File:   4.6.0-TIV-TIM-IF0039.README For ITIM 4.6.0 using IBM WebSphere Application Server.
Date:   March 09, 2007

Interim fix 4.6.0-TIV-TIM-IF0039 for APARs IY94415, IY94616, IY94773, IY95026, IY95030, IY95251
IY95445, and IY95822.
Components:
        enrole.ear for all supported platforms for WebSphere Application Server.
        schema.dsml for all supported platforms for WebSphere Application Server.
        IY93034.txt for all supported platforms for WebSphere Application Server.
        ChangePasswordServlet.java for all supported platforms for WebSphere Application Server.
        ForgotPasswordServlet.java for all supported platforms for WebSphere Application Server.
        logonServlet.java for all supported platforms for WebSphere Application Server.
        provisionOrderedAccounts.ldif for all supported platforms for WebSphere Application Server.

General Description:

This Interim fix provides fixes for APARs IY94415, IY94616, IY94773, IY95026, IY95030, IY95251
IY95445, and IY95822.  

   Problems Fixed:

    APAR:    IY94415
    Symptom: Large unsorted LDAP searches results in OutOfMemory.
    Note **: You must follow guidelines when using SearchMO API to retrieve large resultsets -
             1. If you need the resultsets returned by SearchMO to be sorted, i.e. if you specify
                a sort attribute on SearchMO object, then for large results, it is highly recommended
                to set the property 'enrole.search.sss.enable' in <ITIM_HOME>/data/enRole.properties 
                to 'true' and also ensure that directory server used by ITIM supports server side 
                sorting.

             2. Do not use 'getResults()' function on SearchResultsMO, to get all the search 
                results in one call, instead fetch them page by page.
                Example usage in API client program -
                <snip>

                     SearchMO searchMO = new SearchMO(platform, subject);
                     /* Set the parameters for search here */

                     SearchResultsMO resultsMO = searchMO.execute();
                     int pageNumber = 0;                           // starting page
                     Collection apiResults = new ArrayList();
                     Collection page = resultsMO.getPage(++pageNumber); // get the first page
                     while( page != null && !page.isEmpty() ) {
                        apiResults.addAll(page);
                        page = resultsMO.getPage(++pageNumber);   // get the next page
                     }
                     // At the end of the above while loop, the 'apiResults' collection
                     // will have all the search results.

                </snip>

    APAR:    IY94616
    Symptom: Unable to import exported workflow when in the approval node participant is defined with a 
             dynamic organizational role.

    APAR:    IY94773
    Symptom: Hosted ITIM Account not provisioned automatically for a person even when the hosted account
             entitlement type is 'Automatic' and the person satisfies the policy membership, if the
             person is already an owner of another ITIM account governed by the default ITIM service.

    APAR:    IY95026
    Symptom: When using Oracle 10g JDBC Driver, account provisioning causes Oracle error :
              Error: 24816
              SQL State: 99999

    APAR:    IY95030
    Symptom: When trying to use the viewer.sh script we ship with ITIM to view the msg.log file, it fails with a
             parsing exception because the log file is not valid XML. This happens when there are connection
             error messages in the log file.
    Note:    This fix only prevents future occurrences of connection error messages being logged incorrectly.

    APAR:    IY95251
    Symptom: The ITIM API call, personMO.getRoles() method,  doesn't work as expected per the javadoc.
    Note:    After this fix, PersonMO.getRoles() will throw AuthorizationException under the following 
             conditions -
             1.  The logged-in user does not have 'Read' attribute permission granted on the role attribute
                 of the person.
             2.  The logged-in user does not have 'Search' operation permission granted on any of the roles
                 assigned to the person.

    APAR:    IY95445        
    Symptom: When the ITIM server is protected behind a TAM Webseal junction, the report output cannot be viewed, 
             because the the ITIM report function uses Absolute URLs.  ITIM should be using Relative URLs.

    APAR:    IY95822    22337
    Symptom: SearchResults not closed while enforcing imported dynamic role.

   Old Problems Fixed:

    APAR:    IY93018
    Symptom: ReportManagerBean code does not respect the enrole.ui.report.maxRecordsInReport setting when 
             generating CSV formatted reports.  An OutOfMemory exception may result when trying to allocate 
             a 20+mb StringBuffer as part of a CSV report.
    Note:    The property 'enrole.ui.report.maxRecordsInReport' is only applicable for PDF reports.
             Execute the additional steps listed in step 8 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY94311
    Symptom: An entitlement workflow is reset when someone clicks on "Provisioning Parameter List", then 
             clicks cancel.
    Note:    After applying this Interim Fix, it is recommended that the user do a 
             hard-refresh (Ctrl+F5) on the browser window, so as to enforce the new 
             version of java script files immediately.

