IBM(R) Tivoli(R) Access Manager Plug-in for Web Servers, Patch 5.1.0-TIV-WPI-FP0007 README
====================================================================================

 (C) Copyright International Business Machines Corporation 2004. All rights reserved.
 U.S. Government Users Restricted Rights -- Use, duplication or
 disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  Thursday, 9 December 2004

    CONTENTS

    1.0 ABOUT THIS PATCH
        1.1 Patch Contents
        1.2 Architectures
        1.3 Patches Superseded
        1.4 Dependencies
    2.0 APARS AND DEFECTS FIXED
        2.1 Problems Fixed by Patch 5.1.0-TIV-WPI-FP0007
	  2.2 Problems Fixed by Patch 5.1-WPI-0005LA
        2.3 Problems Fixed by Patch 5.1-WPI-0004LA
        2.4 Problems Fixed by Patch 5.1-WPI-0003
        2.5 Problems Fixed by Patch 5.1-WPI-0002LA
        2.6 Problems Fixed by Patch 5.1-WPI-0001LA
    3.0 INSTALLING THIS PATCH
        3.1 Installing this Patch on AIX Systems
	  3.2 Installing this Patch on Sun Solaris Operating Environment Systems
        3.3 Installing this patch on Linux 
	  3.4 Installing this Patch on Microsoft Windows Systems
    4.0 UNINSTALLING THIS PATCH
    5.0 VERIFYING THE PATCH LEVEL
    6.0 DOCUMENTATION UPDATES
	6.1 Incorrect Instructions for Creating a New External Credential
	6.2 Forms should be configured as pre-authzn modules when using Forms 
	    for authentication
    7.0 SOFTWARE LIMITATIONS
    8.0 TROUBLE SHOOTING
    9.0 NOTICES
        9.1 Trademarks


1.0 ABOUT THIS PATCH
--------------------

This patch package contains fixes for problems in IBM Tivoli Access Manager
Plug-in for Web Servers. This patch requires that IBM Tivoli Access Manager 
Plug-in for Web Servers version 5.1 and Tivoli Access Manager Version 5.1 
are already installed. The later is the level of Tivoli Access Manager on 
which this patch was tested.


1.1 Patch Contents

This patch package contains:

- This README file
- Update patch packaging


1.2 Architectures

This patch package applies to the following architectures:

    IBM AIX 5.1 and 5.2 Plug-in 
    Sun Solaris Operating Environment 2.8 and 2.9 
    SuSE Linux Enterprise Server 8	
    Microsoft Windows 2000 Advanced Server Plug-in for IIS, Version 5.0

1.3 Patches Superseded

None

1.4 Dependencies

IBM Tivoli Access Manager Base Version 5.1.
IBM Tivoli Access Manager Plug-in for Web Servers version 5.1


2.0 APARS AND DEFECTS FIXED

Because patches are cumulative, this patch corrects all the problems
outlined in the following sections.

2.1 Problems Fixed by Patch 5.1.0-TIV-WPI-FP0007

      APAR: IY65335
      Symptom: When failover authentication is enabled, the plug-in can be vulnerable 
               to a form of identity impersonation attack that could take place 
               without the knowledge of the system user. The consequences could allow 
               the attackers the ability to issue web server requests with the 
               compromised user's privileges.

      APAR: IY57739 
      Symptom: The forms single sign-on module cannot handle concurrent 
               requests to multiple pages from frames during the forms 
               single sign-on login process.

      APAR: IY59024 
      Symptom: FSSO fails when IDS is restarted.
    
      APAR: IY59077 
      Symptom: When using LTPA as a post-authzn module configured against an
               AD-LDAP registry, the user-dn in the LTPA token of an authenticated 
               user is filled out as unauthenticated

      APAR: IY59665 
      Symptom: %USERNAME% macro does not fill the nexttokenname value 
               field in when using token authentication via either RSA
	         or when using a custom token CDAS

      APAR: 52809
      Symptom: Potential cross-site scripting vulnerability in Referrer 
               header. To be exploitable the client must have already suffered
               other security failures or be accessing amwebpi via an untrusted 
               proxy.

      APAR: IY60829
      Symptom: xauthn_authenticate doesn't return XAUTHN_EXISTING_CRED correctly.
               
      APAR: IY58280
      Symptom: When the protocols = https option is used in a pdwebpi.conf virtual host 
               stanza, the error message AMZIC0303W is incorrectly received.

      APAR: IY60806
      Symptom: Post trigger for FSSO does not work.

      APAR: IY60808
      Symptom: FSSO does not work when we pass a query string to the URL that 
               triggers FSSO.

