IBM(R) Tivoli(R) Access Manager for e-business WebSEAL, Patch 5.1.0-TIV-AWS-FP0006 README
==============================================================================

(C) Copyright International Business Machines Corporation 2004.
All rights reserved.
U.S. Government Users Restricted Rights -- Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

NOTE:  Before using this information and the product it supports,
       read the general information under "NOTICES" in this document.

DATE:  Wednesday, 10 March 2004

------------------------------------------------------------------------------
    CONTENTS

   1.0 ABOUT THIS PATCH
       1.1 Patch contents
       1.2 Architectures
       1.3 Patches superseded
       1.4 Dependencies

   2.0 APARS AND DEFECTS FIXED
       2.1 Problems fixed by patch 5.1.0-TIV-AWS-FP0006
       2.2 Problems Fixed by Patch 5.1-AWS-FP04
       2.2 Problems Fixed by Patch 5.1-AWS-FP02
       2.3 Problems fixed by patch 5.1-AWS-0001

   3.0 BEFORE INSTALLING THIS PATCH
       3.1 Back up Tivoli Access Manager data
       3.2 Upgrade GSKit to Version 7.0.3.3

   4.0 INSTALLING THIS PATCH
       4.1 Installing this patch on AIX(R) systems
       4.2 Installing this patch on HP-UX systems
       4.3 Installing this patch on Linux systems
       4.4 Installing this patch on Solaris Operating Environment systems
       4.5 Installing this patch on Windows systems

   5.0 UNINSTALLING THIS PATCH

   6.0 AFTER INSTALLING THE PATCH
       6.1 Verifying patch level
       6.2 Adding new components To a system
       6.3 Configuring WebSEAL to use the SecurID client library

   7.0 DOCUMENTATION UPDATES
       7.1  [cdsso] and [e-community-sso] stanzas (45107)
       7.2  New configuration option - default-tokens-use-argument (45261)
       7.3  WebSEAL Administration Guide correction (45908)
       7.4  Additional WebSEAL Administration Guide corrections
       7.5  Attribute Retrieval Service plug-in example - README correction
       7.6  Authorization C API Developer Reference correction
       7.7  Authorization Java Classes Developer Reference correction
       7.8  New [FILTER-CONTENT-TYPES] entries undergo script filtering (45959)
       7.9  [ldap] stanza-related timeout entries not documented (APAR IY53103)
       7.10 CDSSO cannot rely on browser referer header (28346)
       7.11 Cannot update some Active Directory expired passwords (46200)
       7.12 WebSEAL token authentication now supports Lotus Domino and Active
            Directory user registries (44954)
       7.13 Authentication cookie is refreshed on login (IY53475)
       7.14 New optional parameter to [junction] stanza (IY50317)
       7.15 A new parameter in the [script-filtering] stanza (47032)
       7.16 Expired password in AD_LDAP might prevent WebSEAL auth (43684)
       7.17 Filtering is broken if the BASE HREF contains ONLY host name(43515)
       7.18 Server-relative URL filtering is not working. (IY49886)
       7.19 Trace log contains 302 "content-encoding: gzip" responses.(38952)
       7.20 CDSSO-ARGUMENT NOT FUNCTIONING - iv_groups aren't passed to
            BackEnd server. (IY51261)
       7.21 CLARIFICATION OF WEBSEAL LOGGING CONFIGURATION (IY53897)
       7.22 CUSTOMER HAS PROBLEMS CONFIGURING MSGS RECEIVING THEM IN VARIOUS
            LANGUAGES (IY52390)
       7.23 INCORRECT DESCRIPTION OF INTRA-CONNECTION-TIMEOUT (50058)
       7.24 Clarification of Valid Characters for ACL Names (IY53637)
       7.25 Users with expired password can CDSSO, SU, be VOUCHFOR'ED (44563)
       7.26 WebSeal 3.8 custom login pages don't work for 5.1 (47291,IY55336)
       7.27 Docs for using BA headers for SSL needs to be combined (IY56542)
       7.28 WebSEAL script-filter parameter description correction (49901)
       7.29 Switch user admin cred attribute lost during failover. (32478)
       7.30 Change all server passwords for security purposes (50791)
       7.31 Confusing doc for %BASICAUTHN%, %CERTAUTHN%, and %TOKENAUTHN% (IY58348)
       7.32 Document PDADMIN terminate session command (48787)
       7.33 New config option to supress-backend-server-identity (51470)
       7.34 Allow junctioned virtualservers to set virtual domain cookie (IY54986)
       7.35 Bad content length POST returning 'Request entity too large' (IY55367)
       7.36 %ERROR% Macro not set when username or pw is left blank (IY56902)
       7.37 WebSeal drops "?" when search string is empty (IY59576)
       7.38 Incorrect PATH name for cdsso_key_gen in WebSEAL Admin Guide (IY58445)
       7.39 Undocumented webseald message codes need to be documented (IY57186)
       7.40 Incorrect package name listed in the Upgrade Guide (IY61297)
       7.41 Modifying JavaScript inserted by the "-j" junction option (IY61959)

   8.0 SOFTWARE LIMITATIONS

      9.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
       9.1 WebSEAL installation wizard hangs (45569) (APAR IY52675)
       9.2 Install the WebSEAL language package prior to configuring WebSEAL
           (44829)
       9.3 File Downloads getting truncated when no/short delay is involved.
           (APAR IY48098)

  10.0 NOTICES
       10.1 Trademarks

1.0 ABOUT THIS PATCH
--------------------
This patch package contains fixes for problems in the various components that
comprise the Tivoli Access Manager WebSEAL software.


1.1 Patch Contents

This patch package contains:

- This README file
- Update patch packaging


1.2 Architectures

This patch package applies to the following architectures:

    - IBM AIX(R) 5.1 and 5.2
    - Sun Solaris Operating Environment 2.8 and 2.9
    - HP-UX 11 and 11i
    - Red Hat Enterprise Linux 3.0
    - SuSE SLES8 for IA32
    - SuSE SLES8 for S/390(R) and zSeries(R) (31-bit systems) with SP 2
    - SuSE SLES8 for zSeries (64-bit systems, 31-bit compat. mode) with SP 2
    - Microsoft Windows 2000 Server and Advanced Server with SP 3
    - Microsoft Windows 2003 Standard Server and Enterprise Server

NOTE:  SuSE Linux is one of four partner companies whose products are
       based on UnitedLinux 1.0; other companies being the SCO Group,
       Turbolinux, and Conectiva. When SuSe Linux Enterprise Server (SLES)
       is listed as supported, other partner companies' products based on
       UnitedLinux 1.0 support is implied as well. For more information,
       consult the UnitedLinux Web site at:
       http://www.unitedlinux.com


1.3 Patches Superseded

Patches superseded by this patch:

    5.1-AWS-FP02
    5.1-AWS-FP04


1.4 Dependencies

IBM Tivoli Access Manager WebSEAL, Version 5.1
IBM Tivoli Access Manager Base, Version 5.1 with patch


2.0 APARS AND DEFECTS FIXED
---------------------------
Because patches are cumulative, this patch corrects all the problems
outlined in the following sections.

