OBSOLETE Patch-ID# 115766-06
Keywords: access manager
Synopsis: Obsoleted by: 115766-07 AM 6.2: Sun ONE Access Manager
Date: May/10/2005


Install Requirements: NA                      
                      
Solaris Release: 8 9

SunOS Release: 5.8 5.9

Unbundled Product: Sun ONE Access Manager

Unbundled Release: 6.2

Xref: 

Topic: Sun ONE Access Manager

Relevant Architectures: sparc

BugId's fixed with this patch: 2123234 2124253 2124848 2124990 4847369 4872249 4987109 5013718 5013729 5015054 5031902 5040055 5052696 5055145 5060050 5060560 5063149 5072454 5076037 5083368 5083387 5083405 5085363 5087540 5090018 5093089 5095724 5097235 5099037 5102536 5102680 5105263 5107381 5107637 5109607 6178909 6185149 6185928 6197111 6198000 6204178 6204754 6206629 6214677 6215016 6217200 6218242 6222704 6235384 6237056 6241717 6243214 6254890

Changes incorporated in this version: 2123234 2124253 2124848 2124990 6185928 6215016 6218242 6237056 6241717 6243214 6254890

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

	/etc/opt/SUNWam/config/ldif/install.ldif
	/etc/opt/SUNWam/config/xml/amAuth.xml
	/opt/SUNWam/bin/amas70config
	/opt/SUNWam/bin/amwas51config
	/opt/SUNWam/bin/amwl61config
	/opt/SUNWam/bin/amwl81config
	/opt/SUNWam/bin/amws61config
	/opt/SUNWam/dtd/amAdmin.dtd
	/opt/SUNWam/dtd/sms.dtd
	/opt/SUNWam/lib/am_sdk.jar
	/opt/SUNWam/lib/am_services.jar
	/opt/SUNWam/lib/iaik_jce_full.jar
	/opt/SUNWam/lib/xalan.jar
	/opt/SUNWam/lib/xercesImpl.jar
	/opt/SUNWam/lib/xml-apis.jar
	/opt/SUNWam/locale/amAdminCLI.properties
	/opt/SUNWam/locale/amAdminCLI_en.properties
	/opt/SUNWam/locale/amAdminModuleMsgs.properties
	/opt/SUNWam/locale/amAuthSafeWord.properties
	/opt/SUNWam/locale/amAuthSafeWord_en.properties
	/opt/SUNWam/locale/amAuthUI.properties
	/opt/SUNWam/locale/amAuthUI_en.properties
	/opt/SUNWam/locale/amProviderConfig.properties
	/opt/SUNWam/services.war
	/usr/share/lib/identity/console-war/WEB-INF/lib/am_console.jar
        /opt/SUNWam/dtd/policy.dtd
/etc/opt/SUNWam/config/xml/amAuthSafeWord.xml

Problem Description:

