OBSOLETE Patch-ID# 120954-02

NOTE:
***********************************************************************
READ THE TERMS OF THE AGREEMENT ("AGREEMENT") IN THE LEGAL_LICENSE.TXT
FILE CAREFULLY BEFORE USING THIS SOFTWARE. BY USING THE SOFTWARE, YOU
AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE
TERMS, PROMPTLY DESTROY THE UNUSED SOFTWARE.
***********************************************************************

Keywords: access manager security
Synopsis: Obsoleted by: 120954-03 AM 7.0: Sun Java System Access Manager 2005Q4
Date: May/17/2006


Install Requirements: NA                      
                      
Solaris Release: 8 9 10

SunOS Release: 5.8 5.9 5.10

Unbundled Product: Sun Java System Access Manager

Unbundled Release: 7.0

Xref: This patch available for i386 as patch 120955-02, for Linux as patch Patch-ID# 120956-02

Topic: Sun Java System Access Manager

Relevant Architectures: sparc

BugId's fixed with this patch: 6202135 6204679 6236892 6244578 6246905 6269853 6269858 6273148 6281358 6282777 6283582 6289589 6291287 6292616 6293673 6293720 6294440 6294618 6295075 6295078 6295081 6295524 6295834 6296108 6298433 6298462 6299621 6303917 6303975 6305268 6306605 6306833 6307920 6308982 6309830 6309907 6310356 6311985 6313117 6314342 6318296 6319028 6320046 6320475 6321128 6323367 6323608 6324349 6325333 6325343 6326050 6326634 6327691 6327836 6328018 6328362 6328396 6330306 6330678 6330679 6330685 6330687 6330747 6333870 6334633 6335137 6336904 6337063 6337106 6337160 6337701 6338418 6338582 6340418 6340625 6340918 6341686 6341737 6342097 6342223 6342313 6342725 6343531 6343534 6345189 6345362 6346904 6346908 6346918 6347568 6348888 6349253 6349959 6349962 6350126 6350573 6351524 6352008 6352076 6354073 6356127 6356473 6356670 6356715 6356879 6357625 6359266 6360631 6361191 6362232 6362297 6363157 6363399 6366215 6366219 6368218 6369227 6369341 6369414 6369745 6370252 6370350 6370360 6371584 6371762 6373302 6373328 6373458 6373599 6374846 6376650 6380680 6384339 6384379 6385696 6385710 6385729 6387712 6388549 6396409 6396494 6396913 6397102 6402490

Changes incorporated in this version: 6330306 6342097 6345189 6351524 6244578 6360631 6319028 6282777 6337063 6293673 6369414 6357625 6299621 6349253 6352008 6269858 6328018 6340918 6348888 6349962 6356127 6359266 6361191 6362232 6362297 6366219 6369341 6370252 6370350 6370360 6371584 6371762 6373328 6373458 6374846 6376650 6373302 6368218 6369745 6350126 6380680 6269853 6354073 6320046 6385729 6340625 6384339 6384379 6385696 6343534 6388549 6373599 6369227 6385710 6396409 6396913 6397102 6396494 6387712 6202135 6236892 6283582 6363157 6402490

