Novell Access Manager 3.0 SP3 IR2 Readme

2.1.1 Upgrading the Identity Server and Administration Console to IR2

2.1.2 Upgrading the Linux Access Gateway to IR2

Before you upgrade the Linux Access Gateway, the Linux Access Gateway file (AM_303_SP3_IR2_lagrpms.tar.gz) needs to be renamed. In the download, it needs to have a version-specific name, but to use it in an upgrade, it needs the generic name. It should be renamed as follows:

AM_303_SP3_IR2_lagrpms.tar.gz renamed to lagrpms.tar.gz

For more information on the various methods for upgrading the Linux Access Gateway, see “Upgrading the Linux Access Gateway” in the Novell Access Manager Installation Guide.

When upgraded to 3.0 SP3 IR2, the Linux Access Gateway displays the following version:

3.0.3.56

2.1.3 Upgrading SSL VPN to SP3 IR2

Select the correct patch file according to the version of SSL VPN you have installed:

To check the version of SSL VPN that is currently installed on your system, enter the following command:

rpm -qa|grep novl-sslvpn

The RPM names for high bandwidth version appear with an _hb.

Refer to “Upgrading the SSL VPN Server” in the Novell Access Manager Installation Guide for instructions for all installations of SSL VPN: installed as standalone component, installed with the Identity Server or Administration Console, or installed with the Linux Access Gateway.

The version number for SSL VPN, after the upgrading to IR2, is 3.0.2.01.

2.1.4 Upgrading the J2EE Agents to IR2

SP3 IR2 modified the nidp.jar file that contains the embedded service provider code. Access Manager runs more efficiently when all embedded service providers are running the same code.

2.1.5 Upgrading the NetWare Access Gateway to IR2

SP3 IR1 modified the nidp.jar file that contains the embedded service provider code. Access Manager runs more efficiently when all embedded service providers are running the same code.

To upgrade the NetWare Access Gateway:

2.2.1 Protected Resource Feature

You can now specify a query string in the URL path of a resource protected on the Linux Access Gateway. For example:

URL path: /test/index.html?test=test

By default, the Linux Access Gateway ignores query strings when matching URL paths. To use the query string for matching, you must enable the feature by creating the following touch file:

/var/novell/.prWithQuestionMark 

You need to restart the Access Gateway to activate this feature.

If this file is present and the request URL has a query string, the Access Gateway searches for a URL path with a matching query string. If it can’t find a match, the request returns a resource not found error. If you enable this feature, you need to make sure to add the query string to the URL paths of the protected resources.

Without the touch file, the Access Gateway ignores the query string and uses just the path to find a match.

In SP4, this feature will no longer require the touch file. It will also perform two searches. If the request URL has a query string, it will first search for a match with the query string. If it can’t find a match, it will remove the query string and search for a match using just the path.

2.2.2 Ensuring Secure Cookies

If you configure SSL between the browsers and the Linux Access Gateway, you can configure the embedded service provider so that it always sends secure cookies. See Avoiding Non-Secure Cookies.

2.3.1 Linux Access Gateway

2.3.2 Identity Server

2.3.3 Administration Console

2.3.4 SSL VPN

These issues were fixed in IR1.

3.1.1 Upgrading the Identity Server and Administration Console

For the Identity Server and the Administration Console, copy the .tar.gz file to machine where these components are installed. For the Access Gateways, copy the files to a server that is accessible to your Access Gateway, then perform an over-the-wire upgrade. For more information about upgrading the Access Manager components, see “Upgrading Access Manager Components” in the Novell Access Manager Installation Guide.

3.1.2 Upgrading the Linux Access Gateway

The Linux Access Gateway file (AM_303_SP3_lagrpms.tar.gz) must be renamed. In the patch download, it needs to have a version-specific name, but for an upgrade, it needs the generic name. It should be renamed as follows:

AM_303_SP3_lagrpms.tar.gz renamed to lagrpms.tar.gz

3.1.3 Upgrading the J2EE Agents

For instructions on upgrading the agents, see “Upgrading the J2EE Agents” in the Novell Access Manager J2EE Agent Guide.

For a known issue when upgrading the Linux Agents, see The Health of the Linux Agent Is Not Green after Upgrading.

3.1.4 SP2 Version Numbers

To verify that all components have been upgraded to SP2:

3.1.5 Verifying the Upgrade to SP3

When you start the upgrade process for the SP3 release, you need to upgrade all Access Manager components. When you have finished, use the following procedure to verify that all components have been upgraded to SP3.