2.1 Problems Fixed by Patch 5.1.0-TIV-AWS-FP0006

    APAR IY56878
    SYMPTOM:  Webseal changing cookies that then become invalid

    APAR IY54986
    SYMPTOM:  Allow junctioned virtualservers to set virtual domain cookie

    APAR IY59576
    SYMPTOM:  WebSeal drops "?" when search string is empty

    APAR IY55367
    SYMPTOM:  Bad content length POST returning 'Request entity too large'

    APAR IY56902
    SYMPTOM:  %ERROR% Macro not set when username or pw is left blank

    APAR IY58289
    SYMPTOM:  SWITCH-USER FORM ADJUSTMENT CMVC 50369

2.2 Problems Fixed by Patch 5.1-AWS-FP04

    DEFECT: IY51361  (APAR: IY57662)
    SYMPTOM: If a WebSEAL server is configured to resend WebSEAL set-cookies,
             and not to generate e-community sso cookies, and receives an ECSSO
             cookie, the server will crash.

    DEFECT: IY53140  (APAR: IY57663)
    SYMPTOM: Failed connection requests when certs are required, are not logged
             in request.log.

    APAR IY53179
    SYMPTOM:  If timeout for max lifetime is 0 it caused high CPU usage

    APAR IY55117
    SYMPTOM:  Entitlements service not passing multi-values

    APAR IY55120
    SYMPTOM:  WebSEAL not releasing worker threads when clicking "back" on
              a not found page

    APAR IY55336
    SYMPTOM:  WebSeal 3.8 custom login pages don't work for 5.1

    APAR IY55478
    SYMPTOM:  WEBSEAL failed to start if dynurl-map is commented out on Linux

    DEFECT: IY55621  (APAR: IY57665)
    SYMPTOM: If a junction is deleted whose stats are on, webseald dies on next
             stats gathering and writing to log file.

    APAR IY57662
    SYMPTOM:  If resend-webseal-cookies is set, and PD-ECC set w/out ECSSO
              configured, the server will crash

    APAR IY57663
    SYMPTOM:  WEBSEAL is not logging requests when accept-client-certs=required

    APAR IY57664
    SYMPTOM:  Multiple HTTP POST in request.log

    APAR IY57665
    SYMPTOM:  WebSEAL 4.1 cores when STAT is ran for a deleted junction.

    Internal CMVC DEFECT: 44563
    SYMPTOM:  USERS WITH EXPIRED PASSWORD CAN CDSSO, SU, BE VOUCHFOR'ED

    Internal CMVC DEFECT: 47291
    SYMPTOM:  FORTIS - HIDDEN CONFIG - LOGIN-FORM-TYPE FOR LOGIN FORMS

    Internal CMVC Defect 50522
    SYMPTOM: WebSEAL will crash if any error, like a timeout, occurs on a
             connection.

2.3 Problems Fixed by Patch 5.1-AWS-FP02

    APAR IY46618
    SYMPTOM: Session state cannot be maintained with SSL IDs when using Opera
    Web Browser.

    APAR IY46695  (Internal CMVC Defect 44453)
    SYMPTOM: XML/XHTML filtering within WebSEAL causes high CPU utilization.
    This can cause WebSEAL to hang when a user accesses a non-html document
    type.

    APAR IY47032
    SYMPTOM: When a meta-tag refresh is returned from a Backend server accessed
    via a -j junction, the refresh does not work via an HTTP Smart Compression
    proxy with a Netscape 4.x browser.

    APAR IY48098  (Internal CMVC Defect 44452)
    SYMPTOM: File downloads get truncated when no/short delay is involved.

    APAR IY49645
    SYMPTOM: Failed cdmf_get_usr_attributes will not cause CDSSO and ECSSO
    token creation. If the attributes are necessary for an application,
    the application will fail.

    APAR IY49886
    SYMPTOM: Server-relative URL filtering is not working.

    APAR IY49943
    SYMPTOM: WebSEAL leaks file descriptors and (possibly) memory if all of the
    following are true:

    -- a junction was created with one of the -b options
    -- the junction returns a 401 unauthorized response
    -- the response contains a set-cookie header

    APAR IY50317
    SYMPTOM: Cookie handling within webseal not compatable with J2EE apps.

    APAR IY50332 reference IY50754 (Internal CMVC Defect 45026)
    SYMPTOM: WebSEAL returns a bad request OX38CF0424 and a large DBCS or UTF8
    POST body is encountered (larger than the configured size).

    APAR IY51074
    SYMPTOM: A user logs in and is redirected to the login-redirect-page. If
    the user then changes his password, he is redirected to the
    login-redirect-page again. The login-redirect directive should only
    redirect on login, not password changes.

    APAR IY51525
    SYMPTOM:  Mutually authenticated SSL junctions cannot load balance. If a
    user uses one certificate for each server, only the first server defined
    within the actual junction definition functions.

    APAR IY51261  (Internal CMVC Defect 44642)
    SYMPTOM: CDSSO-ARGUMENT NOT FUNCTIONING - iv_groups aren't passed to
    BackEnd server. New configuration parameter (default-tokens-use-argument).

    APAR IY53464  (Internal CMVC Defect 40361)
    SYMPTOM:  If a user's password expired in Active Directory, the user could
    not authenticate to WebSEAL.

    Internal CMVC Defect 32647
    SYMPTOM: Potential crashes due to lack of memory or inaccurate output may
    be displayed when using the sample cdmf library.

    Internal CMVC Defect 38952
    SYMPTOM: Trace log contains 302 "content-encoding: gzip" responses. When
    a user requests a junction point without a trailing slash /.

    Internal CMVC Defect 43515
    SYMPTOM: Filtering is broken if the BASE HREF contains ONLY the host name.

    Internal CMVC Defect 44293
    SYMPTOM: Base tag filtering for server relative URLs fails. This
    problem occurs when the BASE HREF does not have a trailing slash.

    Internal CMVC Defect 44510
    SYMPTOM: Memory leak when WebSEAL is configured for CDSSO on Windows 2003.

    Internal CMVC Defect 44736
    SYMPTOM:  Poor startup performance when WebSEAL is configured to use
    cookies to maintain a session with clients.

    Internal CMVC Defect 44868
    SYMPTOM: An "Invalid Content Length header" error is returned if a response
    contains multiple content-length headers.

    Internal CMVC Defect 45933
    SYMPTOM: Failover cookie does not work since patch 5.1-AWS-0001. The
    WebSEAL log file states "unable to decode failover cookie" when trying
    to consume a failover cookie.

    Internal CMVC Defect 48068
    SYMPTOM: This issue will require upgrading GSKIT to 7.0.1.16.
    IBM has identified a specific reliability issue in all products that use
    the GSKIT component for managing SSL (Secure Socket Layer) communication.
    In the case of this issue, when subjected to a very specific malformed
    transmission, the IBM product will either have a serious performance
    degradation, or will terminate.  The termination of the application does
    not introduce any further security concerns such as being able to access
    a remote system.


