IBM Security Verify Information Queue
=====================================
10.0.12 Release - Jul 28, 2026

-------------------------------------------------------------------------------
| Contents of Starter Kit Zip File                                            |
-------------------------------------------------------------------------------
cfg - user-customizable configuration files
docs - ISIQ Deployment Guide, User's Guide, Troubleshooting Guide, and FAQ
license - ISIQ license files
openshift - YML files and scripts for deploying ISIQ on OpenShift Container Platform
kubernetes - YML files and scripts for deploying ISIQ on Kubernetes
util - utility scripts and an IGI trigger zip file for enabling EVENT_OUT_USER
yml - YML files for both a single-node docker swarm and for a cluster
isiq - shell script to consolidate and simplify common ISIQ administrator functions

At a minimum, you will need to run `isiq setup` to (a) download the latest ISIQ docker
images and (b) generate an SSL certificate for nginx if you do not already have a
certificate from a prior ISIQ installation. Also, edit the cfg/oidc/oidcSettings.json
file to specify your OIDC provider. Please refer to the ISIQ Deployment Guide for
full details on setting up ISIQ.

-------------------------------------------------------------------------------
| Recent ISIQ Updates                                                         |
-------------------------------------------------------------------------------
10.0.12 (Jul 28, 2026)
  - Upgrade dependent libraries and images to latest and removed kafka-connect-cia
    project to resolve vulnerabilities.

10.0.11 (Aug 31, 2025)
  - Add support for using .iq_grouprdn in txdef.json.  It represents the
    attribute used for the DN of a group.  Previously this was handled by
    .iq_groupname and .iq_groupid, which still exist, but you had to use the
    correct one for your group profile.  .iq_grouprdn will always use the
    correct value.
  - Upgrade dependent libraries and images to latest to resolve vulernabilities

10.0.10 (Jan 31, 2025)
  - Add support for ISIM on Liberty (Container and Software)
  - Upgrade dependent libraries and images to latest to resolve vulnerabilities
  ==> PLEASE REVIEW UPGRADE NOTE REGARDING INFLUX DB DATA

10.0.9 (Jul 2, 2024)
  - Remove deprecated appid login method due to multiple vulnerabilities
  - Upgrade dependent libraries and images to latest to resolve vulnerabilities

10.0.8 (Mar 13, 2024)
  - Upgrade kafka and postgreSQL mod levels to remediate security vulnerabilities
  - Allow LDAP directory connector polling delay to be configurable
  - Fix `isiq upgrade` error when merging broker-stack.yml file from pre-10.0.6 level

10.0.7 (Dec 13, 2023)
  - Add new /kubernetes directory with yaml files geared to non-OpenShift K8S deployments
  - Improve algorithm for deleting an IGI application when its corresponding ISIM service is deleted

10.0.6 (Aug 22, 2023)
  - Upgrade Zookeeper from 3.4.14 to 3.6.4 to remove Zookeeper's last log4j dependency
  - Move clientId & clientSecret out of oidcSettings.json to better protect client data

10.0.5 (May 10, 2023)
  - Upgrade 3rd party libraries to remediate security vulnerabilities
  - Ensure that a deleted ISIM service triggers a delete of the corresponding IGI application
  - Add more debug tracing when ISIQ_LOG_OIDC=true is specified

10.0.4 (November 11, 2022)
  - Relocate ISIQ images from Docker Hub to IBM Cloud Container Registry
  - Upgrade to Kafka 3.2.0, which removes log4j 1.x and replaces it with reload4j
  - Support creating custom persons in IGI-to-ISIM event processing
  - Add ALERT_LAG_MIN env var to set a threshold for consumer lag warnings
  - Fix Oracle SQL queries that were incorrectly using the LIMIT clause
  - Upgrade to Java 8.64.0.19 level in isiq-connect image to obtain latest security fixes

10.0.3 (March 30, 2022)
  - Upgrade log4j from 2.16.0 to 2.17.2
  - Improve error handling of IGI data anomalies such as invalid null columns
  - Ensure that an event completion status gets sent from ISIM back to IGI
  - Allow LDAP search limit and lookahead values to be configured
  - Modify OpenShift YMLs to set fs permissions for influx/grafana
  - Upgrade ELK component versions in the optional logs stack

