File:   4.6.0-TIV-TIM-FP0021.README
Date:   June 30, 2006

Fixpack 4.6.0-TIV-TIM-FP0021 for APARs IY81102, IY81934, IY82086, IY82309, IY82314, IY82321, 
IY82894, IY83236, IY83247, IY83249, IY83257, IY83261, IY83262, IY83263, IY83264, IY83265, 
IY83420, IY83475, IY83641, IY83651, IY83709, IY83774, IY83790, IY83875, IY83901, IY83904, 
IY83905, IY83906, IY83908, IY83925, IY83958, IY84379, IY84443, IY84446, IY84451, IY84466, 
IY84467, IY84468, IY84476, IY84678, IY84684, IY84863, IY84864, IY84904, IY84905, IY84907, 
IY84919, IY84954, IY84962, IY85007, IY85046, IY85048, IY85049, IY85050, IY85052, IY85153, 
IY85241, IY85334, IY85436, IY85452, IY85548, IY85549, IY85550, IY85551, IY85553, IY85554, 
IY85685, IY85704, IY85937, IY86116, IY86278, IY86425, IY86426, IY86430, IY86436, IY86437, 
IY86438 and IY86442.

Components:  As needed for IBM WebSphere.

General Description:

This Fixpack provides fixes for APARs IY81102, IY81934, IY82086, IY82309, IY82314, IY82321, 
IY82894, IY83236, IY83247, IY83249, IY83257, IY83261, IY83262, IY83263, IY83264, IY83265, 
IY83420, IY83475, IY83641, IY83651, IY83709, IY83774, IY83790, IY83875, IY83901, IY83904, 
IY83905, IY83906, IY83908, IY83925, IY83958, IY84379, IY84443, IY84446, IY84451, IY84466, 
IY84467, IY84468, IY84476, IY84678, IY84684, IY84863, IY84864, IY84904, IY84905, IY84907, 
IY84919, IY84954, IY84962, IY85007, IY85046, IY85048, IY85049, IY85050, IY85052, IY85153, 
IY85241, IY85334, IY85436, IY85452, IY85548, IY85549, IY85550, IY85551, IY85553, IY85554, 
IY85685, IY85704, IY85937, IY86116, IY86278, IY86425, IY86426, IY86430, IY86436, IY86437, 
IY86438 and IY86442.

  New Problems Fixed:
   
    APAR:    IY81102    17171
    Symptom: Filter set in ACI doesn't work correctly when using the SEARCH function. 
   
    APAR:    IY81934    17218
    Symptom: LDAP filter that is set in lifecycle rule isn't correctly run if it 
             includes NOT condition "!" at the beginning or in the middle.
    Note:    Please note that in addition to being RFC 2254 compliant, the ldap 
             filter may be entered only in the form expressions-first, statements-later.
             For example. the filter (&(|(attrX=valX)(attrY=valY))(attrZ=valZ))
             needs to be written in the form: (&(attrZ=valZ)(|(attrX=valX)(attrY=valY)))
             Matching Rules and Relationship Expressions may not be resolved as desired.
             This restriction may be removed in a future release or future maintenance.
   
    APAR:    IY82086    17226
    Symptom: Mandatory enforcement on the Provisioning Policy doesn't guarantee the link 
             between the ITIM account and the ITIM group.
    Note:    As a fix to this defect, any change to ITIM group membership will lead to
             account modification workflow process being spawned for each ITIM account
             affected by the change. Additionally, removal of ITIM group will be only
             allowed, if the ITIM group does not have any ITIM accounts as members of
             the group.
   
    APAR:    IY82309    17233
    Symptom: If the person object being updated already has the same dn value in the manager 
             attribute, ITDI still does an update (this is not expected behavior). 
   
    APAR:    IY82314    17234
    Symptom: Alert Compliance processing prevents Modify Account Extensions from 
             operating properly when used in suspend/restore/password change operations.
   
    APAR:    IY82321    17235
    Symptom: Get error CTGIMM095E when entering answers to challenge response questions when 
             both English and "Default locale" questions are defined.
   
    APAR:    IY82894    17255
    Symptom: Unable to create new custom person object in TIM after upgrading to 
             4.6.0-TIV-TIM-FP0008.
   
    APAR:    IY83236    17266
    Symptom: Unable to get results if only one result exists for a single value 
             searchmatch field. 
    Note:    After applying this Interim Fix, it is recommended that the user do a 
             hard-refresh (Ctrl+F5) on the browser window, so as to enforce the new 
             version of java script files immediately.
   
    APAR:    IY83247    17268
    Symptom: Get "LDAP error 65 - Object Class Violation" when updating account attributes.
    Note:    If this error is encountered when updating account attributes, then after 
             applying this Interim Fix, reconciliation needs to be run again. This 
             Interim Fix will prevent future incorrect update of single-valued 
             attributes, which are empty on the resource side, during reconciliation.
   
    APAR:    IY83249    17269
    Symptom: ITIM Notification e-mails are not sent when language pack is installed.
   
    APAR:    IY83257    17159
    Symptom: ITIM does not display over 1000 org units in 'My Organization' tab.
    Note:    After installing this fix, you need to change the property, 
             enrole.ui.maxSearchResults, in <ITIM_HOME>/data/ui.properties to the value 
             you wish to be able to view.
   
    APAR:    IY83261    17241
    Symptom: Unable to log in with chinese characters (zhcn936) through SSO ITIM Server.
    Note:    A new property 'enrole.ui.ssoEncoding' is introduced in 
             <ITIM_HOME>/data/ui.properties.
             This property specifies the encoding scheme used by SSO authentication systems 
             like Webseal, to encode user credentials before sending to ITIM. After applying 
             the fix, if the property is not specified, ITIM will use UTF-8 as the default 
             encoding scheme. 

             If the authentication system uses encoding scheme other than UTF-8, then that 
             can be specified by setting 'enrole.ui.ssoEncoding'. Refer to the following 
             example for setting the value of this property to UTF-16:
             1. Open <ITIM_HOME>/data/ui.properties in any text editor.
             2. Search for the property 'enrole.ui.ssoEncoding' and specify UTF-16 as its value.
                enrole.ui.ssoEncoding=UTF-16
             3. Save the changes and exit the editor. 
   
    APAR:    IY83262    17245
    Symptom: Recon complete does not clear the ENROLE.LISTDATA table.
    Note:    After applying this fix, only accounts that have changed on the remote 
             resource will be evaluated for compliance, during reconciliation. Thus
             the reconciliation report will display details of only those accounts 
             that have been changed on the remote resource.
   
    APAR:    IY83263    17242
    Symptom: It is possible to create SMTP addresses with multiple @ symbols although 
             this is not allowed when managed through Microsoft Active Directory.
   
    APAR:    IY83264    17244
    Symptom: GZIP errors using Oracle 10G.
   
    APAR:    IY83265    17247
    Symptom: It is not possible to de-provision orphan ITIM-accounts.
   
    APAR:    IY83420    17274
    Symptom: Updated Documentation on ITIM and ITDI Integration.
   
    APAR:    IY83475    17263
    Symptom: NullPointerException due to uninitialized sessioncontext variable in 
             AuditManagerBean
   
    APAR:    IY83641    17281
    Symptom: AD Service definitions can not be displayed after ITIM 4.5.1 to ITIM 4.6.0 
             migration if they have an erADDomainPassword.
    Note:    A repair utility is shipped along with this interim fix that will enable removal 
             or encryption of such attribute values which are stored in clear text and also 
             specified in 'password.attributes' attribute in <ITIM_HOME>/data/enRole.properties 
             file. 
             To execute the utility please unzip IY83641.zip to a temporary directory on 
             your hard drive and follow the instructions given in Readme.txt present in the 
             extracted directory.
   
    APAR:    IY83651    17283
    Symptom: Java Script Object PersonSearch does not work in a Provisioning Policy Entitlement.
   
    APAR:    IY83709    17285
    Symptom: The enrolelastaccessdate.properties file is not working properly.
             The enrolelastaccessdate.properties file is used to redirect the attribute used 
             to derive the erLastAccessDate value from itself to another attribute on certain 
             account types. For instance, for AD services (erADDAMLService), erLastAccessDate 
             values should be derived from erADLastLogon. For RACF services (erRACFSSLService), 
             this value should be derived from erRacULogtime. 
   
    APAR:    IY83774    17286
    Symptom: Reconcile warnings for TAM groups with trailing whitespace in the group name. 
   
    APAR:    IY83790    17288
    Symptom: Multi-value entitlement attributes with a colon are incorrectly handled.
             Under certain circumstances, when a single colon ':' is used in a provisioning 
             policy entitlement attribute, the values are doubled which makes it act as 
             value separator.
    Note:    While specifying the values manually, for a multivalued attribute, through 
             "Advanced Provisioning Parameter" screen, if a value contains ":" either at 
             the  beginning or at the end, please specify a space before and after the 
             delimiter (::).
   
    APAR:    IY83875    17291
    Symptom: When using Combined Password Rules, specifically the Start With rule, you get a
             strange display result.
   
    APAR:    IY83901    17243
    Symptom: A BAD_NAME_SYNTAX exception occurs whenever the attribute "erTopXGroupName" 
             contains a character that is not valid for an RDN, even though this attribute 
             is tagged as a "RemoteRDN" in xforms.xml.
   
    APAR:    IY83904    17253
    Symptom: Service Provider Requests fail when reconcile is running (locking service) 
             and service profile specifies ASYNCHRONOUS mode.
   
    APAR:    IY83905    17261
    Symptom: ClassCastException occurs in AssignmentEntity.getInputParameters(), an attempt 
             is made to cast the Assignment object into a WorkItemInfo object. 
             The WorkItemInfo class extends Assignment, hence the ClassCastException is 
             thrown trying to cast a parent class as a child class.
    Note:    After applying this fix, the custom code using the API - 
                 AssignmentEntity.getInputParameters() 
             might throw an error or may fail to compile if WorkflowException is not handled. 
             This is because now this function is declared to throw WorkflowException. This
             exception will be thrown if any problem is encountered while trying to retrieve 
             input parameters. So if you are using this API, the custom code may need to be 
             modified to handle WorkFlowException thrown by this API. 
   
    APAR:    IY83906    17277
    Symptom: Custom logo will not display on Config tab.
   
    APAR:    IY83908    17279
    Symptom: CSV feed where erPersonPassword is specified that does not comply with the
             password policy fails to add the personal password account, but adds the user.
   
    APAR:    IY83925    17293
    Symptom: The ACI filter, (${role.errolename}=role_x), for an ACI, targeted on Person 
             entities, selects only persons having "role_x" role only but doesn't select 
             persons having any role other than "role_x".
   
    APAR:    IY83958    17295
    Symptom: Unable to import any of jar from ITIM 4.6 Server when Global Security enable in WAS.
   
    APAR:    IY84379    17322
    Symptom: ADMIN Domain ACI modification require ITIM server restart.
   
    APAR:    IY84443    17324
    Symptom: The "Request Details" of an "Enforce Compliance" activity does not list the 
             NonCompliant accounts, instead it displays the java object identifier of the 
             NonCompliant account.
   
    APAR:    IY84446    17326
    Symptom: Person Modification Operational Workflow always replaces aliases even if 
             nothing was changed. 
   
