File:   4.6.0-TIV-TIM-IF0083.README For ITIM 4.6.0 using IBM WebSphere Application Server.
Date:   November 25, 2008

Interim fix 4.6.0-TIV-TIM-IF0083 for APARs IZ36590, IZ37308, IZ37472, IZ37667, and IZ37677.

Components:
        enrole.ear for all ITIM supported platforms for WebSphere Application Server.
        IZ30152.zip for all supported databases.
        enRole.properties

General Description:

This Interim fix provides fixes for APARs IZ36590, IZ37308, IZ37472, IZ37667, and IZ37677.

    Problems Fixed:

    APAR:    IZ36590
    Symptom: Incorrect label resource is used for displaying the attributes of entities in the report schema
             mapping screen of the ITIM UI.
    Note:    For the reporting component, the look up for the labels in the properties file is performed in
             the following order: reportingLabels.properties, Messages.properties, Labels.properties,
             CustomLabels.properties.

    APAR:    IZ37308
    Symptom: NullPointerException is thrown when 'eruid' attribute of the account has a Read Only ACI and 
             an attempt is made to validate the password against the standard password rules from a new
             provisioning request.

    APAR:    IZ37472
    Symptom: ObjectNotFoundException in DirectoryObjectSearch.read() should be logged at DEBUG_MID level
             instead of the current DEBUG_MIN level.

    APAR:    IZ37667
    Symptom: The relevant data object of type "List" used in workflow doesn't return expected results.

    APAR:    IZ37677
    Symptom: The LogAnalyzer tool is unable to load ITIM trace.log files that contain entries with 
    		 nested CDATA sections.

    Old Problems Fixed from prior Interim Fixes:

    APAR:    IZ31241
    Symptom: The deletion of a dynamic role does not complete when the referential integrity is enabled
             on the directory server configured with ITIM and a person having this dynamic role exists.

    APAR:    IZ33727
    Symptom: If an account add process finishes with a warning, no newAccountNotification is sent to the
             account owner. Whereas an email notification is sent if the process completes successfully.
    Note:    The following new property has been introduced in $ITIM-HOME/data/enRole.properties file:
                 enrole.workflow.notifyaccountsonwarning
             This property specifies whether notifications will be sent when account requests returns a
             status of 'Warning' from the adapter. The default value of this property is 'false'. If set
             to 'true', an email notification is sent even when the account operation (such as Add,
             Modify, Suspend, Restore, Delete or Change Password) completes with a 'Warning' status.
             A copy of enRole.properties file with this addition has been provided for your reference as an
             example.

    APAR:    IZ34100
    Symptom: The ersynchpassword attribute is not updated when a person has only one account in the ITIM server
             and the password change request is initiated from the reverse password synchronization adapter.

    APAR:    IZ29833
    Symptom: Poor performance while expanding the container in an orgchart containing about 2000 business 
             partner organizations with ACIs in effect.

    APAR:    IZ30152
    Symptom: The Custom Operations performed on an account are not displayed in the "Account Operation" report.
    Note:    Execute the additional steps listed in step 3 in the COMMON TASKS section at the 
             end of the README. Additional file, IZ30152.zip is shipped along with this Interim fix.
             Please note that, after the fix, under Reports > Workflow Reports > 'Account Operations' and 
             'Account Operations Performed by an Individual' reports, in the drop down box for 
             "Account Operation", a new option called "subprocessview.type.cp" will be displayed.
             please interpret this as "Custom Process".

    APAR:    IZ31777
    Symptom: PasswordSynch servlet does not check for the existence of Account/Owner, prior to checking
             the password rules.
    Note:    When the Change Password request is performed from the agent, for the account not managed
             by ITIM, the password validation can be skipped by setting the following property in
             $ITIM-HOME>/data/enRole.properties file to a value of 'true' as shown below:.
                 reversePasswordSynch.bypassPwdValidtaionOnOrphanAccount=true
             Please note that passwordsynch logs will still show that the password rule validation
             is done prior to checking for the account in ITIM as the agent sends the request to
             ITIM for password validation. However, on the ITIM side, if the above property is set to
             true, ITIM skips the password validation.

    APAR:    IZ32908
    Symptom: Report Data Synchronization leaves view PROVPOLICYMEMBERVIEW marked as invalid when Oracle
             is used for the ITIM database.

Architecture(s): Windows, Solaris, AIX, HPUX, and Linux.

Fixes superseded: ITIM Interim fixes 4.6.0-TIV-TIM-IF0080 and 4.6.0-TIV-TIM-IF0081.

Dependencies: Fixpack 4.6.0-TIV-TIM-FP0079.

Database Changes: OPTIONAL changes to replace (delete and add) an existing view definition 
                  as required to fix APAR IZ30152.