2.4 Problems fixed by patch 5.1-AWS-0001

    APAR IY53474
    SYMPTOM:  When using cookies as sessions on authentications, a new cookie
    should be generated by WebSEAL.


3.0 BEFORE INSTALLING THIS PATCH
--------------------------------
Before installing this patch, review the following prerequisites and
dependencies.


3.1 Back up Tivoli Access Manager data

Before applying any maintenance, be sure to back up your system.  Use
the pdbackup command provided with the Tivoli Access Manager product
to back up Tivoli Access Manager-specific data.  Documentation for the
pdbackup command is located in the "IBM Tivoli Access Manager Command
Reference, Version 5.1."

3.2 Upgrade GSKit to Version 7.0.3.3

Upgrade the IBM Global Security Toolkit (GSKit) to version 7.0.3.3
BEFORE installing the Tivoli Access Manager packages in this patch.

To obtain the updated GSKit installation packages, contact IBM Customer
Support for download locations.  Contact information can be obtained at the
following Web address:

   http://techsupport.services.ibm.com/guides/tivoli_contacts.html

After downloading the updated GSKit installation packages, use the
instructions located in the 5.1-TAM-0017LA.README to install the upgraded
GSKit packages.

4.0 INSTALLING THIS PATCH
-------------------------
Before installing this patch, be sure that you have reviewed the
prerequisites and have completed the back up procedure in section 3.0,
"BEFORE INSTALLING THIS PATCH".

If the Tivoli Access Manager product is distributed over multiple machines,
this patch must be applied to all WebSEAL systems within a secure domain.

This README assumes that $PATCH (or %PATCH% for Windows) is the path to
your temporary directory.


4.1 Installing this patch on AIX systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the Tivoli Access Manager processes:

        /opt/pdweb/bin/pdweb_start stop

  4. At the command prompt, enter the following:

       installp -a -g -X -d $PATCH <package>

       where <package> is one of the following:

       PDWeb.RTE  Specifies the Access Manager Web Security Runtime
       PDWeb.Web  Specifies the Access Manager WebSEAL Server
       PDWeb.ADK  Specifies the Access Manager Web Services ADK
       PDWeb.ARS  Specifies the Access Manager Attribute Retrieval Service

  5. Restart the Tivoli Access Manager processes:

       /opt/pdweb/bin/pdweb_start start



4.2 Installing this patch on HP-UX systems


   1. Log in to the system as root.

   2. Extract the archive into a temporary directory.  For the
      purpose of this README, assume that the symbol $PATCH
      points to this temporary directory.

   3. Stop the Tivoli Access Manager processes:

        /opt/pdweb/bin/pdweb_start stop

   4. At the command prompt, enter the following:

        swinstall -s $PATCH/<package> <patch>

        where <package> and <patch> are one of the pairs
        from the following table:

             <package>                                      <patch>
        ---------------------------------                -------------
        PDWEBRTE000510-06.depot                            PDWebRTE
        PDWEB000510-06.depot                               PDWeb
        PDWEBADK000510-06.depot                            PDWebADK
        PDWEBARS000510-06.depot                            PDWebARS

   5. Restart the Tivoli Access Manager processes:

        /opt/pdweb/bin/pdweb_start start


4.3 Installing this patch on Linux systems


  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the Access Manager processes.

       /opt/pdweb/bin/pdweb_start stop

  4. At the command prompt, enter the following:

       rpm -U <patchname>

       where <patchname> is one of the following:

       Linux on xSeries(R)

            PDWebRTE-PD-5.1.0-6.i386.rpm
            PDWeb-PD-5.1.0-6.i386.rpm
            PDWebADK-PD-5.1.0-6.i386.rpm
            PDWebARS-PD-5.1.0-6.i386.rpm

       Linux on zSeries

            PDWebRTE-PD-5.1.0-6.s390.rpm
            PDWeb-PD-5.1.0-6.s390.rpm
            PDWebADK-PD-5.1.0-6.s390.rpm
            PDWebARS-PD-5.1.0-6.s390.rpm

       Linux on pSeries(R) and iSeries

            PDWebRTE-PD-5.1.0-6.ppc.rpm
            PDWeb-PD-5.1.0-6.ppc.rpm
            PDWebADK-PD-5.1.0-6.ppc.rpm
            PDWebARS-PD-5.1.0-6.ppc.rpm


       Note:
       If Tivoli Access Manager is already configured, you
       might need to install with the --noscripts flag:

           rpm -U --noscripts <patchname>

   5. Restart the Tivoli Access Manager processes:

       /opt/pdweb/bin/pdweb_start start


4.4 Installing this patch on Solaris Operating Environment systems

  1. Log in to the system as root.

  2. Extract the archive into a temporary directory.  For the
     purpose of this README, assume that the symbol $PATCH
     points to this temporary directory.

  3. Stop the Tivoli Access Manager processes:

        /opt/pdweb/bin/pdweb_start stop

  4. At the command prompt, enter the following:

       cd $PATCH
       patchadd <package>

       where <package> is one of the following:


    PDWEBRTE000510-06   Specifies the TAM Web Security Runtime
    PDWEB000510-06      Specifies the TAM WebSEAL Server
    PDWEBADK000510-06   Specifies the TAM Web Services ADK
    PDWEBARS000510-06   Specifies the TAM Attribute Retrieval Service


  5. Restart the Tivoli Access Manager processes:

      /opt/pdweb/bin/pdweb_start start


4.5 Installing this patch on Windows systems

   1. Log in to the Windows system as the Administrator.

   2. Shut down the Tivoli Access Manager WebSEAL server:
      a.  From Control Panel -> Services click Access Manager
          WebSEAL Server and then click Stop.
      b.  To confirm this action, click Yes.

   3. Unpack the self-extracting archive into a temporary
      directory. For the purpose of this README, assume that
      %PATCH% points to this temporary directory.

   4. Change to the patch directory and run the install command:

           cd %PATCH%
           5.1.0-TIV-AWS-FP0006-WIN.exe

      Note: If, for any reason, you have to reboot your system to
      complete this installation (for example, to overcome a
      shared DLLs problem), you might subsequently encounter a
      problem running the Web Portal Manager to access the console.
      If this happens, confirm that the WebSphere service is
      running. The WebSphere service is installed in manual startup
      mode and might not be running after a reboot.

   5. Restart the Tivoli Access Manager WebSEAL server:

      From the Windows Start menu, click:

      a. Settings -> Control Panel -> Administrative Tools -> Services
      b. Click Access Manager WebSEAL Server -> Start
      c. Click IBM WS AdminServer -> Start



5.0 UNINSTALLING THIS PATCH
---------------------------

NOTE:  Uninstallation is not available on Microsoft Windows systems.