    APAR:    IY84451    17327
    Symptom: Documentation Update:
             Problem: Using ITDI a jndi connection returns serviceLoginContext error.
    Note:    In "ITIM 4.6 Installation and Configuration Guide, Appendix D (line no.141, 142)"  
             the path in step number 5  under "Configuring the JAAS login module for JNDI feed" 
             is incorrectly documented as  
             "com.ibm.remoteservices.provider.itim.ServiceLoginModule". 
             It should be read as: 
             "com.ibm.itim.remoteservices.provider.itim.ServiceLoginModule".
   
    APAR:    IY84466    17316
    Symptom: Custom logo is not displayed on password retrieval page, when, trying to retrieve 
             password using URL http://<ITIM_server_host>:<ITIM_host_port>/enrole/getpassword. 
   
    APAR:    IY84467    17315
    Symptom: Attribute value becomes blank when user navigates from non-compliance attribute 
             screen to the account form using the back button.
   
    APAR:    IY84468    17299
    Symptom: New Function:
             Menu items are not linkable when they are already the active menus.
             Users can drill down up to ten levels to find an account, then, they need to 
             backspace 10 times to get back and repeat the exercise.
   
    APAR:    IY84476    17328
    Symptom: The removeProperty() API is not working in ITIM 4.6.
   
    APAR:    IY84678    17336
    Symptom: This fix affects Oracle Databases only.
             If an agent is down, and a request is sent to that agent, ITIM server tries to 
             take the request information and store it in a table to allow the request to be 
             fired off when the agent is available again. If the request contains large amounts 
             of data, and the customer is using the Oracle 9i driver, the request will fail to 
             be written to the DB with a sql error. 
   
    APAR:    IY84684    17337
    Symptom: When an event notification recon from AD agent runs and sends modify requests for 
             existing AD groups to the TIM server, these fail to get updated in TIM server. 
   
    APAR:    IY84863    17339
    Symptom: When using ITIM 4.5.1 at 4.5.1-TIV-TIM-IF0051 Interim Fix level, and upgrading to 
             ITIM V4.6, get the following SQL error twice.
             SQL0601N: The name of the object to be created is identical to the existing name 
             "ENROLE.RECONCILIATION" of type "TABLE".
   
    APAR:    IY84864    17340
    Symptom: NoClassDefFoundError error on TIM system that was migrated from V4.5.1.
             The jsafe.jar file is no longer used in ITIM 4.6.0, since the encryption
             is changed in 4.6.0, but the jsafe.jar file is needed to be able to
             encrypt the existing 4.5.1 data in LDAP.

             If your TIM V4.6 system is migrated from V4.5.1, it is necessary to copy
             the jsafe.jar and log4j.jar files from the:
             $ITIM_HOME/lib 
             directory into:
             $WAS_HOME/installedApps/$CELL_NAME/enRole.ear directory  
             to prevent the NoClassDefFoundError error.

             You must always copy these 2 files back after installing an ITIM Interim Fix
             or Fixpack.
             The ITIM Fixpack and Interim Fix READMEs have been update with this update.
   
    APAR:    IY84904    17310
    Symptom: ITDI agent doesn't recognize ITIM reconciliation query/filter.
   
    APAR:    IY84905    17314
    Symptom: Unable to submit Chinese chars for Self Registration page.
   
    APAR:    IY84907    17343
    Symptom: Get a subFormRenderingError when trying to display SAP account's 
             "Authorization roles" which contains dates.
   
    APAR:    IY84919    17344
    Symptom: The method, getInputParameters(), of:
             com.ibm.itim.apps.workflow.WorkflowAssignmentMO
             returns collection of objects of type:
             'com.ibm.itim.workflow.model.RelevantDataItem' 
             and as this class is not present in itim_api.jar, it throws an exception. 
   
    APAR:    IY84954    17345
    Symptom: When using the ServiceSearch.searchByFilter, get:
             error: Runtime error com.ibm.itim.script.PROFILE_CONTEXT_MISSING.
    Note:    The functions ServiceSearch.searchByFilter() and ServiceSearch.searchForClosestToPerson() 
             methods can now be accessed in any Workflow scripts.
             The following are a brief description of this methods and its usage. 

             1) ServiceSearch.searchByFilter(filter, [scope], [profileName]); 
             
             Arguments: 
             filter : LDAP search filter that defines the criteria for returned containers to meet. 
                      The filter must be in the format defined by RFC2254 
           
             scope  : Optional search scope, provided as an int. Use 1 for One Level Scope and 2 
                      for SubTree Scope. One Level Scope is the default scope. 

             profileName : Optional profile name, provided as a String. Profile name of the service 
             to use as the basis for the search.

             Returns an array of DirectoryObjects representing the results of the search. 

             Example:
                 searchResult1 = ServiceSearch.searchByFilter("(erntlocalservername=*srv)", 2); 

             // use default one level scope 
                 searchResult2 = ServiceSearch.searchByName("(erntlocalservername=*srv)", "ADProfile");
                 
*IMPORTANT*  Please note that the prototype of the following function has been changed. Prior to 
             4.6.0-TIV-TIM-IF0020 this function accepted an integer argument as its second parameter, 
             which specified the scope of the search. But now that has been changed to accept profile name 
             as the second parameter and this function won't accept scope since it is of no relevance.
             
             2) ServiceSearch.searchForClosestToPerson(person, [profileName]); 
          
             Arguments: 
             person: The DirectoryObject representing a person to use as the basis for the search. 

             profileName :Optional profile name, provided as a String. Profile name of the service 
                          to use as the basis for the search.

             Returns an array of DirectoryObjects representing the results of the search. 

             Example:
                 searchResult1 = ServiceSearch.searchByFilter(subject); 

                 searchResult2 = ServiceSearch.searchByName(subject, "ADProfile");
   
    APAR:    IY84962    17346
    Symptom: Restoring an ITIM account can generate an error stating the password does not 
             meet current policy rules, when Password Sync is enabled. 
   
    APAR:    IY85007    17349
    Symptom: IdentityPolicy.userIDExists(baseidentity, false, false) checks for existing IDs 
             on orphan accounts for All services. The function returns true for orphan accounts 
             on other services, but if account is adopted then it returns false.
   
    APAR:    IY85046    17312
    Symptom: Enclose the actual 'user-entered' report's query filter part in the SQL statement 
             in parenthesis.
   
    APAR:    IY85048    17317
    Symptom: NullPointerException in logging when creating a new account with objectclass 
             violations.
   
    APAR:    IY85049    17300
    Symptom: New Function:
             Search settings are lost after exiting a search.
   
    APAR:    IY85050    17305
    Symptom: New Function:
             User with a large number of accounts wishing to change the password of only a few
             is forced to uncheck the accounts which are NOT being checked. 
   
    APAR:    IY85052    17307
    Symptom: New Function:
             In user managed records (i.e. Microsoft Active Directory), multi-valued items are 
             not sorted alphabetically (e-mails, security groups, etc).
   
    APAR:    IY85153    17365
    Symptom: Using the self care application notification e-mails are only sent during 
             forgot password function and not during the change password function.
    Note:    After applying the fixpack please execute the following steps in order to
             receive email notification for Change-Password operation.
   
             1. Edit 
                <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/ChangePasswordServlet.java.
                You can use any convenient text editor to edit the file.
   
             2. Change method call on line 694 from 
                SelfRequest sreq = spm.changePassword(userID, currentPassword, newPassword);
                to
                SelfRequest sreq = spm.changePassword(null, userID, currentPassword, newPassword, 
                new Boolean(true));
   
             3. Save the changes and quit the editor.
             4. Build and deploy self_care example according to instructions given in the README 
                for self_care. If older version of self_care is already deployed on WAS, you can 
                simply choose to "update" itim_expi application in WAS admin console giving the path 
                freshly built itim_expi.war file. Default settings can be used while updating.
                
             A new API has be exposed in order to fix this defect. SelfPasswordManager.html 
             has been updated with the information on the newly published API.
   
    APAR:    IY85241    17382
    Symptom: AE IY77169 FIX COMPLETION.  After ITIM Fixpack 4.6.0-TIV-TIM-FP005  the
             Automatic entitlement of Service Profile becomes restricted by UI.
   
    APAR:    IY85334    17353
    Symptom: Provide an API in RoleEntity.java, to maintain sync with ITIM 451 APAR IY82728.
    Note:    RoleEntity.html has been updated with the information on the newly published API.
   
    APAR:    IY85436    17394
    Symptom: When using the AccountManager.suspend API, a ClassCastException occurs if there is 
             only 1 account object in the list of accounts to suspend. 
   
    APAR:    IY85452    17386
    Symptom: Under User Interface Customization the listbox control is set to REQUIRED. However, 
             after entering data and then submitting the form, the control does not validate so 
             users can submit requests without selecting a value from the listbox.
   
    APAR:    IY85548    17297
    Symptom: When using '"' (double quote) in a group name, a group search result will 
             return an empty list.
   
    APAR:    IY85549    17352
    Symptom: NEW FUNCTION
             ENHANCEMENT: The mode check box should retain its previous state i.e. "checked" 
             after exiting a search.
   
    APAR:    IY85550    17308
    Symptom: Supervisor, Sponsor, Domain Admin cannot search/see containers they should  
             be able to even with default ACI allowing them to do so.
   
    APAR:    IY85551    17338
    Symptom: NEW FUNCTION
             PERFORMANCE ENHANCEMENT: This enhancement speeds up searches when done by a 
             non-Admin user when there is a very large organization.
   
    APAR:    IY85553    17361
    Symptom: NEW FUNCTION:
             ENHANCEMENT: Default search settings should be available on logon.
    Note:    The default search criteria that appears when the user navigates to the search 
             tab can be specified in the enRole.properties file using the following properties.
             DEFAULT_SEARCH_CONDITION, DEFAULT_SEARCH_CATEGORY, DEFAULT_SEARCH_CLASS and 
             DEFAULT_SEARCH_ATTRIBUTE.
             
             Please execute the following steps to specify the default search settings.
             
             1. Edit <ITIM_HOME>/data/enRole.properties file.
             2. Search for the following properties and specified appropriate value for these 
                properties according to your requirements.
                DEFAULT_SEARCH_CONDITION=1
                DEFAULT_SEARCH_CATEGORY=Person
                DEFAULT_SEARCH_CLASS=Person
                DEFAULT_SEARCH_ATTRIBUTE=cn
             3. Save the file and exit the editor.
   
    APAR:    IY85554    17368
    Symptom: Unhandled exception on Manage Password page.
   
    APAR:    IY85685    17367 17417
    Symptom: Auto account provisioning subprocess aborted.  The problem may occur when a person 
             modify operation triggers a policy enforcement action such that at least one existing 
             account for that person becomes disallowed and a new account gets auto provisioned.
   
    APAR:    IY85704    17414
    Symptom: The javadocs state that: 
             WorkflowSearchMO.setStatement(WorkflowQueryStatement statement)
             And that WorkflowQueryStatement is an Interface and that the implementing classes 
             are:
                ProvisioningQueryStatement
                RequesterQueryStatement

             But there is no code to handle RequesterQueryStatement.  The result is:
             WorkflowSearchMO RequestorQueryStatement ClassCastException 
    Note:    The parameter to WorkflowSearchMO.setStatement(WorkflowQueryStatement statement) should 
             be an instance of ProvisioningQueryStatement. Please utilize WorkflowProcessQuery APIs 
             if you want to use RequesterQueryStatement. The javadoc for 
             WorkflowSearchMO.setStatement(WorkflowQueryStatement statement) has been updated 
             accordingly.
   
