Server it is set correctly. 
    
    APAR:    IY99295
    Symptom: LDAP connection leaks resulting from mishandled error cases in customization. Failed ServiceSearch 
             or DirectoryObjectSearch calls may result in leaked LDAP connections. LDAP connection reference 
             held may have also prevented the JVM from utilizing garbage collection to clean-up these leaked 
             connections.

    APAR:    IY99649    25659
    Symptom: Using ReconUnitData API, the 0=ignore and -1=daily values are not handled correctly.
             Also, a RuntimeException occurs when saving a recon unit using UI without going to "query" tab.

    APAR:    IY99417
    Symptom: CREATE_ACCOUNT_IS_DISALLOWED may be generated when you adopt a non-compliant orphan account or 
             when you adopt a compliant orphan account and make changes in account modify workflow to make 
             it non-compliant.

    APAR:    IY99419
    Symptom: Ldap filter for "objectclass" attribute is case sensitive in the ITIM UI although attribute 
             "objectclass" is case insensitive in LDAP.

    APAR:    IY99659
    Symptom: Participant for compliance alert changes to wrong value.

    APAR:    IZ00197    25696
    Symptom: There is a mismatch between ITIM help and the current behavior of the ITIM.

             According to ITIM help:
             1) Reminder.getOriginalSubject(): This method returns the subject of the original
                notification sent when the work item was first assigned.
             2) Reminder.getXhtmlBody(): This method returns the XHTML body of the original
                notification sent when the work item was first assigned.
             3) Reminder.getTextBody(): This method returns the text body of the original
                notification sent when the work item was first assigned.
    
             When you try to use the Reminder.getTextBody function you get an unexpected behavior. If you specify 
             either "Subject" or "Text Body" or "XHTML Body" in To-do Reminder Template then Reminder.getTextBody() 
             returns the "Text Body" specified in To-do Reminder Template itself.
             But, if you leave "Subject", "Text Body" and "XHTML Body" blank then Reminder.getTextBody() returns the 
             "Text Body" of notification (todo item needing action) template sent.
             
             This fix changes the behavior to match the ITIM help test.

    APAR:    IZ00288    25693
    Symptom: Reminder.getRemindersSent() throws exception.

    APAR:    IZ00311    25694
    Symptom: Reminder.getEscalationTime() returns millisec instead of date.

    APAR:    IZ00812    26351
    Symptom: DSML feed completes successfully but the audit log shows Failure status.

    APAR:    IZ00813    26237
    Symptom: Service not getting exported.  When exporting service entity using ITIM UI import/export, 
             a NullPointerException NPE occurs.

    APAR:    IZ000814    25432
    Symptom: Unable to ensure uniqueness in LDAP with ITIM delete duplicate because ITIM writes records 
             to the LDAP Recycle Bin BEFORE deleting the same value in its normal location.

    APAR:    IY95457
    Symptom: The generation of a PDF report with a high number of records 
             (enrole.ui.report.maxRecordsInReport increased to 13000) 
             fails with an OutOfMemoryError.
    Note: ** Execute the additional steps listed in step 9 in the COMMON TASKS section at
             the end of the README.

    APAR:    IY95684
    Symptom: Unable to import jar file that was exported by export function when 
             multi-byte chars are used for org name.

    APAR:    IY95834
    Symptom: NEW FUNCTION
             ITIM API cannot restore suspended accounts which require a password.
    Note:    To address this requirement two new functions have been introduced 
             in the following published classes -
             1. com.ibm.itim.apps.provisioning.AccountManager - 
                Function: 
                 restore (Collection accounts, String password, Date scheduledTime)
                Description:
                 This function restores account(s) present in Collection 'accounts' with
                 the password. The password will be used while restoring only accounts
                 which satisfy all of the following conditions -
                 a) The account supports a password change. This can be determined by 
                    the service the account is hosted on. For password requirements 
                    refer to function 'SeriveMO.isPasswordRequired'for details.
                 b) If global flag 'account.restore.password.suppress' in ITIM for
                    suppressing the password specification during restore is set to true,
                    but the service profile hosting the account requires the password
                    specification during restore, or if the global flag is set to false.

             2. com.ibm.itim.apps.provisioning.PasswordManager - 
                Function: 
                 generatePasswordForRestore (Collection accounts)
                Description:
                 This function generates a password that can be used to synchronize 
                 the passwords of the accounts passed in. The accounts may be inactive.
                 At least one account should require password on restore. The system 
                 generated password is the password generated by ITIM based on the 
                 combined password rules of accounts passed in.

    APAR:    IY96011
    Symptom: DBPurge.sh fails on ITIM 4.6 after upgrading from ITIM 4.5.1, with the following error:
                /itim/bin/unix/DBPurge.sh 180
                Using JAVA_HOME:  /usr/WebSphere/AppServer/java
                Exception in thread "main" java.lang.NoClassDefFoundError:
                com/rsa/jsafe/JSAFE_Exception
                at java.lang.Class.forName1(Native Method)

    APAR:    IY96118
    Symptom: Unable to override value of property 'enrole.ui.pageSize' set in
             <ITIM_HOME>\data\ui.properties file using ITIM API -
                com.ibm.itim.apps.search.SearchMO # setPageSize(int pageSize).
    Note:    Two new methods have been introduced in each of the following published
             classes to also override the 'enrole.ui.pageLinkMax' property set in
             <ITIM_HOME>\data\ui.properties file -
             1. com.ibm.itim.apps.search.SearchMO -
                a) setPageLinks (int pageLinks)
                   Description:
                    Sets the number of pages to be pre-fetched on one call to
                    SearchResultsMO.getPage(). Pre-fetched pages are stored in an internal cache,
                    and will be returned on subsequent calls to getPage(), thereby improving the
                    performance of subsequent function calls at the cost of increased memory
                    consumption.
                    If SearchResultsMO.getPage() is used to retrieve large results , then it is
                    recommended to set this property to 1, to optimize memory consumption.

                b) getPageLinks()
                   Description:
                    Returns the number of pages to be pre-fetched.

             2. com.ibm.itim.apps.ejb.search.SearchRequest -
                a) setPageLinks (int pageLinks)
                   Description: Same as com.ibm.itim.apps.search.SearchMO # setPageLinks

                b) getPageLinks()
                   Description: Same as com.ibm.itim.apps.search.SearchMO # getPageLinks

    APAR:    IY96120
    Symptom: When removing a customized person entity from ITIM, once the ITIM cache 
             timeout value is reached no one can login to ITIM until the enRole 
             application is stopped and restarted in WebSphere.

    APAR:    IY96121
    Symptom: When removing a customized entity from ITIM when a form template has not 
             been defined an ObjectNotFoundException is thrown.

    APAR:    IY96157
    Symptom: The upgrade to FP33 from ITIM 4.5.1 FP71 completes with no error.
             However after the upgrade the occurrence of the following exception:
             <Exception><![CDATA[com.ibm.itim.remoteservices.exception.RemoteServicesException: 
             Invalid column name 'SERVER'.

    APAR:    IY96180
    Symptom: Get "You are not authorized to perform this operation" message displayed in
             English in spite of Japanese being selected at logon.

    APAR:    IY96255    22887
    Symptom: After migrating from ITIM 451 to ITIM 4.6, the ACIs that were created in 
             the ITIM 451 setup do not work, until they are modified once.

    APAR:    IY96257
    Symptom: Restore Account on UPA async Adapter leads to java.lang.NullPointerException 
             if Oracle is used as database.

    APAR:    IY96322
    Symptom: After an ITIM 4.5.1 system has been upgraded to release 4.6 it is not possible to 
             complete any running workflows including synch join points started before the upgrade.
             This can occur when the processes having synch join points, are waiting for user 
             actions (approvals, RFI, etc). A synch join point is any node in the workflow definition with
             it's join type as AND and more than one incoming transitions to that node.
             After the upgrade some processes will fail and stay permanently in the "running" state.

    Note:    After upgrading to ITIM 4.6, if ITIM contains some pending processes which were 
             initiated in ITIM 451 prior to upgrade, and if these processes have the workflow 
             nodes with Join Type as AND, then the execution behavior of these pending processes 
             in ITIM 4.6 will be same as the behavior in ITIM 451. However, all the new processes 
             created for the same workflow definition in ITIM 4.6 will behave as per the ITIM 4.6 design.

    APAR:    IY96345
    Symptom: In ITIM 4.6.0 FP25, a new feature was added to provide Process Failure Report Popups (APAR IY89842).
             The feature provides links on the 'View Completed' panel which allows a user to click on the 
             "Warning" or "Failed" status to display request status details associated with the warning or
             failure messages.  This feature was initially added by default without a property to control
             its use.
    Note:    On systems with a very large number of completed requests this can cause performance issues.
             The feature now defaults to disabled and the customer may optionally enable it if needed through
             <ITIM_HOME>/data/enroleAuditing.properties by setting the property 
             enrole.auditing.errorpopup.enabled=true

    APAR:    IY96478   
    Symptom: Garbage characters get displayed in pop-up window when selecting "Lock" mark in 
             "Access To Do List".

    APAR:    IY96579   
    Symptom: Importing a new Provisioning Policy removes the dynamic role from all users.

    APAR:    IY96667   
    Symptom: Deadlocks were detected occasionally, during aggregation of emails when
             Post Office Store Forwarding feature was enabled. In WebSphere's SystemOut logs and
             ITIM's trace logs we see an XA_RBDEADLOCK error message, when the deadlock occurs.

    APAR:    IY96690   
    Symptom: When trying to adopt an ITIM account that doesn't have enough authority, get
             "Server caught unhandled exception from servlet [OrphanedAccountControlServlet]: null" 
             and an error page gets displayed on IE.

    APAR:    IY96788
    Symptom: Policy Preview displays attribute value "AS", as "Suspend Account".

    APAR:    IY96865   
    Symptom: The constraint property, "No White Space", shows as unchecked, if the constraint property
             "Invalid Characters" is set for an attribute on Form Customization. This happens when you 
             switch from the attribute selected to another one, and switch back.
    Note:    Execute the additional steps listed in step 10 in the COMMON TASKS section at
             the end of the README.

    APAR:    IY96967
    Symptom: When the account objectclasses of two (or more) service profiles share a common attribute 
             "attr" with different labels, the label assigned to it (for example in the attribute permission 
             details section of the ACI definition page for the profiles's account) is the same for all profiles
             having the common attribute "attr" and coincides to the label defined for one of the profiles.

    APAR:    IY97126    
    Symptom: When a user creates two "Synchronization Data" definitions with the same schedule, only 
             one entry gets displayed on GUI.  Then if he changes the schedule, two synchronization 
             will be run.

    APAR     IY97292
    Symptom: When an Account has an outstanding Compliance Alert and the non-compliance is solved on 
             the endpoint directly, the next reconciliation will not close the Compliance Alert.
             When looking at the Account it is correctly flagged as compliant in TIM. If after the 
             reconciliation "Correct" is chosen on the Compliance Alert it is tried to remove the no 
             longer existing authorization, which of course fails, so the Compliance Alert stays outstanding.

    APAR:    IY97340
    Symptom: When multiple Compliance Alerts are outstanding for an Account, updating the Person object 
             with a Role to solve one or more of the Compliance Alerts does not remove the corresponding 
             Alerts.  

    APAR:    IY97415
    Symptom: When two Compliance Alerts for the same Account exists, selecting the detailed view for 
             the "Compliance Alert Details" of the first entry results in a:
             java.lang.IndexOutOfBoundsException.

    APAR:    IY97496
    Symptom: ITIM sends REPLACE for even multivalued attribute modification, when the POSIX (RMI) 
             adapter expects ADD/DELETE.

    APAR:    IY97545
    Symptom: Modify request should exclude empty/null attributes to be consistent with Add request behavior.
             
    APAR:    IY97546
    Symptom: Nullpointer exception when viewing pending/completed requests after an ITIM account is removed 
             from the administrators group.

    APAR:    IY97548
    Symptom: Persons added via the ITDI HR feed are being placed at the root of the ITIM tree 
             instead of placing them in a container specific to placement rule if the container
             contains multiple values for the attributes referenced in the placement rule.

    APAR:    IY97662    23115   ROUTE from ITIM 4.5.1 IY95666
    Symptom: Custom report column header not translated with CustomLabels.properties.

    APAR:    IY97663    23463   ROUTE from ITIM 4.5.1 IY96524
    Symptom: When clicking on the [...] button of the Subprocess properties in the 
             Workflow Designer, a popup dialog reports RemoteException.  
             The trace.log shows:
                java.lang.NullPointerException

    APAR:    IY97665    22971
    Symptom: Provide ability to use the policy analysis feature when the shared queue
             administrator node is down in a cluster environment.
    Note:    This fix is applicable for "Person" and "Account" entities only.

    APAR:    IY97738
    Symptom: When an Account has an outstanding Compliance Alert, adding roles to the owner does not update 
             the Account. Instead the "MODIFYACCOUNT" Workflow part silently gets aborted (it dies).
             No error is stated or signaled, the Account is not flagged as non-compliant. When the Account 
             is manually modified however the change is nicely processed on the Service and the Compliance
             Alert stays untouched.

    APAR:    IY97769
    Symptom: After an ITIM upgrade from 4.5.1 to 4.6 IF 39, ITIM 'Manage Accounts' performance may have slowed down.

    APAR:    IY97824
    Symptom: If an approval times out or a participant resolution failure occurs, the entire workflow is 
             terminated.

    APAR:    IY98114
    Symptom: This is a DOCUMENTATION update:
             When you have ACIs for ITIM default Person and custom Person (derived from inetOrgPerson).
             You will see that the ACI for the ITIM default Person also affects the custom Person.

    Note:    The behavior of the ACIs has been deliberately changed in ITIM 4.6, to enforce the behavior 
             customer is observing.

             Unlike ITIM 4.5.1, in ITIM 4.6, provisions are made such that an ACI defined for an object class 
             not only apply to entities of this objectclass but also to entities belonging to objectclass(es) 
             that inherit this objectclass directly or indirectly.
             For example, assume we have a custom person defined as "customPerson" which inherits 
             "inetOrgPerson", then any ACI which is applicable to "inetOrgPerson" will also be applicable to 
             "customPerson" in addition to ACIs defined for itself.

             A workaround could be to define an ACI exclusively for "inetOrgPerson" would be to set the ACI 
             "Target Filter" as follows -

             "(!(objectclass=customPerson))"

             (without double quotes) in all the existing ACIs defined for the objectclass - "inetOrgPerson" 
             to allow for the ACI to only apply to the default person entity.

    APAR:    IY98192    24554
    Symptom: NEW FUNCTION
             Performance Enhancement; Optimize SQL query used in Error-display popup in 
             View Completed Requests section.

    APAR:    IY98312
    Symptom: The removeProperty method of the Person object included in the Entity relevant data of the 
             modify person workflow creates (in the Person object) a remove action for the attribute specified
             in input whenever the attribute is already present in the changes list of the Person object.
             If the attribute is actually undefined in the real LDAP entry corresponding to the person 
             (a typical case of this scenario is when a user tries to set an undefined attribute of an already
             existent person) and the removeProperty is called in a script node before the MODIFYPERSON action, 
             the latter fails with the following error:
                LDAP: error code 16 - No Such Attribute

    APAR:    IY98464
    Symptom: AccountManaget getAccountParameters call gets a nullpointer exception when the person for which an 
             account is being provisioned does not have an entitlement to the account. 

    APAR:    IY98612
    Symptom: This is a DOCUMENTATION update:
             The ITIM product documentation/examples don't explain how to configure a WebSphere Application 
             Server running a custom J2EE application to correctly use ITIM APIs to access an ITIM server
             running on a different WebSphere application server.  Please use the information provided in
             $ITIM_HOME/extensions/APAR_Doc/IY98612.pdf to understand how to set up ITIM remote applications 
             on a different WebSphere Application server.

    APAR:    IY98640    25116
    Symptom: Internally found code defect in ITIM UI interface.  This defect may affect customers using the 
             Self Care application.  They may see Activity ID instead of Activity Name.

    APAR     IY98697
    Symptom: When filtering the Pending/Completed Requests views "By Service", reconciliation requests are not 
             being displayed. All other types of requests for the service will show in the UI, except for 
             reconciliations.
    Note: ** Execute the additional steps listed in step 11 in the COMMON TASKS section at the end of the README.

    APAR:    IY99300    24393
    Symptom: Compliance alert is not created for ITIM group.

    APAR:    IY94774
    Symptom: When WebSphere and ITIM servers have different case short host names, you get a failure when 
             attempting to configure the ITIM Cluster Member WebSphere info.

    APAR:    IY96616    22795
    Symptom: After installing IF39 (APAR IY95026), compliance Alerts cannot be deferred.
             You may get an error prompt stating: 
             'The alert cannot be deferred because an internal error occurred'.
    Note:    This fix applies to the Compliance Alerts which will be generated in future.

    APAR:    IY92530
    Symptom: Setting UID in enRole.properties password.attributes parameter breaks DSML feed.

    APAR:    IY92538
    Symptom: Using ServiceManager.getServices() with a wildcard (*) returns a ServiceEntity, 
             rather than a Collection of ServiceMO's. 

    APAR:    IY92688
    Symptom: CTGIMD030E The syntax of the uid DN is not valid.
             JNDI update is not working when the link criteria attribute contains a "+" sign. 
             ITIM can locate the entry, but would not update it.

    APAR:    IY92757
    Symptom: Custom Identity Policy using PersonSearch() generates NullPointerExceptions when 
             evaluated.
 
    APAR:    IY92883
    Symptom: Placement Rule cannot handle value with comma.
    Note:    If the container name contains special character COMMA (e.g. ou=IBM,Inc) then it needs 
             to be escaped in the data source from which data is read. For example, for IDI feed from 
             the CSV file ou=IBM,Inc should be escaped as ou=IBM\,Inc in the CSV file.

    APAR:    IY92993
    Symptom: Ordered Deprovision is run in spite that "Service Prerequisite" isn't set to service.

    APAR:    IY93034
    Symptom: ITIM does not provide a way to aggregate XHTML bodies in the Aggregate XHTML template 
             and have the original XHTML body processed correctly.
    Note:    Execute the additional steps listed in step 6 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY93104
    Symptom: NullPointerException when Stopping a provisioning policy simulation.

    APAR:    IY93117
    Symptom: If the person object being updated already has the same dn value in the manager 
             attribute, ITDI still does an update. 
    Note:    A new property 'remoteservices.hrfeed.resolveDNs' has been introduced in 
             $ITIM_HOME/data/enRole.properties file to provide an option to the end user, for not sending the 
             name attribute of Role/Supervisor in the response for search request fired from the ITDI.
             This property takes a value of true or false.
             If the value for this property is set to true, then the relationship attributes, Supervisor and 
             Roles will be resolved to corresponding names. So name values will be sent to ITDI as a response 
             to the search request. If the value is set to false, then the relationship attributes will not be 
             resolved and the values will be sent as they are to ITDI. 

    APAR:    IY93119
    Symptom: 'User List' tab of dynamic role only displays users in root organization. 

    APAR:    IY93269
    Symptom: The 'ercomment' attribute reports errors because a duplicate insertion occurs, 
             once in the Adapter profiles, and once in ITIM.

    APAR:    IY93292
    Symptom: After installing ITIM Fixpack 4.6.0-TIV-TIM-FP0033, when you search Primary Group 
             for a specific Service Context, you get multiple groups returned for all services, 
             instead of just the one you should get.

    APAR:    IY93360    21175
    Symptom: Read-only checkbox lacking attribute value generates extraneous logging.
 
    APAR:    IY93362    21198
    Symptom: ITIM Front-End Account Operations workflows hangs.
 
    APAR:    IY93426    19267
    Symptom: Some Attributes are not displayed in RFI Activity for ITIM.

    APAR:    IY93428    20876
    Symptom: While searching for provisioning policy, if we go to Entitlement tab and search for 
             workflow, ITIM shows incorrect list of workflows. 

    APAR:    IY93429    21163
    Symptom: Add new internal flags.

    APAR:    IY93430    21191
    Symptom: When starting enrole application using WAS following warning is logged in SystemOut.log
             WARNING - Unable to bind, enroleejb.ReconManagerHome: enroleejb.ReconManagerHome. 
             Original exception : org.omg.CosNaming.NamingContextPackage.AlreadyBound: 
             IDL:omg.org/CosNaming/NamingContext/AlreadyBound:1.0

    APAR:    IY93514    21257
    Symptom: LDAPSearchResult is not being closed in a finally block. This may cause an LDAP 
             connection leak under some circumstances.
             

    APAR:    IY93131
    Symptom: ITIM API call WorkflowProcessQuery.execute() does not return SUBJECT_PROFILE and
             SUBJECT_SERVICE in the result set.

    APAR:    IY93204
    Symptom: OutOfMemory heap dumps in ITIM UI due to invalid logging.

    APAR:    IY93306
    Symptom: When running an out-of-the-box ITIM report, such as "Account Operations", the report 
             screen has date fields labeled as "Start Date" and "End Date". But the Custom 
             report screen date fields do not have these labels and do not specify the operator
             configured.

    APAR:    IY93314
    Symptom: Unable to remove manager value during ITDI datafeed.

    APAR:    IY93316
    Symptom: Problem occurs when ITIM user tries to login using ITIM UI and enters incorrect password.
             ITIM UI will throw the following message: "CTGIMM010E The value entered for the password 
             is incorrect." When the same login attempt is made from Self-Care App UI (also with 
             incorrect password) then the following message is displayed: "Sign on failed. Please 
             try again."

    APAR:    IY93317
    Symptom: Problem occurs when ITIM user tries to retrieve forgotten password using Self-Care 
             App UI but enters wrong answer to the challenge response question. In that case correct
             error message is displayed in ITIM UI and Self-Care App UI but the incorrect error 
             message is thrown to the SystemOut.log.

    APAR:    IY93332
    Symptom: Problem occurs when trying to change the password for a nonexistent user via self_care 
             app UI. When user tries to change the password via self_care app UI and enters incorrect 
             value for user name then no error message is displayed to the UI stating that incorrect 
             user password has been entered.

    APAR:    IY93336
    Symptom: When user tries to change his password via self_care app UI and enters incorrect value 
             for the old password then there is no error message displayed in self_care app UI or 
             SystemOut.log stating that incorrect password has been entered.

    APAR:    IY93350
    Symptom: The KEY_TODO message, "CJL0004E Message key KEY_TODO was not found, is displayed, but no 
             reason is given for the failure. e.g. (password policy check failed).

    APAR:    IY93994
    Symptom: AE FIX COMPLETION for APAR IY91042
             When attempting to run an Individual Account report for a specific user, the report 
             generation fails with arrayindexoutofbounds error.

    APAR:    IY93995
    Symptom: AE FIX COMPLETION for APAR IY85551
             The ACI that allowed you to display Business Partner Persons in the OU structure stopped 
             working, When you have defined two ACIs to allow ITIM group members to view Business 
             Partner Persons under a specific OU. The First ACI allows ITIM Group to search OU structure.
             The Second ACI allows you to view Business Partner Persons under specific OU. After 
             installing a fix with APAR IY85551 the Business Partner Persons are not shown in the OU 
             when logged in as one of ITIM group members.

    APAR:    IY94096    21185
    Symptom: Error restoring ITIM Account during HR Feed when using automated workflow.

    APAR:    IY94208    21188
    Symptom: Correct internal API logic to work properly if the application calling the API is running in the 
             same WebSphere server instance as the ITIM application.    

    APAR:    IY94209    21190
    Symptom: Changed internal API logic to enhance stability.

    APAR:    IY94210    21243
    Symptom: Changed internal API logic to enhance stability.

    APAR:    IY94211    21862
    Symptom: Changed internal API logic to enhance stability.

    APAR:    IY94212    21864
    Symptom: NEW FUNCTION
             Enhancement: Code update to always return Subject profile and Subject service 
             instead of requiring the 'returnAllFields' boolean parameter to be 'true', which
             is passed to the API - WorkflowProcessQuery.execute(WorkflowQueryStatement, boolean).
    
    APAR:    IY94708    20955
    Symptom: ITIM connector does not support (EBCDIC) encoding.

