IBM InfoSphere Identity Insight Version 8.1 Fix Pack 1 - release notes

Corrections and additions for installation and upgrade

Windows installation: pipeline services must be stopped and deleted prior to upgrade.

When installing on Windows, stop and delete old pipeline services prior to running the installer to upgrade to Version 8.1 Fix Pack 1.

Updates to IBM Cognos models and reports

Fix Pack 1 includes a new Cognos Reports deployment: IdentityInsight_v8101_Cognos.zip. This fixes [ APAR # 40069 ] Issue on Cognos Resume (Related Entities section) when entity has no name.

WARNING FOR UPGRADES: Importing the deployment package can restore the ISII Cognos Data Source to its original state, depending on the import options selected. It may be necessary to modify the Cognos Data Source to reconnect Cognos to the database. The following reports will be overwritten with the latest report specifications:

• /ISII/ISII_EntityResume
• /ISII/ISII_RoleAlertDetailActive

The deployed data model package will also be overwritten with the latest version of the published package. - However, the previous model directory will be renamed to <II_INSTALL>/srd-home/cognos/model-v81

To apply the changes to the ISII_EntityResume report:

1. Select the option to upgrade all report specifications to the latest version during the deployment package import.
2. Any customizations to the existing Identity Insight reports will be overwritten by importing the deployment package (including modifications to the report and graph links).
3. See Cognos documentation or Identity Insight documentation for instructions on importing a deployment package into Cognos. The deployment package password is: ISII4YOU
4. The raw ISII_EntityResume.xml file is provided so that the ISII_EntityResume report can be updated using the Report Studio. This does not require an import of the updated deployment package). See Cognos documentation for information on creating reports from the clipboard.
5. Note: the changes to the ISII_EntityResume report require new views. If you want to avoid importing the deployment package, you should update your data model and publish a new report package using Cognos Framework Manager.

Upgrading from future v8.0 fix packs and hotfixes

This fix pack supports upgrading from Version 8.1 to Version 8.1 Fix Pack 1. Version 8.1 Fix Pack 1 includes:

• All previous hotfixes on the v8.1 branch.
• All previous hotfixes and fix packs from the v8.0 branch, up to and including 8.0.0.147.

If you apply hotfixes after hotfix 147 to your v8.0 branch installation, please contact IBM Support before upgrading to Version 8.1 Fix Pack 1.

Considerations and issues for Microsoft Windows 7 and Microsoft SQL Server 2008 users

If you use IBM InfoSphere Identity Insight on Microsoft Windows 7 client or use Microsoft SQL 2008 as your database, be aware of the following additional known issues:

Running Windows Server 2003 or 2008 for pipeline or Application Server in conjunction with a DB2® v9.5 or v9.7 database server

A potential issue exists for IBM Identity Insight Version 8.1 customers who are running Windows Server 2003 or Windows Server 2008 operating system for the pipeline or Application Server, in conjunction with an IBM DB2 Version 9.5 or Version 9.7 database server. For this platform-combination Latin-1 or UTF-8 data may not be encoded correctly when ingested via Identity Insight Version 8.1. If you are using a DB2 v9.5 or v9.7 database, you are strongly encouraged to install IBM Identity Insight Version 8.1 in a test environment and verify correct encoding behavior of Latin-1 or UTF-8 data. To confirm, you may check the following columns:

Table=NAME
Columns=LAST_NAME, FIRST_NAME, MID_NAME, NAME_PFX, NAME_SFX, NAME_GEN

Table=ADDRESS
Columns=ADDR1, ADDR2, ADDR3, CITY, STATE

Table=ATTRIBUTE
Column=ATTR_VALUE

If the data in any of these tables appear to be incorrectly encoded, please check if the following Environment Variable is set on your Windows Pipeline server.