If the Tivoli Access Manager product is distributed over multiple machines,
uninstall this patch on those systems in the reverse order as it was applied.

To remove the patch on UNIX systems, perform the following steps.

   1. Log in to the system as root.

   2. Stop the Tivoli Access Manager processes:

       /opt/pdweb/bin/pdweb_start stop

   3. At the command prompt, enter the following:

      On AIX, reject the applied patch:

         installp -r <package>

         where <package> is one of the following:

           PDWeb.RTE
           PDWeb.ADK
           PDWeb.Web
           PDWeb.ARS


      On HP-UX, remove the patch:

         swremove <patch>

         where <patch> is one of the following:

           PDWebRTE
           PDWeb
           PDWebADK
           PDWebARS


      On Linux, apply the previous patch level:

         rpm -U --oldpackage <old_package>

         where <old_package> is one of the following:

         Linux on xSeries

            PDWebRTE-PD-5.1.0-0.i386.rpm
            PDWeb-PD-5.1.0-0.i386.rpm
            PDWebADK-PD-5.1.0-0.i386.rpm
            PDWebARS-PD-5.1.0-0.i386.rpm

         Linux on zSeries

            PDWebRTE-PD-5.1.0-0.s390.rpm
            PDWeb-PD-5.1.0-0.s390.rpm
            PDWebADK-PD-5.1.0-0.s390.rpm
            PDWebARS-PD-5.1.0-0.s390.rpm


         Linux on pSeries and iSeries

            PDWebRTE-PD-5.1.0-0.ppc.rpm
            PDWeb-PD-5.1.0-0.ppc.rpm
            PDWebADK-PD-5.1.0-0.ppc.rpm
            PDWebARS-PD-5.1.0-0.ppc.rpm


      On Solaris, remove the patch:

         patchrm  <package>

         where <package> is one of the following:

           PDWEBRTE000510-06
           PDWEB000510-06
           PDWEBADK000510-06
           PDWEBARS000510-06


   4. Restart the Tivoli Access Manager processes:

        /opt/pdweb/bin/pdweb_start start



6.0 AFTER INSTALLING THE PATCH
------------------------------

6.1 Verifying patch level

To verify the patch level of your Tivoli Access Manager installation,
do the following.

   On AIX:      lslpp -L PD\*

   On HP-UX:    swlist <package>, example: swlist PDWeb

   On Solaris:  showrev -p

   On Linux:    rpm -q -i PDRTE-PD

   On Windows:  1. run 'regedit'
                2. find \HKEY_LOCAL_MACHINE\
                            SOFTWARE\
                               Tivoli\
                                  Access Manager WebSEAL\
                                     5.1.0.0\

You also can use the pdversion command.


6.2 Adding new components to a system

To install a new component of Tivoli Access Manager on an EXISTING
machine in the Tivoli Access Manager environment after this patch has
been installed:

   1. Install the component using the Tivoli Access Manager Version 5.1
      installation media.

   2. After the new component is installed, reapply this patch to the system.


6.3 Configuring WebSEAL to use the SecurID client library

The default shared library for token authentication maps SecurID (RSA)
token passcode data to a Tivoli Access Manager user identity.  The
authentication process requires an RSA SecurID client library file, located
on the WebSEAL server machine, to communicate with a remote RSA server.

For successful communication between this client file and server, you must
manually set the proper permissions on the file and set an environment
variable that points WebSEAL to the location of the library file:

    1. Change the permissions of the securid file to allow "read"
       access by everyone. The following example assumes the location
       of the file is the /opt/ace/ace/data directory:

       UNIX:
                 cd /opt/ace/ace/data
                 chmod 444 securid

       Windows:
                 Set the Security Properties on the file for "Everyone".

    2. Set the VAR_ACE environment variable to inform WebSEAL
       of the directory location of this file. The following
       example assumes the location of the file is the
       /opt/ace/ace/data directory:

       UNIX:
               export VAR_ACE=/opt/ace/ace/data

       Windows:
               Start -> Settings -> Control Panel -> System -> Environment



7.0 DOCUMENTATION UPDATES
-------------------------
The product documentation for Tivoli Access Manager Version 5.1 can be
found at the following Web address:

http://publib.boulder.ibm.com/tividd/td/IBMAccessManagerfore-business5.1.html

Updated information related to the documentation is as follows.


7.1 [cdsso] and [e-community-sso] stanzas (45107)

When an SSO token is generated, a call is made to the Cross Domain Mapping
Framework (CDMF) API to determine the extended attributes that must be
encoded into the token. This is so the user can be correctly mapped across the
SSO authentication. The propagate-cdmf-errors parameter determines whether
the failure of the cdmf_get_usr_attributes call will cause token creation
to fail. If propagate-cdmf-errors = no (default), a default attribute list is
generated if the CDMF fails, and token creation proceeds without error.
However, if propagate-cdmf-errors = yes and CDMP fails, token creation is
aborted.


7.2 New configuration option - default-tokens-use-argument (45261)
    (reference IY51261)

default-tokens-use-argument is a new configuration parameter in the cdsso and
ecsso stanzas. This parameter defaults to 'yes' as follows:

[cdsso]
default-tokens-use-argument = yes
[ecsso]
default-tokens-use-argument = yes

A 'yes' value specifies to use the default ssocreate and ssoconsume libraries
with cdsso or ecsso. They create/consume tokens with the token name of the
cdsso/vf-argument configuration parameter.

To be backward compatible, set this parameter to 'no'. A 'no' value specifies
for the standard sso libraries to create/consume tokens, called PD-ID (cdsso)
and PD-VF (ecsso), regardless of the cdsso/vf-argument configuration
parameters.


7.3 WebSEAL Administration Guide correction (45908)

On page 54 in the "Multi-locale messages" section, step 5 should read:

"If there are no installed language packs for all the languages
listed in the header, WebSEAL defaults to the language environment
which WebSEAL is running in, as determined by the LC_ALL or LANG
environment variables set in the operating system's environment when
WebSEAL started."


7.4 Additional WebSEAL Administration Guide corrections

The configuration parameter for specifying an authentication strength (step-up)
for certificate authentication is incorrect. Instead of "level=certificate,
" the correct entry is as follows:

level=ssl

Examples on pages 119, 121, and 122 (PDF) are incorrect.  The example on page
123 is correct.


7.5 Attribute Retrieval Service plug-in example - README correction

Step 5 in README file for the ARS sample application is missing an endquote. On
Windows platforms, the README file is located in the following directory:

C:/<install directory>/Tivoli/PDWebARS/protocol_plugin

Replace Step 5 with the following corrected text:

5 - Create an authorization rule that will exercise the example protocol using
pdadmin. For example:
pdadmin> authzrule create examplerule
"<xsl:if test='example_protocol_test_container/test_container = \"test_data\"'>!TRUE!</xsl:if>"


7.6 Authorization C API Developer Reference correction

The attribute azn_cred_ldap_dn is incorrectly deprecated and is still listed.

