Download
Abstract
This is a General Availability (GA) patch containing all the fixes since the release of IBM Tivoli Access Manager for e-Business 6.1.0 (WebSEAL).
Download Description
1.0 ABOUT THIS PATCH
1.1 Patch contents
1.2 Architectures
1.3 Patches superseded
1.4 Dependencies
2.0 APARS AND DEFECTS FIXED
2.1 Problems fixed by patch 6.1.0-ISS-AWS-FP0009
2.2 Problems fixed by patch 6.1.0-TIV-AWS-FP0008
2.3 Problems fixed by patch 6.1.0-TIV-AWS-FP0007
2.4 Problems fixed by patch 6.1.0-TIV-AWS-FP0005
2.5 Problems fixed by patch 6.1.0-TIV-AWS-FP0004
2.6 Problems fixed by patch 6.1.0-TIV-AWS-FP0003
2.7 Problems fixed by patch 6.1.0-TIV-AWS-FP0002
2.8 Problems fixed by patch 6.1.0-TIV-AWS-FP0001
3.0 BEFORE INSTALLING THIS PATCH
3.1 Back up Tivoli Access Manager data
3.2 Upgrade GSKit to Version 7.0.4.42
4.0 INSTALLING THIS PATCH
4.1 Installing this patch on AIX(R) systems
4.2 Installing this patch on HP-UX systems
4.3 Installing this patch on Linux systems
4.4 Installing this patch on Solaris Operating Environment systems
4.5 Installing this patch on Windows(R) systems
5.0 UNINSTALLING THIS PATCH
6.0 AFTER INSTALLING THIS PATCH
6.1 Verifying patch level
6.2 Adding new components to a system
6.3 Update WebSEAL Test Certificate, if Applicable
7.0 DOCUMENTATION UPDATES
7.1 New configuration option - preserve-base-href2 (IZ10008)
7.2 New configuration option - update-session-cookie-in-login-request
(IZ06041)
7.3 Clarification of failover cookie expiration. (IZ12948)
7.4 Clarification of SPNEGO junction platform support.
7.5 New configuration option - slash-before-query-on-redirect (IZ26925)
7.6 New configuration option - ignore-missing-last-chunk (IZ37639)
7.7 Configuring Multiple WebSEALs to Different Domains
7.8 Allow using colon (:) in a user's DN (IZ46307)
7.9 New configuration option - enable-IE6-2GB-downloads (IZ25866)
7.10 JUNCTION COOKIE SCRIPT NOT COMPATIBLE WITH XHTML (IZ36950)
7.11 New configuration option - reprocess-root-jct-404s (IZ38968)
7.12 New configuration option - capitalize-content-length (IZ42716)
7.13 REMOVE MALLOCMULTIHEAP ON WEBSEAL MACHINES (IZ56412)
7.14 Provide 5.1 hostname aliasing behavior (IZ46189)
7.15 Provide ability to redirect to original host and protocol (IZ41927, IZ53257)
7.16 Provide username in macro during local response redirection(IZ50888)
7.17 Incorrect operating systems listed for use with token authentication (IZ54630)
7.18 PASSWORD CHANGE IN MULTI-DOMAIN ENV RESULTS IN NO PASSWORD CHANGE (IZ54248)
7.19 ADD CERTIFICATE SERIAL NUMBER TO XAUTHN INTERFACE (IZ66202)
7.20 WEBSEAL 6.1.0.4 HANDLING OF INVALID CHAR IN QUERY PORTION OF URL (IZ68131)
7.21 New configuration option - disable-IZ13881 (IZ13881/IZ68844)
7.22 Clarification of WebSEAL's use of Certificate Revocation Lists (IZ96632)
7.23 Clarification of Tivoli Access Manager/WebSEAL binary compatibility (IZ96633)
7.24 WebSEAL 6.1 migration does not update the non standard port as part
of virtual hostname in junction xml file. (IZ73438)
7.25 LIMIT NUMBER OF CONCURRENT REQUESTS FOR A SINGLE USER SESSION (IZ92152)
7.26 The WebSEAL Administration guide incorrectly indicates that the
[filter-request-headers] stanza does not apply to
virtual host junctions(IZ96641)
7.27 Incorrect space is provided in [aznapi-configuration] stanza
for logcfg( IZ84632 )
7.28 The DN is incorrectly specified in section "Matching the distinguished name"
(IZ96645)
7.29 Clarification of WebSEAL SPNEGO authentication limitations.(IZ86682)
7.30 New configuration option - enable-duplicate-ssl-dn-not-found-msgs (IZ55503, IZ86311)
7.31 WebSEAL Administration Guide incorrectly specifies Session Management Server Capability. ( IZ84998 )
7.32 WHEN FAILOVER COOKIE ENABLED WITH ECSSO, WEBSEAL SENDS PD-VFHOST AND PD-VF
TO THE BACKEND (IZ97177)
