IBM Security Access Manager for Enterprise Single Sign-On, IMS Server Fix pack 8.2.2-ISS-SAMESSO-IMS-FP0015

Part 1: Switching the version of Java used in WebSphere Application Server

When you deployed the IMS Server, Java Technology Edition 6 was automatically installed with the required version of WebSphere Application Server Network Deployment. To stay current with the latest fixes and security updates, switch to a newer version of the WebSphere SDK, such as, WebSphere SDK Java Technology Edition version 8.0. For more information, see The end of Java SE 6: Where to go from here.

1. Update the IBM WebSphere Java SDK. The WebSphere Java SDK is provided as a separate download with WebSphere fix packs. See Installing and uninstalling SDK Java Technology Edition Version 8.0.
2. Switch the edition of Java that is used in the IMS Server.
   1. Display the list of all SDK names with themanagesdk -listAvailablecommand. was_home/bin/managesdk.bat -listAvailable CWSDK1003I: Available SDKs: CWSDK1005I: SDK name: 1.8_64 CWSDK1005I: SDK name: 1.6_64 CWSDK1001I: Successfully performed the requested managesdk task.
   2. If you want to switch the Java edition that is used for the command-line environment and all future profiles, run the following two commands: was_home/bin/managesdk.bat -set CommandDefault -sdkname sdk_name was_home/bin/managesdk.bat -setNewProfileDefault -sdknamesdk_name For example: was_home/bin/managesdk.bat -setCommandDefault -sdkname 1.8_64 was_home/bin/managesdk.bat -setNewProfileDefault -sdkname 1.8_64
   3. Switch the Java edition that is used for existing profiles by completing the following steps: Standalone deployment: Stop your server. Clustered deployment: Stop your deployment manager, cluster members, and all node agents, in that order. Confirm that the deployment manager server is stopped. Switch the SDK version for the profiles by running themanagesdk.bat -enableProfilecommand. was_home/bin/managesdk.bat -enableProfileAll -sdkname 1.8_64 -enableServers
3. Validate the changes by running themanagesdk -listEnabledProfileAllcommand. was_home/bin/managesdk.bat -listEnabledProfileAll
4. Start the server. Standalone deployment: Start the server. Clustered deployment: Start your nodes and deployment manager again (in that order).

Part 2: Deploying the fix pack

1. Download the 8.2.2-ISS-SAMESSO-IMS-FP0015.zip file from Fix Central.
2. Extract the contents of the 8.2.2-ISS-SAMESSO-IMS-FP0015.zip file onto your local computer.
3. Install the fix pack with the IBM Update Installer for WebSphere Software.
   1. On Windows, click Start > All Programs > IBM WebSphere > Update Installer for WebSphere Software. The IBM Update Installer for WebSphere Software wizard is displayed.
   2. Click Next. The Product Selection page is displayed.
   3. Click Browse to select the location of the <IMS Server installation directory> and click Open. For example: C:\Program Files\IBM\ISAM ESSO\IMS Server
   4. Click Next. The Maintenance Operation Selection page is displayed.
   5. Select Install Maintenance package.
   6. Click Next. The Maintenance Package Directory Selection page is displayed.
   7. Click Browse to select the location of the 8.2.2-ISS-SAMESSO-IMS-FP0015.pak file and click Open.
   8. Click Next.
   9. Select the 8.2.2-ISS-SAMESSO-IMS-FP0015.pak file.
   10. Click Next. The Installation Summary page is displayed.
   11. Click Next. The message Success: The following maintenance package was partially installed is displayed.
   12. Click Finish.
4. Log on to the IBM Integrated Solutions Console.

2.a: Uninstalling earlier versions of the IMS Server

1. From the Integrated Solutions Console navigation pane, select Applications > Application Types > WebSphere enterprise applications.
2. Select the ISAMESSOIMS and ISAMESSOIMSConfig check box.
3. Click Uninstall.
4. Click OK.
5. Click Save.

2.b: Installing the ISAMESSOIMSConfig application

1. Open the command prompt. To open a command prompt, click Start, click All Programs, click Accessories, and then click Command Prompt.
2. From the command prompt, browse to the \bin directory. For example: C:\Program Files\IBM\ISAM ESSO\IMS Server\bin.
3. Run deployIsamessoImsConfig.bat. For example: deployIsamessoImsConfig.bat <WAS Admin user ID> <password>

2.c: Installing the ISAMESSOIMS application

What to do next

• Do the post installation configurations.
• Verify the IMS Server version.

Part 3.a: Post installation configuration

If you are using WebSphere Application Server Network Deployment, complete the following tasks.