    APAR:    IY94313
    Symptom: A 'search query UI' returns results for all services when there are 2 Oracle services and they 
             attempt to search for roles using the search query UI (checkbox on the account form attribute 
             in the form customization).  The results include roles from both Oracle services.
    Note:    This APAR removes the limitation of a SearchFilter control where the 'Objectclass' field 
             eliminates any objectclasses extending the specified objectclass, from the search.

    APAR:    IY94681
    Symptom: The startIncrementalSynchronizer fails if interval is skipped.  The command 
             "& startIncrementalSynchronizer" does not run successfully in background using nohup.
    Note:    Execute the additional steps listed in step 9 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY95033
    Symptom: DOCUMENTATION UPDATE:
             The ITIM InfoCenter needs to be updated with the following correction.
             ITIM 4.6.0 documentation references 'reminderCtx' when it should be 'Reminder'.
             To reference the 'To Do' item reminder object in the JavaScript snippets contained 
             in e-mail reminders, use the relevant data key 'Reminder' instead of 'reminderCtx'.

    APAR:    IY95477    22016
    Symptom: WorkflowAssignmentMO.getPotentialOwners throws exception if one of the potential owners has 
             been removed from the system.   

    APAR:    IY95478    22017
    Symptom: Password Policy evaluation does not detect conflicts between Restricted characters and required 
             characters.  If you have a password policy that requires the letter A and another password policy 
             that disallows the letter A, then when these password policies are combined the server should detect a 
             password rule conflict.

    APAR:    IY93494
    Symptom: Problem occurs when using automatic provisioning if services have prerequisites.
             When provisioning three services, if the provisioning the second service fails,
             the provisioning of the third service doesn't begin.
    Note:    Execute the additional steps listed in step 7 in the COMMON TASKS section at the 
             end of the README. Additional file provisionOrderedAccounts.ldif is provided.

    APAR:    IY93566
    Symptom: Documentation Update:
             LdapUpgrade fails with error 80 when ESSO integration is present 
             LdapUpgrade will fail with "Error in loading schema - [LDAP: error code 80 - Other]" when 
             applying an ITIM Fixpack if the TAM-ESSO (Tivoli Access Manager for Enterprise Single Sign-On) 
             Provisioning Adapter has been integrated into ITIM.  The NamingException should be logged in 
             the ITIM_HOME/install_logs/ldapUpgrade.stdout.  The process of TAM-ESSO integration introduces 
             new attributes into ITIM system object classes erAccountItem and erServiceItem.  Currently, a 
             manual procedure after applying an ITIM Fixpack is required to resolve this error due to the 
             change to the ITIM schema.
    Note:    The user should perform the following process to resolve the error.

             1. Click the "OK" button when the "Error in loading schema" message is prompted.

             2. After the Fixpack application is done, update the ITIM_HOME/config/ldap/er-schema.dsml file 
                by modifying ITIM object classes, erAccountItem and erServiceItem.  
             Following the  <object-identifier>1.3.6.1.4.1.6054.1.2.2</object-identifier> of erAccountItem, 
             add the entries below:

                <attribute ref="vgoAdminID" required="false" />
                <attribute ref="vgoAdminPWD" required="false" />
                <attribute ref="vgoApplicationDescription" required="false" />
                <attribute ref="vgoApplicationID" required="false" />
                <attribute ref="vgoApplicationPWD" required="false" />
                <attribute ref="vgoCredAttribute1" required="false" />
                <attribute ref="vgoCredAttribute2" required="false" />
                <attribute ref="vgoSSOUserID" required="false" />

             Following the <object-identifier>1.3.6.1.4.1.6054.1.2.6</object-identifier> of erServiceItem, 
             add the entries below:

                <attribute ref="vgoApplicationIDMeta" required="false" />
                <attribute ref="vgoSSOUserIDMeta" required="false" />
                <attribute ref="vgoApplicationDescriptionMeta" required="false"/>
                <attribute ref="vgoCredAttribute1Meta" required="false" />
                <attribute ref="vgoCredAttribute2Meta" required="false" />
                <attribute ref="vgoApplicationUserIDMeta" required="false" />

             3. Run ITIM_HOME/bin/ldapUpgrade.

    APAR:    IY93654
    Symptom: ITIM allows delegating time in past.