JMS (Java Messaging Service) Changes: NONE

LDAP Changes: NONE.

Files Replaced or Added or Modified by this Interim fix:

    <ITIM_HOME>/enrole.ear

Patch Contents:
  - This README file
  - enrole.ear
  - IZ30152.zip
  - enRole.properties

MD5 Checksums:
  dff8cb053b1ba32e528de3bd44495292  4.6.0-TIV-TIM-IF0083.zip
  b384b50f620d597a9828674864b4f40a  enrole.ear
  996328e5320f5ad85cd217d93d9d8b56  IZ30152.zip
  575f541cff7736e8058987be9d70a7c8  enRole.properties

Applying the Patch:

    1) Extract the Interim Fix zip file to a temporary directory on your hard drive:

          # jar xvf 4.6.0-TIV-TIM-IF0083.zip

       NOTE:  You may also use any unzip equivalent to unpack the zip file.
              Back-level versions of jar, FastJar or PKZIP may report errors.
              Use the jar executable supplied with java or another zip utility
              to uncompress the file.

    2) Copy the file(s) to the appropriate directory.

NOTE: *************************************************************************
       Always BACKUP your old files in a safe place in case an unforeseen
       event occurs.  It is recommended to backup ITIM_HOME/data directory.
       Especially, be sure to backup any configuration files you
       may have modified  such as properties or xml files.
NOTE: *************************************************************************
       IF YOU ARE USING JAVA 2 SECURITY:
       Backup up your was.policy file to a temporary holding directory.  During
       the fix application you will be re-deploying enrole.ear, which removes the
       $WAS_HOME/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
       directory and its contents. During the deployment, the was.policy is not
       replaced and will need to be copied back during the COMMON TASKS section
       of this document. On a Cluster this needs to be done on the NDM as well.
       $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
NOTE: *************************************************************************
       IF YOU HAVE MIGRATED FROM ITIM 4.5.1 to ITIM 4.6
       If your ITIM V4.6 system is migrated from V4.5.1, it is necessary to copy
       the jsafe.jar and log4j.jar files from the:
       $ITIM_HOME/lib
       directory into:
       $WAS_HOME/installedApps/$CELL_NAME/enRole.ear directory
       You must always copy these 2 files back after installing an ITIM Interim Fix
       or Fixpack.
       The jsafe.jar file is no longer used in ITIM 4.6.0, since the encryption
       is changed in 4.6.0, but the jsafe.jar file is needed to be able to
       encrypt/un-encrypt the existing 4.5.1 data in LDAP.
NOTE: *************************************************************************
       IF YOU HAVE INSTALLED A CUSTOM LOGO:
       The logo is copied to:
       $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war/images
       The Fixpack and Interim fix process removes the enRole.ear and all subdirectories.
       To make it easier to restore the custom logo, copy it to a backup directory of your
       choosing to facilitate copying it back after the Fixpack or Interim fix is applied.
       The ui.properties is preserved so it will not need to be updated.
       After the Interim fix is installed copy the custom logo to:
          $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war/images
NOTE: *************************************************************************
       IF YOU HAVE CREATED CUSTOM APPLICATIONS:
          Custom applications using the ITIM APIs must reference the same level JAR files as
          the ITIM server.  Copy the itim_server.jar and itim_api.jar, as well as any other
          JARs used, to the custom applications classpath. Updated jars are necessary to
          prevent CORBA marshalling exceptions.
NOTE: *************************************************************************
       IF YOU HAVE INSTALLED A LANGUAGE PACK:
          Symptom - Fixpacks and Interim fixes partially overwrite Language Pack installation.
          Note - Before the Fixpack or Interim fix installation, take a back-up of the following
          files/folder related to the language pack, located in the directory:
            $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war
             - AppletErrorMessages_<language code>.properties
             - AppletLabels_<language code>.properties
             - AppletMessages_<language code>.properties
             - The folder along with it's contents by the name as <language code>.

       The <language code> is generally a two letter word representing the language.
       For example for English, the language code is 'en'.

       After applying the Fixpack or Interim Fix, restore all the language pack related files
       and folder, that were backed up, to their respective locations in the directory:
       $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war

       Note that for WAS Cluster installation, the same steps will have to be followed on
       each of the nodes. This procedure is needed only on the cluster member, not on the
       Deployment Manager node.
NOTE: *************************************************************************
       The enrole.ear installed in:
       <ITIM_HOME>/ directory
       The file, enrole.ear, is used for single server and regular cluster.
       For all instances of <server_name> below we are referring to the AppServer name in
       WebSphere, usually referred to as server1 in a single server environment.

       NOTE***  SINGLE SERVER INSTRUCTIONS:
       Please use the following instructions for a Single Server environment.
       If this is a single server environment, only the enrole.ear is needed.

