File:   4.6.0-TIV-TIM-IF0022.README For ITIM 4.6.0 using IBM WebSphere Application Server.
Date:   July 18, 2006
                                     
Interim fix 4.6.0-TIV-TIM-IF0022 for APARs IY85453, IY85781, IY85943, IY85987, IY86372, 
IY86419, IY86471, IY86487, IY86882, IY86885, IY86886, IY86887, IY87048, IY87049,IY87050,
IY87051, IY87052, IY87053, and IY87055.

Components:
        enrole.ear for all supported platforms for WebSphere Application Server.
        adhocreporting.properties for all supported platforms for WebSphere Application Server.

General Description:

This Interim fix provides fixes for APARs IY85453, IY85781, IY85943, IY85987, IY86372, 
IY86419, IY86471, IY86487, IY86882, IY86885, IY86886, IY86887, IY87048, IY87049,IY87050,
IY87051, IY87052, IY87053, and IY87055. 

   Problems Fixed:
   
    APAR:    IY85453    17391
    Symptom: While creating/modifying an Account for any hosted service, on Approval/Reject 
             form, Group DNs are displayed instead of group CNs.
   
    APAR:    IY85781    17418
    Symptom: Customer has an ACI that allows a user to run a custom request, but gets an error,
             SQL0134N Improper use of a string column, host variable, constant, or function 
             "COL_0". SQLSTATE=42907 
             at
             COM.ibm.db2.jdbc.app.SQLExceptionGenerator.throw_SQLException(Unknown Source),
             if a delegate runs the report.
    Note:    After applying the fix, new reports can not be designed with columns of a restricted
             data type.  The restricted data types for a report column are:
             BLOB, CLOB, BINARY, VARBINARY, LONGVARBINARY and LONGVARCHAR, defined in java.sql.Types
             Please refer java documents of the class java.sql.Types for more information on
             data types.
   
             An error message will be displayed if a non-admin user runs an adhoc report which 
             contains any column of a restricted data type. Such reports should be redesigned 
             and any display or filter column of a restricted data type should be removed.
             
             Crystal reports with column of a restricted type can not be imported and an error
             message 'CTGIMN003E An error occurred while saving a report template using the
             Crystal Reports designer' will displayed for such imports.
             
             An error message 'CTGIMN025E One or more Crystal Report templates contain an error.
             Either the report contains an unsupported field or a nonsupported table used in
             the report.' will be displayed on running an existing crystal report with column
             of restricted data type. Such Crystal reports should be modified and restricted
             columns should be removed
          
             After applying the Interim fix execute the following steps in order to add 
             the property 'denyAttribute'. The attribute specified as a value will be excluded 
             from the list of columns that can added in a report.
             
             1. Open <ITIM_HOME>/data/adhocreporting.properties in any text editor.
             2. Copy the property 'denyAttributes' and its values from adhocreporting.properties
                shipped with this Interim fix. Add more attributes as values if required to be
                excluded as columns from a report.
             3. Save the changes and quit the editor.
             4. Restart WAS.
                 a. Stop the AppServer (stopServer.sh)
            
                 b. Start the AppServer (startServer.sh)  


    APAR:    IY85943    17428
    Symptom: When a lifecycle rule filter contains a relationship macro, the success of the 
             search depends on the position of the macro within the search filter.
             The search filter only works if the relationship macro is first in the filter. 
   
    APAR:    IY85987    17429
    Symptom: Problem with SearchMO.setPaging API.
             ITIM APIs SearchMO.execute().getResult() does return search results for smaller 
             sizes (about 10 or less) But they are not returning anything when the results size 
             is larger (11 or more so).

    APAR:    IY86372    17443
    Symptom: Poor performance for rendering date fields in SAP roles after applying IF0019.
    
    APAR:    IY86419    17446
    Symptom: Getting HTTP 500 Internal server error when sending a modify person request to 
             delete a role to which the ITIM user doesn't have permissions set.

    APAR:    IY86471    17448
    Symptom: While approving creating a person, the approver that is specified in workflow needs 
             to check the details of the person in "Access To Do List" by selecting 
             "View Request Data".  However the information that is related to person to be 
             created isn't displayed on the panel if "Domain Administrator" is set to the 
             approver in Participant field.  On the other hand, the Data tab shows the data.
   