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

  /etc/opt/SUNWam/config/AMConfig.properties.template 
  /etc/opt/SUNWam/config/serverconfig.xml.template 
  /etc/opt/SUNWam/config/xml/template/idRepoService.xml 
  /opt/SUNWam/Makefile.distAuthUI 
  /opt/SUNWam/README.distAuthUI 
  /opt/SUNWam/amauthdistui.war 
  /opt/SUNWam/amclient.war
  /opt/SUNWam/bin/amas70config 
  /opt/SUNWam/bin/amas81config 
  /opt/SUNWam/bin/amsdkconfig 
  /opt/SUNWam/bin/amsfoconfig 
  /opt/SUNWam/bin/amsvcconfig 
  /opt/SUNWam/bin/amtune/amtune-directory.template 
  /opt/SUNWam/bin/amtune/amtune-env 
  /opt/SUNWam/bin/amtune/amtune-identity 
  /opt/SUNWam/bin/amtune/amtune-os 
  /opt/SUNWam/bin/amtune/amtune-prepareDSTuner 
  /opt/SUNWam/bin/amtune/remacis.ldif 
  /opt/SUNWam/bin/amutils 
  /opt/SUNWam/bin/amwas51config 
  /opt/SUNWam/bin/amwl81config 
  /opt/SUNWam/bin/amws61config 
  /opt/SUNWam/console.war 
  /opt/SUNWam/docs/am_public_javadocs.jar 
  /opt/SUNWam/dtd/remote-auth.dtd 
  /opt/SUNWam/include/am.h 
  /opt/SUNWam/include/am_log.h 
  /opt/SUNWam/include/am_map.h 
  /opt/SUNWam/include/am_policy.h 
  /opt/SUNWam/include/am_properties.h 
  /opt/SUNWam/include/am_string_set.h 
  /opt/SUNWam/include/am_types.h 
  /opt/SUNWam/include/am_web.h 
  /opt/SUNWam/lib/am_logging.jar 
  /opt/SUNWam/lib/am_sdk.jar 
  /opt/SUNWam/lib/am_services.jar 
  /opt/SUNWam/lib/amclientsdk.jar 
  /opt/SUNWam/lib/libamsdk.so.2 
  /opt/SUNWam/locale/LC_MESSAGES/amsfoconfig.mo 
  /opt/SUNWam/locale/amAuth.properties 
  /opt/SUNWam/locale/amAuthUI.properties 
  /opt/SUNWam/locale/amConsole.properties 
  /opt/SUNWam/locale/amIdRepoService.properties 
  /opt/SUNWam/locale/amPolicy.properties 
  /opt/SUNWam/locale/amPolicyConfig.properties 
  /opt/SUNWam/samples/csdk/README.TXT 
  /opt/SUNWam/samples/csdk/am_log_test.c 
  /opt/SUNWam/samples/csdk/am_sso_test.c 
  /opt/SUNWam/services.war 
  /usr/share/lib/identity/console-war/WEB-INF/lib/am_console.jar 
/opt/SUNWam/share/bin/amtune/amtune-utils 

Problem Description:

