Sun Java System Access Manager 7.1 Release Notes
About Sun Java System Access Manager 7.1
Access Manager 7.1 Patch Releases
Sun Java System LDAP JDK Patches
Access Manager 7.1 Patch 6 WAR File Issue on GlassFish 2.2.x (13730542)
Time to Live (TTL) is implemented for the Service Management (SMS) cache (6973683)
Retry mechanism is implemented in the PLL server (6963531)
Access Manager 7.1 patch Readme lists the required LDAP JDK patches (6959325)
New Features and Changes in Access Manager 7.1 Patch 4
New property prevents "Too many authentication attempts" error (6883136)
New property sets idle time out for policy agent sessions (6697260)
Access Manager session cookies can be marked as HTTPOnly (6843487)
ampassword utility has new options to hash and encrypt a password (6850818)
CDC Servlet inserts custom HTTP response header (6800246)
Changes to the updateschema.sh script (6870576)
Known Issues in Access Manager 7.1 Patch 4
updateschema.pl script fails with older version of ldapjdk.jar (6934848)
New Features and Changes in Access Manager 7.1 Patch 3
Sun Java System LDAP JDK Patches are Available
Running the updateschema Script is Required
Limitation is Removed for Creation of Data Store Authentication Module Instance in Legacy Mode
Backward Compatibility Issue Between Access Manager 7.1 and amclientsdk.jar is Fixed
Sun Java Web Console 3.1 Patches Are Required
New Property Prevents Sessions From Being Destroyed After Session Upgrade
New Property Allows SSO Token Restriction Other Than an IP Address
Distributed Authentication UI Server Works With Basic Authentication
SecurID Authentication Support is Added for Linux Systems
Known Issues in Access Manager 7.1 Patch 3
Single WAR Access Manager Deployment Cannot Use https Protocol Handler (6810092)
If config Directory Path on Windows Contains a Space, Patch 3 updateschema.pl Fails (6852463)
Hard-coded Path Should be Removed from Patch 3 updateschema.pl Script on Windows (6852467)
Access Manager 7.1 on WebLogic Server requires new ldapjdk.jar File (6774634)
Creation of Data Store authentication module instance fails in Legacy mode (6764919)
Sub-realm administrator can log in as amadmin in root realm (6761627)
New com.sun.identity.appendSessionCookieInURL property (6740071)
Backward compatibility issue between Access Manager 7.1 and amclientsdk.jar File (6754863)
Access Manager JAR files should include version number in MANIFEST.MF file (6693152)
Security permission is missing for CRL validation (6673538)
SecurID authentication is supported on Solaris x86 systems (6621802)
Access Manager Key Provider needs option to use types other than JKS format (6603228)
Delegation privileges cannot be defined for a filtered role (6486843)
Persistent cookie support is added (6600325)
Support for specific application idle session timeout values
Web Proxy Agent 2.2-01 in CDSSO mode does not work with Access Manager 7.1 Patch 1 (CR 6611841)
Distributed Auth UI does not work with a WebSphere Application Server 5.1.1.12 server (CR 6625928)
Password file exposed in a temporary directory after Patch 1 re-deployment (CR 6640377)
LDAP Failover not working properly (CR 6611627)
amconfig does not tag-swap and re-register the monitoring framework descriptor (CR 6636710)
amtune does not work if installed in a non-default directory (CR6640673)
amtune does not delete the world readable password file (CR 6640672)
amsfo.pl does not work for Windows (CR 6629189)
Not able to deploy WAR file generated by patch.bat if -l option is used for Windows (CR 6636474)
amserveradmin.bat throwing errors for Access Manager 7.1 Patch for Windows (CR 6631526)
Access Manager classpath not pointing to xml.sec.jar in Patch 1 for Windows (CR 6644461)
Post authentication plug-in supports Microsoft SharePoint (CR 6541695)
Retrieving schema from Active Directory data store fails (CR 6542686)
Access Manager supports the JDK 1.5 HttpURLConnection setReadTimeout method (CR 6536635)
G11n: CLI commands amhasetup and amserver are not localized (CR 6567135)
G11n: The User sub-tab incorrectly translated in French language (CR 6633529)
Web Security Service Issues Fixed
6543625 -- UserName token authentication can authenticate against a configured LDAP module