DB2CODEPAGE

This should be set to the same value as the DB2 Database 'CODEPAGE' variable. For example, if the DB2 Database configuration is:

CODEPAGE=1208
CODESET=UTF-8

In this situation, the DB2CODEPAGE environment variable should be set as follows, prior to ingestion of data:

set DB2CODEPAGE=1208

Considerations and issues for IBM Informix users

If you use IBM Informix as your database, be aware of the following additional known issues:

IBM Informix Dynamic Server Release 11.70.xC4DE database support

Support for IBM Informix Dynamic Server Release 11.70.xC4DE databases (Ultimate Edition and Ultimate Warehouse edition) is provided with the following Application Server architectures (Native OS implementation only):

• IBM AIX 6.1 - 64 bit - POWER 5/6
• Hewlett-Packard HP/UX 11i v2 - 64 bit - IA64
• Linux x-86
• Linux x86_64
• 64-bit Linux on System z
• Novell SUSE Enterprise Linux 10 - 64-bit - IBM System z only
• Novell SUSE Enterprise Linux 11 - 64-bit, x86_64
• RedHat Enterprise Linux 5 - 64-bit, x86_64
• Sun/Oracle Solaris 10 - 64 bit - UltraSPARC IV (and newer compatible)
• Microsoft Windows 2008 Server - 64-bit, x86_64

Note: IBM Informix Dynamic Server 11.7 DataBlade functionality is not supported.

See the section on system requirements for detailed information.

Installation prerequisites and setup information for Informix

The following two environment variables must be set before you run the installer to properly configure an Informix installation: INFORMIXSERVER, INFORMIXDIR. INFORMIXSERVER should point to the instance of the target DB server, for example, ol_informix1170. INFORMIXDIR should point to the root installation directory where the informix client or server package is installed. On UNIX, this is typically /opt/IBM/informix and may have a version number appended. For Windows, it is usually in Program Files/IBM/Informix.

Minimum page sizes for IBM Identity Insight databases when managed with Informix

For Informix installations, the IBM Identity Insight databases need to be created with a minimum page size of 8K. If this is not done, installation will fail with an error similar to the following:

java.sql.SQLException: Total length of columns in constraint is too long. 

Logging mode

Logging mode must be enabled for the Informix database when it is created. Do not use the MODE ANSI keyword. Doing so can break pipeline transaction-handling functions.

Running SUIT

When installing to an Informix database, SUIT can be run with the following command line parameter: -mbi 1. This overrides the default settings (100 for Informix and 1000 for all other database types) and disables statement "batching". If this is not done, the SUIT operation can fail with the error "maximum statement length exceeded" and abort.

Environment variables that must be set

Informix has two optional environment variables that must be set before running the installation: CLIENT_LOCALE and DB_LOCALE. The CLIENT and DB locale values must be the same, or their code sets must be convertible. It is best if both are the same, but both must be UTF8. Recommended settings:

• en_US.UTF8 on Unix/Linux
• en_US.57372 on Windows

codeset name and language name must both be lower case when used in the JDBC call.

Using non-US locale pipeline server / ODBC client against UTF8 Informix database

If you use pipeline servers or other ODBC clients that are set to a non-US UTF8 locale in conjunction with a UTF8  (en_US.UTF8 / en_US.57372) Informix database, you should set up the ODBC configuration on the pipeline server or ODBC client as follows:

1. UNCHECK the "Use Database Server Locale" box.
2. Set BOTH the DB Locale and CLIENT locale to the language in use on the *client* machine.

For example, in the Windows dialog:

• Client Locale=pt_BR.UTF8
• Database Locale=pt_BR.UTF8
• Use Database Server Locale=Unchecked

For UNIX or Linux, in the .odbc.ini file:

[data_source_name]
CLIENT_LOCALE=pt_BR.UTF8
DB_LOCALE=pt_BR.UTF8
USESERVERDBLOCALE=0

Enabling logging for Transactional support

In order for transactions to work with Informix, the database must be created with logging enabled. You can do this through dbaccess using the menu options, or specify it when using DDL:

CREATE DATABASE <database name> WITH LOG

Note: The database should NOT be created with the 'MODE ANSI' keyword. Doing so adversely affects some of the pipeline transaction-handling functionality.

Transaction-handling configuration

The following configuration setting are required for transaction-handling:

• Row-Level table locking DEF_TABLE_LOCKMODE=ROW in onconfig database-configuration file
• Row lock handling SET LOCK MODE TO WAIT on database connection definition.
• Choice of plan optimization: UPDATE STATISTICS HIGH on database after some data has been loaded. This does not work on an empty database.

