File:   5.0.0.6-TIV-TIM-IF0028.README For ITIM 5.0 using IBM WebSphere Application Server.
Date:   June 30, 2009

Interim fix 5.0.0.6-TIV-TIM-IF0028 for APARs IZ50857, IZ51202, IZ51283, IZ51490, IZ51499, IZ52236, IZ52736, IZ53200, IZ53208, IZ53634, IZ54252, IZ54253, IZ54310, and IZ54311.

Components:
        WebSphere update installer package for ITIM as needed for WebSphere Application Server V6.1.

General Description:
Contains accumulated fixes for problems encountered in IBM Tivoli Identity Manager (ITIM) Version 5.0.
The APAR numbers for all fixes included are listed under "Problems Fixed". Refer to the specific APAR descriptions for more detail.
This and other featured documents for IBM Tivoli Identity Manager can be found at:
    http://www.ibm.com/software/sysmgmt/products/support/IBMTivoliIdentityManager.html 

   Problems Fixed:
   
    APAR:    IZ50857    ROUTE OF IZ44232
    Symptom: Need to do more frequent database Commits during Report Data Synchronization to avoid error message "SQL0964C The transaction log for the database is full. SQLSTATE=57011".  This results when the number of uncommitted database transactions exceed the space available for logging.
    Note:    The following property has been introduced in <ITIM_HOME>\data\adhocreporting.properties file to control the commit call frequency for uncommitted transactions during data synchronization. If you are getting 'The transaction log for the database is full' message during report data synchronization, you can set the 'commitFrequency' property to control the commit call frequency. 
             <snip>
             ########################################################################
             ## The below property is applicable for full data synchronization only.
             ## The value of 'commitFrequency' property if set to '0', will maintain the current behavior
             ## of committing database updates only at the end, when each entity mapped is processed and ACI
             ## information is processed for each entity. If this property value is set to '1', then AutoCommit
             ## is set to true, that causes a commit after each update to database. For a value > 1, the commit
             ## will be done when the number of uncommited database transactions are equal to or greater than
             ## this set value.
             ## The default value of the property is '0' and recommended values are multiple of 1000 (Eg : 5000). 
             ########################################################################
             commitFrequency=0
             </snip>
             A copy of the adhocreporting.properties file with this addition has been provided for your reference as an example.
   
    APAR:    IZ51202
    Symptom: Custom report that includes <column> Like '_USERINPUT_', executes using "Equals" condition, instead of "Like" after setting some text that doesn't include "%" or "*" as data to be searched.
   
    APAR:    IZ51283
    Symptom: Recertification Policy change causes MissingProcessDefinition exception.  If a recertification policy is modified then the existing operation definition is deleted from ou=operations without shifting it to ou=recyclebin. So if any To-Do items already exist in View activities, they fail with MISSING_PROCESS_DEFINITION while trying to view it.
   
    APAR:    IZ51490
    Symptom: After making changes in - Configure > Post office, then testing these changes, if cancel is selected the changes remain in the text.
       
    APAR:    IZ51499
    Symptom: Documentation Update:
    		 The ITIM InfoCenter will be update some time in the future with the following changes.
                  Incorrect error message when deleting a mandatory access from the SSUI.
    Note:    When attempting to delete a mandatory access in the SSUI, the error says:
                  CTGIMU994E An error occurred while trying to delete the access.
             This message is incomplete.  An additional possible cause for the access deletion failure could be that the access is currently being used by one of the provisioning policies.
   
    APAR:    IZ52236
    Symptom: The modifyPerson extension may incorrectly restore an ITIM account during suspend. For example, when running a multi-account suspend, where one of the suspend operations has a modifyPerson extension, the ITIM account remains active, even though the operation finishes successfully.
  
    APAR:    IZ52736
    Symptom: If you have customized a recertification workflow to have one more approval node, RECERTAPPROVAL_1, before the default approval node, and if the RECERTAPPROVAL_1 times out, its status is shown as 'Terminated' in the activity audit log. But, the RECERTIFICATIONLOG table is not getting updated with the correct recert_result status. It shows the recert_result set to PE, i.e. Pending, even though the activity has been completed.
   
    APAR:    IZ53200
    Symptom: When modifying the Person form to add constraints on different person attributes, after submission of the form you can't add or modify a user. It may fail with the following error:
			 CTGIMU556E An error has occurred. If the problem persists, contact your system administrator.
   
    APAR:    IZ53208
    Symptom: After upgrading to Interim Fix IF25, some example programs, such as SYNCHPASSWORD.SH, no longer run if you do not explicitly copy api_ejb.jar to the $ITIM_HOME/lib directory.
       
    APAR:    IZ53634
    Symptom: When running an entitlement workflow with a customized mail block, ITIM may hang and CPU may go to 100% usage.  This may happen in cases when the Participant is set to the Requestor.
       
    APAR:    IZ54252	ROUTE OF IZ47455	35806
    Symptom: When using the Self Service UI, if the user sets a February date in a date field on the person form and the host system date is one of the last days of any month, the February date is set to March instead.
       
    APAR:    IZ54253	ROUTE OF IZ19681 and IZ14555	35851
    Symptom: The ITIM API, WorkflowAssignmentMO.getData().getActivityParticipant() returns 'null' even though the activity has a participant.
       
