NovellAccessManager3.
1SP3IR2Readme1NovellNovellAccessManager3.
1SP3IR2ReadmeJuly19,2011ThisReadmedescribestheNovellAccessManager3.
1SP3IR2release.
Section1,"Documentation,"onpage1Section2,"UpgradingtoAccessManager3.
1SP3IR2,"onpage1Section3,"BugsFixedinAccessManager3.
1SP3IR2,"onpage4Section4,"KnownIssuesinAccessManager3.
1SP3IR2,"onpage6Section5,"LegalNotices,"onpage91DocumentationThefollowingsourcesprovideinformationaboutNovellAccessManager:DocumentationWebSite(http://www.
novell.
com/documentation/novellaccessmanager31/index.
html).
AccessManagerSupport(http://www.
novell.
com/support/microsites/microsite.
do).
ForTIDsandCoolSolutionsarticles,selectAccessManagerfortheProductandArticles/TipsintheAdvancedSearchoptions.
NovellAccessManagerProductSite(http://www.
novell.
com/products/accessmanager/).
2UpgradingtoAccessManager3.
1SP3IR2Section2.
1,"UpgradingthePurchasedProduct,"onpage1Section2.
2,"InstallingtheHigh-BandwidthSSLVPNServer,"onpage42.
1UpgradingthePurchasedProductAfteryouhaveobtainedAccessManager3.
1SP3IR2orapreviousreleaseofAccessManager,logintotheNovellCustomerCenter(http://www.
novell.
com/center),thenfollowthelinkthatallowsyoutodownloadthesoftware.
Thefollowingfilesareavailable:FilenameDescriptionAM_31_SP3_IR2_IdentityServer_Linux32.
tar.
gzContainstheLinuxIdentityServer,theLinuxAdministrationConsole,theESP-enabledSSLVPNServer,andtheTraditionalSSLVPNServer.
AM_31_SP3_IR2_IdentityServer_Win32.
exe2NovellAccessManager3.
1SP3IR2ReadmeForupgradeandinstallationinformation:"UpgradeInstructions"onpage2"InstallationInstructions"onpage3"VerifyingVersionNumbersBeforeUpgrading"onpage3"VerifyingVersionNumbersAfterUpgrading"onpage3ContainstheWindowsIdentityServerandWindowsAdministrationConsoleforWindowsServer2003.
AM_31_SP3_IR2_IdentityServer_Win64.
exeContainstheWindowsIdentityServerandWindowsAdministrationConsoleforWindowsServer2008.
AM_31_SP3_IR2_AccessGatewayAppliance_Linux_SLES9.
tar.
gzContainstheupgradeRPMsforthe(SUSELinuxEnterpriseServer)9versionoftheAccessGatewayApplianceandtheTraditionalSSLVPNserver.
AM_31_SP3_IR2_AccessGatewayAppliance_Linux_SLES11.
tar.
gzContainstheupgradeRPMsforthe(SUSELinuxEnterpriseServer)11versionoftheAccessGatewayApplianceandtheTraditionalSSLVPNserver.
AM_31_SP3_ConfigurationUpgrade.
zipContainsthescripttoenablethesessionstickinessoptionforexistingproxyservicesandallowtargetoptionfortheintersitetransferservice.
Thisoptionisdisabledonanupgradefrom3.
1SP2IR3to3.
1SP3IR2.
AM_31_SP3_IR2_AccessGatewayService_Win64.
exeContainstheAccessGatewayServiceforWindowsServer2008R2witha64-bitoperatingsystem.
AM_31_SP3_IR2_AccessGatewayService_Linux64.
binContainstheAccessGatewayServicefor(SUSELinuxEnterpriseServer)11witha64-bitoperatingsystem.
AM_31_SP3_IR2_ApplicationServerAgents_AIX.
binContainstheAgentsservicefortheAIXplatform.
AM_31_SP3_IR2_ApplicationServerAgents_Linux.
binContainstheAgentsservicefortheLinuxplatform.
AM_31_SP3_IR2_ApplicationServerAgents_Solaris.
binContainstheAgentsservicefortheSolarisplatform.
AM_31_SP3_IR2_ApplicationServerAgents_Windows.
exeContainstheAgentsservicefortheWindowsplatform.
FilenameDescriptionNovellAccessManager3.
1SP3IR2Readme32.
1.
1UpgradeInstructionsForinstructionsonupgradingfrom3.
1SP3,3.
1SP3IR1to3.
1SP3IR2,see"UpgradingAccessManagerComponents"intheNovellAccessManager3.
1SP3InstallationGuide.
Toverifythatyourcomponentsarerunning3.
1SP3,3.
1SP3IR1see"VerifyingVersionNumbersbeforeUpgrading"onpage3.