    APAR:    IY85937    17426
    Symptom: ITIM Server javacores with 20000 ous and 250000 ACIs during Person Search.
   
    APAR:    IY86116    17435
    Symptom: When doing person searches through the API by an ACI controlled user, no results 
             returned 
   
    APAR:    IY86278    17441
    Symptom: Documentation Update for the Installation Guide:
             Unhandled error condition when, during Installation, a wrong hostname/IP address 
             is provided.
             During a new installation of ITIM, if the user inserts a hostname/IP address 
             different from the one specified during WebSphere installation, the installation 
             procedure completes but the ITIM product is not properly installed.
             The only message visible in the runConfig.stdout or runConfigTmp.stdout 
             (depending on the kind of installation) is the following one:

                ----- stdout>> **************
                ----- stdout>> Did not find any WebSphere node in the cell. Please check.
                ----- stdout>> **************

             reported several times (one for each call of the get_nodes).
             It should be noted that under this condition, when an incorrect hostname/IP address
             is used, the Installation does not complete properly, even though the messages
             may indicate otherwise.
             This condition will be addressed in the Installation process of a future release of
             the ITIM product.
   
    APAR:    IY86425    17301
    Symptom: NEW FUNCTION:
             ENHANCEMENT: Added Adoption and Orphan buttons to areas of the product where
             they are applicable to operations.
   
    APAR:    IY86426    17302
    Symptom: NEW FUNCTION:
             ENHANCEMENT: Key columns in the 'My Accounts' and 'My Passwords' list are not 
             sortable.  Specifically, the server name column is not sortable in 'My Accounts' 
             and none of the columns in 'My Passwords' are sort-able.
             The "Login Name" and "Service Name" will now allow a sort on 'My Accounts' and 
             'My Passwords' page.
                                                                         
    APAR:    IY86430    17400
    Symptom: IdentityPolicy.userIDExists(baseidentity, false, false) is not checking the target 
             service instance properly for Hosted Service.
   
    APAR:    IY86436    17403
    Symptom: ENHANCEMENT: Challenge Response submissions now pre-processed via JavaScript.
   
    APAR:    IY86437    17434
    Symptom: Enforce documented restrictions on migration (UPGRADE) path to ITIM 4.6.
   
    APAR:    IY86438    17363
    Symptom: The WinAD account creation fails if a constant attribute value in provisioning policy 
             entitlement "Advanced Provisioning Parameter List" contains a newline character.
    Note:    If you want to specify a constant value with a new line character for an advanced parameter, 
             write a javascript that returns a string representation of the value with newline characters 
             replaced by its unicode equivalent \u000A. 
             
             For example say you want to specify the following value for the advanced parameter "description" 
             for an AD account :
             John is a Manager,
             He works in accounts Dept.
             A script interpreter error is thrown. The error can be prevented by replacing the constant with 
             the following script for the "description attribute:

             {
                 var str = "John is a Manager,\u000AHe works in accounts Dept.";
                 return str;
             }
   
    APAR:    IY86442    17439
    Symptom: 'Page cannot be displayed' when Manage Passwords link clicked under My Organization > Manage People 
             for a person who doesn't have any accounts.
             
  Old Fixes included from previous Interim Fixes since Fixpack 4.6.0-TIV-TIM-FP0008.
   
    APAR:    IY81222    17177	
    Symptom: Auto provisioning of two accounts fails with password sync enabled on the 
             ITIM server.
   
    APAR:    IY81564    17191
    Symptom: When using self care module (itim_expi.war) and logging on as a user, 
             attempting to set challenge responses produces error: 
             You cannot use the "Change Challenge/Response Answers" feature at this time.
             The sample code only supports configuring challenge/response answers when the 
             challenges are defined by an Administrator, however, there are no Administrator
             defined challenges at this time.
             
    Note:    To fix this issue we have modified the sample code shipped with ITIM. The modified 
             code will read the properties 'language' and 'country' specified in 
             itim_expi.properties file and display the challenges/responses appropriately. The 
             files:
             <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/expiUtil.java 
             and 
             <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/ChangeChallengeResponseServlet.java 
             have been modified and shipped. Please execute the following steps after applying 
             this fixpack.
             
             1. Rebuild and redeploy itim_expi.war using the new files. Alternatively if you have 
             modified the example code to suit your requirement, you can incorporate the changes 
             in these files and rebuild and redeploy itim_expi.war.
             
             2. In the itim_expi.properties file that is used by self_care application, specify 
             the 'language' and 'country' parameters according to the table given below. 
             self_care application will retrieve the challenges/responses depending on the value 
             specified for these properties. You can refer to the following table to set the 
             values of 'language' and 'country' appropriately.
             
                    Locale                         language                 country
             [specified in TIM UI while          
             setting the admin challenges]
             ------------------------------------------------------------------------------------
             German                                  de            (blank, don't specify anything)
             Spanish                                 es            (blank, don't specify anything)
             French                                  fr            (blank, don't specify anything)
             Italian                                 it            (blank, don't specify anything)
             Japanese                                ja            (blank, don't specify anything)
             Korean                                  ko            (blank, don't specify anything)
             Portuguese                              pt            (blank, don't specify anything)
             Simplified Chinese Resources            zh                       CN
             Traditional Chinese Resources           zh                       TW
             English                                 en            (blank, don't specify anything)

             In case you want to retrieve challenges/responses only for the default locale 
             (no locale specified while setting the admin challenge in directory server, which 
             can happen when you upgrade from ITIM 4.5.1), please comment the two parameters 
             'language' and 'country' by putting a '#' at the beginning. 
             Example:
             #language=
             #country=
   
    APAR:    IY82024    17224
    Symptom: ITIM 4.6 Export feature (Configuration) doesn't handle double-byte characters.
             During Import, get error - container not found.
             
    Note:    After installing the fixpack, for non Windows platform that doesn't support double 
             byte characterset, please ensure that the codeset in environment variable LANG is 
             set to UTF-8. Example; en_US.UTF-8. Usually this is the default setting on Linux 
             platform.  If this is not set, here is a sample script to set the environment 
             variable LANG to en_US.UTF-8. You may add this to the WebSphere startServer.sh if 
             you wish or use this example to start WebSphere, just uncomment the areas needed 
             and replace WAS_HOME appropriately. Please set the language and territory 
             appropriately depending on the locales installed on your operating system.
             
             The value of LANG variable is of the form language[_territory][.codeset][@modifier]
             where territory, codeset and modifier are optional. Ensure that codeset is set to UTF-8.
             
             #!/bin/sh
             
             LANG=en_US.UTF-8
             export LANG
             #<WAS_HOME>/AppServer/bin/startServer.sh server1
             
    APAR:    IY82201    17231
    Symptom: The subject and message are lost on workorders after upgrade from ITIM 4.5.1 to 
             ITIM 4.6
   
    APAR:    IY82903    17254
    Symptom: ITIM Tuning Guide, SC23-5272-01, correction: 
             Create Index Causes SQL0204N: Undefined Name Error 
             On pages 4, 5, 6, and 16 of the ITIM 4.6 Performance and Tuning Guide, 
             SC23-5272-01, the table names should not be double quoted. In the command section 
             each of the 4 commands should appear as follows:
    db2 'create index PROCESS_SUB_X on ENROLE.PROCESS ("SUBMITTED" DESC, "PARENT_ID" ASC)'
    db2 'create index PROCESS_ID_ST on ENROLE.PROCESS ("ID" ASC, "STATE" ASC)'
    db2 'create index PROCESSDATA_ID_DEF on ENROLE.PROCESSDATA ("PROCESS_ID" ASC, "DEF_ID" ASC, "VALUE_LAST_MODIFIED" ASC)'
    db2 'create index SCH_MSG_SVR on ENROLE.SCHEDULED_MESSAGE ("SERVER" ASC)'
   
    APAR:    IY82938    16990 - 17258
    Symptom: Getting CTGIM0040E when modifying account.   Some of the auditing table schema 
             lengths are not sufficient to hold the user data.
   
    APAR:    IY83068    17143
    Symptom: Reporting ACI's do not work after upgrading to ITIM 4.6 from ITIM 4.5.1.
             The target of the reporting ACI's is not preserved after upgrade.
             
    APAR:    IY83078    17223
    Symptom: During DBUpgrade, duplicate entries for "outofbox" Reports get inserted into 
             the table "REPORT".
   
    APAR:    IY83080    17209
    Symptom: Retry settings don't affect participant resolution failures.
   
    APAR:    IY83082    17229
    Symptom: Persons of all types are returned when using a case sensitive search instead 
             of a case insensitive search. However, search for custom persons works fine.
   
    APAR:    IY83243    17212
    Symptom: NotSerializable exception thrown, when trying to initialize the value of a user 
             defined relevant data item of the type array.
   
    APAR:    IY80099    17134
    Symptom: Excluded/Regular expressions in Entitlement are reset for SAP roles.
    
    Note: After applying this fix, on the "Standard View" of Provisioning policy entitlement 
    screen, "--" is displayed for "Start Date" and "End Date" if they do not have any values 
    specified. For example, if we specify a regular expression in "Advanced View", then on 
    switching to "Standard View" the regular expression is displayed with "--" against 
    "Start Date" and "End Date".
   
    APAR:    IY80892    17163
    Symptom: Adding adminDomain administrators requires restarting the ITIM server for this 
             change to take affect.
             
    Note: After applying this fix, any change in the ACI Principals will take effect only after 
    the ACI's get refreshed. This refresh interval is specified by the property 
    "enrole.accesscontrollist.refreshInterval" defined in <ITIM_HOME>/data/enRole.properties.
   
    APAR:    IY81541    17188
    Symptom: Scheduled Messages are being erroneously reinitialized. 
   
    APAR:    IY82149    17208
    Symptom: Modification details of the ‘Default ITIM Provisioning Policy’ entitlement are 
             not displayed in request data.
   
    APAR:    IY82150    17211
    Symptom: Lotus Notes - failed password changes still show as Success in ITIM GUI.
   
    APAR:    IY80454    17148
    Symptom: Policy.level=DEBUG_MAX logging shows password change values in clear text.
   
    APAR:    IY81245    17178
    Symptom: Running DBConfig.exe to drop the database tables generates an error in the 
             DBConfig.STDOUT:
             ----- SQL file: /opt/itim45/config/rdbms/oracle/enrole_functions.ddl
             Exception in 
             readDataFileIntoString(/opt/itim45/config/rdbms/oracle/enrole_functions.ddl):
                java.lang.StringIndexOutOfBoundsException: String index out of range: -1
             
             Note - After applying this patch ensure that you run the task 1 in the 
             COMMON TASKS listed below.
   
    APAR:    IY81650    17176
    Symptom: Recon of resource leaves LDAP connections open.
   
    APAR:    IY81651    17166
    Symptom: Three of ITIM's EJBs generate WARNING messages when deployed.
   
    APAR:    IY81652    17169
    Symptom: ACI with filter that includes a system expression does not have expected 
             effect on access control.
   
    APAR:    IY81654    17172
    Symptom: Not able to set an attribute value to "empty" during DSML/IDI feed, when an 
             "empty" value tag is specified in the feed file.
   
    APAR:    IY81656    16375
    Symptom: Request Data displayed for modifying Default Provisioning policy for ITIM does 
             not display attribute modified.
   
    APAR:    IY80177    17137
    Symptom: Get an erroneous "required field" warning popup during as400 account modification. 
   