    APAR:    IY93940
    Symptom: Filtered search on ACI doesn't work when person search is done.

    APAR:    IY93986
    Symptom: Non-administrative ITIM user is allowed to orphan their accounts.
    Note:    As part of this fix if accounts selected to be orphaned are already orphaned then 
             an error message displayed for the English language pack is :
               "CTGIMI015I Accounts with an owner cannot be made orphan accounts. One or more
                of the selected accounts have an owner."
             The correct error message is :
               "CTGIMI015I Accounts without an owner cannot be made orphan accounts. One or more
                of the selected accounts do not have an owner."
             This will be corrected in a language pack which will be addressed in a Future Release of ITIM.

    APAR:    IY94401
    Symptom: ITIM does not send an email to the user when the agent is down during the 
             first attempt.
    Note:    Password notification of accounts for add, restore and change password operations 
             will take effect only for requests fired, after this fix was applied.

    APAR:    IY94425
    Symptom: EJB user/password that is set in runConfig should be set J2C Authentication data entry of 
             "itim_jms". The ITIM 4.6 Installation Guide, Appendix D., Table 13 needs to be changed to 
             reflect the following corrections:
             
             Field                      Value
             --------------------------------------------------------------------------------------------
             Alias                      itim_jms
             User ID                    Enter either the ITIM EJB userid, by default the WebSphere
                                        administrator ID, usually wasadmin, when WebSphere
                                        global security is on, or enter an empty field  when WebSphere
                                        global security is off.
             Password                   Enter a password for either the ITIM EJB userid  when WebSPhere 
                                        global security is on, or enter an empty field when WebSPhere 
                                        global security is off.  
                                        Please note that this password is limited to 12 characters by the 
                                        WebSphere AppServer.
             Description                JMS J2C authentication alias.

             Please also note that in Chapter 7, under the Security Tab section, the EJB userid password 
             referenced here is the same password discussed above and is restricted to 12 characters.

             This information will be updated in a future release ITIM Installation Guide if applicable. 

    APAR:    IY94471
    Symptom: Multi-valued attributes are not being handled correctly.
             If one of the values supplied to the adapter during add/modify fails, the ITIM ITDI component 
             fails to remove the ITIM LDAP object. 

    APAR:    IY94978    21759
    Symptom: The API WorkflowProcessEntity.getProcessContext() method always throws 
             "UnsupportedOperationException" exception.

    APAR:    IY94979    21801
    Symptom: When submitting a request to create a person in ITIM when the person's name contains 
             a large number of extended ASCII characters, the request will fail to get created in 
             the ITIM database.

    APAR:    IY94980    22053
    Symptom: The password sync servlet doesn't correctly handle passwords including non-ascii characters.
             The non-ascii characters get corrupted.

    APAR:    IY94984    21177
    Symptom: NEW FUNCTION
             Support new line character while displaying description on RFI screen.

    APAR:    IY94985    21186
    Symptom: In the SearchFilter control the "Objectclass" field is not honored correctly. 
             The Objectclass has to be explicitly specified in the filter.
    Note:    The 'Objectclass' field of a SearchFilter control eliminates any objectclasses
             extending the specified objectclass from the search. So to consider an 
             objectclass and all it's subclasses, it should be specified in the 
             'Filter' field, by appending it to the existing filter and leaving the 
             'Objectclass' field of a SearchFilter control blank.

    APAR:    IY94986    22100
    Symptom: ProvisioningPolicySearch and OrganizationalContainerSearch searchByFilter 
             leak LDAP connections.

    APAR:    IY94987    22112
    Symptom: NEW FUNCTION
             Added internal logging additions to enhance debugging. 

    APAR:    IY94988    22108
    Symptom: Introduction of <AssignmentID/> tag in Approval, RFI and WorkOrder nodes to
             retrieve the assignment id.

    APAR:    IY94989    22111
    Symptom: Custom form validation does not take into account LDAP attribute syntax 
             constraints.

    APAR:    IY93131
    Symptom: ITIM API call WorkflowProcessQuery.execute() does not return SUBJECT_PROFILE and
             SUBJECT_SERVICE in the result set.

    APAR:    IY93204
    Symptom: OutOfMemory heap dumps in ITIM UI due to invalid logging.