In "Deprecated API elements" on page 71 (PDF), replace
"azn_cred_group_registry_ids" with "azn_cred_registry_id"

In "Obtaining the user's authorization identification" on page 71 (PDF), replace
"azn_cred_ldap_dn" with "azn_cred_registry_id"

In the following sections and reference pages, remove "azn_cred_ldap_dn" from
the list of read-only attributes:

  - "Modifying the contents of a credential" on page 65 (PDF)
  - "Setting and getting string attribute values for a credential" on page 66 (PDF)
  - azn_creds_modify()
  - azn_creds_set_attr_value_string()
  - azn_svc_creds_modify()


7.7 Authorization Java Classes Developer Reference correction

A deprecated method is used in sample code. In "Obtaining entitlements for the
specified user" on page 22 (PDF), replace the line:

PDAttrValues results = attrsOut.get(PDStatics.AZN_ENT_SVC_PD_POBJ_MATCHES);

with the following:

Collection results = attrsOut.getValues(PDStatics.AZN_ENT_SVC_PD_POBJ_MATCHES);


7.8  New [FILTER-CONTENT-TYPES] entries undergo script filtering (45959)

In the "WebSEAL Administration Guide," Chapter 10 in the "Standard URL
filtering rules for WebSEAL" section, the following information is
provided:

"By default, WebSEAL filters only documents of MIME type 'text/html' and
'text/vnd.wap.wml' that are received from junctioned servers. Additional
MIME types can be configured using the [filter-content-types] stanza of the
WebSEAL configuration file."

Additional content types added to the [filter-content-types] stanza are "not"
subject to standard URL filtering rules. These new content types are filtered
using script filtering rules. WebSEAL scans the body of the entire document
looking for absolute URLs matching junction servername/port/transport
combinations.


7.9  [ldap] stanza-related timeout entries not documented (APAR IY53103)

The "WebSEAL Administration Guide, Version 5.1," Appendix A does not document
that "ssl-port", "replica", "timeout", "authn-timeout", and "search-timeout" are
legal in the [ldap] stanza of webseald.conf. They are legal and have the same
significance as documented in the "Base Administration Guide," Appendix A. They
are also legal in any blade's configuration file.

The "WebSEAL Administration Guide, Version 5.1" also documents an [ldap] stanza
configuration parameter of "ssl-keyfile-label". There is no such [ldap] stanza
configuration parameter. The correct parameter is "ssl-keyfile-dn" as documented
in the "Base Administration Guide," Appendix A.

On page 40 of the "Authorization C API Developer Reference," an
[ldap] stanza configuration parameter of "ldap-replica" is described. The
name in the example is incorrect. The correct parameter name is "replica".

In the "Authorization C API Developer Reference," the [ldap] stanza
configuration parameter "ldap-server-config" is not documented. It is legal
in any blade's configuration file and is documented in the "Base Administration
Guide," Appendix A.

Note: If a blade's config file specifies an "ldap-server-config" parameter,
then azn_initialize() overrides the values for "enabled", "host", "port",
"ssl-port", "max-search-size", and "replica" obtained from the blade's config
file with the values read from the "ldap-server-config" file. This is true for
WebSEAL also, but since WebSEAL requires the "ldap-server-config" parameter,
for WebSEAL, the effective values for these five parameters are always obtained
from the ldap-server-config file.


7.10  CDSSO cannot rely on browser referer header (28346)

Customized ssocreate libraries that rely on the standard ssoconsume library
should always have a PD-REFERER query string argument.

If the ssocreate library is customized, and the library generates a cdsso
redirect without the PD-REFERER query string argument, the standard ssoconsume
library relies on the browser referer header to determine where the request
came from (and which key to use for decryption).


7.11  Cannot update some Active Directory expired passwords (46200)
      (reference IY53464)

The Tivoli Access Manager for e-business Release Notes, Version 5.1 advised that
if a user's password expired in Active Directory, the user could not authenticate
to WebSEAL. This problem has been corrected. For more information, see
"Expired password in Active Directory (AD_LDAP) might prevent WebSEAL
authentication (43684)" in the Release Notes.


7.12  WebSEAL token authentication now supports Lotus Domino and Active Directory
user registries (44954)

The "WebSEAL Administration Guide" describes token authentication support for LDAP
user registries. Token authentication support has been expanded to include Lotus
Domino and Active Directory user registries.  To configure WebSEAL token
authentication to authenticate users through Lotus Domino or Active Directory
registries, you must specify use of the Tivoli Access Manager User Registry Adapter
Framework (URAF).

See the "Token authentication configuration" section in Chapter 6 of the "WebSEAL
Administration Guide." In the "Specify the token authentication" section, add the
following text to the end of step 3:

"To enable token authentication support for Lotus Domino or Active Directory user
registries, specify the following configuration entry in the WebSEAL configuration
file:

[authentication-mechanisms]
token-cdas = libxtokenauthn.so& URAF

For more information on the User Registry Adapter Framework, see Appendix A in the
"Base Administration Guide, Version 5.1."


7.13  Authentication cookie is refreshed on login (IY53475)

When using cookies to maintain session, WebSEAL will now refresh the authentication
cookie upon login. To return to the previous behavior of maintaining the same
authentication cookie, set the following value in the [session] stanza of the
webseald.conf file:

login-update-session-cookie = false

7.14 New optional parameter to [junction] stanza (IY50317)

This fix introduces a new optional parameter to the
[junction] stanza of webseald.conf,
"encode-mangled-cookienames".

With this parameter set to "yes", WebSEAL will mangle the
cookie in a manner to contain only legal characters.

7.15 A new parameter in the [script-filtering] stanza (47032)

A new parameter is available in the [script-filtering] stanza of webseald.conf,
junction-cookie-at-end. When this is set to "yes" the junction cookie script
inserted into HTML pages from -j junctions will be inserted at the end of the
documents, instead of the beginning.


7.16 Expired password in AD_LDAP might prevent WebSEAL auth (43684).

If a user's password expired in Active Directory, the user could not
authenticate to WebSEAL. This problem has been corrected. For more information,
see Chapter 3 of the Tivoli Access Manager for e-business Release Notes,
Version 5.1: "Expired password in Active Directory (AD_LDAP) might prevent
WebSEAL authentication."

7.17 Filtering is broken if the BASE HREF contains ONLY the host name.

For example, if an HTML page has a BASE tag similar to:
<BASE HREF="http://server.ibm.com/">
where junction /jct points to server.ibm.com,
WebSEAL maps the HREF to /jct/ and the BASE tag appears as:
<BASE HREF="https://webseal/jct/">
However, if an HTML page has a BASE tag similar to:
<BASE HREF="http://server.ibm.com"> (without a trailing slash)
where junction /jct points to server.ibm.com,
WebSEAL maps the HREF to /jct, deletes the "jct" (no trailing slash),
and the BASE tag appears as: <BASE HREF="https://webseal/">

7.18 Server-relative URL filtering is not working. (IY49886)

To filter non-html documents, a user would add the following configuration
option in the [server] stanza of the webseald.conf file.