    APAR:    IY93494
    Symptom: Problem occurs when using automatic provisioning if services have prerequisites.
             When provisioning three services, if the provisioning the second service fails,
             the provisioning of the third service doesn't begin.
    Note:    We have provided IY93494.zip, which includes instructions on how to set this up,
             as well as the file,  provisionOrderedAccounts.ldif.  This may be found in directory
             $ITIM_HOME/extensions/APAR_DOC

    APAR:    IY93566
    Symptom: Documentation Update:
             LdapUpgrade fails with error 80 when ESSO integration is present 
             LdapUpgrade will fail with "Error in loading schema - [LDAP: error code 80 - Other]" when 
             applying an ITIM fixpack if the TAM-ESSO (Tivoli Access Manager for Enterprise Single Sign-On) 
             Provisioning Adapter has been integrated into ITIM.  The NamingException should be logged in 
             the ITIM_HOME/install_logs/ldapUpgrade.stdout.  The process of TAM-ESSO integration introduces 
             new attributes into ITIM system object classes erAccountItem and erServiceItem.  Currently, a 
             manual procedure after applying an ITIM fixpack is required to resolve this error due to the 
             change to the ITIM schema.
    Note:    The user should perform the following process to resolve the error.

             1. Click the "OK" button when the "Error in loading schema" message is prompted.

             2. After the fixpack application is done, update the ITIM_HOME/config/ldap/er-schema.dsml file 
                by modifying ITIM object classes, erAccountItem and erServiceItem.  
             Following the  <object-identifier>1.3.6.1.4.1.6054.1.2.2</object-identifier> of erAccountItem, 
             add the entries below:

                <attribute ref="vgoAdminID" required="false" />
                <attribute ref="vgoAdminPWD" required="false" />
                <attribute ref="vgoApplicationDescription" required="false" />
                <attribute ref="vgoApplicationID" required="false" />
                <attribute ref="vgoApplicationPWD" required="false" />
                <attribute ref="vgoCredAttribute1" required="false" />
                <attribute ref="vgoCredAttribute2" required="false" />
                <attribute ref="vgoSSOUserID" required="false" />

             Following the <object-identifier>1.3.6.1.4.1.6054.1.2.6</object-identifier> of erServiceItem, 
             add the entries below:

                <attribute ref="vgoApplicationIDMeta" required="false" />
                <attribute ref="vgoSSOUserIDMeta" required="false" />
                <attribute ref="vgoApplicationDescriptionMeta" required="false"/>
                <attribute ref="vgoCredAttribute1Meta" required="false" />
                <attribute ref="vgoCredAttribute2Meta" required="false" />
                <attribute ref="vgoApplicationUserIDMeta" required="false" />

             3. Run ITIM_HOME/bin/ldapUpgrade.

    APAR:    IY93654
    Symptom: ITIM allows delegating time in past.

    APAR:    IY93940
    Symptom: Filtered search on ACI doesn't work when person search is done.

    APAR:    IY93986
    Symptom: Non-administrative ITIM user is allowed to orphan their accounts.
    Note:    As part of this fix if accounts selected to be orphaned are already orphaned then 
             an error message displayed for the English language pack is :
               "CTGIMI015I Accounts with an owner cannot be made orphan accounts. One or more
                of the selected accounts have an owner."
             The correct error message is :
               "CTGIMI015I Accounts without an owner cannot be made orphan accounts. One or more
                of the selected accounts do not have an owner."
             This will be corrected in a language pack which will be addressed in a Future Release of ITIM.

    APAR:    IY94401
    Symptom: ITIM does not send an email to the user when the agent is down during the 
             first attempt.
    Note:    Password notification of accounts for add, restore and change password operations 
             will take effect only for requests fired, after this fix was applied.

    APAR:    IY94425
    Symptom: EJB user/password that is set in runConfig should be set J2C Authentication data entry of 
             "itim_jms". The ITIM 4.6 Installation Guide, Appendix D., Table 13 needs to be changed to 
             reflect the following corrections:
             
             Field                      Value
             --------------------------------------------------------------------------------------------
             Alias                      itim_jms
             User ID                    Enter either the ITIM EJB userid, by default the WebSphere
                                        administrator ID, usually wasadmin, when WebSphere
                                        global security is on, or enter an empty field  when WebSphere
                                        global security is off.
             Password                   Enter a password for either the ITIM EJB userid  when WebSphere 
                                        global security is on, or enter an empty field when WebSphere 
                                        global security is off.  
                                        Please note that this password is limited to 12 characters by the 
                                        WebSphere AppServer.
             Description                JMS J2C authentication alias.

             Please also note that in Chapter 7, under the Security Tab section, the EJB userid password 
             referenced here is the same password discussed above and is restricted to 12 characters.

             This information will be updated in a future release ITIM Installation Guide if applicable. 

    APAR:    IY94471
    Symptom: Multi-valued attributes are not being handled correctly.
             If one of the values supplied to the adapter during add/modify fails, the ITIM ITDI component 
             fails to remove the ITIM LDAP object. 

    APAR:    IY94978    21759
    Symptom: The API WorkflowProcessEntity.getProcessContext() method always throws 
             "UnsupportedOperationException" exception.

    APAR:    IY94979    21801
    Symptom: When submitting a request to create a person in ITIM when the person's name contains 
             a large number of extended ASCII characters, the request will fail to get created in 
             the ITIM database.

    APAR:    IY94980    22053
    Symptom: The password sync servlet doesn't correctly handle passwords including non-ascii characters.
             The non-ascii characters get corrupted.

    APAR:    IY94984    21177
    Symptom: NEW FUNCTION
             Support new line character while displaying description on RFI screen.

    APAR:    IY94985    21186
    Symptom: In the SearchFilter control the "Objectclass" field is not honored correctly. 
             The Objectclass has to be explicitly specified in the filter.
    Note:    The 'Objectclass' field of a SearchFilter control eliminates any objectclasses
             extending the specified objectclass from the search. So to consider an 
             objectclass and all it's subclasses, it should be specified in the 
             'Filter' field, by appending it to the existing filter and leaving the 
             'Objectclass' field of a SearchFilter control blank.

    APAR:    IY94986    22100
    Symptom: ProvisioningPolicySearch and OrganizationalContainerSearch searchByFilter 
             leak LDAP connections.

    APAR:    IY94987    22112
    Symptom: NEW FUNCTION
             Added internal logging additions to enhance debugging. 

    APAR:    IY94988    22108
    Symptom: Introduction of <AssignmentID/> tag in Approval, RFI and WorkOrder nodes to
             retrieve the assignment id.

    APAR:    IY94989    22111
    Symptom: Custom form validation does not take into account LDAP attribute syntax 
             constraints.

    APAR:    IY93018
    Symptom: ReportManagerBean code does not respect the enrole.ui.report.maxRecordsInReport setting when 
             generating CSV formatted reports.  An OutOfMemory exception may result when trying to allocate 
             a 20+mb StringBuffer as part of a CSV report.
    Note:    Execute the additional steps listed in step 7 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY94311
    Symptom: An entitlement workflow is reset when someone clicks on "Provisioning Parameter List", then 
             clicks cancel.
    Note:    After applying this Fix Pack, it is recommended that the user do a 
             hard-refresh (Ctrl+F5) on the browser window, so as to enforce the new 
             version of java script files immediately.

    APAR:    IY94313
    Symptom: A 'search query UI' returns results for all services when there are 2 Oracle services and they 
             attempt to search for roles using the search query UI (checkbox on the account form attribute 
             in the form customization).  The results include roles from both Oracle services.
    Note:    This APAR removes the limitation of a SearchFilter control where the 'Objectclass' field 
             eliminates any objectclasses extending the specified objectclass, from the search.

    APAR:    IY94681
    Symptom: The startIncrementalSynchronizer fails if interval is skipped.  The command 
             "& startIncrementalSynchronizer" does not run successfully in background using nohup.
    Note:    Execute the additional steps listed in step 8 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY95033
    Symptom: DOCUMENTATION UPDATE:
             The ITIM InfoCenter needs to be updated with the following correction.
             ITIM 4.6.0 documentation references 'reminderCtx' when it should be 'Reminder'.
             To reference the 'To Do' item reminder object in the JavaScript snippets contained 
             in e-mail reminders, use the relevant data key 'Reminder' instead of 'reminderCtx'.

    APAR:    IY95477    22016
    Symptom: WorkflowAssignmentMO.getPotentialOwners throws exception if one of the potential owners has 
             been removed from the system.   

    APAR:    IY95478    22017
    Symptom: Password Policy evaluation does not detect conflicts between Restricted characters and required 
             characters.  If you have a password policy that requires the letter A and another password policy 
             that disallows the letter A, then when these password policies are combined the server should detect a 
             password rule conflict.
  
    APAR:    IY94415
    Symptom: Large unsorted LDAP searches results in OutOfMemory.
    Note **: You must follow guidelines when using SearchMO API to retrieve large resultsets -
             1. If you need the resultsets returned by SearchMO to be sorted, i.e. if you specify
                a sort attribute on SearchMO object, then for large results, it is highly recommended
                to set the property 'enrole.search.sss.enable' in <ITIM_HOME>/data/enRole.properties 
                to 'true' and also ensure that directory server used by ITIM supports server side 
                sorting.

             2. Do not use 'getResults()' function on SearchResultsMO, to get all the search 
                results in one call, instead fetch them page by page.
                Example usage in API client program -
                <snip>

                     SearchMO searchMO = new SearchMO(platform, subject);
                     /* Set the parameters for search here */

                     SearchResultsMO resultsMO = searchMO.execute();
                     int pageNumber = 0;                           // starting page
                     Collection apiResults = new ArrayList();
                     Collection page = resultsMO.getPage(++pageNumber); // get the first page
                     while( page != null && !page.isEmpty() ) {
                        apiResults.addAll(page);
                        page = resultsMO.getPage(++pageNumber);   // get the next page
                     }
                     // At the end of the above while loop, the 'apiResults' collection
                     // will have all the search results.

                </snip>

    APAR:    IY94616
    Symptom: Unable to import exported workflow when in the approval node participant is defined with a 
             dynamic organizational role.

    APAR:    IY94773
    Symptom: Hosted ITIM Account not provisioned automatically for a person even when the hosted account
             entitlement type is 'Automatic' and the person satisfies the policy membership, if the
             person is already an owner of another ITIM account governed by the default ITIM service.

    APAR:    IY95026
    Symptom: When using Oracle 10g JDBC Driver, account provisioning causes Oracle error :
              Error: 24816
              SQL State: 99999

    APAR:    IY95030
    Symptom: When trying to use the viewer.sh script we ship with ITIM to view the msg.log file, it fails with a
             parsing exception because the log file is not valid XML. This happens when there are connection
             error messages in the log file.
    Note:    This fix only prevents future occurrences of connection error messages being logged incorrectly.

    APAR:    IY95251
    Symptom: The ITIM API call, personMO.getRoles() method,  doesn't work as expected per the javadoc.
    Note:    After this fix, PersonMO.getRoles() will throw AuthorizationException under the following 
             conditions -
             1.  The logged-in user does not have 'Read' attribute permission granted on the role attribute
                 of the person.
             2.  The logged-in user does not have 'Search' operation permission granted on any of the roles
                 assigned to the person.

    APAR:    IY95445        
    Symptom: When the ITIM server is protected behind a TAM Webseal junction, the report output cannot be viewed, 
             because the ITIM report function uses Absolute URLs.  ITIM should be using Relative URLs.

    APAR:    IY95822    22337
    Symptom: SearchResults not closed while enforcing imported dynamic role.

    APAR:    IY90228
    Symptom: If a compliance issue entry is larger than 241 characters, the TODO entry is not created.

    APAR:    IY91106
    Symptom: SearchFilter field value changing from name to dn under some conditions.

    APAR:    IY91347
    Symptom: The canned report 'Approvals and Rejections' produces incorrect output. It produces 
             too many rows due to the SQL statement being used.
    Note:    If "Approvals And Rejections" report template has been modified, you will have to 
             redo the modifications again after DBUpgrade. If Crystal reports is configured and 
             OutOfBox ApprovalsAndRejections.rpt has been imported, then you will need to reimport 
             it once again from <ITIM_HOME>\extensions\examples\reports\crystal directory.

    APAR:    IY91507
    Symptom: Get CTGIMM036E when you submit an incorrect Challenge/Response. We expect CTGIMM037E 
             because max invalid attempts are setup in the ITIM GUI. 

    APAR:    IY91533
    Symptom: In ITIM 4.6 the Authentication API is not compatible with that present in ITIM 4.5.1.

    APAR:    IY91561
    Symptom: APAR IY74422 provides java code for a custom fesi extension and this was originally 
             developed for TIM 4.5.1.  The same java code does not work correctly with TIM 4.6.  
             When this is used you get a class cast exception.
    Note:    This is a Sample Java Code change. The IY91561.zip is shipped with the updated sample 
             code showing how to code a custom Fesiextension.
             To use the sample code please unzip $ITIM_HOME/extensions/APAR_Doc/IY91561.zip to a 
             temporary directory on your hard drive and follow the instructions given in Readme.txt
             present in the extracted directory.
 
    APAR:    IY91759
    Symptom: Modify of erldapgroupname attribute is sent as replace instead of add/delete operation 
             from TIM server to TDI/RMI LDAP adapter.
 
    APAR:    IY91804
    Symptom: Default date field does not retain the value of 31 when multiple date fields are on 
             the Person form.

    APAR:    IY91896
    Symptom: A 4.6 upgrade from 4.5.1 fails when a large amount of data is being upgraded.

    APAR:    IY92039
    Symptom: Email field for the Person object does not allow to you enter certain email addresses.
             For example: info@2good.com.

    APAR:    IY92097
    Symptom: When the erroles attribute of the Person entity is configured as SearchMatch the 
             behavior of the corresponding org role search function is not consistent.

    APAR:    IY92176
    Symptom: Problem with RACF account subform "Connect Groups" when using a Scandinavian
             Character set.

    APAR:    IY92733
    Symptom: Documentation Update for JAVA Key Store Vulnerability:
             This is a restatement of the DCF Technote found at:
             http://www-1.ibm.com/support/docview.wss?uid=swg21251069
             This will work on OS Platforms that support -Xoptionsfile Generic JVM Argument.
             ***   Problem Description:
             To configure SSL connection between TIM server and adapters, the following two parameters 
             are required to be defined in WAS as parameter to JVM.

                - javax.net.ssl.trustStore
                - javax.net.ssl.trustStorePassword

             As a result, when process list is inquired using "ps -ef" command, password of the 
             Java Key Store gets listed in the result output as follows.

             ---------------------------------------
             # ps -ef | grep java
             root  995486       1   0   Dec 07  pts/1 21:24
             /usr/WebSphere511/AppServer/java/bin/java
             ...
             ...        (more lines of process data)
             -Djavax.net.ssl.trustStorePassword=password     <------------*** in plain text
             -Djava.security.policy=/usr/WebSphere511/AppServer/properties/...                                  
             ...
             ...        (more lines of process data)
             ---------------------------------------

       ***   Solution, this is a sample solution:
             Describe these parameters in a file, then specify the file with "-Xoptionsfile" 
             option.
             
             1) Create a file, then describe these parameters on the same line as follows:
             
             ------
             -Djavax.net.ssl.trustStore=/usr/IBM/itim/itim46.jks
             -Djavax.net.ssl.trustStorePassword=password
             ------

             2) Specify the file name with "-Xoptionsfile" option as parameter to JVM
               a. Open WAS admin console
               b. Select "Server" -> "Application Server" -> <server name> 
             -> Process Definition -> Java Virtual Machine
               c. Add "-Xoptionsfile" option as follows                   
                                                                          
             -Xoptionsfile=/usr/IBM/itim/jksProps.txt                     
                                                                          
             3) Restart WAS                                                            
                                                                                       
             The following is sample of the process list.                              
             
             ---------------------------------------
             # ps -ef | grep java
             root  995486       1   0   Dec 07  pts/1 21:24
             /usr/WebSphere511/AppServer/java/bin/java
             -Djava.net.preferIPv4Stack=true -Dwas.status.socket=57028
             ...
             ...        (more lines of process data)
             -Xoptionsfile=/usr/IBM/itim/jksProps.txt      <----------* only get txt file name
              -Djava.security.auth.login.config=/usr/WebSphere511/AppServer/properties/...
             ...
             ...        (more lines of process data)
             ---------------------------------------

             Note that the -Xoptionsfile option is non-standard and subject to change without 
             notice.

    APAR:    IY92777
    Symptom: Dropdown list in RFI throws a CastClassException.

    APAR:    IY92840    20808
    Symptom: Get OutOfMemory Exception whenever attempting to run report data synchronization.
             This can occur on a large organizational structure, for example, an Organization 
             with more than 7000 OU's and 6000 ACIs, 20000 people, each having at least
             three accounts (TAM, ITIM, RACF).

    APAR:    IY92841    20920
    Symptom: SystemUserSearch searchByFilter leaks LDAP connections.
    NOTE:    After applying this patch, all the applications that use any of ITIM's 
             Entity Search APIs such as AccountSearch, PersonSearch etc. should close the 
             SearchResults in the finally block.
             Example:
             <snip>
                    SearchResults searchRes = null;
                    try{
                       searchRes = (new AccountSearch()).searchByFilter(searchCtxt, 
                                                  profileName, filter, params);
                      //process the result
                    } catch(Exception e){
                        //Handle the exception
                    } finally{
                       if(searchRes != null) {
                       //Close SearchResults
                          searchRes.close();
                       }
                    }
             </snip>

    APAR:    IY92849    17524
    Symptom: When you click on 'Non-Compliant' symbol gives 'page cannot be displayed' error.

    APAR:    IY92850    17949
    Symptom: When you run the command "config_remote_services.sh -profile dsml2testservice", the
             dsml2testservice does not get imported.
 
    APAR:    IY92851    19540
    Symptom: The ITDI Integration HR Feed example contains some errors.
 
    APAR:    IY92884
    Symptom: Documentation update for README for 4.6.0-TIV-TIM-IF0032.
             UpgradeAccountStatus.sh is a sample script provided in IF0032 to help with the fix 
             provided for APAR IY91096 and may need to be modified as needed to suit the specific 
             requirements of a customer's environment.
    Note:    We have provided an updated version of the utility to initialize ‘eraccountstatus’ 
             attribute of all active accounts, to the default active status value of 0.
             
             Execute the following steps to run this utility.
             1. Unpack $ITIM_HOME/extensions/APAR_Doc/IY92884.zip, shipped along with this fix pack, 
                into any appropriate location.
             2. Edit UpgradeAccountStatus.bat [windows] or UpgradeAccountStatus.sh [unix] and follow the 
                instructions given in the corresponding scripts.
             3. Run the scripts.

    APAR:    IY90903
    Symptom: An ITIM user with no rights on a SERVICE can create a Provisioning Policy 
             for that SERVICE.

    APAR:    IY91030
    Symptom: Incorrect export failed message during profile import.

    APAR:    IY91096
    Symptom: Life cycle fails to execute ldap filter correctly when system.date is used 
             in a filter in combination with another filter.
    Note:    To enable correct execution of LifeCycle rules defined for accounts using a filter 
             condition such as (eraccountstatus=0) used to filter out active accounts, all the accounts 
             should have eraccountstatus attribute defined. We have provided a utility to initialize 
             ‘eraccountstatus’ attribute of all active accounts, to the default active status value 0.
             
             Please refer the APAR IY92884 for the steps to execute the utility.
             
    APAR:    IY91323
    Symptom: If the account used to filter requests is deleted, then when the user re-enters 
             'pending or completed requests', the user receives an error in ITIM.

    APAR:    IY91390
    Symptom: Pop-up dialog is displayed when value in drop-down list attribute is not one of 
             the defined values for the widget.

    APAR:    IY91415
    Symptom: When viewing TIM interface with IE 6 browser and in the browser Advanced Internet 
             Settings the "Disable Script Debugging (Internet Explorer)" is unchecked and
             "Display a notification about every script error" is checked,
             then you get a pop-up message complaining about entPopUp being undefined.
 
    APAR:    IY91511
    Symptom: "Filter By Service" option in "Filter Requests" page on "View Pending Requests" or 
             "View Completed Requests" tab doesn't work as expected.

    APAR:    IY91566
    Symptom: The ersynchpassword and erhistoricalpassword attributes are not correctly set when 
             "Repeat History Length" is set in a password policy.
             
    APAR:    IY91648
    Symptom: Incorrect ITIM lifecycle rule filter example in the ITIM 4.6 online help.
             The incorrect lifecycle rule filter example

             (&(employeType=active) (erPswdLastChanged >= ${system.date - 30}))

             appears in the sections Adding a new lifecycle rule for entities, Adding 
             a new lifecycle rule for entity type, Define lifecycle rule: Event tab, 
             Lifecycle example, and Lifecycle rule filtering and scheduling.  There 
             should not be white space after the inequality operator since the LDAP 
             server will interpret the white space as part of value.  The correct 
             filter rule of the above example should be

             (&(employeType=active) (erPswdLastChanged>=${system.date - 30}))

             Correct examples are shown in the section System expression syntax of the 
             ITIM 4.6 online help.
 
    APAR:    IY91656
    Symptom: An empty mandatory attribute is allowed to be submitted in an RFI.

    APAR:    IY92043
    Symptom: Attribute Names are truncated in a Custom Report query.

    APAR:    IY92208    17970
    Symptom: Multiple Account Delete operation does not get listed in Accounts operation report.
    Note:    After this Fixpack, please execute the steps mentioned in step 3 in the COMMON TASKS 
             section at the end of the README.

    APAR:    IY92218    19264
    Symptom: ITIM Account can not be searched if user id contains \/ (backslash or slash).

    APAR:    IY92219    19320
    Symptom: A '#' character is present at the end of text in every entry in an ACI report for 
             Object Type. 
 
    APAR:    IY92220    19407
    Symptom: ITIM account containing \ (backslash) can not be accessed.

    APAR:    IY92221    19408
    Symptom: Unable to login with ITIM account containing \ and / (backslash and slash).

    APAR:    IY92222    19381
    Symptom: DEFAULT tag is not stored in Directory Server when SOURCE tag is present.

    APAR:    IY92223    20308
    Symptom: NEW FUNCTION: Add filtering capability to completed requests. 

    APAR:    IY92225    20309
    Symptom: NEW FUNCTION: Maintain sort selection in completed requests.
    Note:    Execute the additional steps listed in step 4 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY92226    20310
    Symptom: NEW FUNCTION: Configurable field order in Completed Requests.
    Note:    Execute the additional steps listed in step 4 in the COMMON TASKS section at the 
             end of the README.
    
    APAR:    IY92227    20311
    Symptom: NEW FUNCTION: Add auto-refresh option to completed requests.
    Note:    Execute the additional steps listed in step 4 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY92228    19316
    Symptom: Unknown error occurred while deleting ITIM Service.

    APAR:    IY92229    20202
    Symptom: NEW FUNCTION Expose new recon management API.

    APAR:    IY89302    S17550
    Symptom: Setting relevant data item in string format to boolean values causes workflow 
             operation hang.

    APAR:    IY90062
    Symptom: FESI Engine cannot handle array objects.

    APAR:    IY90453
    Symptom: Regardless of the language selected at logon time, the report name gets displayed 
             in English after saving it on the Design Report panels.
   
    APAR:    IY91001
    Symptom: Unable to restore account without write access to the password.
   
    APAR:    IY91022
    Symptom: LDAP filter that is set in lifecycle rule isn't correctly run if it includes NOT (!)
   
    APAR:    IY91334    C17925
    Symptom: Null Pointer exception while restoring orphan account.

    APAR:    IY91548    C17539
    Symptom: Supervisor field is displayed as dn if deleted even when referential integrity is
             configured on Sun ONE directory server.
   
    APAR:    IY91549    C17542
    Symptom: User can login with userid as * & password as itim manager's password.
   
    APAR:    IY91551    C19869
    Symptom: DN returned when search is unbalanced. If you put ")" at the end of search criteria 
             (for a person, for example) search results show up erglobalid instead of user name.
   
    APAR:    IY89299    17548
    Symptom: Workflow set to DEBUG_MAX level causes NullPointerException.
   
    APAR:    IY89314    17552
    Symptom: The search should be disabled for non-admin ITIM users when searching a report.
   
    APAR:    IY89643    17559
    Symptom: OutOfMemory errors in the java plugin after an upgrade from ITIM 4.5.1 to ITIM 4.6.
    Note:    After applying this fix please clear the java plugin cache for these changes to take 
             effect. The plugin cache has to be cleared on every machine from which you access 
             ITIM applets in a browser. The steps differ for each version of java plugin 
             installed.
             
             Execute the following steps to clear the Java Plug-in cache for the JRE Version 
             1.5.x.
             1. On a Windows box, click Start > Control Panel and double-click the Java icon in 
                the control panel.The Java Control Panel appears.
                
                If you are on a unix box, you can launch the java control panel by running the 
                <JRE installation directory>/bin/ControlPanel or 
                <JRE installation directory>/bin/JavaPluginControlPanel program. On some systems 
                you can also load the Control Panel applet with a web browser by running 
                <JRE installation directory>/ControlPanel.html.