    APAR:    IY93306
    Symptom: When running an out-of-the-box ITIM report, such as "Account Operations", the report 
             screen has date fields labeled as "Start Date" and "End Date". But the Custom 
             report screen date fields do not have these labels and do not specify the operator
             configured.

    APAR:    IY93314
    Symptom: Unable to remove manager value during ITDI datafeed.

    APAR:    IY93316
    Symptom: Problem occurs when ITIM user tries to login using ITIM UI and enters incorrect password.
             ITIM UI will throw the following message: "CTGIMM010E The value entered for the password 
             is incorrect." When the same login attempt is made from Self-Care App UI (also with 
             incorrect password) then the following message is displayed: "Sign on failed. Please 
             try again."

    APAR:    IY93317
    Symptom: Problem occurs when ITIM user tries to retrieve forgotten password using Self-Care 
             App UI but enters wrong answer to the challenge response question. In that case correct
             error message is displayed in ITIM UI and Self-Care App UI but the incorrect error 
             message is thrown to the SystemOut.log.

    APAR:    IY93332
    Symptom: Problem occurs when trying to change the password for a nonexistent user via self_care 
             app UI. When user tries to change the password via self_care app UI and enters incorrect 
             value for user name then no error message is displayed to the UI stating that incorrect 
             user password has been entered.

    APAR:    IY93336
    Symptom: When user tries to change his password via self_care app UI and enters incorrect value 
             for the old password then there is no error message displayed in self_care app UI or 
             SystemOut.log stating that incorrect password has been entered.

    APAR:    IY93350
    Symptom: The KEY_TODO message, "CJL0004E Message key KEY_TODO was not found, is displayed, but no 
             reason is given for the failure. e.g. (password policy check failed).

    APAR:    IY93994
    Symptom: AE FIX COMPLETION for APAR IY91042
             When attempting to run an Individual Account report for a specific user, the report 
             generation fails with arrayindexoutofbounds error.

    APAR:    IY93995
    Symptom: AE FIX COMPLETION for APAR IY85551
             The ACI that allowed you to display Business Partner Persons in the OU structure stopped 
             working, When you have defined two ACIs to allow ITIM group members to view Business 
             Partner Persons under a specific OU. The First ACI allows ITIM Group to search OU structure.
             The Second ACI allows you to view Business Partner Persons under specific OU. After 
             installing a fix with APAR IY85551 the Business Partner Persons are not shown in the OU 
             when logged in as one of ITIM group members.

    APAR:    IY94096    21185
    Symptom: Error restoring ITIM Account during HR Feed when using automated workflow.

    APAR:    IY94208    21188
    Symptom: Correct internal API logic to work properly if the application calling the API is running in the same WebSphere server 
             instance as the ITIM application.

    APAR:    IY94209    21190
    Symptom: Changed internal API logic to enhance stability.

    APAR:    IY94210    21243
    Symptom: Changed internal API logic to enhance stability.

    APAR:    IY94211    21862
    Symptom: Changed internal API logic to enhance stability.

    APAR:    IY94212    21864
    Symptom: NEW FUNCTION
             Enhancement: Code update to always return Subject profile and Subject service 
             instead of requiring the 'returnAllFields' boolean parameter to be 'true', which
             is passed to the API - WorkflowProcessQuery.execute(WorkflowQueryStatement, boolean).

    APAR:    IY92530
    Symptom: Setting UID in enRole.properties password.attributes parameter breaks DSML feed.

    APAR:    IY92538
    Symptom: Using ServiceManager.getServices() with a wildcard (*) returns a ServiceEntity, 
             rather than a Collection of ServiceMO's. 

    APAR:    IY92688
    Symptom: CTGIMD030E The syntax of the uid DN is not valid.
             JNDI update is not working when the link criteria attribute contains a "+" sign. 
             ITIM can locate the entry, but would not update it.

    APAR:    IY92757
    Symptom: Custom Identity Policy using PersonSearch() generates NullPointerExceptions when 
             evaluated.
 
    APAR:    IY92883
    Symptom: Placement Rule cannot handle value with comma.
    Note:    If the container name contains special character COMMA (e.g. ou=IBM,Inc) then it needs 
             to be escaped in the data source from which data is read. For example, for IDI feed from 
             the CSV file ou=IBM,Inc should be escaped as ou=IBM\,Inc in the CSV file.

    APAR:    IY92993
    Symptom: Ordered Deprovision is run in spite that "Service Prerequisite" isn't set to service.

