Release notes - IBM Security Verify Access Adapter 10.0.5

Release notes - IBM Security Verify Governance Adapter v10.0.6 for IBM Security Verify Access

IBM Security Verify Governance Adapter v10.0.6 for IBM Security Verify Access is available. Compatibility, installation and other getting-started issues are addressed.

Copyright International Business Machines Corporation 2003, 2023. All rights reserved.
US Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

 

Contents

 

Preface

 

Welcome to the IBM Security Verify Governance Adapter for IBM Security Verify Access, previously known as IBM Tivoli Access Manager Combo Adapter.

 

·        IBM Security Verify Access Adapter Installation and Configuration Guide

 

Adapter Features and Purpose

 

The IBM Security Verify Access Adapter is designed to create and manage accounts on the IBM Security Access Manager for Web server. The adapter runs in "agentless" mode and communicates using the IBM Security Access Manager RegistryDirect API to the systems being managed.

The IBM Security Verify Governance Adapters are powerful tools that require Administrator Level authority. Adapters operate much like a human system administrator, creating accounts, permissions and home directories. Operations requested from IBM Security Verify server, IBM Security Verify Privilege Vault, and IBM Security Verify- Governance server will fail if the adapter is not given sufficient authority to perform the requested task. IBM recommends that this adapter run with administrative (sec_master) permissions.

 

License Agreement

Review and agree to the terms of the IBM Security Verify Governance Adapter License prior to using this product. The license can be viewed from the "license" folder included in the adapter package.

 

Contents of this Release

 

Adapter Version

 

Component

Version

Build Date

2023 March 08 03.46.57

Adapter Version

10.0.6

Component Versions

Adapter build: 10.0.6.1

Profile: 10.0.6.1

Connector: 10.0.6.1

Dispatcher 7.0.39 (or higher, packaged separately)

Documentation

The following guides are available in the IBM Verify Adapters Knowledge Center:

 

·IBM Security Verify Access Adapter Installation and Configuration Guide

 

New Features

 

 

Internal#

 

Enhancement # (RFE)

Description

 

 

Items included in 10.0.6 release

 

 

None

 

 

Items included in 10.0.5 release

RTC 190879

ADAPT-121

Add support for ISVA 10.0.4

 

 

Items included in 10.0.4 release

RTC 190344

 

ISVA Internal Changes for SDI Log4j update

 

 

Items included in 10.0.3 release

RTC 189881

 

Added support for ISVA 10.0.2

 

 

Items included in 10.0.2 release

 

 

None

 

 

Items included in 10.0.1 release

 

 

None

 

 

Items included in 7.1.29 version

 

 

None

 

 

Items included in 7.1.28 version

RTC 183244

 

Internal - ISAM 9.0.7 support

RTC 184339

 

Internal - Attribute value lookup for IGI 5.2.5

 

 

Items included in 7.1.27 version

 

RTC 182692

 

Add support for IGI 5.2.5

 

See “Limitation on how to use eritamcred attribute” section for more information.

 

 

Items included in 7.0.26 version

 

 

Add support for IGI 5.2.2

This adapter is now designed for use with Identity Manager, Privileged Identity Manager, and Identity Governance and Intelligence.

 

 

 

Items included in 7.0.25 version

 

 

Add support for ISAM 9.0

The ISAM 9 PDJRTE is included in the appliance. In the Local Management Interface, navigate to Manage System Settings -> Secure Settings -> File Downloads. Under the isam directory, download pdjrte-9.0.0-0.zip

 

RFE76110

 

Add ability to manage Disable Time Interval on each account

 

INT126053

 

*** CHANGE IN DEFAULT BEHAVIOR ***
Reconciliation now uses a case insensitive filter.

If you need the old behavior, edit the service.def file in the profile. In the tamSearch section, look for "CaseInSensitiveFilter", then change true to false between the default tags.

 

 

 

Items included in 7.0.24 version

 

 

None

 

 

 

Items included in 7.0.23 version

 

RFE17072

 

Add ability to manage Max Password Age on each account

 

RFE56722

 

Add ability to manage Max Concurrent Web Sessions on each account. The value must be an integer greater than zero, -3 for Displace, or -4 for Unlimited.

 

RFE33651

 

Add ability to synchronize user password to GSO credentials during account create.

To utilize this feature, the ISAM service must be configured to Synchronize SSO passwords. When specifying the SSO credentials, leave the password field empty. And a password must be supplied for the user. If using the import option and not providing a user password, or not enabling Sync Password to SSO Lockbox on the Service form, a blank GSO credential password will generate an error.

 

RFE61605

 

Boolean flag attributes are always converted to lowercase before checking their value.

 

 

 

Initial release.