       1. Log in to the App Server Administrator.

        a. Example:
                http://localhost:9090/admin .

       2. Uninstall enrole application

        a. Select the enRole application

        b. Stop the enRole application

        c. Uninstall the enRole application

        d. Above this box, click on save the configuration...another panel will
           come up and you will need to confirm this by pressing the save configuration
           button.

        e. You are now finished with the App Server Administrator
       3. In the <ITIM_HOME>/bin directory run
                SetupEnrole install server:<server_name>  (e.g. server1)

           If you have WAS Security setup then:

                SetupEnrole install server:<server_name> user:<userid> password:<password>

       4. Perform the COMMON TASKS listed below these instructions.

       5. After you are done with the COMMON TASKS, then:

       6. Restart WAS and you are done.

        a. Stop the AppServer (stopServer.sh)

        b. Start the AppServer (startServer.sh)


       NOTE***  CLUSTER INSTRUCTIONS:
       Please use the following instructions for a Cluster environment.

       1C. Ensure all node agents are up and can communicate with the NDM.

       2C. Uninstall the ITIM Application from WebSphere.

        a. Stop the cluster. Use "ssCluster.sh stop" or from NDM admin console,
           navigate to Servers -> Clusters. Select the cluster (s) where ITIM
           is installed, and stop.

        b. Uninstall the enrole enterprise app.

        c. Save the config ensuring that it is synched with all the nodes.

        d. Logout from the NDM admin console.

       3C. Re-Install ITIM.

        a. From NDM, run <ITIM_HOME>/bin/setupEnrole install. This is same as
           in single server case, except, you don't need the "server" argument
           here because the app will be deployed onto a cluster.

           If you have WAS Security setup then:

                SetupEnrole install user:<userid> password:<password>

       4C. Perform the COMMON TASKS listed below these instructions.

       5C. Start the cluster. Use "ssCluster.sh start" or do it from the NDM
           admin console.


NOTE: *********************************************************************************
       The following are COMMON TASKS that you need to perform prior to restarting the
       AppServer or Cluster.
NOTE: *********************************************************************************

       1. You must copy the updated api jar files to the $ITIM_HOME/lib directory.
           Copy the itim_api.jar, itim_server.jar and the api_ejb.jar from:
                $WAS_HOME/installedApps/$CELL_NAME/enrole.ear  directory to
                $ITIM_HOME/lib  directory.

       2. If you are using the JAVA 2 Security, replace the was.policy file you saved
          earlier.  Copy it back to:
          $WAS_HOME/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
          For Cluster in the NDM:
          $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
          Where $CELL_NAME is either the $MACHINE_NAME or $CLUSTER_NAME.
          For additional information on using JAVA 2 Security with ITIM, please review the ITIM
          Installation Guide, Appendix C.

       3. OPTIONAL: Additional steps for IZ30152
          1. Extract the IZ30152.zip file to a temporary directory on your hard drive.
          
          2. Execute the following steps to apply the database schema change:

            The ddl file(s) present in the database type specific directory, which contains a database script, 
            should be executed on your corresponding DB platforms (i.e. DB2,Oracle and SQL Server). 
            The script should be run by the database user configured for ITIM. 
            Copy the ddl file(s) into some appropriate work directory of your choosing
            Run the scripts according to the instructions given below.

          SQL Server:
          -----------
             Use the Microsoft SQL Server "Query Analyzer" tool, or a supported SQL client to 
             execute the ddl script.
             In Initial Dialog "Connect to SQL Server", specify:
             User: enrole
             Password: <enrole's configured password>
             Select menu "File" | "Open..."
             File name: <Full path name of IZ30152DeleteView.ddl shipped in mssql folder 
                        in IZ30152.zip>
             Select menu "Query" | "Change Database..."
             Select your database name (default is "itim")
             Select "OK".
             Select menu "Query" | "Execute"
             Select menu "File" | "Open..."
             File name: <Full path name of IZ30152CreateView.ddl shipped in mssql folder 
                        in IZ30152.zip>
             Select menu "Query" | "Execute"
             Select "File" | "Exit".

          Oracle:
          -------
          Run the Oracle sqlplus program. Specify your database user password for the
          enrole user in place of "PASSWORD", your Oracle ITIM instance name in place of
          "ITIMDB".
              sqlplus enrole/PASSWORD@ITIMDB
              > @<Full path name of IZ30152.ddl shipped in oracle folder in IZ30152.zip>
              > quit

          DB2:
          ----
          Type db2cmd to get the db2 prompt and on the prompt type the following:
              db2 connect to <dbname> user enrole using <enrole's password>
              db2 -tvf <Full path name of IZ30152.ddl shipped in db2 folder in IZ30152.zip>

         END OF COMMON TASKS

End of Readme