    [server]
    filter-nonhtml-as-xhtml = yes

If the option is set to yes, all non-html documents are filtered similar to
html documents.

7.19 Trace log contains 302 "content-encoding: gzip" responses.(38952)

POP attributes were not being correctly retrieved for requests for a junction
point if the requested URL did not have a trailing slash.  For instance, POPs
would not be correctly applied to a request for "/junction."

7.20 CDSSO-ARGUMENT NOT FUNCTIONING - iv_groups aren't passed to BackEnd
server. (IY51261)

cdsso-argument is not functional with the default ssocreate and ssoconsume
libraries. If the customer is has customized both libraries, they should
be ok. When a cdsso token is being generated, ssocreate is called out to,
and the default library creates a cdsso token with the name PD-ID, instead
of the configured cdsso-argument value.
When a cdsso token is being consumed, the ssoconsume library is called out
to if a query string argument matches the configured cdsso-argument
(this is correct behavior). However, the default ssoconsume library cannot
decode any token not called PD-ID.

WebSEAL's token d/encoding libraries (which are called by ssocreate and
ssoconsume) will be updated to handle the cdsso-argument value instead of
just PD-ID.

7.21 CLARIFICATION OF WEBSEAL LOGGING CONFIGURATION (IY53897)

The WebSEAL Admin Guide's description of configuring WebSEAL's logging
is not as clear as it could be.

The first difficulty is that the documentation is spread across multiple
manuals.  Because WebSEAL is just a blade of Access Manager, the Access
Manager documentation must be considered as a part of the WebSEAL
documentation.

  Note that the "examples" on p101 of the WebSEAL 5.1 Admin Guide are not
  examples.  They are the logcfg statements instantiated by WebSEAL's
  default HTTP logging when requested by webseald.conf's settings in the
  [logging] stanza.  For example, if "requests = yes" is specified in the
  [logging] stanza of webseald.conf, then the effect is identical to
  specifying

    logcfg = http.clf:file path=<requests-file>,flush=<flush-time>, \
             rollover=<max-size>,log=clf,buffer_size=8192,queue_size=48

in the [aznapi-configuration] stanza.

There have been questions about the option

    log=clf

This option is explained on p199 of the TAM 5.1 Base Admin Guide:

In a configuration entry, the option names are case-insensitive and can be
abbreviated to any shortened length of the full option name that remains
unique.

  Therefore,

    log=clf

  is equivalent to

    log_id=clf

On p203 of the TAM 5.1 Base Admin Guide there is a description of a critical
behavior of logging:

A file is only opened once. If multiple configuration entries exist to
selectively capture events at different points of the event pool hierarchy to
the same file, the file opens according to the options found in the first
configuration entry processed.

After a file has been opened, further file configurations can simply use the
following shorthand notation to record events to the same file:

    [aznapi-configuration]
    logcfg = <category>:file log_id=<logid>

An unstated side-effect of these paragraphs is that any configuration entry for
a particular log_id that precedes the first configuration entry specifying a
file's path is ignored.

When webseald initializes, the [aznapi-configuration] stanza's logcfg entries
are processed before the logcfg entries created by the [logging] stanza's
settings are processed.  Therefore, if any one of the 3 types of default
WebSEAL HTTP logging is enabled in the [logging] stanza -- requests, referers,
or agents --  and the logcfg created for that logging is the first one
processed with that log_id that specifies a file path, then any configuration
entries using that log_id in the [aznapi-configuration] stanza are ignored.

For example, if webseald.conf says

	[logging]
	requests=yes
	requests-file = /var/pdweb/www/log/request.log

	[aznapi-configuration]
	stats = pdweb.authn 40
	logcfg = stats.pdweb.authn:file path=/opt/pdweb/log/stats,log=clf

	logcfg = http.conf:file log,log=clf

then all three kinds of logging will appear in the /opt/pdweb/log/stats.log
file because that logcfg entry was the first one processed for log_id=clf that
had a file path specified.

If, instead, that last logcfg entry read

    logcfg = stats.pdweb.authn:file log=clf

then only the "requests" logging would appear in the
/var/pdweb/www/log/request.log file.  The other two types of logging would not
appear anywhere.

7.22 CUSTOMER HAS PROBLEMS CONFIGURING MSGS RECEIVING THEM IN VARIOUS
     LANGUAGES (IY52390)

In the "Multi-locale support for Web services" section of the WebSEAL
Administrator Guide there is a nice example of how WebSEAL handles an
accept-language header containing "pt-br".  The final paragraph describes the
default behavior of WebSEAL that occurs if there are no installed language
packs for all languages listed in the header, but nowhere is it said what
WebSEAL's behavior is if it receives a message with no accept-language header
at all. In fact, WebSEAL performs the same default behavior in this case as in
the no-language-packs-installed case: it defaults to the language environment
in which WebSEAL is running, as determined by the LC_ALL or LANG environment
variables set in the operating system's environment when WebSEAL started.

7.23 INCORRECT DESCRIPTION OF INTRA-CONNECTION-TIMEOUT (50058)

The behavior of the intra-connection-timeout config parameter as implemented
by the fix to IY48098 in WebSEAL 5.1 differs from its behavior in WebSEAL 4.1.
Now the intra-connection-timeout parameter *must* be set >0 to cause an RST to
be sent on a timeout of a client connections.  If the intra-connection-timeout
parameter is not set or is set to zero then the browser will not be aware that
WebSEAL has timed-out the connection.

The WebSEAL 5.1 implementation of the fix to IY48098 enables write timeouts on
both TCP and SSL client connections, where the WebSEAL 4.1 implemented write
timeouts on only SSL client connections.

7.24 Clarification of Valid Characters for ACL Names (IY53637)

  The WebSEAL Admin Guide, Chapter 5, section titled 'Valid characters
  for ACL names' fails to mention that the number characters 0 through 9
  are valid.  It should read:

  The following characters are valid for creating ACL names:
    A-Z
    a-z
    0-9
    underscore(_)
    hyphen (-)
    backslash (\)
    Any character from a double-byte character set

  Again, the 0 through 9 characters are valid for use in ACL naming.

7.25 Users with expired password can CDSSO, SU, be VOUCHFOR'ED (44563)

  This has been fixed in 5.1-AWS-0003LA

7.26 WebSeal 3.8 custom login pages don't work for 5.1 (47291,IY55336)

  To re-enable the pre-5.1 handling of form authentication, the
  following change needs to be in the webseald.conf file:

  default-login-form-type = pwd


  EXAMPLE
  -------
  :
  :
  [forms]
  #----------------------
  # FORMS
  #----------------------

  default-login-form-type = pwd

  # Enable authentication using the forms authentication mechanism
  # One of <http, https, both, none>
  forms-auth = both

7.27 Docs for using BA headers for SSL needs to be combined (IY56542)

  When reading the "Configuring BA headers for single sign-on solutions"
  section of the "Single sign-on solutions across junctions" chapter
  (IBM Tivoli Access Manager WebSEAL Administration Guide), you must
  additionally refer to "Handling client identity information across
  junctions" located in the "Mutually authenticated SSL junctions"
  section of the "WebSEAL junctions" chapter.