      Internal Defect: 51507
      Symptom: Acctmgmt configuration per virtual host not effective.

      APAR: IY62644
      Symptom: Setting account-valid=no causes the error "AMZIC0279E".

      Internal Defect:  52762
      Symptom: Web Plug-in fails to start when a virtual host is configured 
               for switch user.

2.2 Problems Fixed by Patch 5.1-WPI-0005LA

	APAR: IY59636
	Symptom: Attempts to install the web server plugin for IIS will
               fail is IIS is installed with or after installing 
               Windows 2000 Service Pack 4.

2.3 Problems Fixed by Patch 5.1-WPI-0004LA

	Internal Defect: 51944
	Symptom: The Access Manager Web Server Plug-in is vulnerable to a 
		   HTTP response splitting attack

2.4 Problems Fixed by Patch 5.1-WPI-0003
	
	APAR: IY54159
	Symptom: Plug-in for Web Server get access plugin error, 
		   location header above contains a server relative URL

	Internal Defect: 44355
	Symptom: Plug-in does not start after an upgrade    

	Internal Defect: 44488
	Symptom: ACCT-MGMT: CANNOT OVERLOAD CONFIGURATION PER VHOST
                    
 	Internal Defect: 45206
	Symptom: PASSWORD CHANGE DENIES UNAUTHENTICATED ACCESS

	Internal Defect: 45143
	Symptom: LTPA DOES NOT RE-GENERATE COOKIES ON CREDENTIAL CHANGE         

2.5 Problems Fixed by Patch 5.1-WPI-0002LA
	Internal Defect: 44562
	Symptom: iis hidden auto-extension-request-uri-config param not working

	Internal Defect: 44588
	Symptom: sap portal only works with pdwebpi.plugin trace set to 9

	Internal Defect: 44595
	Symptom: iis post data following header after server 100 continue broken
	
2.6 Problems Fixed by Patch 5.1-WPI-0001LA

	Internal Defect: 45186 
	Symptom: When a user logs in using forms authentication, they receive
		   a cookie and a login page. The user logs in and obtains a 
		   credential. A security vulnerability exists where an attacker
		   could send his unauthenticated cookie to person X. If person X 
		   logged in using this cookie, the attacker could hijack the 
		   session of person X

	Internal Defect: 44377 
	Symptom: Memory leak in SSL page access.


3.0 INSTALLING THIS PATCH
-------------------------

3.1 Back Up Tivoli Access Manager Data

Before applying any maintenance, be sure to back up your system.  
Use the 'pdbackup' command provided with the Tivoli Access Manager 
product to back up Access Manager-specific data.  Documentation for 
the 'pdbackup' command can be found in the Tivoli Access Manager 
Version 5.1 Command Reference.

If the Tivoli Access Manager Plug-in for Web Servers product is 
distributed over multiple machines, this patch must be applied to all 
systems within a domain.

3.2 Installing This Patch on AIX Systems


  1. Log in to the system as root.

  2. Extract the archive into a temporary directory. For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the plug-in process:
     /opt/pdwebpi/sbin/pdwebpi_start stop         
	 
  4. The host web server should also be stopped.

  5. At the command prompt, enter the following:

      installp -a -g -X -d $PATCH <package>

	where <package> is one of the following:

           PD.WPI
           PD.WPIIHS
	     PD.WPIiPlanet
      Note: The user does not have the option of installing selected APARs using smitty.

  6. Restart the plug-in processes:

       /opt/pdwebpi/sbin/pdwebpi_start start	
     
  7. Restart the host web server
  

3.3 Installing This Patch on Sun Solaris Operating Environment Systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.
     
  3. Stop the Plug-in process:

         /opt/pdwebpi/sbin/pdwebpi_start stop
	
  4. Stop the host web server.

  5. At the command prompt, enter the following:

       cd $PATCH
       patchadd <package>
     
       where <package> is one of the following:

      	PDWPI000510-07
		PDWPIAPA000510-07
		PDWPIIPL000510-07
		PDWPIIHS000510-07

  6. Restart the Plug-in processes:

	 /opt/pdwebpi/sbin/pdwebpi_start start
 
  7. Restart the host Web server
  

3.6 Installing this patch on Linux Systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the Plug-in process:

         /opt/pdwebpi/sbin/pdwebpi_start stop

  4.  Stop the host Web server. 

  5. At the command prompt, enter the following:

       rpm -U <patchname>

       where <patchname> is one of the following:

           PDWPI-Apache-5.1.0-7.s390.rpm
           PDWPI-IHS-5.1.0-7.s390.rpm
           PDWPI-PD-5.1.0-7.s390.rpm

       If Tivoli Access Manager is already configured, you
       might need to install with the --noscripts flag:

	rpm -U --noscripts <patchname>

       
  6. Restart the Plug-in processes:

	 /opt/pdwebpi/sbin/pdwebpi_start start

  7. Restart the host Web server.


3.7 Installing This Patch on Microsoft Windows Systems

   1. Log in to the Windows system as the Administrator.

      Shut down the plug-in services:
         a. From Control Panel -> Services click 
	    'Access Manager Plug-in for Web Servers' then click 
	    'Stop'.
         b. Confirm your action by clicking 'Yes'.
         c. Stop the IIS server using the Internet Services Manager.   
         
