TIBCO ActiveMatrix Policy Agent Release Notes

Software Release 2.0.0 November 2007

Important Information
SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED TIBCO SOFTWARE IS SOLELY TO ENABLE THE FUNCTIONALITY (OR PROVIDE LIMITED ADD-ON FUNCTIONALITY) OF THE LICENSED TIBCO SOFTWARE. THE EMBEDDED OR BUNDLED SOFTWARE IS NOT LICENSED TO BE USED OR ACCESSED BY ANY OTHER TIBCO SOFTWARE OR FOR ANY OTHER PURPOSE. USE OF TIBCO SOFTWARE AND THIS DOCUMENT IS SUBJECT TO THE TERMS AND CONDITIONS OF A LICENSE AGREEMENT FOUND IN EITHER A SEPARATELY EXECUTED SOFTWARE LICENSE AGREEMENT, OR, IF THERE IS NO SUCH SEPARATE AGREEMENT, THE CLICKWRAP END USER LICENSE AGREEMENT WHICH IS DISPLAYED DURING DOWNLOAD OR INSTALLATION OF THE SOFTWARE (AND WHICH IS DUPLICATED IN TIBCO ActiveMatrix Policy Agent Users Guide) OR IF THERE IS NO SUCH SOFTWARE LICENSE AGREEMENT OR CLICKWRAP END USER LICENSE AGREEMENT, THE LICENSE(S) LOCATED IN THE LICENSE FILE(S) OF THE SOFTWARE. USE OF THIS DOCUMENT IS SUBJECT TO THOSE TERMS AND CONDITIONS, AND YOUR USE HEREOF SHALL CONSTITUTE ACCEPTANCE OF AND AN AGREEMENT TO BE BOUND BY THE SAME. This document contains confidential information that is subject to U.S. and international copyright laws and treaties. No part of this document may be reproduced in any form without the written authorization of TIBCO Software Inc.

TIB, TIBCO, TIBCO Software, TIBCO Adapter, Predictive Business, Information Bus, The Power of Now, BusinessWorks, TIBCO Administrator, TRA, TIBCO Enterprise Message Service, TIBCO Designer, TIBCO ActiveMatrix are either registered trademarks or trademarks of
TIBCO Software Inc. in the United States and/or other countries. EJB, J2EE, and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. All other product and company names and marks mentioned in this document are the property of their respective owners and are mentioned for identification purposes only. THIS SOFTWARE MAY BE AVAILABLE ON MULTIPLE OPERATING SYSTEMS. HOWEVER, NOT ALL OPERATING SYSTEM PLATFORMS FOR A SPECIFIC SOFTWARE VERSION ARE RELEASED AT THE SAME TIME. SEE THE README.TXT FILE FOR THE AVAILABILITY OF THIS SOFTWARE VERSION ON A SPECIFIC OPERATING SYSTEM PLATFORM. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. THIS DOCUMENT COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE INFORMATION HEREIN; THESE CHANGES WILL BE INCORPORATED IN NEW EDITIONS OF THIS DOCUMENT. TIBCO SOFTWARE INC. MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED IN THIS DOCUMENT AT ANY TIME. THE CONTENTS OF THIS DOCUMENT MAY BE MODIFIED AND/OR QUALIFIED, DIRECTLY OR INDIRECTLY, BY OTHER DOCUMENTATION WHICH ACCOMPANIES THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY RELEASE NOTES AND "READ ME" FILES. Copyright 2006-2007 TIBCO Software Inc. ALL RIGHTS RESERVED. TIBCO Software Inc. Confidential Information

| iii

Contents

Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
New Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Release 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Changes in Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Release 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Deprecated Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Release 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Migration and Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Release 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Closed Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Known Issues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

TIBCO ActiveMatrix Policy Agent Release Notes

iv

TIBCO ActiveMatrix Policy Agent Release Notes

|1

Release Notes

Check the TIBCO Product Support web site at https://support.tibco.com for product information that was not available at release time. Entry to this site requires a username and password. If you do not have a username, you can request one. You must have a valid maintenance or support contract to use this site.

Topics
New Features, page 2 Changes in Functionality, page 3 Deprecated Features, page 4 Migration and Compatibility, page 5 Closed Issues, page 6 Known Issues, page 7

TIBCO ActiveMatrix Policy Agent Release Notes

Release Notes

New Features
This section lists features added since the last major (x.0.0) release of this product.

Release 2.0
The following are new features in this release.
SKI Subject Key Identifier is supported. SOAP/HTTPS Proxy agents support SOAP/HTTPS protocols. SOAP 1.2 Policy Agent supports the SOAP 1.2 protocol. Secure Proxy Agents The proxyAgentConfig utility accepts SSL-related

parameters to configure secure communication with other components, consumers and providers.
Routing Policy Manager 8.0 includes new policy types can route requests to target providers; proxy agents can enforce routing policies. SOAP/JMS Proxy agents now support SOAP/JMS (consumers and

providers).
Samples Added a routing policy sample. Universal Installer This release uses the new TIBCO Universal Installer.