3.2.1 Upgrading from the Evaluation Version to the Product Version

After purchasing the Access Manager product, upgrade your evaluation version to the product version. If you install the evaluation version of SP3, you need to buy SP3, then upgrade to the product version of SP3. The evaluation version for SP3 is build 39, which is one version less than the product version, which is build 40. This allows you to upgrade from the evaluation version to the product version.

6.3.1 L4 Switch

If you use an Alteon^* L4 switch and do not enable the sticky bit, you must turn on Direct Access Mode, which allows a client to communicate with any real server’s load-balanced service.

6.3.2 Rebooting Cluster Members

If you reboot too many machines at the same time, some of the machines might report a configuration store error and not start. This problem resolves itself eventually, but it can take several hours.

To prevent this problem, reboot the cluster members individually, waiting until a rebooted machine has started before issuing the next reboot command. This is a known issue and will be fixed in a future release.

6.4.1 Configuration Datastore Crashes

If you are having problems keeping the Administration Console running because eDirectory and Tomcat stop working, your configuration might be triggering a known issue with eDirectory 8.8.1.

Try the following workaround:

If this does not solve the problem, contact Novell.

6.4.2 iManager Functionality

Access Manager uses a modified version of Novell iManager called the Administration Console. You cannot use standard iManager features or plug-ins with the Access Manager version of the product.

6.4.3 Running in a VMware ESX Server Environment

If you are running Access Manager in a VMware* ESX Server environment (ESX Server 3.0.2) and your Access Gateway configuration contains a path-based multi-homing reverse proxy with over 200 protected resources, you might experience an extended delay (five minutes or more) when viewing the configuration page for the proxy.

6.4.4 Using an Auditing Server Other Than the One on the Administration Console

If you set up Access Manager to use an auditing server other than the one installed on the Administration Console, devices that are imported after this configuration do not receive the IP address of the auditing server. When the device is rebooted, it tries to send auditing events to the auditing server on the Administration Console.

To work around this issue after importing new devices, configure the auditing server to use the IP address of the Administration Console, then click OK. This saves the configuration to the Administration Console. Return to the Auditing page, reset the IP address to the address of the auditing server you want to use, then apply the configuration to all the devices imported into the Administration Console (use the Update links). After the configuration has been applied to the devices, reboot the devices.

For more information on how to change the IP address of the auditing server, see “Specifying the Logging Server and Events” in the Novell Access Manager 3.0 SP2 Administration Guide

6.4.5 Identity Injection or Form Fill for Single Sign-On

The iManager version used in the Administration Console is not compatible with Identity Injection or Form Fill for single sign-on.

6.4.6 Secondary Consoles

As long as the primary console is running, all configuration changes should be made at the primary console. If you make changes at both a primary console and a secondary console, browser caching can cause you to create an invalid configuration.

6.5.1 Affiliated Objects Are Missing the SecretStore Schema

When you create a user store on the Identity Server (Local > User Stores) and define it as an external Novell SecretStore (Liberty > Web Service Provider > Credential Profile) some attributes are not being created properly on the SAML affiliate object. The workaround is to access the user store configuration page (Local > User Stores), then exit. This action results in a check to verify that the schema, objects, and attributes exist, and it re-creates the affiliate object, if necessary.

The following affiliate objects must exist:

authsamlCertContainerDN (container holding trusted certificates, such as SCC Trusted Root.Security)
authsamlProviderID 
authsamlTrustedCertDN (list of trusted certificates)
authsamlValidAfter (180 seconds default)
authsamlValidBefore (180 seconds default)

If these attributes exist, the system works normally, but your Identity Server and SecretStore server are not synchronized for time. If time sync is an issue, you can change the 180-second default validity times as a workaround.

6.5.2 Account Lockout on a Password Expiration Servlet

When users are within the grace login limit, and a password expiration servlet is specified on a Name/Password or Secure Name/Password (form-based) authentication contract, they are redirected to the password expiration servlet to change their passwords. If the user does not update the password correctly, or escapes out of the page for any reason, the account is locked.

6.5.3 Multiple Administrators

Currently, locking has not been implemented on the pages for modifying the Identity Server. If you have multiple administrators, they must coordinate with each other so that only one administrator is modifying an Identity Server cluster at any given time.