 

Closed Issues

 

Internal#

Case# / APAR#

Description

 

 

Items included in 10.0.6 release

RTC 190836

 

Remove Apache log4j from 3rd party libraries TAM/SVA adapter
Adapter is using TDI v7.2 lib during build

 

 

Items included in 10.0.5 release

Bug 3785

RTC 190685

TS008649391

 

"Default_Ok" hook restored

 

Items closed in 10.0.4 release

Bug 3623

RTC 190036

TS006724428

IJ36550

Issue While Importing User from ISIM When AD is Used as Federated User Registry.

 

 

Items closed in 10.0.3 release

None

 

 

Items closed in 10.0.2 release

Bug 3390

TS004351858

IJ31246

ObjectClassViolation during tamAdd when using AD federated user registry.

 

 

Items closed in 10.0.1 release

RTC 187878

Bug 3359

TS004188986

IJ28694

ISAM Adapter returns STATUSCODE 3 when group does not exists in isam, breaks IGI flow.

RTC 187879

Bug 3340

TS004159719

IJ28942

Recon fails with "Unparseable date" error for unknown attribute

 

 

Items closed in 7.1.29 version

RTC 186402, Bug 3106, TS002983015

IJ22617

ISAM adapter should restore PwdValid flag to existing value after change password operation

 

 

Items closed in 7.1.28 version

RTC 183804,

Bug 2890

 

Usage of Admin API deprecated

 

See “Add admin API option on service form” section for more information.

 

 

 

Items closed in 7.1.27 version

RTC 182698, Bug 2802

IJ13310

As an ISAM adapter developer, I must ensure that the adapter re-uses the LDAP connections

RTC 182696

 

Internal - As an ISAM adapter developer, I must ensure that the operation name in service.def uses proper case

 

 

Items closed in 7.0.26 version

 

 

 

None

 

 

 

Items closed in 7.0.25 version

 

IV74759

 

Attempting to modify account with a non-existent group results in whole request failing.

 

 

 

Items closed in 7.0.24 version

INT123097

 

 

Changes for RFE61605 caused new accounts to be provisioned as inactive if "eraccountstatus" was not included in the request.

 

 

 

Items closed in 7.0.23 version

INT102186

 

 

The previously deprecated LDAP profile has been removed. Any installations that were using the LDAP profile will need to review the ISAM Service configuration in ISIM after loading the new profile. The service form is different, and some fields will need to be set.

 

 

 

Initial release.

 

Known Limitations

 

Internal#

APAR#

Case# / Description

85051

 

 

When using the IBM Security Access Manager API method of reconciliation to reconcile IBM Security Access Manager accounts, if an IBM Security Access Manager account already in the IBM Security Identity registry becomes a malformed IBM Security Access Manager account then IBM Security Identity will identify this malformed IBM Security Access Manager account as no longer existing, and delete it from the IBM Security Identity registry. If the malformed IBM Security Access Manager account does not already exist within the IBM Security Identity server's known IBM Security Access Manager accounts, the account will not be added. This behavior does not provide any warning or failure message by the IBM Security Identity server. See the Installation guide for how to change the adapter configuration regarding this issue.

 

 

 

During the creation of IBM Security Access Manager accounts when IBM Security Access Manager is configured against Windows Active Directory, the account is created as a GSO user even when the Single Signon Capability for the account is not checked (i.e. There is no request to create the account as a GSO user). This is a reflection of the operation of IBM Security Access Manager when administrating accounts. If GSO credentials are supplied with same request they will be created without warning that IBM Security Access Manager account doesn't have Single Signon Capability.

93688

 

 

When IBM Security Access Manager is configured against Windows Active Directory, IBM Security Access Manager account's common name (cn) must be the same as the first RDN value of the Distinguished Name. For example, when requesting a new IBM Security Access Manager service account through the IBM Security Identity web console, the "Full name" specified in the Account form must be the same as the "cn" portion of the Distinguished Name. E.g. If a user has the Distinguished Name cn=JohnSmith,o=myCompany,c=com,  then the "Full name" should also be set to JohnSmith. Not doing so could result in account modification issues.

 

 

 

Adapter does not check syntax for any non-IBM Security Access Manager account attributes. This can result in those attributes not being set in the registry if their values have incorrect syntax. A possible consequence is that operations such as account creation may fail.

 

 

 

In case an account already has SSO credentials and the checkbox Single Signon Capability is disabled during MODIFY operation, this will delete credentials in IBM Security Access Manager registry, but not in the IBM Security Identity server. A reconciliation is needed to synchronize the account attributes.

 

 

 

If password synchronization is configured to synchronize passwords from WebSEAL via the IBM Security Identity server to other person accounts, the synchronization with SSO credential passwords is not supported. The synchronization with SSO credential passwords is supported only if the password change is initiated from the IBM Security Identity server, and the corresponding SDI Assembly Line is executed.

 

 

 

If password synchronization is configured to synchronize passwords from WebSEAL the "Change password on next login" checkbox on the account form cannot be reset. This is due to a current limitation of the IBM Security Identity Manager Server.

