Version 10.1.0 Fix Pack 1 delivers the following enhancements:

• Orchestration Query Language ( OQL)
• Advanced password encryption
• Enhancing authentication using JSON Web Tokens
• Enhancing command-line authentication using API Keys
• Installing the agent on IBM i with a user different from QSECOFR
• Orchestration CLI

Changed features and feature capabilities

A list of features changed since the previous release.

The following features have changed or have been introduced or removed since the previous release:

REST APIs documentation automatically integrated into the product documentation

Information about REST APIs is automatically extracted from the code and integrated into the documentation at IBM Workload Scheduler API for easier reading and increased retrievability.

File Proxies now selected randomly in the Managed File Transfer integration

By default, the integration uses the File Proxy specified by the dynamic domain manager. You can also optionally define a list of preferred File Proxies to be used instead of the default list.

The File Proxy is selected randomly in the list provided by the dynamic domain manager. If you provided a custom list, the random selection is performed only on your list.

The random selection mechanism ensures higher tolerance for peaks in workload and workstation failures. For more information, see File Transfer Integration on Automation Hub.

Default storing mechanism of job log changed

When you perform a fresh installation, by default the job log is stored in memory instead of being stored in a file, as in the previous releases. This ensures compliance with the PCI standard. For more information, see the section about log files and archived files in Administration Guide.

Enhanced security with the conn_verify property

You can now optionally set the conn_verify property to 1 or 2, so that the agent must provide valid certificates in order to establish an SSL connection. The default value is 0, which means that no verification is performed on certificates.

Hostname verification for File Proxy

You can now optionally enable a check on the hostname defined for the certificates used by File Proxy. To enable the verification, create the Java system property named wa.fileproxy.enforceSSLhostnameVerify and set it to true.

Hostname verification for the mail sender plug-in

You can now optionally define the MAILPLUGIN_ENABLE_HOST_VERIFICATION property in the TWSConfig.properties file to enable the verification of the hostname of the SMTP server. If you set the property to yes, hostname verification is enabled, if you set it to no, no verification is performed. The default value for fresh installations is yes.

Supported WebSphere Application Server Liberty Base versions

IBM Workload Scheduler Version 10.1 Fix Pack 1 was formally tested by using WebSphere Application Server Liberty Base 22.0.0.10 and 22.0.0.11. The minimum required WebSphere® Liberty version to successfully install the fixpack is 22.0.0.3 or later.

Higher security for job integrations

The Verify host name check box is selected by default in some integrations. Starting from version 10.1 Fix Pack 1, to increase the security standard provided by the product, this selection starts a check on the data contained in the keystore file. Ensure you provide the correct path and credentials to the keystore file in the Certificates section for the following integrations:

• JSR 352 Java Batch
• Restful Job Management
• Job Stream Submission
• Variable Table

If the information in the Credentials section is not correct, this causes the job to fail with an error similar to the following:

AWKJMJ041E An error occurred during the Job submission. The error was "AWKSPI006E Keystore authentication failed. The error message is "No certificates provided, cannot verify the hostname."

If your integrations fail after upgrading to Fix Pack 1, you have the following options:

• deselect the Verify host name check box.
• provide the correct path and credentials to the keystore file.

Satisfying Requests for Enhancements (RFEs)

RFEs give customers the opportunity to collaborate directly with the product development team and other users. The team prioritizes and develops new product features based on proposals made by customers. IBM Workload Scheduler V10.1 Fix Pack 1 delivers the following RFEs:

RFE 149367 - Installation of dynamic agents on Windows operating systems using Local System Account

You can now install dynamic agents on Windows operating systems without providing a specific user. This means that you no longer need to provide twsuser credentials to the operator performing the installation. Moreover, the password no longer expires, ensuring a smooth running of your jobs. For more information, see the section about agent installation parameters in IBM Workload Scheduler: Planning and Installation.

RFE 69917 - Interactive jobs supported on dynamic agents installed on Windows operating systems

You can now determine the behavior of native and executable jobs starting interactive programs on dynamic agents installed on Windows operating systems. Interactive programs run only if the job user has an active session open when the job runs. If there is no active session for the job user, the job behavior is defined by the new RunInteractiveJobOnInvalidSession property in the JobManager.ini file. You can set the property to true to enable jobs to start interactive programs even if there is no active session for the job user. Alternatively, set the property to false to prevent jobs from starting interactive programs if there is no active session for the job user. This feature was already available for fault-tolerant agents and is now also available by default for dynamic agents. For more information about enabling and disabling this feature, see the section about configuring properties of the native job launcher [NativeJobLauncher] in Administration Guide.

