IBM(R) Tivoli(R) Access Manager Base, Patch 5.1.0-TIV-TAM-FP0038 README
======================================================================================

(C) Copyright International Business Machines Corporation 2004. All rights reserved.
U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  Friday, 19 September 2008

---------------------------------------------------------------------------------------

    CONTENTS

    1.0 ABOUT THIS PATCH
       1.1 Patch contents
       1.2 Architectures
       1.3 Patches superseded
       1.4 Dependencies

    2.0 APARS AND DEFECTS FIXED
       2.1 Problems fixed by patch 5.1.0-TIV-TAM-FP0038
       2.2 Problems fixed by patch 5.1.0-TIV-TAM-FP0036
       2.3 Problems fixed by patch 5.1.0-TIV-TAM-FP0034
       2.4 Problems fixed by patch 5.1.0-TIV-TAM-FP0032
       2.5 Problems fixed by patch 5.1.0-TIV-TAM-FP0030
       2.6 Problems fixed by patch 5.1.0-TIV-TAM-FP0026
       2.7 Problems fixed by patch 5.1.0-TIV-TAM-FP0024
       2.8 Problems fixed by patch 5.1.0-TIV-TAM-FP0022
       2.9 Problems fixed by patch 5.1.0-TIV-TAM-FP0020
       2.10 Problems fixed by patch 5.1.0-TIV-TAM-FP0017
       2.11 Problems fixed by patch 5.1.0-TIV-TAM-FP0015
       2.12 Problems fixed by patch 5.1.0-TIV-TAM-FP0013
       2.13 Problems fixed by patch 5.1.0-TIV-TAM-FP0009
       2.14 Problems fixed by patch 5.1.0-TIV-TAM-FP0006
       2.15 Problems fixed by patch 5.1-TAM-FP04
       2.16 Problems fixed by patch 5.1-TAM-FP02

    3.0 BEFORE INSTALLING THIS PATCH
       3.1 Back up Tivoli Access Manager data
       3.2 Upgrade GSKit to Version 7.0.4.11
           3.2.1 To upgrade GSKit on AIX
           3.2.2 To upgrade GSKit on HP/UX
           3.2.3 To upgrade GSKit on Linux
           3.2.4 To upgrade GSKit on Solaris
           3.2.5 To upgrade GSKit on Microsoft Windows
           3.2.6 Confirm That GSKit Was Updated
       3.3 Upgrade IBM JCE to resolve Digital Certificate Expiry issue
	   affecting IBM JDK 1.3.1 (IY85217)
           3.3.1 Components affected.
           3.3.2 How to check the JRE for each components and take 
	         remedial action.

     4.0 INSTALLING THIS PATCH
       4.1 Installing this patch on AIX systems
       4.2 Installing this patch on HP-UX systems
       4.3 Installing this patch on Linux systems
       4.4 Installing this patch on Solaris Operating Environment systems
       4.5 Installing this patch on Windows systems

    5.0 UNINSTALLING THIS PATCH

    6.0 AFTER INSTALLING THIS PATCH
       6.1 Verifying patch level
       6.2 Adding new components to a system
       6.3 WPM post-install steps (IY87189)

    7.0 DOCUMENTATION UPDATES
       7.1 IBM Tivoli Directory Server 5.2 does not support Trusted Solaris 8
           (45727)
       7.2 azn_cred_ldap_dn corrections in Authorization C API Dev Ref (45019)
       7.3 Tuning suffix search order does not match the ldap.conf file (43928)
       7.4 Installation instructions for Tivoli Identity Manager (IY53027)
       7.5 WebSphere Application Server 5, fix pack 2 installation (IY52954)
       7.6 Supported JREs (45682)
       7.7 Solaris Operating Environment 9 patch correction (47108)
       7.8 Base Install Guide IDS 5.2 no support on HPUX11 (IY53018)
       7.9 Language Pack needs to be installed after WPM (IY53162)
       7.10 AM 5.1 for Red Hat Enterprise Linux 3.0 is only supported
            on JRE 1.4.1 (IY54569)
       7.11 AM apps require access to a writeable registry server. (IY47745)
       7.12 Java Secure Sockets Extension fix (IY49135)
       7.13 Access Manager 5.1 can communicate with WebSEAL 4.1 for migration
            purposes (IY54956)
       7.14 TAM 5.1 user password expiry issue with W2003 and AD (IY53464)
       7.15 Setting JAVA_HOME in a Windows environment to use the GSKit IKeyman
            utility (IY56770)
       7.16 Incremental_bulkload.sh gets an error in DBCS environment.(IY53551)
       7.17 Additional Information for utility 'create_indexes_ns.sh' (IY55094)
       7.18 Not clear that pdjrte must be configured for each Java Runtime
            Environment (IY52278)
       7.19 Change all server passwords for security purposes (50791)
       7.20 Upgrading PDJRTE with WPS/WAS installed. (IY59440)
       7.21 File permissions changes when migrating from AM 4.1 to 5.1 (IY58917)
       7.22 Wrong keywords for pdversion command (IY58887)
       7.23 pdmgrd will ignore ca-cert-download-enabled (IY59615)
       7.24 Mounting Rock Ridge CD-ROMs (IY60069)
       7.25 Native LDAP dynamic groups needs to be documented in TAM 5.1 (53080)
       7.26 Statistics documentation do not state the unit of measurements (49120)
       7.27 Novell EDIR setup has incorrect command references (51336)
       7.28 Migrating from TAM 4.1 to TAM 5.1 with failover-password set (52344)
       7.29 adschema_update.exe is not documented (IY61963)
       7.30 The com.tivoli.pd.jazn classes are not documented (IY58627)
       7.31 The pdproxycfg CLI has a bad template file (IY60057)
       7.32 TAM 5.1- PDMGRD ERROR HPDAC0455E LOGGED WHEN NEW DOMAIN CREATED (IY63834)
       7.33 LIBGCC is not listed as pre-req for the Plug-in for Edge Server (IY60563)
       7.34 TAM error 0x1354a424 is not documented (IY65986)
       7.35 Documentation for the Policy Server must be installed in the root domain (IY65821)
       7.36 If the user who created the ACL is deleted, ACL cannot be removed. (IY63388)
       7.37 http-timeout ignored if OS timeout is lower (IY68420)
       7.38 Usage of multiple PDContext in application (IY67354)
       7.39 Information about kdb password lifetime refresh trigger (IY63992)
       7.40 The Enterprise Admins and the Schema Admins groups belong to the Active
            Directory root domain. (53789)
       7.41 Additional steps required to apply fix for IY53908. (IY69559)
       7.42 Log files on AIX limited to 2gig regardless of OS settings (IY69483)
       7.43 Support of RHES 4 with SELinux (IY68707)
       7.44 More details are required for pdjrtecfg command (IY71571)
       7.45 Documentation required for pdjrteupg command (IY71577)
       7.46 IKeyman's -expire parameter's default is misdocumented (IY72175)
       7.47 Handle ITDS FP520S-01 password policy enforcement (54278)
       7.48 Webseal delays 25 secs in connecting to LDAP Replica Server (IY68129)
       7.49 The auth-using-compare field is commented out in ivacld.conf (IY74651)
       7.50 Updated javadocs in PD.AuthADK (IY72168)
       7.51 Corrected instructions available for migrating from IBM Directory Server
            4.1 or 5.1 with DB2 7.2 on AIX to IBM Directory Server 5.2 (IY73876)
       7.52 How TAM handles LDAP password policies (IY76706)
       7.53 Need Re-Compile/Re-Link After Applying FP with ADK changes (IY77752).
       7.54 TAM Support for SLES9 on zSeries (IY77827)
       7.55 Additional configuration needed for IY79330
       7.56 WPM cannot delete GSO credential after migration from 4.1 > 5.1 (IY81577)
       7.57 GSO data not accessible when running in a mixed 4.1/5.1 environment (IY81206)
       7.58 It is unclear how Access Manager Runtime for Java ranks work (IY80970)
       7.59 TAM 3.9->5.1 pre-5.1 GSO users unable to get GSO resource (IY81998,IY72782)
       7.60 Unable to configure PDRTE in Windows for AD_LDAP with SSL (IY84130)
       7.61 Setup documentation for IBM LDAP on Z/OS and OS/390 IS NOT CLEAR (IY83217)
       7.62 Recommendations for using JAVA API PDCONTEXT (IY80755)
       7.63 Details on changes for IY84481: Extended credential attributes not passed
            to chained cdas
       7.64 Additional Details and configuration parameter for internal defect 57798:
            Implement AMJRTE certificate auto-refresh
       7.65 ADD CURRENT CONTEXT COUNTER FROM REMOTE APPS INTO TRACING LOG (IY90753)
       7.66 "R" ACTION LIST BIT WAS NOT MIGRATED (IY95312)
       7.67 SSL-LISTENING-PORT SHOULD BE CHANGED VIA SVRSSLCFG -CHGPORT (IY95392)	
       7.68 "OBJECT SHOW" DISPLAYS EVEN THOUGH IT IS NOT AN OBJECT (IY96548)
       7.69 Clarification on configuring remote log file agents. (IY98399)
       7.70 LDAP PASSWORD POLICY AND AUTH-USING-COMPARE (IZ23829)
       7.71 PDContext Application Design Considerations (IZ23831)


    8.0 SOFTWARE LIMITATIONS
       8.1 Active Directory cannot create or import Active Directory users
           (IY52682)(45593)
       8.2 Checksum error on install of TAM 5.1 PD.AUTHADK on AIX when validation
           option is selected (IY75340)
       8.3 Path of ivmgrd.kdb is hardcoded in mgrsslcfg utility (IY77574)

    9.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
       9.1 Issue requiring upgrade to GSKIT to 7.0.1.16. (47682)
       9.2 Users in AD groups that have been imported into TAM 4.1 are
           not being granted access via those groups (IY46666)
       9.3 TAM 5.1 with Sun ONE Directory fails login after restarting Sun ONE
           (IY56160)
       9.4 Installation errors out and require patch PHSS_26945 install on HP.
           (IY53143)
       9.5 AM 5.1 for Red Hat Enterprise Linux 3.0 is only supported on
           JRE 1.4.1 (IY56035)
       9.6 Fixpack requires pdrte in order to apply pdjrte patches
       9.7 Incorrect file ownerships seen after performing an installation/upgrade
           on Unix platforms (IY57034)
       9.8 TAMOS configuration failure cause by missing action list item after
           migration from pre-TAM 4.1.0.7 to TAM 5.1 (IY56226)
       9.9 Can not install Access Manager FixPack on Win2K environment after
           clicking the "Cancel" button mid-way to the installation. (IY64846)
       9.10 TAM5.1 FOR LINUX SHIPS WITH AN EXPIRED DB2 LICENSE (IY67211)
       9.11 Sometimes, WebSEAL might return error HPDIA0501E under high load
            (IY68129)
       9.12 Install problem on 5.1.0-TIV-TAM-LA0016 Windows Only! (64564)
       9.13 GSKit 7.0.3.17 installation problem (64564)
       9.14 Using piped logging adversely affects system performance on AIX 5.2
            (IY81833)
       9.15 PDACLD_config fails if LDAP does not allow anonymous binding (IY90440)
       9.16 LDAP's "User must change password after reset" policy does not work (IZ10367)
       9.17 Migration problem from TAM510 to TAM600 in Windows (IZ05179, IZ09965)


   10.0 NOTICES
       10.1 Trademarks


1.0 ABOUT THIS PATCH
--------------------
This patch package contains fixes for problems in Tivoli Access Manager
Base software. This patch requires that IBM Tivoli Access Manager Base,
Version 5.1 already be installed and configured successfully.

Tivoli Access Manager Base components are installed as part of the
following products:

    - IBM Tivoli Access Manager for e-business, Version 5.1
    - IBM Tivoli Access Manager for Business Integration, Version 5.1
    - IBM Tivoli Access Manager for Operating Systems, Version 5.1


1.1 Patch contents

This patch package contains:

    - This README file
    - Update patch packaging


1.2 Architectures

This patch package applies to the following architectures:

    - IBM AIX(R) 5.1 and 5.2
    - IBM AIX(R) 5.3 with
        1.xlC.rte (6.0.0.0 C Set ++ Runtime)
        2.xlC.aix50.rte (6.0.0.13 C Set ++ Runtime for AIX 5.0)
        3.bos.rte.libc (5.3.0.0 libc Library)
    - Sun Solaris Operating Environment 2.8, 2.9, and 10
    - HP-UX 11 and 11i
    - Red Hat Enterprise Linux 3.0 update 3, RHEL 4, and RHEL 4AS
    - SuSE SLES8 for IA32
    - SuSE SLES8 for zSeries(R) (31-bit systems) with SP 2
    - SuSE SLES8 for zSeries (64-bit systems, 31-bit compat. mode) with SP 2
    - SuSE SLES9 i/p & xSeries
    - Microsoft Windows 2000 Server and Advanced Server with SP 3
    - Microsoft Windows 2003 Standard Server and Enterprise Server


Notes:

    1) Web Portal Manager is also supported on SuSE SLES8 for pSeries and
       iSeries.
    2) Tivoli Access Manager ADK, Runtime, and Java Runtime Environment systems
       are also supported on the following architectures:

       - IBM AIX 4.3.3
       - Sun Solaris Operating Environment 2.7
       - SuSE SLES8 for pSeries and iSeries
       - Microsoft Windows NT 4.0 with SP 6a
       - Microsoft Windows XP and 2000 Pro

    3) SuSE Linux is one of four partner companies whose products are based on
       UnitedLinux 1.0; other companies being the SCO Group, Turbolinux, and
       Conectiva. When SuSe Linux Enterprise Server (SLES) is listed as
       supported, other partner companies' products based on UnitedLinux 1.0
       support is implied as well. For more information, consult the
       UnitedLinux Web site at:  http://www.unitedlinux.com

    4) Sun Solaris 10 is supported with the following limitations:
       ITDS Version 5.2 Client support on Solaris 10 is limited and only supported
       when it is bundled with products like TAMeb 5.1 .


1.3 Patches superseded

Patches superseded by this patch:

    5.1.0-TIV-TAM-FP0036
    5.1.0-TIV-TAM-FP0034
    5.1.0-TIV-TAM-FP0032
    5.1.0-TIV-TAM-FP0030
    5.1.0-TIV-TAM-FP0026
    5.1.0-TIV-TAM-FP0024
    5.1.0-TIV-TAM-FP0022
    5.1.0-TIV-TAM-FP0020
    5.1.0-TIV-TAM-FP0017
    5.1.0-TIV-TAM-FP0015
    5.1.0-TIV-TAM-FP0013
    5.1.0-TIV-TAM-FP0009
    5.1.0-TIV-TAM-FP0006
    5.1-TAM-FP04
    5.1-TAM-FP02


1.4 Dependencies

IBM Tivoli Access Manager Base, Version 5.1
IBM Global Security Toolkit (GSKit) version 7.0.4.11


2.0 APARS AND DEFECTS FIXED
---------------------------
Because patches are cumulative, this patch corrects all the problems
outlined in the following sections.


2.1 Problems fixed by patch 5.1.0-TIV-TAM-FP0038

   APAR IZ01036
   Symptom: INCONSISTENT TAM BEHAVIOR WITH DIFFERENT LDAP REGISTRIES
            Access Manager configured against "z/OS LDAP V1R6" does
            not support ibm-AllGroups or ibm-AllMemebrs operational
            attributes and as such cannot support dynamic group.