             2. Click Settings under Temporary Internet Files. The Temporary Files Settings 
                dialog box appears.
             
             3. Click Delete Files. The Delete Temporary Files dialog box appears.
                There are three options on this window to clear the cache.
                1. Delete Files

                2. View Applications

                3. View Applets
             
             4. Click OK on Delete Temporary Files window. 
                Note: This deletes all the Downloaded Applications and Applets from the cache.
             
             5. Click OK on Temporary Files Settings window.
                Note: If you want to delete a specific application and applet from the cache, 
                      click on View Application and View Applet options respectively. 
             
             Execute the following steps to clear the Java Plug-in cache for the JRE Version 
                1.4.x.
             1. On a Windows box, click Start > Control Panel and double-click the Java icon 
                in the control panel.The Java Control Panel appears.

                If you are on a unix box, you can launch the java control panel by running the 
                <JRE installation directory>/bin/ControlPanel or 
                <JRE installation directory>/bin/JavaPluginControlPanel program. On some systems 
                you can also load the Control Panel applet with a web browser by running 
                <JRE installation directory>/ControlPanel.html.
             
             2. Click on the Cache tab
     
             3. Click on the Clear button
         
             4. Click OK to confirm and exit.

    APAR:    IY89672    17560
    Symptom: Unable to logon due to CTGMM095E error when processing challenge response.
   
    APAR:    IY89797    17561
    Symptom: Lifecycle rules defined for an ITIM Account do not appear in list of available 
             rules to export in IMPORT/EXPORT tab of CONFIGURATION.
       
    APAR:    IY89952    17566
    Symptom: After applying 4.6.0-TIV-TIM-IF0024, when you go to Configuration=> Entities and 
             click on Intern/Contractor-Horizontal getting an error:
             "CTGIML010E The URL cannot be accessed." 
   
    APAR:    IY90135
    Symptom: This is a documentation notice for Fixpack README's.  It is not applicable to
             Interim Fix README's and is presented here only to notify ITIM Customer's to be 
             aware of an additional step to install ITIM Fixpacks.  The ITIM Installer 
             cannot handle encrypted passwords during runconfig.  If you have encrypted 
             passwords, you will need the following workaround.
             When doing an UPGRADE, you may workaround this problem by:       
                Turn off the encryption flag using  runConfig, then proceed with 
                the UPGRADE and after a successful UPGRADE, use runConfig again  
                to set the encryption back on.                                   
   
    APAR:    IY90231
    Symptom: There may be a displaying problem when adding USERS to GROUPS consecutively.
   
    APAR:    IY90136    17568
    Symptom: Placement rule on HR feed does not work on multiple nested ou's.
   
    APAR:    IY91040    17554
    Symptom: Get "workflow definition cannot be found" exception while importing already exported 
             and deleted child workflow.
   
    APAR:    IY91041    17573
    Symptom: Attribute values in database from report data sync are truncated at 
             255 characters.
   
    APAR:    IY91042    C17822
    Symptom: Report shows wrong User Input Condition.
   
    APAR:    IY91043    C17829
    Symptom: Unable to create account for user on deletion of hosted service.
   
    APAR:    IY91048    C17915
    Symptom: In "Default Identity Policy", the Service and Definition entries are blank.
   
    APAR:    IY91049    C18005
    Symptom: Service Owner field is displayed as DUMMYDN in reports.
    Note:    For any entity of the type 'Service' mapped for synchronization, if the owner is 
             undefined in LDAP, then after synchronization, the value stored in DB for the entity 
             would be the constant string 'DUMMYDN' and not a NULL or empty string value. So any 
             reports displaying owner column of a service entity would display 'DUMMYDN' instead 
             of NULL for services that do not have an owner.
   
    APAR:    IY91054    C18394
    Symptom: ACI for Provisioning Policy does not work when you select the "entire policy" option 
             while submitting the provisioning policy modification.
   
    APAR:    IY91056    C19326
    Symptom: Value of erSystemRoleCategory gets modified in LDAP.

    APAR:    IY91058    C19406
    Symptom: If Service Selection Policy name is modified as blank, the component becomes 
             unusable.
   
    APAR:    IY86991    17468
    Symptom: Get OutOfMemory Error when exporting too many org roles using Export feature.
   
    APAR:    IY87045    17471
    Symptom: Attribute list isn't displayed in "Where" field while using the "Search" 
             menu for person search.

    APAR:    IY88093    17515
    Symptom: Getting CTGIMA706E The workflow definition cannot be found exception during
             Export operation.
   
    APAR:    IY88726    17531
    Symptom: OutOfMemory exception occurs in authorization package during large searches. 
    Note:    A new property 'enrole.userACICache.maxSize'  has been introduced in 
             enRole.properties in $ITIM_HOME/data directory.
             The value for this property defines the size of 'ACI check results' in-memory cache,
             maintained for every logged-in user. The default cache size is 50, if the property 
             is undefined.  The value of the property can be changed by editing enRole.properties 
             and adding the following line:
             enrole.userACICache.maxSize=50
             The minimum size of the cache is 1. The Greater the value for this property, there 
             will be more consumption of memory and a shorter response time. This property 
             mainly impacts search and listing operations.
   
    APAR:    IY89269    17547
    Symptom: ACI filter for erroles does not work with exact DistinguishedName.
             For example, When using an ACI filter of:
                (erroles=erglobalid=9238,ou=roles,erglobalid=0000,ou=ibm,dc=com) 
             ITIM cannot find the people who have this role.
   
    APAR:    IY89854    17541
    Symptom: Correct internal ACI logic for ACI filters.
   
    APAR:    IY89855    17545
    Symptom: Get Exception 
                " CTGIML009E: An error occurred during XSL Processing" 
             on Search Page for special characters in the search filter.
   
    APAR:    IY89857    C18105
    Symptom: While Adding groups to ACIs,ITIM displays "Please Select profile" for an admin-user.
    
    APAR:    IY91820    C19513
    Symptom: NameNotFoundException with ITDI schema fetch operation.
    
    APAR:    IY91821    C19514
    Symptom: ArrayOutOfBoundException for entry lookup operation.
    
    APAR:    IY91822    C19519
    Symptom: Excessive log statements in ITDI console with default settings.
    
    APAR:    IY91825
    Symptom: DOCUMENTATION UPDATE
             The extensions directory example, idi_integration, is updated to show the 
             changes needed for the Assembly line, account_management.xml, to work properly.
  
    APAR:    IY87426    17487
    Symptom: RFI dialog exits without any logging or exception data if the return key is pressed 
             in the ADD field of a SearchMatch element and this element is the only one in the 
             RFI.  Previously assigned values are lost.
    Note:    After applying the fix, the return key press may be ignored for submitting some 
             forms in ITIM.
    
    APAR:    IY87798    17510
    Symptom: Incorrect label resource is used for "Title" column of Person table in 
             "Design Report" panel.
    Note:    This is only required for customers generating CSV Reports in a NON-English Locale.
             In earlier Fixpacks, Same key "title' is being used for labels in CustomLabels.properties
             and reportingLabels.properties. To avoid a conflict between keys in different properties
             files, some key names used for Adhoc Report header, are changed in
             reportingLabels.properties. 
             Please see Step 5 of the COMMON TASKS after applying this Fixpack to update the file for 
             different locales as described below:
 
             Steps to change the keys in reportingLabels.properties for a locale:
             1. Open <ITIM_HOME>\data\reportingLabels_<locale suffix>.properties in a text editor.
                Here <locale suffix> is the suffix for respective locale, Example:'ja' for Japanese.
             2. Change the following keys below the line '#Report PDF headers':
                --------    ----------------
                OLD KEY     NEW KEY
                --------    ----------------
                'title'     'report.title'
                'time'      'report.time'
                'author'    'report.author'
                --------    ----------------
             3. Save the file.
             4. Restart ITIM.
             
    APAR:    IY88691    17525
    Symptom: Customer has created two custom password rules. Both show up in the defined password 
             rules, but only one of them shows up for the end user, and only one is enforced.
             This is a Documentation update in the ITIM extensions/examples.
   
    APAR:    IY88875    17533
    Symptom: When you attempt to abort a dsml feed, the feed aborts, but the service 'recon lock' 
             sometimes stays set. You must then manually run a set of sql statements to delete 
             the lock in order to run another recon. 
   
    APAR:    IY88987    17537
    Symptom: When English is selected by the language selector after the Japanese language pack 
             has been installed, some messages are displayed in Japanese. 
   
    APAR:    IY88999    17538
    Symptom: In the report design schema panel for a custom-defined person entity it is not 
             possible to map the erPersonStatus attribute (by default labeled "Status"). 
             The attribute is not shown in the "Unmapped Attributes" list.
   
    APAR:    IY89044    17543
    Symptom: After running a data synch, it completes successfully, but the 'name' column in 
             the organizationalcont0 table is no longer stored.  This problem occurred after 
             upgrading to APAR IY83709 (DT 17285) in 4.6.0-TIV-TIM-IF0020 or later.
   
    APAR:    IY89839    17488
    Symptom: Internally found defect.
             Scheduled "Enforcement action" change shows immediate change.  Enforcement 
             action should be "Mark" and after the schedule time it should be changed to 
             "Correct".
   
    APAR:    IY89840   C17870
    Symptom: Internally found defect.
             Alignment of IBM logo varies on some pages of PDF report.
   
    APAR:    IY89841    17303
    Symptom: NEW FUNCTION
             Purpose: The completed requests page must be sortable by status.
    Note :   The requests in the completed section can be ordered on the 'Status' column.
             The ordering will be internally done, based on the severity code mapped to
             the status in the new SUMMARY_ORDER table created in the ITIM database, as part 
             of DBUpgrade, during Fixpack installation. The table is populated with a default 
             mapping, covering all the default status codes.  Following is the default mapping :
             Severity Code - Status 
                       100 - Failure
                        99 - Warning
                        98 - Timeout
                        97 - Rejected
                        96 - Participant Resolution Failed
                        95 - Skipped
                        94 - Escalated
                        93 - Approved
                        92 - Submitted
                         1 - Pending
                         0 - Success
   
    APAR:    IY89842    17319
    Symptom: NEW FUNCTON
             Purpose:  To provide Audit Trail enhancements.
             Presently, the user interface for the audit trail makes it very difficult to locate
             errors and drill down on the reason for those errors. It may take many clicks to 
             find the cause of an error if there is just a single error within a request. Many 
             failed requests have multiple errors. This enhancement provides a single view for 
             the errors that may have occurred in a request. Please refer the doc 
             $ITIM_HOME/extensions/APAR_Doc/IY89842.pdf for detailed information.
             
    APAR:    IY89844    17460
    Symptom: Internally found defect.  
             Remove CTGIMA440E CTGIMA441E from enRoleLogging.properties in ITIM 4.6
   
    APAR:    IY89880   C19216
    Symptom: Internally found defect.
             Checkboxes for Alert do not allow selection.  
   
    APAR:    IY89881   C19319
    Symptom: Internally found defect.
             If Service name contains an & (ampersand), the Account cannot be added or modified. 
   
    APAR:    IY87017    17470
    Symptom: After installing Japanese from the language pack, viewing a report shows garbled 
             characters after selecting English at the ITIM logon. When selecting Japanese at the 
             logon, the report is correctly displayed without showing any garbled characters.  
             This problem only occurs if you run a Japanese language report and have set the 
             English LOCALE.  This occurs, because the default font used by ITIM, 'sans-serif' 
             does not support DBCS characters.
             This is a DOCUMENTATION Update:
             If you have set the English LOCALE and wish to view Reports generated in a DBCS 
             Language, you will need to ensure to use a font that is capable of displaying DBCS 
             characters.
             1) Open $ITIM_HOME/data/enRoleFonts.properties file.
             2) Comment out the $LOCALE=$font_name line for the English font.
             3) Add a new line for the $LOCALE=$DBCS_character_support_font_name
             4) Save the file
             EXAMPLE:
             If characters in the report are Japanese and $LOCALE = en
             then comment out en=sans-serif
             # en=sans-serif
             and add 
             en=Japanese
             The following DBCS Character support fonts are as follows:
             1) Japanese
             2) Simplified_Chinese
             3) Traditional_Chinese
             4) Korean
             This information is also applicable for locales other than English when DBCS
             Characters are not supported by the respective Font.
             
    APAR:    IY87276    17481
    Symptom: Can not get lifecycle rules for accounts to work when checking DN attributes within 
             the owned object. Example filter: (${owner.erparent}=<DN>)  
   
    APAR:    IY87389    17485
    Symptom: Restore of an account yields the following error:
                [com.ibm.itim.util.EncryptionException]CTGIMO036E An error occurred while
                processing an encryption request. The following error occurred. Error:
                Given final block not properly padded 
   
    APAR:    IY87405    17486
    Symptom: Unable to open ITIM Group which has more than 250,000 users belonging to that group.
   
    APAR:    IY87654    17493
    Symptom: When an ACI filter contains multiple relationship macros, only the first one is
             evaluated. For example with the following filter on an ACI for person objects to 
             limit the scope to two specific OUs that are located in the Org structure below the 
             ACI, only persons in the first macro listed are returned by the filter.
             Example filter:
                (|(${parent.ou}=Support)(${parent.ou}=Sales)) 
   
    APAR:    IY88709    17521
    Symptom: Unable to create account due to authorization error even if the ITIM account has 
             an appropriate ACI.
   
    APAR:    IY89035    17489
    Symptom: An extra Org Role column is sometimes displayed when searching Org Roles.
             Two Organizational Role columns are displayed, but only one column is valid.
   
    APAR:    IY89038    17498
    Symptom: When you add a User from the Provisioning/Manage ITIM Groups panel, after you click 
             on Submit, the user does not automatically appear on the User List tab. There is no 
             Refresh button on the page.
   
    APAR:    IY89039    17474
    Symptom: Under some conditions the Org Tree does not get expanded.
   
    APAR:    IY89040    17499
    Symptom: NEW FUNCTION
             Purpose:  To provide sufficient context to users in account forms to indicate which 
             account is being edited. 
             Added function: Added service name and account identifier in the "you are here" 
             above the account form. 
   
    APAR:    IY89041    17502
    Symptom: NEW FUNCTION
             Purpose: Enable the EditableTextList for widget to copy and edit existing entries.
   
    APAR:    IY89042    17532
    Symptom: Delete Account ACI doesn't allow to delete Orphan accounts.
   
    APAR:    IY86640    17452
    Symptom: AccessControlList caching causes OutOfMemory core when 1000's of ACIs present. 
    Note:    A new property 'enrole.accesscontrollist.maxSize' has been introduced to control 
             the number of containers of which access rights are cached. If this property is not
             specified, a default number of 1000 containers' ACIs will be cached. The value of
             this property if specified, should be a valid positive number. The value may be 
             increased or decreased depending on memory constraints.

    APAR:    IY86717    17453
    Symptom: The manager attribute value on person should be case insensitive when viewing
             the TODO items.
    Note:    After applying this fix pack, the manager attribute will be treated in a case 
             insensitive manner for new TODO items created. To be able to view the old TODO 
             items created before applying the patch, customer may need to execute 
             normalizeParticipant.ddl provided with this fix pack. The 
             .ddl file (normalizeParticipant.ddl), which contains a database script,
             should be executed on all DB platforms (i.e. DB2,Oracle and SQL Server). The script 
             should be preferably run by the Administrator who has complete access to all the 
             tables in the database. The normalizeParticipant.ddl is zipped in IY86717.zip.
             
             Execute the following steps to unzip and run the database script:
             1. Unzip $ITIM_HOME/extensions/APAR_Doc/IY86717.zip in a temporary directory.
             2. Execute following steps for corresponding database type
             
             SQL Server:
             -----------     
             Use the Microsoft SQL Server "Query Analyzer" tool, or a supported SQL client to 
             execute the ddl script.
             In Initial Dialog "Connect to SQL Server", specify:
                User: enrole
                Password: <your configured password>
                Select menu "File" | "Open..."
                File name: <temp_dir>\normalizeParticipant.ddl
                Select menu "Query" | "Change Database..."
                Select your database name (default is "itim")
                Select "OK".
                Select menu "Query" | "Execute"
                Select "File" | "Exit".

             Oracle:
             -------
             Run the Oracle sqlplus program. Specify your database user password for the 
             enrole user in place of "PASSWORD", your Oracle ITIM instance name in place of 
             "ITIMDB", and your <ITIM_HOME> location.
                sqlplus enrole/PASSWORD@ITIMDB
                > @<temp_dir>\normalizeParticipant.ddl
                > quit

             DB2:
             ----
             Type db2cmd to get the db2 prompt and on the prompt type the following:-
                db2 connect to <dbname> user enrole using <enrole's password>
                db2 -tvf <temp_dir>\normalizeParticipant.ddl

             here <temp_dir> is path to the normalizeParticipant.ddl. 
  
    APAR:    IY86727    17454
    Symptom: Event notification reconciliations are not invoking policy checking on ITIM server.
   
    APAR:    IY86740    17455
    Symptom: Modifying the phone # on person record from 949-555-1212 syntax to 9495551212 
             syntax fails with ldap error 20.
   
    APAR:    IY86773    17456
    Symptom: When an automatic provisioning policy has an attribute defined as mandatory with 
             the following javascript:
                var attr=subject.getProperty("initials"); if
                ((attr!=null)&(attr.length>0)) { return attr[0]; } else return null;
             and the policy enforcement on the service is set to correct, the account is created 
             with an empty attribute, but is flagged as non-compliant and the create fails:
                Status Failed
                Summary com.ibm.itim.workflowextensions.CREATE_ACCOUNT_IS_DISALLOWED;  
   
    APAR:    IY86880    17463
    Symptom: When attempting to run any default report, you get the following error. It also 
             occurs when trying to define a report or define schema:
                ORA-01424: MISSING OR ILLEGAL CHARACTER FOLLOWING THE ESCAPE CHARACTER
             This ran fine under Oracle 9i; the problem only happens with Oracle 10g.

    APAR:    IY86946    17465
    Symptom: Report creator isn't displayed on report header.
    Note:    Execute the following steps to apply the fix:
             1. Backup <ITIM_HOME>/data/adhocreport/xsl/standard.xsl in a safe place
             2. Unzip the $ITIM_HOME/extensions/APAR_Doc/IY86946.zip to a temporary directory.
             3. Replace <ITIM_HOME>/data/adhocreport/xsl/standard.xsl with standard.xsl from
                the unzipped directory.
             4. Restart ITIM.
             
    APAR:    IY86990    17467
    Symptom: The sample code provided in <ITIM_HOME>\extensions\examples\apps directory 
             truncates spaces from the arguments provided in a command line interface.
             For example, "cn=Manual Add" gets changed to "cn=ManualAdd"
             and displays "Unable to find account owner." for Provision account if the account
             owner is a custom defined Person.
    Note:    The examples directory will be updated by the application of this Fixpack.
    
    APAR:    IY87096    17472
    Symptom: Syntactic error in Account.searchByOwner script sample.
             In the online help docs, a sample script show:
                var account = new AccountSearch().searchByOwner(person.dn);
             This above will cause ScriptEvaluationException.
             The corrected version is:
                var account = (new AccountSearch()).searchByOwner(person.dn);
   
    APAR:    IY87271    17479
    Symptom: No message or visual indication when ACI prevents an ITIM account from modifying 
             Policy Enforcement on a service.
   
    APAR:    IY87274    17477
    Symptom: The asynchronous profile of the UPAdapter is not behaving asynchronously.  
             The ADD operation immediately shows SUCCESS without waiting for the agent response.
   
    APAR:    IY87275    17404
    Symptom: Getting OutOfMemory during large reconciliations.
   
    APAR:    IY87706    17505
    Symptom: Modify account fails with LDAP Error code 20, when a space value exists for 
             single valued attributes.  Employee # changes get warnings that attribute 
             value already exists even though the value stored in the ldap does not match 
             exactly with the value in the person form. 
   
    APAR:    IY88165    17372
    Symptom: Incorrect behavior of sorting functionality with Select All option.
   
    APAR:    IY88166    17464
    Symptom: NEW FUNCTION:
             Purpose: Support the manager attribute to allow it to be mapped via ersupervisor 
             mapping, as a multi-valued attribute.
   
    APAR:    IY88167    17473
    Symptom: Identity Policy Name is a required field but ITIM doesn't validate it so user can 
             create an Identity Policy without the name.
   
    APAR:    IY88168    17508
    Symptom: A deprovision transaction submitted while a reconciliation for the related service 
             is running, and for which the account on the managed platform has already been 
             manually deleted, will never complete once the reconciliation ends and must be 
             aborted.
   
    APAR:    IY85453    17391
    Symptom: While creating/modifying an Account for any hosted service, on Approval/Reject 
             form, Group DNs are displayed instead of group CNs.
   
    APAR:    IY85781    17418
    Symptom: Customer has an ACI that allows a user to run a custom request, but gets an error,
             SQL0134N Improper use of a string column, host variable, constant, or function 
             "COL_0". SQLSTATE=42907 
             at
             COM.ibm.db2.jdbc.app.SQLExceptionGenerator.throw_SQLException(Unknown Source),
             if a delegate runs the report.
    Note:    After applying the fix, new reports can not be designed with columns of a restricted
             data type.  The restricted data types for a report column are:
             BLOB, CLOB, BINARY, VARBINARY, LONGVARBINARY and LONGVARCHAR, defined in java.sql.Types
             Please refer java documents of the class java.sql.Types for more information on
             data types.
   
             An error message will be displayed if a non-admin user runs an adhoc report which 
             contains any column of a restricted data type. Such reports should be redesigned 
             and any display or filter column of a restricted data type should be removed.
             
             Crystal reports with column of a restricted type can not be imported and an error
             message 'CTGIMN003E An error occurred while saving a report template using the
             Crystal Reports designer' will displayed for such imports.
             
             An error message 'CTGIMN025E One or more Crystal Report templates contain an error.
             Either the report contains an unsupported field or a nonsupported table used in
             the report.' will be displayed on running an existing crystal report with column
             of restricted data type. Such Crystal reports should be modified and restricted
             columns should be removed
          
             After applying the Interim fix execute the following steps in order to add 
             the property 'denyAttribute'. The attribute specified as a value will be excluded 
             from the list of columns that can added in a report.
             
             1. Open <ITIM_HOME>/data/adhocreporting.properties in any text editor.
             2. Copy the property 'denyAttributes' and its values from adhocreporting.properties
                shipped with this Interim fix. Add more attributes as values if required to be
                excluded as columns from a report.
             3. Save the changes and quit the editor.
             4. Restart WAS.
                 a. Stop the AppServer (stopServer.sh)
            
                 b. Start the AppServer (startServer.sh)  


    APAR:    IY85943    17428
    Symptom: When a lifecycle rule filter contains a relationship macro, the success of the 
             search depends on the position of the macro within the search filter.
             The search filter only works if the relationship macro is first in the filter. 
   
    APAR:    IY85987    17429
    Symptom: Problem with SearchMO.setPaging API.
             ITIM APIs SearchMO.execute().getResult() does return search results for smaller 
             sizes (about 10 or less) But they are not returning anything when the results size 
             is larger (11 or more so).

    APAR:    IY86372    17443
    Symptom: Poor performance for rendering date fields in SAP roles after applying IF0019.
    
    APAR:    IY86419    17446
    Symptom: Getting HTTP 500 Internal server error when sending a modify person request to 
             delete a role to which the ITIM user doesn't have permissions set.

    APAR:    IY86471    17448
    Symptom: While approving creating a person, the approver that is specified in workflow needs 
             to check the details of the person in "Access To Do List" by selecting 
             "View Request Data".  However the information that is related to person to be 
             created isn't displayed on the panel if "Domain Administrator" is set to the 
             approver in Participant field.  On the other hand, the Data tab shows the data.
   
    APAR:    IY86487    17449
    Symptom: Customer applied IF20 and now is unable to transfer person records via the search 
             servlet. Instead of being able to search for the new OU, a person search is brought 
             up instead.
   
    APAR:    IY86882    17444
    Symptom: NEW FUNCTION:
             Performance enhancement for HR feeds.
             The biggest performance issue in HR Feeds when starting with a large user 
             population is a particular IDS search. The search is being performed to try 
             to recurs down the org chart to determine whether or not the person in the 
             feed already exists. This ITIM Performance Enhancement changes the search 
             technique from a recursive search through the org chart starting at a specific 
             OU to a single search in the entire organization followed by a determination 
             of whether the people found reside in the OU or its children.
    Note:    To optimize IDI HR Feed, a new property enrole.hrfeed.cache.timeout has been 
             introduced in enRole.properties file. The value of this property defines the 
             timeout of cache in minutes, internally maintained by ITIM to improve IDI HR 
             Feed performance. If the value of this property is not defined or does not have 
             a positive numeric value defined, a default of 5 minutes will be assumed, for 
             timeout of the cache. As this timeout property is used to cache information by 
             ITIM, some changes like a change in placement rule of IDI service etc, will not 
             take effect until the timeout.
             Execute the following steps to specify a value for this property in 
             <ITIM_HOME>/data/enRole.properties file.
             