6.5.4 Orphaned Objects in the Trust/Configuration Store

If you delete a User object in LDAP, the objects in the trust/configuration datastore related to that user can become orphaned. The system uses these objects for federated identity and user profiles. Currently, there are no known issues related to orphaned identity objects, but they might affect system performance. Orphaned user profile objects might also affect user lookup operations, and therefore you should remove them.

To do so, you first delete the user’s profile before you delete a User object, as described in the following steps:

6.5.5 Auto Provision X509

There are issues with the Auto Provision X509 option. If there are already values in the LDAP attribute for X509 Subject Name mapping, and you enable Auto Provision X509 for the X509 authentication class, the LDAP attribute values are overwritten with the client certificate subject name.

6.6.1 The Rewriter Does Not Rewrite the Location Header When the Hostname Contains Uppercase Characters

When the Location Header coming from the Web server contains a hostname with uppercase characters such as DSM2300.dsm.novell.com, the header is not rewritten.

The current solution is to make sure users do not enter URLs in uppercase and that the hostnames for all Web servers used by Access Manager are in lowercase.

This issue will be fixed in SP4.

6.6.2 Form Fill and Identity Injection Silently Fail

Login with Form Fill or Identity Injection can fail when all of the following conditions occur:

The new unlock feature for SecretStore can resolve this issue. See “Determining a Strategy for Unlocking the SecretStore in the Novell Access Manager Administration Guide.

6.6.3 Reinstalling a Failed Access Gateway

If the hardware of your Access Gateway fails and the Access Gateway is not a member of a cluster, you might receive the following message when you reinstall it:

Start unsuccessful. Reason: Unable to read keystore : /opt/novell/devman/jcc/certs/esp/signing.keystore.

If you receive this message, use the following process to solve the problem:

6.6.4 Pending Commands After an Upgrade

Occasionally during an upgrade, the response to an upgrade command is lost, even though the command succeeds. This results in a pending status for the command, and this status is never updated to success.

To clear a pending command:

6.6.5 Form Fill Character Sets (UTF-8)

Novell supports only UTF-8 encoding (UCS Transformation Format 8) and ISO 8859-1. Otherwise, Form Fill translations to the SSO data store cannot be guaranteed.

6.6.6 Certificate Modifications

Both the Linux Access Gateway and the NetWare Access Gateway have the following issue when cancelling changes to certificate modifications:

If you make certificate changes on the Reverse Proxy or the Web Servers page, click the Configuration Panel link, and then cancel the changes on the Configuration page, the Reverse Proxy is configured with an invalid certificate. Return to the page and select the old certificate. As soon as you exit the page, the certificate is pushed to the device. Because you did not change the certificate, you do not need to restart the embedded service provider.

6.7.1 NSure Audit Client Causes the Linux Access Gateway to Crash

If you have configured your Access Manager system to use a Novell Sentinel or Novell Audit server for auditing, the NSure audit client sometimes disconnects from the auditing server. This usually happens when communication problems exist on the network. When this happens, the Linux Access Gateway might crash. It can also prevent the successful completion of any Linux Access Gateway configuration changes.

To solve this problem, make sure that no communication problems exist between the auditing client on the Linux Access Gateway and the auditing server. Novell is working on a fix for this issue.

6.7.2 Reimporting a Linux Access Gateway

When reimporting a Linux Access Gateway with the initial configuration option, the health status displays the health of the previous configuration. You must apply changes from the Administration Console for health status to display the new configuration. Alternatively, you can enter the /etc/init.d/novell-vmc restart command from the command line to restart the Access Gateway. This issue does not happen when you reimport the proxy with the current configuration option.

6.7.3 Importing a Linux Access Gateway Configuration

When importing a Linux Access Gateway configuration, it is possible that the imported configuration contains an Audit server IP address that is different from the Audit server IP address that has been configured in the Administration Console. Updating the Linux Access Gateway configuration does not correct this address problem. As long as the addresses differ, the Access Gateway can hang during subsequent updates or restarts because the Novell Audit Agent of the Access Gateway cannot connect to its configured Audit server.

You must force the Linux Access Gateway to change its Audit server settings.

6.7.4 Upgrading Randomly Halts the Embedded Service Provider

After upgrading, the embedded service provider sometimes halts at the end of the upgrade process. When this happens, restart the Linux Access Gateway. In the Administration Console, click Access Manager > Access Gateways, select the Access Gateway, then click Reboot.