   2. Unpack the self-extracting archive into a temporary
      directory. For the purpose of this README, assume that
      %PATCH% points to this temporary directory.

   3. Change to the patch directory and run the install command:

           cd %PATCH%
           5.1-WPI-0007.exe

      Note: if for any reason you have to reboot your system to
      complete this installation (for example, to overcome a
      shared DLLs problem), you might subsequently encounter a
      problem running the Web Portal Manager to access the console.
      If this happens, confirm that the WebSphere service is
      running. The WebSphere service is installed in manual startup
      mode and might not be running after a reboot.

   4. Restart the Web plug-in:

      From the Windows Desktop:
         a. Click 'Access Manager Plug-in for Web Servers' -> Start
         b. Start the IIS server using the Internet Services Manager.


4.0 UNINSTALLING THIS PATCH
---------------------------

NOTE:  Uninstallation is not available on Microsoft Windows systems.

If the Tivoli Access Manager product is distributed over multiple machines,
uninstall this patch on those systems in the reverse order as it was applied.

To remove the patch on UNIX systems, perform the following steps.

   1. Log in to the system as root.

   2. Stop the Plug-in process:

         /opt/pdwebpi/sbin/pdwebpi_start stop
   3. Stop the host Web server.

   4. At the command prompt, enter the following:

      On AIX, reject the applied patch:

         installp -r <package>

         where <package> is one of the following:

           PD.WPI
           PD.WPIIHS
	     PD.WPIiPlanet

         Example:  installp -r  PD.WPI


      On Solaris, remove the patch:

         patchrm  <package>

         where <package> is one of the following:
         
      	PDWPI000510-07
		PDWPIAPA000510-07
		PDWPIIPL000510-07
		PDWPIIHS000510-07
	Example:  patchrm PDWPI000510-07
      
      On Linux, apply the previous patch level:

         rpm -U --oldpackage <old_package>

              
   4. Restart the Plug-in processes:

          /opt/pdwebpi/sbin/pdwebpi_start start

   5. Restart the host Web server and the processes associated with
      other Tivoli Access Manager products stopped in step 2.



5.0 VERIFYING THE PATCH LEVEL
-----------------------------

To verify the patch level of your Tivoli Access Manager installation,
do the following.

   On AIX:      lslpp -L PD\*

   On Solaris:  showrev -p

   On Windows:  1. run 'regedit'
                2. find \HKEY_LOCAL_MACHINE\
                            SOFTWARE\
                               Tivoli\
                                  Access Manager Plug-in for Microsoft IIS\
					5.1\
                                  Access Manager Plug-in for Web Servers\
					5.1\

You also can use the pdversion command.

6.0 DOCUMENTATION UPDATES
-------------------------

The product documentation for Tivoli Access Manager Version 5.1 can be
found at the following Web address:

  http://publib.boulder.ibm.com/tividd/td/IBMAccessManagerfore-business5.1.html

Updated information related to the documentation is as follows.

6.1 Incorrect Instructions for Creating a New External Credential 

Under the heading, 'Adding LDAP extended attributes to the HTTP header' (tag value)
on pages  102 - 103, the plug-in documentation incorrectly  provides
instructions for creating a new extended credential and specifying it 
as an authentication mechanism. This is 4.1 functionality that is no 
longer supported in 5.1. Users should disregard the instructions on page 103 
that begin:
You can also create a new Tivoli Access Manager extended credential CDAS 
and specify this as an authentication mechanism in the plug-in. For 
example...
The guide then goes on to list four steps for achieving this. This passage 
is incorrectly included in this document.

6.2 Forms should be configured as pre-authzn modules when using Forms for authentication

Instructions for configuring the forms authentication mechanism in 
the Tivoli Access Manager Plug-in for Web Servers Integration Guide should make 
it clear that when Forms are used for authentication they should also be 
configured as a pre-authzn module. 
On page 62 under the heading 'Enabling Forms Authentication', the first sentence
of the second paragraph should read:
'When using forms authentication, the plug-in must also be configured
to use forms for pre-authorization processing.' 
On page 197, the description for the pdwpi-forms-module currently
states that when in use it must also be configured as a 
post-authzn module, this should be pre-authzn.


