Tivoli Access Manager for Enterprise Single Sign-On

Transcription

1 Tivoli Access Manager for Enterprise Single Sign-On Version 6.0 DPRA Release Notes SC

2

3 Tivoli Access Manager for Enterprise Single Sign-On Version 6.0 DPRA Release Notes SC

4 Note: Before using this information and the product it supports, read the information in Notices, on page 9. First Edition (September 2006) This edition applies to version 6, release 0, modification 0 of IBM Tivoli Access Manager for Enterprise Single Sign-On (product number 5724-N70) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Release Notes IBM Tivoli Access Manager for Enterprise Single Sign-On: Desktop Password Reset Adapter Version 6.00 September, 2006 IBM is releasing version 6.00 of IBM Tivoli Access Manager for Enterprise Single Sign-On: Desktop Password Reset Adapter (TAM E-SSO: Desktop Password Reset Adapter). These release notes provide important information about this release. The information in this document supplements and supersedes information in the TAM E-SSO: Desktop Password Reset Adapter product documents. The following topics are discussed: What s New...2 Technical Notes...4 Resolved Issues...6 Open Issues...7 Product Documentation...8 Contacting Customer Support...9

6 What s New What s New TAM E-SSO: Desktop Password Reset Adapter delivers a secure and easy to use and administer self-service password-reset solution for the Windows password. It encourages enrollment and adoption as it provides a convenient means for accessing the reset process. These topics describe the major new features of this product. What s New in 6.00 Customizable User Interfaces The look and feel of TAM E-SSO: Desktop Password Reset Adapter Client pages (the Enrollment and Reset interviews) can be customized to the look and feel of any Organization. Under the Settings tab in the Management Console, the Enrollment UI and Reset UI panels can be used to adjust colors, fonts & logos. User Enrollment Status Report A new status report is available in the Management Console under the Users tab. This report has a new display feature which allows administrators to generate a report based on user s enrollment status. Role/Group Specific Challenge Questions System challenge questions can now be assigned to particular roles or user groups. Role/Group assignment determines the questions a user will be presented with during the enrollment interview. The question assignment is configured in the TAM E-SSO: Desktop Password Reset Adapter Management Console on the System Questions configuration page. Please see the TAM E-SSO DPRA Management Console Guide for more information. External Validator Support By default, TAM E-SSO: Desktop Password Reset Adapter requires that all the questions and weights used for reset are entered and set up by the administrator and answered by the user upon enrollment. TAM E-SSO: Desktop Password Reset Adapter can now also work with external validator sources to simplify this process. External validators allow Organizations to write an interface to their backend which can be accepted by TAM E-SSO: Desktop Password Reset Adapter. This validator can call data from various sources (i.e. HR database) which contain pre-defined answers. Please see the TAM E-SSO DPRA Management Console Guide for more information. Change Question Weights In previous versions of TAM E-SSO: Desktop Password Reset Adapter, once created, the weight of a question could not be changed. In this release, question weights may be modified. A possible ramification of modifying a correct response weight after a question has been created is that enrolled users may not be able to pass the reset test due to an insufficient score, even if they answer all the questions correctly. In attempt to prevent such an occurrence, if a correct response weight is changed, a dialog appears which presents the option to modify the question, or to disable the question and create a new one. The benefit to disabling a question and creating a new one is that currently enrolled users will not be affected by the changes. Please see the TAM E-SSO DPRA Management Console Guide for more information. 2 Release Notes

7 Server Unavailable Error Message What s New A new error message dialog box has been added. When a user clicks on the Reset button ("Forgot your password? Click here to reset it."), and the user's machine is not connected to the network, this dialog box appears and displays the error message: "The Reset server is not accessible because the network is disconnected." Built on.net Framework 2.0 TAM E-SSO: Desktop Password Reset Adapter now leverages the power of.net 2.0 to improve performance and management of Web services. Unlock Account Feature This new feature provides users with the ability to unlock their account instead of resetting their password. This feature adds functionality on both the TAM E-SSO: Desktop Password Reset Adapter Management Console and Reset Quiz: The Management Console "Settings" page contains the administrative checkbox setting to enable this feature: "Show 'Unlock Account only' option". If enabled, and the Reset Quiz has been completed successfully, an additional screen appears which gives the user the option to 'reset' their password or 'unlock' their account. 'Redirection' popup disabled In previous versions of TAM E-SSO: Desktop Password Reset Adapter, when the user clicked the TAM E-SSO: Desktop Password Reset Adapter button to redirect them to the external reset page, a Microsoft pop-up displayed that indicated that the user was being redirected. The ability to disable this popup has been implemented in this release. To disable this popup, the TAM E-SSO: Desktop Password Reset Adapter Client will now set the following setting before launching windowsinterface.exe and then restore it after: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings Value: WarnonZoneCrossing Ability to run the Reset client under a specified user account The TAM E-SSO: Desktop Password Reset Adapter Client now provides the ability to run the Reset client under a specified user account instead of the Local System account. This eliminates the possibility that the Reset client will have rights to access resources they should not be able to. To enable this feature, follow these steps: 1. Open a command prompt and run "aspnet_setreg - k:software\passlogix\sspr\windowsinterface -u:domain\username -p:password", replacing "domain\username" and "password" with real values. 2. Ensure the key "HKLM\Software\Passlogix\SSPR\WindowsInterface\ASPNET_SETREG" has been created. There should be two values in there, "password" and "username". 3. Rename the "ASPNET_SETREG" key to "RestrictedUser". 4. The Reset Client should launch under the configured user. The Enrollment Client will run under the logged-in user. To test this feature: 1. Open the Registry and browse to HKLM\Software\Passlogix\SSPR\WindowsInterface. 2. Copy the value of EnrollURL and set ResetURL to that value. 3. Launch the Reset client. The Enrollment screen should appear. 4. The Enrollment screen should successfully identify you as the specified user. 3 Release Notes