    APAR:    IY86487    17449
    Symptom: Customer applied IF20 and now is unable to transfer person records via the search 
             servlet. Instead of being able to search for the new OU, a person search is brought 
             up instead.
   
    APAR:    IY86882    17444
    Symptom: NEW FUNCTION:
             Performance enhancement for HR feeds.
             The biggest performance issue in HR Feeds when starting with a large user 
             population is a particular IDS search. The search is being performed to try 
             to recurse down the org chart to determine whether or not the person in the 
             feed already exists. This ITIM Performance Enhancement changes the search 
             technique from a recursive search through the org chart starting at a specific 
             OU to a single search in the entire organization followed by a determination 
             of whether the people found reside in the OU or its children.
    Note:    To optimize IDI HR Feed, a new property enrole.hrfeed.cache.timeout has been 
             introduced in enRole.properties file. The value of this property defines the 
             timeout of cache in minutes, internally maintained by ITIM to improve IDI HR 
             Feed performance. If the value of this property is not defined or does not have 
             a positive numeric value defined, a default of 5 minutes will be assumed, for 
             timeout of the cache. As this timeout property is used to cache information by 
             ITIM, some changes like a change in placement rule of IDI service etc, will not 
             take effect until the timeout.
             Execute the following steps to specify a value for this property in 
             <ITIM_HOME>/data/enRole.properties file.
             
             1. Open <ITIM_HOME>/data/enRole.properties in any text editor.
             2. Add the following line at the end of the file. Specify appropriate value 
                for this property.
                enrole.hrfeed.cache.timeout=5
             3. Save the file and quit the editor.
   
    APAR:    IY86885    17419
    Symptom: If there is a problem within a fesiextension application, the request 
             fails immediately. The retry parameters have no effect on the request, 
             while in the fesi code. 
    Note:    To enable retry of an activity in the workflow, when the java script 
             evaluation fails, due to Directory Server being down, edit the file :
             <ITIM-HOME>\data\fesiextension.properties and add the following new property.
             fesi.extension.retryOn=com.ibm.itim.dataservices.model.DS_COMMUNICATION_ERROR
      
             Additionally any custom FESI code, used in the workflow, which performs any 
             LDAP operation, should be modified to throw JS Exception, with the exception 
             message set to "com.ibm.itim.dataservices.model.DS_COMMUNICATION_ERROR". 
             Example: 
             try { 
             //Custom FESI Code performing LDAP operation
             } catch(ModelCommunicationException e) {
             
                  String msg = "com.ibm.itim.dataservices.model.DS_COMMUNICATION_ERROR";
                  throw new CustomJSException(msg, e);
             }
             
             Alternatively, the exception message thrown by a custom FESI extension, can be
             included as another value of the 'fesi.extension.retryOn' property. Multiple 
             values specified for this property need to be comma separated.

   
    APAR:    IY86886    17450
    Symptom: When clicking on the 'Back' button on the NON-COMPLIANT FORM form, a popup dialog 
             box is displayed about an unhandled exception from servlet [AccountComplianceServlet], 
             also an Error Page is displayed with the same information that is in the IE popup 
             window.
   
    APAR:    IY86887    17440
    Symptom: DOCUMENTATION UPDATE for JAVADOCS
             The javadocs for remote APIs that contain a scheduled date time argument, such as
             PersonManager.createPerson, do not indicate that if the action is to be 
             "immediate" and not scheduled then the Date argument should be null.
             The javadocs will be updated and shipped in a future Fixpack.  At this time,
             please note that If you send a NULL, it means schedule immediately.
   
    APAR:    IY87048    17355
    Symptom: 'Page cannot be displayed' error is displayed on clicking on submit button of
             'Modify Entitlement' window.
   
    APAR:    IY87049    17405
    Symptom: Optimizing display of membership of dynamic role with many members.
             When a large dynamic role in an OU is displayed (with over 1000 members), there is 
             a problem handling the LDAP results that causes an empty list to be displayed, 
             instead of the paged role membership. 
   
    APAR:    IY87050    17377
    Symptom: Identity Manager Users are not displayed in Search under some rare conditions.
   
    APAR:    IY87051    17395
    Symptom: While processing a DSML response message from ITDI in ITIM, subsequent checks are 
             performed even after failure of initial check. This results in an 
             ArrayIndexOutofBound Exception when an operation is performed on a nonexistent 
             entry in an array.
   