Required entries for LD_LIBRARY_PATH:

1. Add required entries for LD_LIBRARY_PATH:
   • $INFORMIXDIR/lib
   • $INFORMIXDIR/lib/cli
   • $INFORMIXDIR/lib/esql
2. Ensure that $INFORMIXDIR/bin is in the $PATH.
3. After setting up the Informix database, you must update your ODBC configuration. For Unix and Linux, please see: http://publib.boulder.ibm.com/infocenter/idshelp/v117/topic/com.ibm.odbc.doc/ids_odbc_062.htm. For all platforms please refer to the following notes: http://publib.boulder.ibm.com/infocenter/idshelp/v117/index.jsp?topic=/com.ibm.relnotes.doc/notes/csdk_370xc3/mach/odbc.html.

JDBC files

Make sure that $INFORMIX/jdbc/lib exists before installing. Some Informix installations do not automatically lay down the jdbc files. These files must exist before installing:

C:\PROGRA~1\informix_1170\jdbc\lib>dir
Volume in drive C has no label.
Volume Serial Number is D477-2F8F

Directory of C:\PROGRA~1\informix_1170\jdbc\lib

18/07/2012  12:31          <DIR>     .
18/07/2012  12:31          <DIR>     ..
23/09/2011  20:01          816.096 ifxjdbc.jar
23/09/2011  19:58            44.939 ifxjdbcx.jar
23/09/2011  19:58        1.585.532 ifxlang.jar
23/09/2011  19:58          307.332 ifxlsupp.jar
23/09/2011  19:58          806.318 ifxsqlj.jar
23/09/2011  19:58            48.982 ifxtools.jar
              6 File(s)      3.609.199 bytes
              2 Dir(s)  1.093.832.704 bytes free 

Do not segment or partition database tables that are used for UMF input transports

Database tables that are used for UMF input transports must not be segmented or partitioned. Segmenting or partitioning these transport tables will result in errors in the pipeline transport and lost data.

Known issue: Informix sometimes returns trailing spaces on data

Informix sometimes returns trailing spaces on data. If this occurs, edit the on_config_<server name> file, which is usually located in $INFORMIXDIR/etc. Set the following parameter:

IFX_LEGACY_CONCAT 1

Then restart the server.

Considerations and issues for Oracle database users

If you use an Oracle database with IBM InfoSphere Identity Insight, be aware of the following additional known issues:

Do not segment or partition database tables that are used for UMF input transports

Database tables that are used for UMF input transports must not be segmented or partitioned. Segmenting or partitioning these transport tables will result in errors in the pipeline transport and lost data.

Visualizer usage note for Find-by-Attribute function using an Oracle database (previously reported in the v8.1 Release Notes)

This issue is resolved.

Known issues and changes when using the product

Be aware of the following considerations and known issues related to using the product:

Match/Merge processing and From/Thru dates

If you have a specific requirement for From/Thru dates to be taken into account during Match/Merge processing, you should explicitly set the DATERANGETHRESHOLD value to '0' in the Console as part of this FP1 upgrade. This ensures that From/Thru dates continue to be honored. Note that setting this to '0' is not the recommended value. Please contact IBM Support for further information and guidance.

If you have previously set [MM] DATERANGETHRESHOLD = -1 in your configuration, your system will now correctly ignore the From/Thru dates during Match/Merge processing.

Do not specify ODBC Isolation level=1 (uncommitted Read) on any ODBC client

Do not specify ODBC Isolation level=1 (uncommitted Read) on any ODBC client. This is particularly true when using a multi-threaded pipeline, or multiple pipelines. Doing so can cause data corruption or unexpected pipeline shutdown. Example pipeline output:

08/07 14:49:38 [pipeline:503380304] CRIT: CRITICAL ERROR:
08/07 14:49:38 [pipeline:503380304] CRIT: {
08/07 14:49:38 [pipeline:503380304] CRIT:  Requested resolve config for an invalid entity type: 0
08/07 14:49:38 [pipeline:503380304] CRIT:  Check logs or UMF_EXCEPT table for more information.
08/07 14:49:38 [pipeline:503380304] CRIT: }  

MERGE_ID and NUM_MERGED tags not used or required

The <MERGE_ID> and <NUM_MERGED> tags are not used or required by the pipeline. If you use them, they will be ignored by the pipeline. Only a single <MERGE> segment can be present in a UMF input document.