1. In the WebSphere administrative console navigation pane, click Applications>Application types>WebSphere enterprise applications.
2. Click ISAMESSOIMS.
3. Under Web Module Properties, click Session management.
4. Under General Properties, select Override session management.
5. Click Apply.
6. In the Messages box, click Save. The ISAMESSOIMS application is stopped.
7. Configure session management override for AccessAdmin.
   1. In the Enterprise Applications page, click ISAMESSOIMS.
   2. Under Modules, click Manage Modules.
   3. Click the ISAM ESSO IMS Server AccessAdmin <version number> link.
   4. Under Additional Properties, click Session management.
   5. Select the Override session management check box.
   6. Click OK.
   7. Click Save.
8. Resynchronize the nodes.
   1. Click System administration>Nodes.
   2. Select the check box for each corresponding node.
   3. Click Full Resynchronize.
9. Start the cluster.

If you are using WebSphere Application Server stand-alone, start the IMS Server.

1. On the Integrated Solutions Console left navigation pane, select Applications> Application Types> WebSphere enterprise applications.
2. Select the ISAMESSOIMS check box.
3. Click Start.

Part 3.b: If you are planning to enable reset password in AccessAssistant/Web Workplace in a non-SSL Active Directory environment

For standalone deployments:

1. Go to WebSphere administrative console.
2. Go to Servers > Server Types > WebSphere application servers > <host_name> > [Container Settings] Container Services > Transaction Service.
3. Under General Properties > External WS-Transaction HTTP(S) URL Prefix, select the Prefix to be https://<host_name_or_IP>:<port> (WCInboundDefaultSecure)
4. Apply and save your changes.
5. Restart your server.

For Network Deployment:

1. Edit server.xmlwhich is located at: <dmgr_profile_folder>\config\cells\<cell_name>\nodes\<cell_manager_name>\servers\dmgr, For example: C:\WASProfile\Dmgr01\config\cells\ibm-svr1Cell01\nodes\ibm-svr1CellManager01\servers\dmgr
2. Search for the httpsProxyPrefixattribute.
3. For the httpsProxyPrefix, specify the value in the following format
   https://<host_name>:<port>.
   For example: httpsProxyPrefix="https://imsserver:9443"
4. Save your changes.
5. Restart the deployment manager.
6. Resynchronize the nodes.
   1. Click System administration>Nodes.
   2. Select the check box for each corresponding node.
   3. Click Full Resynchronize.
7. Restart the cluster.

Part 4.a : Upgrading the IMS Server certificates from SHA1 to SHA2 by using the WebSphere Admin Console

Before you begin

• In the IMS Server /bin folder, see the file readme_updateSHACertificates.txt.
• Certificate conversion is verified with Strict SHA256withRSA and 2048 key size.
• Convert the certificates.  See https://www.ibm.com/support/knowledgecenter/SSEQTP_8.5.5/com.ibm.websphere.base.doc/ae/usec_standards_convert.html

Part 4.b : Deploy the updateSHACertificates.bat file

1. WebSphere Application ISAMESSOIMS and ISAMESSOIMSConfig must be in running state.
2. Open the command prompt with administrator privileges.
3.  In the command prompt, from the IMS Server installation directory, browse to the /bin folder and locate the updateSHACertificates.bat file.
4. Run the updateSHACertificates.bat file script.
   updateSHACertificates.bat <WebsphereUsername> <WebspherePassword> --keystorePassword <KeystorePassword>
   
   For example:
   updateSHACertificates.bat wasadmin  wasadmin --keystorePassword WebAS

Note: In the IMS Server bin folder, see readme_updateSHACertificates.txt file.

Part 5: Updating the deployment files in IMS Server

Note: The license file was updated in FP0002 and is required if license files are not updated previously

1. Launch the command prompt as an administrator.
   1. Click Start and type "cmd" in Search. 
   2. Right click on the cmd.exe and select "Run as Administrator".
2. In the command Prompt navigate to the folder containing downloaded files.  There is a file called UpdateDeploymentFile.vbs
3. Type UpdateDeploymentFile.vbs and press ENTER to execute the script.

Part 6: Verifying the IMS Server version after the fix pack installation

You can verify the IMS Server version to determine whether the fix pack installation was successful.

1. Log on to AccessAdmin (https://<Web server name>/admin).
2. Click System > Status > IMS Server version. If you successfully installed 8.2.2-ISS-SAMESSO-IMS-FP0015, the IMS Server version is updated to 8.2.2.0.333.

Uninstalling the fix pack 

1. Stop the WebSphere Application Server (WAS) from First Steps.
2. Launch the command prompt with administrator privileges.
3. In the command prompt, browse to the <IMS Server installation path>/bin folder and locate unDeployMSSqlConfig.bat file.
4. Run the unDeployMSSqlConfig.bat script.
5. Start the WebSphere Application Server (WAS) from First Steps.