   APAR IZ03747
   Symptom: Webseal hang

   APAR IZ14403
   Symptom: WebSEAL hanging with high CPU usage


2.2 Problems fixed by patch 5.1.0-TIV-TAM-FP0036


   APAR IZ06867
   Symptom: RANDOM "HPDIA0202W AN UNKNOWN USER NAME" ERROR IN WAS LOGS

   APAR IZ18737
   Symptom: IBMJCE ERROR AFTER APPLYING FIXPACK 32
	    Could not login to WPM due to "access denied" in inserting
	    provider IBMJCE

   APAR IZ23833
   Symptom: PD.JAR SIGNER CERT EXPIRED ON MARCH 05 2008
	    Certificate used to sign TAM's PD.jar file has expired on
	    March 05, 2008


2.3 Problems fixed by patch 5.1.0-TIV-TAM-FP0034

   APAR IZ18104
   Symptom: cannot receive certificate using gsk5cmd

   APAR IY08511
   Symptom: <event> tag not closed by </event> tag in audit.log, possible
            webseald core

   APAR IZ09612
   Symptom: pdmgrd core when removing users when using eDirectory

   APAR IZ09964
   Symptom: SPECIFYING MORE THAN 2 AUTHORIZATION SERVERS IN JAVA API 
             When specifying more than 2 entries for appsvr-authzsvrs in the 
             Java Application's properties file and the first two are down
             or otherwise inaccessible, the failover does not use the 3rd 
             Authorization server or beyond.

   APAR IZ04038
   Symptom: TAM resource managers cannot do auto-refresh of certificate 
             when secCertDn attribute values change cases.

   APAR IZ04279
   Symptom: Performance problems may be experienced when using the
             "Delegate Administration" feature of Web Portal Manager.

   APAR IZ09965
   Symptom: In Windows Only, sometimes a patch image does not overwrite
             existing files.


2.4 Problems fixed by patch 5.1.0-TIV-TAM-FP0032

    APAR IY99421
    SYMPTOM: Memory leak when using administrative API calls
             ivadmin_context_createdefault2()/ivadmin_free()

    APAR IY99423
    SYMPTOM: Memory leak when using administrative API call
             ivadmin_protobj_get3()

    APAR IY95460
    SYMPTOM: PDMGRD coredump under rare conditions

    APAR IY99307
    SYMPTOM: Request log lines concatenated without newlines when entry
             is exactly 512 bytes long

    APAR IY99285
    SYMPTOM: If rollover_size option is not specified with the logcfg
             parameter, then a default value of zero is used instead of
             the documented default of 2mb.


2.5 Problems fixed by patch 5.1.0-TIV-TAM-FP0030

    APAR IY95004
    SYMPTOM: Attempt to create sub-domain via WPM's delegate interface fails.
             The WPM/Delegate tool reports error "HPDMG0767E The
             Distinguished Name (DN) has an invalid syntax.  (0x14c012ff)"
             when trying to create a subdomain.

    APAR IY95312
    SYMPTOM: After migration from AM410 to AM510, "Bypass Authzrule" action
             bit "R" was not created.

    APAR IY95392
    SYMPTOM: Additional documentation details required for svrsslcfg usage.

    APAR IY96076
    SYMPTOM: sec_master password is rejected during WPM configuration after
             application of fixpack 26.

    APAR IY96548
    SYMPTOM: Additional documentation required for clarification of output
             of "object show" command for objects in dynamic objectspace.

    Internal CMVC Defect: 75153
    SYMPTOM: When IBM Directory Server is configured to return a limited
             number of members of a group (on group show-members), Access
             Manager will display a message indicating entry not found.
             This situation most often occurs when using dynamic groups
             which resolve into a large number of members.  

    APAR IY90440
    SYMPTOM: PDACLD_CONFIG FAILS IF LDAP DOES NOT ALLOW ANONYMOUS BINDING.

    APAR IY90753
    SYMPTOM: ADD CURRENT CONTEXT COUNTER FROM REMOTE APPS INTO TRACING LOG
             Users will get errors related to lost or expired sessions.
             This is most often reported when using Java applications.
             Errors can occur in either pdmgrd  or pdacld.

    APAR IY91112
    SYMPTOM: Stability fixes for WebSEAL

    APAR IY91387
    SYMPTOM: Stability fixes for WebSEAL

    APAR IY92739
    SYMPTOM: Stability fixes for PDOSOBJSIG

    APAR IY94045
    SYMPTOM: INCORRECT VERSION OF TAM RUNTIME

    APAR IY94711
    SYMPTOM: ERROR HPDAC1660W DOES NOT IDENTIFY FILE
             Error HPDAC1660W should also display used configuration file
             but it does not.

    APAR IY80755
    SYMPTOM: Customer can run into performance problems with the Policy
	     Server if they use excessive PDContexts in their remote
	     Java API applications. 

    APAR IY85135
    SYMPTOM: Validation of certificate has shifted 10 Hours early.
	     Fixed in GSKit Level of 7.0.3.27

    APAR IY87263
    SYMPTOM: Stability fixes for WebSEAL

    APAR IY87263
    SYMPTOM: Performance problem with portal-map setting.

    APAR IY87857
    SYMPTOM: Windows policy proxy server not contained in patch.

    APAR IY88988
    SYMPTOM: Stability fixes for Authorization Server (PDACLD)

    APAR IY90253
    SYMPTOM: WPM should handle properly when LDAP_SIZELIMIT_EXCEEDED return
	     code is returned when a dynamic group resolve to membership that
 	     exceed LDAP_SIZELIMIT.

    APAR IY90959
    SYMPTOM: The pdbackup program can hang if user creates and then deletes
	     domains with pdadmin.  This leaves an empty domain = string in the 
	     ivmgrd.conf file.

    APAR IY91913
    SYMPTOM: WPM's  performance issues with users and large user groups with
	     WPM Delegate interface.


2.6 Problems fixed by patch 5.1.0-TIV-TAM-FP0026

    APAR IY77336
    SYMPTOM: Memory leak occurs when a custom credential attribute entitlement
             service is configured when users with no entitlements
             authenticate.

    APAR IY81791
    SYMPTOM: Web Portal Manager delegate admin search for a specific user
             is very slow.

    APAR IY84130
    SYMPTOM: TAM Runtime Configuration with SSL with Active Directory may
             fail after Windows 2003 SP1 is installed.

    APAR IY84481
    SYMPTOM: Extended credential attributes not passed to chained cdas in 510
             release

    APAR IY74590
    SYMPTOM: After migration from WebSEAL 41 to WebSEAL 51 svrsslcfg -chgcert
             command does not work for migrated instance of webseal.

    APAR IY85006
    SYMPTOM: CRL checking takes a long time, slow performance.

    APAR IY86211
    SYMPTOM: LTPA token not generated when using a CDAS and Active Directory
             as registry.

    Internal CMVC Defect: 57798
    SYMPTOM: Implement AMJRTE certificate auto-refresh


2.7 Problems fixed by patch 5.1.0-TIV-TAM-FP0024

    APAR IY79206
    SYMPTOM: Webseald failing, and producing core file.	The nature of the 
             problem is a memory leak in the webseald process which 
             eventually causes it to run out of memory and fail. The 
             websealds are configured to use failover cookies, and to use 
             tag/value support for several LDAP attributes.  When a failover 
             event occurs, it appears that webseald leaks memory.  

    APAR IY79403
    SYMPTOM:  If a user changes their password using Web Portal Manager (WPM)
              the asterisks are not cleared from the password and verify 
              password text fields.  So, the user is not sure if the password 
              change took place or not. 

    APAR IY80572
    SYMPTOM: TAM Base FixPack for Solaris Platform does not include the  
             FixPack for PDMgrPrxy i.e. Policy Server Proxy. 

    APAR IY80970
    SYMPTOM: Access Manager Runtime for Java documentation indicates that ranks
             can be specified for multiple authorization servers, but does not 
             indicate how these ranks work

    APAR IY81006
    SYMPTOM: When "ivmgrd/master" Daemon ID fails to get LDAP handle due to 
             password problem, Policy Server does not log a  meaningful error 
             in the log file. 

    APAR IY81206
    SYMPTOM:  README:GSO DATA NOT ACCESSIBLE WHEN RUNNING IN A MIXED 4.1/5.1

    APAR IY81231 
    SYMPTOM: The process pdacld seems unresponsive when under a medium/high 
             load while a pdadmin update command is running (i.e creating a 
             object space).  Only stopping and starting resumes service.

    APAR IY81519
    SYMPTOM: When Policy Server is configured against Active Directory 
             Multi-Domain environment, attempt to create Enterprise Domain via
             WPM's delegate interface fails.

    APAR IY81577
    SYMPTOM: Right after upgrade/migration from TAM4.1 to TAM5.1, any GSO 
             Credentials of type "web" created using WPM for a  user shows up 
             as "group" credentials. Even "pdadmin> rsrccred list user userID" 
             indicate the credentials as of type "group" The same problem can 
             happen via pdadmin too.

    APAR IY81839
    SYMPTOM: Web Portal Manager is unable to handle locale variants for help 
             pages. For example, if a browser tries to use en_US or en_CA, 
             it should return the help pages for "en".  However, instead, 
             a 404 error is returned. 

    APAR IY81883
    SYMPTOM:   On AIX 5.2 only, when using the piped logging feature of 
               TAM 5.1, system performance is adversely affected.

    APAR IY81998
    SYMPTOM: After migration from 3.9 or 4.1 to 5.1, any new 5.10  WebSEAL 
             instances created after the migration, will not be  able to 
             access GSO Credentials created during 3.9 or 4.1  environment.

    APAR IY82210
    SYMPTOM: Webseal is unable to authenticate a user who doesn't have a user 
             policy and the ldap-client-timeout stanza of the 
             activedir_ldap.conf is set to anything other than 0. 

    APAR IY82960
    SYMPTOM: When doing a trace list on the pdadmin command, the pdweb.jct 
             component shows up. However, if that trace is enabled, nothing 
             is collected. 

    APAR IY83653
    SYMPTOM: When creating a new user using WPM, deselecting the 
             "Password Valid" option has no effect. 

    APAR IY84130
    SYMPTOM: Unable to configure PDRTE on Windows for AD_LDAP with SSL

    APAR IY85217
    SYMPTOM: IBM JCE's digital certificate that was used to sign the
             JCE jar file expired on May 18, 2006, after that IBM JCE
             will stop working.


2.8 Problems fixed by patch 5.1.0-TIV-TAM-FP0022

    APAR IY77838
    SYMPTOM: webseald core

    APAR IY78549
    SYMPTOM: Webseal does not show account expired message when account
             password is expired in IBM Directory Server

    APAR IY78821
    SYMPTOM: users can be deleted from Active Directory registry when
             an attempt to import a user fails

    APAR IY79049
    SYMPTOM: a more meaningful message needs to be returned when a new
             password violates Active Directory password policy during
             password change/reset from TAM

    APAR IY79330
    SYMPTOM: there is a limitation when using Active Directory registry
             that a user's login name (sAMAccountName attribute) and
             principle name (userPrincipalName attribute) must match

    Internal CMVC Defect 68166
    SYMPTOM: in a multiple domain Active Directory configuration,
             changes for IY79330 can break TAM authentication for a
             secondary domain


2.9 Problems fixed by patch 5.1.0-TIV-TAM-FP0020

    APAR IY74227    
    SYMPTOM: WPM cannot use GSO resources after migration fro 3.9 to 5.1

    APAR IY74250
    SYMPTOM: Webseal startup searches take a long time;
  	     customer had more than 3 millions users in an LDAP Suffix, 
	     WebSEAL was taking too long to startup (more than 3 min)

    APAR IY74590
    SYMPTOM: policy server allows "svrsslcfg -chgcert" command to create 
	     duplicate "seccertdn" entries in directory

    APAR IY74686
    SYMPTOM: need to return a more meaningful error message when a new
             password does not conform to Novell eDirectory's password 
	     policy.

    APAR IY74875
    SYMPTOM: WPM does not correctly display a large number of attributes

    APAR IY75368
    SYMPTOM: cannot start webseal with max-search-size=0

    APAR IY76125
    SYMPTOM: browsing a domain tree with more than 15 subdomains is not
             possible using WPM

    APAR IY76161
    SYMPTOM: com.tivoli.pd.jazn.PDPrincipal.addGroupMemberships() doesn't
             work with subdomains

    APAR IY76509 
    SYMPTOM: nested delegated subdomains greater than 4 subdomains with
             more than 15 domains within a subdomain will fail to be displayed

    APAR IY77669 
    SYMPTOM: need to ensure LDAP redrive capability during an LDAP timeout


2.10 Problems fixed by patch 5.1.0-TIV-TAM-FP0017

    APAR IY69436
    SYMPTOM: problem with roles in Web Portal Manager's delegated admin

    APAR IY70898
    SYMPTOM: changed the way we create passwords in AMWPMCFG to make it
             more secure

    APAR IY70952
    SYMPTOM: GSO update hangs policy server when LDAP master is down

    APAR IY71014
    SYMPTOM: PDADMIN config command doesn't handle negative numbers

    APAR IY71341
    SYMPTOM: Web Portal Manager unsets junction FSSO (-S) configuration

    APAR IY71695
    SYMPTOM: authentication problem for WASADMIN using the TAM for WAS

    APAR IY71734
    SYMPTOM: result of 'stats' for PDWEB.HTTP(ETC) is garbled in Japanese

    APAR IY71891
    SYMPTOM: unable to import users into TAM when the user's name contains
             certain non-English language characters

    APAR IY72875
    SYMPTOM: SSO to multiple junctions for the same user results in no
             single sign-on target for user error 0X38CF025B

    APAR IY73225
    SYMPTOM: svrsslcfg -chgcert -f doesn't work with Active Directory

    APAR IY73474
    SYMPTOM: WPM is showing the activation status of a Role of the Parent
             Domain instead of the Domain itself

    APAR IY74442
    SYMPTOM: IVRGY_TOOL cores in Solaris when called with -p bind_pwd


2.11 Problems fixed by patch 5.1.0-TIV-TAM-FP0015

    APAR IY61480
    SYMPTOM: Webseald cores when locale is set to ja_JP and client system has
             time set more than one hour different than server

    APAR IY66649
    SYMPTOM: under certain configurations, forms login attempt to WebSEAL
             while Policy Server machine is down produces incorrect error w/AD

    APAR IY67531
    SYMPTOM: the warning part of the pop show command is garbled

    APAR IY67711
    SYMPTOM: LDAP failover doesn't work on Active Directory

    APAR IY67759
    SYMPTOM: TAM MTS does not handle EAGAIN properly when polling a socket

    APAR IY67792
    SYMPTOM: WEB Portal Manager 5.1 requires junction attribute not created

    APAR IY68043
    SYMPTOM: a part of server show command output is garbled

    APAR IY68129
    SYMPTOM: WebSeal delays 25 seconds in connecting to a LDAP replica server
             if the Primary AD is down.

    APAR IY68974
    SYMPTOM: additional occurrences of IY54343 problem

    APAR IY69114
    SYMPTOM: PDACL.CREATEACL creates duplicate entries

    APAR IY69842
    SYMPTOM: PDBACKUP not backing up all files on Win 2003 Webseal server

    APAR IY70069
    SYMPTOM: WPM resets the REQUESTENCODING value on a junction

    APAR IY70608
    SYMPTOM: modifying Webseal junction using WPM doesn't work attempting to
             remove IV-USER option


2.12 Problems fixed by patch 5.1.0-TIV-TAM-FP0013

    APAR IY60342
    SYMPTOM: Object list of 4.1 WebSEAL with 5.1 PDMGR returns no data

    APAR IY60445
    SYMPTOM: Webseal crashes when customer users perform SSO using SAML
             integration guide from developerworks.

    APAR IY60943
    SYMPTOM: AZN_UTIL_PASSWORD_CHANGE does not work properly with
             Active Directory

    APAR IY62057
    SYMPTOM: Deleted users are not removed from groups using LDAP on Z/OS

    APAR IY62104
    SYMPTOM: Webseald coredump ( TAM 5.1 + FP 4 )

    APAR IY62725
    SYMPTOM: Stateful junction becomes NOT stateful if it is modified

    APAR IY62905
    SYMPTOM: TAM 5.1, W2K3, Active Directory fails to add or import user to
             different organizational units.