4872249: Subject eval should be outside of the policy
5052696 : Session and Auth Objects dont get cleaned up completely a fter a login/timeout
5031902 : Policy Cache not cleaned up correctly
5040055 : readACL - search ACL in the search engine does not work with filtered roles
5060050 : iPlanet Portal Server 6.3 Service definitions do not pop up
5015054 : There should be a way to configure the redirect url on identity server
CRT# 873 : revision number changes for SMS.dtd
5072454 : pre61to62upgrade script hangs, using wrong Directory Serv
er instance path
Esc# 1-2184055 : Web Server crashes in liberty when accessed by multiple clients
5055145 : Identity Server preupgrade script removes the locale directory but not the localization package.
5060560 : not refreshing cache
5013729 : Policy state is made inconsistent after the Policy Service is deleted
5013718 : Safeword connections are not closed by Identity server
5076037 5086581 5046174: Non-JAAS thread implementation to 6.2 in auth framework in order to prevent DOS attack
5090018 : LDAP Auth fails when authenticating against OpenLDAP
5109607 : Xalan2.6 upgrade
5095724: Logout action leads to 'ServerError'
5097235 5051401: XML configuration for authentication modules does not work as expected
5063149 : SSO tokens created by internal auth api fails on policy evaluation.
5107381 : Recursive user-profile look-up in Certificate Authentication
5102680 : CRLValidation doesnot work on IS6.2 due to GeneralNamesException class being drop in JDK 1.4.2 and above.
5085363 : Identity Server running on two networks cannot distinguish between addresses
5093089 : TCP sessions builds up to a point where the machine runs out of file descriptor.
5083405 : Authentication failed page leads to "AuthnRequest is not Valid"
6178909 : Can not install IS6.2HP1 when SSL is enabled on DS
5105263 : IS6.2 - Reauth with invalid credential should show error
5099037 : Need to make AuthenticationLocality configurable
5083368 : Threading and performance problem in federation and de-federation scenario
5102536 : Unable to modify trusted provider list after a provider had been deleted
4987109 : possible bug in preserving referential integrity of objects [ subs & policies ]
5083387 : amadmin cli cannot add subconfiguration if subConfigName contains "/"
6185149 : AddDefaultValues doesnt add default value for an existing service
5087540 : Error "modification of profile fail" when adding a user to a group.
6197111 :  IS 6.2 HP2 does not seem to be patching the WAR staging area, instead it is patching the exploded areas
4847369 : Logs getting inconsistent values for IP address
6215016 : Module parameter in url cannot be carried into new org login page 
6198000 6202838 :Back button on invalid session breaks goto
6204754 6202840 : Session history keeping Goto URL's around (Security issue)
5107637 : Already logged in - an incorrect wording
6206629 : WebLogic J2EE Agents have persistent LDAP connections closed by load balancer due to idle
6204178 : there is no way to terminate a session created by application auth module
6198000 : Back button on invalid session breaks goto
6222704 : Pre/Post processing doesn't work for password changes
6217200 : users in filtered admin roles are not redirected to the admin console.
6214677 : Policy API not extracting policy correctly in certain circumstances.
6235384 : AM 6.2 backout issue
2123234 : Makefiles need to be changed to pick up fix of 6221011 on ldapjdk.jar 4.16.1
2124253 : Searching for another ldap subject after selecting one subject throws error 
2124848 : Inconsistent usage of com.iplanet.am.smtpport property 
2124990 : Image/Text place holder while CDCServlet is processing the AuthNResponse after Login 
6185928 : AM6.2HP2 - Default "LoginURL" not work, when SSL terminated externaly 
6218242 : Access Manager does not handle List types in group selection 
6237056 : AM6.2 patch 4 should redeploy services.war to update Login.jsp for a bug fix 
6241717 : 6.2patch4 fails to update classpath for xml jars 
6243214 : Issues when installing AM6.2 patches
6254890 : ApprovalCallback has to have a property which makes AM server to trust only servers listed in AMConfig.properties

Patch Installation Instructions:
--------------------------------
 
1. Backup  following files
amAuthSafeWord.xml
amAuth.xml
amAuthSafeWord.properties
amAdminCLI.properties
AMConfig.properties
amAuthUI.properties
Login.jsp
membership.jsp
new_org.jsp
 
For Solaris 8 and 9 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/115766-06
 
When postpatch script is executed, it will ask one to three questions about
the server instance path. In case Identity Server is running on web server,
you will be asked with this question:
 
What is the path of the WS 6.1 instance [/opt/SUNWwbsvr/https-hostname.domainname] ?
 
For Identity Server running on application server, the following question 
will be asked:
 
What is the path of Application Server instance [/var/opt/SUNWappserver7/domains/domain1/server1]
 
When Identity Server is running on application server, if the Identity
Server applications are redeployed multiple times, the application root
path can vary. In this case, you will be asked to input the correct path
to the deployment directory of application /amserver and /amconsole
 
What is the path of the deployment directory of /amserver [/var/opt/SUNWappserver7/domains/domain1/server1/applications/j2ee-modules/amserver_1] ?
 