    APAR:    IY93034
    Symptom: ITIM does not provide a way to aggregate XHTML bodies in the Aggregate XHTML template 
             and have the original XHTML body processed correctly.
    Note:    Execute the additional steps listed in step 3 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY93104
    Symptom: NullPointerException when Stopping a provisioning policy simulation.

    APAR:    IY93117
    Symptom: If the person object being updated already has the same dn value in the manager 
             attribute, ITDI still does an update. 
    Note:    Execute the additional steps listed in step 4 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY93119
    Symptom: 'User List' tab of dynamic role only displays users in root organization. 

    APAR:    IY93269
    Symptom: The 'ercomment' attribute reports errors because a duplicate insertion occurs, 
             once in the Adapter profiles, and once in ITIM.
    Note:    Execute the additional steps listed in step 5 in the COMMON TASKS section at the 
             end of the README.

    APAR:    IY93292
    Symptom: After installing ITIM Fixpack 4.6.0-TIV-TIM-FP0033, when you search Primary Group 
             for a specific Service Context, you get multiple groups returned for all services, 
             instead of just the one you should get.

    APAR:    IY93360    21175
    Symptom: Read-only checkbox lacking attribute value generates extraneous logging.
 
    APAR:    IY93362    21198
    Symptom: ITIM Front-End Account Operations workflows hangs.
 
    APAR:    IY93426    19267
    Symptom: Some Attributes are not displayed in RFI Activity for ITIM.

    APAR:    IY93428    20876
    Symptom: While searching for provisioning policy, if we go to Entitlement tab and search for 
             workflow, ITIM shows incorrect list of workflows. 

    APAR:    IY93429    21163
    Symptom: Add new internal flags.

    APAR:    IY93430    21191
    Symptom: When starting enrole application using WAS following warning is logged in SystemOut.log
             WARNING - Unable to bind, enroleejb.ReconManagerHome: enroleejb.ReconManagerHome. 
             Original exception : org.omg.CosNaming.NamingContextPackage.AlreadyBound: 
             IDL:omg.org/CosNaming/NamingContext/AlreadyBound:1.0

    APAR:    IY93514    21257
    Symptom: LDAPSearchResult is not being closed in a finally block. This may cause an LDAP 
             connection leak under some circumstances.

Architecture(s): Windows, Solaris, AIX, HPUX, and Linux.

Fixes superseded: ITIM Interim Fix 4.6.0-TIV-TIM-IF0034, 4.6.0-TIV-TIM-IF0035, and 4.6.0-TIV-TIM-IF0037.

Dependencies: Fixpack 4.6.0-TIV-TIM-FP0033.

Database Changes: NONE
                  

JMS (Java Messaging Service) Changes: NONE

LDAP Changes: OPTIONAL changes to update process definition of ITIM operation 
              'provisionOrderedAccounts', required when a service is a prerequisite
              service of two or more services.
              Reference APAR IY93494.

Files Replaced or Added or Modified by this Interim fix:

    <ITIM_HOME>/enrole.ear
    <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/ChangePasswordServlet.java 
    <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/ForgotPasswordServlet.java 
    <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/logonServlet.java 

Patch Contents:
  - This README file
  - enrole.ear
  - schema.dsml
  - IY93034.txt
  - ChangePasswordServlet.java
  - ForgotPasswordServlet.java 
  - logonServlet.java
  - provisionOrderedAccounts.ldif
  
MD5 Checksums:

d61fd1cb23c721d4a28398c4718d9c9c  4.6.0-TIV-TIM-IF0039.zip

MD5 Checksums:

3820395fbfd311f8ecc4d0338f13b90d  ChangePasswordServlet.java

79cef2c7b2c9d8d7d1532146a0d25d36  ForgotPasswordServlet.java

04772cf7ae9acdbbb3ab9c0add0c630c  IY93034.txt

2f0f7112eec1aca36a53181e99e228e5  logonServlet.java

8ef48110842cfa1385c9d5a0dd63ab55  provisionOrderedAccounts.ldif

c764feedb3bac1c3d44cc9d5621ccd3f  schema.dsml

9915715ad91dfb30cbdb96077638e9f8  enrole.ear


Applying the Patch:

    1) Extract the Interim Fix zip file to a temporary directory on your hard drive:
      
          # jar xvf 4.6.0-TIV-TIM-IF0039.zip  

       NOTE:  You may also use any unzip equivalent to unpack the zip file.
              Back-level versions of jar, FastJar or PKZIP may report errors. 
              Use the jar executable supplied with java or another zip utility 
              to uncompress the file.
       