             1. Open <ITIM_HOME>/data/enRole.properties in any text editor.
             2. Add the following line at the end of the file. Specify appropriate value 
                for this property.
                enrole.hrfeed.cache.timeout=5
             3. Save the file and quit the editor.
   
    APAR:    IY86885    17419
    Symptom: If there is a problem within a fesiextension application, the request 
             fails immediately. The retry parameters have no effect on the request, 
             while in the fesi code. 
    Note:    To enable retry of an activity in the workflow, when the java script 
             evaluation fails, due to Directory Server being down, edit the file :
             <ITIM-HOME>\data\fesiextension.properties and add the following new property.
             fesi.extension.retryOn=com.ibm.itim.dataservices.model.DS_COMMUNICATION_ERROR
      
             Additionally any custom FESI code, used in the workflow, which performs any 
             LDAP operation, should be modified to throw JS Exception, with the exception 
             message set to "com.ibm.itim.dataservices.model.DS_COMMUNICATION_ERROR". 
             Example: 
             try { 
             //Custom FESI Code performing LDAP operation
             } catch(ModelCommunicationException e) {
             
                  String msg = "com.ibm.itim.dataservices.model.DS_COMMUNICATION_ERROR";
                  throw new CustomJSException(msg, e);
             }
             
             Alternatively, the exception message thrown by a custom FESI extension, can be
             included as another value of the 'fesi.extension.retryOn' property. Multiple 
             values specified for this property need to be comma separated.

   
    APAR:    IY86886    17450
    Symptom: When clicking on the 'Back' button on the NON-COMPLIANT FORM form, a popup dialog 
             box is displayed about an unhandled exception from servlet [AccountComplianceServlet], 
             also an Error Page is displayed with the same information that is in the IE popup 
             window.
   
    APAR:    IY86887    17440
    Symptom: DOCUMENTATION UPDATE for JAVADOCS
             The javadocs for remote APIs that contain a scheduled date time argument, such as
             PersonManager.createPerson, do not indicate that if the action is to be 
             "immediate" and not scheduled then the Date argument should be null.
             The javadocs will be updated and shipped in a future Fixpack.  At this time,
             please note that if you send a NULL, it means schedule immediately.
   
    APAR:    IY87048    17355
    Symptom: 'Page cannot be displayed' error is displayed on clicking on submit button of
             'Modify Entitlement' window.
   
    APAR:    IY87049    17405
    Symptom: Optimizing display of membership of dynamic role with many members.
             When a large dynamic role in an OU is displayed (with over 1000 members), there is 
             a problem handling the LDAP results that causes an empty list to be displayed, 
             instead of the paged role membership. 
   
    APAR:    IY87050    17377
    Symptom: Identity Manager Users are not displayed in Search under some rare conditions.
   
    APAR:    IY87051    17395
    Symptom: While processing a DSML response message from ITDI in ITIM, subsequent checks are 
             performed even after failure of initial check. This results in an 
             ArrayIndexOutofBound Exception when an operation is performed on a nonexistent 
             entry in an array.
   
    APAR:    IY87052    17402
    Symptom: Get Class Cast exception in auditMultipleAdoptEvent when multiple accounts are adopted.
   
    APAR:    IY87053    17412
    Symptom: During adoption of an orphan account, user is allowed to submit the request without
             a 'Person to adopt account'.
   
    APAR:    IY87055    17357
    Symptom: The carriage return is stripped out in the contents of notes field of the WinAD 
             orphan account.
   
    APAR:    IY81102    17171
    Symptom: Filter set in ACI doesn't work correctly when using the SEARCH function. 
   
    APAR:    IY81934    17218
    Symptom: LDAP filter that is set in lifecycle rule isn't correctly run if it 
             includes NOT condition "!" at the beginning or in the middle.
    Note:    Please note that in addition to being RFC 2254 compliant, the ldap 
             filter may be entered only in the form expressions-first, statements-later.
             For example. the filter (&(|(attrX=valX)(attrY=valY))(attrZ=valZ))
             needs to be written in the form: (&(attrZ=valZ)(|(attrX=valX)(attrY=valY)))
             Matching Rules and Relationship Expressions may not be resolved as desired.
             This restriction may be removed in a future release or future maintenance.
   
    APAR:    IY82086    17226
    Symptom: Mandatory enforcement on the Provisioning Policy doesn't guarantee the link 
             between the ITIM account and the ITIM group.
    Note:    As a fix to this defect, any change to ITIM group membership will lead to
             account modification workflow process being spawned for each ITIM account
             affected by the change. Additionally, removal of ITIM group will be only
             allowed, if the ITIM group does not have any ITIM accounts as members of
             the group.
   
    APAR:    IY82309    17233
    Symptom: If the person object being updated already has the same dn value in the manager 
             attribute, ITDI still does an update (this is not expected behavior). 
   
    APAR:    IY82314    17234
    Symptom: Alert Compliance processing prevents Modify Account Extensions from 
             operating properly when used in suspend/restore/password change operations.
   
    APAR:    IY82321    17235
    Symptom: Get error CTGIMM095E when entering answers to challenge response questions when 
             both English and "Default locale" questions are defined.
   
    APAR:    IY82894    17255
    Symptom: Unable to create new custom person object in TIM after upgrading to 
             4.6.0-TIV-TIM-FP0008.
   
    APAR:    IY83236    17266
    Symptom: Unable to get results if only one result exists for a single value 
             searchmatch field. 
    Note:    After applying this Fixpack, it is recommended that the user do a 
             hard-refresh (Ctrl+F5) on the browser window, so as to enforce the new 
             version of java script files immediately.
   
    APAR:    IY83247    17268
    Symptom: Get "LDAP error 65 - Object Class Violation" when updating account attributes.
    Note:    If this error is encountered when updating account attributes, then after 
             applying this Interim Fix, reconciliation needs to be run again. This 
             Interim Fix will prevent future incorrect update of single-valued 
             attributes, which are empty on the resource side, during reconciliation.
   
    APAR:    IY83249    17269
    Symptom: ITIM Notification e-mails are not sent when language pack is installed.
   
    APAR:    IY83257    17159
    Symptom: ITIM does not display over 1000 org units in 'My Organization' tab.
    Note:    After installing this fix, you need to change the property, 
             enrole.ui.maxSearchResults, in <ITIM_HOME>/data/ui.properties to the value 
             you wish to be able to view.
   
    APAR:    IY83261    17241
    Symptom: Unable to log in with Chinese characters (zhcn936) through SSO ITIM Server.
    Note:    A new property 'enrole.ui.ssoEncoding' is introduced in 
             <ITIM_HOME>/data/ui.properties.
             This property specifies the encoding scheme used by SSO authentication systems 
             like Webseal, to encode user credentials before sending to ITIM. After applying 
             the fix, if the property is not specified, ITIM will use UTF-8 as the default 
             encoding scheme. 

             If the authentication system uses encoding scheme other than UTF-8, then that 
             can be specified by setting 'enrole.ui.ssoEncoding'. Refer to the following 
             example for setting the value of this property to UTF-16:
             1. Open <ITIM_HOME>/data/ui.properties in any text editor.
             2. Search for the property 'enrole.ui.ssoEncoding' and specify UTF-16 as its value.
                enrole.ui.ssoEncoding=UTF-16
             3. Save the changes and exit the editor. 
   
    APAR:    IY83262    17245
    Symptom: Recon complete does not clear the ENROLE.LISTDATA table.
    Note:    After applying this fix, only accounts that have changed on the remote 
             resource will be evaluated for compliance, during reconciliation. Thus
             the reconciliation report will display details of only those accounts 
             that have been changed on the remote resource.
   
    APAR:    IY83263    17242
    Symptom: It is possible to create SMTP addresses with multiple @ symbols although 
             this is not allowed when managed through Microsoft Active Directory.
   
    APAR:    IY83264    17244
    Symptom: GZIP errors using Oracle 10G.
   
    APAR:    IY83265    17247
    Symptom: It is not possible to de-provision orphan ITIM-accounts.
   
    APAR:    IY83420    17274
    Symptom: Updated Documentation on ITIM and ITDI Integration.
   
    APAR:    IY83475    17263
    Symptom: NullPointerException due to uninitialized sessioncontext variable in 
             AuditManagerBean
   
    APAR:    IY83641    17281
    Symptom: AD Service definitions can not be displayed after ITIM 4.5.1 to ITIM 4.6.0 
             migration if they have an erADDomainPassword.
    Note:    A repair utility is shipped along with this fix pack that will enable removal 
             or encryption of such attribute values which are stored in clear text and also 
             specified in 'password.attributes' attribute in <ITIM_HOME>/data/enRole.properties 
             file. 
             To execute the utility please unzip $ITIM_HOME/extensions/APAR_Doc/IY83641.zip 
             to a temporary directory on your hard drive and follow the instructions given in 
             Readme.txt present in the extracted directory.
   
    APAR:    IY83651    17283
    Symptom: Java Script Object PersonSearch does not work in a Provisioning Policy Entitlement.
   
    APAR:    IY83709    17285
    Symptom: The enrolelastaccessdate.properties file is not working properly.
             The enrolelastaccessdate.properties file is used to redirect the attribute used 
             to derive the erLastAccessDate value from itself to another attribute on certain 
             account types. For instance, for AD services (erADDAMLService), erLastAccessDate 
             values should be derived from erADLastLogon. For RACF services (erRACFSSLService), 
             this value should be derived from erRacULogtime. 
   
    APAR:    IY83774    17286
    Symptom: Reconcile warnings for TAM groups with trailing whitespace in the group name. 
   
    APAR:    IY83790    17288
    Symptom: Multi-value entitlement attributes with a colon are incorrectly handled.
             Under certain circumstances, when a single colon ':' is used in a provisioning 
             policy entitlement attribute, the values are doubled which makes it act as 
             value separator.
    Note:    While specifying the values manually, for a multivalued attribute, through 
             "Advanced Provisioning Parameter" screen, if a value contains ":" either at 
             the  beginning or at the end, please specify a space before and after the 
             delimiter (::).
   
    APAR:    IY83875    17291
    Symptom: When using Combined Password Rules, specifically the Start With rule, you get a
             strange display result.
   
    APAR:    IY83901    17243
    Symptom: A BAD_NAME_SYNTAX exception occurs whenever the attribute "erTopXGroupName" 
             contains a character that is not valid for an RDN, even though this attribute 
             is tagged as a "RemoteRDN" in xforms.xml.
   
    APAR:    IY83904    17253
    Symptom: Service Provider Requests fail when reconcile is running (locking service) 
             and service profile specifies ASYNCHRONOUS mode.
   
    APAR:    IY83905    17261
    Symptom: ClassCastException occurs in AssignmentEntity.getInputParameters(), an attempt 
             is made to cast the Assignment object into a WorkItemInfo object. 
             The WorkItemInfo class extends Assignment, hence the ClassCastException is 
             thrown trying to cast a parent class as a child class.
    Note:    After applying this fix, the custom code using the API - 
                 AssignmentEntity.getInputParameters() 
             might throw an error or may fail to compile if WorkflowException is not handled. 
             This is because now this function is declared to throw WorkflowException. This
             exception will be thrown if any problem is encountered while trying to retrieve 
             input parameters. So if you are using this API, the custom code may need to be 
             modified to handle WorkFlowException thrown by this API. 
   
    APAR:    IY83906    17277
    Symptom: Custom logo will not display on Config tab.
   
    APAR:    IY83908    17279
    Symptom: CSV feed where erPersonPassword is specified that does not comply with the
             password policy fails to add the personal password account, but adds the user.
   
    APAR:    IY83925    17293
    Symptom: The ACI filter, (${role.errolename}=role_x), for an ACI, targeted on Person 
             entities, selects only persons having "role_x" role only but doesn't select 
             persons having any role other than "role_x".
   
    APAR:    IY83958    17295
    Symptom: Unable to import any of jar from ITIM 4.6 Server when Global Security enable in WAS.
   
    APAR:    IY84379    17322
    Symptom: ADMIN Domain ACI modification require ITIM server restart.
   
    APAR:    IY84443    17324
    Symptom: The "Request Details" of an "Enforce Compliance" activity does not list the 
             NonCompliant accounts, instead it displays the java object identifier of the 
             NonCompliant account.
   
    APAR:    IY84446    17326
    Symptom: Person Modification Operational Workflow always replaces aliases even if 
             nothing was changed. 
   
    APAR:    IY84451    17327
    Symptom: Documentation Update:
             Problem: Using ITDI a jndi connection returns serviceLoginContext error.
    Note:    In "ITIM 4.6 Installation and Configuration Guide, Appendix D (line no.141, 142)"  
             the path in step number 5  under "Configuring the JAAS login module for JNDI feed" 
             is incorrectly documented as  
             "com.ibm.remoteservices.provider.itim.ServiceLoginModule". 
             It should be read as: 
             "com.ibm.itim.remoteservices.provider.itim.ServiceLoginModule".
   
    APAR:    IY84466    17316
    Symptom: Custom logo is not displayed on password retrieval page, when, trying to retrieve 
             password using URL http://<ITIM_server_host>:<ITIM_host_port>/enrole/getpassword. 
   
    APAR:    IY84467    17315
    Symptom: Attribute value becomes blank when user navigates from non-compliance attribute 
             screen to the account form using the back button.
   
    APAR:    IY84468    17299
    Symptom: New Function:
             Menu items are not linkable when they are already the active menus.
             Users can drill down up to ten levels to find an account, then, they need to 
             backspace 10 times to get back and repeat the exercise.
   
    APAR:    IY84476    17328
    Symptom: The removeProperty() API is not working in ITIM 4.6.
   
    APAR:    IY84678    17336
    Symptom: This fix affects Oracle Databases only.
             If an agent is down, and a request is sent to that agent, ITIM server tries to 
             take the request information and store it in a table to allow the request to be 
             fired off when the agent is available again. If the request contains large amounts 
             of data, and the customer is using the Oracle 9i driver, the request will fail to 
             be written to the DB with a sql error. 
   
    APAR:    IY84684    17337
    Symptom: When an event notification recon from AD agent runs and sends modify requests for 
             existing AD groups to the TIM server, these fail to get updated in TIM server. 
   
    APAR:    IY84863    17339
    Symptom: When using ITIM 4.5.1 at 4.5.1-TIV-TIM-IF0051 Interim Fix level, and upgrading to 
             ITIM V4.6, get the following SQL error twice.
             SQL0601N: The name of the object to be created is identical to the existing name 
             "ENROLE.RECONCILIATION" of type "TABLE".
   
    APAR:    IY84864    17340
    Symptom: NoClassDefFoundError error on TIM system that was migrated from V4.5.1.
             The jsafe.jar file is no longer used in ITIM 4.6.0, since the encryption
             is changed in 4.6.0, but the jsafe.jar file is needed to be able to
             encrypt the existing 4.5.1 data in LDAP.

             If your TIM V4.6 system is migrated from V4.5.1, it is necessary to copy
             the jsafe.jar and log4j.jar files from the:
             $ITIM_HOME/lib 
             directory into:
             $WAS_HOME/installedApps/$CELL_NAME/enRole.ear directory  
             to prevent the NoClassDefFoundError error.

             You must always copy these 2 files back after installing an ITIM Interim Fix
             or Fixpack.
             The ITIM Fixpack and Interim Fix READMEs have been update with this update.
   
    APAR:    IY84904    17310
    Symptom: ITDI agent doesn't recognize ITIM reconciliation query/filter.
   
    APAR:    IY84905    17314
    Symptom: Unable to submit Chinese chars for Self Registration page.
   
    APAR:    IY84907    17343
    Symptom: Get a subFormRenderingError when trying to display SAP account's 
             "Authorization roles" which contains dates.
   
    APAR:    IY84919    17344
    Symptom: The method, getInputParameters(), of:
             com.ibm.itim.apps.workflow.WorkflowAssignmentMO
             returns collection of objects of type:
             'com.ibm.itim.workflow.model.RelevantDataItem' 
             and as this class is not present in itim_api.jar, it throws an exception. 
   
    APAR:    IY84954    17345
    Symptom: When using the ServiceSearch.searchByFilter, get:
             error: Runtime error com.ibm.itim.script.PROFILE_CONTEXT_MISSING.
    Note:    The functions ServiceSearch.searchByFilter() and ServiceSearch.searchForClosestToPerson() 
             methods can now be accessed in any Workflow scripts.
             The following are a brief description of this methods and its usage. 

             1) ServiceSearch.searchByFilter(filter, [scope], [profileName]); 
             
             Arguments: 
             filter : LDAP search filter that defines the criteria for returned containers to meet. 
                      The filter must be in the format defined by RFC2254 
           
             scope  : Optional search scope, provided as an int. Use 1 for One Level Scope and 2 
                      for SubTree Scope. One Level Scope is the default scope. 

             profileName : Optional profile name, provided as a String. Profile name of the service 
             to use as the basis for the search.

             Returns an array of DirectoryObjects representing the results of the search. 

             Example:
                 searchResult1 = ServiceSearch.searchByFilter("(erntlocalservername=*srv)", 2); 

             // use default one level scope 
                 searchResult2 = ServiceSearch.searchByName("(erntlocalservername=*srv)", "ADProfile");
                 
*IMPORTANT*  Please note that the prototype of the following function has been changed. Prior to 
             4.6.0-TIV-TIM-IF0020 this function accepted an integer argument as its second parameter, 
             which specified the scope of the search. But now that has been changed to accept profile name 
             as the second parameter and this function won't accept scope since it is of no relevance.
             
             2) ServiceSearch.searchForClosestToPerson(person, [profileName]); 
          
             Arguments: 
             person: The DirectoryObject representing a person to use as the basis for the search. 

             profileName :Optional profile name, provided as a String. Profile name of the service 
                          to use as the basis for the search.

             Returns an array of DirectoryObjects representing the results of the search. 

             Example:
                 searchResult1 = ServiceSearch.searchByFilter(subject); 

                 searchResult2 = ServiceSearch.searchByName(subject, "ADProfile");
   
    APAR:    IY84962    17346
    Symptom: Restoring an ITIM account can generate an error stating the password does not 
             meet current policy rules, when Password Sync is enabled. 
   
    APAR:    IY85007    17349
    Symptom: IdentityPolicy.userIDExists(baseidentity, false, false) checks for existing IDs 
             on orphan accounts for All services. The function returns true for orphan accounts 
             on other services, but if account is adopted then it returns false.
   
    APAR:    IY85046    17312
    Symptom: Enclose the actual 'user-entered' report's query filter part in the SQL statement 
             in parenthesis.
   
    APAR:    IY85048    17317
    Symptom: NullPointerException in logging when creating a new account with objectclass 
             violations.
   
    APAR:    IY85049    17300
    Symptom: New Function:
             Search settings are lost after exiting a search.
   
    APAR:    IY85050    17305
    Symptom: New Function:
             User with a large number of accounts wishing to change the password of only a few
             is forced to uncheck the accounts which are NOT being checked. 
   
    APAR:    IY85052    17307
    Symptom: New Function:
             In user managed records (i.e. Microsoft Active Directory), multi-valued items are 
             not sorted alphabetically (e-mails, security groups, etc).
   
    APAR:    IY85153    17365
    Symptom: Using the self care application notification e-mails are only sent during 
             forgot password function and not during the change password function.
    Note:    After applying the fixpack please execute the following steps in order to
             receive email notification for Change-Password operation.
   
             1. Edit 
                <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/ChangePasswordServlet.java.
                You can use any convenient text editor to edit the file.
   
             2. Change method call on line 694 from 
                SelfRequest sreq = spm.changePassword(userID, currentPassword, newPassword);
                to
                SelfRequest sreq = spm.changePassword(null, userID, currentPassword, newPassword, 
                new Boolean(true));
   
             3. Save the changes and quit the editor.
             4. Build and deploy self_care example according to instructions given in the README 
                for self_care. If older version of self_care is already deployed on WAS, you can 
                simply choose to "update" itim_expi application in WAS admin console giving the path 
                freshly built itim_expi.war file. Default settings can be used while updating.
                
             A new API has been exposed in order to fix this defect. SelfPasswordManager.html 
             has been updated with the information on the newly published API.
   
    APAR:    IY85241    17382
    Symptom: AE IY77169 FIX COMPLETION.  After ITIM Fixpack 4.6.0-TIV-TIM-FP005  the
             Automatic entitlement of Service Profile becomes restricted by UI.
   
    APAR:    IY85334    17353
    Symptom: Provide an API in RoleEntity.java, to maintain sync with ITIM 451 APAR IY82728.
    Note:    RoleEntity.html has been updated with the information on the newly published API.
   
    APAR:    IY85436    17394
    Symptom: When using the AccountManager.suspend API, a ClassCastException occurs if there is 
             only 1 account object in the list of accounts to suspend. 
   
    APAR:    IY85452    17386
    Symptom: Under User Interface Customization the listbox control is set to REQUIRED. However, 
             after entering data and then submitting the form, the control does not validate so 
             users can submit requests without selecting a value from the listbox.
   
    APAR:    IY85548    17297
    Symptom: When using '"' (double quote) in a group name, a group search result will 
             return an empty list.
   
    APAR:    IY85549    17352
    Symptom: NEW FUNCTION
             ENHANCEMENT: The mode check box should retain its previous state i.e. "checked" 
             after exiting a search.
   
    APAR:    IY85550    17308
    Symptom: Supervisor, Sponsor, Domain Admin cannot search/see containers they should  
             be able to even with default ACI allowing them to do so.
   
    APAR:    IY85551    17338
    Symptom: NEW FUNCTION
             PERFORMANCE ENHANCEMENT: This enhancement speeds up searches when done by a 
             non-Admin user when there is a very large organization.
   
    APAR:    IY85553    17361
    Symptom: NEW FUNCTION:
             ENHANCEMENT: Default search settings should be available on logon.
    Note:    The default search criteria that appears when the user navigates to the search 
             tab can be specified in the enRole.properties file using the following properties.
             DEFAULT_SEARCH_CONDITION, DEFAULT_SEARCH_CATEGORY, DEFAULT_SEARCH_CLASS and 
             DEFAULT_SEARCH_ATTRIBUTE.
             
             Please execute the following steps to specify the default search settings.
             
             1. Edit <ITIM_HOME>/data/enRole.properties file.
             2. Search for the following properties and specified appropriate value for these 
                properties according to your requirements.
                DEFAULT_SEARCH_CONDITION=1
                DEFAULT_SEARCH_CATEGORY=Person
                DEFAULT_SEARCH_CLASS=Person
                DEFAULT_SEARCH_ATTRIBUTE=cn
             3. Save the file and exit the editor.
   
    APAR:    IY85554    17368
    Symptom: Unhandled exception on Manage Password page.
   
    APAR:    IY85685    17367 17417
    Symptom: Auto account provisioning subprocess aborted.  The problem may occur when a person 
             modify operation triggers a policy enforcement action such that at least one existing 
             account for that person becomes disallowed and a new account gets auto provisioned.
   
    APAR:    IY85704    17414
    Symptom: The javadocs state that: 
             WorkflowSearchMO.setStatement(WorkflowQueryStatement statement)
             And that WorkflowQueryStatement is an Interface and that the implementing classes 
             are:
                ProvisioningQueryStatement
                RequesterQueryStatement

             But there is no code to handle RequesterQueryStatement.  The result is:
             WorkflowSearchMO RequestorQueryStatement ClassCastException 
    Note:    The parameter to WorkflowSearchMO.setStatement(WorkflowQueryStatement statement) should 
             be an instance of ProvisioningQueryStatement. Please utilize WorkflowProcessQuery APIs 
             if you want to use RequesterQueryStatement. The javadoc for 
             WorkflowSearchMO.setStatement(WorkflowQueryStatement statement) has been updated 
             accordingly.
   
    APAR:    IY85937    17426
    Symptom: ITIM Server javacores with 20000 ous and 250000 ACIs during Person Search.
   
    APAR:    IY86116    17435
    Symptom: When doing person searches through the API by an ACI controlled user, no results 
             returned 
   
    APAR:    IY86278    17441
    Symptom: Documentation Update for the Installation Guide:
             Unhandled error condition when, during Installation, a wrong hostname/IP address 
             is provided.
             During a new installation of ITIM, if the user inserts a hostname/IP address 
             different from the one specified during WebSphere installation, the installation 
             procedure completes but the ITIM product is not properly installed.
             The only message visible in the runConfig.stdout or runConfigTmp.stdout 
             (depending on the kind of installation) is the following one:

                ----- stdout>> **************
                ----- stdout>> Did not find any WebSphere node in the cell. Please check.
                ----- stdout>> **************

             reported several times (one for each call of the get_nodes).
             It should be noted that under this condition, when an incorrect hostname/IP address
             is used, the Installation does not complete properly, even though the messages
             may indicate otherwise.
             This condition will be addressed in the Installation process of a future release of
             the ITIM product.
   