    APAR IY63900
    SYMPTOM: Can not change WebSeal password after upgrading to FP6 on Linux

    APAR IY63945
    SYMPTOM: After applying 8LA patch, ?(question marks) are appeared in yes
             or no portions of the result of pdadmin commands except 'policy
             get password-spaces'.

    APAR IY64840
    SYMPTOM: Authentication to Domino user registry causes performance issue
             on WebSeal

    APAR IY64846
    SYMPTOM: While installing a Patch, if you Click on "Cancel" button,
             re-install of the same patch fails with error saying
             "Access Manager is Running........."

    APAR IY65025
    SYMPTOM: Unable to delete GSO credentials after migration (55401)

    APAR IY65303
    SYMPTOM: Webseal event logging not generating principal entries

    APAR IY65344
    SYMPTOM: can not log stats via webseald.conf


2.13 Problems fixed by patch 5.1.0-TIV-TAM-FP0009

    APAR  IY53908
    SYMPTOM: white space within user names not translated properly by WPM

    APAR  IY55163
    SYMPTOM: the output of 'get password-spaces' is garbled

    APAR  IY55388
    SYMPTOM: silent install fails with java exception when using a response file
             with Tivoli Common Directory logging enabled

    APAR  IY55394
    SYMPTOM: Requesting long URL causes line wrap error in request.log

    APAR  IY58304
    SYMPTOM: With a hardened AIX environment pd_start gives error about time

    APAR  IY61707
    SYMPTOM: Once pdmgrd is restarted, upgraded webseald cannot receive new cert

    APAR  IY63064
    SYMPTOM: IPLANET user expiry is not handled

    APAR  IY63065
    SYMPTOM: GSO id/pw length issues

    Internal Defect 53220
    SYMPTOM: dispkdb tool cores in solaris for printf call with null string


2.14 Problems fixed by patch 5.1.0-TIV-TAM-FP0006

    APAR IY55001
    SYMPTOM: Webseal crashes when turn on the audit log (logaudit = yes) and
             password does not fit into the policy

    APAR IY59546
    SYMPTOM:  Login in via webseal resulted in "No Single Sign-On Target for
              User" after IDS is recycled

    APAR IY59547
    SYMPTOM:  Webseal crashes when turn on the audit log and password does not
              fit into the policy

    APAR IY59548
    SYMPTOM:  A Regression of 25187: Encode Gso password for iPlanet

    APAR IY59549
    SYMPTOM:  WPM 5.1 behaves differently than pdadmin with regards to object
              browse when a nested acl states you do not have permission.


2.15 Problems fixed by patch 5.1-TAM-FP04

    APAR IY53464
    SYMPTOM:  TAM 5.1 user password expiry issue with W2003 and AD

    APAR IY54130
    SYMPTOM: pdmgr crashes when deleting a gso user with gskit tracing enabled

    APAR IY54171
    SYMPTOM: AD user, imported to TAM, whose "Password never expired" checkbox
             is unchecked and access webseald more than max-login-failures
             times with bad password causes webseald to crash.

    Internal CMVC DEFECT: 46503
    SYMPTOM:  Webseal is allowed to login without DomainName for AD-LDAP

    Internal CMVC DEFECT: 49847
    SYMPTOM:  URAF Global policy cache entry not timing out


2.16 Problems fixed by patch 5.1-TAM-FP02

    APAR IY51619
    SYMPTOM: User import from Active Directory fails when user-dn contains an
             apostrophe.

    APAR IY53009
    SYMPTOM: Unable to create a new Key Database file with GSKit 7 after 1/08

    Internal CMVC Defect 42136
    SYMPTOM: New suffix not detected if partial match. When a user is created,
             Tivoli Access Manager checks the user's suffix and adds it to
             the search list if it is new. Sometimes a new suffix is not
             recognized because it appears to be an existing suffix.

    Internal CMVC Defect 44312
    SYMPTOM: In Web Portal Manager, when "Search Groups" is selected, the DBCS
             group name is not displayed completely.

    Internal CMVC Defect 44321
    SYMPTOM: HP-UX only: Wrong default port given during configuration of the
             policy proxy server using the installation wizard. The correct
             default administration request is 7139.

    Internal CMVC Defect 44357
    SYMPTOM: Intermittent SPNEGO failures on UNIX

    Internal CMVC Defect 44371
    SYMPTOM: WebSEAL crashes when using Active Directory LDAP and experiencing
             Active Directory server problems.

    Internal CMVC Defect 44569
    Reinstating deprecated methods - createProtObject, createPop, createAcl

    Internal CMVC Defect 45011
    SYMPTOM: Linux only: pdmgr_ucf utility does not remove .configure files.

    Internal CMVC Defect 45131
    SYMPTOM: Tivoli Access Manager does not successfully configure with
             novschema.def using Novell eDirectory 8.6.2 or 8.7.


3.0 BEFORE INSTALLING THIS PATCH
--------------------------------
Before installing this patch, review the following prerequisites and
dependencies.


3.1 Back up Tivoli Access Manager data

Before applying any maintenance, be sure to back up your system.  Use
the pdbackup command provided with the Tivoli Access Manager product
to back up Tivoli Access Manager-specific data.  Documentation for the
pdbackup command is located in the "IBM Tivoli Access Manager Command
Reference, Version 5.1."


3.2 Upgrade GSKit to Version 7.0.4.11

Upgrade the IBM Global Security Toolkit (GSKit) to version 7.0.4.11
BEFORE installing the Tivoli Access Manager packages in this patch.

The updated GSKit installation packages may be downloaded at the URL:

   https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=gskitupdt&S_PKG=GSKit_7.0.4.11

After downloading the updated GSKit installation packages, use the
following instructions to install the upgraded GSKit packages.  The
commands assume that you are in the directory where the GSKit installation
packages are located and are running as root on UNIX systems and as
Administrator on Windows systems.


3.2.1 To upgrade GSKit on AIX:

   1. Install the patch:
        for 32 bit
        installp -a -X -g  -d  . gskta.rte

        for 64 bit also install
        installp -a -X -g  -d  . gsksa.rte

   2. From the command line, run the following commands to stop and
      restart the Tivoli Access Manager processes:

        pd_start stop
        pd_start start

   3. Confirm that the upgrade was successful by following the
      instructions in the "Confirm That GSKit Was Updated" section.


3.2.2 To upgrade GSKit on HP/UX:

   1. Uncompress and extract the file from gsk7bas.tar.Z

   2. Install the patch:

      swinstall -s $PATH/gsk7bas gsk7bas

      where $PATH is the directory with gsk7bas package.

   3. Ensure that you set and verify that the following path has
      been set in your .profile:

      SHLIB_PATH=/usr/lib
      To set this path, enter the following command:
      export SHLIB_PATH=/usr/lib;$SHLIB_PATH

      After you install GSKit, no configuration is necessary.
      Note that the SHLIB_PATH is only required to run the iKeyman
      key management utility (gsk7ikm), which is installed with the
      GSKit package. This enables you to create key databases,
      public-private key pairs, and certificate requests. For more
      information about gsk7ikm, see the Secure Sockets Layer
      Introduction and iKeyman User’s Guide.

   4. From the command line, run the following commands to stop
      and restart the Tivoli Access Manager processes:

        pd_start stop
        pd_start start

   5. Confirm that the upgrade was successful by following the
      instructions in the "Confirm That GSKit Was Updated" section.


3.2.3 To upgrade GSKit on Linux:

   1. Install the patch:

      At the command prompt, enter the following:

      rpm -U <patchname>

       where <patchname> is one of the following:

       Linux on xSeries(R)
            Red Hat
           gsk7bas-7.0.4.11.i386.rpm

            Suse SLES8
           gsk7bas-7.0.4.11.i386.rpm

       Linux on zSeries

           gsk7bas-7.0.4.11.s390.rpm

       Linux on pSeries(R) and iSeries

           gsk7bas-7.0.4.11.ppc32.rpm


       If Tivoli Access Manager is already configured, you
       might need to install with the --noscripts flag:

       rpm -U --noscripts <patchname>



   2. From the command line, run the following commands to stop
      and restart the Tivoli Access Manager processes:

        pd_start stop
        pd_start start

   3. Confirm that the upgrade was successful by following the
      instructions in the "Confirm That GSKit Was Updated" section.


3.2.4 To upgrade GSKit on Solaris:

   1. Uncompress and extract the file from gsk7bas.tar.Z

   2. Install the patch:

      pkgadd -a none -d . gsk7bas

      a. Answer 'y' when asked whether to overwrite an
         installed instance directory

      b. When prompted for a package base directory,
         enter /opt if GSKit is installed in the default
         location. Otherwise, specify the appropriate
         location.

   3. From the command line, run the following commands to stop
      and restart the Tivoli Access Manager processes:

        pd_start stop
        pd_start start

   4. Confirm that the upgrade was successful by following the
      instructions in the "Confirm That GSKit Was Updated" section.


3.2.5 To upgrade GSKit on Microsoft Windows:

    ### If installing 5.1.0-TIV-TAM-LA0016 ONLY,
    ### read KNOWN PROBLEMS AND WORKAROUNDS 9.12
    ### before doing this upgrade!

   1. Extract the GSKit upgrade package:

      gsk7bas.exe gsk7bas
      cd gsk7bas

   2. Use the following command to upgrade GSKit:

          setup gsk7 <location> -sf1".\setup.iss"

      where <location> is the drive and parent directory to your
      desired GSKit install location.

      NOTE: The GSKit installation program does not recognize spaces
            in the <location> string. Therefore, if GSKIT was
            originally installed in:

               C:\Program Files\ibm\gsk7

            you must specify the location using the following
            syntax, which eliminates the spaces:

               C:\Progra~1\ibm\gsk7

            The complete command for this example would be:

              setup gsk7 c:\Progra~1\ibm\gsk7 -sf1".\setup.iss"

      After entering the setup command, an InstallShield window
      is displayed. Follow the installation directions. In the window
      where you are prompted for the destination location, you must
      change the default location from:

            C:\Program Files\ibm\gsk7
      to:

            C:\Progra~1\ibm\gsk7

      or to whatever install location is applicable.

   3. Shut down and reboot the system.

   4. Confirm that the upgrade was successful by following the
      instructions in the "Confirm That GSKit Was Updated" section.


3.2.6 Confirm That GSKit Was Updated

After upgrading to the version of GSKit included with this patch,
the GSKit PRODUCT VERSION should be 7.0.4.11 for ALL components
of the GSKit toolkit.

To determine the version of GSKit installed, use the following
command on any platform:

      gsk7ver

NOTE:  On HP-UX, you might need to add the following path in your
       profile for the above command to work:

                SHLIB_PATH=/usr/lib


3.3 Upgrade IBM JCE to resolve Digital Certificate Expiry issue
    affecting IBM JDK 1.3.1 (IY85217)

 Overview: 
 IBM JDK Version 1.3.1 as well as Tivoli Access Manager Java 
 Runtime contain an older version of IBM Java Cryptographic Engine 
 (JCE) that is signed with a digital certificate that expired at 
 approximately 10PM GMT, May 18, 2006. This impacts standalone 
 JVM implementations and WebSphere Application Server (WAS). 
 IBM JDK 1.4.* is not affected by this issue.

 Details of the expiry can be found at:
 http://www-128.ibm.com/developerworks/java/jdk/alerts/


3.3.1 Components affected.

 a) TAM Web Portal Manager (WPM) runs on WAS and may be affected.
 b) If a customer has their own custom applications using the 
    ITAM Java API and TAM Java runtime (pdjrte), such as Java
    applications making TAM Java API calls, they also need to 
    check the JVM that those applications are using.	

 c) Some IDS and GSKit versions are also affected, so if you're 
    using SSL to connect to the ITIM LDAP, you should check the 
    Java being used by Gskit under IDS.


3.3.2 How to check the JRE for each components and take remedial
      action.

 a) ITAM WPM's WebSphere Application Server (WAS) version.

    Check for WAS Version:

    To find the WAS version, look at the SystemOut.log file. 
    There will be startup messages at the begining of the file 
    that shows the WAS version as well as the Java version. 
    If the WAS version is 5.0.2.4 or less, there could be 
    problems with the JCE.

    Do the following to check the JCE version under the WAS 
    being used: 

    For JRE used by each instance of Application Servers, 
    check the Build-Level or Implementation-Version 
    (depending on the JCE version) in the MANIFEST.MF from 
    the ibmjcefw.jar which is located in 
    install_root/java/jre/lib/ or 
    install_root/java/jre/lib/ext depending the version of 
    WebSphere. 
    To do this check:
      Open the jar file using jar (e.g. jar xvf ibmjcefw.jar) 
      or tar/unzip
      View the file MANIFEST.MF
      The top few lines of the manifest should look something 
      like the following:

      Manifest-Version: 1.0
      Name: javax/crypto/spec/ javax/crypto/interfaces/ javax/crypto/
      IBM-Reusable-JVM-Compatible: True
      Created-By: 1.2.2 (IBM Corporation)
      Implementation-Vendor: IBM Corporation
      Implementation-Version: 1.00, Build_011214
      Implementation-Title: IBM Java(tm) Cryptography Extension Package

    The key information is the date found in Implementation-Version 
    and Build-Level or just Level. In this example it is 011214 i.e. 
    Dec 14, 2001. 
    If it is dated 040219 (19 February 2004) or later then that
    JRE will not be affected by the certificate expiration issue
    and no further action will be necessary for that JRE.

    Note: 
    The keytool.exe displays the certificate as only being 
    valid until 18 May 2006. This is not an issue once the solution 
    has been applied. JCE specification has changed its signed jar 
    verification routine to accept signed jars with legitimate 
    certificates even if the certificate has expired. 
    As a result, JCE services will not be disrupted even if the 
    signer's certificate for a JCE provider has expired.

    Upgrade WAS if necessary:
    If the IBM JCE Build Level is earlier than  040219 
    (19 February 2004) then that particular JRE will need to be 
    upgraded.

    There are two steps to upgrading WAS with WPM:
    1. Upgrade the WAS software and
    2. Reconfigure WPM following the WAS upgrade.

    Upgrade WAS

    TAM 5.1 ships with WAS 5.0.2. To upgrade this version, 
    the WAS Flash lists three upgrade options 
    (see: http://www-1.ibm.com/support/docview.wss?uid=swg21236118) 
    but it is recommended to go to the latest WAS 5.0.2 fixpack. 

    Customers should upgrade to 5.0.2.17. This fix can be found at:
    http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27006881#50217

    Once the customer has upgraded WAS, there are additional steps 
    needed to reconfigure WPM.

    Reconfigure WPM:
    After upgrading WAS to 5.0.2.17, WPM should not be accessed and WPM
    needed to be re-configured, to do this:
    1. Unconfigure pdwpm (using amwpmcfg -action unconfig -interactive)
    2. Copy the TAM PD.jar file from the TAM java directory (such as 
       C:\Program Files\Tivoli\Policy Director\java\export\pdwpm 
       or /opt/PolicyDirector/java/export/pdwpm) 
       to the WAS java\jre\lib\ext library.
    3. Configure pdwpm (using amwpmcfg -action config -interactive)

    There should be no need to reconfigure the pdjrte.

    Now WPM is ready and can be accessed as usual.

 b) JVM used by any Custom Java Apps using the ITAM Java API.	

    Customers may have written their own applications using the ITAM 
    Java API. If so, they will need to determine which JRE they are 
    using and whether that JRE needed to be updated or not.

