OBSOLETE Patch-ID# 119502-05

NOTE:
***********************************************************************
READ THE TERMS OF THE AGREEMENT ("AGREEMENT") IN THE LEGAL_LICENSE.TXT
FILE CAREFULLY BEFORE USING THIS SOFTWARE. BY USING THE SOFTWARE, YOU
AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE
TERMS, PROMPTLY DESTROY THE UNUSED SOFTWARE.
***********************************************************************

Keywords: access manager linux rhel2.1 security
Synopsis: Obsoleted by: 119502-06 Sun Java(TM) System Access Manager 6 2005Q1 RHEL2.1
Date: Jan/06/2006


Install Requirements: Additional instructions may be listed below                      
                      
Solaris Release: 
Note: Redhat


SunOS Release: 
Note: RHEL2.1


Unbundled Product: Sun Java System Access Manager 6

Unbundled Release: 2005Q1

Xref: 

Topic: Access Manager

Relevant Architectures: i386

BugId's fixed with this patch: 4948368 5021818 5029256 5056727 5085524 5096815 5107637 6175880 6189388 6198000 6201204 6201986 6202538 6202574 6202840 6203563 6204646 6205443 6207888 6212380 6219822 6220837 6228389 6231218 6236892 6240262 6244499 6244578 6246367 6251848 6254890 6255526 6259627 6261110 6269826 6269853 6272812 6276972 6277119 6277475 6281059 6282777 6290949 6292616 6292838 6293833 6293866 6298312 6298973 6301106 6301199 6319028 6321421 6323358 6323368 6325233 6325343

Changes incorporated in this version: 6290949 6323368 6321421 6261110 6319028 6325343 6325233 6269853 6323358 6293833 6276972 6292838 6301106

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 
Note: sun-identity-clientsdk-6.3-14.i686.rpm
sun-identity-console-6.3-14.i686.rpm
sun-identity-console-sdk-6.3-14.i686.rpm
sun-identity-external-6.3-14.i686.rpm
sun-identity-federation-6.3-14.i686.rpm
sun-identity-password-6.3-14.i686.rpm
sun-identity-samples-6.3-14.i686.rpm
sun-identity-sci-6.3-14.i686.rpm
sun-identity-sdk-6.3-14.i686.rpm
sun-identity-sdk-config-6.3-14.i686.rpm
sun-identity-services-6.3-14.i686.rpm
sun-identity-services-config-6.3-14.i686.rpm
sun-identity-sfodb-6.3-14.i686.rpm
sun-identity-utils-6.3-14.i686.rpm

Files included with this patch: 


Problem Description:

6290949 Modify the default value for iplanet-am-session-store-cpl-max-wait-time
6323368 AMUser.addEventListener does not notify and throws Exception
6321421 Wrong versions of xalan.jar & xercesImpl.jar in /opt/SUNWam/lib
6261110 User gets "Redirect limit for this URL exceeded".
6319028 clientsdk does not handle exceptions in the SOAP message
6325343 amclientsdk.jar doesn't handle localized content in utf-8 properly
6325233 Policy notifications not working for amclientsdk.jar in 63 RTM bits
6269853 Logged User id is null when an invalid uid is used.
6323358 remote policy api failing to create application SSO token for amclientsdk from 63 RTM
6293833 Exception thrown when removing members from static group
6276972 Delay in AM6.3 failover to secondary ldap directory
6292838 iplanet-am-role-display-options not processed correctly for Filtered Roles
6301106 After amconfig, WebSphere Application server fails to start
 
(from 119502-04)
 
(from 119502-03)
6201204 HTTPS redirect in CDSSO - redirets to default http PORT 80
6244578 AM should warn user that the browser cookie support is disabled/not available 
6236892 Image/Text place holder while CDCServlet is processing the AuthNResponse after Login 
5021818 amLog file is reporting Filehandler errors 
6255526 Cookieless fix - performance issues (objects leak, etc.) when 'cookie.check' is 'true' in AMConfig 
6272812 login failure attempts-count is not reset upon a successful login
6281059 AM6.1 event service does not work when polling is enabled 
6282777 implementing TTL on amsdk cache 
6240262 Agent is not working with cookiesless mode unable to read ssotoken from URL querystring 
6246367 AM hangs due a deadlock in initializing - EventService/SM/UM are all waiting for each others init
 