8 Technical Notes Technical Notes This section describes important technical information about this release. Role/Group Support As described above in the What s New section, system challenge questions can be assigned to particular roles or user groups. The assignment is done through the TAM E-SSO: Desktop Password Reset Adapter Management Console. There is a Users and Groups list which is populated with the domain s groups and individual users. These users and groups can then be assigned Allow and Deny rights. By default, if any user or group is placed in the Deny list, ALL users and groups are denied access except those specified in the Allow list. This means that if any user or group is placed in the Deny list, at least one user or group must be in the Allow list or everyone is denied access to the question. The rules surrounding this can be found in the TAM E-SSO DPRA Management Console Guide and in the Management Console Online Help. Active Directory Schema Error Schema error (code 35) occurs when applying Active Directory storage settings in TAM E- SSO: Desktop Password Reset Adapter under IIS 5.0 (Windows 2000 Server). This error occurs when TAM E-SSO: Desktop Password Reset Adapter Server v6.00 is installed in an environment that uses Windows 2000 Server (which uses IIS 5.0) and AD as the storage container. The security settings for VgoSelfServiceReset are configured under IIS 5.0. On the System tab of the TAM E-SSO: Desktop Password Reset Adapter Management Console, if a schema is configured to use AD as TAM E-SSO: Desktop Password Reset Adapter's storage settings, once the Submit button is clicked the following schema error is returned: "Error saving changes: Error saving schema: 0x35" Error code 35 indicates that AD did not allow an update to the schema. Write access must be enabled to the schema. Please refer to Microsoft s Schema Updates Require Write Access to Schema in Active Directory support article Q for more information ( Upgrade Notes If you are performing an upgrade from TAM E-SSO: Desktop Password Reset Adapter 5.0x to 6.00, please perform the following upgrade steps: Uninstall TAM E-SSO: Desktop Password Reset Adapter 5.0x first: 1. Uninstall TAM E-SSO: Desktop Password Reset Adapter Server 5.0x. 2. Install TAM E-SSO: Desktop Password Reset Adapter Please see the TAM E- SSO DPRA Installation and Setup Guide. 3. Once installed, apply the storage settings for the existing repository (created by TAM E-SSO: Desktop Password Reset Adapter 5.0x) through the TAM E-SSO: Desktop Password Reset Adapter Management Console s Storage page (under the System tab). Please see the TAM E-SSO DPRA Management Console Guide for 4 Release Notes

9 Technical Notes more information. Once this is done, the old user base and enrollment and reset logs will continue to be used. Reset AutomaticEnroll Key: During installation, the AutomaticEnroll key is reset to 0 and must be set back to 1, otherwise the Enrollment Interview does not automatically launch when a new user logs in. To reset this key: 1. Open the Registry and drill down to the following key: HKEY_Local_Machine > Software > Passlogix > SSPR > Windows Interface: AutomaticEnroll. 2. Change the value from 0 to 1. Reset Anonymous Access Account: During installation, the Windows User account for anonymous access in IIS Manager is reset to the default IUSR_<computer name> account. This must be reset back to the Administrator (or any account used) account. To do this: 1. Open the IIS Manager on the TAM E-SSO: Desktop Password Reset Adapter Server machine. 2. In the left tree pane, expand Internet Information Services > Web sites > Default Web sites. 3. Right-click on vgoselfservicereset and select Properties. 4. Select the Directory Security tab. 5. Under Authentication and Access Control, click Edit. Change the Windows User account for anonymous access back to the appropriate account, for example, the Administrator account. 5 Release Notes