    APAR:    IY80468    17149
    Symptom: NullPointerException triggered after applying FP8 during IDI HR feed, when 
             updating a Person Attribute with a value, whose previous value is null/nothing.
                             
    APAR:    IY80789    17157
    Symptom: NullPointerException triggered after FP8 during Reconciliation, where an 
             Attribute's new value is null, but the old value is not null.
   
    APAR:    IY80881    17125
    Symptom: Self care application hangs when changeonlytimpassword is set to "true" in:
             itim_expi.propertes file.
   
    APAR:    IY80882    17127
    Symptom: Suspended ITIM Manager account is not restored on ldapconfig.
             Note - After applying this patch copy the file er-tenant.tmpl 
             to <ITIM_HOME>/config/ldap folder.
   
    APAR:    IY80883    17136
    Symptom: Date math is not calculating the year correctly which results in a date in the future.
   
    APAR:    IY80884    17139
    Symptom: Removal of System.gc() from Import Export component.
   
    APAR:    IY80886    17140
    Symptom: Identity Policy is evaluated twice during account add and modify.
   
    APAR:    IY80887    17141
    Symptom: The customer's subform works fine when within "Manage People", but during an RFI 
             the value of "target_dn" (not container_dn) is empty.
             Note - Please refer to IY80887.txt that contains detail instructions and examples on 
             accessing contextual parameters in SubForm control type.
   
    APAR:    IY80889    17144
    Symptom: ITIM gets ERROR 500 and throws NullPointerexception in some Reports menus.
   
    APAR:    IY80890    17152
    Symptom: When loading BPPerson data, ITIM does not perform a lookup on the erSponsor attribute 
             value, like it does for the erSupervisor (Manager) on Person objects.
   
    APAR:    IY78427    17054
    Symptom: ITIM 4.6 FP installer does not work with SSL connection setup between ITIM and LDAP. 
   
    APAR:    IY78978    17080
    Symptom: Unable to configure SearchMatch field, to Single Value.
   
    APAR:    IY79192    17090   
    Symptom: Dropdownbox\Listbox form element displays "Source Attribute" value instead of 
             "Attribute" value.
             NOTE *** To set the "Source Attribute" value of a Dropdownbox\Listbox form 
             element as the DistinguishedName of an entity, set it to 'dn'.'$dn' is not a 
             valid value.
   
    APAR:    IY79391    17096
    Symptom: When two persons have TAM GSO accounts with an identical name, neither of the 
             accounts are deleted on TAM although "View Completed Requests" indicates 
             that the deletion requests to these accounts are successfully completed.
   
    APAR:    IY79543    17102
    Symptom: Password Sync initiated password change on AD Agent does not send email to 
             the defined itim user account via the itim server.
             NOTE *** A new property has been introduced in enRole.properties located in
             ITIM_HOME/data directory i.e. 'enrole.passwordsynch.module.sendMail'. 
             Only if the value of this property in enRole.properties is set to 'true', an 
             email will be sent to the defined itim user account. This property can be set 
             to true by adding the following line in enRole.properties:
             enrole.passwordsynch.module.sendMail=true
             A copy of enRole.properties with this addition has been provided for your use
             as an example.  Do NOT copy this enRole.properties file to your system.
   
    APAR:    IY79559    17105
    Symptom: XSL parse error viewing pending or completed AD service request when account 
             has value for eradhomedirdrive attribute.
   
    APAR:    IY79936    17117
    Symptom: Although MQ CLI commands are referenced in the ITIM product manuals these 
             commands do not work if you are using the WebSphere embedded messaging 
             (which comes with the product) and have WAS global security turned on.

    APAR:    IY79938    17091
    Symptom: MBCS characters in URL are not encoded properly, for some locations in ITIM. 
             NOTE *** Fix has been incorporated and tested for versions of IE, supported by 
             ITIM 4.6.
   
    APAR:    IY79939    17087
    Symptom: Documentation for the self_care sample application is missing from the examples 
             documentation directory. The examples directory has been updated with the correct 
             information.  This Readme.htm will need to be copied to:
             <ITIM_HOME>/extensions/doc/self_care       directory
             
   
    APAR:    IY80010    17116
    Symptom: NullPointerException exception on new account creation when 
             CreatePassword & "Enable password editing" are disabled.
   
    APAR:    IY80012    17119
    Symptom: Get setProperty error with single character on Solaris.
             This is a very unique problem, during an account modify workflow that if the
             user does setProperty using a single-character to an attribute called: eg.
                myRasexecVar7 
             that it gets corrupted on the ACF2/Agent side of the transaction.
             For example, an 'E' generates a '69' on the mainframe.  When more than one 
             character is set, the value appears correct.
   
    APAR:    IY80019    17120
    Symptom: The erlastaccessdate attribute and value get removed from ITIM account if added 
             to the account form.
             NOTE *** The following attributes of an account entity, are managed by ITIM:
             - erlastaccessdate
             - erpassword 
             - erservice
             - owner
             The value of the above listed attributes can only be viewed in ITIM UI.
             Changes to the values of these attributes of an account entity, made by any 
             user,from ITIM UI, will be ignored.
   
    APAR:    IY80034    17118
    Symptom: Missing null check for attribute of a relationship object, during evaluation 
             of a RelationShip expression of ACI filter.
   
    APAR:    IY80035    16947   INTERNAL
    Symptom: Documentation: configuration info incomplete for SSL between ITIM server and LDAP 
             server.  Please see ITIM_LDAPS_Configuration.pdf file included in this Fixpack.
             
  Fixes for enroleagent.jar
    
    APAR:    IY80441    17147
    Symptom: CA certs valid in 4.5.1 can be invalid in 4.6.

    APAR:    IY78197   17073
    Symptom: Agent password from AD service form displayed in clear text in WebSphere 
            SystemOut.log file
            
  Old Fixes included from previous Fixpacks

    APAR:    IY79776    17048
    Symptom: Enhancement: 
             New property introduced in enRole.properties to control ITIMs behaviour encoding 
             a Challenge Response. ITIM by default converts responses to lower case before storing 
             them. Enhancement provides for administrators to chose encoding case for customization
             None implies case-sensitive challenge response enforcement.  Valid options are:
             enrole.challengeresponse.responseConvertCase=(lower|none|upper)

    APAR:    IY75064    16768
    Symptom: Various reports don't show information related to custom-defined persons.
             Note - To view information related to all custom-defined persons,
             adhoc synchronization has to be run again.
   
    APAR:    IY75663    16811
    Symptom: If configured values are differing in case, and if attribute is read only, 
             it is not displayed properly.
   
    APAR:    IY77051    16971
    Symptom: Specific script value of null in an entitlement causes Policy Enforcement to fail.
             NOTE: The following documentation change should be made in the section 
             "Account Validation Logic" of the ITIM 4.6 documentation:
             
             The existing paragraph:
             A null default or optional parameter value means that all values on the corresponding 
             attribute of a new or existing account are disallowed, except those allowed by any 
             other allowing values, but currently set values will not be removed.
             
             should be changed to:
             A null default or optional parameter value means that all values on the corresponding 
             attribute of a new or existing account are disallowed, except those allowed by any 
             other allowing values.   
             
    APAR:    IY77070    16982
    Symptom: The scheduler for Recon & Data Synchronization is broken.
   
    APAR:    IY77195    16986
    Symptom: In the field description of the formdesigner, the $ (dollar sign) gets lost, when
             you reenter the formdesigner for the gui-type dropdownbox. 
   
    APAR:    IY77505    16997
    Symptom: If a user has an extra whitespace after a property value, the parser does not work
             properly.  The parser should remove all whitespaces after a value. 
   
    APAR:    IY77579    16999
    Symptom: When viewing accounts from -> Provisioning -> Manage service -> service -> Accounts,
             then viewing the values for a non-compliant account, (orange triangle), the value for 
             'non-compliant value' is empty.  But, the value can be confirmed and does contain 
             data when viewing the full account from the service and managed account screens.  
   
    APAR:    IY77706    17004
    Symptom: When an OU name contains "&" character this results in XSL parsing error when viewing 
             details of Org Role in the OU.  
   
    APAR:    IY78078    17033
    Symptom: Null pointer exception when trying to submit a password change for an ITIM account.
   
    APAR:    IY78146    17039
    Symptom: Unable to run ldapClean.sh/bat script.
   
    APAR:    IY78383    17051
    Symptom: Update requests on DSML feed removes any attribute values not included  in the feed.
   
    APAR:    IY78667    17065
    Symptom: Logviewer gets SAX parse errors when it encounters trace entries with XML 
             data in the entry.
             Please note that input.xml should not contain xml header i.e. <?xml?>.
             The 'Wrapper Script' section in Readme.html in the following directory
                 <ITIM_HOME>\bin\logviewer 
             has been updated with this note.
   
    APAR:    IY78670    17066
    Symptom: Auditing of Provisioning Policy Drafts is lacking
   
    APAR:    IY78740    17008
    Symptom: Cannot configure certain extension nodes for entity type operations for business 
             partner entity types.
   
    APAR:    IY78741    17026
    Symptom: The ITIM userPassword values get truncated when fed to ITIM from IDI.
             NOTE: Binary attributes should be encoded to a Base 64 string in any request 
             from IDI to TIM or vice-versa. At receiver's end, these attributes should be 
             decoded from Base 64 string to get the binary value. In ITIM, only the binary 
             attributes with syntax listed in  $ITIM_HOME/data/Dsml2Schema.properties are 
             encoded or decoded, while communicating with IDI.In some cases, the syntax of 
             a particular binary attribute may not be present in Dsml2Schema.properties.
                             
             Steps to add a new attribute syntax in Dsml2Schema.properties:
             1. Open Dsml2Schema.properties file in a text editor.
             2. Add an entry for the desired binary attribute, to the file in the following 
                format:
                syntax.binary.<ATTRIBUTE_SYNTAX_NAME>=<OID_OF_SYNTAX>
                For example, the attribute syntax of 'OctetString' is used for  some binary
                attributes in SunOne Directory Server. So to add attribute syntax of 
                octetstring, add the following entry to the file:
                 syntax.binary.octetstring=1.3.6.1.4.1.1466.115.121.1.40
             3. Save the file.
             4. Restart ITIM for the changes to take effect.    
             
   
    APAR:    IY78743    17035
    Symptom: Request remains in "View Pending Request" with "Running" status.
             NOTE:  To clean entries from "ou=recyclebin" in ldap, use the ldapClean 
             utility provided with ITIM.
             After applying this patch follow the steps as given below:
             1. Copy itim_api.jar, itim_server.jar and api_ejb.jar from:
                $WAS_HOME/installedApps/$MACHINE_NAME/enrole.ear directory, to
                $ITIM_HOME/lib  directory.
                             