    2) Copy the file(s) to the appropriate directory.

NOTE: *************************************************************************       
       Always BACKUP your old files in a safe place in case an unforseen 
       event occurs.  It is recommended to backup ITIM_HOME/data directory.
       Especially, be sure to backup any configuration files you 
       may have modified  such as properties or xml files.
NOTE: *************************************************************************       
       IF YOU ARE USING JAVA 2 SECURITY:
       Backup up your was.policy file to a temporary holding directory.  During 
       the fix application you will be re-deploying enrole.ear, which removes the
       $WAS_HOME/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
       directory and its contents. During the deployment, the was.policy is not 
       replaced and will need to be copied back during the COMMON TASKS section 
       of this document. On a Cluster this needs to be done on the NDM as well.
       $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
NOTE: *************************************************************************       
       IF YOU HAVE MIGRATED FROM ITIM 4.5.1 to ITIM 4.6
       If your ITIM V4.6 system is migrated from V4.5.1, it is necessary to copy
       the jsafe.jar and log4j.jar files from the:
       $ITIM_HOME/lib 
       directory into:
       $WAS_HOME/installedApps/$CELL_NAME/enRole.ear directory  
       You must always copy these 2 files back after installing an ITIM Interim Fix
       or Fixpack.
       The jsafe.jar file is no longer used in ITIM 4.6.0, since the encryption
       is changed in 4.6.0, but the jsafe.jar file is needed to be able to
       encrypt/un-encrypt the existing 4.5.1 data in LDAP.
NOTE: *************************************************************************       
       IF YOU HAVE INSTALLED A CUSTOM LOGO:
       The logo is copied to:
       $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war/images
       The Fixpack and Interim fix process removes the enRole.ear and all subdirectories.  
       To make it easier to restore the custom logo, copy it to a backup directory of your 
       choosing to facilitate copying it back after the Fixpack or Interim fix is applied.
       The ui.properties is preserved so it will not need to be updated.
       After the Interim fix is installed copy the custom logo to:
          $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war/images
NOTE: *************************************************************************       
       IF YOU HAVE INSTALLED A LANGUAGE PACK:
          Symptom - Fixpacks and Interim fixes partially overwrite Language Pack installation.
          Note - Before the Fixpack or Interim fix installation, take a back-up of the following
          files/folder related to the language pack, located in the directory:
            $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war
             - AppletErrorMessages_<language code>.properties
             - AppletLabels_<language code>.properties
             - AppletMessages_<language code>.properties
             - The folder along with it's contents by the name as <language code>.
                    
       The <language code> is generally a two letter word representing the language. 
       For example for English, the language code is 'en'.
         
       After applying the Fixpack or Interim Fix, restore all the language pack related files 
       and folder, that were backed up, to their respective locations in the directory: 
       $WAS_HOME/installedApps/$CELL_NAME/enRole.ear/app_web.war
        
       Note that for WAS Cluster installation, the same steps will have to be followed on 
       each of the nodes. This procedure is needed only on the cluster member, not on the 
       Deployment Manager node.
NOTE: *************************************************************************       
       The enrole.ear installed in:
       <ITIM_HOME>/ directory
       The file, enrole.ear, is used for single server and regular cluster.
       For all instances of <server_name> below we are referring to the AppServer name in
       WebSphere, usually referred to as server1 in a single server environment.
     
       NOTE***  SINGLE SERVER INSTRUCTIONS:
       Please use the following instructions for a Single Server environment.
       If this is a single server environment, only the enrole.ear is needed.
           
       1. Log in to the App Server Administrator.
       
        a. Example:
                http://localhost:9090/admin .
       
       2. Uninstall enrole application       
       
        a. Select the enRole application
        
        b. Stop the enRole application
        
        c. Uninstall the enRole application
        
        d. Above this box, click on save the configuration...another panel will 
           come up and you will need to confirm this by pressing the save configuration
           button.
           
        e. You are now finished with the App Server Administrator
        
       3. Restart WAS.
       
        a. Stop the AppServer (stopServer.sh)
        
        b. Start the AppServer (startServer.sh)  
       
       4. In the <ITIM_HOME>/bin directory run 
                SetupEnrole install server:<server_name>  (e.g. server1)
                
           If you have WAS Security setup then:
          
                SetupEnrole install server:<server_name> user:<userid> password:<password>
                
       5. Perform the COMMON TASKS listed below these instructions.
       
       6. After you are done with the COMMON TASKS, then:
       
       7. Restart WAS and you are done.
              
        a. Stop the AppServer (stopServer.sh)
               
        b. Start the AppServer (startServer.sh)
                
          
       NOTE***  CLUSTER INSTRUCTIONS:
       Please use the following instructions for a Cluster environment.  
           