(from 119502-02)
6202840 Session history keeping Goto URL's around
5085524 Session object are not cleared up when they are destroyed
6293866 amconsole navigate to next page fail
6201986 AM SDK can not handle user credentials with  >'& ' and '<' characters
6251848 AMSDK does not work with AM behind loadbalancer
6277475 Patch application on SDK nulls out amadmin and ampassword on linux
6244499 Console logout on WebLogic results in Error 500 and exceptions
6254890 Approval Callback has to have a property makes AM server trust only listed in AMConfig.properties
6277119 Error is shown when amconsole is accessed after installing ampatch in weblogic install on linux
6189388 Identity ACI's causing performance degredation
6219822 Admin console online help gives 404 error on WebSphere 5.1
6301199 Gateway configuration fails in 7.0 build8
6269826 login password in debug mode shown in plain text in amAuth debug file
6298312 WebServer fails to start after patchadd
6298973 amconfig scripts fail to reconfig AM after following patch README
6292616 AM sdk clients need restart after svc schema change
 
(from 119502-01)
6231218 On Linux platform, asadmin create-jvm-options does not recognize JVM options with ":"
5056727 On Linux platform, getNumberOfCPUS() returns incorrect value for Xeon based systems
6204646 WAS5 failed to start after successful configuration on linux
6202538 Weblogic8.1SP2/Linux3.0: Internal server error while accessing amconsole
6212380 Access Manager amtune-as8 script has error for passwordfile
5096815 amconfig fails to add properties to AMConfig.properties, if this file was already tagswapped
6175880 PS-IS cannot co-exist on the same host on a different webcontainer
6203563 Get Exception error when select Affiliate option of an affiliate Entity.
6202574 fedCookie status does not change
6205443 EventService should not run into a tight loop when it does not get Persistent Search Connection
6220837 Deleting a service assigned to user makes system unusable
5029256 Typo in argument to referencial integrity plugin + more attribute indxes needed user makes system unusable
6228389 Perf changes for Session Failover (making session blob encryption configurable)
6207888 Accessing Admin Console Online Help on WebLogic results in 404 Error
4948368 IS sdk does not get app session for SRA gateway in bea cluster configuration
6198000 Back button on invalid session breaks goto
6202840 Session history keeping Goto URL's around unexpectedly
5107637 Already logged in - an incorrect wording
6259627 Issues related to 'cookie hijack enabled' cookie maintenance

Patch Installation Instructions:
--------------------------------
 
The following command installs a patch to a standalone machine:
 
       example# cd 119502-05
       example# ./installpatch

Special Install Instructions:
-----------------------------
 
1. Make sure you are applying the patch to an existing Access Manager 6 2005Q1 
installation.
 
2. Before applying the patch, obtain the information required to configure
Access Manager after the patch installation. You must provide specific 
information, including administrator names and passwords. 
 
For example, you must know the Access Manager administrator and password 
and the Directory Manager name and password for the Directory Server that 
Access Manager is using.
 
3. Back up any customized files.
 
4. Apply the following Access Manager patch for the Linux OS: 119502-05.
 
5. Configure Access Manager for your specific web container by setting the Access Manager 
configuration variables and running the amconfig script. 
 
The patch installation process prepares a configuration script input file 
named /tmp/.amsilent. This file is based on the amsamplesilent template file.
 
Before you run amconfig, set the appropriate configuration variables in the 
/tmp/.amsilent file, including:
 
  - DEPLOY_LEVEL=21 
  - DIRECTORY_MODE=5
  - Passwords for DS_DIRMGRPASSWD, ADMINPASSWD, and AMLDAPUSERPASSWD
  - Access Manager Web container variables. For more details about the Web container 
    variables, see the amsamplesilent file in the <AccessManager-base>/identity/bin 
    directory on Linux systems.
 
The <AccessManager-base> default installation directory is /opt/sun on Linux systems.
 
6. Run the amconfig command as shown below. Before you run amconfig, 
Directory Server and the Access Manager web container must be running.
 
For example, to run amconfig on a Linux system with Access Manager 
installed in the default base installation directory:
 
  cd /opt/sun/identity/bin
  ./amconfig -s /tmp/.amsilent
 
The /tmp/.amsilent file is generated during the patch installation
and updated manually, as described above.
 