120954-02
=========
6330306 Access Manager SDK HttpsURLConnection uses a plain socket when retrying
a failed connection
6342097 When Cert CRL is enabed, too many LDAPConnections open and never get closed, this causes memory leak
6345189 Web agent has to get right naming table even when it is configured with multiple LBs
6351524 LDAP search time during policy evaluation is too long when there are thousands users in a group
6244578 AM should warn user that the browser cookie support is disabled/not available
6360631 Session not terminated through session management
6319028 Clientsdk does not handle exceptions in the SOAP message
6282777 Implementing TTL on amsdk cache
6337063 Adding a sub-organistation using Access Manager 7.0 in JES4 breaks the gateway and Access Manager
6293673 Need to retain the original session information when sending out session timeout notification
6369414 Not able to get session property in token listener callback after timeout
6357625 ID-FF 1.1 AuthContext includes AuthContextComparison
6299621 Legacy mode:Get Invalid user's location when login as an admin user that created from newconsole
6349253 PostProcessor and a custom policy condition classes, set attibutes to the SSOToken, they are lost
6352008 SOAP object does not set the SOAPAction header when transported over HTTP(s) in the SAML request
6269858 AM SDK Cache/ID Repo Cache - Cache size grew substantailly b.w 6.3 and 7.0
6328018 Authentication instance still displayed after being deleted
6340918 Dynamic group/Membership Filter is not updated after saving the changes
6348888 SDK does not check if the IDRepo Plugin supports role memberships
6349962 After removing "AMSDK" plugin in root realm, "amadmin" cannot view the administration page
6356127 Remote Auth does not work if Access Manager instances are running behind a non-sticky load balancer
6359266 DistAuth Fails in the session upgrade scenario
6361191 Trouble to deploy the war of Distributed Authentication on BEA WebLogic
6362232 AM 7.0 patch 1: Client SDK installations cannot be patched
6362297 Wrong entity ID is sent in case of failed single logout
6366219 Policy Evaluation failure with cn as search attribute
6369341 Need to set Attributes passed down from IDP in Assertion as properties on SSO token on SP side
6370252 Distributed Auth after patch1: Click to relogin after logout gives 500 error
6370350 Dist Auth Not working after failed auth - unable to clear authContext /unable to invalidate session
6370360 Attribute based authZ - add LDAPFilterCondition support to AccessManager
6371584 Distributed Auth after patch 1 cannot loadbalance across dist-auth servers
6371762 AM7 console exception for user with multiple roles, user cannot use console
6373328 Provide correct notification URL in the Makefile.distAuthUI
6373458 Unable to modify "iplanet-am-session-quota-limit" for user in ldapv3 data store
6374846 AM 7.0 Group Members filter only works with *
6376650 New authentication services are displayed in the the global (config) section
6373302 Unable to load /portal web application after AMSDK upgrade
6368218 Login fails since Auth throws Null Pointer Exception
6369745 Auth framework needs to append suffix to user principal in case of ignore profile
6350126 Add "User profile" core authn parameter to session
6380680 Destroy Session is not working in LB setup for AM7.0
6269853 User id is null when user id or password is null
6354073 Certificate Mapping authentication module is not flexible
6320046 User name is displaying as 'null' in the Lockout notification mail
6385729 NPE in 7.0 if Federated Identity where in IDP and SP act simultaneously
6340625 JVM option java.util.logging.manager=com.sun.identity.log.LogManager being set in Websphere's xml
6384339 Policy decision returning more than expected ldap attributes 
6384379 LDAP atttribute names returned from AM are in lower case 
6385696 Existing and new IDP's and SP's	are not visible
6343534 AuthN,SSO and policy C APIs broken on Solaris platform
6388549 Server hangs forever when one of the LDAPv3 plugin config is incorrect
6373599 Need to modify session code to migrate AM SDK apis to IDRepo interfaces
6369227 Cert auth module maps full cert subject DN to LDAP attribute value
6385710 Single Logout Request causes Server Error
6396409 LDAPv3 datastore against sun DS keeps looping the psearch connections
6396913 ldapv3 getAttributes call fails if naming attribute is multivalued, resulting in login failure
6397102 LDAP Connections abandoned by LDAPv3 plugin if wrong user password is specified for datastore 
6396494 Removing users from static groups with amadmin fails
6387712 Notification requests can cause a build up of close_wait connections
6202135 Auth taglib target attribute incorrectly quoted
6236892 Image/Text place holder while CDCServlet is processing the AuthNResponse after Login
6283582 Num of login failures are not shared across AM instances
6363157 Need to disable unnecessary persistent searches which affect performance
6402490 DSTModify Operation throws exception 
 