    APAR:    IY86425    17301
    Symptom: NEW FUNCTION:
             ENHANCEMENT: Added Adoption and Orphan buttons to areas of the product where
             they are applicable to operations.
   
    APAR:    IY86426    17302
    Symptom: NEW FUNCTION:
             ENHANCEMENT: Key columns in the 'My Accounts' and 'My Passwords' list are not 
             sortable.  Specifically, the server name column is not sortable in 'My Accounts' 
             and none of the columns in 'My Passwords' are sort-able.
             The "Login Name" and "Service Name" will now allow a sort on 'My Accounts' and 
             'My Passwords' page.
                                                                         
    APAR:    IY86430    17400
    Symptom: IdentityPolicy.userIDExists(baseidentity, false, false) is not checking the target 
             service instance properly for Hosted Service.
   
    APAR:    IY86436    17403
    Symptom: ENHANCEMENT: Challenge Response submissions now pre-processed via JavaScript.
   
    APAR:    IY86437    17434
    Symptom: Enforce documented restrictions on migration (UPGRADE) path to ITIM 4.6.
   
    APAR:    IY86438    17363
    Symptom: The WinAD account creation fails if a constant attribute value in provisioning policy 
             entitlement "Advanced Provisioning Parameter List" contains a newline character.
    Note:    If you want to specify a constant value with a new line character for an advanced parameter, 
             write a javascript that returns a string representation of the value with newline characters 
             replaced by its unicode equivalent \u000A. 
             
             For example say you want to specify the following value for the advanced parameter "description" 
             for an AD account :
             John is a Manager,
             He works in accounts Dept.
             A script interpreter error is thrown. The error can be prevented by replacing the constant with 
             the following script for the "description attribute:

             {
                 var str = "John is a Manager,\u000AHe works in accounts Dept.";
                 return str;
             }
   
    APAR:    IY86442    17439
    Symptom: 'Page cannot be displayed' when Manage Passwords link clicked under My Organization > Manage People 
             for a person who doesn't have any accounts.
   
    APAR:    IY81222    17177        
    Symptom: Auto provisioning of two accounts fails with password sync enabled on the 
             ITIM server.
   
    APAR:    IY81564    17191
    Symptom: When using self care module (itim_expi.war) and logging on as a user, 
             attempting to set challenge responses produces error: 
             You cannot use the "Change Challenge/Response Answers" feature at this time.
             The sample code only supports configuring challenge/response answers when the 
             challenges are defined by an Administrator, however, there are no Administrator
             defined challenges at this time.
             
    Note:    To fix this issue we have modified the sample code shipped with ITIM. The modified 
             code will read the properties 'language' and 'country' specified in 
             itim_expi.properties file and display the challenges/responses appropriately. The 
             files:
             <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/expiUtil.java 
             and 
             <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/ChangeChallengeResponseServlet.java 
             have been modified and shipped. Please execute the following steps after applying 
             this fixpack.
             
             1. Rebuild and redeploy itim_expi.war using the new files. Alternatively if you have 
             modified the example code to suit your requirement, you can incorporate the changes 
             in these files and rebuild and redeploy itim_expi.war.
             
             2. In the itim_expi.properties file that is used by self_care application, specify 
             the 'language' and 'country' parameters according to the table given below. 
             self_care application will retrieve the challenges/responses depending on the value 
             specified for these properties. You can refer to the following table to set the 
             values of 'language' and 'country' appropriately.
             
                    Locale                         language                 country
             [specified in TIM UI while          
             setting the admin challenges]
             ------------------------------------------------------------------------------------
             German                                  de            (blank, don't specify anything)
             Spanish                                 es            (blank, don't specify anything)
             French                                  fr            (blank, don't specify anything)
             Italian                                 it            (blank, don't specify anything)
             Japanese                                ja            (blank, don't specify anything)
             Korean                                  ko            (blank, don't specify anything)
             Portuguese                              pt            (blank, don't specify anything)
             Simplified Chinese Resources            zh                       CN
             Traditional Chinese Resources           zh                       TW
             English                                 en            (blank, don't specify anything)

             In case you want to retrieve challenges/responses only for the default locale 
             (no locale specified while setting the admin challenge in directory server, which 
             can happen when you upgrade from ITIM 4.5.1), please comment the two parameters 
             'language' and 'country' by putting a '#' at the beginning. 
             Example:
             #language=
             #country=
   
    APAR:    IY82024    17224
    Symptom: ITIM 4.6 Export feature (Configuration) doesn't handle double-byte characters.
             During Import, get error - container not found.
             
    Note:    After installing the fixpack, for non Windows platform that doesn't support double 
             byte characterset, please ensure that the codeset in environment variable LANG is 
             set to UTF-8. Example; en_US.UTF-8. Usually this is the default setting on Linux 
             platform.  If this is not set, here is a sample script to set the environment 
             variable LANG to en_US.UTF-8. You may add this to the WebSphere startServer.sh if 
             you wish or use this example to start WebSphere, just uncomment the areas needed 
             and replace WAS_HOME appropriately. Please set the language and territory 
             appropriately depending on the locales installed on your operating system.
             
             The value of LANG variable is of the form language[_territory][.codeset][@modifier]
             where territory, codeset and modifier are optional. Ensure that codeset is set to UTF-8.
             
             #!/bin/sh
             
             LANG=en_US.UTF-8
             export LANG
             #<WAS_HOME>/AppServer/bin/startServer.sh server1
             
    APAR:    IY82201    17231
    Symptom: The subject and message are lost on workorders after upgrade from ITIM 4.5.1 to 
             ITIM 4.6
   
    APAR:    IY82903    17254
    Symptom: ITIM Tuning Guide, SC23-5272-01, correction: 
             Create Index Causes SQL0204N: Undefined Name Error 
             On pages 4, 5, 6, and 16 of the ITIM 4.6 Performance and Tuning Guide, 
             SC23-5272-01, the table names should not be double quoted. In the command section 
             each of the 4 commands should appear as follows:
    db2 'create index PROCESS_SUB_X on ENROLE.PROCESS ("SUBMITTED" DESC, "PARENT_ID" ASC)'
    db2 'create index PROCESS_ID_ST on ENROLE.PROCESS ("ID" ASC, "STATE" ASC)'
    db2 'create index PROCESSDATA_ID_DEF on ENROLE.PROCESSDATA ("PROCESS_ID" ASC, "DEF_ID" ASC, "VALUE_LAST_MODIFIED" ASC)'
    db2 'create index SCH_MSG_SVR on ENROLE.SCHEDULED_MESSAGE ("SERVER" ASC)'
   
    APAR:    IY82938    16990 - 17258
    Symptom: Getting CTGIM0040E when modifying account.   Some of the auditing table schema 
             lengths are not sufficient to hold the user data.
   
    APAR:    IY83068    17143
    Symptom: Reporting ACI's do not work after upgrading to ITIM 4.6 from ITIM 4.5.1.
             The target of the reporting ACI's is not preserved after upgrade.
             
    APAR:    IY83078    17223
    Symptom: During DBUpgrade, duplicate entries for "outofbox" Reports get inserted into 
             the table "REPORT".
   
    APAR:    IY83080    17209
    Symptom: Retry settings don't affect participant resolution failures.
   
    APAR:    IY83082    17229
    Symptom: Persons of all types are returned when using a case sensitive search instead 
             of a case insensitive search. However, search for custom persons works fine.
   
    APAR:    IY83243    17212
    Symptom: NotSerializable exception thrown, when trying to initialize the value of a user 
             defined relevant data item of the type array.
   
    APAR:    IY80099    17134
    Symptom: Excluded/Regular expressions in Entitlement are reset for SAP roles.
    
    Note: After applying this fix, on the "Standard View" of Provisioning policy entitlement 
    screen, "--" is displayed for "Start Date" and "End Date" if they do not have any values 
    specified. For example, if we specify a regular expression in "Advanced View", then on 
    switching to "Standard View" the regular expression is displayed with "--" against 
    "Start Date" and "End Date".
   
    APAR:    IY80892    17163
    Symptom: Adding adminDomain administrators requires restarting the ITIM server for this 
             change to take affect.
             
    Note: After applying this fix, any change in the ACI Principals will take effect only after 
    the ACI's get refreshed. This refresh interval is specified by the property 
    "enrole.accesscontrollist.refreshInterval" defined in <ITIM_HOME>/data/enRole.properties.
   
    APAR:    IY81541    17188
    Symptom: Scheduled Messages are being erroneously reinitialized. 
   
    APAR:    IY82149    17208
    Symptom: Modification details of the ‘Default ITIM Provisioning Policy’ entitlement are 
             not displayed in request data.
   
    APAR:    IY82150    17211
    Symptom: Lotus Notes - failed password changes still show as Success in ITIM GUI.
   
    APAR:    IY80454    17148
    Symptom: Policy.level=DEBUG_MAX logging shows password change values in clear text.
   
    APAR:    IY81245    17178
    Symptom: Running DBConfig.exe to drop the database tables generates an error in the 
             DBConfig.STDOUT:
             ----- SQL file: /opt/itim45/config/rdbms/oracle/enrole_functions.ddl
             Exception in 
             readDataFileIntoString(/opt/itim45/config/rdbms/oracle/enrole_functions.ddl):
                java.lang.StringIndexOutOfBoundsException: String index out of range: -1
   
    APAR:    IY81650    17176
    Symptom: Recon of resource leaves LDAP connections open.
   
    APAR:    IY81651    17166
    Symptom: Three of ITIM's EJBs generate WARNING messages when deployed.
   
    APAR:    IY81652    17169
    Symptom: ACI with filter that includes a system expression does not have expected 
             effect on access control.
   
    APAR:    IY81654    17172
    Symptom: Not able to set an attribute value to "empty" during DSML/IDI feed, when an 
             "empty" value tag is specified in the feed file.
   
    APAR:    IY81656    16375
    Symptom: Request Data displayed for modifying Default Provisioning policy for ITIM does 
             not display attribute modified.
   
    APAR:    IY80177    17137
    Symptom: Get an erroneous "required field" warning popup during as400 account modification. 
   
    APAR:    IY80468    17149
    Symptom: NullPointerException triggered after applying FP8 during IDI HR feed, when 
             updating a Person Attribute with a value, whose previous value is null/nothing.
                             
    APAR:    IY80789    17157
    Symptom: NullPointerException triggered after FP8 during Reconciliation, where an 
             Attribute's new value is null, but the old value is not null.
   
    APAR:    IY80881    17125
    Symptom: Self care application hangs when changeonlytimpassword is set to "true" in:
             itim_expi.propertes file.
   
    APAR:    IY80882    17127
    Symptom: Suspended ITIM Manager account is not restored on ldapconfig.
             Note - After applying this patch copy the file er-tenant.tmpl 
             to <ITIM_HOME>/config/ldap folder.
   
    APAR:    IY80883    17136
    Symptom: Date math is not calculating the year correctly which results in a date in the future.
   
    APAR:    IY80884    17139
    Symptom: Removal of System.gc() from Import Export component.
   
    APAR:    IY80886    17140
    Symptom: Identity Policy is evaluated twice during account add and modify.
   
    APAR:    IY80887    17141
    Symptom: The customer's subform works fine when within "Manage People", but during an RFI 
             the value of "target_dn" (not container_dn) is empty.
             Note - Please refer to IY80887.txt that contains detail instructions and examples on 
             accessing contextual parameters in SubForm control type.
   
    APAR:    IY80889    17144
    Symptom: ITIM gets ERROR 500 and throws NullPointerexception in some Reports menus.
   
    APAR:    IY80890    17152
    Symptom: When loading BPPerson data, ITIM does not perform a lookup on the erSponsor attribute 
             value, like it does for the erSupervisor (Manager) on Person objects.
   
    APAR:    IY78427    17054
    Symptom: ITIM 4.6 FP installer does not work with SSL connection setup between ITIM and LDAP. 
   
    APAR:    IY78978    17080
    Symptom: Unable to configure SearchMatch field, to Single Value.
   
    APAR:    IY79192    17090   
    Symptom: Dropdownbox\Listbox form element displays "Source Attribute" value instead of 
             "Attribute" value.
             NOTE *** To set the "Source Attribute" value of a Dropdownbox\Listbox form 
             element as the DistinguishedName of an entity, set it to 'dn'.'$dn' is not a 
             valid value.
   
    APAR:    IY79391    17096
    Symptom: When two persons have TAM GSO accounts with an identical name, neither of the 
             accounts are deleted on TAM although "View Completed Requests" indicates 
             that the deletion requests to these accounts are successfully completed.
   
    APAR:    IY79543    17102
    Symptom: Password Sync initiated password change on AD Agent does not send email to 
             the defined itim user account via the itim server.
             NOTE *** A new property has been introduced in enRole.properties located in
             ITIM_HOME/data directory i.e. 'enrole.passwordsynch.module.sendMail'. 
             Only if the value of this property in enRole.properties is set to 'true', an 
             email will be sent to the defined itim user account. This property can be set 
             to true by adding the following line in enRole.properties:
             enrole.passwordsynch.module.sendMail=true
             A copy of enRole.properties with this addition has been provided for your use
             as an example.  Do NOT copy this enRole.properties file to your system.
   
    APAR:    IY79559    17105
    Symptom: XSL parse error viewing pending or completed AD service request when account 
             has value for eradhomedirdrive attribute.
   
    APAR:    IY79936    17117
    Symptom: Although MQ CLI commands are referenced in the ITIM product manuals these 
             commands do not work if you are using the WebSphere embedded messaging 
             (which comes with the product) and have WAS global security turned on.

    APAR:    IY79938    17091
    Symptom: MBCS characters in URL are not encoded properly, for some locations in ITIM. 
             NOTE *** Fix has been incorporated and tested for versions of IE, supported by 
             ITIM 4.6.
   
    APAR:    IY79939    17087
    Symptom: Documentation for the self_care sample application is missing from the examples 
             documentation directory. The examples directory has been updated with the correct 
             information.  This Readme.htm will need to be copied to:
             <ITIM_HOME>/extensions/doc/self_care       directory
             
   
    APAR:    IY80010    17116
    Symptom: NullPointerException exception on new account creation when 
             CreatePassword & "Enable password editing" are disabled.
   
    APAR:    IY80012    17119
    Symptom: Get setProperty error with single character on Solaris.
             This is a very unique problem, during an account modify workflow that if the
             user does setProperty using a single-character to an attribute called: eg.
                myRasexecVar7 
             that it gets corrupted on the ACF2/Agent side of the transaction.
             For example, an 'E' generates a '69' on the mainframe.  When more than one 
             character is set, the value appears correct.
   
    APAR:    IY80019    17120
    Symptom: The erlastaccessdate attribute and value get removed from ITIM account if added 
             to the account form.
             NOTE *** The following attributes of an account entity, are managed by ITIM:
             - erlastaccessdate
             - erpassword 
             - erservice
             - owner
             The value of the above listed attributes can only be viewed in ITIM UI.
             Changes to the values of these attributes of an account entity, made by any 
             user, from ITIM UI, will be ignored.
   
    APAR:    IY80034    17118
    Symptom: Missing null check for attribute of a relationship object, during evaluation 
             of a RelationShip expression of ACI filter.
   
    APAR:    IY80035    16947   INTERNAL
    Symptom: Documentation: configuration info incomplete for SSL between ITIM server and LDAP 
             server.  Please see IY80035_ITIM_LDAPS_Configuration.pdf file which can be 
             found in the $ITIM_HOME/extensions/APAR_DOC directory.
             
  Fixes for enroleagent.jar
    
    APAR:    IY80441    17147
    Symptom: CA certs valid in 4.5.1 can be invalid in 4.6.

    APAR:    IY78197   17073
    Symptom: Agent password from AD service form displayed in clear text in WebSphere 
            SystemOut.log file

    APAR:    IY79776    17048
    Symptom: Enhancement: 
             New property introduced in enRole.properties to control ITIMs behavior encoding 
             a Challenge Response. ITIM by default converts responses to lower case before storing 
             them. Enhancement provides for administrators to chose encoding case for customization
             None implies case-sensitive challenge response enforcement.  Valid options are:
             enrole.challengeresponse.responseConvertCase=(lower|none|upper)

    APAR:    IY75064    16768
    Symptom: Various reports don't show information related to custom-defined persons.
             Note - To view information related to all custom-defined persons,
             adhoc synchronization has to be run again.
   
    APAR:    IY75663    16811
    Symptom: If configured values are differing in case, and if attribute is read only, 
             it is not displayed properly.
   
    APAR:    IY77051    16971
    Symptom: Specific script value of null in an entitlement causes Policy Enforcement to fail.
             NOTE: The following documentation change should be made in the section 
             "Account Validation Logic" of the ITIM 4.6 documentation:
             
             The existing paragraph:
             A null default or optional parameter value means that all values on the corresponding 
             attribute of a new or existing account are disallowed, except those allowed by any 
             other allowing values, but currently set values will not be removed.
             
             should be changed to:
             A null default or optional parameter value means that all values on the corresponding 
             attribute of a new or existing account are disallowed, except those allowed by any 
             other allowing values.   
             
    APAR:    IY77070    16982
    Symptom: The scheduler for Recon & Data Synchronization is broken.
   
    APAR:    IY77195    16986
    Symptom: In the field description of the formdesigner, the $ (dollar sign) gets lost, when
             you reenter the formdesigner for the gui-type dropdownbox. 
   
    APAR:    IY77505    16997
    Symptom: If a user has an extra whitespace after a property value, the parser does not work
             properly.  The parser should remove all whitespaces after a value. 
   
    APAR:    IY77579    16999
    Symptom: When viewing accounts from -> Provisioning -> Manage service -> service -> Accounts,
             then viewing the values for a non-compliant account, (orange triangle), the value for 
             'non-compliant value' is empty.  But, the value can be confirmed and does contain 
             data when viewing the full account from the service and managed account screens.  
   
    APAR:    IY77706    17004
    Symptom: When an OU name contains "&" character this results in XSL parsing error when viewing 
             details of Org Role in the OU.  
   
    APAR:    IY78078    17033
    Symptom: Null pointer exception when trying to submit a password change for an ITIM account.
   
    APAR:    IY78146    17039
    Symptom: Unable to run ldapClean.sh/bat script.
   
    APAR:    IY78383    17051
    Symptom: Update requests on DSML feed removes any attribute values not included  in the feed.
   
    APAR:    IY78667    17065
    Symptom: Logviewer gets SAX parse errors when it encounters trace entries with XML 
             data in the entry.
             Please note that input.xml should not contain xml header i.e. <?xml?>.
             The 'Wrapper Script' section in Readme.html in the following directory
                 <ITIM_HOME>\bin\logviewer 
             has been updated with this note.
   
    APAR:    IY78670    17066
    Symptom: Auditing of Provisioning Policy Drafts is lacking
   
    APAR:    IY78740    17008
    Symptom: Cannot configure certain extension nodes for entity type operations for business 
             partner entity types.
   
    APAR:    IY78741    17026
    Symptom: The ITIM userPassword values get truncated when fed to ITIM from IDI.
             NOTE: Binary attributes should be encoded to a Base 64 string in any request 
             from IDI to TIM or vice-versa. At receiver's end, these attributes should be 
             decoded from Base 64 string to get the binary value. In ITIM, only the binary 
             attributes with syntax listed in  $ITIM_HOME/data/Dsml2Schema.properties are 
             encoded or decoded, while communicating with IDI. In some cases, the syntax of 
             a particular binary attribute may not be present in Dsml2Schema.properties.
                             
             Steps to add a new attribute syntax in Dsml2Schema.properties:
             1. Open Dsml2Schema.properties file in a text editor.
             2. Add an entry for the desired binary attribute, to the file in the following 
                format:
                syntax.binary.<ATTRIBUTE_SYNTAX_NAME>=<OID_OF_SYNTAX>
                For example, the attribute syntax of 'OctetString' is used for  some binary
                attributes in SunOne Directory Server. So to add attribute syntax of 
                octetstring, add the following entry to the file:
                 syntax.binary.octetstring=1.3.6.1.4.1.1466.115.121.1.40
             3. Save the file.
             4. Restart ITIM for the changes to take effect.    
             
   
    APAR:    IY78743    17035
    Symptom: Request remains in "View Pending Request" with "Running" status.
             NOTE:  To clean entries from "ou=recyclebin" in ldap, use the ldapClean 
             utility provided with ITIM.
             After applying this patch follow the steps as given below:
             1. Copy itim_api.jar, itim_server.jar and api_ejb.jar from:
                $WAS_HOME/installedApps/$MACHINE_NAME/enrole.ear directory, to
                $ITIM_HOME/lib  directory.
                             
             2. For operating system other than windows:
                Edit ldapClean.sh in $ITIM_HOME/bin/unix directory, to
                include path of database driver and additional jars in classpath.
                Example - If you are using DB2 as the database, add the following line:
                          CLASSPATH=$CLASSPATH:<Path of db2java.zip>
                If your database is Oracle, add the following line:
                          CLASSPATH=$CLASSPATH:$ITIM_HOME/lib/ojdbc14.jar
                If your database is MS SQL Server, add the following line:
                          CLASSPATH=$CLASSPATH:$ITIM_HOME/lib/JSQLConnect.jar
                
                For all database types add following lines:
                          CLASSPATH=$CLASSPATH:$ITIM_HOME/lib/aspectjrt.jar
                          CLASSPATH=$CLASSPATH:$ITIM_HOME/lib/jlog.jar
                
             3. For Microsoft Windows operating system:
                Edit ldapClean.cmd in %ITIM_HOME%\bin\win directory, to
                include path of database driver and additional jars in classpath. 
                Example - If you are using DB2 as the database, add the following line:
                          set CLASSPATH=%CLASSPATH%;<Path of db2java.zip>
                If your database is Oracle, add the following line:
                          set CLASSPATH=%CLASSPATH%;%ITIM_HOME%\lib\ojdbc14.jar
                If your database is MS SQL Server, add the following line:
                          set CLASSPATH=%CLASSPATH%;%ITIM_HOME%\lib\JSQLConnect.jar

                For all database types add following lines:
                          set CLASSPATH=%CLASSPATH%;%ITIM_HOME%\lib\aspectjrt.jar
                          set CLASSPATH=%CLASSPATH%;%ITIM_HOME%\lib\jlog.jar
                             
             4. In a UNIX environment, source the DB2 environment before executing 
                ldapClean.sh.
                E.G. . /home/db2inst1/sqllib/db2profile 
   
    APAR:    IY78754    17030
    Symptom: ITIM makes too many searches with a search clause of (!(erisdeleted=y)).
   
    APAR:    IY78755    17025
    Symptom: ITIM loops while trying to search orphan accounts.
   
    APAR:    IY78846    16166
    Symptom: After submitting provisioning policy change (priority 1 was changed to priority 2).
             the Replace section of Data tab under "View Completed Requests" was showing a 
             value of 1 for priority. 
   
    APAR:    IY78847    16994
    Symptom: ACI filter expression only considers the first value of multi-valued attributes.
   
    APAR:    IY78848    17031
    Symptom: Custom report execution fails after upgrade from ITIM 4.5.1 to 4.6.
               
    APAR:    IY78849    17029
    Symptom: Get ClassNotFound exceptions when attempting to run Provisioning Policy Applications
             from ITIM 4.5.1.  Corrected API packaging in itim_api.jar in TIM 4.6.
   
    APAR:    IY78851    17037
    Symptom: Root Password of HP-UX 11i box is visible in trace.log.  ITDI adapter issue.
   
    APAR:    IY78852    17038
    Symptom: Suspending an LDAP account fails.  ITDI adapter issue
   
    APAR:    IY77960    17023
    Symptom: Fail to send notification E-mail by Work Order when multiple E-mail addresses are 
             registered in Person object.
   
    APAR:    IY77718    17006
    Symptom: The completion notification fails with a NullPointerException whenever a Manual 
             operation, such as WorkOrder or Approval, is added to the changePassword 
             lifecycle operation.
   
    APAR:    IY79193    16943
    Symptom: The file, itim_server.jar, should not be required for the remote API 
             PersonMO.getData(..) to work.

    APAR:    IY79588    17089
    Symptom: Documentation on defining identity policies does not note that identity policies 
             are based on service definitions and not organizational containers.  For the 
             identity policies to be evaluated, they must be placed in the organization tree 
             at the same level or above the service they intend to govern.  The Infocenter
             will be updated to reflect this in a FUTURE Release of ITIM.
   