    Checking and Upgrading the version of the JCE in any standalone 
    JRE:
      Open the ibmjcefw.jar using the jar command 
      (e.g. jar xvf ibmjcefw.jar) or tar/unzip. This should be done 
      in a safe/harmless location (e.g. copy the ibmjcefw.jar file to 
      /tmp and unjar there).
      View the file MANIFEST.MF

      The top few lines of the manifest should look something like
      the following:

      Manifest-Version: 1.0
      Name: javax/crypto/spec/ javax/crypto/interfaces/ javax/crypto/
      IBM-Reusable-JVM-Compatible: True
      Created-By: 1.2.2 (IBM Corporation)
      Implementation-Vendor: IBM Corporation
      Implementation-Version: 1.00, Build_011214
      Implementation-Title: IBM Java(tm) Cryptography Extension Package

      The key information is the date found in Implementation-Version 
      and Build-Level or just Level. In this example it is 011214 i.e.
      Dec 14, 2001. If it is dated 040219 (19 February 2004) or later 
      the customer will be unaffected by the certificate expiration 
      issue.
      If it is dated earlier than 040219, then IBM JCE needed to be 
      updated and new JCE can be downloaded from the following URL:

      https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?\
      source=gskitupdt&S_PKG=ibmjceprovider.zip 

      Download ibmjceprovider.zip, unzip it in a temporary location,
      backup the lib/ext directory of the JRE being updated, copy
      all the jar files over to the lib/ext directory of the JRE.


 c) ITAM directory server JVM used by Gskit.

    The ITDS server and client do not use Java. All SSL communication 
    for ITDS is performed by GSKit and this is not an exposure with this 
    issue.
    With ITDS 5.1 and greater the UI is provided by the IDSWebApp which 
    is a Java application that runs on WAS or WAS Express. The application 
    itself does not make Java security calls, but WAS may be doing so on 
    its behalf. Follow the steps described in Section A: whether WAS
    Express needed IBM JCE upgrade or not.
   
    GSKit does not ship its own Java, it uses the Java already installed 
    on the server. The current versions, v7 and v6, can use Java 1.3 or 
    above. Only the Java components, the user-driven UI (such as gsk7ikm) 
    and command line (such as gsk7cmd) interface, are affected. 

    Find out which JRE is being used by gsk7ikm/gsk7cmd and follow the 
    same procedure as outlined for "Checking and Upgrading the version 
    of the JCE in any standalone JRE" above.


4.0 INSTALLING THIS PATCH
-------------------------
  NOTE: Before installing this patch, be sure that you have reviewed the
prerequisites and have completed the backup procedure in section 3.0,
"BEFORE INSTALLING THIS PATCH".

If the Tivoli Access Manager product is distributed over multiple machines,
this patch must be applied to all Tivoli Access Manager systems within a
secure domain.

This README assumes that $PATCH (or %PATCH% for Windows) is the path to
your temporary directory.


4.1 Installing this patch on AIX systems

  1. Log in to the system as root.

 2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the Tivoli Access Manager processes.

     a.  Stop the processes associated with Tivoli Access Manager for
         Operating Systems, if that product is installed:

           rc.osseal stop

     b.  Stop the processes associated with Tivoli Access Manager for
         Business Integration, if that product is installed.

     c.  Stop the Tivoli Access Manager Base and WebSEAL processes:

         /opt/PolicyDirector/bin/pd_start stop

  4. At the command prompt, enter the following:

       installp -a -g -X -d $PATCH <package>

       where <package> is one of the following:

          PD.RTE       Specifies the Tivoli Access Manager Runtime
          PD.Mgr       Specifies the Tivoli Access Manager Policy Server
          PD.MgrPrxy   Specifies the Tivoli Access Manager Policy Proxy Server
          PD.Acld      Specifies the Tivoli Access Manager Authorization Server
          PD.AuthADK   Specifies the Tivoli Access Manager ADK
          PDJ.rte      Specifies the Tivoli Access Manager Java Runtime Env.
          PD.WPM       Specifies the Tivoli Access Manager Web Portal Manager

  5. Restart the Tivoli Access Manager processes:

       /opt/PolicyDirector/bin/pd_start start

  6. Restart the processes associated with other Tivoli Access Manager
     products stopped in step 3.


4.2 Installing this patch on HP-UX systems

   1. Log in to the system as root.

   2. Extract the archive into a temporary directory.  For the
      purpose of this README, assume that the symbol $PATCH
      points to this temporary directory.

   3. Stop the Tivoli Access Manager processes.

     a.  Stop the processes associated with Tivoli Access Manager for
         Operating Systems, if that product is installed:

         rc.osseal stop

     b.  Stop the processes associated with Tivoli Access Manager for
         Business Integration, if that product is installed.

     c.  Stop the Tivoli Access Manager Base and WebSEAL processes:

         /opt/PolicyDirector/bin/pd_start stop

   4. At the command prompt, enter the following:

        swinstall -s $PATCH/<package> <patch>

        where <package> and <patch> are one of the pairs
        from the following table:

             <package>                             <patch>
        ------------------------                -------------
        PDRTE000510-38.depot                       PDRTE
        PDMGR000510-38.depot                       PDMgr
        PDMGRPRXY000510-38.depot                   PDMgrPrxy
        PDACLD000510-38.depot                      PDAcld
        PDAUTHADK000510-38.depot                   PDAuthADK
        PDJRTE000510-38.depot                      PDJrte
        PDWPM000510-38.depot                       PDWPM


  5. Restart the Tivoli Access Manager processes:

     /opt/PolicyDirector/bin/pd_start start

  6. Restart the processes associated with other Tivoli Access Manager
     products stopped in step 3.


4.3 Installing this patch on Linux systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the Access Manager processes.

     a.  Stop the processes associated with Tivoli Access Manager for
         Operating Systems, if that product is installed:

         rc.osseal stop

     b.  Stop the Tivoli Access Manager base and WebSEAL processes:

         /opt/PolicyDirector/bin/pd_start stop

  4. At the command prompt, enter the following:

       rpm -U <patchname>

       where <patchname> is one of the following:

       Linux on xSeries(R)

           PDRTE-PD-5.1.0-38.i386.rpm
           PDMgr-PD-5.1.0-38.i386.rpm
           PDMgrPrxy-PD-5.1.0-38.i386.rpm
           PDAcld-PD-5.1.0-38.i386.rpm
           PDAuthADK-PD-5.1.0-38.i386.rpm
           PDJrte-PD-5.1.0-38.i386.rpm
           PDWPM-PD-5.1.0-38.i386.rpm

       Linux on zSeries

           PDRTE-PD-5.1.0-38.s390.rpm
           PDMgr-PD-5.1.0-38.s390.rpm
           PDMgrPrxy-PD-5.1.0-38.s390.rpm
           PDAcld-PD-5.1.0-38.s390.rpm
           PDAuthADK-PD-5.1.0-38.s390.rpm
           PDJrte-PD-5.1.0-38.s390.rpm
           PDWPM-PD-5.1.0-38.s390.rpm

       Linux on pSeries(R) and iSeries

           PDAcld-PD-5.1.0-38.ppc.rpm
           PDAuthADK-PD-5.1.0-38.ppc.rpm
           PDJrte-PD-5.1.0-38.ppc.rpm
           PDWPM-PD-5.1.0-38.ppc.rpm


       If Tivoli Access Manager is already configured, you
       might need to install with the --noscripts flag:

       rpm -U --noscripts <patchname>

   5. Restart the Tivoli Access Manager processes:

        /opt/PolicyDirector/bin/pd_start start

  6. Restart the processes associated with other Tivoli Access Manager
     products stopped in step 3.


4.4 Installing this patch on Sun Solaris Operating Environment systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the Tivoli Access Manager processes.

     a.  Stop the processes associated with Tivoli Access Manager for
         Operating Systems, if that product is installed:

           rc.osseal stop

     b.  Stop the processes associated with Tivoli Access Manager for
         Business Integration, if that product is installed.

     c.  Stop the Tivoli Access Manager base and WebSEAL processes:

         /opt/PolicyDirector/bin/pd_start stop

  4. At the command prompt, enter the following:

       cd $PATCH
       patchadd <package>

       where <package> is one of the following:


             <package>                           <patch>
        ----------------------                ------------
        PDRTE000510-38                          PDRTE
        PDMGR000510-38                          PDMgr
        PDMGRPRXY000510-38                      PDMgrPrxy
        PDACLD000510-38                         PDAcld
        PDAUTHADK000510-38                      PDAuthADK
        PDWPM000510-38                          PDWPM
        PDJRTE000510-38                         PDJrte


        5. Restart the Tivoli Access Manager processes:

              /opt/PolicyDirector/bin/pd_start start

  6. Restart the processes associated with other Tivoli Access Manager
     products stopped in step 3.


4.5 Installing this patch on Windows systems

   1. Log in to the Windows system as the Administrator.

   2. Stop all Access Manager services.

      If the Web plug-in is being used:
         a. Click Start -> Settings -> Control Panel ->
            Administrative Tools -> Services, right-click
            Access Manager Plug-in for Web Servers and then
            click Stop.
         b. To confirm your action, click Yes.
         c. Stop the IIS server using the Internet Services Manager.

   3. Change to the patch directory and run the install command:

           cd %PATCH%
           5.1.0-TIV-TAM-FP0038-WIN.exe

      Note: If for any reason you have to reboot your system to
      complete this installation (for example, to overcome a
      shared DLLs problem), you might subsequently encounter a
      problem running the Web Portal Manager to access the console.
      If this happens, confirm that the WebSphere service is
      running. The WebSphere service is installed in manual startup
      mode and might not be running after a reboot.

   4. Restart Tivoli Access Manager services, including the Access
      Manager Policy Server and Authorization Server:

      From the Windows Desktop, click Start -> Settings -> Control Panel
      -> Administrative Tools -> Services, right-click the service name
      and then click Start. Repeat this for each Access Manager service.

      If the Web plug-in is being used:
         a. Click Access Manager Plug-in for Web Servers -> Start
         b. Start the IIS server using the Internet Services Manager.

   5. Restart the processes associated with other Tivoli Access Manager
      products stopped in step 2.


5.0 UNINSTALLING THIS PATCH
---------------------------

NOTE:  Uninstallation is not available on Microsoft Windows systems.

If the Tivoli Access Manager product is distributed over multiple machines,
uninstall this patch on those systems in the reverse order as it was applied.

To remove the patch on UNIX systems, perform the following steps.

   1. Log in to the system as root.

   2. Stop the Tivoli Access Manager processes.

     a.  Stop the processes associated with Tivoli Access Manager for
         Operating Systems, if that product is installed:

           rc.osseal stop

     b.  Stop the processes associated with Tivoli Access Manager for
         Business Integration, if that product is installed.

     c.  Stop the Tivoli Access Manager Base and WebSEAL processes:

         /opt/PolicyDirector/bin/pd_start stop

   3. At the command prompt, enter the following:

      On AIX, reject the applied patch:

         installp -r <package>

         where <package> is one of the following:

           PD.RTE
           PD.Mgr
           PD.MgrPrxy
           PD.Acld
           PD.AuthADK
           PD.WPM
           PDJ.rte

         Example:  installp -r PD.RTE


      On HP-UX, remove the patch:

         swremove <patch>

         where <patch> is one of the following:

            PDRTE
            PDMgr
            PDMgrPrxy
            PDAcld
            PDAuthADK
            PDWPM
            PDJrte

         Example:  swremove PDWPM


      On Linux, apply the previous patch level:

         rpm -U --oldpackage <old_package>

         where <old_package> is one of the following:

         Linux on xSeries

           PDRTE-PD-5.1.0-0.i386.rpm
           PDMgr-PD-5.1.0-0.i386.rpm
           PDMgrPrxy-PD-5.1.0-0.i386.rpm
           PDAcld-PD-5.1.0-0.i386.rpm
           PDAuthADK-PD-5.1.0-0.i386.rpm
           PDJrte-PD-5.1.0-0.i386.rpm
           PDWPM-PD-5.1.0-0.i386.rpm

         Linux on zSeries

           PDRTE-PD-5.1.0-0.s390.rpm
           PDMgr-PD-5.1.0-0.s390.rpm
           PDMgrPrxy-PD-5.1.0-0.s390.rpm
           PDAcld-PD-5.1.0-0.s390.rpm
           PDAuthADK-PD-5.1.0-0.s390.rpm
           PDJrte-PD-5.1.0-0.s390.rpm
           PDWPM-PD-5.1.0-0.s390.rpm

         Linux on pSeries and iSeries

           PDAcld-PD-5.1.0-0.ppc.rpm
           PDAuthADK-PD-5.1.0-0.ppc.rpm
           PDJrte-PD-5.1.0-0.ppc.rpm
           PDWPM-PD-5.1.0-0.ppc.rpm


      On Solaris, remove the patch:

         patchrm  <package>

         where <package> is one of the following:

            PDRTE000510-38
            PDMGR000510-38
            PDMGRPRXY000510-38
            PDACLD000510-38
            PDAUTHADK000510-38
            PDWPM000510-38
            PDJRTE000510-38

         Example:  patchrm PDRTE000510-38

   4. Restart the Tivoli Access Manager processes:

          /opt/PolicyDirector/bin/pd_start start

   5. Restart the processes associated with other Tivoli Access Manager
      products stopped in step 2.


6.0 AFTER INSTALLING THE PATCH
------------------------------
Complete the following tasks after you have installed the patch.


6.1 Verifying patch level

To verify the patch level of your Tivoli Access Manager installation,
do the following.

   On AIX:      lslpp -L PD\*

   On HP-UX:    swlist <package>, example: swlist PDWeb

   On Solaris:  showrev -p

   On Linux:    rpm -q -i PDRTE-PD

   On Windows:  1. run 'regedit'
                2. find \HKEY_LOCAL_MACHINE\
                            SOFTWARE\
                               Tivoli\
                                  Policy Director Management Server\
                                     5.1\

You also can use the pdversion command.


6.2 Adding new components to a system

To install a new component of Tivoli Access Manager on an EXISTING
machine in the Tivoli Access Manager environment after this patch has
been installed:

   1. Install the component using the Tivoli Access Manager Version 5.1
      installation media.

   2. After the new component is installed, reapply this patch to the system.


6.3 WPM post-install steps (IY87189)

If WPM is configured, you need to perform the following steps to complete the
install of this patch for WPM:
    1. Unconfigure pdwpm (using amwpmcfg -action unconfig -interactive)
    2. Configure pdwpm (using amwpmcfg -action config -interactive)


7.0 DOCUMENTATION UPDATES
-------------------------
The product documentation for Tivoli Access Manager for e-business, Version 5.1,
can be found at the following Web address:

  http://publib.boulder.ibm.com/tividd/td/IBMAccessManagerfore-business5.1.html

Updated information related to the documentation is as follows.


7.1 IBM Tivoli Directory Server 5.2 does not support Trusted Solaris, Version 8
   (45727)

The Tivoli Access Manager release notes and installation guides incorrectly
state support of Trusted Solaris 8 for IBM Tivoli Directory Server,
Version 5.2. IBM Tivoli Directory Server, Version 5.2, is supported on Sun
Solaris Operating Environment, Versions 2.8 and 2.9.


7.2 azn_cred_ldap_dn corrections in Authorization C API Dev Ref (45019)

"Authorization C API Developer Reference" error:

The table in Chapter 5 that lists deprecated attributes has an incorrect entry.
The replacement attribute for the azn_cred_ldap_dn should be
azn_cred_registry_id.

The deprecated attribute azn_cred_ldap_dn should be removed from the attribute
lists in the following sections:

  - Chapter 4 "Modifying the contents of a credential" and "Setting and getting
    string attribute values for a credential"
  - Reference pages for azn_creds_modify(), azn_creds_get_attr_value_string()
    and azn_svc_creds_modify()


7.3 Tuning suffix search order does not match the ldap.conf file (43928)

With IBM Tivoli Directory Server 5.x, the returned order of suffixes is the
same as the order in the ldap.conf file. Tivoli Access Manager dynamically
adjusts the search ordering of the LDAP suffixes used to locate users in the
LDAP directory tree during authentication. You can reduce the number of suffix
search operations and improve performance by minimizing the number of suffixes
that exist in the directory server.