             2. For operating system other than windows:
                Edit ldapClean.sh in $ITIM_HOME/bin/unix directory, to
                include path of database driver and additional jars in classpath.
                Example - If you are using DB2 as the database, add the following line:
                          CLASSPATH=$CLASSPATH:<Path of db2java.zip>
                If your database is Oracle, add the following line:
                          CLASSPATH=$CLASSPATH:$ITIM_HOME/lib/ojdbc14.jar
                If your database is MS SQL Server, add the following line:
                          CLASSPATH=$CLASSPATH:$ITIM_HOME/lib/JSQLConnect.jar
                
                For all database types add following lines:
                          CLASSPATH=$CLASSPATH:$ITIM_HOME/lib/aspectjrt.jar
                          CLASSPATH=$CLASSPATH:$ITIM_HOME/lib/jlog.jar
                
             3. For Microsoft Windows operating system:
                Edit ldapClean.cmd in %ITIM_HOME%\bin\win directory, to
                include path of database driver and additional jars in classpath. 
                Example - If you are using DB2 as the database, add the following line:
                          set CLASSPATH=%CLASSPATH%;<Path of db2java.zip>
                If your database is Oracle, add the following line:
                          set CLASSPATH=%CLASSPATH%;%ITIM_HOME%\lib\ojdbc14.jar
                If your database is MS SQL Server, add the following line:
                          set CLASSPATH=%CLASSPATH%;%ITIM_HOME%\lib\JSQLConnect.jar

                For all database types add following lines:
                          set CLASSPATH=%CLASSPATH%;%ITIM_HOME%\lib\aspectjrt.jar
                          set CLASSPATH=%CLASSPATH%;%ITIM_HOME%\lib\jlog.jar
                             
             4. In a UNIX environment, source the DB2 environment before executing 
                ldapClean.sh.
                E.G. . /home/db2inst1/sqllib/db2profile 
   
    APAR:    IY78754    17030
    Symptom: ITIM makes too many searches with a search clause of (!(erisdeleted=y)).
   
    APAR:    IY78755    17025
    Symptom: ITIM loops while trying to search orphan accounts.
   
    APAR:    IY78846    16166
    Symptom: After submitting provisioning policy change (priority 1 was changed to priority 2).
             the Replace section of Data tab under "View Completed Requests" was showing a 
             value of 1 for priority. 
   
    APAR:    IY78847    16994
    Symptom: ACI filter expression only considers the first value of multi-valued attributes.
   
    APAR:    IY78848    17031
    Symptom: Custom report execution fails after upgrade from ITIM 4.5.1 to 4.6.
               
    APAR:    IY78849    17029
    Symptom: Get ClassNotFound exceptions when attempting to run Provisioning Policy Applications
             from ITIM 4.5.1.  Corrected API packaging in itim_api.jar in TIM 4.6.
   
    APAR:    IY78851    17037
    Symptom: Root Password of HP-UX 11i box is visible in trace.log.  ITDI adapter issue.
   
    APAR:    IY78852    17038
    Symptom: Suspending an LDAP account fails.  ITDI adapter issue
   
    APAR:    IY77960    17023
    Symptom: Fail to send notification E-mail by Work Order when multiple E-mail addresses are 
             registered in Person object.
   
    APAR:    IY77718    17006
    Symptom: The completion notfication fails witha NullPointerException whenever a Manual 
             operation, such as WorkOrder or Approval, is added to the changePassword 
             lifecycle operation.
   
    APAR:    IY79193    16943
    Symptom: The file, itim_server.jar, should not be required for the remote API 
             PersonMO.getData(..) to work.

    APAR:    IY79588    17089
    Symptom: Documentation on defining identity policies does not note that identity policies 
             are based on service definitions and not organizational containers.  For the 
             identity policies to be evaluated, they must be placed in the organization tree 
             at the same level or above the service they intend to govern.  The Infocenter
             will be updated to reflect this in a FUTURE Release of ITIM.
   
    APAR:    IY79589    17040
    Symptom: Documentation added in $ITIM_HOME/extensions for additional information that may be 
             used when working with the condition described by APAR IY78741, working with BINARY 
             attributes for user password values.
   
    APAR:    IY79591    17072
    Symptom: Provide Purge utility to purge audit and process database tables.
             We are shipping a utility that will delete old data from process and audit 
             related tables. This utility can be found in the directory -
             <ITIM_HOME>/bin/<platform>/DBPurge 
             The utility takes an integer argument and will purge all data related 
             to completed processes which are older than the specified number of days. 
             It will also delete all the data from other audit related tables that are 
             related to the deleted process. 

             For example, executing the following command will delete all completed 
             processes older then 2 days, for ITIM installed on Windows platform -
             <ITIM_HOME>\bin\win>DBPurge.bat 2
   
    APAR:    IY79592    17076
    Symptom: ClassNotFoundException thrown while trying to remove a service profile from database.
   
    APAR:    IY79692    16163
    Symptom: The user should not be allowed to import 2 identity policies with the same 
             specifications.  Prior to this fix, importing was successful and this was incorrect. 
             There should not be 2 identity policies with the same user class/services. If the 
             user manually creates 2 identity policies with the same specification, an error 
             message is given.  Import/export also needs to follow these rules.
   
    APAR:    IY79693    16843
    Symptom: Mapping and Unmapping of Account Profiles attributes not working properly for Ad-hoc 
             reporting.
   
    APAR:    IY79694    16854
    Symptom: Incremental schema synchronization not working properly for implicitly-mapped 
             attributes.
   
    APAR:    IY79695    16869
    Symptom: Problems with shell scripts for crystal reports.
   
    APAR:    IY79696    16871
    Symptom: Dormant Report not showing data in Oracle.
   
    APAR:    IY79697    16895
    Symptom: Crystal Configuration Script failing to map attributes for out-of-box reports, if they 
             are not present.
   
    APAR:    IY79699    16903
    Symptom: Unmapping "cn" attribute of Person entry causes data sync trouble.
   
    APAR:    IY79700    16948  
    Symptom: Certain Crystal Reports not showing PersonDN as the default user input (in Non-Admin).
   
    APAR:    IY79701    16949
    Symptom: Crystal version of suspended individual report not showing correct data.
   
    APAR:    IY79702    16981
    Symptom: Custom report using DN attribute of an entity, does not show correct data 
             after upgrading ITIM from 4.5.1 to 4.6.
             Documentation update:
             The only supported route of upgrade is 4.5.1 + FP50 + IF53 to 4.6. So , 

                1) If you have designed reports before applying IF 53, 
                   re-design them after applying IF 53. And then upgrade to 4.6.
                   Locate the custom reports which have used the "DN" attribute
                   in the filter section of the report.
                   For each such report do the following:
                        a. remove the filter from the custom report and save the
                           report.
                        b. Now open the same report and add the filter again and
                           save the report.
                2) Whatever new templates are designed after applying IF53 can 
                   be straightway upgraded to 4.6 .
                3) Any new templates designed at 4.6 will always work. 
                4) Report templates using policy tables can not be upgraded from 
                   4.5.1 setup to 4.6. Since there is substantial DB schema 
                   change for these reports. These updates will be updated in the 
                   ITIM 4.6 InfoCenter.
   
    APAR:    IY79703    17070
    Symptom: Exception when generating a report in BiDirectional Language function.
   
    APAR:    IY79704    17077
    Symptom: This is a performance enhancement.
             Request never completes when adding a service to an existing provisioning policy due 
             to CNTR0051E: WAS transaction timeout error.  This problem occurs when more than 200
             services already exist.
             
             In addition to installing this Interim fix, you must also change the 
             policy.message.size=25 in enrolepolicies.properties to policy.message.size=1.  
             It is also recommended to set the DB2_APP_CTL_HEAP_SZ to 2048 and to set the JVM 
             Maximum Heap Size to 1536, provided you have sufficient real memory to accommodate 
             these settings.
   
    APAR:    IY79707    17085
    Symptom: Unable to generate compliance alert, gets NullPointerException.
   
    APAR:    IY79772    17088
    Symptom: ITDI DSMLv2 Event Handler throws an exception if ITIM passes or is passed an 
             attribute name with an underscore via ITDI.
   
  Fixes in enroleagent.jar and ERMA libs.
   
    APAR:    IY79711    17014
    Symptom: When the password saved on the service form is not correct a reconciliation of the 
             service does not fail. The recon either remains in pending state or completes with 
             success.  The recon should complete with a status of failed.
   
    APAR:    IY79712    17015
    Symptom: Passwords appear in the cleartext in itim logs.
   
    APAR:    IY79713    17016
    Symptom: When user is suspended and restored the first time, the restore operation is successful. 
             If the user account is suspended again and a second restore is attempted, the operation 
             fails. 
   
    APAR:    IY79715    17017
    Symptom: FTP based agents periodically encounter process hangs or core dumps.
   
    APAR:    IY75246    16712
    Symptom: Under some conditions, LDAP upgrade fails during ITIM 4.5.1 TO ITIM 4.6 UPGRADE.
   
    APAR:    IY75251    16713
    Symptom: Under some conditions, DataBase upgrade fails during ITIM 4.5.1 TO ITIM 4.6 UPGRADE.   
   
    APAR:    IY76425    16913
    Symptom: Adding an ACI in the section, MyOrganization>ACI of the type SAP Account and 
             inserting the following filter (suggested from ITIM 4.6 documentation) : 

                (${service.erservicename}=SAP Service Test Name) 

             and specifying an itim group that should be impacted from this aci, the filter 
             does not work.
   
    APAR:    IY76868    16950
    Symptom: JavaDoc for SearchResults.size() method needs additional explanation.
    
             The following JavaDoc published for SearchResults.size() states:
               * Returns: 
               *      Total number of results returned.  If this cannot be determined
               *      then the result will be -1.
               * 
                         
             The above description is technically correct, although most common searches
             will return only 0 or -1 due to the underlying EnumeratedSearchResults 
             implementation used for SearchResults.   
             A "-1" return value means the result can not be determined.  The workaround 
             is to call toCollection() to determine the actual size.  However, this is a 
             significant performance consideration.
               This is true of the classes:
                 -- AccountSearch
                 -- PersonSearch 
                 -- ServiceSearch
                 -- DirectoryObjectSearch
                 -- RoleSearch
                 -- PrivilegeRuleSearch
                 -- SystemRoleSearch

             
             The following Search classes return the correct number of results since they use  
             the LDAPSearchResults implementation of SearchResults:
                -- AdminDomainSearch
                -- BusinessPartnerOrgSearch
                -- BusinessUnitSearch
                -- DynamicRoleSearch
                -- OrganizationalContainerSearch
                -- HostSelectionPolicySearch
                -- IdentityPolicySearch
                -- PasswordPolicySearch
                -- ProvisioningPolicySearch
                -- SystemUserSearch 
                -- CustomProcessSearch 
                -- AccountTable
                -- OrganizationSearch
                -- ServiceModel
                -- AdoptionPolicySearch
                -- JoinDirectiveSearch

    APAR:    IY77883    16819
    Symptom: SingleSignOn example uses wrong web.xml file.   
             While installing the SiteMinder singlesignon example from 
             \itim46\extensions\examples\singlesignon 
             you get a 404 error when you try to access the servlet.
   
    APAR:    IY77884    16904
    Symptom: No warning email sent to a user when using reverse password sync agent and 
             password sync fails on one resource. 
             The workflow examples have been changed to provide direction on how to use 
             password sync and return meaningful information to a user when a failure occurs.
 
    APAR:    IY77887    16956
    Symptom: When a Remote ITIM Application is secured by a WebSphere role, an exception 
             is encountered "javax.naming.NoPermissionException: NO_PERMISSION" 
             when attempting to make ITIM API calls. 
   
    APAR:    IY77888    16977
    Symptom: When creating a person, the date field is not displayed as expected.  After 
             entering required fields in the form and submitting, the following error is 
             displayed: "You are not authorized to perform this operation".  After clicking 
             'OK' to the error, the user is taken back to managed people and the person is 
             not created. Note that this fix is for Default-Date.
   
    APAR:    IY77889    16991
    Symptom: When a Remote ITIM Application is secured by a WebSphere role, an exception is 
             encountered 
                "javax.naming.NoPermissionException: 
                NO_PERMISSION" when attempting to make ITIM API calls. 
   