    APAR:    IY79589    17040
    Symptom: Documentation added in $ITIM_HOME/extensions for additional information that may be 
             used when working with the condition described by APAR IY78741, working with BINARY 
             attributes for user password values.
   
    APAR:    IY79591    17072
    Symptom: Provide Purge utility to purge audit and process database tables.
             We are shipping a utility that will delete old data from process and audit 
             related tables. This utility can be found in the directory -
             <ITIM_HOME>/bin/<platform>/DBPurge 
             The utility takes an integer argument and will purge all data related 
             to completed processes which are older than the specified number of days. 
             It will also delete all the data from other audit related tables that are 
             related to the deleted process. 

             For example, executing the following command will delete all completed 
             processes older then 2 days, for ITIM installed on Windows platform -
             <ITIM_HOME>\bin\win>DBPurge.bat 2
   
    APAR:    IY79592    17076
    Symptom: ClassNotFoundException thrown while trying to remove a service profile from database.
   
    APAR:    IY79692    16163
    Symptom: The user should not be allowed to import 2 identity policies with the same 
             specifications.  Prior to this fix, importing was successful and this was incorrect. 
             There should not be 2 identity policies with the same user class/services. If the 
             user manually creates 2 identity policies with the same specification, an error 
             message is given.  Import/export also needs to follow these rules.
   
    APAR:    IY79693    16843
    Symptom: Mapping and Unmapping of Account Profiles attributes not working properly for Ad-hoc 
             reporting.
   
    APAR:    IY79694    16854
    Symptom: Incremental schema synchronization not working properly for implicitly-mapped 
             attributes.
   
    APAR:    IY79695    16869
    Symptom: Problems with shell scripts for crystal reports.
   
    APAR:    IY79696    16871
    Symptom: Dormant Report not showing data in Oracle.
   
    APAR:    IY79697    16895
    Symptom: Crystal Configuration Script failing to map attributes for out-of-box reports, if they 
             are not present.
   
    APAR:    IY79699    16903
    Symptom: Unmapping "cn" attribute of Person entry causes data sync trouble.
   
    APAR:    IY79700    16948  
    Symptom: Certain Crystal Reports not showing PersonDN as the default user input (in Non-Admin).
   
    APAR:    IY79701    16949
    Symptom: Crystal version of suspended individual report not showing correct data.
   
    APAR:    IY79702    16981
    Symptom: Custom report using DN attribute of an entity, does not show correct data 
             after upgrading ITIM from 4.5.1 to 4.6.
             Documentation update:
             The only supported route of upgrade is 4.5.1 + FP50 + IF53 to 4.6. So , 

                1) If you have designed reports before applying IF 53, 
                   re-design them after applying IF 53. And then upgrade to 4.6.
                   Locate the custom reports which have used the "DN" attribute
                   in the filter section of the report.
                   For each such report do the following:
                        a. remove the filter from the custom report and save the
                           report.
                        b. Now open the same report and add the filter again and
                           save the report.
                2) Whatever new templates are designed after applying IF53 can 
                   be straightway upgraded to 4.6 .
                3) Any new templates designed at 4.6 will always work. 
                4) Report templates using policy tables can not be upgraded from 
                   4.5.1 setup to 4.6. Since there is substantial DB schema 
                   change for these reports. These updates will be updated in the 
                   ITIM 4.6 InfoCenter.
   
    APAR:    IY79703    17070
    Symptom: Exception when generating a report in BiDirectional Language function.
   
    APAR:    IY79704    17077
    Symptom: This is a performance enhancement.
             Request never completes when adding a service to an existing provisioning policy due 
             to CNTR0051E: WAS transaction timeout error.  This problem occurs when more than 200
             services already exist.
             
             In addition to installing this Interim fix, you must also change the 
             policy.message.size=25 in enrolepolicies.properties to policy.message.size=1.  
             It is also recommended to set the DB2_APP_CTL_HEAP_SZ to 2048 and to set the JVM 
             Maximum Heap Size to 1536, provided you have sufficient real memory to accommodate 
             these settings.
   
    APAR:    IY79707    17085
    Symptom: Unable to generate compliance alert, gets NullPointerException.
   
    APAR:    IY79772    17088
    Symptom: ITDI DSMLv2 Event Handler throws an exception if ITIM passes or is passed an 
             attribute name with an underscore via ITDI.
   
  Fixes in enroleagent.jar and ERMA libs.
   
    APAR:    IY79711    17014
    Symptom: When the password saved on the service form is not correct a reconciliation of the 
             service does not fail. The recon either remains in pending state or completes with 
             success.  The recon should complete with a status of failed.
   
    APAR:    IY79712    17015
    Symptom: Passwords appear in the cleartext in itim logs.
   
    APAR:    IY79713    17016
    Symptom: When user is suspended and restored the first time, the restore operation is successful. 
             If the user account is suspended again and a second restore is attempted, the operation 
             fails. 
   
    APAR:    IY79715    17017
    Symptom: FTP based agents periodically encounter process hangs or core dumps.
   
    APAR:    IY75246    16712
    Symptom: Under some conditions, LDAP upgrade fails during ITIM 4.5.1 TO ITIM 4.6 UPGRADE.
   
    APAR:    IY75251    16713
    Symptom: Under some conditions, DataBase upgrade fails during ITIM 4.5.1 TO ITIM 4.6 UPGRADE.   
   
    APAR:    IY76425    16913
    Symptom: Adding an ACI in the section, MyOrganization>ACI of the type SAP Account and 
             inserting the following filter (suggested from ITIM 4.6 documentation) : 

                (${service.erservicename}=SAP Service Test Name) 

             and specifying an itim group that should be impacted from this aci, the filter 
             does not work.
   
    APAR:    IY76868    16950
    Symptom: JavaDoc for SearchResults.size() method needs additional explanation.
    
             The following JavaDoc published for SearchResults.size() states:
               * Returns: 
               *      Total number of results returned.  If this cannot be determined
               *      then the result will be -1.
               * 
                         
             The above description is technically correct, although most common searches
             will return only 0 or -1 due to the underlying EnumeratedSearchResults 
             implementation used for SearchResults.   
             A "-1" return value means the result can not be determined.  The workaround 
             is to call toCollection() to determine the actual size.  However, this is a 
             significant performance consideration.
               This is true of the classes:
                 -- AccountSearch
                 -- PersonSearch 
                 -- ServiceSearch
                 -- DirectoryObjectSearch
                 -- RoleSearch
                 -- PrivilegeRuleSearch
                 -- SystemRoleSearch

             
             The following Search classes return the correct number of results since they use  
             the LDAPSearchResults implementation of SearchResults:
                -- AdminDomainSearch
                -- BusinessPartnerOrgSearch
                -- BusinessUnitSearch
                -- DynamicRoleSearch
                -- OrganizationalContainerSearch
                -- HostSelectionPolicySearch
                -- IdentityPolicySearch
                -- PasswordPolicySearch
                -- ProvisioningPolicySearch
                -- SystemUserSearch 
                -- CustomProcessSearch 
                -- AccountTable
                -- OrganizationSearch
                -- ServiceModel
                -- AdoptionPolicySearch
                -- JoinDirectiveSearch

    APAR:    IY77883    16819
    Symptom: SingleSignOn example uses wrong web.xml file.   
             While installing the SiteMinder singlesignon example from 
             \itim46\extensions\examples\singlesignon 
             you get a 404 error when you try to access the servlet.
   
    APAR:    IY77884    16904
    Symptom: No warning email sent to a user when using reverse password sync agent and 
             password sync fails on one resource. 
             The workflow examples have been changed to provide direction on how to use 
             password sync and return meaningful information to a user when a failure occurs.
 
    APAR:    IY77887    16956
    Symptom: When a Remote ITIM Application is secured by a WebSphere role, an exception 
             is encountered "javax.naming.NoPermissionException: NO_PERMISSION" 
             when attempting to make ITIM API calls. 
   
    APAR:    IY77888    16977
    Symptom: When creating a person, the date field is not displayed as expected.  After 
             entering required fields in the form and submitting, the following error is 
             displayed: "You are not authorized to perform this operation".  After clicking 
             'OK' to the error, the user is taken back to managed people and the person is 
             not created. Note that this fix is for Default-Date.
   
    APAR:    IY77889    16991
    Symptom: When a Remote ITIM Application is secured by a WebSphere role, an exception is 
             encountered 
                "javax.naming.NoPermissionException: 
                NO_PERMISSION" when attempting to make ITIM API calls. 
   
    APAR:    IY77899    16992
    Symptom: If one or more ACIs for same target are defined at an Organization or BU level, 
             with some target filter, only one of the ACIs will evaluate and the other ACIs 
             will be completely ignored.
   
    APAR:    IY77901    16993
    Symptom: Documentation for the self_care sample application needs to be added to the 
             examples documentation directory.
   
    APAR:    IY78065    16928
    Symptom: Remote ITIM Applications can not supply a proper LTPA authentication token when 
             WebSphere authentication realms are dissimilar between the remote application 
             server and the ITIM server. 
   
    APAR:    IY78395    16957
    Symptom: Remote ITIM Applications do not recover whenever ITIM is restarted and the web 
             applications must be manually restarted. 
    
    APAR:    IY74391    16688
    Symptom: Cannot use custom profiles after installing.
             Note - After applying this patch follow the steps as given below -
             1. Make sure to copy itim_api.jar, itim_server.jar and api_ejb.jar from:$WAS_HOME/
                installedApps/$MACHINE_NAME/enrole.ear directory, to $ITIM_HOME/lib  directory.
   
    APAR:    IY75058    16781
    Symptom: During an IDI data feed (with ITIM acting as DSMLv2 server) some "modify person" 
             requests hang (and show up in the "pending requests" list).
   
    APAR:    IY76000    16866
    Symptom: The presence of both MANDATORY and EXCLUDED enforcement on the same multivalued 
             attribute (coming from different provisioning policies) reduce the set of allowed 
             values to the MANDATORY ones only.
   
    APAR:    IY76116    16887
    Symptom: If you configure SSL between ITIM and IDS (LDAP), service profiles cannot be imported.
             Note: Please refer Readme.txt in $ITIM_HOME/extensions/APAR_Doc/IY76116.zip for more 
             information.
   
    APAR:    IY77445    16838
    Symptom: Cannot run Crystal reports using Non-admin user. 
   
    APAR:    IY77446    16855
    Symptom: When using the IDI DSMLv2 handler to load data into ITIM and placing a person record 
             into a specific OU with over 5,000 sub-OUs, ITIM eventually crashes with "OutOfMemory"
             and "Unable to create thread" errors.
   
    APAR:    IY77447    16902
    Symptom: The "Disallow User Name (case insensitive)" will parse the CN attribute and 
             derive single character from attribute value that it will check in the password. 
   
    APAR:    IY77479    16802
    Symptom: The compliance alert detail screen displays the raw data instead of the resolved 
             display label.
   
    APAR:    IY77480    16794
    Symptom: If the "enforcement" on the original service (referred by the hosted service) is 
             changed to "correct", the accounts on hosted service gets deleted.

   
    APAR:    IY77481    16979
    Symptom: Under some conditions the ITIM server does not update MANDATORY attributes with the 
             new values, instead, it uses the old values.
             Note - Spaces and hyphens are ignored during comparison of attribute values with the
             Telephone Number syntax i.e. with OID as 1.3.6.1.4.1.1466.115.121.1.50.
   
    APAR:    IY77483    16967
    Symptom: The saproleservlet is not able to handle SAP role names containing characters 
             outside the US-ASCII character set (but included in the ISO 8859-1 one, such 
             as accented vowels).
   
    APAR:    IY77484    16968
    Symptom: OBJECT_NOT_FOUND exception during Person transfer with Select Business Unit 
             set to Root Organization.
   
    APAR:    IY77485    16978
    Symptom: ITIM Server logs show password in clear text for Password Synch.
   
    APAR:    IY77486    16980
    Symptom: The examples.api.ChangePassword returns a NullPointerException when attempting to 
             change the password of an orphaned account.
             Note - After applying this patch follow the steps as given below -
             1. Make sure to copy itim_api.jar, itim_server.jar and api_ejb.jar from:$WAS_HOME/
                installedApps/$CELL_NAME/enrole.ear directory, to $ITIM_HOME/lib  directory.
             
             
    APAR:    IY77487    16952
    Symptom: When trying to reset a user password on a config that has a "Password Rule" with 
             Required Characters value set to '(' or ')' or both and Disallow In Dictionary? set to true. An 
             invalid password exception is thrown.
   
    APAR:    IY77488    16808
    Symptom: New option provided in serviceability.sh tool to suppress information from LDAP.
                 Running "serviceability.sh no" will prevent the tool from retrieving any 
                 information from the directory server. The option applies to both the 
                 serviceability.sh and serviceability.cmd scripts.
    
    APAR:    IY77491    16924
    Symptom: Correct problems with the Adapter interface.
   
    APAR:    IY77169    16983
    Symptom: New Function: Bi-Directional Language Enablement. 
   
    APAR:    IY74180    16658
    Symptom: LDAP error code 32 during AD adapter 4.6 reconciliation. 
   
    APAR:    IY74325    16682
    Symptom: Need to be able to delete/remove service profiles that were imported and are no 
             longer needed.
             Note - After applying this patch follow the steps as given below -
             1. Copy itim_api.jar, itim_server.jar and api_ejb.jar from:
                $WAS_HOME/installedApps/$MACHINE_NAME/enrole.ear directory, to
                $ITIM_HOME/lib  directory.

             2. For operating system other than windows -
                Edit remove_service_profiles.sh in $ITIM_HOME/bin/unix directory, to
                include path of database driver in classpath.
                Example - If you are using DB2 as the database, add the following line -
                          CLASSPATH=$CLASSPATH:<Path of db2java.zip>

             3. For windows operating system -
                Edit remove_service_profiles.cmd in %ITIM_HOME%/bin/win directory, to
                include path of database driver in classpath. 
                Example - If you are using DB2 as the database, add the following line -
                          set CLASSPATH=%CLASSPATH%;<Path of db2java.zip>

             4. In a UNIX environment, source the DB2 environment before executing 
                remove_service_profiles.sh.
                E.G. . /home/db2inst1/sqllib/db2profile 
   
    APAR:    IY74455    16699
    Symptom: Valid ldap filters throw "invalid filter" errors in ITIM UI.
   
    APAR:    IY75100    16773
    Symptom: WAS Security enablement instructions in ITIM Installation Guide page 41 should 
             contain a reference to:
             'Creating J2C authentication data entries' action requirements.
             The ITIM Installation Guide will be updated to add an entry after the line:
             3. Configure the local OS user registry with these steps.
             The following will be added:
             4. Update J2C Authentication Data for alias itim_jms with a valid User Id and 
             password (see Appendix D - Creating J2C authentication data entries).
   
    APAR:    IY75576    16832
    Symptom: Incorrect workaround in ITIM 4.6 Release notes for LDAP version 3 filter example.
             The ITIM 4.6 Release notes page 36 shows the workaround using the same incorrect
             V3 search Filter.  The ITIM 4.6 Release notes page 36 will be corrected to show:
             
                ====================================================================      
                Problem: Using LDAP Version 3 filters causes inconsistent results 
                from an adapter, or may not be accepted by the adapter as input. 
                Using more than two operands for '&' and '|' operators in a 
                reconciliation filter might cause an error, unless they are modified 
                to have no more than two operands. For example, the following filter 
                causes a FilterException error:                                           
                                                                          
                (&(eruid=a*)(ersql2000defdatabase=i*)(ersql2000deflanguage-E*))           
                                                                          
                Workaround: Use filters such that '&' and '|' operators have no 
                more than two operands.     
                For example, the above filter can be modified as follows to get 
                the same results:
                (&(&(eruid=a*)(ersql2000defdatabase=i*))(ersql2000deflanguage-E*))  
                ====================================================================
   
    APAR:    IY75653    16548
    Symptom: Transaction timeouts during Report generation.
   
    APAR:    IY75654    16687
    Symptom: Get "java.lang.OutOfMemoryError" failure during large multi account password change. 
   
    APAR:    IY75655    16701
    Symptom: Account creation email notification should also be sent on success with warnings, 
             not just 100% success.

             Note - To resolve this issue, a new ITIM extension 'notifyNewAccount' has been 
             introduced. This extension takes owner, service and account entities as input 
             parameters and notifies the owner, with information related to the new account.
             This extension may be used when account creation is to be notified to the owner 
             even when the operation completes with warnings.

             Note that if property "enrole.workflow.notifynewaccount" is set to 'false' in
             enRole.properties, this extension will not send notification email to the owner.

             You will have to register this extension with ITIM as follows -
             1. Open workflowextensions.xml located in $ITIM_HOME\data directory using a 
                suitable text editor.
             2. Add the following entry in the file, before the closing </WORKFLOWEXTENSIONS>
                tag in the file:
                 <ACTIVITY ACTIVITYID="notifyNewAccount" LIMIT="600000">
                 <IMPLEMENTATION_TYPE>
                   <APPLICATION CLASS_NAME="com.ibm.itim.workflowextensions.AccountExtensions" METHOD_NAME="notifyNewAccount"/>
                 </IMPLEMENTATION_TYPE>
                 <PARAMETERS>
                  <IN_PARAMETERS PARAM_ID="owner" TYPE="Person"/>
                  <IN_PARAMETERS PARAM_ID="service" TYPE="Service"/>
                  <IN_PARAMETERS PARAM_ID="account" TYPE="Account"/>
                 </PARAMETERS>
                 <TRANSITION_RESTRICTION JOIN="XOR"/>
                 <SCRIPT EVENT="onComplete"><![CDATA[
                  WorkflowRuntimeContext.setProcessResult(WorkflowRuntimeContext.getActivityResult());
                  WorkflowRuntimeContext.setProcessResultDetail(WorkflowRuntimeContext.getActivityResultDetail());
                  ]]></SCRIPT>
                 </ACTIVITY>
             3. Save the file.

             ITIM will have to be restarted for the changes in this file, to get reflected.
             Please refer IY75655.pdf for more details.
   
    APAR:    IY75656    16702
    Symptom: Attribute selection in a search popup has a fixed width for the attribute labels.
             These need to have a variable width.
             Note - The fix has been provided for the default english language pack.

             Before applying this patch,take a backup of folder named <language code>
             located in directory : $WAS_HOME/installedApps/$MACHINE_NAME/enrole.ear/app_web.war.
             The <language code> is generally two letter word representing the language. 
             For example for English, the language code is 'en'.

             After applying the patch, restore the folder back to the same directory and
             perform the following steps - 
             1. Locate Styles.css in directory :
                $WAS_HOME/installedApps/$MACHINE_NAME/enrole.ear/app_web.war/<language code>
             2. Open Styles.css using a suitable text editor.
             3. Locate string "narrowPicklist" in this file.
             4. Change width attribute of this class to "auto" as follows -
                .narrowPicklist {
                   width: auto;
                }
             5. Save the file.
   
    APAR:    IY75658    16799
    Symptom: README DOC update.
             Account modification throws Authorization Exception even when 'write' permission is 
             granted to the ITIM user for the attributes that were actually modified.

             Solution:
             1. Navigate to User Interface Customization, through ITIM.
             2. Open the corresponding Account form template.
             3. For all attributes in the Account form defined of the type 'DropDown Box' or 
                'ListBox' control with custom values, check the option 'Use Blank Row', to 
                allow these attributes to have an empty value.
             4. Next, for all attributes in the Account form defined as a 'CheckBox' control, 
                change the form control to a 'DropDown Box' control with two custom values set 
                to "TRUE" and "FALSE" (Values should be in upper case) and also check the 
                option 'Use Blank Row', to allow these attributes to have an empty value.
             5. Save the form template and exit the form designer.

             Note - This workaround is applicable in case the Account form has some attributes 
             which are defined to have a default value in the form template, (For example dropdown 
             box controls with custom values, with 'Use Blank Row' unchecked) but are not present 
             in LDAP because the remote agent was unable to set a value of this attribute, during 
             account provisioning or modification, due to some reason. 
   
    APAR:    IY75659    16721
    Symptom: ITDI location field should be displayed as mandatory ( * ) 
   
    APAR:    IY75660    16751
    Symptom: Bulk loading ( ~ 60000) of POSIX Solaris Accounts gives error in ibmdi.log of 
             "ALNotFoundExceptioncom"
   
    APAR:    IY75661    16810
    Symptom: Get error 500 on UI when doing a manual provision a person on a Win Local Account with 
             User and Guests for local attr -- forcing a compliant alert screen on Guests value.
   
    APAR:    IY75731    16835
    Symptom: The examples file:
             $ITIM_HOME\extensions\examples\idi_integration\LDAPAccountManagement\AccountManagement.html
             is not accurate for UNIX systems.  
             Need to ensure people executing config_remote_servcies to first source the 
             DB2 environment in a UNIX environment.
             E.G. . /home/db2inst1/sqllib/db2profile 
   
    APAR:    IY75965    16820
    Symptom: Clicking the Submit button on "View|Modify Entitlement Detail" a second time during 
             processing results in "out of memory" error. 
   
    APAR:    IY73980    16641
    Symptom: Entering a double quote in Java script  for Entitlement causes standard view to 
             fail with 'JS Error'.
   
    APAR:    IY74422    16049
    Symptom: Identity Policy disregards owner when 'CHECK ALL SERVICES' and 'DON'T CHECK RECYCLE 
             BIN Selected.  This is a README Documentation update. 
    Note:    Please refer to the updated sample present in $ITIM_HOME/extensions/APAR_Doc/IY91561.zip.
   
    APAR:    IY74428    16567
    Symptom: You may encounter slow performance or transaction timeouts during 
             report generation for certain reports against large data sets.
   
    APAR:    IY74443    16600
    Symptom: BeanNotReentrantException thrown when running on WAS 5.1.1.4 or 5.1.1.5.
   
    APAR:    IY74444    16549
    Symptom: After Search, viewing the adoption rule for a particular service produces 
             Illegal Argument Exception".
   
    APAR:    IY74502    16587
    Symptom: Improved email notification performance.
   
    APAR:    IY74503    16586
    Symptom: Out of Memory while doing a Report Synchronize.
   
    APAR:    IY74504    16653
    Symptom: AccountMO.selfClaim() was incorrectly left in the API javadoc.  It is now 
             removed.
   
    APAR:    IY74512    16044
    Symptom: Error message is not displayed in expected language.
   
    APAR:    IY74515    16224
    Symptom: Windows2000 Group Names not shown correctly in the account form when Filter 
             is removed.
   
    APAR:    IY74517    16496
    Symptom: One attribute fails to get included in the attributes list for RACFacct in the 
             ITIM Search interface: "Installation Data" (erracuinstdata).
             To address this issue, binary attributes are also included in the attributes list
             in the ITIM Search interface. The binary attributes are suffixed by an asterisk 
             mark '*', while displaying them in the attribute list. Only 'Contains' and 
             'Not contains' options are supported for searching with binary attributes.
             The 'Not contains' option for binary attributes is known to degrade search 
             performance and hence is not recommended.
   
    APAR:    IY74519    16497
    Symptom: DN is displayed in ListBox instead of 'cn'.
   
    APAR:    IY74525    16501
    Symptom: Users would like to have a way to disable the check box "create password".
    
             Edit the enRole.properties file to set the value you wish.    
             ############################################################# 
             ## Enable/Disable CreatePassword checkbox                     
             ## CreatePassword=true Checkbox will remain enabled           
             ## CreatePassword=false Checkbox will be disabled             
             #############################################################  
             enrole.CreatePassword=true                                     
             The value of true is the default and will allow the use of the 
             checkbox.
   
    APAR:    IY74526    16570
    Symptom: Wrong Attribute Mapping of entities when doing the following:
             1. Go to Configuration->entity->person(Org,BP Org,BP Person)->define mapping                                               
             2. select an attribute from Identity Manager attribute. Do not select any attribute 
             in Custom Ldap Attributes.                
             3. Click on the Map and then Unmap buttons.

   
    APAR:    IY74527    16579
    Symptom: ITIM uses an invalid search filter against a binary attribute, resulting 
             in an LDAP Error 92.
   
    APAR:    IY74528    16584
    Symptom: Read only fields not working properly on a customized person entry form.
   
    APAR:    IY74530    16405
    Symptom: Warning messages are not logged if the value of property policy.message.size, in 
             enrolepolicies.properties is 0 or negative.
   
    APAR:    IY74531    16610
    Symptom: Exception thrown in log when setting value to empty, for an attribute that does 
             not have entry in xforms and resource.def has the flag TRANSFORM_NAMES_AND_VALUES.
   
    APAR:    IY74532    16609
    Symptom: Performance issue with "User interface customization" and a high number of 
             service profiles.
   