Although it is not recommended that you modify the LDAP suffix search order,
there are tuning options applicable to any LDAP directory server supported
by Tivoli Access Manager, for example, the IBM Directory Server.

For instance, you can configure those suffixes that do not contain
Tivoli Access Manager users or groups and should not be searched.
This is controlled by the ignore-suffix parameter setting in the ldap.conf
configuration file.

UNIX:     /opt/PolicyDirector/etc/ldap.conf
Windows:  <pd_install_dir>\etc\ldap.conf

By default, the ldap.conf file contains an ignore-suffix parameter setting to
ignore the following suffix: cn=ibmpolicies

Using an ordered list of suffixes, Tivoli Access Manager finds a user by
searching each suffix in the list, in order, and stopping when a match is found.
The ordering of the suffix list is periodically adjusted through incrementing
suffix counters. The default adjustment uses a most frequently used approach
in which the suffixes are sorted from highest to lowest suffix counter value.

The following environment variables are provided to control the search ordering
algorithm:

PD_SUFFIX_TRIGGER_COUNT
Default: 10

Acceptable values: a positive integer
This environment variable controls how often the search list is adjusted. When
any suffix counter reaches this value, the suffix search list is adjusted and
all counters are reset to zero.

PD_SUFFIX_MAX_ITERATIONS
Default: -1
Acceptable values: -1, 0, or a positive integer

This environment variable defines the maximum number of consecutive executions
of the adjustment algorithm that results in no change to a suffix search list.
Any execution of the adjustment algorithm that changes the suffix search list
resets the iteration count to zero. A value of -1 indicates no limit to the
number of adjustments. A value of 0 indicates no adjustments. With no
adjustments,the order of the suffix search list is statically initialized to
the order in which the LDAP server returns the set of suffixes it maintains.

PD_SUFFIX_ORDERING_BUBBLE
Default: most frequently used adjustment algorithm
Acceptable values: any, must simply be defined

If defined, this environment variable replaces the most frequently used default
adjustment algorithm with one that places the suffix with the highest counter
value at the front of the list, leaving the remaining order of the list
unchanged.

7.4 Installation instructions for Tivoli Identity Manager (APAR IY53027)

Additional instructions are necessary for "Installation where Tivoli Identity
Manager is not installed" on page 50 of the "IBM Tivoli Identity Manager
Provisioning Fast Start Guide."

JAAS must be configured prior to installing the Web Application Sample on a
system on which Tivoli Identity Manager is not installed. Follow these
instructions to first set up JAAS properly:

    1. Locate the following JAAS configuration files:

     ITIM_HOME/extension/examples/apps/jaas_login_was.conf (WebSphere)
     ITIM_HOME/extension/examples/apps/jaas_login_wls.conf (WebLogic)

     These files contain the values that are necessary for the JAAS
     configuration.

    2. Using the WebSphere Administration Console, click Security ->
       JAAS Configuration -> Application Logins to add a new JAAS alias.

       Using the values from the jaas_login.was.conf or jaas.login.wls.conf
       files, specify the following values:

       Alias: ITIM
       Jaas Login Module: com.ibm.ws.security.common.auth.module.proxy.
       WSLoginModule Authentication Strategy: Required Custom Property:
       delegate = com.ibm.itim.aps.jaas.spi.PlatformLoginModule

       After you have set the JAAS configuration, continue with the existing
       steps in the guide that detail how to install the Sample when Tivoli
       Identity Manager is not installed.


7.5 WebSphere Application Server 5, fix pack 2 installation (APAR IY52954)

In the Base and Web Security Installation Guides in the "Installing WebSphere
Application Server, fix pack 2" sections for AIX and HP-UX platforms, the
JAVA_HOME variable must be set to the 'java' directory under the WAS directory
structure.  For example:

export JAVA_HOME=usr/WebSphere/AppServer/java

Do not specify the /opt/ directory as instructed in the installation guide.

To set this variable correctly, you can either export the JAVA_HOME variable
or run the setupCmdLine script before running the updateWizard.


7.6 Supported JREs (45682)

In the "Authorization Java Classes Developer Reference" in the JRE requirements
section on page 3, it states "You also can choose to use any of the supported
JREs listed in the IBM Tivoli Access Manager for e-business Release Notes for
developing and deploying your Tivoli Access Manager Java applications."

This statement is incorrect. Supported JREs are not listed in the release
notes. Tivoli Access Manager for e-business, Version 5.1, supports IBM JRE,
Version 1.3.1 (IBM JRE 1.3.1.5 on AIX) and JRE 1.4 as described in the
"Base Installation Guide."


7.7 Solaris Operating Environment 9 patch correction (47108)

The Version 5.1 release notes and installation guides state that patch 11711-06
is a required patch for Solaris Operating Environment 9. This patch number
should read: 111711-06.

7.8 Base Install Guide IDS 5.2 no support on HPUX11 (IY53018)

Although Tivoli Access Manager 5.1 is supported on both HP-UX 11 and HP-UX 11i,
the IBM Tivoli Directory Server 5.2 is supported only on HP-UX 11i. It is
important to consider this while planning installation of Tivoli Access
Manager on HP-UX 11.

7.9 Language Pack needs to be installed after WPM (IY53162)

If you are installing Web Portal Manager on a system, you will have to install
the language support package AFTER the installation of Web Portal Manager.
Attempting to install the language support package before running the
installation wizard for Web Portal Manager will fail without error.

The language pack always must be installed AFTER WPM installation.

The reason is the directory that the language packs are installed into only
exist after WPM is installed.

7.10 AM 5.1 for Red Hat Enterprise Linux 3.0 is only supported on JRE 1.4.1
     (IY54569)

Access Manager 5.1 for Red Hat Enterprise Linux 3.0 is only supported on
JRE 1.4.1. The Access Manager installation guide/Release Note incorrectly
mentions support for JRE 1.3.1

7.11 Tivoli Access Manager applications require access to a
      writeable registry server. (IY47745

Tivoli Access Manager applications require access to a writeable registry
server (such as LDAP) during configuration. When using firewalls, special
care should be taken when read-only LDAP replicas are added to the Tivoli
Access Manager
runtime configuration.

A restrictive firewall configuration may prevent server configuration utilities
from completing, or in some instances will cause SSL connection attempts to
hang.

7.12 Java Secure Sockets Extension fix (IY49135)

There is a JSSE(Java Secure Sockets Extension) fix available from the Java
Information hub that addresses the timing based attack Vulnerabilities in JSSE.
This is ONLY applicable if using JSSE. To get this contact L2:

     http://techsupport.services.ibm.com/guides/tivoli_contacts.html
     DCF reference number for this fix is 1155286

7.13 Access Manager 5.1 can communicate with WebSEAL 4.1 for migration
     purposes (IY54956)

For migration purposes, WebSEAL 4.1 can communicate with Access Manager 5.1
if they are on different systems.

7.14 TAM 5.1 user password expiry issue with W2003 and AD (IY53464)

Remove the restriction for AD user expiry limitation (43684) from the release
notes, Using Webseal section if possible.

7.15 Setting JAVA_HOME in a Windows environment to use the GSKit IKeyman
     utility (IY56770)

The AM5.1 Base Installation guide in chapter 12, on page 155, documents the
following for using the GSKit iKeyman utility on Windows.
"If you plan to use the GSKit iKeyman utility, do the following: a. Set the
JAVA_HOME environmental variable to the full path to your Java installation.
For example: set JAVA_HOME=c:\Program Files\IBM\Java131"

The correct JAVA_HOME path for the above example on Windows should read
JAVA_HOME=c:\Program Files\IBM\Java131\JRE

7.16 Incremental_bulkload.sh gets an error in DBCS environment. (IY53551)

The current version of incremental_bulkload.sh has a switch for delimiter
substitution. The specified delimiter is passed on to the IDS bulkload utility.

Usage: incremental_bulkload.sh <drop_indexes|with_indexes>
       [<db2 import file field delimiter>]

The delimiter is an optional second parameter.  Example:

  incremental_bulkload.sh with_indexes "*"

 This command uses a '*' delimiter instead of the '|'.

If an invalid delimiter is specified, bulkload uses the default "|" delimiter.

A list of valid delimiters:

    \"%&'()*,./:;<>?|

Note: the '$' is not a valid delimiter at this time.

7.17 Additional Information for utility 'create_indexes_ns.sh' (IY55094)

  The performance tuning script 'create_indexes_ns.sh', included with those
  scripts within the performance tuning utilities, creates indexes for the
  fields/columns titled PrincipalName and SecDN on you LDAP based user
  registry.  This is done to greatly increase searching speed on the LDAP
  server.  Additional information about how this script functions may be
  obtained by viewing the script itself.

7.18 Not clear that pdjrte must be configured for each Java Runtime Environment
    (IY52278)

  The following line needs to be added to the Access Manager Base Installation
  Guide

  pdjrtecfg must be run to configure the Tivoli Access Manager Java Runtime
  for every Java Runtime Environment that is used to run applications using
  the Tivoli Access Manager Java Runtime.

7.19 Change all server passwords for security purposes (50791)

  For security purposes, it is recommended that you change all server
  passwords from the original password set during configuration.

7.20 Upgrading PDJRTE with WPS/WAS installed. (IY59440)

  When upgrading the Tivoli Access Manager Java runtime environment (PDJRTE)
  component on a system with WebSphere server installed, it is recommended
  that you stop the WebSphere server before upgrading this component.

7.21 File permissions changes when migrating from AM 4.1 to 5.1 (IY58917)

  Ensure that the file permissions of pd.kdb and pd.sth files in directory
  /var/PolicyDirector/keytab allow R/W access to the user you intend to use
  when using 'pdadmin' if using other id than root.


7.22 Wrong keywords for pdversion command (IY58887)
        When using pdversion command use the following keywords
        amacld   -->  pdacld
        amadk    -->  pdadk
        ampfs    -->  pdpfs
        amjrte   -->  pdjrte
        ammgr    -->  pdmgr
        amproxy  -->  pdproxy
        amrte    -->  pdrte
        amwas    -->  pdwas
        amweb    -->  pdweb
        amwebars -->  pdwebars
        amwebadk -->  pdwebadk
        amwpi    -->  pdwpi
        amwls    -->  pdwls
        amwsl    -->  pdwsl
        amwpm    -->  pdwpm


7.23 pdmgrd will ignore ca-cert-download-enabled (IY59615)
  pdmgrd always allows CA certificate download, it is up to the client
  application to allow downloading of the certificate.

7.24 Mounting Rock Ridge CD-ROMs (IY60069)
  Previously, mounting Rock Ridge CD-ROMs on HP required running PFS, which
  was very unstable. HP now provides patches to mount Rock Ridge CD-ROMs
  natively for HP-UX 11 and 11i.
  Patches for HP-UX 11.00: PHCO_28931, PHKL_23153, PHKL_28935
  Patches for HP-UX 11.11: PHCO_25841, PHKL_26269, PHKL_28025
  With these patches, the CD-ROMs can be mounted using the command:
   mount -orr DEVICENAME MOUNTPOINT
  The option -orr denotes mounting a Rock Ridge CD-ROM.

7.25 Native LDAP dynamic groups needs to be documented in TAM 5.1 (53080)

  In TAM 5.1, a new feature was added allowing dynamic groups to be used in
  Access Manager.

  In chapter 3, "Tivoli Access Manager administration" of the base guide,
  page 36 in the topic "Users and Groups", the following information was added"

  Tivoli Access Manager maintains information about Tivoli Access Manager users
  and groups in the user registry. Users and groups that already exist in the
  user registry can be imported into Tivoli Access Manager. If a user or group
  does not already exist in the user registry, it can be created directly
  within Tivoli Access Manager.

  For Active Directory and LDAP registry users, Tivoli Access Manager also
  supports the use of dynamic groups—groups whose members are automatically
  updated based on the results of a defined search filter. For example, suppose
  you create a dynamic group for members of department XYZ. If you import a new
  user whose data matches an entry in the search filter, the user is
  automatically added to the group; if an existing employee switches
  departments, the user is removed from the group. Manual intervention is not
  required.

  Tivoli Access Manager also supports different types of users. When a domain
  is created, a special user known as the domain administrator is created. For
  the management domain, the user ID of the domain administrator (sec_master)
  and the password are set during the configuration of the Tivoli Access
  Manager policy server. For other domains, the user ID and password of the
  domain administrator are established when the domain is created. The domain
  administrator has nearly complete control of the domain. Think of the domain
  administrator as the Tivoli Access Manager equivalent of the UNIX root
  account, or the Microsoft Windows Administrator user.


7.26 Statistics documentation do not state the unit of measurements (49120)

  The documentation regarding WebSEAL statistics (Chapter 8) found in
  the Problem Determination Guide does not specify the units of the
  measurements.

  For example, page 83 talks about the pdweb.jct.# statistic component.
  It gives the description of each statistic taken but does not say
  what unit is being used (seconds, milliseconds, etc).

  Units for time-related WebSEAL statistics (pdadmin stats) are all
  seconds:milliseconds.

  example:  0:000  (seconds:milliseconds)

7.27 Novell EDIR setup has incorrect command references (51336)

  In the install guide there is a section on setting up Novell eDirectory
  located in Part 2, Chapter 4, Pg 83.  This specifies to use the ivrgy_tool
  command to update the schema however the command syntax is now different.

     AM 5.1 Install Guide:
  Says to use the following command:  ( all on one line )
  ivrgy_tool -h edir_server_name -p port -D edir_admin_dn
  -w edir_admin_password schema


     Command Line help:
  C:\Program Files\Tivoli\Policy Director\sbin>ivrgy_tool.exe
  Manipulate Access Manager security info in the LDAP server.

  usage:
    ivrgy_tool [options] command
  options:
    -h host      LDAP server host name (required).
    -p port      LDAP server port number (if not specified, default LDAP port
    will be used.)
    -D dn        bind dn.
    -w password  bind password.
    -Z           Use SSL.
    -d           Debug (verbose) output.
    -K keyfile   SSL Key Database file.
    -P key_pw    keyfile password.
    -N key_name  private key name to use in keyfile.
    -S name      Security Master Principal Name.  (Default is "sec_master").
    -g name      Daemon type [acld-server or remote-acl-user]
    -s suffix    LDAP suffix under which to create the Management Domain
      (Default is "").
    -R           Remove from registry for uninstall command (Default is FALSE).

  command:
    install <domain> <password>
    add-daemon <domain> <daemon> <password>
    del-daemon <domain> <daemon>
    list-daemon <domain>
    check-domain <domain>
    check-bind <dn> <password>
    check-db

7.28 Migrating from TAM 4.1 to TAM 5.1 with failover-password set (52344)

  Migrating from TAM4.1 to TAM 5.1.

  When doing the pkgadd -d . -a PDWeb, it is leaving behind the TAM 4.1
  version of libfailoverauthn.so (in /opt/pdweb/lib).  I started manually
  start webseal (-config etc/webseald-default.conf), it leaves
  webseald-default.conf with  the line:

  "failover-password = /opt/pdweb/lib/libfailoverauthn.so"

  Attempting to failover this way will cause a core dump of webseal.

  It should be changed in the webseald-default.conf to:
  "failover-password = /opt/pdwebrte/lib/libfailoverauthn.so"

7.29 adschema_update.exe is not documented (IY61963)

  The Access Manager 5.1 Base Installation Guide states:
  If you configured Tivoli Access Manager in the single domain, and the domain
  is the non-root domain, you must run adschema_update.exe manually on the root
  domain controller.
  However, it does not indicate how the command should be run, or where to find
  the command so that it can be copied to the root domain controller and run.