What is the path of the deployment directory of /amconsole [/var/opt/SUNWappserver7/domains/domain1/server1/applications/j2ee-modules/amconsole_1] ?
 
Restart Sun ONE Identity Server once the patch is installed successful.
 
The following example removes a patch from a standalone system:
 
       example# patchrm 115766-06
 
For additional examples please see the appropriate man pages.

Special Install Instructions:
-----------------------------
 
The instructions in this section are optional. Only if you are concerning 
a bug descripted in this section, you would need to follow the instructions 
under that particular bug.
 
Alternate Root install mode (patchadd -R) is not supported for this patch; this
also means that the Live Upgrade product cannot be used to apply this patch.
 
 
1. If any of the files are customized in the current installation, please take a back up of those customized files. Compare the contents of the backedup files with the contents of the new files installed by this patch to identify the customizations done. Merge the customizations with the new files and save them.
 
2. This step is mandatory. There is a change in schema. This also fixes Bug#5099037 
 
i) create a xml file <INSTALL_DIR>/bin/alter.xml with following contents:
 
<?xml version="1.0" encoding="ISO-8859-1"?>
 
<!DOCTYPE Requests
    PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q1 Admin CLI DTD//EN"
   "jar://com/iplanet/am/admin/cli/amAdmin.dtd" >
 
<Requests>
<SchemaRequests serviceName="iPlanetAMProviderConfigService"
    SchemaType="Organization"
    SubSchema="/EntityDescriptor/Provider/LocalConfiguration">
    <AddAttributeSchema
        fileName="<INSTALL_DIR>/bin/newattr.xml" />
</SchemaRequests>
</Requests>
 
 
where INSTALL_DIR is the location where Identity server is installed.
Example: INSTALL_DIR is /opt/SUNWam
 
ii) create a xml file <INSTALL_DIR>/bin/newattr.xml with following contents:
 
<?xml version="1.0" encoding="ISO-8859-1"?>
 
<!DOCTYPE Requests >
<Requests >
<AttributeSchema name="sunIdentityServerProviderAssertionIssuer"
    type="single"
    syntax="string"
    i18nKey="a239">
</AttributeSchema>
</Requests >
 
iii) <INSTALL_DIR>/bin/amadmin -u amadmin -w <PASSWORD> --data <INSTALL_DIR>/bin
/alter.xml
 
3. For bug# 5013718 
You must manually update the new amAuthSafeWord.xml with encoding information. 
You can get the customer setup encoding information from backup files.
eg: If the customer setup has encoding "UTF-8"
Then, modify following line in amAuthSafeWord.xml,
<?xml version='1.0' encoding="XML_ENCODING"?>
to
<?xml version="1.0" encoding="UTF-8"?> 
 
Run following commands manually to load the new SafeWord Service
$INSTALL_DIR/SUNWam/bin/amadmin -u amadmin -w "<PASSWORD>" --deleteservice iPlanetAMAuthSafeWordService
$INSTALL_DIR/SUNWam/bin/amadmin -u amadmin -w "<PASSWORD>" --schema /etc/opt/SUNWam/config/xml/amAuthSafeWord.xml
 
 
4. For bug# 5015054
Add the following property to AMConfig.properties -
com.sun.identity.url.redirect=protocol,hostname
 
5. For bug# 5013729
A new option "--cleanpolicyrules" is supported while removing services using amadmin.
Usage:
amadmin --runasdn "admindn" --password password -r ServiceName --cleanpolicyrules
If the option "--cleanpolicyrules" is passed while removing the service,  policy rules defined for the <ServiceName> are removed along with the service.
 