TIBCO ActiveMatrix Policy Agent Release Notes

Changes in Functionality 3

Changes in Functionality
This section lists changes in functionality since the last major (x.0.0) release of this product.

Release 2.0
This release does not include changes in functionality.

TIBCO ActiveMatrix Policy Agent Release Notes

Release Notes

Deprecated Features
This section describes deprecated features and lists equivalent features that accomplish the same result, if relevant. Any use of a deprecated feature should be discontinued as it may be removed in a future release. You should avoid becoming dependent on deprecated features and become familiar with the equivalent feature.

Release 2.0
None

TIBCO ActiveMatrix Policy Agent Release Notes

Migration and Compatibility 5

Migration and Compatibility

This section explains how to migrate from a previous release to this release.

Release 2.0
See migration instructions in TIBCO ActiveMatrix Policy Manager Installation.

TIBCO ActiveMatrix Policy Agent Release Notes

Release Notes

Closed Issues
The table in this section list issues that were closed in the named releases. Reference # and Release Summary

Issues Closed in Release 2.0 1-7A0P5R 2.0 1-7X70DL 2.0 1-80I5OD 2.0 1-80HRBZ 2.0 1-80RF93 2.0 Fixed a defect in which several proxy agents (registered with one central services instance) all had identical nameswhich made it difficult to differentiate them in the console. Proxy agent names now incorporate the proxy host name and port. Fixed a defect in which proxy agents attempted to decrypt all inbound messages from consumers, even in the absence of a decryption policy. Fixed a defect in whicheven in the absence of a decryption policyproxy agents decrypted messages to obtain SOAP operation names, and erroneously forwarded the resulting cleartext message rather than the ciphertext. Fixed a defect in which uninstalling Service Grid would uninstall .jar files which Policy Manager and Policy Agent require, and without which they could no longer function. Subject Key Identifier (SKI) is supported in this release.

TIBCO ActiveMatrix Policy Agent Release Notes

Known Issues 7

Known Issues
The table in this section lists known issues in this release. Change Request ID Summary/Workaround

Known issues in release 2.0.0 1-8HPOIW 2.0

Summary The TIBCO Universal Installer program installs all TIBCO software

under the same TIBCO home directory. If the location of this directory is not yet determined, the installer prompts you to supply it. If you supply the parent directory of the 1.1 release, the installer will place the 2.0 release alongside the 1.1 release. If you supply a different location as the TIBCO home directory, the installer will place the 2.0 release under that locationpreventing the migration utility from operating correctly.
Workaround Supply the parent directory of the 1.1 release as the new TIBCO home directory.

1-8J8TM2 2.0

Summary When creating a routing policy for the SOAP/JMS endpoints, the values you specify for the attributes JMSConnection and JMSDestination are not validated. Workaround None

1-8CJM7D 1-8B1QWX 1-8DNUW5 1-8IXU6M 2.0

Summary JMS Server Connection Error

In situations where a proxy agent manages a JMS endpoint, and the JMS server is down, then this can inhibit Policy Manager console tasks. In particular the console can fail to complete operations involved in managing endpoints, policies or infrastructure. The console reports a JMS server connection error.
Workaround Do these steps:

1. Restart the JMS server. 2. Restart the proxy agent. 3. Do the console task again.

TIBCO ActiveMatrix Policy Agent Release Notes

Release Notes

Change Request ID 1-8LE3MG 1-80XGN4 2.0

Summary/Workaround
Summary The utility registerGenericServices, when called with its
-registerOnlyEndpoints

option, nonetheless both registers and manages

services.
Workaround Two workarounds are possible:

1-8HEEGS 2.0

Register endpoints using the Policy Manager console. Register endpoints using registerGenericServices, then unmanage the services that you intend to be registered (but not managed).

Summary When an agent logs message exchanges to an Oracle 9i database, the agent stores the request and response properties, but not the request and response details. Workaround To resolve this problem, replace the Oracle 9i driver with a driver from Oracle 10g. Download the file ojdbc14.jar from the Oracle web site, and install it in the location specified in TIBCO ActiveMatrix Policy Manager Installation, in the appendix, Other Databases, Overview, JDBC Driver.

1-8LH4MA 2.0

Summary It is not possible to edit a routing policy after the policy is in the applied state. This restriction includes reconfiguring settings, adding target endpoints, removing target endpoints, and changing the routing type. Workaround Two workarounds are possible:

Edit the routing policy from the Policies tabselect the policy, click Edit > Edit Policy. Delete the existing routing policy, and create a new replacement policy. For instructions, see TIBCO ActiveMatrix Policy Agent Users Guide.

TIBCO ActiveMatrix Policy Agent Release Notes

Known Issues 9

Change Request ID 1-8KE5P9 2.0

Summary/Workaround
Summary When a consumer on a Windows platform sends an encrypted request to a provider on a Solaris platform, the decryption operation at the providers agent fails, rejecting the request message. Workaround Modify the providers list of security providers:

1. In the directory tibco_home/tibcojre/1.5.0/lib/security, use a text editor to open the file java.policy. 2. Find List
of providers and their preference orders.