7.28 WebSEAL script-filter parameter (49901)

  Correction to Webseal Admin Guide v5.1 (page 290) should read as follows:
  This filtering solution parses a script embedded in HTML code and therefore
  requires additional processing overhead that can negatively impact
  performance. Only enable the script-filter parameter when your WebSEAL
  environment requires filtering of embedded absolute URLs.

7.29 Switch user admin cred attribute lost during failover. (32478)

  su is not supported across failover - if WebSEAL fails while an su-admin
  is impersonating another user, and the failover cookie is used to
  authenticate, then the user will be returned to their original identity
  (su-admin).

7.30 Change all server passwords for security purposes (50791)

  For security purposes, it is recommended that you change all server passwords
  from the original password set during configuration.

7.31 Confusing doc for %BASICAUTHN%, %CERTAUTHN%, and %TOKENAUTHN% (IY58348)

  Error Description:
  The WebSeal Administration Guide page 90 it documents these macros as...

  Substitution variable used to alter login form.
  When authentication method valid, WebSEAL removes the variable.
  When authentication method invalid, WebSEAL comments out the macro.
  Used in tokenlogin.html, certlogin.html, and stepuplogin.html.

  Correction:
  Documenation should be updated to clarify that the macro is not actually
  commented out, but that it actually gets replaced by a start comment
  delimiter, "<!--".
  This results in everything following this macro to be commented out until
  a comment closing delimiter, "-->" is reached.

7.32 Document PDADMIN terminate session command (48787)

  Terminating single user sessions.

  You can terminate a specific user session based on the User Session ID.
  A back-end application can use the Tivoli Access Manager administration
  API to terminate a specific user session based on the User Session ID
  passed in an HTTP header across the junction. In such a scenario, the
  application would invoke the ivadmin_server_performtask() function.

  The WebSEAL server instance, the User Session ID, and the terminate session
  command from the standard pdadmin expression for this task are necessary
  parameters to this function:

  pdadmin> server task instance-webseald-host terminate session user_session_id

Note:

 Although you can manually perform this pdadmin operation, the long User
  Seesion ID string value (obtained from the HTTP header) can make this task
  cumbersome. WebSEAL verifies that the back-end server initiating the
  terminate operation has appropriate permissions before terminating the user
  session. It is important to consider the conditions under which this command
  might be used.

  If the intent is to make sure a user is removed from the secure domain
  entirely, the termination of a single user is only effective when, in
  addition, the account for that user is made invalid (removed). Certain
  authentication methods, such as Basic Authentication, client-side
  certificate, and failover cookies, return cached authentication information
  automatically with no user intervention. The terminate session action would
  not prevent return logins for a user using any of those authentication
  methods. You must additionally invalidate the appropriate user account in the
  registry.

  Refer to the IBM Tivoli Acess Manager Administration C API Developer
  Reference for further information and for ivadmin_server_performtask()syntax.

7.33 New config option to supress-backend-server-identity (51470)

  HTTP responses normally include a header ("server") containing the identity
  and version of the server sending the response. Examples:

  server: WebSEAL/6.0.0
  or
  server: IBM_HTTP_SERVER/1.3.19  Apache/1.3.20 (Win32)

  To suppress WebSEAL server identity in HTTP server responses, set the
  suppress-server-identity parameter in the [server] stanza of the WebSEAL
  configuration file to "yes":

  [server]
  suppress-server-identity = yes

  The default setting is "no".

  To suppress back-end application server identity in HTTP server responses,
  set the suppress-backend-server-identity parameter in the [server] stanza of
  the WebSEAL configuration file to "yes":

  [server]
  suppress-backend-server-identity = yes

  The default setting is "no".

7.34 Allow junctioned virtualservers to set virtual domain cookie (IY54986)

  A new hidden parameter may be set in the [session] stanza:

  support-virtual-host-domain-cookies = yes/no

  It will be set to yes by default. It can be documented as follows:

  If allow-backend-domain-cookies is set to "yes",
  then this option will modify how WebSEAL validates the domain.

  This option will have no effect if validate-backend-domain-cookies = no

  If set to "yes" then the domain cookie will be validated by comparing it with
  the virtual host specified for a backend server with the -v junction option.
  If set to "no", or if no virtual host was specified for a junction, then the
  fully qualified hostname will be compared with the domain value of a backend
  cookie for validation.

7.35 Bad content length POST returning 'Request entity too large' (IY55367)

  If a customer expects that they will be sending content length headers that
  are longer than the actual content for POST requests, and they are interested
  in seeing  a 'no content' error page returned instead of a 'request entity too
  large' page, then they should add this hidden config item to the server stanza
  in the config file:

  send-post-nocontent-errors = yes

  It defaults to no, and is by default hidden.

7.36 %ERROR% Macro not set when username or pw is left blank (IY56902)

  This APAR introduced and hidden config option that needed to be added to the
  [forms] stanza of the webseald.conf file.

  [forms]
  allow-empty-form-fields = yes

  Default value for this flag is FALSE.

7.37 WebSeal drops "?" when search string is empty (IY59576)

  For this APAR, wesbeald.conf file need to be modified for the server stanza
  with following config condition:

  [server]
  keep-null-query-string = yes

7.38 Incorrect PATH name for cdsso_key_gen in WebSEAL Admin Guide (IY58445)

  Error Description:
  The WebSeal Administration Guide page 203, under section "Create an encryption
  key for cookie data", the path for the cdsso_ke_gen tool for UNIX is stated as
  /opt/pdweb/bin/cdsso_key_gen

  Correction:
  The correct path for the tool is /opt/pdwebrte/bin/sdsso_key_gen so the correct
  example for UNIX is:
  /opt/pdwebrte/bin/sdsso_key_gen absolute_pathname_for_keyfile

7.39 Undocumented webseald message codes need to be documented (IY57186)

	dceweb_st_nocontent	     0x38cf041e
  Explanation: The client sent a request with a content length header value
  greater than the length of the actual content sent.
  Action: None.

	dceweb_st_movedtemp  	     0x38cf0421
  Explanation: HTTP 302 error - The requested resource resides temporarily
  under a different URI.
  Action: None.

	dceweb_st_badrequest	     0x38cf0424
  Explanation: A request was sent that did not adhere to the HTTP
  specification.
  Action: None.

	dceweb_st_forbidden	     0x38cf0427
  Explanation: The user's credential doesn't have sufficient permissions to
  access the resource.
  Action: None

	dceweb_st_methodnotallowed   0x38cf0429
  Explanation: A POST request was made to a directory or a non-executable
  resource.
  Action: None.

	dceweb_st_internalerror	     0x38cf042f
  Explanation: An internal error has occured.
  Action: Check logs for more information.

	dceweb_st_notimplemented     0x38cf0430
  Explanation: HTTP 501 error - The server does not support the functionality
  required to fulfill the request.
  Action: None

	dceweb_st_serviceunavailable 0x38cf0432
  Explanation: The resource requested in unavailable.
  Action: Try again later, or check the status of the junction of the request.

	dceweb_st_entitytoolarge     0x38cf0467
  Explanation: Request was larger than request-body-max-read
  Action: Ensure request-body-max-read is set as intended.