    APAR:    IY77899    16992
    Symptom: If one or more ACIs for same target are defined at an Organization or BU level, 
             with some target filter, only one of the ACIs will evaluate and the other ACIs 
             will be completely ignored.
   
    APAR:    IY77901    16993
    Symptom: Documentation for the self_care sample application needs to be added to the 
             examples documentation directory.
   
    APAR:    IY78065    16928
    Symptom: Remote ITIM Applications can not supply a proper LTPA authentication token when 
             WebSphere authentication realms are dissimilar between the remote application 
             server and the ITIM server. 
   
    APAR:    IY78395    16957
    Symptom: Remote ITIM Applications do not recover whenever ITIM is restarted and the web 
             applications must be manually restarted. 
    
    APAR:    IY74391    16688
    Symptom: Cannot use custom profiles after installing.
             Note - After applying this patch follow the steps as given below -
             1. Make sure to copy itim_api.jar, itim_server.jar and api_ejb.jar from:$WAS_HOME/
                installedApps/$MACHINE_NAME/enrole.ear directory, to $ITIM_HOME/lib  directory.
   
    APAR:    IY75058    16781
    Symptom: During an IDI data feed (with ITIM acting as DSMLv2 server) some "modify person" 
             requests hang (and show up in the "pending requests" list).
   
    APAR:    IY76000    16866
    Symptom: The presence of both MANDATORY and EXCLUDED enforcement on the same multivalued 
             attribute (coming from different provisioning policies) reduce the set of allowed 
             values to the MANDATORY ones only.
   
    APAR:    IY76116    16887
    Symptom: If you configure SSL between ITIM and IDS (LDAP), service profiles cannot be imported.
             Note: Please refer Readme.txt in IY76116.zip for more information.
   
    APAR:    IY77445    16838
    Symptom: Cannot run Crystal reports using Non-admin user. 
   
    APAR:    IY77446    16855
    Symptom: When using the IDI DSMLv2 handler to load data into ITIM and placing a person record 
             into a specific OU with over 5,000 sub-OUs, ITIM eventually crashes with "OutOfMemory"
             and "Unable to create thread" errors.
   
    APAR:    IY77447    16902
    Symptom: The "Disallow User Name (case insensitive)" will parse the CN attribute and 
             derive single character from attribute value that it will check in the password. 
   
    APAR:    IY77479    16802
    Symptom: The compliance alert detail screen displays the raw data instead of the resolved 
             display label.
   
    APAR:    IY77480    16794
    Symptom: If the "enforcement" on the original service (referred by the hosted service) is 
             changed to "correct", the accounts on hosted service gets deleted.

   
    APAR:    IY77481    16979
    Symptom: Under some conditions the ITIM server does not update MANDATORY attributes with the 
             new values, instead, it uses the old values.
             Note - Spaces and hyphens are ignored during comparison of attribute values with the
             Telephone Number syntax i.e. with OID as 1.3.6.1.4.1.1466.115.121.1.50.
   
    APAR:    IY77483    16967
    Symptom: The saproleservlet is not able to handle SAP role names containing characters 
             outside the US-ASCII character set (but included in the ISO 8859-1 one, such 
             as accented vowels).
   
    APAR:    IY77484    16968
    Symptom: OBJECT_NOT_FOUND exception during Person transfer with Select Business Unit 
             set to Root Organization.
   
    APAR:    IY77485    16978
    Symptom: ITIM Server logs show password in clear text for Password Synch.
   
    APAR:    IY77486    16980
    Symptom: The examples.api.ChangePassword returns a NullPointerException when attempting to 
             change the password of an orphaned account.
             Note - After applying this patch follow the steps as given below -
             1. Make sure to copy itim_api.jar, itim_server.jar and api_ejb.jar from:$WAS_HOME/
                installedApps/$CELL_NAME/enrole.ear directory, to $ITIM_HOME/lib  directory.
             
             
    APAR:    IY77487    16952
    Symptom: When trying to reset a user password on a config that has a "Password Rule" with 
             Required Characters value set to '(' or ')' or both and Disallow In Dictionary? set to true. An 
             invalid password exception is thrown.
   
    APAR:    IY77488    16808
    Symptom: New option provided in serviceability.sh tool to suppress information from LDAP.
                 Running "serviceability.sh no" will prevent the tool from retrieving any 
                 information from the directory server. Thi option applies to both the 
                 serviceability.sh and serviceability.cmd scripts.
    
    APAR:    IY77491    16924
    Symptom: Correct problems with the Adapter interface.
   
    APAR:    IY77169    16983
    Symptom: New Function: Bi-Directional Language Enablement. 
   
    APAR:    IY74180    16658
    Symptom: LDAP error code 32 during AD adapter 4.6 reconciliation. 
   
    APAR:    IY74325    16682
    Symptom: Need to be able to delete/remove service profiles that were imported and are no 
             longer needed.
             Note - After applying this patch follow the steps as given below -
             1. Copy itim_api.jar, itim_server.jar and api_ejb.jar from:
                $WAS_HOME/installedApps/$MACHINE_NAME/enrole.ear directory, to
                $ITIM_HOME/lib  directory.

             2. For operating system other than windows -
                Edit remove_service_profiles.sh in $ITIM_HOME/bin/unix directory, to
                include path of database driver in classpath.
                Example - If you are using DB2 as the database, add the following line -
                          CLASSPATH=$CLASSPATH:<Path of db2java.zip>

             3. For windows operating system -
                Edit remove_service_profiles.cmd in %ITIM_HOME%/bin/win directory, to
                include path of database driver in classpath. 
                Example - If you are using DB2 as the database, add the following line -
                          set CLASSPATH=%CLASSPATH%;<Path of db2java.zip>

             4. In a UNIX environment, source the DB2 environment before executing 
                remove_service_profiles.sh.
                E.G. . /home/db2inst1/sqllib/db2profile 
   
    APAR:    IY74455    16699
    Symptom: Valid ldap filters throw "invalid filter" errors in ITIM UI.
   
    APAR:    IY75100    16773
    Symptom: WAS Security enablement instructions in ITIM Installation Guide page 41 should 
             contain a reference to:
             'Creating J2C authentication data entries' action requirements.
             The ITIM Installation Guide will be updated to add an entry after the line:
             3. Configure the local OS user registry with these steps.
             The following will be added:
             4. Update J2C Authentication Data for alias itim_jms with a valid User Id and 
             password (see Appendix D - Creating J2C authentication data entries).
   
    APAR:    IY75576    16832
    Symptom: Incorrect workaround in ITIM 4.6 Release notes for LDAP version 3 filter example.
             The ITIM 4.6 Release notes page 36 shows the workaround using the same incorrect
             V3 search Filter.  The ITIM 4.6 Release notes page 36 will be corrected to show:
             
                ====================================================================      
                Problem: Using LDAP Version 3 filters causes inconsistent results 
                from an adapter, or may not be accepted by the adapter as input. 
                Using more than two operands for '&' and '|' operators in a 
                reconciliation filter might cause an error, unless they are modified 
                to have no more than two operands. For example, the following filter 
                causes a FilterException error:                                           
                                                                          
                (&(eruid=a*)(ersql2000defdatabase=i*)(ersql2000deflanguage-E*))           
                                                                          
                Workaround: Use filters such that '&' and '|' operators have no 
                more than two operands.     
                For example, the above filter can be modified as follows to get 
                the same results:
                (&(&(eruid=a*)(ersql2000defdatabase=i*))(ersql2000deflanguage-E*))  
                ====================================================================
   
    APAR:    IY75653    16548
    Symptom: Transaction timeouts during Report generation.
   
    APAR:    IY75654    16687
    Symptom: Get "java.lang.OutOfMemoryError" failure during large multi account password change. 
   
    APAR:    IY75655    16701
    Symptom: Account creation email notification should also be sent on success with warnings, 
             not just 100% success.

             Note - To resolve this issue, a new ITIM extension 'notifyNewAccount' has been 
             introduced. This extension takes owner, service and account entities as input 
             parameters and notifies the owner, with information related to the new account.
             This extension may be used when account creation is to be notified to the owner 
             even when the operation completes with warnings.

             Note that if property "enrole.workflow.notifynewaccount" is set to 'false' in
             enRole.properties, this extension will not send notification email to the owner.

             You will have to register this extension with ITIM as follows -
             1. Open workflowextensions.xml located in $ITIM_HOME\data directory using a 
                suitable text editor.
             2. Add the following entry in the file, before the closing </WORKFLOWEXTENSIONS>
                tag in the file:
                 <ACTIVITY ACTIVITYID="notifyNewAccount" LIMIT="600000">
                 <IMPLEMENTATION_TYPE>
                   <APPLICATION CLASS_NAME="com.ibm.itim.workflowextensions.AccountExtensions" METHOD_NAME="notifyNewAccount"/>
                 </IMPLEMENTATION_TYPE>
                 <PARAMETERS>
                  <IN_PARAMETERS PARAM_ID="owner" TYPE="Person"/>
                  <IN_PARAMETERS PARAM_ID="service" TYPE="Service"/>
                  <IN_PARAMETERS PARAM_ID="account" TYPE="Account"/>
                 </PARAMETERS>
                 <TRANSITION_RESTRICTION JOIN="XOR"/>
                 <SCRIPT EVENT="onComplete"><![CDATA[
                  WorkflowRuntimeContext.setProcessResult(WorkflowRuntimeContext.getActivityResult());
                  WorkflowRuntimeContext.setProcessResultDetail(WorkflowRuntimeContext.getActivityResultDetail());
                  ]]></SCRIPT>
                 </ACTIVITY>
             3. Save the file.

             ITIM will have to be restarted for the changes in this file, to get reflected.
             Please refer IY75655.pdf for more details.
   
    APAR:    IY75656    16702
    Symptom: Attribute selection in a search popup has a fixed width for the attribute labels.
             These need to have a variable width.
             Note - The fix has been provided for the default english language pack.

             Before applying this patch,take a backup of folder named <language code>
             located in directory : $WAS_HOME/installedApps/$MACHINE_NAME/enrole.ear/app_web.war.
             The <language code> is generally two letter word representing the language. 
             For example for English, the language code is 'en'.

             After applying the patch, restore the folder back to the same directory and
             perform the following steps - 
             1. Locate Styles.css in directory :
                $WAS_HOME/installedApps/$MACHINE_NAME/enrole.ear/app_web.war/<language code>
             2. Open Styles.css using a suitable text editor.
             3. Locate string "narrowPicklist" in this file.
             4. Change width attribute of this class to "auto" as follows -
                .narrowPicklist {
                   width: auto;
                }
             5. Save the file.
   
    APAR:    IY75658    16799
    Symptom: README DOC update.
             Account modification throws Authorization Exception even when 'write' permission is 
             granted to the ITIM user for the attributes that were actually modified.

             Solution:
             1. Navigate to User Interface Customization, through ITIM.
             2. Open the corresponding Account form template.
             3. For all attributes in the Account form defined of the type 'DropDown Box' or 
                'ListBox' control with custom values, check the option 'Use Blank Row', to 
                allow these attributes to have an empty value.
             4. Next, for all attributes in the Account form defined as a 'CheckBox' control, 
                change the form control to a 'DropDown Box' control with two custom values set 
                to "TRUE" and "FALSE" (Values should be in upper case) and also check the 
                option 'Use Blank Row', to allow these attributes to have an empty value.
             5. Save the form template and exit the form designer.