    APAR:    IZ54310	36107
    Symptom: Security fix:  Correct XSS vulnerabilities in the self-service interface.
       
    APAR:    IZ54311	36115
    Symptom: Security fix:  Correct XSS vulnerability in the console interface
        
Architecture(s): Windows, Solaris, AIX, HPUX, and Linux.

Fixes superseded: NONE.

Dependencies: ITIM 5.0 Fixpack 5.0.0.6-TIV-TIM-FP0006.

Database Changes: NONE

JMS (Java Messaging Service) Changes: NONE

LDAP Changes: NONE

Files Replaced or Added or Modified by this Interim fix:

    ITIM ear, home, and updi files   (embedded inside the *.pak file)
    adhocreporting.properties

Patch Contents:
  - This README file
  - adhocreporting.properties
  - 5.0.0.6-TIV-TIM-IF0028.pak
  
   
MD5 Checksums:
878a990ddbf44e730fd32e4687b1065b  5.0.0.6-TIV-TIM-IF0028.zip
3b993e9df5b4b4a885656fa426fe2e27  5.0.0.6-TIV-TIM-IF0028.pak
a1054e24e3801b6b23d10a84a7903dcf  adhocreporting.properties


Applying the Patch:

    1) Extract the Interim Fix zip file to a temporary directory on your hard drive:

          # jar xvf 5.0.0.6-TIV-TIM-IF0028.zip

       NOTE:  You may also use any unzip equivalent to unpack the zip file.
              Back-level versions of jar, FastJar or PKZIP may report errors.  Use the jar executable supplied with java or another zip utility to uncompress the file.

    2) Copy the file(s) to the appropriate directory.  The following is a typical example.  Yours may be different.
       /opt/IBM/WebSphere/UpdateInstaller/maintenance/

NOTE: *************************************************************************
       Always BACKUP your old files in a safe place in case an unforeseen event occurs.  It is recommended to backup ITIM_HOME/data directory.  Especially, be sure to backup any configuration files you may have modified  such as properties or xml files.
NOTE: *************************************************************************
       When performing this Interim Fix installation on a slower system the deployment could take a long time.
       We have seen times in the 30 minute range.  It is recommended to extend the WebSphere SOAP Request Timeout value from 180 to 1800 seconds or higher as needed.
       Configuration file:
          WAS_HOME/profiles/PROFILE_NAME/properties/soap.client.props
       Property to change:
          com.ibm.SOAP.requestTimeout=1800

       If you encounter a timeout problem you may see the following entries in the update installer logs:
        WASX7017E: Exception received while running file
        "/opt/IBM/itim/properties/version/nif/config/install/was/updateEar.py";
        exception information: com.ibm.websphere.management.exception.ConfigServiceException
        com.ibm.websphere.management.exception.ConnectorException
        org.apache.soap.SOAPException: [SOAPException: faultCode=SOAP-ENV:Client; msg=Read timed out;
        targetException=java.net.SocketTimeoutException: Read timed out]

        You may also see other errors indicating an error during the deployment of the ear.
NOTE: *************************************************************************
       You must use the WebSphere Update Installer Version V6.1.0.13 or newer.  You may download the latest version and get more information about the WebSphere Update Installer here:
       http://www.ibm.com/support/docview.wss?rs=180&uid=swg24012718
NOTE: *************************************************************************
      Interim Fix Installation procedure

       NOTE***  For Installing on a Cluster:
       Perform the  procedure starting at step 2 first on the NDM and then on every node in the cluster.
       Do not perform Step 1. on a Cluster.
       Before starting Fixpack Installation on cluster:
       A. Ensure all node agents are up and can communicate with the NDM.
       B. Ensure ITIM application cluster and ITIM Messaging cluster are stopped.
       C. If the DM node and a cluster member are in the same host, perform this procedure only once.
       NOTE***  For Installing on a Cluster end.
       1. Stop WebSphere using your normal procedures, e.g.
                $WAS_HOME/profiles/AppSrv01/bin/stopServer.sh server1
                Or if you wish to submit userid and password when WAS admin security is used:
                $WAS_HOME/profiles/AppSrv01/bin/stopServer.sh server1 -username xxxx -password yyyy
           Proceed to step 2, only after the stop confirmation is displayed.

       2.  Execute the WebSphere Update Installer, e.g.
                 /opt/IBM/WebSphere/UpdateInstaller/update.sh
                 C:\Program Files\IBM\WebSphere\UpdateInstaller\update.bat

       3. When the update installer asks for Product Selection, specify your ITIM_HOME directory, typically, /opt/IBM/itim.  Later steps will prompt for the location of the fix deliverable (.pak file).  When you go forward in the update installer panels, you should see the Interim Fix listed in the "Available Maintenance Package to Install" panel.

       4. Select the Next Button and confirm in the next panel by selecting the Next button.

       5. After the Maintenance Installation is complete, you may exit the Update Installer.

       6. Perform the COMMON TASKS listed below these instructions.

       7. After you are done with the COMMON TASKS, then:

       8. You may now begin using ITIM.  The Update Installer automatically restarts the WebSphere AppServer.


NOTE: *********************************************************************************
       The following are COMMON TASKS that you need to perform prior to restarting the AppServer or Cluster.
NOTE: *********************************************************************************

NONE
         
End of Readme