120954-01
=========
6289589 Incorrect ldap server info is causing the UI not to display the LDAP related subjects in console
6295075 legacy: Reset button does not work for Client Detection/edit page
6204679 amadmin failed with no specific error message for a valid xml file but with uppercase suffix
6273148 Could not add/delete/modify discovery service resource offerings
6246905 Wrong error msg for Single Sign-On Failure Redirect URL
6291287 Policy UI for condition by auth level displays wrong values for auth level
6310356 amwas51config incorrectly using WL8_PROTOCOL when setting values for naming and notification URL's
6298462 amsfoconfig fails on linux 2.1 server
6298433 amsfoconfig has incorrect permissions on linux 2.1
6292616 AM sdk clients need restart after svc schema change
6305268 Problem with idrepo ldapv3 plugin and openldap
6308982 Need population of module specific customized error message and error template via Auth remote API
6309830 Adding more amadmin properties in the console is changing the amadmin user password
6296108 realm: Exception error when selecting a user from a new Realm contains the default v3 info
6313117 Client SDK (amclientsdk.jar) throws error messages that permission denied for reading config data
6294440 LDAP authentication module can prompt user to change their password prematurely
6320475 com.iplanet.am.session.client.polling.enable on server side must not be true
6306605 AM does not deploy on WebSphere with non-default URI's
6318296 Can't remove Session Service configuration for a subrealm
6311985 CDC: CDC Servlet redirecting to the invalid login page when Policy condition is specified
6325343 amclientsdk.jar doesn't handle localized content in utf-8 properly
6325333 Request to add InternalSession.getObject/InternalSession.setObject() methods
6309907 postprocess plugin defined for a Named config does not execute for role based auth
6328396 IDrepo Gives exception while storing new attribute with LDAPV3 plugin
6324349 JAXRPC classcast exceptions cause initialization failure for portal webapp
6295524 amwl81config: typo prevents wireless_rendering.jar and wireless_rendering_util.jar from being used
6306833 Modification notification mail is sent when other attribute is changed
6303975 Memory leak in distributed Auth
6330678 IdRepo doesn't cache sub entries of ou=users,ou=default,ou=globalconfig,ou=1.0,ou=sunidentityreposit
6330687 There are 4 directory searchs for each authentication
6314342 Unnecessary object creation of Notification/NotificationSet in session service cause perf. problem
6281358 AM legacy mode: Deletion Notification does not work
6293720 legacy: Created groups is not placed under Groups container
6294618 After first click on Directory Management tab, sub-tabs do not appear
6295081 legacy: Should prevent Orgs, Containers, People Con, user,roles to be created under grp Container
6295834 Changing password via console with debug 'message' logs changed password in amProfile
6303917 Deprecating SiteAttributeMapper overwrites new PartnerSiteAttributeMapper in SAML
6321128 Special characters (&) in SAML statements should be encoded
6323367 AM70 does not allow customers to get the uuid through command line or console
6323608 AuthContext object instances/bytes linger/leak even after user logouts and session/idle timeouts
6326050 Session event should be sent when the pre-authentication session times out
6326634 SAML: Duplicate Trusted Partner console edit errors
6327691 UrlAccessAgent SSOToken is expiring as the Application module does not return the special user DN
6327836 Distributed Authentication service to be not required to stick to one server for LB deployments
6328362 Federation performance is slow campared to 6.3
6330679 Auth model cannot be created during to lack of page session data
6330685 Include AM Server healthcheck JSP within services.war
6330747 Unable to assign Named Config(created in sub-realm) to a role
6333870 Adding a DNS/Aliases name to an organization from the Access Management will give LDAP error
6335137 Session notification is unnecessarily being sent to AM server itself
6337106 Ability to disable DNS Lookup
6337701 Realm/Subjects/Role doesnot contains a General page
6338418 Universal ID disappeard when Save button is pressed
6338582 SSO fails for federation
6340418 Logout fails after federation termination
6341737 AMSDK call to AMUser.getAttributesByteArray() returns empty if called after AMUser.getAttributes()
6342313 Login as an org admin user when click on Directory Manager link will get user page
6349959 Adding "role=read,create,edit,delete" to LDAPv3 IdRepo plugin causes IdRepo to fail
6343531 Deleting service leaves amconsole unusable and service partially deleted
6352076 WL8.1 SP4: Access denied while accessing any resource first time in cdsso setup
6356879 amadmin gives access to AM even with invalid user/password
6350573 Distributed Authentication Does not work when deployed in Production mode in Bea WebLogic Server
6334633 Inconsistent AM-SDK Global Schema Cache behaviour
6346904 Session Polling could hang the server under high load
6346908 Session Destroy or logout on the client sdk does not work properly
6342223 Session cache has no way to cleanup client cache when notifications are missed
6341686 Adding all groups to a user get error " Error [Ljava.lang.Object;@1d8be60"
6336904 Authentication service should not be required to stick to one server for LB deployments
6295078 legacy:Cannot delete an organization that created under a container
6307920 Special characters (&) in SAML statements should be encoded
6345362 Server failed to start if com.sun.am.event.connection.idle.timeout is set to a non zero value
6366215 IDRepo unable to search based on "cn" - LDAPv3Repo unable to search with respect to naming attribute
6363399 Policy evaluation fails for LDAPV3 filtered role
6342725 idrepo cache not updated
6356473 Gateway does not come up on a separate node after installation
6346918 cookie name property is missing in AMClient.properties since AMClientSDK is not working
6347568 amclientsdk webapp is not working the amclientsdk.jar file is missing in the war file built.
6356670 java.lang.NullPointerException in amSecurity debug logs
6356715 Auth Remote API gives error due to failure in retrieval of internal session from session ID on server
6337160 IdRepo calls SMS for every operation, leading to performance issues