             Note - This workaround is applicable in case the Account form has some attributes 
             which are defined to have a default value in the form template, (For example dropdown 
             box controls with custom values, with 'Use Blank Row' unchecked) but are not present 
             in LDAP because the remote agent was unable to set a value of this attribute, during 
             account provisioning or modification, due to some reason. 
   
    APAR:    IY75659    16721
    Symptom: ITDI location field should be displayed as mandatory ( * ) 
   
    APAR:    IY75660    16751
    Symptom: Bulk loading ( ~ 60000) of POSIX Solaris Accounts gives error in ibmdi.log of 
             "ALNotFoundExceptioncom"
   
    APAR:    IY75661    16810
    Symptom: Get error 500 on UI when doing a manual provision a person on a Win Local Account with 
             User and Guests for local attr -- forcing a compliant alert screen on Guests value.
   
    APAR:    IY75731    16835
    Symptom: The examples file:
             $ITIM_HOME\extensions\examples\idi_integration\LDAPAccountManagement\AccountManagement.html
             is not accurate for UNIX systems.  
             Need to ensure people executing config_remote_servcies to first source the 
             DB2 environment in a UNIX environment.
             E.G. . /home/db2inst1/sqllib/db2profile 
   
    APAR:    IY75965    16820
    Symptom: Clicking the Submit button on "View|Modify Entitlement Detail" a second time during 
             processing results in "out of memory" error. 
   
    APAR:    IY73980    16641
    Symptom: Entering a double quote in Java script  for Entitlement causes standard view to 
             fail with 'JS Error'.
   
    APAR:    IY74422    16049
    Symptom: Identity Policy disregards owner when 'CHECK ALL SERVICES' and 'DON'T CHECK RECYCLE 
             BIN Selected.  This is a README Documentation update.  We are providing
             IY74422.zip to show users how to code a Fesiextension to allow this.  IY74422.zip 
             may be unzipped using the same procedure you use to unzip the Interim fix package.  
             See Applying the Patch: described below.
   
    APAR:    IY74428    16567
    Symptom: You may encounter slow performance or transaction timeouts during 
             report generation for certain reports against large data sets.
   
    APAR:    IY74443    16600
    Symptom: BeanNotReentrantException thrown when running on WAS 5.1.1.4 or 5.1.1.5.
   
    APAR:    IY74444    16549
    Symptom: After Search, viewing the adoption rule for a particular service produces 
             Illegal Argument Exception".
   
    APAR:    IY74502    16587
    Symptom: Improved email notification performance.
   
    APAR:    IY74503    16586
    Symptom: Out of Memory while doing a Report Synchronize.
   
    APAR:    IY74504    16653
    Symptom: AccountMO.selfClaim() was incorrectly left in the API javadoc.  It is now 
             removed.
   
    APAR:    IY74512    16044
    Symptom: Error message is not displayed in expected language.
   
    APAR:    IY74515    16224
    Symptom: Windows2000 Group Names not shown correctly in the account form when Filter 
             is removed.
   
    APAR:    IY74517    16496
    Symptom: One attribute fails to get included in the attributes list for RACFacct in the 
             ITIM Search interface: "Installation Data" (erracuinstdata).
             To address this issue, binary attributes are also included in the attributes list
             in the ITIM Search interface. The binary attributes are suffixed by an asterisk 
             mark '*', while displaying them in the attribute list. Only 'Contains' and 
             'Not contains' options are supported for searching with binary attributes.
             The 'Not contains' option for binary attributes is known to degrade search 
             performance and hence is not recommended.
   
    APAR:    IY74519    16497
    Symptom: DN is diaplayed in ListBox instead of 'cn'.
   
    APAR:    IY74525    16501
    Symptom: Users would like to have a way to disable the check box "create password".
    
             Edit the enRole.properties file to set the value you wish.    
             ############################################################# 
             ## Enable/Disable CreatePassword checkbox                     
             ## CreatePassword=true Checkbox will remain enabled           
             ## CreatePassword=false Checkbox will be disabled             
             #############################################################  
             enrole.CreatePassword=true                                     
             The value of true is the default and will allow the use of the 
             checkbox.
   
    APAR:    IY74526    16570
    Symptom: Wrong Attribute Mapping of entities when doing the following:
             1. Go to Configuration->entity->person(Org,BP Org,BP Person)->define mapping                                               
             2. select an attribute from Identity Manager attribute. Do not select any attribute 
             in Custom Ldap Attributes.                
             3. Click on the Map and then Unmap buttons.

   
    APAR:    IY74527    16579
    Symptom: ITIM uses an invalid search filter against a binary attribute, resulting 
             in an LDAP Error 92.
   
    APAR:    IY74528    16584
    Symptom: Read only fields not working properly on a customized person entry form.
   
    APAR:    IY74530    16405
    Symptom: Warning messges are not logged if the value of property policy.message.size, in 
             enrolepolicies.properties is 0 or negative.
   
    APAR:    IY74531    16610
    Symptom: Exception thrown in log when setting value to empty, for an attribute that does 
             not have entry in xforms and resource.def has the flag TRANSFORM_NAMES_AND_VALUES.
   
    APAR:    IY74532    16609
    Symptom: Performance issue with "User interface customization" and a high number of 
             service profiles.
   
    APAR:    IY74533    16631
    Symptom: 'RoleChangeNotAllowed' exception is not thrown if the logged-in ITIM user does not 
             have 'MODIFY' permission on ORG role entry and he tries to remove all roles from 
             a person.
   
    APAR:    IY74534    16643
    Symptom: Hide on Modify attribute becomes visible on 'View Data Screen' navigated from 
             Approve-Reject tab while switching tabs.
   
    APAR:    IY74535    16651
    Symptom: Missing CN attribute results in NullPointerException
   
    APAR:    IY74536    16620
    Symptom: Data feed of people with status set is always get overriden by ITIM 
             with ACTIVE status.
   
    APAR:    IY74537    16634
    Symptom: ITIM does not allow for automatic entitlement of "service type" target.
   
    APAR:    IY74538    16680
    Symptom: Viewing 3000+ orphan accounts on the services fails with CORBA_NO_MEMORY error.
   
    APAR:    IY74539    16665
    Symptom: An attribute label that contains "&" breaks display of ACI attribute permissions 
             page.
   
    APAR:    IY74540    16684
    Symptom: Duplicate accounts in RACF Recon. 
   
    APAR:    IY74542    16679
    Symptom: Data with "&" in single-valued Search Widget in Read-only mode causes xsl error.

Dependencies: ITIM 4.6 (This Fixpack cannot be applied to earlier releases)

Fixes superseded by this Fixpack: 4.6.0-TIV-TIM-FP0001, 4.6.0-TIV-TIM-FP0005, 
4.6.0-TIV-TIM-FP0008, 4.6.0-TIV-TIM-FP0014, 4.6.0-TIV-TIM-IF0015, 4.6.0-TIV-TIM-IF0016, 
4.6.0-TIV-TIM-IF0017, 4.6.0-TIV-TIM-IF0018, 4.6.0-TIV-TIM-IF0019, and 4.6.0-TIV-TIM-IF0020.

Database Changes: These are done only if the database is Oracle. The changes are required for 
                  IY84678 fix 

JMS (Java Messaging Service) Changes: NONE

LDAP Changes: NONE
              
OSDB Certification updates, ITIM Server now supports the following Operating systems and middleware:

New as of July 31, 2006:

SUSE Linux Enterprise Server 9.0 for zLinux 64 bit kernel (support as 31 bit implementation).

Previously tested environments:

HP-UX 11i

Solaris 10

Oracle 10g (certified running on Solaris 10)

Red Hat Enterprise Linux AS release 4 for Intel

Red Hat Enterprise Linux AS release 4 Update 1 for POWER

SUSE Linux Enterprise Server 9.0 for POWER

SUSE Linux Enterprise Server 8.0 for Intel  
SUSE Linux Enterprise Server 9.0 for Intel
NOTE *** You may need to contact the WebSphere Support Center for installation assistance to 
       install WebSphere AppServer on the SUSE platforms.


Patch Contents:
  - This README file
  - 4.6.0-TIV-TIM-AIX-WAS-FP0021.zip
  - 4.6.0-TIV-TIM-HPUX-WAS-FP0021.zip
  - 4.6.0-TIV-TIM-LNX-WAS-FP0021.zip
  - 4.6.0-TIV-TIM-PPC-WAS-FP0021.zip
  - 4.6.0-TIV-TIM-SOL-WAS-FP0021.zip
  - 4.6.0-TIV-TIM-WIN-WAS-FP0021.zip
  - IY74422.zip
  - IY75655.pdf
  - IY76116.zip
  - IY83641.zip

MD5 Checksums:
   
b80b823f896af679187447fb41906dfd  4.6.0-TIV-TIM-AIX-WAS-FP0021.zip
49f009286790bd3faf5eb1059561bf45  4.6.0-TIV-TIM-LNX-WAS-FP0021.zip
8aba4f0febf030efb7c737e37a7c3b44  4.6.0-TIV-TIM-ZLNX-WAS-FP0021.zip
1fb13f5e91eb180dad2cf9aef66533da  4.6.0-TIV-TIM-HPUX-WAS-FP0021.zip
98e3fc72c26e1b4951014a26e56a1bda  4.6.0-TIV-TIM-PPC-WAS-FP0021.zip
652f102c1854e1f178600c0da6771d3d  4.6.0-TIV-TIM-SOL-WAS-FP0021.zip
73d8589228a223e714cdad7fb9402ae5  4.6.0-TIV-TIM-WIN-WAS-FP0021.zip

5457ea0572eb1728930829efedaabe9e  IY74422.zip
145b949bba08b349c496deba74d1d3d9  IY75655.pdf
2dcef36148fdec40a5236137369b193f  IY76116.zip
ede73a3d0f856e5dbc7785c21f29189d  IY83641.zip

d78dba4c2b7cb9e350b19c752992c00a  instaix_was_ITIM_5778.bin 
4d8b2b3c86bd7e3e96f5a7bcef94e3ca  instlinux_was_ITIM_5778.bin
d09e6194a170b1404f90288eb3634c32  instzlinux_was_ITIM_5778.bin
790c4fb5749b04c9ba06b75b3bdad670  insthpux_was_ITIM_5778.bin
0509383c432c67d80c9ee900fe70fb94  instppc_was_ITIM_5778.bin
171d03571ef5065191e4fd138935ec01  instsolaris_was_ITIM_5778.bin
660b613ddda78b79d711ea7f54978c34  instwin_was_ITIM_5778.exe

 
Applying the Patch:  