 

Known Limitations

 

Internal#

APAR#

Case# / Description

 

 

Limitation on how to use eritamcred attribute

 

Enter the value for eritamcred attribute in this format - “Name of the resource (Web Resource)|username|{clear}password”

e.g. zira (Web Resource)|isupport|{clear}password

 

Please note that the password will be visible in clear text in the logs as option to encrypt the password is not available on IGI currently.

 

To avoid password in clear text, use the “Synchronize IBM Security Access Manager password in SSO Lockbox” checkbox to set the SSO credential password same as the ISAM account password.

 

 

 

Adapter does not support modifying the last name (sn) attribute of IBM Security Access Manager account when IBM Security Access Manager Administration API is used since the API does not support modifying the last name.

 

 

 

Management of non-standard IBM Security Access Manager account attributes is only available for user registries supported by Registry Direct API.

 

 

 

IBM Security Access Manager Web Gateway appliance in standalone mode, PRIOR TO FP4, does not externalize the interface to its internal directory server. Consequently, Registry Direct API and managing non-standard ISAM account attributes are not supported by the adapter for the appliance versions 8.0 through 8.0.0.3. For example, the adapter cannot modify "mail" attribute of the user object stored in the appliance's internal directory server. In addition, only "TAM API" based reconciliation is supported for the appliance in standalone mode prior to FP4.

 

 

 

Registry Direct API based reconciliation does not reconcile inetorgperson attributes by default. This is an optimization that was made in order to improve the performance of the reconciliation. In order to reconcile the inetorgperson attributes, edit "tamSearch" assemblyline in the profile to include the required attributes in the input mapping of the connector "tamIterRgy". Please refer to this technote for more details.

 

 

 

The adapter does not support the modification of UID, CN, principal name, and attribute(s) that form the Distinguished Name(DN).

 

 

 

Custom containers are not supported when creating an IBM Security Access Manager group. IBM Security Access Manager specifies a default

 

 

 

Filtered reconciliation on groups is not supported.

 

 

 

When "Single Signon Capability" attribute is unchecked and an account modification request is submitted, the SSO credentials for the account are removed in IBM Security Access Manager but this is not reflected in the ISIM server. This is due to the RMI protocol not allowing the response to contain the updated account information. In order to work around this limitation, edit the "modify" operation workflow for "IBM Security Access Manager Account" entity to delete "eritamcred" attribute when "eritamsinglesign" attribute is set to "false". For example, add a script element with the following script before "MODIFYACCOUNT" extension:

 

var accountObj = account.get();
var changes = account.get().getChanges();
if (changes != null && changes.length > 0)
{
    for (i =0 ; i < changes.length ; i++)
    {
        if (changes[i].attr == "eritamsinglesign" && changes[i].values[0] == "false")
        {
          accountObj.removeProperty("eritamcred");
          account.set(accountObj);
        }
    }
}

Alternatively, a subsequent reconciliation will correct the account information in ISIM.

 

Known IBM Security Verify Access Issues

Internal#

APAR#

Case# / Description

 

IV71775

 

The "com.tivoli.pd.rgy.jar" API library that can be downloaded from ISAM v8.0.1 appliance includes an incorrect search that will not return GSO enabled users during a reconciliation. This is corrected in the jar file available from the v8.0.1-FP1 appliance.

 

 

 

Certain user management functions (e.g. enabling GSO) in IBM Security Access Manager do not work if the user ID contains "," and as such "," in the user ID is not supported by the adapter.

 

 

 

When the Single Signon Capability of an IBM Security Access Manager user account is disabled (i.e. the user is no longer a GSO user), the GSO resource credentials for that account are also deleted. Hence when disabling the Single Signon Capability for a IBM Security Access Manager user account from the IBM Security Identity server, attempting to delete or modify resource credentials in the same request for that account results in "successful with warning" as the GSO credentials cannot be found.

 

 

 

IBM Security Access Manager Java Admin API does not provide for a CN to be specified when creating a group. This is reflected in the adapter which does not manage this attribute when adding or modifying groups.

 

 

 

If IBM Security Access Manager is configured against Windows Active Directory, an existing user or group description cannot be modified to a blank value. The description will remain unchanged.

 

 

 

If IBM Security Access Manager is configured against Windows Active Directory, when importing an account using the pdadmin command line, the user name and first RDN value of the user DN must be the same. This issue is reflected in the adapter: User ID and first RDN value in the user Distinguished Name must be the same.

 

 

 

If IBM Security Access Manager is configured against IBM Tivoli Directory Server 6.0, then Fix Pack 5 must be installed on the Directory Server. This fix pack addresses a problem that may affect adapter operation (APAR IO06328).

Installation and Configuration Notes

See the Installation and Configuration guide for IBM Security Verify Governance Adapter for IBM Security Verify Access for detailed instructions.

Corrections to Installation Guide