    APAR:    IY74533    16631
    Symptom: 'RoleChangeNotAllowed' exception is not thrown if the logged-in ITIM user does not 
             have 'MODIFY' permission on ORG role entry and he tries to remove all roles from 
             a person.
   
    APAR:    IY74534    16643
    Symptom: Hide on Modify attribute becomes visible on 'View Data Screen' navigated from 
             Approve-Reject tab while switching tabs.
   
    APAR:    IY74535    16651
    Symptom: Missing CN attribute results in NullPointerException
   
    APAR:    IY74536    16620
    Symptom: Data feed of people with status set is always get overridden by ITIM 
             with ACTIVE status.
   
    APAR:    IY74537    16634
    Symptom: ITIM does not allow for automatic entitlement of "service type" target.
   
    APAR:    IY74538    16680
    Symptom: Viewing 3000+ orphan accounts on the services fails with CORBA_NO_MEMORY error.
   
    APAR:    IY74539    16665
    Symptom: An attribute label that contains "&" breaks display of ACI attribute permissions 
             page.
   
    APAR:    IY74540    16684
    Symptom: Duplicate accounts in RACF Recon. 
   
    APAR:    IY74542    16679
    Symptom: Data with "&" in single-valued Search Widget in Read-only mode causes xsl error.

Dependencies: ITIM 4.6 (This Fixpack cannot be applied to earlier releases)

Fixes superseded by this Fixpack: 4.6.0-TIV-TIM-FP0001, 4.6.0-TIV-TIM-FP0005, 
4.6.0-TIV-TIM-FP0008, 4.6.0-TIV-TIM-FP0014, 4.6.0-TIV-TIM-FP0021, 4.6.0-TIV-TIM-FP0025, 
4.6.0-TIV-TIM-FP0033, 4.6.0-TIV-TIM-FP0040, 4.6.0-TIV-TIM-FP0048, 4.6.0-TIV-TIM-FP0055, 
4.6.0-TIV-TIM-FP0061, 4.6.0-TIV-TIM-FP0068, 4.6.0-TIV-TIM-IF0069, 4.6.0-TIV-TIM-IF0070, 
4.6.0-TIV-TIM-IF0071, 4.6.0-TIV-TIM-IF0072, and 4.6.0-TIV-TIM-IF0073.

Please NOTE: 4.6.0-TIV-TIM-IF0028 has been superseded for all APARs EXCEPT IY91819.  
If you need ITDI 6.1 support, you still need to download 4.6.0-TIV-TIM-IF0028.  This 
Interim Fix is not needed if you use ITDI 6.1.1

Database Changes: IY84678, IY88875, IY89842, IY91041, and IY92208. No additional actions need 
                  to be done to update the DB. The DBUpgrade utility will automatically upgrade 
                  the DB configuration.

JMS (Java Messaging Service) Changes: NONE

LDAP Changes: IY91548 and IY90228. No additional actions need to be done to update the LDAP .
              The LDAPUpgrade utility will automatically upgrade the LDAP configuration.
              
OSDB Certification updates, ITIM Server now supports the following Operating systems and middleware:

New as of Dec 21, 2007:
ITDS 6.1

DB2 9.1, with Fixpack 2  Please see the following notes:
        1. Make sure the DB2 environment (db2profile) is set to use the lib and NOT lib64 for the $LIBPATH
        variable.  ITIM 4.6 and WebSphere 5.1 support only 32 bit libraries.  The libraries setup by DB2 during 
        install on a 64 bit Operating System default to 64 bit libraries, eg. lib64
        2. Make sure the ITIM_JDBC_DRIVER_PATH environment variable in the WebSphere Environment setting is set 
        to point to:
        /home/db2inst1/sqllib/java
        and NOT:
        /home/db2inst1/sqllib/java12
        If installing new, the ITIM_JDBC_DRIVER_PATH environment variable will be set correctly.  If you migrate
        from DB2 8.x to DB2 9.1 in an existing ITIM installation, you will need to correct this. 
        The above directories are unix examples, your DB2 home directory may be different.
        To do this, log into the WebSphere Admin console and select Environment -> Manage WebSphere Variables and
        view/or change the ITIM_DB_JDBC_DRIVER_PATH as needed.
        3. During ITIM Install or ITIM Fixpack Install (Upgrade), you may get a message that indicates DB2TEMPDIR
        cannot be found.  Ignore this message POP-UP and continue.  On the next panel ensure that the DB2 HOME
        directory is correct and if not, correct it at that time.
        4. If you have DB2 8.x installed and need to migrate to DB2 9.1, please reference the DB2 Documentation for
        migration of Databases and Instances for ITIM and ITDS as needed.  The above 3 steps need to be reviewed and
        corrected after the DB2 migration and REBINDs as noted in the DB2 Documentation prior to running ITIM.
        
        ADDITIONALLY
        If the DB2 9.1 co-exists with the DB2 8.x, the following rules should be followed prior to running the ITIM 
        4.6 installer when using DB2 9.1.

        On the Unix/Linux Operating System - 
        1. The db2profile of the correct DB2 instance should be sourced in the shell before starting the ITIM installer.  
        This will ensure the correct version of DB2 will be used.
        2. The above rule applies to either using the local DB2 9.1 server or using the DB2 9.1 runtime client.

        On the Windows Operating System - 
        1. The user should run the command "db2cmd" from the DB2_91_Home\bin directory, such as 
        "C:\Programs Files\IBM\sqllib91\bin".  If the DB2 9.1 client co-exists with the instance of DB2 8.x,
        the user should run the command "db2cmd" from the DB2 9.1 client bin directory.
        2. Run the set environment variable command "set DB2TEMPDIR=DB2_91_HOME" from the db2cmd console.
        Here DB2_91_HOME is the DB2 9.1 installation directory.  Note that there should be no space on the 
        DB2 installation path.  For example, "C:\Programs Files\IBM\sqllib91\bin" should be set as 
        C:\Progra~1\IBM\sqllib91.
        3. Run the ITIM 4.6 installer from the db2cmd console.
        4. If the user wants to run DBConfig as a stand-alone utility, it should also run from the DB2 9.1 
        db2cmd command console.

*** NOTE that the above steps are required only when the DB2 9.1 and the DB2 8.x coexist. 

New as of May 18, 2006:

MS SQL Server 2005 

New as of March 30, 2007:

Microsoft Internet Explorer 7 

Firefox 2.0

Oracle 10g  Release 2

New as of July 31, 2006:

SUSE Linux Enterprise Server 9.0 for zLinux 64 bit kernel (support as 31 bit implementation).
Red Hat Enterprise Linux AS release 4 for zLinux 64 bit kernel (support as 31 bit implementation).

Previously tested environments:

HP-UX 11i

Solaris 10

Oracle 10g

Red Hat Enterprise Linux AS release 4 for Intel

Red Hat Enterprise Linux AS release 4 Update 1 for POWER

SUSE Linux Enterprise Server 9.0 for POWER

SUSE Linux Enterprise Server 8.0 for Intel  
SUSE Linux Enterprise Server 9.0 for Intel
NOTE *** You may need to contact the WebSphere Support Center for installation assistance to 
       install WebSphere AppServer on the SUSE platforms.

Patch Contents:
  - This README file
  - 4.6.0-TIV-TIM-AIX-WAS-FP0074.zip
  - 4.6.0-TIV-TIM-HPUX-WAS-FP0074.zip
  - 4.6.0-TIV-TIM-LNX-WAS-FP0074.zip
  - 4.6.0-TIV-TIM-PPC-WAS-FP0074.zip
  - 4.6.0-TIV-TIM-SOL-WAS-FP0074.zip
  - 4.6.0-TIV-TIM-WIN-WAS-FP0074.zip
  - 4.6.0-TIV-TIM-ZLNX-WAS-FP0074.zip

MD5 Checksums:
   
f1d2534e91701aab71800df5555f48de  4.6.0-TIV-TIM-AIX-WAS-FP0074.zip
3c6e9e07fbe6014233062807ee225212  4.6.0-TIV-TIM-HPUX-WAS-FP0074.zip
0ee4d9c54676edf9eb53c9b0f5c783db  4.6.0-TIV-TIM-LNX-WAS-FP0074.zip
66e43550eb1a56ca81bb60692188b71a  4.6.0-TIV-TIM-PPC-WAS-FP0074.zip
9d413d6e8e529de6ccc3910ad63c3f56  4.6.0-TIV-TIM-SOL-WAS-FP0074.zip
b17158abe9c42472b125223cd01c228d  4.6.0-TIV-TIM-WIN-WAS-FP0074.zip
6bd64edf7846f089e957b7fd1257c047  4.6.0-TIV-TIM-ZLNX-WAS-FP0074.zip

086ae92217ebd31c6e29d1607bbef1d9  instaix_was_ITIM_5826.bin
0cfe58ebadccc0e21deeda7adc794c1e  insthpux_was_ITIM_5826.bin
642440d401d108aaba7007daef872ec3  instlinux_was_ITIM_5826.bin
e6cd2d6180db23506a215ea23997db36  instppc_was_ITIM_5826.bin
c30743296428b1e896d034274a1a32b3  instsolaris_was_ITIM_5826.bin
b848e88a00bb46d78fad1926eefc59f0  instwin_was_ITIM_5826.exe
31e96fa65fc684883a27be3acb1d0070  instzLinux_was_ITIM_5826.bin


 
Applying the Patch:  

NOTE: *************************************************************************       
    Please backup any configuration files you modified after installation such as xml or 
    properties files.  It is recommended that you save all files in the $ITIM_HOME/data 
    directory if you have made modifications/customizations.  These files may be replaced 
    during the UPGRADE process.
NOTE: *************************************************************************       
    IF YOU ARE USING JAVA 2 SECURITY:
    Backup up your was.policy file to a temporary holding directory.  During 
    the fix application you will be re-deploying enrole.ear, which removes the
    $WAS_HOME/AppServer/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
    directory and its contents. During the deployment, the was.policy is not 
    replaced and will need to be copied back during the COMMON TASKS section 
    of this document.  On a Cluster this needs to be done on the NDM as well.
    $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
NOTE: *************************************************************************       
    IF YOU HAVE MIGRATED FROM ITIM 4.5.1 to ITIM 4.6        
    If your TIM V4.6 system is migrated from V4.5.1, it is necessary to copy
    the jsafe.jar and log4j.jar files from the:
    $ITIM_HOME/lib 
    directory into:
    $WAS_HOME/installedApps/$CELL_NAME/enRole.ear directory  
    You must always copy these 2 files back after installing an ITIM Interim Fix
    or Fixpack.
    The jsafe.jar file is no longer used in ITIM 4.6.0, since the encryption
    is changed in 4.6.0, but the jsafe.jar file is needed to be able to
    encrypt/un-encrypt the existing 4.5.1 data in LDAP.
NOTE: *************************************************************************       
    IF YOU HAVE INSTALLED A CUSTOM LOGO:
    The logo is copied to:
    $WAS_HOME/installedApps/<machine_name>/enRole.ear/app_web.war/images
    The Fixpack Install/Upgrade removes the enRole.ear and all subdirectories.  To make it
    easier to restore the custom logo, copy it to a backup directory of your choosing to 
    facilitate copying it back at the proper time.
    The ui.properties is preserved during a Fixpack install so this will not need to be updated
    again.  There are 2 choices to restoring the custom logo file.
    1. During the Fixpack Install/Upgrade, a utility called runConfig will execute and present 
       a small panel with several items that you may modify, including the custom logo.  This 
       panel has a TAB called UI and you can select this and see that your custom logo name
       should be present.  At this time, you may copy the custom logo from the backup 
       directory where you saved it to:
       $WAS_HOME/installedApps/<machine_name>/enRole.ear/app_web.war/images
       Then continue with the Install/Upgrade by selecting the OK button.
    2. If you wish, you may wait until the Install/Upgrade completes and then copy the
       custom logo to:
       $WAS_HOME/installedApps/<machine_name>/enRole.ear/app_web.war/images
       You may then manually execute runConfig from $ITIM_HOME/bin .  Select the UI tab to 
       verify the custom logo name and then select the OK button.
NOTE: *************************************************************************       
    IF YOU HAVE INSTALLED A LANGUAGE PACK:
    1. The FPxx number shown will not be updated to the current FPxx number
    due to current limitations in the build and install process.  Please 
    check the Build number for verification of an upgrade to the fixpack.
    The build number is the suffix number of the install binary 
    eg. instaix_was_ITIM_579n.bin
    The number 579n is the build number and will be seen in many ITIM UI panels.
    2. Symptom - Fixpacks partially overwrite Language Pack installation.
       Note - Before Fixpack installation, take a back-up of the following
       files/folder related to the language pack, located in the directory:
              $WAS_HOME\installedApps\$MACHINE_NAME\enRole.ear\app_web.war
                - AppletErrorMessages_<language code>.properties
                - AppletLabels_<language code>.properties
                - AppletMessages_<language code>.properties
                - The folder along with its contents by the name as <language code>.
                        
    The <language code> is generally a two letter word representing the language. 
    For example for English, the language code is 'en'.
        
    After Fixpack installation, restore all the language pack related files and folder, 
    those were backed up, to their respective locations in the directory: 
    $WAS_HOME\installedApps\$MACHINE_NAME\enRole.ear\app_web.war
        
    Note that for WAS Cluster installation, the same steps will have to be followed on 
    each of the nodes. This procedure is needed only on the cluster member, not on the 
    Deployment Manager node.
NOTE: *************************************************************************       
    IF YOU HAVE ENCRYPTED PASSWORDS:
    1. Prior to running the Installer for this Fixpack, please execute runconfig from
       &ITIM_HOME/bin
    2. Turn off encryption.
    3. Install this Fixpack
    4. Execute runconfig again and turn encryption back on.
NOTE: *************************************************************************       
        End of notes.
        
    1) Copy the appropriate Platform Fixpack zip file to a temporary staging directory
       and use the following command as an example to unzip it.
    
        For any version
          # jar xvf 4.6.0-TIV-TIM-nnnn-aaa-FP0074.zip  (where nnnn is the platform code and
                                                  aaa is the AppServer type (WAS or WL)

       NOTE:  You may also use any unzip equivalent to unpack the zip file.
              Back-level versions of jar or FastJar as well as some versions
              of Pkzip may report errors. Use the jar executable at version 1.3.1 
              or another zip utility to uncompress the file.
       
    2) Upgrade Installations
    For Single Server deployments, you do not need to stop the WebSphere AppServer.
    For Cluster deployments, ensure the cluster is completely up and functional.
    Run the appropriate binary from the staging location.
    For example:
         instwin_was_ITIM_5813.exe
    When prompted, select the UPGRADE option and follow the directions on the panels.
    To ensure all Cluster members are updated completely, you should perform this
    on each Cluster member. 

    
NOTE ***    
              
    3) Initial Installations
    Initial installation using this package can only be performed on WebSphere platforms. 
    If you are planning on doing new installations on WebSphere using this package, then 
    you may wish to review the Installation Guide.  This Fixpack provides Installation 
    support for IBM WebSphere.  However, ITIM will NOT install the IBM WebSphere product 
    with this Fixpack.  
    
NOTE ***  
    If you stop the INSTALL/UPGRADE process and then restart it, Default config data 
    is inserted.
    If the fix pack installation is aborted before system configuration (runConfig) is complete, 
    your system property settings are restored to default values - your pre-fix-pack-installation 
    settings are lost - when you run the fix pack installer again.  This is usually ONLY a concern
    when you are doing an UPGRADE.  To correct the system property settings, restore the 
    <ITIM_HOME>/data directory with the pre-fix-pack-installation backup (per above instructions)
    before you run the Fixpack installer again.
           
NOTE: ************************************************************************************
       The following are COMMON TASKS that you may need to perform prior to restarting the
       AppServer or Cluster. 
NOTE: ************************************************************************************
  *** NEW ***
  ITIM Server has now added a new OPTIONAL Self Service UI Application.  For additional information, please 
  see the README.txt that can be found in $ITIM_HOME/extensions/SelfServiceUI/README.txt.
  *** NEW ***

NOTE **** All Additional APAR Documentation and Documentation Updates can now be found in
        $ITIM_HOME/extensions/APAR_Doc directory.  Any late breaking changes will be found included in the 
        Fixpack zip file.  These newer doc updates supersede those with the same names in the above directory.

1.    
NOTE ***  
    If you are using the JAVA 2 Security, replace the was.policy file you saved
    earlier.  Copy it back to:
    $WAS_HOME/AppServer/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
    For Cluster in the NDM:
    $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
    Where $CELL_NAME is either the $MACHINE_NAME or $CLUSTER_NAME.
    For additional information on using JAVA 2 Security with ITIM, please review the ITIM
    Installation Guide, Appendix C.

2.
NOTE ***  After applying this Fixpack please clear the java plugin cache for the changes in 
          this Fixpack take effect. The plugin cache may need to be cleared on every system 
          from which you access ITIM applets in a browser. The steps differ for each version 
          of the java plugin installed.
          
NOTE ***  You may wish to review the logs that can be found in:
                $ITIM_HOME/install_logs 
          The files you may wish to review for any errors are:
                dbUpgrade.stdout
                itim_installer_debug.txt
                dapUpgrade.stdout
                runConfigTmp.stdout

NOTE ***  This task prevents OutOfMemory errors in the java plugin when running ITIM Applets.
          
          Execute the following steps to clear the Java Plug-in cache for the JRE Version 
          1.5.x.
          1. On a Windows system, click Start > Control Panel and double-click the Java icon 
             in the control panel. The Java Control Panel appears.
             
             If you are on a unix system, you can launch the java control panel by running the 
             <JRE installation directory>/bin/ControlPanel or 
             <JRE installation directory>/bin/JavaPluginControlPanel program. On some systems 
             you can also load the Control Panel applet with a web browser by running 
             <JRE installation directory>/ControlPanel.html.

          2. Click Settings under Temporary Internet Files. The Temporary Files Settings 
             dialog box appears.
          
          3. Click Delete Files. The Delete Temporary Files dialog box appears.
             There are three options on this window to clear the cache.
             1. Delete Files

             2. View Applications

             3. View Applets
          
          4. Click OK on Delete Temporary Files window. 
             Note: This deletes all the Downloaded Applications and Applets from the cache.
          
          5. Click OK on Temporary Files Settings window.
             Note: If you want to delete a specific application and applet from the cache, 
                   click on View Application and View Applet options respectively. 
          
          Execute the following steps to clear the Java Plug-in cache for the JRE Version 
             1.4.x.
          1. On a Windows box, click Start > Control Panel and double-click the Java icon 
             in the control panel. The Java Control Panel appears.

             If you are on a unix box, you can launch the java control panel by running the 
             <JRE installation directory>/bin/ControlPanel or 
             <JRE installation directory>/bin/JavaPluginControlPanel program. On some systems 
             you can also load the Control Panel applet with a web browser by running 
             <JRE installation directory>/ControlPanel.html.
          
          2. Click on the Cache tab
     
          3. Click on the Clear button

3. OPTIONAL: Additional steps for APAR IY92208

          Execute the following steps to correct the problem of "Life Cycle Rule Execution" being 
          displayed instead of "Suspend Multiple Accounts" in the drop down box for "Root Process"
          in Reports > Workflow Reports > Account Operations.
          
          1. Open <ITIM_HOME>/data/reportingLabels.properties in any text editor.
          
          2. Find the statement "rootprocessview.type.ls=life Cycle Rule Execution"
          
          3. Replace 'ls' with 'lc'. i.e. after the change the line will look like 
              "rootprocessview.type.lc=life Cycle Rule Execution"
          
          4. Add the following line at the end.
               "rootprocessview.type.ld=Delete Multiple Accounts"
          
          5. Save the file and quit the editor.
          
          6. If you have a language pack installed, execute the above steps for the 
             file <ITIM_HOME>/data/reportingLabels_nn.properties, where nn stands for two letter 
             code that represents your locale. you will have to translate the string 
             "Delete Multiple Accounts" in step 4 into appropriate language specific strings.
                
4. OPTIONAL: Additional steps for APARs IY92225, IY92226 and IY92227.
          
          Three new properties have been introduced in <ITIM_HOME>/data/enroleAuditing.properties 
          for configuring certain display options in the Request Manager Audit trail. Execute the 
          following steps for configuring these properties. Use the enroleAuditing.properties file 
          shipped with this fix pack as an example.
          
          1. Open <ITIM_HOME>/data/enroleAuditing.properties file in any text editor.
          
          2. Specify the column names for property "enrole.auditing.completed_requests.fields=" 
             from default list. Whichever column name specified first will appear first in 
             "View Completed Requests" panel, otherwise, a default list will be displayed. This is 
              a new functionality introduced by IY92226.
             
          3. Set the property  "enrole.auditing.retainSortSettings" to true or false. If set to 
             true, the previous sort settings will be retained on manual and auto refresh operations, 
             for 'Completed Requests', 'Pending Requests', and 'ToDo' sections of request manager.
             This is a new functionality introduced by IY92225.
          
          4. Specify appropriate auto refresh rate for the property 
             "enrole.auditing.completed_requests.autoRefreshRate". This property defines the rate of 
             refresh in seconds for the 'Completed Requests' section. If this property is not defined 
             or has a value '0', auto-refresh will be disabled. This is a new functionality introduced 
             by IY92227.
          
          5. Save the file and quit the editor.
                
5. OPTIONAL: Additional step for APAR IY87798.
NOTE ***  This is only required for customers generating CSV Reports in a NON-English Locale.
          To avoid a conflict between keys in different properties files, some key names used for
          Adhoc Report header, are changed in reportingLabels.properties. 
          If required, After applying the fix, update the file for different locales as described below:
          1. Open <ITIM_HOME>\data\reportingLabels_<locale suffix>.properties in a text editor.
             Here <locale suffix> is the suffix for respective locale, Example:'ja' for Japanese.
          2. Change the following keys below the line '#Report PDF headers':
             --------    ----------------
             OLD KEY     NEW KEY
             --------    ----------------
            'title'     'report.title'
            'time'      'report.time'
            'author'    'report.author'
             --------    ----------------
          3. Save the file.
          4. Restart ITIM.
           
6. OPTIONAL: Additional step for IY93034.
          An optional attribute 'escapeentities' has been introduced for the <JS> tag. A "false" 
          value for this attribute indicates to the <JS> tag interpreter that the result of the 
          execution of the javascript enclosed in <JS> tag, be treated as XML and not plain text, 
          so that the XML special characters like >, <, &, in the result, are not escaped. Any 
          other value specified for this attribute, will have no effect on the <JS> tag execution.

          Usage :

              <JS escapeentities="false">

                 var  temp;
                 ...
                 ...
                 return temp;

              </JS>

          ** This attribute may be only set to true, in the XHTML body of a notification or 
             post-office aggregate template.
             In addition to the above setting, the customers using the post-office XHTML body 
             template to aggregate individual XHTML  templates may need to further add some 
             code in the <JS> tag, to append only the body part, of individual XHTML notification 
             messages to prevent duplicate tags in the generated XHTML mails. A sample XHTML body 
             to be used for Post Office has been provided in $ITIM_HOME/extensions/APAR_Doc/IY93034.txt.
             This sample uses the 'escapeentities' attribute and considers the content enclosed only 
             in 'body' tags of individual notifications.

7. OPTIONAL: Additional step for IY93018.
          A new property 'reportBatchSize' has been introduced to control the size of a
          single StringBuffer object during CSV report generation. A value assigned to this
          property represents the number of rows of report data to be fetched from the
          database in a single call, formatted into a StringBuffer object. The value may 
          be increased or decreased depending on memory constraints. As the value of this 
          property is reduced, the number of database calls may increase and so would the 
          time taken to generate the report.
          If this property is undefined or has a value set to 0 or has an invalid value
          specified, then there will be no size limit on the StringBuffer object and 
          the behavior will be exactly same as that prior to the fix.

          To set this property follow the steps below :-
          1. Open <ITIM_HOME>/data/adhocreporting.properties file in any text editor.
          2. Set the property  "reportBatchSize" to a positive numeric value.
             e.g: If a value of 10000 is set to this property, then the last line of 
                  adhocreporting.properties file would look like this:

                  reportBatchSize=10000
          3. Save the file and quit the editor.

          10000 is an ideal value for most cases but this may be changed depending on 
          memory constraints.

8. OPTIONAL: Additional step for IY94681.
          A new command line argument 'runInBackground' has been introduced to be able to run the 
          Incremental Synchronizer in the background. This argument may be specified at the end of
          the command line. 
          An example command line specifying 'runInBackground' option is as follows -
             ./startIncrementalSynchronizerCMD_WAS.sh "itim manager" secret "cn=changelog" 3 runInBackground 

          Execute the following steps for non-Windows platforms -
           1. Open <ITIM_HOME>/bin/unix/startIncrementalSynchronizerCMD_WAS.sh file in any text editor.
           2. Edit the following command to pass in the 5th argument as follows -
              $JAVA -D$OPTIONS -classpath $CLASSPATH com.ibm.itim.adhocreport.changelog.DeltaSynchronizer.DeltaSynchronizeCMD $1 $2 $3 $4 $5
           3. Save the file and quit the editor.