ILOG graph generates error for custom number types

The Attribute Alert section of the ILOG graphing tool can generate an error when displaying an entity that contains custom number type.

If new Number-Types or Attribute-Types are added to the system via the Configuration Console, you must restart the pipelines and the "Graph server" within eWAS (or the entire eWAS) before the iLOG Graph can display these new types correctly.

MATCH_ID column on the SEP_CONFLICT_REL table

The MATCH_ID column on the SEP_CONFLICT_REL table is currently defined as a NUMBER (10). This can artificially limit the size of values that can be stored in this table and cause SQL insert failures and pipeline shutdown with large data volumes. To allow larger Match-ID numbers to be stored, this column-type for the MATCH_ID column can be safely altered to be: "max" precision / BIGINT.

Handling names that include single-name aliases (Main Name 'a/k/a' Alias Name)

To handle names that include single-name aliases (Main Name 'a/k/a' Alias Name) do the following:

1. The ' Main Name' can be ingested using the standard 'M' <NAME_TYPE> tag, in either an unparsed (<FULL_NAME>) or parsed (<FIRST_NAME>, <LAST_NAME>) format.
2. An alias name can be encoded as follows:

   <NAME_TYPE>A</NAME_TYPE> 
   <DSRC_CODE>+<DSRC_ACCT> = same as the Main Name record

   The alias name is passed in via the <FULL_NAME> tag DQM Rule #289 (Alternate Parse) enabled for NAME segment.

   This approach enables the alias name (particularly if the alias is a single-token name) to be encoded in a way that maximizes the possibility of name-matching.

Entity Searcher '?' Help and "Learn more..." linked content

The Entity Searcher is currently included as an example application or template. If you hover over the '?' help icon and click on the Learn more... link on the hover popup, a help page opens with sample text: "Placeholder Help Page - This is a placeholder help page. It was passed to the topic 'mainHelp' as a request parameter."

This is functioning as designed and is intended as an example for integrators, developers, or service teams who could be tasked with customizing this application and related help information. In a future product update, these example applications may be further developed and expanded with addition detail and related information.

Modified views and deprecated tables

The following list includes modified views and deprecated tables and columns for Version 8.1.0 and prior upgrades.

Modified views

Installing Version 8.1.0 overwrites the product views. If you have modified any of the listed views, back up your changes to prevent them from being overwritten. These views are listed in the product information center (and PDF version) under Installing and upgrading > Upgrading the product > Upgrade items > Customized views overwritten or deleted during upgrade.

Fix Pack 1 added views include:

• COG_DISCLOSURES_NAMES
• COG_ENTITY_DISCLOSURES
• COG_INBOX_ROLE_ALERT
• COG_ROLE_ALERT_DETAIL
• COG_RELATED_ENTITIES
• COG_RPT_RE_UNION
• VIS_ENTITY_PROPERTIES

Modified views include:

• BEST_ENTITY_INFO
• CONFLICT_RPT
• RPT_RESUME_RELS1_SUB
• RPT_RESUME_RELS2_SUB
• RPT_RE_UNION
• SOA_ENTITY_SUMMARIES
• VIS_DISTINCT_COUNTS

Deprecated tables and columns

There are no tables or columns that are deprecated with Version 8.1.0 Fix Pack 1.