    APAR:    IY87052    17402
    Symptom: Get Class Cast exception in auditMultipleAdoptEvent when multiple accounts are adopted.
   
    APAR:    IY87053    17412
    Symptom: During adoption of an orphan account, user is allowed to submit the request without
             a 'Person to adopt account'.
   
    APAR:    IY87055    17357
    Symptom: The carriage return is stripped out in the contents of notes field of the WinAD 
             orphan account.
   
Architecture(s): Windows, Solaris, AIX, HPUX, and Linux.

Fixes superseded: None.

Dependencies: Fixpack 4.6.0-TIV-TIM-FP0021.

Database Changes: NONE 

JMS (Java Messaging Service) Changes: NONE

LDAP Changes: NONE

Files Replaced or Added or Modified by this Interim fix:

    <ITIM_HOME>/enrole.ear
    <ITIM_HOME>/data/adhocreporting.properties
    
Patch Contents:
  - This README file
  - enrole.ear
  - adhocreporting.properties
  
MD5 Checksums:
fab0eafc8b127c8cfb2df57a47d201a4  4.6.0-TIV-TIM-IF0022.zip

MD5 Checksums:

7341d7ab0def2e3a6267e3acdb336a92   enrole.ear
132b7871314421c212b83560185b4024   adhocreporting.properties


Applying the Patch:

    1) Extract the Interim Fix zip file to a temporary directory on your hard drive:
      
          # jar xvf 4.6.0-TIV-TIM-IF0022.zip  

       NOTE:  You may also use any unzip equivalent to unpack the zip file.
              Back-level versions of jar, FastJar or PKZIP may report errors. 
              Use the jar executable supplied with java or another zip utility 
              to uncompress the file.
       
    2) Copy the file(s) to the appropriate directory.

NOTE: *************************************************************************       
       Always BACKUP your old files in a safe place in case an unforseen 
       event occurs.  It is recommended to backup ITIM_HOME/data directory.
       Especially, be sure to backup any configuration files you 
       may have modified  such as properties or xml files.
NOTE: *************************************************************************       
       IF YOU ARE USING JAVA 2 SECURITY:
       Backup up your was.policy file to a temporary holding directory.  During 
       the fix application you will be re-deploying enrole.ear, which removes the
       $WAS_HOME/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
       directory and its contents. During the deployment, the was.policy is not 
       replaced and will need to be copied back during the COMMON TASKS section 
       of this document. On a Cluster this needs to be done on the NDM as well.
       $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
NOTE: *************************************************************************       
       IF YOU HAVE MIGRATED FROM ITIM 4.5.1 to ITIM 4.6        
       If your TIM V4.6 system is migrated from V4.5.1, it is necessary to copy
       the jsafe.jar and log4j.jar files from the:
       $ITIM_HOME/lib 
       directory into:
       $WAS_HOME/installedApps/$CELL_NAME/enRole.ear directory  
       You must always copy these 2 files back after installing an ITIM Interim Fix
       or Fixpack.
       The jsafe.jar file is no longer used in ITIM 4.6.0, since the encryption
       is changed in 4.6.0, but the jsafe.jar file is needed to be able to
       encrypt/un-encrypt the existing 4.5.1 data in LDAP.
NOTE: *************************************************************************       
       IF YOU HAVE INSTALLED A CUSTOM LOGO:
       The logo is copied to:
       $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war/images
       The Fixpack and Interim fix process removes the enRole.ear and all subdirectories.  
       To make it easier to restore the custom logo, copy it to a backup directory of your 
       choosing to facilitate copying it back after the Interim fix is applied.
       The ui.properties is preserved so it will not need to be updated.
       After the Interim fix is installed copy the custom logo to:
          $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war/images
NOTE: *************************************************************************       
       IF YOU HAVE INSTALLED A LANGUAGE PACK:
          Symptom - Fixpacks and Interim fixes partially overwrite Language Pack installation.
          Note - Before the Fixpack or Interim fix installation, take a back-up of the following
          files/folder related to the language pack, located in the directory:
            $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war
             - AppletErrorMessages_<language code>.properties
             - AppletLabels_<language code>.properties
             - AppletMessages_<language code>.properties
             - The folder along with it's contents by the name as <language code>.
                    
       The <language code> is generally a two letter word representing the language. 
       For example for English, the language code is 'en'.
         