For example, consider a job which consists of both interactive instructions (for example, using a text editor), and batch instructions, which run in background when the job is launched. If you set the RunInteractiveJobOnInvalidSession property to true, batch instructions can run even if the interactive part is not displayed because the user does not have an active session at the moment.

RFE 60060 - dynamic agents to track the workload on the local system

This capability is now available using the Orchestration CLI, as described in the section in this readme about Orchestration CLI.

To view a complete list of RFEs, new, planned, and delivered, see: RFE online community.

Resolved Common Vulnerabilities and Exposures (CVE)

CVE-2020-36518

CVE-2022-42003

CVE-2022-42004

CVE-2022-36033

CVE-2022-27664

CVE-2022-32149

CVE-2022-3171

This section lists APARs and internal defects solved by Fix Pack 1.

This fix pack delivers support for scheduling objects in folders, including workstations. When monitoring workstations from a back-level agent workstation, the output displays the workstation unique identifier and not the workstation name for those workstations that were defined in folders different from the root folder. To identify the corresponding workstation name, run the conman command using the showid filter, showcpu ;showid, from an updated agent workstation.

The following are software limitations and workarounds that affect IBM Workload Scheduler version 10.1.0 Fix Pack 1. For a list of known problems and limitations documented for the V10.1.0 General Availability release, see the product Release Notes at IBM Workload Scheduler Release Notes.

WebSphere Liberty minimum required version

the minimum required WebSphere Liberty version to successfully install the fixpack is 22.0.0.3.

IBM Common Inventory Technology scanner ceases HP support

IBM Common Inventory Technology scanner does not support HP operating systems starting from January 1st 2023. The IBM Workload Scheduler dynamic agent utilizes IBM Common Invetory Technology to collect system configuration data used in the definiton of dynamic pools. For customers using dynamic agents on HP and dynamic pools, we strongly recommend to review dynamic pool workstation definitions. If their requirements are based on filesystems, especially network or remote filesystems, we strongly recommend to remove the HP dynamic agent from the dynamic pool, since management of the requirements may not be accurate.

APAR IJ39106

When installing using the keystore and truststore files, customers are required to manually configure these files prior the installation setup. If providing custom .jks files, it is the customers responsibility to provide such .jks files equipped with all the CA certificates they need in the truststore. For more information see Installing the master domain manager and backup master domain manager.

Agent Installation and Custom Certs on Upgraded MDM

If you plan to install a dynamic agent which uses custom certificates and connect it to a master domain manager which uses custom certificates and has been updated to version 10.1 FP1, you need to add the public part of the default certificates into the master domain manager truststore. This ensures communication between agent and master.

To import the public part of the default certificates, perform the following steps on the master domain manager:

1. On the agent, list the labels within the KDB certificate:

   "gsk8capicmd_64 -cert -list -db TWSClientKeyStore.kdb"

   An output similar to the following is returned:

   "Certificates found

   • default, -personal, ! trusted, # secret key"

   ! server

   • client

   The public label is preceded by the "-" sign. In our example, the public label is "client".

2. On the agent, optionally, check the details for the "client" label, as follows:

   "gsk8capicmd_64 -cert -list -db TWSClientKeyStore.kdb -label client"

3. On the agent, extract the "client" label to a file of your choice, as follows:

   "gsk8capicmd_64 -cert -extract db TWSClienKeystore.kdb -label client -target my_file.cer"

4. On the master domain manager, import the file to the Liberty truststore JKS of the master domain manager using the keytool command, as follows:

   "keytool -importcert -file my_file.cer -keystore <TWA_HOME>/usr/servers/engineServer/resources/security/TWSServerTrustFile.jks -alias my_certs -trustcacerts"

5. On the master domain manager, type yes when requested to trust the imported certificate.

You have now successfully imported the public part of the default certificates into the master domain manager truststore.

When installing the IBM Workload Scheduler Fix Pack, follow these recommendations:

IBM Workload Scheduler version 10.1.0 Fix Pack 1 supports all product versions indicated in the IBM Workload Scheduler version 10.1.0 Fix Pack 1 Release Notes which can be accessed at the following link: Release Notes.

To obtain the latest information about permanent disk space requirements when installing IBM Workload Scheduler on supported operating systems, run the Hardware requirements report and click on the relevant operating system link

TWA_HOME/TWS + TWA_HOME/TDWB + TWA_HOME/wastools + TWA_HOME/properties

This topic describes how to roll back an applied fix pack to a previous version.

Any additions or changes to the documentation as a result of this Fix Pack have been integrated into the online product documentation available in IBM Documentation.