7.40 Incorrect package name listed in the Upgrade Guide (IY61297)

  The Tivoli Access Manager for e-business-5.1 Upgrade Guide lists the
  wrong package on page 57, Step 15(AIX: Upgrading a WebSEAL Server).
  The package for the WebSeal ADK should be PDWeb.ADK and not PD.WebADK

  The installp command should read as
         installp -cagNXd . PD.AuthADK PDWeb.ADK

7.41 Modifying JavaScript inserted by the "-j" junction option (IY61959)

  The "-j" junction option modifies HTML documents returned from junctioned
  servers to include a small piece of JavaScript that sets a cookie on the
  browser interpreting the document. The junction cookie is described in greater
  detail in the IBM Tivoli Access Manager WebSEAL Administration Guide chapter
  titled, "Handling server-relative URLs with junction cookies (-j)."
  The JavaScript inserted by the -j junction option may cause problems in some
  environments. There are two configuration options that allow administrators
  greater control over the script.

  Inserting the JavaScript at the end of the document: Normally WebSEAL
  prepends  the JavaScript at the beginning of HTML documents returned from
  junctions. This may cause HTML rendering problems in some environments.
  Administrators may configure WebSEAL to append the JavaScript to the document
  instead via the "-J trailer" junction option.
      Example: pdadmin> server task server-name create ... -j -J trailer ...

  Multiple junctions using the -j junction option: In environments where a
  single client is using multiple junctions simultaneously, the IV_JCT cookie
  created by the JavaScript may refer to the wrong junction. As an example,
  consider a scenario with two junctions, /jctA and /jctB, both using the -j
  junction option. If a client first requests a page from /jctA, then switches
  to /jctB, then returns to /jctA, the client will send the wrong IV_JCT cookie
  to WebSEAL. If the request does not include the junction point (typically
  because of an unfiltered server-relative URL), WebSEAL will attempt to
  service the request using /jctB instead of /jctA. To work around this
  problem, administrators may configure WebSEAL to use the JavaScript "onfocus"
  event handler in the JavaScript. The "onfocus" handler is used to reset the
  IV_JCT cookie whenever clients switch the browser focus from one window to
  another.
      Example: pdadmin> server task server-name create ... -j \
                        -J trailer,onfocus ...

  The "onfocus" option should always be used in conjunction with the "trailer"
  option. Otherwise, the JavaScript inserted by WebSEAL may interefere with
  rendering of HTML frame sets.

  Note: No error message is provided if the options specified to -J are invalid.
  If the -J junction option does not behave as expected, double-check that you
  are providing the correct argument.

8.0 SOFTWARE LIMITATIONS
------------------------
None


9.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
------------------------------------------------
The following problems are known to exist after installing this patch. Some known
problems are identified by internal tracking numbers.


9.1 WebSEAL installation wizard hangs (45569) (reference APAR IY52675)

The WebSEAL installation wizard hangs when WebSEAL is configured to listen on
a port already in use.

Workaround: Ensure that the HTTP and HTTPS listening ports are not already in use
by another service before running the WebSEAL installation wizard. The default
listening ports are port 80 and 443. To see what ports are already in use, run:

netstat -an


9.2  Install the WebSEAL language package prior to configuring WebSEAL (44829)

HTML files of foreign languages are not copied to www-instance/lib/html if
the WebSEAL language package is installed after WebSEAL is configured.

WORKAROUND:
Install the WebSEAL language package prior to installing WebSEAL. If the
WebSEAL language package is installed after WebSEAL is configured, you must
unconfigure WebSEAL and then configure it again for the HTML pages to be
copied to the correct directory.


9.3  File Downloads getting truncated when no/short delay is involved (APAR IY48098)


The significance of two webseald.conf parameters is changing and a third,
optional, webseald.conf parameter is being added.

The client-connect-timeout parameter is now used for timing-out only the
initial read of a client connection after the accept() succeeds.

The persist-con-timeout parameter is now used for timing-out only the initial
read of a persistent client connection.

A new, optional, parameter is being introduced, intra-connection-timeout.
Its value, if non-zero, is used to time-out all other read/write operations on
an SSL connection to the client.  The default value for this new parameter is
the value of the client-connect-timeout parameter.


10.0 NOTICES
------------
This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this
document in other countries. Consult your local IBM representative for
information on the products and services currently available in your area. Any
reference to an IBM product, program, or service is not intended to state or
imply that only that IBM product, program, or service may be used. Any
functionally equivalent product, program, or service that does not infringe
any IBM intellectual property right may be used instead. However, it is the
user's responsibility to evaluate and verify the operation of any non-IBM
product, program, or service. IBM may have patents or pending patent
applications covering subject matter described in this document. The
furnishing of this document does not give you any license to these patents.
You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the
IBM Intellectual Property Department in your country or send inquiries, in
writing, to:

IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106, Japan

The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law: INTERNATIONAL
BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT
WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions; therefore, this statement may not
apply to you.

This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this
IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the
purpose of enabling: (i) the exchange of information between independently
created programs and other programs (including this one) and (ii) the mutual
use of the information that has been exchanged, should contact:

IBM Corporation
2Z4A/101
11400 Burnet Road
Austin, TX 78758
U.S.A.

Such information may be available, subject to appropriate terms and
conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer
Agreement, IBM International Program License Agreement or any equivalent
agreement between us.

Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments
may vary significantly. Some measurements may have been made on
development-level systems and there is no guarantee that these measurements
will be the same on generally available systems. Furthermore, some measurement
may have been estimated through extrapolation. Actual results may vary. Users
of this document should verify the applicable data for their specific
environment.

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.

All statements regarding IBM's future direction or intent are subject to
change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include
the names of individuals, companies, brands, and products. All of these names
are fictitious and any similarity to the names and addresses used by an actual
business enterprise is entirely coincidental.



10.1 Trademarks

The following terms are trademarks or registered trademarks of International
Business Machines Corporation in the United States, other countries, or both:

AIX
IBM
IBM logo
iSeries
pSeries
S/390
Tivoli
Tivoli logo
xSeries
zSeries

Java and all Java-based trademarks and logos are trademarks of Sun Microsystems, Inc.
in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft
Corporation in the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and
other countries.

Other company, product, and service names may be trademarks or service marks
of others.



End of IBM Tivoli Access Manager for e-business WebSEAL, Patch 5.1.0-TIV-AWS-FP0006 README