Patch Installation Instructions:
--------------------------------
 
Backup following files:
 
For Solaris 8 and 9 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
	example# patchadd /var/spool/patch/120954-02
 
The following example removes a patch from a standalone system:
 
	example# patchrm 120954-02
 
For additional examples please see the appropriate man pages.
 
After the patch is installed or removed, AM applications need to be
redeployed. Please refer to release notes rel_notes.html for more
details.

Special Install Instructions:
-----------------------------
 
For Access Manager Server specific patch information and patch installation
instructions, refer to the included patch release notes file, rel_notes.html,
located inside the patchID directory once the file has been unzipped.
 
The patch release notes include must read information including installation
information, redeployment instructions, instructions on how to deal with
customized auth jsp files and workarounds for known issues and limitations.
 
The following 2 commands need to be run after 7.0 patch2 is
successfully installed and configured.
 
cd <DirectoryServerBase>/mps/serverroot/shared/bin
./ldapmodify -h <DirectoryServerHost> -p <DirectoryServerPort> -D "cn=Directory Manager" -w <DirectoryMangerPassword> -a -f /etc/opt/SUNWam/accountLockout.ldif
$BASEDIR/bin/amadmin -u amadmin -w amadmin_password -t /etc/opt/SUNWam/accountLockoutData.xml
 
DOCUMENTATION ERRORS
There are 2 minor errors in the rel_notes.html which will be corrected
in the next patch release
 
1) In the special instructions for
   # 6283582: Num of login failures are not shared across AMs 
 
there is an error. The second 'amadmin' command to deploy the
accountLockoutAuthServiceSchema.xml should not be executed.
 
# cd <DirectoryServerBase>/mps/serverroot/shared/bin
# ./ldapmodify -h <DirectoryServerHost> -p <DirectoryServerPort> -D "cn=Directory Manager" -w <DirectoryMangerPassword> -a -f /etc/opt/SUNWam/accountLockout.ldif 
# $BASEDIR/bin/amadmin -u amadmin -w amadmin_password -s /etc/opt/SUNWam/accountLockoutAuthServiceSchema.xml      ==> This is an erroneous step
# $BASEDIR/bin/amadmin -u amadmin -w amadmin_password -t /etc/opt/SUNWam/accountLockoutData.xml
 
2) Under the Bug #6254355, it says
   To update the WAR files:
 
# cd $BASEDIR/$PRODUCT_DIR
# jar -uvf amconsole.war <$path/$modified file>
# jar -uvf amservices.war <$path/$modified file>
# jar -uvf ampassword.war <$path/$modified file>
 
The file names should be console.war, services.war and password.war respectively,
and not amconsole.war, amservices..war and ampassword.war as mentioned in the
rel_notes.html

README -- Last modified date:  Thursday, August 24, 2006