3. Rearrange the list, moving the SunPKCS11 provider to the bottom, and renumbering accordingly:
security.provider.1=sun.security.provider.Sun security.provider.2=sun.security.rsa.SunRsaSign security.provider.3=com.sun.net.ssl.internal.ssl.Provider security.provider.4=com.sun.crypto.provider.SunJCE security.provider.5=sun.security.jgss.SunProvider security.provider.6=com.sun.security.sasl.Provider security.provider.7=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/sunpkcs11-solaris.cfg

4. Save the modified file. 5. Restart the proxy agent. 1-8JCQM9 2.0
Summary When registering a UDDI infrastructure item, subsequent synchronization does not add pre-existing proxy endpoints or registered endpoints to the registry. (It does add endpoints that you register or manage after registering the UDDI infrastructure item.) Workaround Always register the UDDI infrastructure item before registering or managing any services.

1-8IUMVY 2.0

Summary When a proxy agent manages a proxy endpoint for a Service Grid SOAP endpoint, then before undeploying the service assembly, you must first delete the proxy endpointotherwise, you can never delete the proxy endpoint.

TIBCO ActiveMatrix Policy Agent Release Notes

10

Release Notes

Change Request ID 1-8KPFW7 2.0

Summary/Workaround
Summary When creating a proxy endpoint to manage a SOAP/JMS Service Grid endpoint, Policy Manager erroneously creates an extra endpoint (with None as the value of Agent Type, under Management Details).

The presence of this extra endpoint does not interfere with correct policy enforcement at the proxy endpoint, nor at the Service Grid endpoint. However, you cannot view message exchange logs (from a logging policy) at the Service Grid endpoint. Removing the proxy endpoint does not also remove the extra endpoint, nor can you explicitly remove the extra endpoint.
Workaround None

1-8MHUNB 2.0

Summary A typographical error occurs in the product documentation for TIBCO ActiveMatrix Policy Agent 2.0. In Chapter 7 of the TIBCO ActiveMatrix Policy Agent User's Guide ("Integrating BusinessWorks with Policy"), the section "Non-Overlapping Functionality" on page 100 reads:

"It also supports encryption of selected elements only (for example, some SOAP headers, some fields of the message)." This is incorrect, and should read: "It also supports encryption of selected elements of request only (for example, some fields of the message)." Note that selective encryption is only supported on the SOAP body elements of the service request. Known issues in release 1.1.0 1-805KWV 1.1.0 1-80O262 1.1.0
Summary When a service has two or more proxy endpoints, and only some of them have logging policies, then attempting to view logs at a proxy endpoint without a logging policy causes the console to throw an exception. Summary Policy criteria do not properly exclude a service based on deployment structure properties of BusinessWorks services (added by the utility registerBWServices). (However, criteria do work properly when they include a service based on these properties.) Workaround Modify the criteria to exclude the service based on its endpoint

name, rather than on deployment properties.

TIBCO ActiveMatrix Policy Agent Release Notes

Known Issues 11

Change Request ID 1-80BB9H 1-7TOZ22 1.1.0

Summary/Workaround
Summary Agents do not revisit inaccessible keystores. For example, if a keystore URL is inaccessible when a proxy agent receives a policy that refers to that keystore, then the proxy agent does not subsequently find the missing keystore, even after it becomes accessible. Workaround Two workarounds are possible:

Ensure keystores are accessible when configuring and applying policies that use them. Manually unregister and re-register affected keystores, then re-apply at least one policy that uses each affected keystore.

Known issues in release 1.0.0 1-7TPLKJ 1.0.0 1-7T0078 1.0.0

Summary Proxy agents enforce cryptographic receiving policies before logging policies, so logs contain plaintext requests. Summary The policy Authentication: Signature presents an interoperability issue with TIBCO BusinessWorks. BusinessWorks lets consumers use a different certificate for authentication than for ensuring message integrity. Policy Manager does not support this distinction, so it cannot authenticate messages from BusinessWorks services that use distinct certificates for these two purposes. Workaround BusinessWorks services must specify the same certificate for authentication and integrity.

1-7TCW4C 1.0.0

Summary If the environment variable TIBCO_HOME has a different value when installing ActiveMatrix Service Grid and Policy Manager than it had when installing TIBCO Hawk and TRA, then the BusinessWorks registration utility will fail. Workaround Two workarounds are possible:

Ensure that TIBCO_HOME has the same value for all four products. Manually edit the following script file to reflect the correct locations for TIBCO Hawk and TRA.
Windows tibco_home/amx/1.0/policyagent/bin/setenv.bat UNIX tibco_home/amx/1.0/policyagent/bin/setenv.sh

TIBCO ActiveMatrix Policy Agent Release Notes

12

Release Notes

TIBCO ActiveMatrix Policy Agent Release Notes