  After installation adschema_update.exe can be found in:
    C:\Program Files\Tivoli\Policy Director\sbin directory.

  When run from the command line as adschema_update.exe /? you are given

  Valid options are:
		[-o [g[ui]]]   		Output stderr or messagebox (gui)
		[-f <filename>]		Qualified schema filename
		[-u <user_id>		Administrator ID
		 -p <password>]		Administrator password.

  Example:
	  adschema_update -o -f c:\adschema.def -u admin -p password

7.30 The com.tivoli.pd.jazn classes are not documented (IY58627)

  In several locations the documentation states the
  PDPrincipal.getEntitlements() method expects the deprecated
  com.tivoli.mts.PDAttrs() rather than the replacement class
  com.tivoli.pd.jutil.PDAttrs().

  The documentation should list the com.tivoli.pd.jazn.PDPrincipal
  interface which uses the new replacement class com.tivoli.pd.jutil.PDAttrs()

  Use the undocumented, but supported, com.tivoli.pd.jazn.PDPrincipal interface
  PDAttrs getEntitlements(PDAuthorizationContext ctxt, java.lang.String
  serviceID, PDAttrs attrsIn) to return all the objects to which this
  PDPrincipal has the specified access

  In place of the PDPrincipal.getEntitlements() method expects the deprecated
  com.tivoli.mts.PDAttrs() rather than the replacement
  class com.tivoli.pd.jutil.PDAttrs().

  The jutil PDAttrs is in PD.jar, as is the mts version.

7.31 The pdproxycfg CLI has a bad template file (IY60057)

  The /rspfile/pdproxycfg.rsp.template file on the TAM 5.1 Base CD is incorrect.
  When you edit it to create your response file, add a "[pdproxy]" line at the
  start of the file.

  The pdproxycfg CLI is not documented in the TAM 5.1 Base Install manual.
  By executing "pdproxycfg -operations" you can see all the options for the
  CLI.  By referring to the documentation in Chapter 19 for the other two
  configuration CLIs, amwpmcfg and pdjrtecfg, many of the common options can
  be understood.  For those options that are not in common among the three
  commands, the /rspfile/pdproxycfg.rsp.template file has good descriptions.

7.32 TAM 5.1- PDMGRD ERROR HPDAC0455E LOGGED WHEN NEW DOMAIN CREATED (IY63834)

  During the creation of a new Domain, Policy Manager creates the domain
  successfully but logs the following error message in the log file.

  pdmgrd ERROR acl acldb management.cpp 4466 0x00000114 HPDAC0455E   The
  authorization policy database has not been initialized.

  The above message should not have been logged at all as ERROR or it should have
  been logged as just a NOTICE.

7.33 LIBGCC is not listed as pre-req for the Plug-in for Edge Server (IY60563)

  Before installing Plug-in for Edge Server, Version 5.1 on Red Hat Enterprise
  Linux 21, ensure that the libgcc fileset is installed. If this fileset is
  not already installed, you can install libgcc-3.0.4-1.i386.rpm from the
  Red Hat installation media.

7.34 TAM error 0x1354a424 is not documented (IY65986)

  In some cases the error code of 0x1354a424 may be logged. 0x1354a424
  is an internal error with the meaning 'Could not connect to server'.

7.35 Documentation for the Policy Server must be installed in the root domain (IY65821)

  When Tivoli Access Manager is configured using the Active Directory as
  user registry with the Active Directory multiple domains option, then the
  Tivoli Policy Server must be installed and configured from the root Active Directory
  domain or a client of that root domain only.

7.36 If the user who created the ACL is deleted, ACL cannot be removed. (IY63388)

  If a user creates an ACL and sets permission for Any-Other to 'Tr' and
  Unauthenticated to 'T' only and latter on if that user get deleted then
  no other user has any control over that ACL and that ACL cannot be deleted.

  It is recommended that every ACL should have a group entry say like 'iv-admin'
  with enough permissions so that any member of that group has the ability to
  attach and delete that ACL if necessary so that this kind of situation never
  occurs.

7.37 http-timeout ignored if OS timeout is lower (IY68420)

  If the OS timeout (tcp_syn_retries on Solaris) is lower than
  http-timeout or https-timeout that lower value will be used when
  determining connectivity. In this case if you disconnect the back-end
  server from WebSEAL it will wait till the OS tells it the socket
  is closing before it sends the error to the client.

7.38 Usage of multiple PDContext in application (IY67354)

  PDContext creation is an extremely resource exhaustive operation. Although
  there is no upper limit to creating multiple PDContexts, system resource
  limitations will eventually determine how many can be successfully created/used.
  It is recommended that only a small number of PDContexts be created and pooled
  in the customer application environment. The close() method provided in the
  PDContext class is only to clean up the logger data associated with the
  context but does not destroy the context.

7.39 Information about kdb password lifetime refresh trigger (IY63992)

  User had questions regarding the trigger of the password refresh
  for a blades kdb file. If half the expiration time had occurred
  but the blade was not up or receiving acl updates the refresh did not
  happen.
  Making acl updates from the policy server should not trigger the
  password refresh unless half-life has already been exceeded, but if the
  half-life has been exceeded, this would be checked with the acl database
  update occurs.
  In that case, the condition would be detected and the password would be
  refreshed, but only if the half-life had already been exceeded.
  If the blade server is not running during the second half of the
  password life, an acl update would not be able to refresh the password,
  since this operation involves using the connection from the management
  server to the blade server (actually utilizing the ssl connection
  protected by the certificate protected by the password).

7.40 The Enterprise Admins and the Schema Admins groups belong to the Active
     Directory root domain. (53789)

  The following section in the Base Installation Guide is to be up dated
  with the note below.
    Part 2 Base Installation Guide
      Chapter 4  Setting up the registry server
        Setting up Microsoft Active Directory
          Create an AD Administrative user

  Note: The Enterprise Admins and the Schema Admins groups belong to the
  Active Directory root domain.  The Administrators mentioned above referred
  to the Administrators group of the root domain, not the secondary or child
  domain.  If it's intended for TAM to configure using Active Directory single
  domain on an Active Directory secondary or child domain (non-root domain),
  the user created above must still be added to all those groups above order
  for TAM to configure properly.  After the TAM configuration is finished, the
  Administrators, Enterprise Admins and Schema Admins groups can be removed
  from the user's group member list.  Also, this user must be used to log in
  to the secondary or child domain in order to configure TAM.  Failure to do
  so can cause TAM configuration failure.

7.41 Additional steps required to apply fix for IY53908. (IY69559)

  After the application of a fixpack for fixing IY53908, the customer will
  see the same problem as before.  In order for the changes to take effect
  and to fix the problem, the customer will have to be unconfigure and
  reconfigure the WPM.  After the reconfiguration of WPM the changes will
  now be in place and the problem will be fixed.

7.42 Log files on AIX limited to 2gig regardless of OS settings (IY69483)

  Regardless of the limits and filesystem settings the max log file size
  on AIX is 2gig. This is due to the way TAM is built. There is an
  enhancement request open for this issue (MR0323053453).

7.43 Support of RHES 4 with SELinux (IY68707)

  We now support RHES 4 with SELinux in it's "default, non-hardened"
  base install configuration.

7.44 More details are required for pdjrtecfg command (IY71571)

  pdjrtecfg command can configure Java Runtime in "full" and "standalone"
  mode. It appears that the purpose of the "standalone" mode does not have
  enough details.

  standalone:
  Specifies the configuration mode where the Tivoli Access Manager Java
  runtime component's configuration program does not require Tivoli Access
  Manager policy server information to run and configuration program does
  NOT try to get CA Cert for the Application.
  This mode lets you use Tivoli Access Manager Java APIs without requiring a
  Tivoli Access Manager policy server. This mode is normally used to configure
  Tivoli Access Manager Development environment.

7.45 Documentation required for pdjrteupg command (IY71577)

  In certain situation, specially during upgrade from prior release to 5.1,
  we instruct the user to run pdjrtupg command manually but the syntax for
  the command is not documented.

  pdjrteupg command takes same input parameters as pdjrtecfg command.
  Please see the pdjrtecfg command's description for full details of
  each parameter.

7.46 IKeyman's -expire parameter's default is misdocumented (IY72175)

  The IKeyman Manual says the default value for -expire when a KDB is
  created is 60 days.  Actually, this default is "none".  If you do not
  specify a -expire value when you create a KDB, then that KDB will never
  expire.

  In addition, as of GSKit 7.0.3.17 the default value for -expire when a
  certificate is created will change from 365 days to "none".

7.47 Handle ITDS FP520S-01 password policy enforcement (54278)

  IDS password history is enabled in TAM as of  5.1-TAM-LA0011  with IDS 5.1
  FixPack 1. In order for this feature to work properly, Access Manager should
  be configured with the following option in the configuration file in [ldap]
  stanza (e.g /opt/pdweb/etc/webseald-default.conf )

  auth-using-compare = no

  Please consult IDS 5.2 Administration Guide for more information about
  IDS 5.2 Password History and Validation Information.

7.48 Webseal delays 25 secs in connecting to LDAP Replica Server (IY68129)

  Active Directory is configured in a single domain with 2 Domain Controller
  Servers. When the first server is shutdown, the second server takes over and
  it takes about 25 second to authenticate a user via Webseal that is running
  in UNIX.

7.49 The auth-using-compare field is commented out in ivacld.conf (IY74651)

  The auth-using-compare field in the [ldap] stanza of the ivacld.conf
  file is commented out by default. The default ACL Settings that Tivoli
  Access Manager sets up, do not allow the Authorization Server to do a
  password compare. Therefore, the auth-using-compare field in the
  ivacld.conf file is commented out. This way the authentication will be
  done using a ldap bind rather than using a ldap compare.

7.50 Updated javadocs in PD.AuthADK (IY72168)

  The PD.AuthADK package contains the updated documentation on the Java
  classes and methods necessary for performing authorization and
  administration functions in IBM Tivoli Acess Manager. Please use this
  for getting the most current javadoc information.

7.51 Corrected instructions available for migrating from IBM Directory Server
     4.1 or 5.1 with DB2 7.2 on AIX to IBM Directory Server 5.2 (IY73876)

  The IBM Tivoli Access Manager 5.1 Upgrade Guide contains instructions for
  migrating from IBM Directory Server 4.1 or 5.1 with DB2 7.2 on AIX to
  IBM Directory Server 5.2.  These instructions are incomplete and have been
  corrected in the IBM Tivoli Directory Server README Addendum, section
  2.1.4 (located at the following URL).  These instructions should be used
  instead of the original instructions in the Access Manager 5.1 Upgrade
  Guide:

  http://publib.boulder.ibm.com/tividd/td/IBMDS/ID7002517S_521/en_US/HTML/
  addendum52.htm#HDRMIG51DB7

7.52 How TAM handles LDAP password policies (IY76706)
  How does TAM handle LDAP's own Password Policy?

  TAM enforce its own Password Policy first and foremost. TAM will attempt 
  to update password in LDAP only when the provided password passes TAM's
  own Password Policy check.

  After that TAM tries to accommodate LDAP's own Password Policy to the best 
  of its ability using the return code that it get from LDAP during a password 
  related LDAP update operation.

  If TAM can map this return code without any ambiguity to a corresponding TAM 
  error code, it will do so and will return proper error message to the user.

  There are no configuration steps needed in TAM to make it support LDAP's 
  own Password Policy. TAM does not assume the existence or non-existence
  of LDAP's own Password Policy at all. So LDAP's Password Policy can be
  configured or unconfigured at any time in a TAM environment.

7.53 Need Re-Compile/Re-Link After Applying FP with ADK changes (IY77752).

  After applying a Tivoli Access Manager FP, if there were any modifications
  in the TAM ADKs (PDAuthADK, PDWebADK), users need to re-compile/re-link 
  their applications that used the ADKs (i.e. CDAS) 

7.54 TAM Support for SLES9 on zSeries (IY77827)

  TAM 5.1 is not supported on SLES9 for zSeries because the ITDS 5.2 client 
  is not supported in this environment. TAM 6.0 and the ITDS 6.0 client are 
  supported on both 31bit and 64bit (running in 31bit mode) SLES9. However, 
  the ITDS 6.0 server is only supported on 31 bit SLES9. It is important to 
  keep this in mind while setting up TAM on SLES9/zSeries

7.55 Additional configuration needed for IY79330

  For this Fix to be effective, a configuration option in the activedir.conf
  file should be added.  The "authenticate-with-alt-upn-and-sam" option
  should be set to "yes" in the [uraf-registry] stanza, as follows:

  [uraf-registry] 
  authenticate-with-alt-upn-and-sam = yes

7.56 WPM cannot delete GSO credential after migration from 4.1 > 5.1 (IY81577)

  After migration from 4.1 to 5.1, attempt to create "web" type GSO Credentials 
  using old GSO Resource ( i.e. GSO Resource created in 4.10 environment) get 
  created successfully but it's type attribute erroneously get set to "group" 
  instead of "web".

  After applying this Patch, any newly created "GSO Credentials" of type "web"
  (using old GSO Resource) will have its type attribute set properly but the
  ones that already been created before applying this Patch will still indicate
  them as of type "group" when it was intended to be of type "web".

  Use following pdadmin command to delete those erroneous GSO Resources and 
  re-create them either using WPM or pdadmin CLI.

  pdadmin> rsrccred delete "CredName" rsrctype web user "userName"


7.57 GSO data not accessible when running in a mixed 4.1/5.1 environment (IY81206)
  
  In Tivoli Access Manager Version 5.1 and beyond, new functionalities to 
  support multiple domains were added. The existing GSO Technology that comes 
  with previous versions of Tivoli Access Manager has no concept of domains and 
  thus modified to maintain the GSO data in LDAP server in a multi-domain
  format. Access Manager Runtime was modified to support this multi-domain
  format and would continue to recognize and use the existing previous GSO
  data format. Therefore, the version 5.1 WebSEAL would continue to use 
  existing GSO Resource Credentials, which were created using the version 4.1 
  GSO Technology. The version 5.1 WebSEAL can also use newly created GSO data 
  in the multi-domain format.
  However, once the  version 4.1 Policy Server is migrated to version 5.1,
  newly created GSO Resources, Resource Groups and Resource Credentials, will
  be created and maintained in the new multi-domain format. Versions of WebSEAL
  prior to version 5.1, would not be able to use these newly created GSO data
  at all.

  It is strongly encouraged to upgrade all WebSEALs to version 5.1 to be able
  to access and use new GSO Credentails. If it is not  at  all  possible to 
  upgrade WebSEAL to version 5.1, then the following workaround can be used 
  so that version 4.1 WebSEAL can access and use new GSO Credentials.

  For this workaround to wrok properly, the following steps should be followed:

  a) All required GSO Resources have already been created using the version
     4.1 Policy Server currently in place.
  b) Upgrade the Policy Server to version 5.1.
  c) Create new users using the pdadmin utility as usual, but do not indicate
     that it will be a GSO user, i.e. do not use the "-gsouser" option and
     do not modify the user to be a gsouser. 

     Example:
     pdadmin> user create 510gsouser1 cn=510gsouser1,o=tivoli,c=us 510gsouser1 \
		510gsouser1 password1

  d) Modify the below provided version 4.1 "GSO Resource Credential format"
     template ldif file to match the newly created user information like
     Common Name, Distinguished Name etc.

  e) Also modify the GSO Resource Credential name, secretKey and uid,
     Template used "Resource1", "gsoPassword1" and "gsoID" respectively.

  f) Once properly modified, the template can be added to the newly created
     user object in LDAP using a standard "ldapadd" command.