6.7.5 Single Machine Installation Is Not Supported for this Release

This release does not support installation of the Administration Console, Identity Server, Linux Access Gateway, and SSL VPN on a single machine.

6.7.6 Linux Access Gateway Version Is Incorrectly Displayed on the Administration Console

After the installation of the Linux Access Gateway, the wrong version of the product is displayed on the Administration Console. To get the correct version of the product, select Access Gateways > <Name of Server> > Upgrade or specify the following command from a Linux Access Gateway machine:

cat /etc/issue

6.7.7 YaST Goes into a Non-Responsive Mode When a Partition Is Deleted or Created by Using YaST

YaST goes into a non-responsive mode if you click Finish after adding, deleting, or modifying a partition by using YaST. To work around this problem, click Apply, then click Quit instead of clicking Finish.

6.7.8 Hostname Cannot Be Configured As linux

During installation, if you configure the hostname as linux, the Linux Access Gateway is not imported.

6.7.9 Issues When Importing Trusted Roots from Web Servers

The Linux Access Gateway requires both the Server Certificate and the Root CA to be present in the trusted roots imported from Web servers. If the trusted root imported from the Web server displays only the server certificate, select the Do Not Verify option from the Web Server Trusted Root drop-down list when you are configuring SSL between the Proxy Service and Web servers. For more information, see “Configuring SSL between the Proxy Service and the Web Servers” in the Novell Access Manager Administration Guide.

6.7.10 Web Servers That Do Not Support TLS and Do Not Fall Back to SSLV3 Are Not Accelerated

The Linux Access Gateway uses the TLS protocol by default. However, some Web servers that do not support the TLS protocol abort the SSL handshake because they do not fall back to SSLV3.

To work around this problem, create the /var/novell/.doNotUseTLS touch file and restart the Linux Access Gateway. When this touch file is set, the Linux Access Gateway tries the SSLV3 protocol by default, instead of the TLS protocol.

6.7.11 Linux Access Gateway Does Not Accelerate Netware 6.5 Pre-SP3 Web Servers

The Web server closes the connection when the Linux Access Gateway sends the HTTP request to the Netware 6.5 pre-SP3 Web server, after the SSL handshake.

6.7.12 Cookies Set by JavaScript inside the Entity Are Not Rewritten

The Linux Access Gateway rewrites the path and domain only in those cookies that are set by using the Set-Cookie header. The cookies set by JavaScript* inside the entity are not rewritten by the Linux Access Gateway.

6.7.13 Rewriter Does Not Handle [ow], [w], and [oa] Options in Search and Replace

The character rewriter profile does not support the [w], [ow], and [oa] options to search and replace plain words and strings.

6.7.14 Exclude Alias DNS with Scheme Option Does Not Work

The Exclude Alias DNS name with Scheme option does not work. For example, if you add https://www.mygroup.com, it is not excluded from the list. You must provide only the DNS name, such as www.mygroup.com.

6.7.15 Form Fill Auto-Submit Option Does Not Work with Multiple Forms on the Same Web Page

The Linux Access Gateway Form Fill fails to auto-submit HTML pages with multiple <FORM> sections. For example, if you have an HTML login page, and the page contains two <FORM> sections as follows:

<HTML> <FORM name="form1"...> <INPUT name="username" type="text"...> </FORM> <FORM name="form2"...> <INPUT name="password" type="password"...> </FORM> </HTML>

Linux Access Gateway fills both the forms but does not auto-submit them. To use the auto-submit feature, there can only be one form on the page.

6.7.16 Form Fill Fails When a Policy Is Configured to Use String Constants

The Form Fill feature of Linux Access Gateway fails to fill the form when a policy is configured to use only string constants for all the input fields. However, Form Fill works when a string constant is used in combination with other input field values, such as credential profile.

6.7.17 Form Fill Auto Submit Issue

Form Fill auto-submit fails when an input field in an HTML page contains name="submit".

6.7.18 Form Fill Does Not Work if the Web Page Contains an Apostrophe

The Linux Access Gateway Form Fill does not work if the Web page contains the apostrophe character.

6.7.19 Form Fill Fails If the Web Server Does Not Send the Content Type

Form Fill does not process the page if the Web server does not send the content type. Form Fill processes the following content types:

"text/html" "text/xml" "text/css" "text/javascript” "application/javascript" "application/x-javascript"

6.8.1 Mutual SSL

When you upgrade to Access Manager 3.0 SP1, the upgrade process disables mutual SSL between the proxy service and the Web servers.