7.33 CR/LF IS ADDED TO IV_USER IF USERNAME IS SUBMITTED WITH CR/LF (104500)
7.34 UNCONFIGURING PARTIALLY-CONFIGURED DOMAINS CREATED WITH THE -DOMAIN OPTION
7.35 Changes to the confifuration option crl-ldap-server.
7.36 New Configuration Option - disallow-trailing-spaced-usernames (IZ96041, IZ89810)
7.37 New Configuration Option - trailing-slash-redirect-return-301 (IV06254)
7.38 How to Configure Sun PKSC11 devices for Webseal.
7.39 Document configuration option - neg-delay-fix-disable (IV07287)
7.40 New options for controlling authentications when EAI enabled. (IV15466)
7.41 New configuration option for pkmslogout header verification (IV16180)
7.42 Document configuration option - http-rsp-header (IV15101)
7.43 LD_PRELOAD SHOULD BE REPLACED WITH LD_PRELOAD_32 FOR SOLARIS EN (IV18038)
7.44 Obsoleted static HTML server response pages (IV22992)
7.45 Document new cipher values to allow a unique single cipher (IV22088)
8.0 SOFTWARE LIMITATIONS
8.1 Compatibility with WebSEAL daemon and virtual networking (IZ36908)
9.0 KNOWN PROBLEMS AND WORKAROUNDS, IF AVAILABLE
9.1 Compatibility issues for eCSSO/MAS failover cookies and Lotus Domino (IZ43559)
10.0 NOTICES
10.1 Trademarks
*****************************************************************************
*****************************************************************************
1.0 ABOUT THIS PATCH
--------------------
This patch package contains fixes for problems in the various components that
comprise the Tivoli Access Manager WebSEAL software.
1.1 Patch contents
This patch package contains:
- This README file
- Updated patch packaging for Tivoli Access Manager WebSEAL software.
1.2 Architectures
Refer to the following URL for latest information on supported operating
systems and software
http://www-01.ibm.com/support/docview.wss?uid=swg27022004
________________________________________________________________________
Additional Certifications:
Windows Server 2008/2003 Active Directory TAM610 Fix Pack 05
(Mixed Mode)
ITDS 6.3 (server Only) TAM610 Fix Pack 05
AIX 7.1 on Power 7 System TAM610 Fix Pack 05
IBM Lotus Domino 8.5 Server TAM610 Fix Pack 02
Oracle Directory Server TAM610 Fix Pack 05
Enterprise Edition 7.0 (DSEE 7.0)
Windows Server 2008 Active Directory TAM610 Fix Pack 03
Domain Service (ADDS)
Internet Explorer 7.0 (IE 7.0) TAM610 Fix Pack 04
Internet Explorer 8.0 (IE 8.0) TAM610 Fix Pack 03
________________________________________________________________________
Cryptographic Hardware Support:
(IZ44092)
WebSEAL, using GSKit for SSL communication and key management, provides
interface support for Cryptographic hardware.
The list of supported hardware devices can be found at the following location:
http://www.ibm.com/developerworks/tivoli/library/t-gsk7/index.html
At any one point in time, this URL will list those devices supported by GSKit.
Support is provided for any of these devices when used with WebSEAL.
WebSEAL can utilize cryptographic cards to provide hardware acceleration and
secure key storage for specific operations within the WebSEAL product,
but the product documentation does not provide specific information about
which operations (and in which connections) can be off-loaded.The following
DeveloperWorks article explains how to use Cryptographic card with WebSEAL:
http://www.ibm.com/developerworks/tivoli/library/t-sslwebseal/
________________________________________________________________________
1.3 Patches superseded
All patches are cumulative unless otherwise explicitly stated.
Patches superseded by this patch:
6.1.0-TIV-AWS-FP0008
6.1.0-TIV-AWS-FP0007
6.1.0-TIV-AWS-FP0005
6.1.0-TIV-AWS-FP0004
6.1.0-TIV-AWS-FP0003
6.1.0-TIV-AWS-FP0002
6.1.0-TIV-AWS-FP0001
1.4 Dependencies
IBM Tivoli Access Manager Base, Version 6.1 with patch 6.1.0-ISS-TAM-FP0009
IBM Tivoli Access Manager Web Security Runtime, Version 6.1
IBM Tivoli Access Manager WebSEAL, Version 6.1
NOTE1:
When installing patches on a particular machine, install patches for components
of IBM Tivoli Access Manager, Version 6.1, from patch
6.1.0-ISS-TAM-FP0009 and 6.1.0-ISS-AWS-FP0009
on the same machine.