          Execute the following steps for Windows platform -
           1. Open <ITIM_HOME>/bin/win/startIncrementalSynchronizerCMD_WAS.bat file in any text editor.
           2. Edit the following command to pass in the 5th argument as follows -
              "%JAVA_HOME%\bin\java" -D%OPTIONS% -classpath "%CLASSPATH%" com.ibm.itim.adhocreport.changelog.DeltaSynchronizer.DeltaSynchronizeCMD %1 %2 %3 %4 %5
           3. Save the file and quit the editor.

9. REQUIRED: Additional step for IY95457. 
          1. Perform following steps for any custom xsl files you may have in 
             <ITIM_HOME>/data/adhocreport directory.

             a. Open the xsl file in a text editor and replace all occurrences of 
                "ColumnValue" by "cv" and "Row" by "r".
             b. Save the file and quit the editor.

10. REQUIRED: Additional step for IY96865 and IZ03452. 
          After applying this Fix Pack please clear the java plug-in cache for the changes in 
          this Fix Pack to take effect. The plug-in cache may need to be cleared on every system 
          from which you access ITIM applets in a browser. The steps differ for each version 
          of the java plug-in installed.

          Execute the following steps to clear the Java Plug-in cache for the JRE Version 
          1.5.x.
          1. On a Windows system, click Start > Control Panel and double-click the Java icon 
             in the control panel. The Java Control Panel appears.

             If you are on a Unix box, you can launch the java control panel by running the 
             <JRE installation directory>/bin/ControlPanel or 
             <JRE installation directory>/bin/JavaPluginControlPanel program. On some systems 
             you can also load the Control Panel applet with a web browser by running 
             <JRE installation directory>/ControlPanel.html.

          2. On Java Control Panel, click Settings under Temporary Internet Files. 
             The Temporary Files Settings dialog box appears.

          3. Click Delete Files. The Delete Temporary Files dialog box appears.
             There are three options on this window to clear the cache.
             1. Delete Files

             2. View Applications

             3. View Applets

          4. Click OK on Delete Temporary Files window. 
             Note: This deletes all the Downloaded Applications and Applets from the cache.

          5. Click OK on Temporary Files Settings window.
             Note: If you want to delete a specific application and applet from the cache, 
                   click on View Application and View Applet options respectively. 

          Execute the following steps to clear the Java Plug-in cache for the JRE Version 
             1.4.x.
          1. On a Windows box, click Start > Control Panel and double-click the Java icon 
             in the control panel. The Java Control Panel appears.

             If you are on a Unix box, you can launch the java control panel by running the 
             <JRE installation directory>/bin/ControlPanel or 
             <JRE installation directory>/bin/JavaPluginControlPanel program. On some systems 
             you can also load the Control Panel applet with a web browser by running 
             <JRE installation directory>/ControlPanel.html.

          2.On Java Control Panel, click on the Cache tab.

          3.On the Cache tab, click on the Clear button.

11. REQUIRED: Additional step for IY98697.
             This step is required to update old completed reconciliation processes with correct 
             information for the SUBJECT_SERVICE column.

             Execute the following steps to unzip and run the database script:
             1. Unzip $ITIM_HOME/extensions/APAR_Doc/IY98697.zip in a temporary directory.
             2. Execute following steps for corresponding database type
             SQL Server:
             -----------     
             Use the Microsoft SQL Server "Query Analyzer" tool, or a supported SQL client to 
             execute the ddl script.
             In Initial Dialog "Connect to SQL Server", specify:
                User: enrole
                Password: <your configured password>
                Select menu "File" | "Open..."
                File name: <temp_dir>\updateReconProcesses.ddl
                Select menu "Query" | "Change Database..."
                Select your database name (default is "itim")
                Select "OK".
                Select menu "Query" | "Execute"
                Select "File" | "Exit".

             Oracle:
             -------
             Run the Oracle sqlplus program. Specify your database user password for the 
             enrole user in place of "PASSWORD", your Oracle ITIM instance name in place of 
             "ITIMDB", and your <ITIM_HOME> location.
                sqlplus enrole/PASSWORD@ITIMDB
                > @<temp_dir>\updateReconProcesses.ddl
                > quit

             DB2:
             ----
             Type db2cmd to get the db2 prompt and on the prompt type the following:-
                db2 connect to <dbname> user enrole using <enrole's password>
                db2 -tvf <temp_dir>\updateReconProcesses.ddl

             here <temp_dir> is path to the updateReconProcesses.ddl.

12. OPTIONAL: Additional step for IY97902.
             To extend the maximum and minimum years displayed for a date control displayed
             on any page on ITIM UI, but not associated with form templates, two new properties
             in <itim_home>/data/ui.properties have been introduced as follows -
                 1. enrole.ui.date.minRangeYear=<minRangeYear>  (default value is 1990)
                 2. enrole.ui.date.maxRangeYear=<maxRangeYear>  (default value is 2010)

             Note: Minimum/Maximum year displayed on any date control on various screens like scheduling screen
             or the 'Filter Requests' screen. This property has no effect on entity forms like person form.
             
13. OPTIONAL: Additional step for IZ01112.
          The index file is generated by default when some entry is added/modified containing indexed
          attributes.  During LDAPConfig, as data is loaded in the Directory Server, index files are generated.
          However during LDAPUpgrade, in some cases, data is not loaded in Directory Server, so all index 
          files may not be generated. The index files will be generated only when the end user tries to 
          add/modify entries containing the indexed attribute.
          To manually regenerate the index, the customer can run the 'db2index.pl' perl script file located
          under directory : <SunOneRoot>/slapd-<serverID>, on the machine where Sun One iPlanet is installed.

14. OPTIONAL: Additional step for IZ01338.
          By default, columns of the following restricted data types :
          BLOB, CLOB, BINARY, VARBINARY, LONGVARBINARY and LONGVARCHAR are not available when designing 
          or executing custom reports. A new property, 'allowedRestrictedColumns', has been introduced in
          <ITIM-HOME>/data/reporttabledeny.properties, which allows ITIM administrators to explicitly 
          allow columns of restricted data types to be used for designing and executing custom reports.
          Such reports however will work for ITIM Administrators only. If a non-administrator attempts 
          to execute such reports, the result would be an AuthorizationException, even though an ACI may be 
          defined which allows that user to view the report.
          When using Crystal Reports, if an ITIM Administrator tries to import a report which contains a 
          column of restricted data type, which is not present in 'allowedRestrictedColumns' property value 
          then the error message "CTGIMN025E One or more Crystal Report templates contain an error.  Either 
          the report contains an unsupported field or a nonsupported table used in the report." will be displayed.

          To set the property follow the steps below:
             1. Open <ITIM_HOME>/data/reporttabledeny.properties file in any text editor.
             2. Set the value of property 'allowedRestrictedColumns' to 
                'ACTIVITY.RESULT_DETAIL, PROCESS.RESULT_DETAIL, PROCESSLOG.NEW_DATA'
                After doing this the modified line of adhocreporting.properties file would look like this:
                  allowedRestrictedColumns=ACTIVITY.RESULT_DETAIL, PROCESS.RESULT_DETAIL, PROCESSLOG.NEW_DATA
             3. Save the file and quit the editor.
             
          The value of the property is a comma separated list of <TABLE_NAME>.<COLUMN_NAME>.
          If this property is undefined, then none of the columns of the restricted data type
          will be available for reporting.

15. OPTIONAL: Additional step for IZ03326.
          To address this issue, a new property, 'enrole.recyclebin.enable', has been introduced, 
          which can be configured in <ITIM_HOME>\data\enRole.properties file.

          If this property is set to 'true', ITIM managed objects, like persons, deleted using 
          ITIM UI or API will be copied to the Recycle Bin folder in the Directory Server.

          If this property is set to 'false', the objects deleted using ITIM UI or APIs will no
          longer be copied to the Recycle Bin. This will result in the Recycle Bin being empty
          and so ITIM will no longer append '(!(erisdeleted=Y))' component to any of the 
          search filters.
          Before setting this property to 'false', all entries under 'ou=recycleBin,ou=itim,<tenant_dn>' 
          folder need to be removed from the directory server, to avoid deleted objects from being
          included in any search results using ITIM.
          If the property is undefined or has an invalid value, the default value is treated as 'true'.
          
16. OPTIONAL: Additional step for IY99084.
          Two new properties have been introduced in <ITIM_HOME>/data/enRole.properties file :
          1. enrole.search.windowsort.enable
             This property when set to 'true', will affect the internal sorting algorithm of the 
             accounts listed under 'Manage Accounts' from a Person's submenu. Further, an internal
             sorting algorithm will be used only if Directory Server side sorting has been disabled
             i.e. the value of property 'enrole.search.sss.enable' in enRole.properties file has 
             been set to 'false'. The default value of this property is 'false'.

             To set this property, follow the steps below :
             1. Open <ITIM_HOME>/data/enRole.properties file in any text editor.
             2. Set the property 'enrole.search.windowsort.enable' and set it's value to 'true' -
                After doing this the modified line of enRole.properties file would look like this:
                    enrole.search.windowsort.enable=true
             3. Save the file and quit the editor.

          2. enrole.manageaccount.sort.enable
             The value of this property if set to 'false', will disable the default sorting of accounts
             listed on clicking 'Manage Accounts' link from a Person's submenu, by their respective 
             User IDs. So by setting this property to 'false', the overhead in terms of response time and
             memory usage, due to default sorting of accounts, is completely eliminated. 
             This property may be set to 'false', to improve performance when the Identity Policy 
             defined for different services is same, leading to a person entity having almost all his 
             accounts, belonging to different services, having the same User Id.
             The default value of this property is 'true'.

             To set this property, follow the steps below.
             1. Open <ITIM_HOME>/data/enRole.properties file in any text editor.
             2. Set the property 'enrole.manageaccount.sort.enable' and set it's value to 'false' -
                After doing this the modified line of enRole.properties file would look like this:
                  enrole.manageaccount.sort.enable=false
             3. Save the file and quit the editor.

17. OPTIONAL: Additional step for IY98942.
            To enable Runtime ACI Evaluation feature follow the steps below:
            1. Open <ITIM_HOME>/data/adhocreporting.properties file in any text editor.
            2. Set the  property 'applyACIAtRuntime' and set it's value to 'true' -
               After doing this the modified line of adhocreporting.properties file would look like this:

                  applyACIAtRuntime=true

            3. To change the default refresh interval of 60 minutes of the ACI Filter cache
               add the new property 'aciFilterRefreshInterval' and set it's value to a valid 
               non-zero numeric value. So if you want to set the refresh interval to 100 minutes, 
               the last line of adhocreporting.properties file would look like this:

                 aciFilterRefreshInterval=100

               Refer to the note for IY98942, for more details on the ACI Filter cache.
            4. Save the file and quit the editor.

            A sample 'adhocreporting.properties' has been shipped with this Fixpack containing
            default values for the new properties, which may be used as a reference.

            Additionally for optimal performance of this feature it is recommended to set the value
            of property 'enrole.accesscontrollist.maxSize' defined in 
            <ITIM_HOME>/data/enRole.properties file to a value greater than or equal to total number 
            of business units or containers in the organization tree.
            
18. OPTIONAL: Additional step for IZ01072.
            To enable DN normalization during data synchronization follow the steps below:
            1. Open <ITIM_HOME>/data/adhocreporting.properties file in any text editor.
            2. Set the property 'normalizeDN' and set it's value to 'true' -
               After doing this the modified line of adhocreporting.properties file would look like this:
                  normalizeDN=true

            3. Save the file and quit the editor.

            When DN normalization during data synchronization is enabled, only data inserted into 
            the ITIM database from the Directory Server, during data synchronization will be normalized.
            Changes to this property value will take effect only after ITIM application restart.

            A sample 'adhocreporting.properties' has been shipped with this Fixpack containing
            default values for the new properties, which may be used as a reference.
            
19. OPTIONAL: Additional steps for IZ03822
         Execute the following steps to be able to generate ITIM reports with Lifecycle information :

           1. Open <ITIM_HOME>/data/reportingLabels.properties in any text editor.

           2. Find the statement "rootprocessview.type.ls=life Cycle Rule Execution".
              In this statement replace 'ls' with 'lc'. So after the change, the line will 
              be as follows -
                  "rootprocessview.type.lc=life Cycle Rule Execution"

           3. Add a new label by adding the following line:
              'process.type.lc=Life Cycle Rule Execution'

           4. Save the file and quit the editor.

           Note :If you have a language pack installed, execute the above steps for the file 
           <ITIM_HOME>/data/reportingLabels_<language code>.properties. <language code> is 
           generally a two letter word representing the language. For example for English, 
           the language code is 'en'. 
                For languages other than English, the text following the '=' sign, in the 
           statement to be modified and added, may vary. If the text in the language stands for a 
           lifecycle rule process for ITIM, only then the key may be changed.

20. OPTIONAL: Additional steps for IZ04598
         Execute the following steps to correct the incorrect label keys :

           1. Open <ITIM_HOME>/data/Labels.properties in any text editor.
           2. Replace all occurrences of "gloablLDProcessName=" by "globalLDProcessName=".
           3. Similarly replace all occurrences of "gloablLDProcessDesc=" by
              "globalLDProcessDesc=".
           4. Save the file and quit the editor.

           Note : If you have a language pack installed, execute the above steps for the
           file <ITIM_HOME>/data/Labels_<language code>.properties. <language code> is 
           generally a two letter word representing the language. For example for English,
           the language code is 'en'. 

21. OPTIONAL: Additional step for IZ07359.
           A new property 'enrole.auditlog.readuncommitted.enable' has been introduced in
           <ITIM_HOME>/data/enRole.properties file. The value of this property decides if
           uncommitted reads are allowed when displaying the 'Audit Log' of a pending or
           completed workflow process. This APAR change allows uncommitted reads when displaying 
           the 'Audit Log', when this property has a value set to 'true'. Otherwise, the
           ITIM processing remains as previously, that is, uncommitted reads will not be used.
           This property should be enabled only if deadlocks have been encountered when viewing
           the 'Audit Log' of a pending process, preventing the pending process to complete 
           successfully.

           To set this property, follow the steps below.
           1. Open <ITIM_HOME>/data/enRole.properties file in any text editor.
           2. Set the value of 'enrole.auditlog.readuncommitted.enable' to 'true'. After doing this
              the modified line of enRole.properties file would look like this:
              enrole.auditlog.readuncommitted.enable=true
           3. Save the file and quit the editor.

           Note : This property is only applicable when the database used by ITIM is DB2.

22. OPTIONAL: Additional step for IZ14391.
          This is only required for the customers running enRole application and SelfServiceUI applications
          on Windows Platform. However customers running enRole application and SelfServiceUI applications
          on non-Windows Platform can also execute the steps if they wish to re-direct the SelfServiceUI 
          trace logs to different log files other than the log files used by the enRole application.
          
          A new SelfServiceUI logging configuration properties file, SelfServiceLogging.properties,
          similar to enRoleLogging.properties file has been introduced with this fix. This properties file
          also includes following trace level settings specific to the SelfService application's UI layer:
                    # logger.trace.com.ibm.itim.ui.impl.level=DEBUG_MIN 
                    # logger.trace.com.ibm.itim.ui.struts.level=DEBUG_MIN

          Execute the following steps to configure the new properties file.
          1. Copy the SelfServiceLogging.properties file from 
                  $ITIM-HOME/extensions/SelfServiceUI/IdentityManagerSelfService/data to $ITIM-HOME/data directory.
          2. Open $ITIM-HOME/data/SelfServiceLogging.properties file in any text editor.
          3. Set appropriate values for the following properties:
                 logger.productInstance=
                 handler.file.fileDir=
                 handler.file.msg.fileName=
                 handler.file.security.fileDir=
                 handler.file.security.fileName=
                 handler.file.trace.fileName=
                 handler.ffdc.baseDir=
                 handler.ffdc.fileCopy.filesToCopy=
                 
             Note: The values set for the properties 'handler.file.msg.fileName', 'handler.file.security.fileName',
                   and 'handler.file.trace.fileName' should be different than the one defined in 
                   enRoleLogging.properties file.
                   
          4. Save the file and quit the editor.
          
           With the above settings, the log statements generated via the SelfServiceUI application will be 
           logged into the files configured in the SelfServiceLogging.properties file. The previous
           log level settings configured for the SelfServiceUI application in enRoleLogging.properties 
           will not be honored anymore if the above steps are performed.

23. REQUIRED: Documentation update for IZ20436.
         There have been code changes in the dataservices module via APARs IY99198 and IY98312. 
         As a result of these changes when modifying the attribute value using any method from
         com.ibm.itim.common.AttributeValue class, the method needs to be invoked on a new instance 
         of the AttributeValue object.

         Prior to IF47/FP48, if attribute values are not changed or if you try to remove a 
         non-existing attribute, these changes were sent to the resource which was incorrect.
         The correct behavior now is to send only the actual changes.

         Corresponding methods of class com.ibm.itim.dataservices.model.DirectoryEntry are modified
         to retain only the actual changes (add/modify/remove) related to the old directory attributes.
         So after the IY98312 and IY99198 fixes, if there are no actual changes to old directory entry
         for a particular attribute, then that attribute will not be included in the request sent to 
         the remote resource.

         Prior to IF47/FP48, the custom code similar to below logic would work, however once the fixes 
         in IF47/FP48 are in place, the same custom code will not work as expected.

            AttributeValue newVal = targetEntity.getAttribute(attrName);
            newVal.addValue(attrValue);
            targetEntity.setAttribute(newVal);

         In such scenarios, you must modify the custom application extension code to use
         addAttribute(), setAttribute() and removeAttribute() properly so that the 
         targetEntity.getChanges() will return non-empty list, if there are any actual changes made to the 
         targetEntity object.
         You may use the following code to set the attribute value which will result in targetEntity.getChanges() 
         returning the list of attribute change operations:

             AttributeValue newVal = new AttributeValue();  // Create a new instance of 'AttributeValue'
             newVal.setName(attrName);
             newVal.addValue(attrValue); 
               
             OR
               
             AttributeValue newVal = new AttributeValue();  // Create a new instance of 'AttributeValue'
             newVal.setValues(collectionOfValues);
             targetEntity.setAttribute(newVal);

          Similarly, you may need to update all the custom code which uses the following type of reference:

             AttributeValue newVal = targetEntity.getAttribute(attrName);
             newVal.addValue(attrValue);
             targetEntity.setAttribute(newVal);
               
             OR
               
             AttributeValue newVal = targetEntity.getAttribute(attrName);
             newVal.removeValue(attrValue);
             targetEntity.setAttribute(newVal);
               
             OR
               
             AttributeValue newVal = targetEntity.getAttribute(attrName);
             newVal.removeValue(attrValue);
             targetEntity.removeAttribute(newVal);


End of COMMON TASKS.

End of Server Upgrade instructions.

Instructions for enroleagent.jar fixes:
    
    Additional instructions for APAR IY80441; edit enrole.properties file and add following line
      
       com.ibm.daml.jndi.DAMLContext.CACERT_DISABLE_BASIC_CONSTRAINT_CHECK=false
      
       true - Basic constraints will not be checked while validating the V3 certificate.
       false - Basic constraints will be checked while validating the V3 certificate.
      
    The default is false.
       
    If this value is not present or invalid value is specified, enroleagent will perform basic constraint check. 
    The enrole.properties file is in <ITIM_HOME>/data/ directory
       
END of Instructions for enroleagent.jar

ERMA Library instructions:

No additional steps are need for Windows systems.  However, you may wish to review the log file:
    <ITIM_HOME>\install_logs\itim_installer_debug.txt 
    To make sure the files were copied, without errors, from:
    <ITIM_HOME>\lib\nt to 
    <SYSTEM_ROOT>\system32\ 
        
    AIX, SOLARIS, HPUX and LINUX(x86) DEPLOYMENT INSTRUCTIONS:
    
    Verify that in the startServer.sh startup script PROTOCOL_DIR environment variable 
    is set to <ITIM_HOME>/lib/<platform>.
    Add this environment variable if not present. See the example below
    
    Please use the following instructions to deploy the ERMA Libraries on all supported 
    AIX, Solaris, hpux and Linux systems:
      1. Stop the ITIM Server (See instructions in the ITIM Installation Guide).
      
      2. Ensure the libraries are copied to <ITIM_HOME>/lib/<platform> directory.
      
      3. Run link commands from createlinks.sh (located at <ITIM_HOME>/lib/<platform>) 
         on command line one at a time for all shared library files.
      
      4. Set the shared library environment variable (see note) to specify the path of 
         shared libraries. The environment variable should point to the directory where 
         all the above files exist and it should also include /usr/lib directory.

         e.g. type following command on command line for Solaris:
         export LD_LIBRARY_PATH=<ITIM_HOME>/lib/sun:/usr/lib:$LD_LIBRARY_PATH 
         LD_LIBRARY_PATH is name of the shared library environment variable
         for Solaris and 'sun' is the directory name which contains ERMA 
         libraries for Solaris. 
         See note below, for environment variable names on other operating system, 
         and also the name of the directories containing the ERMA libraries.

      5. Verify that the shared library environment variable value contains all 
         required files by executing the ldd command on both libErmApi.so and 
         libErmJni2.so.
              e.g. type following command on command line
              ldd libErmApi.so
              ldd ErmApiFtp.so
              If any files are listed as "not found", add the path to those 
              files in the LD_LIBRARY_PATH.

      6. Once all the shared libraries are in path, update the WebSphere Start Script
         to include this new LD_LIBRARY_PATH and PROTOCOL_DIR if it is not already updated.
         
         The following is a display of a portion of the startServer.sh startup 
         script on Solaris opened in the editor.(vi $WAS_HOME/AppServer/bin/startServer.sh)
         This is an example of how to set the LD_LIBRARY_PATH and PROTOCOL_DIR paths.
         
         <...SEVERAL lines omitted...>
         SunOS)
             LD_LIBRARY_PATH="$WAS_LIBPATH":$LD_LIBRARY_PATH
             LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ITIM_HOME/lib/sun
             export LD_LIBRARY_PATH ;;
         
             # Required for agent communication
             PROTOCOL_DIR=$ITIM_HOME/lib/sun
             export PROTOCOL_DIR ;;
        <...remainder of script omitted...>
        
        
        Alternatively you can use the following sample script to make the ERMA LIBS work for 
        the FTP based agents. Use this example to start WebSphere, just uncomment the 
        areas needed:
        
            #!/bin/sh
            
            export LD_LIBRARY_PATH=<ITIM_HOME>/lib/<platform>:${LD_LIBRARY_PATH}
            export PROTOCOL_DIR=<ITIM_HOME>/lib/<platform>
            #<WAS_HOME>/AppServer/bin/startServer.sh server1
            #<HTTP_SERVER_HOME>/bin/apachectl start
            
         
      7. Start the ITIM server (See instructions in the ITIM Installation Guide).

      NOTE: The shared library environment variable on AIX is LIBPATH and on
            HPUX is SHLIB_PATH instead of LD_LIBRARY_PATH. LD_LIBRARY_PATH is
            the shared library environment variable name for Solaris and Linux.
            The name of the directory in the folder <ITIM_HOME>/lib, containing
            the ERMA libraries are as follows -
            'aix'    for ITIM installed on AIX , 
            'sun'    for ITIM on Solaris, 
            'hpux11' for ITIM on HPUX and 
            'linux'  for ITIM on Linux operating system on x86 platform.

    *** NOTE ***
    In a cluster deployment, these steps must be done for each node of the cluster. 
        Alternatively you can execute the following steps.

        1. Navigate to Application Servers > <SERVER_NAME> > Process Definition
        2. Choose Environment Entries from the Additional Properties.  
        3. Add LD_LIBRARY_PATH [or LIBPATH or SHLIB_PATH based on your platform] 
           and PROTOCOL_DIR environment entries here with the correct values.
        4. Perform these steps for each server that is a part of the cluster.
        5. Restart the cluster.
        
        End of WAS Cluster info.

    ERMA Library Files Replaced or Added:

    For Aix:
    Replaced file:
     <ITIM_HOME>/lib/aix/ErmApiFtp.so
    
    For Hpux:
    Replaced file:
     <ITIM_HOME>/lib/hpux11/ErmApiFtp.so

    For Linux:
    Replaced file:
     <ITIM_HOME>/lib/linux/ErmApiFtp.so
     
    For Solaris:
    Replaced file:
     <ITIM_HOME>/lib/sun/ErmApiFtp.so
    

    
End of ERMA Library instructions.

End of Readme