10.0.2 (December 20, 2021)
  - Upgrade the Kafka version in broker-stack.yml from 5.3.0 to 6.2.0
    ==> Please see Upgrade notes below for MANDATORY configuration step <==
  - Upgrade log4j from 1.2.17 to 2.16.0
  - Show System Health dashboard alerts even if no products are configured
  - Allow IGI events from a specific user to be skipped when integrating with ISIM
  - Improve handling of case differences when integrating ISIM data to IGI

10.0.1 (June 18, 2021)
  - Prevent unnecessary Modify Account events from going to IGI
  - Allow services to be excluded or included when configuring an ISIM data source
  - Add the ability to pause an individual ISIQ connector
  - Correct how ISIM account renames and orphaned accounts are propagated to IGI
  - Support Microsoft Azure AD as an OIDC provider for ISIQ logins

10.0.0 (December 18, 2020)
  - Add an Audit feature to record and display key ISIQ lifecycle events
  - Implement a Vault service to manage product password encryption/decryption
  - Rebrand 'IBM Security Information Queue' as 'IBM Security Verify Information Queue'

1.0.7 (August 7, 2020)
  - Add an ISIGADI-to-ISIQ migration tool
  - Implement a new Sharing Center as an enhanced approach to group management
  - Support more options for determining which ISIM data to collect or skip

-------------------------------------------------------------------------------
| Upgrade Considerations                                                      |
-------------------------------------------------------------------------------
!!!!!!!! WHEN UPGRADING TO 10.0.10 OR LATER, YOU MUST DO THE FOLLOWING !!!!!!!!!
(1) As root, cd to /var/lib/docker/volumes/connect_isiq_metricsdb
(2) chown -R nobody:nobody _data
(3) If using the example logs stack, repeat for /var/lib/docker/volumes/logs_isiq_influxdata

The influxDB containers in earlier versions of ISIQ had been left at their default user settings, which caused them to run as "root".  To rectify this, the yaml files have been updated to run them as the "nobody" user.  The IMPORTANT point here is that the files must match the uid running the InfluxDB process.  There are at least 3 options:

1. Edit the connect-stack and logs-stack yaml files to remove the "user: nobody" line from the influxDB services.  This will allow them to continue to run as root, and no further changes are needed.

2. Accept the new default setting of "nobody", and follow the steps above to update the files to be owned by "nobody". Be sure to check the group setting for "nobody" as well.  On Ubuntu, it tends to be called "nogroup" instead of "nobody".

3. Select a different userid to run the InfluxDB server.  In that case, edit the yamls to specify which user to use, and then run the steps above providing that userid to the "chown" command to update the file permissions.


The nginx image was also changed to its unprivileged variant, so it will not run as root.  Be sure to diff your existing nginx.conf file with the one provided in v10.0.10 for important changes.

The most important is this new line at the start of the file:

pid /tmp/nginx.pid;

Without that, the image will fail to start with a Persmission denied error.  The SSL protocols and ciphers were also adjusted to improve security.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;

TLSv1.3 was added to the supported protocols, while the ciphers were changed from "HIGH" to a specific set that do not have known vulnerabilities.  It is not required to adjust these lines, but it is highly recommended.



!!!!!!!! WHEN UPGRADING TO 10.0.2 OR LATER, YOU MUST DO THE FOLLOWING !!!!!!!!!
(1) As root, cd to /var/lib/docker/volumes/broker_isiq_kdata
(2) chown -R 1000:1000 _data
The switch from Kafka 5.3.0 to 6.2.0 changed the default owner of Kafka's docker
volumes from root to a non-root user with id 1000. If you don't run this chown
command (note: you only need to run the command once on each of your ISIQ nodes
after installing 10.0.2 or later) and you start your docker swarm, then your
Kafka containers will repeatedly fail, restart, fail, etc. After upgrading to
ISIQ 10.0.2 or later, if you notice instability in your Kafka containers, please
check for this permission issue since it's the most likely explanation.
*******************************************************************************

Other considerations when upgrading from a pre-10.0.2 ISIQ release:
(1) Review the latest changes to the /cfg/connect/txdef.json file. The file
contains transformation rules for mapping attributes between ISIM and IGI.
In an ISIQ release, there may be fixes and enhancements in txdef.json. If you
have a customized copy of txdef.json, run a 'diff' against the newly installed
txdef.json to examine the latest changes and to determine how to merge them to
your copy of txdef.json.

(2) If you use "./isiq upgrade" to preserve your configuration files in case
you've modified them, be aware that the "./isiq upgrade" backup file is now
named <data>_<time>.backup_cfg.tar.gz.



(c) 2019-2024 IBM