To re-enable mutual SSL, select the SSL Mutual Certificate on the Web Servers page. Click Access Manager > Access Gateways > Edit > <Name of Reverse Proxy> > <Name of Proxy Service> > Web Servers.

6.8.2 Form Fill Data Is Not Cached

The NetWare Access Gateway does not cache Form Fill data. Therefore, if you assign a Form Fill policy to a protected resource that uses a wildcard (*) in the URL path, the NetWare Access Gateway queries the Identity Server for Form Fill data each time a user accesses any page that matches the protected resource. It is strongly recommended that you specify a specific page when you assign a Form Fill policy to a protected resource.

The NetWare Access Gateway does cache Identity Injection and Authorization policy information for the lifetime of the user’s session, so the protected resources for these policies can use wildcards in their URL paths.

6.8.3 Secondary Administration Console Command Failure

You can push commands from the secondary Administration Console, but any commands dealing with the Certificate Authority fail, unless you move the Certificate Authority to the secondary server.

6.8.4 DNS Naming

Do not begin an Access Gateway server DNS name with a number.

6.8.5 Using an SSH Client with the Secure File Transfer Protocol

In order to transfer files to and from the NetWare Access Gateway server when the SSH client that you are using for the transfer is configured with the Secure File Transfer Protocol (SFTP) enabled, you must load ncpip.nlm and enable NCP™ for the SFTP.

To set up and configure NCPIP, add the following to the tune.ncf file:

load ncpip.old
SET NCP Exclude Addresses = ALL
SET NCP Include Addresses = 127.0.0.1

6.8.6 IDEATA.HAM Drivers and Serial ATA Controllers

In the BIOS you specify the modes to use for the IDEATA.HAM driver to work with a SATA controller. (Legacy, Compatible, or Enhanced mode.) You do not need to manipulate the driver or OS.

The IDESATA.HAM driver works with all AHCI controllers in pure AHCI mode, which is the recommended mode because it is the fastest. This driver is invoked instead of IDEATA.HAM only when the BIOS setting for the particular chip set is set to AHCI.

6.8.7 SSL Certificate Log Error with X.509 Authentication from the NetWare Access Gateway

If you set up an X.509 contract and use it to authenticate from the NetWare Access Gateway, you might see an error generated in the Identity Server log for certificate or SSL mutual authentication. This occurs during SSL re-negotiation between Tomcat and the Internet Explorer* browser, and is possibly an IE bug. This error does not occur with Firefox. The Access Gateway can cause the error at the Identity Server by requesting the certificate authentication from the Identity Server, but it is not the only device that can cause the error. Any device requiring or requesting certificate authentication from the Identity Server, including the Identity Server itself, can cause the error. It is cosmetic.

6.8.8 Novell Remote Manager

NetWare abends can occur when Novell Remote Manager Group Operations are used on a NetWare Access Gateway. We recommend that you do not use Novell Remote Manager on a NetWare Access Gateway.

6.9.1 General SSL VPN Issues

6.9.2 Kiosk Mode Issues

6.9.3 Enterprise Mode Issues

6.10.1 Browse Button for Importing a Private/Public Key Pair

In some combinations of Linux and Firefox, you might see the Browse button display incorrectly in the Import Private/Public Keypair window. This does not affect functionality.

6.10.2 Certificate Command Failure

Certificate commands are generated when you upgrade the Administration Console, and you should ensure that they have completed successfully. In the Administration Console, click Access Manager > Certificates > Command Status.

If a certificate command fails, note the store, then click Auditing > Troubleshooting > Certificates. Select the store, then click Re-push certificates to push the certificates to the store.

6.11.1 The Health of the Linux Agent Is Not Green after Upgrading

When upgrading a Linux Agent, you get an error on the Health page for the agent that says the ESP cannot read the signing.keystore file in /opt/novell/devman/jcc/certs/esp/<id>/ directory.

To correct this problem:

6.11.2 Audit Log Event Problems on 64-Bit Platforms

No audit log events occur on 64-bit platforms. There is currently no workaround for the WebSphere^* Agent. For the JBoss^* and WebLogic* Agents, you can enable log events on 64-bit platforms by deleting the LogEvent.jar file and replacing it with the NAuditPA.jar file.

On Windows, the NAuditPA.jar file is located in Program Files\novell\Nsure Audit directory. On Linux, the file is located in /opt/novell/naudit/java/pa directory.