7.0 SOFTWARE LIMITATIONS
------------------------

   None


8.0 TROUBLE SHOOTING
-----------
Symptom: 

Installation of patches may fail if Sun patch 110934-10 is installed. 
Doing a patchadd on Solaris has a potential problem in that the OS can 
report that it requires an unusually large amount of disk space to perform 
the operation.
Reference: http://seer.support.veritas.com/docs/252441.htm

Solution: 
The workaround is either:
1. Rename the space file. 
   For example, if installing the LA release of WebPI (Jan 2004), 
   then do the following:
   mv /var/sadm/pkg/pdwebpi/install/space /var/sadm/pkg/pdwebpi/space.org
Or for Sun OS 5.8,
2.  Upgrade to Sun pkgadd patch 110934-11 where Bug ID 4786593 is fixed.

Symptom:

The patch will fail if an attempt is made to upgrade to 5.1.0-TIV-WPI-FP0007  
from the 5.1-WPI-0001LA, 5.1-WPI-0002LA,5.1-WPI-0003LA,5.1-WPI-0004LA
or 5.1-WPI-0005LA install packages on the Sun Solaris operating system.
  
This is due to a limitation in the patchadd utility. The error is as 
follows:

Checking installed patches...
One or more patch packages included in
PDWPI000510-07 are not installed on this system.

Patchadd is terminating.

Solution:
The work around is as follows:
1. Modify the VERSION entry in the pkginfo file to point to the currently 
   installed version. For example, if the version currently installed  
   is 5.1-WPI-0004, then the VERSION field needs to be set to 5.1.0.4
2. Perform a patchadd of the modified patch, this will fail.
3. Get the correct checksum for the modified pkginfo from the patchadd 
   log file and amend the checksum value within the pkgmap file of the patch.
4. Perform a patchadd of the modified patch.


9.0 NOTICES
-----------

This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this
document in other countries. Consult your local IBM representative for
information on the products and services currently available in your area. Any
reference to an IBM product, program, or service is not intended to state or
imply that only that IBM product, program, or service may be used. Any
functionally equivalent product, program, or service that does not infringe
any IBM intellectual property right may be used instead. However, it is the
user's responsibility to evaluate and verify the operation of any non-IBM
product, program, or service. IBM may have patents or pending patent
applications covering subject matter described in this document. The
furnishing of this document does not give you any license to these patents.
You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the
IBM Intellectual Property Department in your country or send inquiries, in
writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law: INTERNATIONAL
BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions; therefore, this statement may not
apply to you.

This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this
IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the
purpose of enabling: (i) the exchange of information between independently
created programs and other programs (including this one) and (ii) the mutual
use of the information that has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758
U.S.A.

Such information may be available, subject to appropriate terms and
conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer
Agreement, IBM International Program License Agreement or any equivalent
agreement between us.

Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments
may vary significantly. Some measurements may have been made on
development-level systems and there is no guarantee that these measurements
will be the same on generally available systems. Furthermore, some measurement
may have been estimated through extrapolation. Actual results may vary. Users
of this document should verify the applicable data for their specific
environment.

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.

All statements regarding IBM's future direction or intent are subject to
change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include
the names of individuals, companies, brands, and products. All of these names
are fictitious and any similarity to the names and addresses used by an actual
business enterprise is entirely coincidental.

9.1 Trademarks

IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, NetView, Tivoli Enterprise,
Tivoli Enterprise Console, and TME are trademarks or registered trademarks of
International Business Machines Corporation in the United States, other
countries, or both.

Lotus is a registered trademark of Lotus Development Corporation and
International Business Machines Corporation in the United States or other
countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
Microsoft Corporation in the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and
other countries.

C-bus is a trademark of Corollary, Inc. in the United States, other countries,
or both.

ActionMedia, LANDesk, MMX, Pentium, and ProShare are trademarks of Intel
Corporation in the United States, other countries, or both. For a complete
list of Intel trademarks, see
http://www.intel.com/sites/corporate/tradmarx.htm.

SET and the SET Logo are trademarks owned by SET Secure Electronic Transaction
LLC.

Java and all Java-based trademarks and logos are trademarks or registered
trademarks of Sun Microsystems, Inc. in the United States and other countries.

Other company, product, and service names may be trademarks or service marks
of others.



End of IBM Tivoli Access Manager Plug-in for Web Servers, Patch 5.1-WPI-0007 README