APARs addressed in this fix pack

This fix pack corrects or fixes the following APARs:

• ipsdb00096786/ipsdb00096915 - DB2 Database transport performance enhancement.
• ipsdb00096515/[APAR # PJ39590] - Unresolve-Reresolve logic improvement.
• ipsdb00096192 - NameSifter Objects thread safety improvement.
• ipsdb00094982/[APAR # PJ39217] - Unique constraint violation error during load.
• ipsdb00072414 - Unresolve improvement when processing disclosed relation messages.
• ipsdb00093704/[PMR # 73027499000] - Logging optimization and name scores.
• ipsdb00081520 - Unique number and name generation confirmations - unresolve improvement.
• ipsdb00093549 - Delete record is added if dsrc_acct does not exist in the database (DSRC_ACTION 'D' and 'F').
• ipsdb00096888 - "Persistent Search" entities return other search entities in result UMF documents.
• ipsdb00021200 - Find By Attribute will return a persistent search as a result.
• ipsdb00001935 - DQM function 660 - DQM Extender fix.
• ipsdb00093408 - Processed records with invalid segments have Return Code = 200, and not 202.
• ipsdb00096229 - Pitney-Bowes address handling improvement.
• ipsdb00096841 - Configured polling delays applied when the transport is empty.
• ipsdb00091255 - From/through date handling improvement.
• ipsdb00095916 - Oracle Latin-1 Find By Attribute improvement.
• S2 CRM: 62513,499,000 - Company-name vs personal name matching improvements.
• ipsdb00098339 - Personal name parsing improvement.
• ipsdb00098475 - Forced merge optimization.
• [APAR # PJ39121]/ipsdb00094562 - UMF_MERGE message FROM/TO DSRC_ACCT_ID handling.
• IBM InfoSphere Global Name Management (GNM) update - Updated name transliteration files
• ipsdb00096843 - Unresolve account-handling improvement.
• ipsdb00096894 - Unresolve determinism improvement.
• ipsdb00099419 - Account determinism improvement.
• -- HTTP transport error handling improvement.
• ipsdb00098773 - GNM full name score improvement.
• ipsdb00098774 - GNM Name scoring performance improvement.
• ipsdb00098766 - GNM Name scoring improvement.
• ipsdb00098777 - Improved pipeline logging.
• ipsdb00098431 - GNM LEFTBIAS value updated for Indian names
• ipsdb00098523 - Number-only name scoring improvement.
• ipsdb00098789 - Single-token name scoring improvement
• -- Pitney-Bowes exception error return-code handling.
• ipsdb00090827/PMR 17673,180 - Fix for Pipeline exception on Windows.
• ipsdb00097502 - Date of birth performance improvement.
• ipsdb00097700 - COMPANY name matching improvements.
• -- Honor when date range-checking is disabled.
• ipsdb00099806 - Attribute table Oracle index improvement.
• ipsdb00099971 - Close versus exact ONUM match improvement.
• ipsdb00101105 - Alert filtering improvement.
• ipsdb00094817 - Visualizer Inbox versus Entity Resume alert discrepancy.
• ipsdb00098277 - Empty 'Description' field for Attribute-Type or Number-Type causes EntitySearcher exception.
• ipsdb00097841 - getDirectEntityRelationships() run time exception.
• ipsdb00094723 - SOA_ENTITY_SUMMARY - filter on GEM_EVENT_SITUATION.SYS_DELETE_DT.
• ipsdb00098961 - RPT_RE_UNION view - filter all search entities.
• ipsdb00095206 - About, Help and Change Password links missing in the Configuration Console when using Database authentication.
• APAR # PJ40100 - iLOG graph enhancements.
• APAR # PJ40069 - Cognos report improvement.
• ipsdb00101346 - "New ER Data" filter improvement.
• ipsdb00102644/APAR # PJ40306 - HTTP Transport Memory Leak.
• ipsdb00103139 - "undo merge" entity-handling improvement.
• ipsdb00103645 - Unresolve performance improvement.
• -- Cognos Reports - Address City/ZIP reversal fix.

To see the latest information about known problems and issues

As problems are discovered and resolved, the IBM Support team updates the Support portal. By searching the Support portal, you can quickly find workarounds or solutions to problems.

At time of publication, there were no known installation problems. Check the Support portal for the most current information.

System requirements updates

For the latest information about hardware and software compatibility, see the detailed system requirements document at http://www.ibm.com/support/entry/portal/Software/Information_Management/InfoSphere_Identity_Insight.