For example, consider a machine with the following components:
(your machine may have more components installed)
IBM Tivoli Access Manager Runtime (PDRTE)
IBM Tivoli Access Manager Web Security Runtime (PDWebRTE)
IBM Tivoli Access Manager WebSEAL (PDWeb)
IBM Tivoli Security Utilities (TivSecUtl)
To patch the given machine, you must install PDRTE and TivSecUtl components from Patch
6.1.0-ISS-TAM-FP0009, PDWebRTE and PDWeb components
from Patch 6.1.0-ISS-AWS-FP0009 on the given machine.
A machine in a Tivoli Access Manager environment must have all components at the same
patch level. See the 6.1.0-ISS-TAM-FP0009.README for
information about how to install the relevant components of the
6.1.0-ISS-TAM-FP0009 patch.
NOTE2:
In a Tivoli Access Manager environment, install patches in the following order:
a) Policy Server machine: install patches for all components
as described in NOTE1.
b) Policy Proxy Server, if you have one in your Tivoli Access Manager environment
c) All other machines in the Tivoli Access Manager environment.
As described in NOTE1, install patches for all components,
on each machine. You can install patches in other
machines(category c) gradually. However, once the Policy Server is patched,
we strongly encourage that all other machines in the Tivoli Access Manager
environment have the same patch level installed as soon as
possible.
2.0 APARS AND DEFECTS FIXED
---------------------------
This patch corrects problems
outlined in the following sections.
2.1 Problems fixed by patch 6.1.0-ISS-AWS-FP0009
APAR IV22987
Symptom: SMS stability fix.
APAR IV13101
Symptom: WEBSEAL DOES NOT RELEASE THE FILE HANDLE AT OS LEVEL.
APAR IV22991
Symptom: Added new configuration option to require "referer" and
"host" headers to be present in order to allow a pkmslogout
request.
APAR IV03634
Symptom: WEBSEAL HTTPS FORWARD PROXY URIS NOT IGNORED.
APAR IV12457
Symptom: Post to pkmslogin.form where username and password are not
filled in is passed to backend server when root WebSEAL
junction acl permits it.
APAR IV22961
Symptom: Only when Webseal is configured to use both SMS and EAI
Some unauthenticated requests are logged as a user who
is currently logged in.
APAR IV18038
Symptom: LD_PRELOAD SHOULD BE REPLACED WITH LD_PRELOAD_32 FOR SOLARIS EN
APAR IV23012
Symptom: When Webseal gets session from SMS because of a cache miss
it immediately updates the session in SMS even though
nothing has changed.
APAR IV22962
Symptom: POST TO /PKMSLOGIN.FORM LOGS UNAUTHENTICATED USER IN
APAR IV11822
Symptom: The WebSEAL server does not set the iv_server_name header for
ping requests.
APAR IV15325
Symptom: HTTP-RSP-HEADER PARAMETER NOT RETURNING %MACRO% VALUES CORRECT
Installation Instructions
3.0 BEFORE INSTALLING THIS PATCH
--------------------------------
Before installing this patch, review the following pre-requisites and
dependencies.
3.1 Back up Tivoli Access Manager data
Before applying any maintenance, be sure to back up your system. Use
the 'pdbackup' command provided with the Tivoli Access Manager product
to back up Tivoli Access Manager-specific data.
See the "IBM Tivoli Access Manager Command Reference" guide
for information on the 'pdbackup' command.
Patch installation for PDWeb component should not over-write the existing
pdweb_start script but still it is highly recommended to backup pdweb_start
script in UNIX systems, specially if any customizations are made on this script.
Patch for PDWeb component will install pdweb_start script as pdweb_start.fixpack
so that if any update or fix made to pdweb_start script is available to Customers
to incorporate into their customized pdweb_start script.
3.2 Upgrade GSKit to Version 7.0.4.42
Upgrade the IBM Global Security Toolkit (GSKit) to version 7.0.4.42
BEFORE installing the Tivoli Access Manager packages in this patch.
The updated GSKit installation packages may be downloaded at the URL:
https://www14.software.ibm.com/webapp/iwm/web/reg/pick.do?source=gskitupdt
After downloading the updated GSKit installation packages, use the
instructions located in the 6.1.0-ISS-TAM-FP0009.README to install the upgraded
GSKit packages.
4.0 INSTALLING THIS PATCH
-------------------------
Before installing this patch, be sure that you have reviewed the
pre-requisites and have completed the backup procedure in section 3.0,
"BEFORE INSTALLING THIS PATCH".
If the Tivoli Access Manager product is distributed over multiple machines,
this patch must be applied to all WebSEAL systems within a secure domain.
If the special character support for remote filenames offered by IZ91061
is needed, redeploy query_contents.sh manually (IV06260)
See the IBM Tivoli Access Manager for e-business Administration Guide for details.
This README assumes that $PATCH (or %PATCH% for Windows) is the path to
your temporary directory.