       1C. Ensure all node agents are up and can communicate with the NDM.
       
       2C. Uninstall the ITIM Application from WebSphere.
       
        a. Stop the cluster. Use "ssCluster.sh stop" or from NDM admin console, 
           navigate to Servers -> Clusters. Select the cluster (s) where ITIM 
           is installed, and stop. 
        
        b. Uninstall the enrole enterprise app. 
        
        c. Save the config ensuring that it is synched with all the nodes. 
        
        d. Logout from the NDM admin console.
        
       3C. Re-Install ITIM.
       
        a. From NDM, run <ITIM_HOME>/bin/setupEnrole install. This is same as 
           in single server case, except, you don't need the "server" argument 
           here because the app will be deployed onto a cluster.
       
           If you have WAS Security setup then:
          
                SetupEnrole install user:<userid> password:<password>
                
       4C. Perform the COMMON TASKS listed below these instructions.
                
       5C. Start the cluster. Use "ssCluster.sh start" or do it from the NDM 
           admin console. 
           
NOTE: *********************************************************************************
       The following are COMMON TASKS that you need to perform prior to restarting the
       AppServer or Cluster. 
NOTE: *********************************************************************************

       1. You must copy the updated api jar files to the $ITIM_HOME/lib directory.
           Copy the itim_api.jar, itim_server.jar and the api_ejb.jar from:
                $WAS_HOME/installedApps/$CELL_NAME/enrole.ear  directory to
                $ITIM_HOME/lib  directory.

       2. If you are using the JAVA 2 Security, replace the was.policy file you saved
          earlier.  Copy it back to:
          $WAS_HOME/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
          For Cluster in the NDM:
          $WAS_HOME/DeploymentManager/config/cells/$CELL_NAME/applications/enRole.ear/deployments/enRole/META-INF
          Where $CELL_NAME is either the $MACHINE_NAME or $CLUSTER_NAME.
          For additional information on using JAVA 2 Security with ITIM, please review the ITIM
          Installation Guide, Appendix C.

       3. OPTIONAL: Additional step for IY93034.
          An optional attribute 'escapeentities' has been introduced for the <JS> tag. A "false" 
          value for this attribute indicates to the <JS> tag interpreter that the result of the 
          execution of the javascript enclosed in <JS> tag, be treated as XML and not plain text, 
          so that the XML special characters like >, <, &, in the result, are not escaped. Any 
          other value specified for this attribute, will have no effect on the <JS> tag execution.

          Usage :

              <JS escapeentities="false">

                 var  temp;
                 ...
                 ...
                 return temp;

              </JS>

          ** This attribute may be only set to true, in the XHTML body of a notification or 
             post-office aggregate template.
             In addition to the above setting, the customers using the post-office XHTML body 
             template to aggregate individual XHTML  templates may need to further add some 
             code in the <JS> tag, to append only the body part, of individual XHTML notification 
             messages to prevent duplicate tags in the generated XHTML mails. A sample XHTML body 
             to be used for Post Office has been provided in IY93034.txt. This sample uses the 
             'escapeentities' attribute and considers the content enclosed only in 'body' tags of 
             individual notifications.


       4. OPTIONAL: Additional step for IY93117. 
          A new property 'remoteservices.hrfeed.resolveDNs' has been introduced in 
          $ITIM_HOME/data/enRole.properties file to provide an option to the end user, for not sending the 
          name attribute of Role/Supervisor in the response for search request fired from the ITDI.
          Execute the following steps for configuring this property.
             
          1. Open $ITIM_HOME/data/enRole.properties file in any text editor.
          
          2. Add the property "remoteservices.hrfeed.resolveDNs" with value true or false. If the flag is 
             set to true, then the relationship attributes, Supervisor and Roles will be resolved to corresponding 
             names. So name values will be sent to ITDI as a response to the search request. If the value is 
             set to false, then the relationship attributes will not be resolved and the values will be sent as 
             they are to ITDI. After the change, the file will contain a new line as shown below.
             remoteservices.hrfeed.resolveDNs=true

          3. Save the file and quit the editor.
          
       5. OPTIONAL: Additional step for IY93269.
          The file, schema.dsml is provided for APAR IY93269. Replace the file schema.dsml present in 
          $ITIM_HOME/data/remote_resources/commonprofile folder with the one shipped in this interim fix.