"ServiceName" is deleted
 
6.For bug# 5060050
To set propertiesViewBeanURL in a service configuration. You
can do the followings
 a. Create a xml file that contains the followings
 
    <!DOCTYPE Requests
        PUBLIC "-//iPlanet//Sun Java System Access Manager Admin CLI DTD//EN"
        "jar://com/iplanet/am/admin/cli/amAdmin.dtd"
    >
 
    <Requests>
        <SchemaRootNodeRequests serviceName="$SERVICE_NAME">
        <SetPropertiesViewBeanURL url="$NEW_URL" />
       </SchemaRootNodeRequests>
    </Requests>
 
    Please replace $SERVICE_NAME with the service name of the service configuration; and replace $NEW_URL with the URL for the propertiesViewBeanURL of this service.
 
 b. Execute amadmin command line tool
     $IS_INSTALL_DIR/SUNWam/bin/amadmin -u amadmin -w $PASSWORD --data $XML_FILE
    where $IS_INSTALL_DIR is the directory where Identity Service is installed.
          $PASSWORD is the password of amadmin user
          $XML_FILE is the xml file that you have created in step a. 
 
Add the following property to AMConfig.properties:
com.sun.am.event.connection.idle.timeout=0
 
This property specifies the timeout value in minutes after which the
persistent searches will be restarted. Ideally, this value should be
lower than the Load Balancer/Firewall TCP timeout, to make sure that
the persistent searches are restarted before the connections are dropped.
A value of '0' indicates that these searches will not be restarted. By
default the value is '0'
Note: only the connections that are timed out will be reset.
 
7. For bug# 5060560/ Bug 6206629
 
Add the following property to AMConfig.properties:
com.sun.am.event.connection.idle.timeout=0
 
This property specifies the timeout value in minutes after which the
persistent searches will be restarted. Ideally, this value should be
lower than the Load Balancer/Firewall TCP timeout, to make sure that
the persistent searches are restarted before the connections are dropped.
A value of '0' indicates that these searches will not be restarted. By
default the value is '0'
Note: only the connections that are timed out will be reset.
 
 
8. For bug# 5109607
Due to the xalan2.6 upgrade jaxp-api.jar,dom.jar,sax.jar,xsltc.jar
are replaced with xml-apis.jar from xalan 2.6 
For utilities (using these jars) to work with patch,the portal utilities need to be updated with the new jars.
 
9. For bug# 5101929
Please set the correct domainname. You may not see this issue.
eg., domainname red.iplanet.com
 
10. For bug #6175850
The workaround is that the user either logs out or restart the browser. 
 
11. For bug #5107381
Change the 'People Container for All Users:' attribute value in the 'Core' auth service configuration, under default org from "ou=People,ROOT_SUFFIX" to "ROOT_SUFFIX"
eg., ROOT_SUFFIX=dc=red,dc=iplanet,dc=com 
 
12. For bug#4987109
Test case description:
a. Login to the admin console with amadmin username/password.
b. Click "Service Configuration" tab.
c. Select "Administration" service configuration.
d. Scroll down until you see the attribute field labelled with "Pre and Post-Processing Classes".
e. Enter implementation class name for the AMCallBack interface, for instance: com.sun.identity.policy.plugins.SubjectReferentialIntegrityPlugin
f. Save the change.
g. Create a user/role. 
h. Create a policy with the subject as the created user/role.
i. delete the created user/role. 
j. You should be able to see the plugin methods being invoked and the user/role is removed from the subject.
 
13. For bug #5083387
"/" should be replaced with "&#47;" while adding subConfigName 
 
14. For bug #6204178
Add the following property in AMConfig.properties file
com.sun.identity.authentication.special.users=cn=dsameuser,ou=DSAME Users,ORG_BASE|cn=amService-UrlAccessAgent,ou=DSAME Users,ORG_BASE
Update ORG_BASE acoording to the domain settings.
 
 
15. Bug 6222704  
A new plug-in interface has been introduced in 115766-04. Any class 
which implements this interface and is declared in the list of 
"Pluggable User Status Event Classes" (core authentication module) will 
be notified during the following events : user password change or user 
account lockout (memory lockout). The event type and a map of event 
parameters are passed to the plug-in class(es)  when the event occurs.
 
16. Bug# 6185928
Change the attribute value for "iplanet-am-auth-login-success-url" from
%protocol://%host:%port/amconsole to /amconsole in the Core Authentication Service

README -- Last modified date:  Friday, June 17, 2005