For more information about running the amconfig script, 
see the Access Manager Administration Guide:
 
http://docs.sun.com/source/817-7647/ConfigScripts.html#wp21317
 
##############################################################################
 
 
-----------------------------------------------------------------------------
 
Bug ID 5029256: Typo in Argument to Referential Integrity Plugin Impacts 
Performance
 
When Access Manager enables the referencial integrity plugin for Directory 
Server, an argument to the plugin has a typo in an attribute name 
(iplanet-am-modifiable-by).  A "search not indexed" warning is generated in 
the Directory Server error log, and Directory Server performance is impacted.
 
 
Workaround
 
1. Backup your existing index.ldif and plugin.ldif files.
 
2. Copy the new index.ldif and plugin.ldif files from the patch installation 
to your specific installed directory. The default directory is:
 
  /etc/opt/sun/identity/config/ldif.
 
3. Import the indexes from the index.ldif and plugin.ldif into Directory Server 
using the ldapmodify command.
 
4. Since new indexes are introduced, rebuild the indexes to generate a new set 
of indexes after updating the files on all databases. There are various ways to 
rebuild the indexes. For example,you can run the db2index.pl Perl script on 
all instances where the index.ldif was updated.
 
If your Directory Server instance is on /var/Sun/mps, the db2index.pl script 
is in the /var/Sun/mps/slapd-<hostname> directory.
 
For more information about the db2index.pl perl script, see
Chapter 8, "Command-Line Scripts" in the Directory Server Configuration, 
Command, and File Reference:
 
  http://docs.sun.com/source/816-5608-10/scripts.htm#27451
 
-----------------------------------------------------------------------------
Bug ID 6276972: Delay in AM6.3 failover to secondary ldap directory
 
1.Add the following VM option to server.xml for the specific container.
<JVMOPTIONS>-Dnetworkaddress.cache.ttl=0</JVMOPTIONS>
<JVMOPTIONS>-Dsun.net.inetaddr.ttl=0</JVMOPTIONS>
2.Restart web container.
 
----------------------------------------------------------------------------
 
Bug ID 6292838: iplanet-am-role-display-options not processed correctly for Filtered Roles
 
Copy am_console.jar from "/usr/share/lib/identity/console-war/WEB-INF/lib"  to
"/opt/SUNWwbsvr/https-<machine_name>.<domain_name>/is-web-apps/applications/WEB-
INF/lib" directory.
 
-----------------------------------------------------------------------------
 
Bug ID 6301106: After amconfig, WebSphere Application server fails to start
 
-In server.xml file, remove the leading extra characters "/:" in the
value for the genericJvmArguments option in the jvmEntries before adding
the patch.
 
-In the startServer.sh add /opt/sun/private/lib to the LD_LIBRARY_PATH (for Linux)
diff startServer.sh startServer.sh.orig
75c75
<	LD_LIBRARY_PATH="$WAS_LIBPATH":$LD_LIBRARY_PATH:/opt/sun/private/lib
---
<	LD_LIBRARY_PATH="$WAS_LIBPATH":$LD_LIBRARY_PATH
 
 
##############################################################################
 
Backout instructions
 
1. Make sure to take the ldap backup before adding AM Linux patch.
(Later we can automate this step)
cd /var/opt/mps/serverroot/slapd-yourinstance
db2ldif -s "root_suffix"
ldiffile:
/var/opt/mps/serverroot/slapd-yourinstance/ldif/YYYY_DD_MM_XXXX.ldif
<--- This is the backup file.
Example for root_suffix: dc=red,dc=iplanet,dc=sun
 
2. Add patch-XX
Please note patch scripts takes backup of /opt/sun/ into a file
am63_backup.gzip
Copy am63_backup.gzip in a in a safe folder.
 
3. Keep YYYY_DD_MM_XXXX.ldif and am63_backup.gzip in a safe folder
(i.e., not in installation directory)
 
4. uninstall AM63.
 
5. Install AM63 with patch-1.
 
6 Restore the directoryserver backup
cd /var/opt/mps/serverroot/slapd-yourinstance
./stop-slapd
ldif2db -s ?dc=red,dc=iplanet,dc=com? -i
/var/opt/mps/serverroot/slapd-yourinstance/ldif/YYYY_DD_MM_XXXX.ldif
 
7. To copy am63_backup.gzip into installation area
 
mv /opt/sun/ /opt/sun.orig
 
8. cd /
 
tar xfz am63_backup.gzip
 
9. Restart DS and AM instance.

README -- Last modified date:  Thursday, January 19, 2006