       After applying the Fixpack or Interim Fix, restore all the language pack related files 
       and folder, that were backed up, to their respective locations in the directory: 
       $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war
        
       Note that for WAS Cluster installation, the same steps will have to be followed on 
       each of the nodes. This procedure is needed only on the cluster member, not on the 
       Deployment Manager node.
NOTE: *************************************************************************       
       The enrole.ear installed in:
       <ITIM_HOME>/ directory
       The file, enrole.ear, is used for single server and regular cluster.
       For all instances of <server_name> below we are referring to the AppServer name in
       WebSphere, usually referred to as server1 in a single server environment.
     
       NOTE***  SINGLE SERVER INSTRUCTIONS:
       Please use the following instructions for a Single Server environment.
       If this is a single server environment, only the enrole.ear is needed.
           
       1. Log in to the App Server Administrator.
       
        a. Example:
                http://localhost:9090/admin .
       
       2. Uninstall enrole application       
       
        a. Select the enRole application
        
        b. Stop the enRole application
        
        c. Uninstall the enRole application
        
        d. Above this box, click on save the configuration...another panel will 
           come up and you will need to confirm this by pressing the save configuration
           button.
           
        e. You are now finished with the App Server Administrator
        
       3. Restart WAS.
       
        a. Stop the AppServer (stopServer.sh)
        
        b. Start the AppServer (startServer.sh)  
       
       4. In the <ITIM_HOME>/bin directory run 
                SetupEnrole install server:<server_name>  (e.g. server1)
                
           If you have WAS Security setup then:
          
                SetupEnrole install server:<server_name> user:<userid> password:<password>
                
       5. Perform the COMMON TASKS listed below these instructions.
       
       6. After you are done with the COMMON TASKS, then:
       
       7. Restart WAS and you are done.
              
        a. Stop the AppServer (stopServer.sh)
               
        b. Start the AppServer (startServer.sh)
                
          
       NOTE***  CLUSTER INSTRUCTIONS:
       Please use the following instructions for a Cluster environment.  
           
       1C. Ensure all node agents are up and can communicate with the NDM.
       
       2C. Uninstall the ITIM Application from WebSphere.
       
        a. Stop the cluster. Use "ssCluster.sh stop" or from NDM admin console, 
           navigate to Servers -> Clusters. Select the cluster (s) where ITIM 
           is installed, and stop. 
        
        b. Uninstall the enrole enterprise app. 
        
        c. Save the config ensuring that it is synched with all the nodes. 
        
        d. Logout from the NDM admin console.       
        
       3C. Re-Install ITIM.
       
        a. From NDM, run <ITIM_HOME>/bin/setupEnrole install. This is same as 
           in single server case, except, you don't need the "server" argument 
           here because the app will be deployed onto a cluster.
       
           If you have WAS Security setup then:
          
                SetupEnrole install user:<userid> password:<password>
                
       4C. Perform the COMMON TASKS listed below these instructions.
                
       5C. Start the cluster. Use "ssCluster.sh start" or do it from the NDM 
           admin console. 
           
NOTE: *********************************************************************************
       The following are COMMON TASKS that you need to perform prior to restarting the
       AppServer or Cluster. 
NOTE: *********************************************************************************

       1. You must copy the updated api jar files to the $ITIM_HOME/lib directory.
           Copy the itim_api.jar, itim_server.jar and the api_ejb.jar from:
                $WAS_HOME/installedApps/$CELL_NAME/enrole.ear  directory to
                $ITIM_HOME/lib  directory.

       2. If you are using the JAVA 2 Security, replace the was.policy file you saved
          earlier.  Copy it back to:
          $WAS_HOME/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
          For Cluster in the NDM:
          $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
          Where $CELL_NAME is either the $MACHINE_NAME or $CLUSTER_NAME.
          For additional information on using JAVA 2 Security with ITIM, please review the ITIM
          Installation Guide, Appendix C.
          
       3. Edit adhocreporting.properties in directory <ITIM_HOME>/data/ as explained below.
          1. Open adhocreporting.properties in any text edior.
          2. Copy the property 'denyAttributes' and its values from adhocreporting.properties
             shipped with this Interim fix. Add more attributes as values if required to be
             excluded as columns from a report.
          3. Save the changes and quit the editor.
          

       END OF COMMON TASKS

End of Readme