     An example of "ldapadd" command is as follows ( assuming that the properly
     modified ldif is contained in a file name gsouser.ldif)

     ldapadd -h ldapHost -p ldapPort -D cn=root -w adminPWD -v -i gsouser.ldif

  g) After the successful completion of above "ldapadd" step, pdadmin command
     can be used to modify the newly added GSO Credentials for the user created
     in step c.

  h) Both the version 4.1 WebSEAL and version 5.1 WebSEAL should be able to use
     the GSO Credentail created with the above steps.


  Restrictions:
     Only existing version 4.1 GSO Resources should be used. Once the Policy
     Server has been upgraded to version 5.1, any new Resources created will be
     in multi-domain format and the above procedures will not work for these
     Resources. 

  Here is the Template:
------------------------------- START--------------------------------
#
# Define the Global Sign-On (GSO) user profile object (eGsoUser object type).
#
# Change the Common Name (cn) to match the TAM user identity.
# In this example, the TAM user identity is "gsouser1".
# Change the 'dn'and 'associatedname' to reflect the created TAM user DN
# In this example, the user object DN is "cn=510gsouser1,o=tivoli,c=us".
#
dn: cn=510gsouser1,cn=510gsouser1,o=tivoli,c=us
objectclass: top
objectclass: cimManagedElement
objectclass: eUser
objectclass: eGsoUser
cn: 510gsouser1
associatedname: cn=510gsouser1,o=tivoli,c=us
usertype: PD User
userstate: Active
description::

#
# Define the Global Sign-On (GSO) user's GSO resource credential (eTargetRecord type).
#
# Change the Common Name (cn) to match the TAM resource name with the "T:" prepended
# For example, if the TAM resource (rsrc) is called "Resource1", the common
# name would be "cn=T:Resource1".
# Change the 'targetservice' to "tsName=<TAM_resource>"
#  where the <TAM_resource> is the TAM resource name (rsrc).
# Change the 'dn' to define this object 'below' the GSO user profile.
#
# The GSO resource credential resource-userid is maintained in the "uid" attribute.
# The GSO resource credential resource-password is maintained in the "secretKey" attribute
# In the LDIF, the secretKey value can be kept in clear text.
# It will be automatically encrypted by the IBM Directory Server when it is stored.
#
dn: cn=T:Resource1,cn=510gsouser1,cn=510gsouser1,o=tivoli,c=us
objectclass: top
objectclass: cimManagedElement
objectclass: cimSetting
objectclass: eTargetRecord
cn: T:Resource1
launchable: false
description::
secretkey: gsoPassword1
targetservice: tsName=Resource1
tstype: Web Resource
uid: gsoID
------------------------------- END--------------------------------

7.58 It is unclear how Access Manager Runtime for Java Server ranks work (IY80970)

The Authorization Java Classes Developer Reference indicates that you can
specify multiple policy servers and/or authorization servers, giving each one a
numeric rank, in the -policysvr and/or -authzsvr parameters of the SvrSslCfg 
command.  The numeric rank is defined as follows:

The rank specifies in what order the application should attempt to connect to 
the servers defined.  For example, if two servers are specified, one with rank 1
and another with rank 2, the application will always attempt to connect to the 
server with rank 1. If a connection cannot be established to server 1, the 
application will then failover and attempt to connect to the server with rank 2.

Note that even if only one server is specified, it still needs a rank specified.

Also note that each server should get a unique rank (i.e.  only one server should
be specified at each rank), as this is a list of servers to try, not a load 
balancing mechanism.  

7.59 TAM 3.9->5.1 pre-5.1 GSO users unable to get to GSO resource (IY81998,IY72782)

  After migration from 3.9 or 4.1 to 5.1, any new 5.10 WebSEAL instances created
  after the migration, will not be able to access GSO Credentials created during
  3.9 or 4.1 environment. This is because the 5.10 WebSEAL bind-dn does not have
  the proper access rights to the GSO Suffix in LDAP.

  Follow the following steps to add the new WebsEAL instance's bind-dn to the 
  proper admin group:
  (This assumes IDS Server as Registry and o=ibm,c=us as GSO Suffix and also it 
   assumes that instructions, provided by Tivoli Support, for APAR IY55900 was 
   followed during migration.)

  Use DMT tool (or other suitable process) and find the entry:
  o=ibm,c=us->systemName=IBMGSO -> cn=Access Groups-> cn=Senior Administrators
       1. Select this entry then click on Edit.
       2. In the member, "Group members", add the entry:
          cn=instanceName-webseald/host,cn=SecurityDaemons,secAuthority=Default
          (do not delete what ever exists already)
          This is the new WebSEAL's bind-dn, need to do the same if there are 
          other instances of the WebSEAL that are not already member.
       3. Close, answer yes or ok to all windows.

  Do the same for: (very important)
  o=ibm,c=us -> systemName=IBMGSO -> cn=Access Groups -> cn=Administrators
       1. Select this entry then click on Edit.
       2. In the member, "Group members", add the entry:
          cn=instanceName-webseald/host,cn=SecurityDaemons,secAuthority=Default
          (do not delete what ever exists already)
          This is the new WebSEAL's bind-dn, need to do the same if there are 
          other instances of the WebSEAL that are not already member.
       3. Close, answer yes or ok to all windows.

  After that, either re-start LDAP server or all new WebSEAL servers.

7.60 Unable to configure PDRTE in Windows for AD_LDAP with SSL (IY84130)

 Windows 2003 Active Directory used to allow anonymous bind for  root DSE 
 search, but with SP1 installed, Windows 2003 Active Directory does not
 allow anonymous bind for root DSE search anymore. Because of that,
 TAM Runtime Configuration on Windows with AD_LDAP interface using SSL
 may fail if anonymous bind to Active Directory is not enabled.
 
 The following work-around can be used to configure Access Manager 
 Runtime for SSL with Active Directory.

 a) First Configure Runtime for non-ssl
 b) Now modify activedir_ldap.conf file to turn SSL on.
    Modify the [uraf-registry] stanza with the following information,

    [uraf-registry]
    usessl = true

    ssl-keyfile       = <Key File Location>
    ssl-keyfile-label = <CertificateLabel if any>
    ssl-keyfile-pwd   = <password>
    
  c) If desired, the "ssl-keyfile-pwd" can be obfuscated with the following
     command:

    pdadmin -l
    pdadmin local> config modify keyvalue set -obfuscate \
    <path-for-activedir-ldap.conf> uraf-registry ssl-keyfile-pwd <password>
    To verify the password:
    pdadmin local> config show <path-for-activedir-ldap.conf> uraf-registry \
	           ssl-keyfile-pwd

 
  Runtime is now configured for SSL.

7.61 Setup documentation for IBM LDAP on Z/OS and OS/390 is not clear (IY83217)

  Tivoli Access Manager for e-Business Version 5.10, Base Installation Guide 
  (SC32-1362-00), section "Setting up IBM z/OS and OS/390 Security Servers, 
  Updating schema files, in page 71 needs the following clarification:
  The existing paragraph can be replaced with the following: 
 
  First ensure that z/OS Server has all of the installation-supplied schema 
  applied. After that you must update the schema to support Tivoli Access 
  Manager, Version 5.1. To do so, use the ivrgy_tool utility to apply the 
  schema to the z/OS LDAP server before you create the secAuthority=Default 
  suffix. You can run the following command to apply the schema:

  ivrgy_tool -d -h host -p port -D ldap_admin -w admin_pwd schema

  This would ensure that entries for TAM that may not have been included in
  the z/OS LDAP default schema would be applied. 

7.62 Recommendations for using JAVA API PDCONTEXT (IY80755)

  It is recommended that customers either share a single PDContext or create
  a pool of contexts to be shared by their Admin Java API applications.
  The PDContext is thread-safe and it should be noted that access to it is
  serialized internally. Therefore it may be more beneficial to maintain
  a pool of contexts for performance reasons.

7.63 Details on changes for IY84481: Extended credential attributes not passed
     to chained cdas

  Prior to Access Manager 5.1 WebSEAL, custom ext-attr-cdas libraries were
  passed an xauthn_identity_t *ident structure which contained tag-value
  attributes specified in the [ldap-ext-cred-tags] stanza.  In the 510 release,
  the addition of tag-value attributes was moved from the ldapauthn module to
  the registry entitlements service, which is called after chained CDAS
  modules.  This breaks backward compatibility for those modules, without a
  workaround.

  Changes for apar IY84481 return the ability for the ldapauthn module to add
  tag-value attributes thus providing a work-around.  Configuration and
  operation is identical to 4.1 and earlier except the stanza is now called
  [ldap-ext-cred-tags-41] (instead of the original name of
  [ldap-ext-cred-tags]).

7.64 Additional Details and configuration parameter for internal defect 57798:
     Implement AMJRTE certificate auto-refresh

  Defect 57798 adds certificate auto-refresh capability to the Tivoli Access
  Manager Runtime for Java.

  The certificate in the keystore for a Tivoli Access Manager Runtime for Java
  configured application expires based on the certificate lifetime set on the
  policy server. Prior to the auto-refresh capability, the -action replcert
  option was required to generate a new certificate for the application.  The 
  added Tivoli Access Manager Runtime for Java's certificate auto-refresh can
  automatically refresh the application server's Tivoli Access Manager
  certificate while the application is active.

  The application's certificate will be automatically refreshed after it has
  reached the mid-point in its lifespan.  A new certificate will be requested,
  signed by the policy server, then stored in place of the existing
  certificate in the application server?s keystore file.

  Tivoli Access Manager Runtime for Java auto-refresh capability can be
  disabled by setting the following property in the application's configuration
  file: 

    appsvr-certrefresh=false 

  By default, auto refresh is enabled:

    appsvr-certrefresh=true

7.65 ADD CURRENT CONTEXT COUNTER FROM REMOTE APPS INTO TRACING LOG (IY90753)

  New option to allow adjusting session cache size.

  A new option, called "ssl-session-cache-size" has been added  to allow
  customizing  the size of the SSL session cache used by GSKit and the
  internal session list used by ivmgrd and ivacld.  The default value of
  1024 has not changed and will be appropriate in most circumstances.

  Use of this option is not recommended except in extreme situations
  such as the need to create a large number of PDContext(s).
  (see section 7.38)

  The option is valid for use in either ivmgrd.conf or ivacld.conf.  Valid
  range is 1  to 4095.  If a value is provided outside of that range then the
  default value of 1024 is used.  In order to fully utilize the session cache
  even powers of 2 should be used, therefore the session cache size should be
  limited to one of 512,1024 or 2048.

     [ssl]
     ssl-session-cache-size = 2048

7.66 "R" Action bit was not created during migration from 410 to 510 (IY95312)

  "R" Action bit for "Bypass Authzrule" was added in TAM 510 release.
  During the migration of 410 system to 510, migration process does not create
  the "R" action bit.
  "pdadmin action create" command can create action bit that are NOT part of
   Core ACL action. Core ACL action bits are action bits with appropriate bitmask
   and get created during initial database configuration time.

  To get this "R" action bit properly created, do the following:

  If you have created "R" action bit in the primary group with or without the
  suggestion made by IY56226, delete it using pdadmin command.

  Install this patch i.e. the patch containing the APAR IY95312
  Now create the "R" action bit with the following command:

  pdadmin> action create R "Bypass AuthzRule" Base

  Every thing but description i.e. "Bypass AuthzRule" have to be exactly the way
  it is typed above.

  Please note that you will not be able to delete this "R" action bit any more
  as it is created as part of "Core" acl action bit.

  Immediately after creating the "R" action bit, it is suggested to modify the
  following default ACLs and add "R" action bit to iv-admin group:

        default-root
        default-webseal
        default-management
        default-gso
        default-policy
        default-config
        default-domain
        default-replica

  Please check "pdadmin acl modify" command for detailed usuage.

7.67 SSL-LISTENING-PORT SHOULD BE CHANGED VIA SVRSSLCFG -CHGPORT (IY95392)
 
  1. The ssl-listen-port can be changed directly or by using 
     'svrsslcfg -chgport' command.
      The modified port will be reported to policy server after 
      restarting the resource manager.

  2. The Chapter 2 of 'Tivoli Access Manager for e-Business Command
     Reference guide' for the svrsslcfg -chg* commands have a comment
     "Stop the Tivoli Access Manager policy server before running this 
     command."

     Correction:

     The comment for the svrsslcfg -chg* (except 'svrsslcfg -chgport') 
     commands must read as "Restart the Tivoli Access Manager resource
     manager after running this command."

7.68 "OBJECT SHOW" DISPLAYS EVEN THOUGH IT IS NOT AN OBJECT (IY96548)
   
     By design, a blade like WebSEAL manages part of the objectspace.
     Therefore, TAM never assumes it has ownership of an object.
     This is the reason that "object show" command always returns an object
     and hence it returns a dummy version of an object when the particular 
     object, specified in the "object show" command, does not exist.

7.69 Clarification on configuring remote log file agents. (IY98399)

     The Tivoli Access Manager for e-business Auditing Guide, states:

     "All events entering a host through the remote auditing service are placed
     in a category constructed in the following manner: 
           remote.client-category-domain.hostname.program"

     While this statement is correct, the short name version of the hostname does
     not always work.  Sometimes a fully quallified host name is required.  This is
     most apparent when filtering events by program name.  Therfore to use the form 
     containing the program name,  you should provide a hostname that matches what 
     your system returns from gethostbyname. This is often the fully qualified 
     DNS name.

     For example, to log to the file /tmp/myaudit.log

     [aznapi-configuration]
     logcfg = remote.audit.myhost.mydomain.com.webseald:file path=/tmp/myaudit.log


7.70 LDAP PASSWORD POLICY AND AUTH-USING-COMPARE (IZ10367,IZ23829)

     Access Manager 5.10 documentation states that to use IBM LDAP's Password 
     Policy with Access Manager, auth-using-compare=no option has to be used in
     configuration file.
     With ITDS 5.2 Fix Pack 01 (IBM LDAP Server) or latter, the above mentioned 
     restriction of using auth-using-compare=no is not valid any more.

     So, starting with FixPack 12 or above for Access Manager version 510 and 
     assuming ITDS 5.2 + Fix Pack 01 or latter is installed, the above 
     restriction about auth-using-compare=no has been removed.

        [ldap]
  	     auth-using-compare=yes

     can be used in the configuration file and Access Manager will continue to 
     honor IBM LDAP's Password Policy with some limitation that is described 
     in section 9.16 under "KNOWN PROBLEMS AND WORKAROUNDS".


7.71 PDContext Application Design Considerations (IZ23831)

  There are a number of questions that should be asked when designing
  applications that use the PDContext class.

        1.  How many applications will be using PDContext at any one time?

        2.  How  many users per application will use PDContext?

        3.  Will the application make many administrative requests to
            the Policy Server?  If so will this be handled by a single
            user or many users?

  The most important concept to remember when designing an application that uses
  the PDContext class is that PDContext objects should be reused whenever possible.
  You should not create a new PDContext object for every operation. Doing so will
  quickly exhaust the sessions availble on the server. For every PDContext object
  created by your application, a session is created and maintained on the Policy
  Server.  The session is valid for set period of time controlled by the
  ssl-v3-timeout parameter in the pd.conf file. The default value for
  ssl-v3-timeout in the pd.conf file is 7200 seconds (2 hours).

  Each PDContext object can manage several connections.  However only one
  connection is active per context at a time. Other connections are queued up
  and blocked until the current connection has completed, allowing the next
  connection to complete.  By default each PDContext object supports 10
  connections.  This is advantageous in multithreaded applications allowing
  multiple threads to easily share a PDContext.  This approach is best for
  application with a small number of threads and only occasional requests to
  the policy server.

  The number of PDContext objects created represents the number of concurrent
  requests handled by your application. For applications requiring a large
  number of threads and frequent requests to the policy server, it is recommended
  that PDContext objects be maintained in a pool where PDContext objects are
  checked out as needed and returned to the pool when the operation has completed.
  Depending on the number of threads and the number PDContext objects in the pool
  this approach yields very good performance results.