NOTE: *************************************************************************       
    Please backup any configuration files you modified after installation such as xml or 
    properties files.  It is recommended that you save all files in the $ITIM_HOME/data 
    directory if you have made modifications/customizations.  These files may be replaced 
    during the UPGRADE process.
NOTE: *************************************************************************       
    IF YOU ARE USING JAVA 2 SECURITY:
    Backup up your was.policy file to a temporary holding directory.  During 
    the fix application you will be re-deploying enrole.ear, which removes the
    $WAS_HOME/AppServer/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
    directory and its contents. During the deployment, the was.policy is not 
    replaced and will need to be copied back during the COMMON TASKS section 
    of this document.  On a Cluster this needs to be done on the NDM as well.
    $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
NOTE: *************************************************************************       
    IF YOU HAVE MIGRATED FROM ITIM 4.5.1 to ITIM 4.6        
    If your TIM V4.6 system is migrated from V4.5.1, it is necessary to copy
    the jsafe.jar and log4j.jar files from the:
    $ITIM_HOME/lib 
    directory into:
    $WAS_HOME/installedApps/$CELL_NAME/enRole.ear directory  
    You must always copy these 2 files back after installing an ITIM Interim Fix
    or Fixpack.
    The jsafe.jar file is no longer used in ITIM 4.6.0, since the encryption
    is changed in 4.6.0, but the jsafe.jar file is needed to be able to
    encrypt/un-encrypt the existing 4.5.1 data in LDAP.
NOTE: *************************************************************************       
    IF YOU HAVE INSTALLED A CUSTOM LOGO:
    The logo is copied to:
    $WAS_HOME/installedApps/<machine_name>/enRole.ear/app_web.war/images
    The Fixpack Install/Upgrade removes the enRole.ear and all subdirectories.  To make it
    easier to restore the custom logo, copy it to a backup directory of your choosing to 
    facilitate copying it back at the proper time.
    The ui.properties is preserved during a Fixpack install so this will not need to be updated
    again.  There are 2 choices to restoring the custom logo file.
    1. During the Fixpack Install/Upgrade, a utility called runConfig will execute and present 
       a small panel with several items that you may modify, including the custom logo.  This 
       panel has a TAB called UI and you can select this and see that your custom logo name
       should be present.  At this time, you may copy the custom logo from the backup 
       directory where you saved it to:
       $WAS_HOME/installedApps/<machine_name>/enRole.ear/app_web.war/images
       Then continue with the Install/Upgrade by selecting the OK button.
    2. If you wish, you may wait until the Install/Upgrade completes and then copy the
       custom logo to:
       $WAS_HOME/installedApps/<machine_name>/enRole.ear/app_web.war/images
       You may then manually execute runConfig from $ITIM_HOME/bin .  Select the UI tab to 
       verify the custom logo name and then select the OK button.
NOTE: *************************************************************************       
    IF YOU HAVE INSTALLED A LANGUAGE PACK:
    1. The FPxx number shown will not be updated to the current FPxx number
    due to current limitations in the build and install process.  Please 
    check the Build number for verification of an upgrade to the fixpack.
    The build number is the suffix number of the install binary 
    eg. instaix_was_ITIM_576n.bin
    The 576n is the build number and will be seen in many ITIM UI panels.
    2. Symptom - Fixpacks partially overwrite Language Pack installation.
       Note - Before Fixpack installation, take a back-up of the following
       files/folder related to the language pack, located in the directory:
              $WAS_HOME\installedApps\$MACHINE_NAME\enRole.ear\app_web.war
                - AppletErrorMessages_<language code>.properties
                - AppletLabels_<language code>.properties
                - AppletMessages_<language code>.properties
                - The folder along with it's contents by the name as <language code>.
                        
    The <language code> is generally a two letter word representing the language. 
    For example for English, the language code is 'en'.
        
    After Fixpack installation, restore all the language pack related files and folder, 
    that were backed up, to their respective locations in the directory: 
    $WAS_HOME\installedApps\$MACHINE_NAME\enRole.ear\app_web.war
        
    Note that for WAS Cluster installation, the same steps will have to be followed on 
    each of the nodes. This procedure is needed only on the cluster member, not on the 
    Deployment Manager node.
NOTE: *************************************************************************       
        End of notes.
        
    1) Copy the appropriate Platform Fixpack zip file to a temporary staging directory
       and use the following command as an example to unzip it.
    
        For any version
          # jar xvf 4.6.0-TIV-TIM-nnnn-aaa-FP0021.zip  (where nnnn is the platform code and
                                                  aaa is the AppServer type (WAS or WL)

       NOTE:  You may also use any unzip equivalent to unpack the zip file.
              Back-level versions of jar or FastJar as well as some versions
              of Pkzip may report errors. Use the jar executable at version 1.3.1 
              or another zip utility to uncompress the file.
       
    2) Upgrade Installations
    For Single Server deployments, you do not need to stop the WebSphere AppServer.
    For Cluster deployments, ensure the cluster is completely up and functional.
    Run the appropriate binary from the staging location.
    For example:
         instwin_was_ITIM_5778.exe
    When prompted, select the UPGRADE option and follow the directions on the panels.
    
NOTE ***    
              
    3) Initial Installations
    Initial installation using this package can only be performed on WebSphere platforms. 
    If you are planning on doing new installations on WebSphere using this package, then 
    you may wish to review the Installation Guide.  This Fixpack provides Installation 
    support for IBM WebSphere.  However, ITIM will NOT install the IBM WebSphere product 
    with this Fixpack.  
    
NOTE ***  
    If you stop the INSTALL/UPGRADE process and then restart it, Default config data 
    is inserted.
    If the fix pack installation is aborted before system configuration (runConfig) is complete, 
    your system property settings are restored to default values - your pre-fix-pack-installation 
    settings are lost - when you run the fix pack installer again.  This is usually ONLY a concern
    when you are doing an UPGRADE.  To correct the system property settings, restore the 
    <ITIM_HOME>/data directory with the pre-fix-pack-installation backup (per above instructions)
    before you run the Fixpack installer again.
    
NOTE ***  
    Additional NOTE:
    If you are using the JAVA 2 Security, replace the was.policy file you saved
    earlier.  Copy it back to:
    $WAS_HOME/AppServer/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
    For Cluster in the NDM:
    $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
    Where $CELL_NAME is either the $MACHINE_NAME or $CLUSTER_NAME.
    For additional information on using JAVA 2 Security with ITIM, please review the ITIM
    Installation Guide, Appendix C.
    
NOTE ***  
End of Server Upgrade instructions.

Instructions for enroleagent.jar fixes:
    
    Additional instructions for APAR IY80441; edit enrole.properties file and add following line
      
       com.ibm.daml.jndi.DAMLContext.CACERT_DISABLE_BASIC_CONSTRAINT_CHECK=false
      
       true - Basic constraints will not be checked while validating the V3 certificate.
       false - Basic constraints will be checked while validating the V3 certificate.
      
    The default is false.
       
    If this value is not present or invalid value is specified, enroleagent will perform basic constraint check. 
    The enrole.properties file is in <ITIM_HOME>/data/ directory
       
END of Instructions for enroleagent.jar

ERMA Library instructions:

No additional steps are need for Windows systems.  However, you may wish to review the log file:
    <ITIM_HOME>\install_logs\itim_installer_debug.txt 
    To make sure the files were copied, without errors, from:
    <ITIM_HOME>\lib\nt to 
    <SYSTEM_ROOT>\system32\ 
        
    AIX, SOLARIS, HPUX and LINUX(x86) DEPLOYMENT INSTRUCTIONS:
    
    Verify that in the startServer.sh startup script PROTOCOL_DIR environment variable 
    is set to <ITIM_HOME>/lib/<platform>.
    Add this environment variable if not present. See the example below
    
    Please use the following instructions to deploy the ERMA Libraries on all supported 
    AIX, Solaris, hpux and Linux systems:
      1. Stop the ITIM Server (See instructions in the ITIM Installation Guide).
      
      2. Ensure the libraries are copied to <ITIM_HOME>/lib/<platform> directory.
      
      3. Run link commands from createlinks.sh (located at <ITIM_HOME>/lib/<platform>) 
         on command line one at a time for all shared library files.
      
      4. Set the shared library environment variable (see note) to specify the path of 
         shared libraries. The environment variable should point to the directory where 
         all the above files exist and it should also include /usr/lib directory.

         e.g. type following command on command line for Solaris:
         export LD_LIBRARY_PATH=<ITIM_HOME>/lib/sun:/usr/lib:$LD_LIBRARY_PATH 
         LD_LIBRARY_PATH is name of the shared library environment variable
         for Solaris and 'sun' is the directory name which contains ERMA 
         libraries for Solaris. 
         See note below, for environment variable names on other operating system, 
         and also the name of the directories containing the ERMA libraries.

      5. Verify that the shared library environment variable value contains all 
         required files by executing the ldd command on both libErmApi.so and 
         libErmJni2.so.
              e.g. type following command on command line
              ldd libErmApi.so
              ldd ErmApiFtp.so
              If any files are listed as "not found", add the path to those 
              files in the LD_LIBRARY_PATH.

      6. Once all the shared libraries are in path, update the WebSphere Start Script
         to include this new LD_LIBRARY_PATH and PROTOCOL_DIR if it is not already updated.
         
         The following is a display of a portion of the startServer.sh startup 
         script on Solaris opened in the editor.(vi $WAS_HOME/AppServer/bin/startServer.sh)
         This is an example of how to set the LD_LIBRARY_PATH and PROTOCOL_DIR paths.
         
         <...SEVERAL lines omitted...>
         SunOS)
             LD_LIBRARY_PATH="$WAS_LIBPATH":$LD_LIBRARY_PATH
             LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ITIM_HOME/lib/sun
             export LD_LIBRARY_PATH ;;
         
             # Required for agent communication
             PROTOCOL_DIR=$ITIM_HOME/lib/sun
             export PROTOCOL_DIR ;;
        <...remainder of script omitted...>
        
        
        Alternatively you can use the following sample script to make the ERMA LIBS work for 
        the FTP based agents. Use this example to start WebSphere, just uncomment the 
        areas needed:
        
            #!/bin/sh
            
            export LD_LIBRARY_PATH=<ITIM_HOME>/lib/<platform>:${LD_LIBRARY_PATH}
            export PROTOCOL_DIR=<ITIM_HOME>/lib/<platform>
            #<WAS_HOME>/AppServer/bin/startServer.sh server1
            #<HTTP_SERVER_HOME>/bin/apachectl start
            
         
      7. Start the ITIM server (See instructions in the ITIM Installation Guide).

      NOTE: The shared library environment variable on AIX is LIBPATH and on
            HPUX is SHLIB_PATH instead of LD_LIBRARY_PATH. LD_LIBRARY_PATH is
            the shared library environment variable name for Solaris and Linux.
            The name of the directory in the folder <ITIM_HOME>/lib, containing
            the ERMA libraries are as follows -
            'aix'    for ITIM installed on AIX , 
            'sun'    for ITIM on Solaris, 
            'hpux11' for ITIM on HPUX and 
            'linux'  for ITIM on Linux operating system on x86 platform.

    *** NOTE ***
    In a cluster deployment, these steps must be done for each node of the cluster. 
        Alternatively you can execute the following steps.

        1. Navigate to Application Servers > <SERVER_NAME> > Process Definition
        2. Choose Environment Entries from the Additional Properties.  
        3. Add LD_LIBRARY_PATH [or LIBPATH or SHLIB_PATH based on your platform] 
           and PROTOCOL_DIR environment entries here with the correct values.
        4. Perform these steps for each server that is a part of the cluster.
        5. Restart the cluster.
        
        End of WAS Cluster info.

    ERMA Library Files Replaced or Added:

    For Aix:
    Replaced file:
     <ITIM_HOME>/lib/aix/ErmApiFtp.so
    
    For Hpux:
    Replaced file:
     <ITIM_HOME>/lib/hpux11/ErmApiFtp.so

    For Linux:
    Replaced file:
     <ITIM_HOME>/lib/linux/ErmApiFtp.so
     
    For Solaris:
    Replaced file:
     <ITIM_HOME>/lib/sun/ErmApiFtp.so
    

    
End of ERMA Library instructions.

End of Readme