       6. If you have a need to compile the examples in $ITIM_HOME/extensions/examples/self_care
          application, you will need to copy the following 3 files:
          - ChangePasswordServlet.java
          - ForgotPasswordServlet.java 
          - logonServlet.java 
          to:
             <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/ChangePasswordServlet.java 
             <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/ForgotPasswordServlet.java 
             <ITIM_HOME>/extensions/examples/self_care/src/examples/expi/logonServlet.java 

          ** Please be aware that this will overwrite any changes you may have made to the original 
             files in the self_care directory.

       7. OPTIONAL: Additional step for IY93494.
          The process definition of the operation 'provisionOrderedAccounts' needs to be
          updated, to enable requests that are independent of the failed request to be 
          started. The requests dependent on a service, will be executed serially 
          one after another, and not simultaneously.
          Steps for modifying the definition in directory server:

          1. Connect to directory server that contains the itim data using any LDAP client.
             Ensure that the connected user has the permissions to modify LDAP entries.

          2. Before importing the provisionOrderedAccounts.ldif file, change the dn in the 
             file appropriately.
             Current dn is,
                dn: erglobalid=00000000000000000008, ou=operations, ou=itim, ou=IBM, DC=COM
             Here the tenant is 'IBM' and root suffix is 'DC=COM'.
             Change these to appropriate tenant and root suffix.

          3. Import the provisionOrderedAccounts.ldif file. Make sure that while importing
             the mode is update, as it updates the attribute 'erxml' for process definition, 
             erglobalid=00000000000000000008,ou=operations,ou=itim,ou=<tenant>,<root suffix>. 

       8. OPTIONAL: Additional step for IY93018.
          A new property 'reportBatchSize' has been introduced to control the size of a
          single StringBuffer object during CSV report generation. A value assigned to this
          property represents the number of rows of report data to be fetched from the
          database in a single call, formatted into a StringBuffer object. The value may 
          be increased or decreased depending on memory constraints. As the value of this 
          property is reduced, the number of database calls may increase and so would the 
          time taken to generate the report.
          If this property is undefined or has a value set to 0 or has an invalid value
          specified, then there will be no size limit on the StringBuffer object and 
          the behavior will be exactly same as that prior to the fix.

          To set this property follow the steps below :-
          1. Open <ITIM_HOME>/data/adhocreporting.properties file in any text editor.
          2. Set the property  "reportBatchSize" to a positive numeric value.
             e.g: If a value of 10000 is set to this property, then the last line of 
                  adhocreporting.properties file would look like this:

                  reportBatchSize=10000
          3. Save the file and quit the editor.

          10000 is an ideal value for most cases but this may be changed depending on 
          memory constraints.

       9. OPTIONAL: Additional step for IY94681.
          A new command line argument 'runInBackground' has been introduced to be able to run the 
          Incremental Synchronizer in the background. This argument may be specified at the end of
          the command line. 
          An example command line specifying 'runInBackground' option is as follows -
             ./startIncrementalSynchronizerCMD_WAS.sh "itim manager" secret "cn=changelog" 3 runInBackground 

          Execute the following steps for non-Windows platforms -
           1. Open <ITIM_HOME>/bin/unix/startIncrementalSynchronizerCMD_WAS.sh file in any text editor.
           2. Edit the following command to pass in the 5th argument as follows -
              $JAVA -D$OPTIONS -classpath $CLASSPATH com.ibm.itim.adhocreport.changelog.DeltaSynchronizer.DeltaSynchronizeCMD $1 $2 $3 $4 $5
           3. Save the file and quit the editor.

          Execute the following steps for Windows platform -
           1. Open <ITIM_HOME>/bin/win/startIncrementalSynchronizerCMD_WAS.bat file in any text editor.
           2. Edit the following command to pass in the 5th argument as follows -
              "%JAVA_HOME%\bin\java" -D%OPTIONS% -classpath "%CLASSPATH%" com.ibm.itim.adhocreport.changelog.DeltaSynchronizer.DeltaSynchronizeCMD %1 %2 %3 %4 %5
           3. Save the file and quit the editor.

         END OF COMMON TASKS

End of Readme