  Application requirements vary considerably depending on the goal. Therefore
  we can only provide general guidelines on a PDContext Pool design.  Basic
  requirements include:

        Maintain the pool as a private class variable

        All methods that access the pool should be synchronized

        Start with a pool size of 10 PDContext objects and adjust as needed to
        improve performance.

        Creating PDContext objects can be  time consuming so avoid using too
        large of a pool.

        To improve overall performance do not create PDContext objects on the
        fly, instead initialize the pool when the application starts.




8.0 SOFTWARE LIMITATIONS
------------------------

8.1 Active Directory cannot create or import Active Directory users
     (IY52682)(45593)

If you use alternative userPrincipalName suffixes for your Active Directory
users, you must use the same user names in Tivoli Access Manager to permit the
users to use the same login IDs for both Windows and WebSEAL.

However, when using a single domain Active Directory user registry, Access
Manager will not accept user names with suffixes. When using a multi-domain
Active Directory user registry, Access Manager will not accept alternative
UPN suffixes.

The problem occurs when attempting to create or import a user with an
alternative UPN suffix.  The pdadmin command (for example):

pdadmin> user create testuser@fakedomain.com \
"CN=Test User,CN=users,DC=test,DC=domain,DC=msft" \
"Test User" User passw0rd

returns the message:

Could not perform the administration request.
Error: HPDIA0202W An unknown user name was presented to Access Manager.
(status 0x132120ca)


Currently, there is no workaround.


8.2 Checksum error on install of TAM 5.1 PD.AUTHADK on AIX when validation
    option is specified (IY75340)

  PD.AuthADK package contains two files, among others, with the following
  names:
  "PDAdminDemo.class" and "PDAdminDemo$ConsoleEraser.class"

  As one of the filename contains a "$" character in it, portion of the file
  name i.e. "$ConsoleEraser" get interpreted by Shell as a Shell variable so
  the lppchk command mistakenly reports information about the file named
  "PDAdminDemo.class" instead of "PDAdminDemo$ConsoleEraser.class"
  "sum" command can be used to verify this information.

  Beside this error, everything else about the package is working fine.

  Currently, there is no workaround.

8.3 Path of ivmgrd.kdb is hardcoded in mgrsslcfg utility (IY77574)

  The mgrsslcfg utility uses predefined paths for files like ivmgrd.kdb.
  For Windows, the default full path name for ivmgrd.kdb is:
  C:\Progra~1\Tivoli\Policy~1\keytab\ivmgrd.kdb
  For UNIX, the path is: 
  /var/PolicyDirector/keytab/ivmgrd.kdb

  The mgrsscfg utility always looks for a file called ivmgrd.kdb in the above 
  mentioned predefined location and since mgrsslcfg does not use the 
  ivmgrd.conf configuration file to determine the location of files like 
  ivmgrd.kdb, changing the file location in ivmgrd.conf file will not work 
  for the mgrsslcfg utility. 


9.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
------------------------------------------------

9.1 Issue requiring upgrade to GSKIT to 7.0.1.16. (47682)

IBM has identified a specific reliability issue in all products that use the
GSKIT component for managing SSL (Secure Socket Layer) communication. In the
case of this issue, when subjected to a very specific malformed transmission,
the IBM product will either have a serious performance degradation, or will
terminate. The termination of the application does not introduce any further
security concerns such as being able to access a remote system.

9.2 Users in AD groups that have been imported into TAM 4.1 are
             not being granted access via those groups (IY46666)

Users in AD groups that have been imported into Tivoli Access Manager
are not being granted access via those groups.  User show-group fails
to return the group for the user in question.  Active Directory and
TAMe show the same number of users in the group.

TAMe is not pulling the PrimaryGroupID when identifying what groups a
user is a member of.  If the user has a PrimaryGroupID that matches a
group imported into TAMe, that group is not identified in the TAMe
group list for the user.

WORKAROUND
Reset the user Primary group to a group not imported into TAMe.

9.3 TAM 5.1 with Sun ONE Directory fails login after restarting Sun ONE
   (IY56160)

If installing IBM Tivoli Access Manager 5.1 with a Sun ONE 5.2 user registry,
all works fine upon initial configuration of TAM.  Once restarting the Sun ONE
server, one can no longer login to TAM, receive errors pointing to problems
with the registry, etc.

The solution (workaround until problem is corrected by Sun) is to not take the
default options when creating the suffix.  If you do, the name "Default" is
assigned to your database.  This name causes your data to be removed upon a
restart of the server.  The fix is to go into the "Options" tab and assign a
different name by selecting the Custom button when creating the suffix for the
first time.  For illustrations on this workaround, reference Technote #1167178.

9.4 Installation errors out and require patch PHSS_26945 install on HP.
   (IY53143)

For Access Manager 5.1 installation on HP, install HP patch PHSS_28897 before
proceeding with AM/GSKit installation. The installation will error out and
require patch PHSS_26945 installation. This should not be required as patch
PHSS_28897 supersedes PHSS_26945.

9.5 AM 5.1 for Red Hat Enterprise Linux 3.0 is only supported on
JRE 1.4.1 (IY56035)

Access Manager 5.1 for Red Hat Enterprise Linux 3.0 is only supported on
JRE 1.4.1. The Access Manager installation guide/Release Note incorrectly
mentions support for JRE 1.3.1

9.6 Fixpack requires pdrte in order to apply pdjrte patches

If you encounter the following error message while applying
the FixPack on NT, you will need to install the Base Runtime
Environment (PDRTE) in order by apply any FixPack updates:

    Access Manager is currently running.
    You must stop Access Manager before installing this update.

The FixPack erroneously expects the Base Runtime Environment
to be installed if any other components of the product are
installed, including the PDJRTE component which should
function standalone.

9.7 Incorrect file ownerships seen after performing an installation/upgrade
on Unix platforms (IY57034)

In rare cases, after performing an installation of Tivoli Access Manager or
one of its patches, the user and group ownership of certain files have been
set to '300'.  These files should belong to the 'ivmgr' account.   If you have
installed Tivoli Access Manager or one of its patches, on a Unix platform, you
should check the files in the following directories for correct user and group
ownership:  /opt   /usr   /var   /etc
If you see user and/or group entries of '300', please use the following two
commands as a work-around to correct the problem.  You must run the following
commands from the 'root' account, and from the root (/) directory.

(to find and fix the user permissions)
find /opt /usr /var /etc -user 300 | xargs -l1 -p -i chown ivmgr {}

(to find and fix the group permissions)
find /opt /usr /var /etc -group 300 | xargs -l1 -p -i chgrp ivmgr {}

The above commands will search all affected directories for the '300' entries
and replace the incorrect entry with the correct 'ivmgr' user and group account.

9.8 TAMOS configuration failure cause by missing action list item after
migration from pre-TAM 4.1.0.7 to TAM 5.1.

After migration of a pre-TAM 4.1.0.7 system to TAM 5.1, there is a missing
action list item from pdamin.  This item being, "R Bypass AuthzRule Base".
If you attempt to configure TAMOS without this action list item, the following
error message will be displayed:

0x357D519D pdoscfg NOTICE ?
ocf pdoscfg_trace pdoscfg_ivcommon.c 1628 0x00000001 ? ? ? ? ? ?
Argument[3] = TR[OSSEAL]CDGKLNRUdloprwx.

The work-around for this is to create the action list member manually using the
following command from the pdadmin account:

pdadmin> action create R "Bypass Authzule" Base

After completing the above you will now be able to configure TAMOS without error.

9.9 Can not install Access Manager FixPack on Win2K environment after
    clicking the "Cancel" button mid-way to the installation. (IY64846)

Create a dummy file name pdira.dll in <InstallDir>\bin directory and re-try
the patch install.

9.10 TAM5.1 FOR LINUX SHIPS WITH AN EXPIRED DB2 LICENSE (IY67211)

Customers will not be able to successfully configure their IDS servers
on Linux as the DB2 license shipped in the TAM5.1 Linux CDs has expired.

As there is no obvious error pointing to an expired license, customers
will keep seeing 'ldapcfg' command errors even after fixing all possible
recommended solutions, without being able to successfully configure
their IDS servers.

Therefore, to resolve this problem, the following must be done after
installing the DB2 and IDS binaries, but before running any of the
'ldapcfg' commands:

1. Copy the DB2 license file (db2ese.lic) provided in the TAM5.1
   Solaris CD into the /tmp directory of the machine that has
   DB2 installed.
2. Update the DB2 license file with the following command:
      /opt/IBM/db2/V8.1/adm/db2licm -a /tmp/db2ese.lic

Once the DB2 license file has been updated, proceed to configure
the DB2 database by either re-running the installer or continuing at
Step 14 of the Installation Guide for IDS using native tools on Linux.

9.11 Sometimes, WebSEAL might return error HPDIA0501E under high load (IY68129)

This issue was fixed by an LDAP APAR "IO01170" which is part of IDS 5.2
FixPack 3. So, in addition to the AM Patch, please install also IDS 5.2
FixPack 3 to get complete resolution of the problem.

9.12 Install problem on 5.1.0-TIV-TAM-LA0016 Windows Only! (64564)

On a system that previously had GSKit installed, when that version
was >= 7.0.3.8, there was are no problems upgrading GSKit.  However,
installing GSKit 7.0.3.17 on a system that had no prior version installed,
the install will complete, but GSKit will not function correctly.

WORK-AROUND: Install GSKit 7.0.3.8 or above before installing GSKit 7.0.3.17.
Make sure to install it into the existing GSKit 7.0.3.8 directory. Typically,
C:\Program Files\IBM\GSK7.

9.13 GSKit 7.0.3.17 installation problem (64564)

If you are installing GSKit 7.0.3.17 on a system that previously had
GSKit installed, if that version is >= 7.0.3.8, there are no problems.
However, if that version is < 7.0.3.8, you must install a version from
7.0.3.8 up to 7.0.3.16, then install 7.0.3.17. A internal defect has been
opened (64564) to correct this problem and is being worked.

Does not apply to version 7.0.3.24.

9.14 Using Piped Logging Adversely Affects System Performance on AIX 5.2.
(IY81883)

On a system installed with AIX 5.2 and TAM 5.1, if piped logging is enabled,
it will adversely affect system perform.  This appears to only affect 
systems running AIX 5.2.

WORK-AROUND:  Please change/set the following system environment variables
to fix the problem:
	SPINLOOPTIME=650
	MALLOCMULTIHEAP=1
	AIXTHREAD_MUTEX_DEBUG=OFF
	AIXTHREAD_SCOPE=S
	MALLOCTYPE=buckets
	LDR_CNTRL=MAXDATA=0x40000000
These can be set within the systems /etc/profile.

9.15 PDACLD_config fails if LDAP does not allow anonymous binding (IY90440)

When anonymous binding is disabled in LDAP server configuration,
the validity check for a specified keyfile, label and password fails
during PDACLD configuration with following error.
HPDBG0109W   Invalid LDAP authentication.

Following are the Workarounds to overcome this issue:

Workaround 1 :
	Enable anonymous binding during the configuration phase.

Workaround 2 :
	Add a bind DN and password to the 'ldapSSLSearch' function in 'PDAcld_config' script.
	Example: 
	${LDAPSEARCH} -h ${LDAPHOST} -p ${port} -D cn=root -w XXXXXXXX
	-K "${keyfile}" -N "${keyfiledn}" -P "${keyfilepwd}" -b ""
	-s base objectclass=* > /dev/null 2>&1

9.16 LDAP's "User must change password after reset" policy does not work (IZ10367)

Problem Description:
 When "auth-using-compare=yes" is set in configuration file of blades, then
 LDAP Password Policy named "User must change password after reset" will be 
 ignored. When "auth-using-compare=no" is set in configuration file,
 "User must change password after reset" will not work due to the way 
 Access Manager blades change user's password. As the password change is 
 done by blades' own daemon id, pwdreset for user in the LDAP does not get 
 cleared. Hence, for WebSEAL, user will be prompted to change password again 
 and in pdadmin, user will be issued error indicating user's password has 
 expired.

Workaround:
 There is no reasonable workaround available for this issue. It is suggested 
 to keep LDAP's "User must change password after reset" policy turned off.


9.17 Migration problem from TAM510 to TAM600 in Windows only (IZ05179,IZ09965)
     (for both Base and WebSEAL).

 On Windows platforms only:
 This is applicable for both Base and WebSEAL.

 Problem description:
 In certain situations, when attempting to upgrade TAM510 to TAM600 in Windows
 platforms, TAM600 installer does not copy/overwrite all the installed TAM510 
 files with the corresponding version of TAM600 files.
 This problem only happens in Windows platforms and only when TAM510 LA19 or
 latter, up to Fix Pack 32, is  installed. This problem is fixed in TAM510
 LA33 and latter.

 Fixes and Workaround for both Base and WebSEAL:
  a) Prior to attempting to upgrade, install Fix Pack LA33 or latter and 
     right after the successful Fix Pack installation, without modifying 
     anything else, start the upgrade.

	or

  b) Before attempting to upgrade, change the date of all files installed 
     under "C:\Program Files\Tivoli" to a date prior to the date Oct 28, 2005 
     and then proceed with migration.

     Example:
     Assuming unix like "find" and "touch" commands are available via MKS
     toolkit, command like the following can be used to change the timestamps
     of the files belonging to TAM510 to a date like Oct 01, 2005.
  
     Execute the following comannd from C:\Program Files\Tivoli
     (Assuming both Base and WebSEAL installed)
     find "Policy Director" -type f -exec touch -t 200510011000 {} ;
     find  PDWeb            -type f -exec touch -t 200510011000 {} ;
     find  PDWebRTE         -type f -exec touch -t 200510011000 {} ;

     Now do the upgrade operation.


 

10.0 NOTICES
------------
This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this
document in other countries. Consult your local IBM representative for
information on the products and services currently available in your area. Any
reference to an IBM product, program, or service is not intended to state or
imply that only that IBM product, program, or service may be used. Any
functionally equivalent product, program, or service that does not infringe
any IBM intellectual property right may be used instead. However, it is the
user's responsibility to evaluate and verify the operation of any non-IBM
product, program, or service. IBM may have patents or pending patent
applications covering subject matter described in this document. The
furnishing of this document does not give you any license to these patents.
You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the
IBM Intellectual Property Department in your country or send inquiries, in
writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law: INTERNATIONAL
BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions; therefore, this statement may not
apply to you.

This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this
IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the
purpose of enabling: (i) the exchange of information between independently
created programs and other programs (including this one) and (ii) the mutual
use of the information that has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758
U.S.A.

Such information may be available, subject to appropriate terms and
conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer
Agreement, IBM International Program License Agreement or any equivalent
agreement between us.

Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments
may vary significantly. Some measurements may have been made on
development-level systems and there is no guarantee that these measurements
will be the same on generally available systems. Furthermore, some measurement
may have been estimated through extrapolation. Actual results may vary. Users
of this document should verify the applicable data for their specific
environment.

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.

All statements regarding IBM's future direction or intent are subject to
change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include
the names of individuals, companies, brands, and products. All of these names
are fictitious and any similarity to the names and addresses used by an actual
business enterprise is entirely coincidental.


10.1 Trademarks

The following terms are trademarks or registered trademarks of International
Business Machines Corporation in the United States, other countries, or both:

AIX
IBM
IBM logo
iSeries
pSeries
S/390
Tivoli
Tivoli logo
xSeries
zSeries

Java and all Java-based trademarks and logos are trademarks of
Sun Microsystems, Inc. in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
Microsoft Corporation in the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and
other countries.

Other company, product, and service names may be trademarks or service marks
of others.



End of IBM Tivoli Access Manager Base, Patch 5.1.0-TIV-TAM-FP0038 README