6543626 -- SOAPRequestHandler returns the SSOToken set in the Subject
6559603 -- Boolean configuration flag for "request" signing
6570021 Encryption supports SOAP messages with extra spaces.
Removed ACIs that cause unnecessary performance degradation (CR 6484947)
6.3-based console online help not displayed win Application Server 8.2 (CR 6587213)
Multiple passwords not required for amtune script
amtune-os will not run in local zone
Pre-Installation Considerations
Installing and Configuring Access Manager
Patch Installation Instructions
Patch Installation Instructions For Solaris Systems
Patch Installation Instructions For Linux Systems
Patch Installation Instructions For Windows Systems
Access Manager 7.1 Patch 1 Single WAR Deployment
New Container Versions Supported
Considerations for Single WAR Deployment with WebSphere 6.1
Considerations for Single WAR Deployment with Weblogic 9.2
Applying Patch 1 for Single WAR Deployment
Known Issues with Patch 1 WAR Deployment
Modifying SAML source ID in WAR deployment for Access Manager 7.1 Patch 1 (CR 6582972)
amAdmin from amAdminTools.zip Single WAR does not work with IBM JDK WebSphere 6.1 (CR 6618861)
Java ES Monitoring Framework Integration
Single Access Manager WAR file deployment
Deprecation Notification and Announcement
Hardware and Software Requirements
General Compatibility Information
AMSDK intersystem incompatibility with Access Manager server
Upgrade not supported for Access Manager HPUX version
Java ES Silent Installation Using a State File
"Configure Now" Installation Option in Graphical Mode
"Configure Now" Installation Option in Text-Based Mode
"Configure Later" Installation Option
Single WAR Configurator fails against DS (6562076)
Multi-server configuration of AM Single WAR on same host throws exception (6490150)
Required Services not supported in Access Manager 7.1 Console in Realm Mode (6615838)
Access Manager Single Sign-On fails on Universal Web Client (6367058, 6429573)
StackOverflowError occurs on Web Server 7.0 running in 64-bit mode (6449977)
Incompatibilities exist in core authentication module for legacy mode (6305840)
Delegated Administrator commadmin utility does not create a user (6294603)
Delegated Administrator commadmin utility does not create an organization (6292104)
Incorrect console redirection behind a load balancer (6480354)
Password Reset service reports notification errors when a password is changed (6455079)
Account Locking feature fails to send email notification when the user's account is locked (6760137)
Platform server list and FQDN alias attribute are not updated (6309259, 6308649)
Data validation for required attributes in the services (6308653)
Document workaround for deployment on a secure WebLogic 8.1 instance (6295863)
The amconfig script does not update the realm/DNS aliases and platform server list entries (6284161)
Default Access Manager mode is realm in the configuration state file template (6280844)
In Realm mode, creation of a new group generates Group Admin with ACIs that never get used (6485695)
New Access Manager Console cannot set the CoS template priorities (6309262)
Old console appears when adding Portal Server related services (6293299)
Add ContainerDefaultTemplateRole attribute after data migration (4677779)
Clients do not get notifications after the server restarts (6309161)
SDK clients need to restart after service schema change (6292616)
Attribute uniqueness broken in the top-level organization for naming attributes (6204537)
System creates invalid service host name when load balancer has SSL termination (6245660)
Using HttpSession with third-party web containers
Debug error occurs on Access Manager startup (6309274, 6308646)
Error displayed when performing AMIdentity.modifyService (6506448)
Group members don't show up in selected list (6459598)
Access Manager Login URL Returns Message "No such Organization found" (6430874)
Sub-org creation not possible from Access Manager when using amadmin (5001850)
The amconfig script fails when SSL certificate is expired. (6488777)
Clientsdk samples directory contains unwanted makefile (6490071)
JVM problems occur when running Access Manager on Application Server (6223676)
Access Manager auto configuration failed when installing on zh_TW and es locales (6515043)
HP-UX needs gettext binary with AM while installing Java Enterprise System full stack (6497926)
Logout error occurs in Federation (6291744)
Administration console components displayed in English in the zh locale (6470543)
Current Value and New value are incorrectly displayed in the console (6476672)
Policy condition date must be specified according to English custom (6390856)
Removing UTF-8 is not working in Client Detection (5028779)
Multi-byte characters are displayed as question marks in log files (5014120)
Missing information when configuring Access Manager in SSL mode (6660610)
Document the roles and filtered roles support for LDAPv3 plug-in (6365196)
Document unused properties in the AMConfig.properties file (6344530)
Document how to enable XML encryption (6275563)
Access Manager 7.1 Documentation Collection
Support for the Java SecurID Authentication Module
Access Manager in an Application Server Cluster
The following combinations are not compatible between the AMSDK and the Access Manager server in the following Java Enterprise System releases:
Java Enterprise System 2004Q2 AMSDK is not compatible with the Java Enterprise System 5 Access Manager server (this release).
Java Enterprise System 5 AMSDK (this release) is not compatible with the Java Enterprise System Access Manger 2004Q2 (formerly Identity Server) server.
There is no support for an upgrade path from Access Manager 7 2005Q4 to Access Manger 7.1 (this release) for the HPUX version.
If you are installing Access Manager with any of the following products, you must select the Access Manager Legacy (6.x) mode:
Sun Java System Portal Server
Sun Java System Communications Services servers, including Messaging Server, Calendar Server, Instant Messaging, or Delegated Administrator
You select the Access Manager Legacy (6.x) mode, depending on how you are running the Java ES installer:
To determine the more for an Access Manager 7.1 installation, see Determining the Access Manager Mode.
Java ES installer silent installation is a non-interactive mode that allows you to install Java ES components on multiple host servers that have similar configurations. You first run the installer to generate a state file (without actually installing any components) and then edit a copy of the state file for each host server where you plan to install Access Manager and other components.
To select Access Manager in Legacy (6.x) mode, set the following parameter (along with other parameters) in the state file before you run the installer in silent mode:
... AM_REALM = disabled ...
For more information about running the Java ES installer in silent mode using a state file, see the Chapter 5, Installing in Silent Mode, in Sun Java Enterprise System 5 Installation Guide for UNIX.
If you are running the Java ES Installer in graphical mode with the “Configure Now” option, on the “Access Manager: Administration (1 of 6)” panel, select “Legacy (version 6.x style)”, which is the default value.
If you are running the Java ES Installer in text-based mode with the “Configure Now” option, for Install type (Realm/Legacy) [Legacy] select Legacy, which is the default value.
If you ran the Java ES Installer with the “Configure Later“ option, you must run the amconfig script to configure Access Manager after installation. To select Legacy (6.x) mode, set the following parameter in your configuration script input file (amsamplesilent):
... AM_REALM=disabled ...
For more information about configuring Access Manager by running the amconfig script, refer to the Sun Java System Access Manager 7.1 Administration Guide.
To determine whether a running Access Manager 7.1 installation has been configured in Realm or Legacy mode, invoke:
http(s)://host:port/amserver/SMSServlet?method=isRealmEnabled
Results are:
true: Realm mode
false: Legacy mode
The following table shows the compatibility of Policy Agents with the Access Manager 7.1 modes.
Table 4 Policy Agents Compatibility With Access Manager 7.1 Modes
|