10 Resolved Issues Resolved Issues This section describes issues that were reported in earlier releases of TAM E-SSO: Desktop Password Reset Adapter and have been resolved in this release: Issue TAM E-SSO: Desktop Password Reset Adapter did not adhere to the Minimum Password Age Policy setting Error message received when viewing Enrollment and Reset information Error message received when installing TAM E- SSO: Desktop Password Reset Adapter HotFixes Error message received during enrollment "Deferral of Enrollment" functionality did not work with all values Command Line install forced user to reboot machine Timeout error message received Description Users were able to circumvent the password age minimum because they had the ability to reset their password an unlimited amount of times. Users should have only been allowed to change their domain password once per every number of days configured in the policy. When viewing User Enrollment and Reset information through the TAM E-SSO: Desktop Password Reset Adapter management console, if a previously enrolled user cannot be found in the domain, TAM E-SSO: Desktop Password Reset Adapter reports the following error: "Error retrieving information. Please ensure the storage settings are correctly set." TAM E-SSO: Desktop Password Reset Adapter periodically displayed an error message when installing TAM E-SSO: Desktop Password Reset Adapter HotFixes. When enrolling in TAM E-SSO: Desktop Password Reset Adapter 5.0x, the "Next Enroll Question" would return an unknown question type error message. The "Deferral of Enrollment" functionality was not working with any value other than "0" (i.e., user is not permitted any deferrals). Administrators should have the ability to set the deferral functionality to any number they choose before users are forced to enroll. Installing the TAM E-SSO: Desktop Password Reset Adapter Client via the /q command line switch would force the user to reboot the machine. If the Enrollment or Reset tabs were clicked, a timeout error message was received. This issue was only seen if a large amount of users existed in the directory (10,000+). 6 Release Notes

11 Open Issues Open Issues This section describes issues that remain open in this release. The table lists the issue and a detailed description, if applicable. Issue Description Upgrade of the TAM E- If a user upgrades to a previously configured TAM E-SSO: SSO: Desktop Desktop Password Reset Adapter server, anonymous access Password Reset configurations are overwritten and the user must reconfigure. Adapter Server overwrites anonymous IBM is currently working on a resolution to this issue. access settings TAM E-SSO: Desktop Password Reset Adapter Console fails when a remote SQL Server is initialized TAM E-SSO: Desktop Password Reset Adapter Console fails when a remote SQL Server is initialized (database and tables created). This issue does not occur when the SQL Server is located on the same machine as the TAM E-SSO: Desktop Password Reset Adapter Server. To workaround this issue: 1. Copy the SQL scripts from the machine running TAM E- SSO: Desktop Password Reset Adapter Server to the SQL Server machine. The SQL files are in the "SSPR\WebServices" folder of the TAM E-SSO: Desktop Password Reset Adapter Server install directory. The files are "SQLDatabase.sql" and "SQLTables.sql". 2. On the SQL Server, click Start > Program Files > Microsoft SQL Server > Query Analyzer. 3. Log into SQL Server with a user that has administrative access. 4. Open "SQLDatabase.sql" and execute the query (ensure "master" is the active database). 5. Open "SQLTables.sql" and execute the query. Note: Only follow these steps if the TAM E-SSO: Desktop Password Reset Adapter Anonymous Web account is not the same account as the SQL administrator. 1. Click Start > Program Files > Microsoft SQL Server > Enterprise Manager. 2. Expand Microsoft SQL Servers > SQL Server Group > [Machine] > Security. 3. Right-click Logins and choose New Login Click the "..." button next to Name and select the SSPR Anonymous Web account. 5. Select SSPR as the default database. 6. On the Database Access tab, check SSPR and then check db_owner in the roles list. 7. Click OK to close the dialog. 7 Release Notes

12 Product Documentation Product Documentation The following documents support this product: TAM E-SSO DPRA Installation and Setup Guide TAM E-SSO DPRA Management Console Guide TAM E-SSO DPRA User Guide 8 Release Notes

13 Contacting Customer Support Contacting Customer Support Before contacting IBM Tivoli Software Support with a problem, refer to the IBM Tivoli Software Support site by clicking the Tivoli support link at the following Web address: If you need additional help, contact software support by using the methods described in the IBM Software Support Guide at the following Web address: The guide provides the following information: Registration and eligibility requirements for receiving support Telephone numbers, depending on the country in which you are located A list of information you should gather before contacting customer support 9 Release Notes

14 Appendix. Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user s responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo , Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Copyright IBM Corp

15 Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged should contact: IBM Corporation 2ZA4/ Burnet Road Austin, TX U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee. The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. Trademarks The following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both: AIX DB2 developerworks eserver IBM iseries Lotus Passport Advantage pseries RACF Rational Redbooks Tivoli WebSphere zseries Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. 10 IBM Tivoli Access Manager for Enterprise Single Sign-On: DPRA Release Notes

16 Intel, Intel Inside (logos), MMX and Pentium are trademarks of Intel Corporation in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. Linux is a trademark of Linus Torvalds in the U.S., other countries, or both. Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. Other company, product, and service names may be trademarks or service marks of others. Appendix. Notices 11

17 12 IBM Tivoli Access Manager for Enterprise Single Sign-On: DPRA Release Notes

18

19 Printed in USA SC