4.1 Installing this patch on AIX systems
1. Log in to the system as root.
2. Extract the archive into a temporary directory. For the
purpose of this README, assume that the symbol $PATCH
points to this temporary directory.
3. Stop the Tivoli Access Manager processes:
/opt/pdweb/bin/pdweb_start stop
4. At the command prompt, enter the following:
installp -a -g -X -d $PATCH <package>
where <package> is:
PDWeb.RTE Specifies the Access Manager Web Security Runtime
PDWeb.ADK Specifies the Access Manager Web ADK package
PDWeb.Web Specifies the Access Manager WebSEAL Server
5. Restart the Tivoli Access Manager processes:
/opt/pdweb/bin/pdweb_start start
4.2 Installing this patch on HP-UX systems
1. Log in to the system as root.
2. Extract the archive into a temporary directory. For the
purpose of this README, assume that the symbol $PATCH
points to this temporary directory.
3. Stop the Tivoli Access Manager processes:
/opt/pdweb/bin/pdweb_start stop
4. At the command prompt, enter the following:
swinstall -s $PATCH/<package> <patch>
where <package> and <patch> are:
<package> <patch>
------------------------------ -------------
PDWebRTE000610-09.depot PDWebRTE
PDWebADK000610-09.depot PDWebADK
PDWeb000610-09.depot PDWeb
5. Restart the Tivoli Access Manager processes:
/opt/pdweb/bin/pdweb_start start
4.3 Installing this patch on Linux systems
1. Log in to the system as root.
2. Extract the archive into a temporary directory. For the
purpose of this README, assume that the symbol $PATCH
points to this temporary directory.
3. Stop the Tivoli Access Manager processes.
/opt/pdweb/bin/pdweb_start stop
4. At the command prompt, enter the following:
rpm -U <patchname>
where <patchname> is one of the following:
Linux on xSeries(R)
PDWebRTE-PD-6.1.0-7.i386.rpm
PDWebADK-PD-6.1.0-7.i386.rpm
PDWeb-PD-6.1.0-7.i386.rpm
Linux on zSeries
PDWebRTE-PD-6.1.0-7.s390.rpm
PDWebADK-PD-6.1.0-7.s390.rpm
PDWeb-PD-6.1.0-7.s390.rpm
Note:
If Tivoli Access Manager is already configured, you
might need to install with the --noscripts flag:
rpm -U --noscripts <patchname>
5. Restart the Tivoli Access Manager processes:
/opt/pdweb/bin/pdweb_start start
4.4 Installing this patch on Sun Solaris Operating Environment systems
1. Log in to the system as root.
2. Extract the archive into a temporary directory. For the
purpose of this README, assume that the symbol $PATCH
points to this temporary directory.
3. Stop the Tivoli Access Manager processes:
/opt/pdweb/bin/pdweb_start stop
4. At the command prompt, enter the following:
cd $PATCH
Solaris 9:
patchadd <package>
Solaris 10 and above:
patchadd -t <package>
where <package> is:
PDWEBRTE000610-09 Specifies the Access Manager Web Security Runtime
PDWEBADK000610-09 Specifies the Access Manager Web ADK package
PDWEB000610-09 Specifies the Tivoli Access Manager WebSEAL Server
5. Restart the Tivoli Access Manager processes:
/opt/pdweb/bin/pdweb_start start
4.5 Installing this patch on Windows systems
1. Log in to the Windows system as the Administrator.
2. Shut down the Tivoli Access Manager WebSEAL server:
a. Click 'Control Panel' > 'Services'
b. Click 'Access Manager WebSEAL Server' > 'Stop'.
c. To confirm this action, click 'Yes'.
3. Unpack the self-extracting archive into a temporary
directory. For the purpose of this README, assume that
%PATCH% points to this temporary directory.
4. Change to the patch directory:
cd %PATCH%
For each component to apply service to, run the following command:
<component directory>/Disk Images/Disk1/setup.exe
List of component directory names.
PDWebRTE Specifies the Access Manager Web Security Runtime
PDWebADK Specifies the Access Manager Web ADK package
PDWeb Specifies the Tivoli Access Manager WebSEAL Server
Note: If you must reboot your system to
complete this installation, you might subsequently encounter a
problem running the Web Portal Manager to access the console. For example,
you might need a system reboot to overcome a shared DLLs problem.
If this happens, confirm that the WebSphere service is
running. The WebSphere service is installed in manual startup
mode and might not be started after a reboot.
5. Restart the Tivoli Access Manager WebSEAL server:
From the Windows Start menu, click:
a. 'Settings' > 'Control Panel' > 'Administrative Tools' > 'Service'.
b. Click 'Access Manager WebSEAL Server' > 'Start'.
c. Click 'IBM WS AdminServer' > 'Start'.
Problems (APARS) fixed
Problems (APARS) fixed
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg24033154