AnyAccessManagerversionpriorto3.
1SP2IR2shouldbefirstupgradedto3.
1SP3.
Formoreinformationonupgradingto3.
1SP3,seetheNovellAccessManager3.
1SP3InstallationGuide.
2.
1.
2InstallationInstructionsForinstallationinstructionsfortheAccessManagerAdministrationConsole,theIdentityServer,theAccessGatewayAppliance,theAccessGatewayService,andtheSSLVPNserver,seetheNovellAccessManager3.
1SP3InstallationGuide.
2.
1.
3VerifyingVersionNumbersbeforeUpgradingIfyouareupgradingfromAccessManager3.
0,allcomponentsmustbefirstupgradedtoAccessManager3.
1SP3beforeupgradingtoAccessManager3.
1SP3IR2.
1IntheAdministrationConsole,clickAccessManager>Auditing>Troubleshooting>Version.
2ExaminethevalueintheVersionfield.
Thefollowingtableindicatestheversionsthatcanbeupgradedto3.
1SP3IR2.
2.
1.
4VerifyingVersionNumbersafterUpgradingWhenyouhavefinishedupgradingyourAccessManagercomponents,verifythattheyhaveallbeenupgraded.
1IntheAdministrationConsole,clickAccessManager>Auditing>Troubleshooting>Version.
2ExaminethevalueintheVersionfieldtoverifythatthecomponenthasbeenupgradedto3.
1SP3IR2.
Component3.
1SP33.
1SP3IR1AdministrationConsole3.
1.
3.
2473.
1.
3.
273IdentityServer3.
1.
3.
2473.
1.
3.
273LinuxAccessGateway3.
1.
3.
2473.
1.
3.
273AccessGatewayServices3.
1.
3.
2473.
1.
3.
273SSLVPN3.
1.
3.
2473.
1.
3.
273Component3.
1SP3IR2AdministrationConsole3.
1.
3.
292IdentityServer3.
1.
3.
292LinuxAccessGateway3.
1.
3.
292AccessGatewayServices3.
1.
3.
2924NovellAccessManager3.
1SP3IR2Readme2.
2InstallingtheHigh-BandwidthSSLVPNServerThekeyforthehigh-bandwidthSSLVPNserverdoesnotshipwiththeproductbecauseofexportlawsandrestrictions.
Thehigh-bandwidthversiondoesnothavetheconnectionandperformancerestrictionsthatarepartoftheversionthatshipswiththeproduct.
YourregularNovellsaleschannelcandetermineiftheexportlawallowsyoutoorderthehigh-bandwidthversionatnoextracost.
Afteryouhaveobtainedauthorizationforthehigh-bandwidthversion,logintotheNovellCustomerCenter(http://www.
novell.
com/center)andfollowthelinkthatallowsyoutodownloadthehigh-bandwidthkey.
3BugsFixedinAccessManager3.
1SP3IR2Section3.
1,"IdentityServer,"onpage4Section3.
2,"LinuxAccessGatewayAppliance,"onpage5Section3.
3,"AccessGatewayService,"onpage53.
1IdentityServerFixedanissuewherethepasswordfetchmethoddoesnotgetexecutedatourSAML2.
0ServiceProviderwhileconsuminganassertionfromtheidentityproviderserverthroughtheinter-sitetransferURLFixedanissuewheretheusercouldnotsetavalueforSAML2.
0RequestedAuthnContextcomparisonexcept"Exact.
"FixedanissuewhereauthenticationfailedforWSFederationwithSharePoint2010afterapplying3.
1SP3whenthetimesfortheidentityproviderWSFedwerenotsynchronized.
Formoreinformation,see"AssertionValidityWindow.
"FixedanissuewheretheKerberosauthenticationfailedwhentherequestwasproxiedbyanidentityprovidertoanotheridentityprovider.
FixedanissuewheretheclustercookiesdidnothaveanysecureandHTTPOnlyoptions.
Theseoptionsarenotenabledbydefault,andtheweb.
xmloptionsareintroducedtoenabletheseoptions.
Formoreinformation,see"EnablingSecureorHTTPOnlyFlagsforClusterCookies.
"FixedanissuewheretheserviceprovidergeneratedtwoSAMLSSOrequests,resultingintwosessionindexesthatcausedincompletesinglelogout.
FixedanissuewhentheidentityserverinaclusterreceivedaSAML2.
0logoutrequestwheretheauthenticationwasperformedonadifferentnode.
FixedanissuewhereaSAML2.
0attributequeryresponsedidnotpopulatetheinResponseToattributeinSubjectConfirmation.
SSLVPN3.
1.
3.
292Component3.
1SP3IR2NovellAccessManager3.
1SP3IR2Readme5FixedanissuewhereSAML2.
0ignoredtheFrontChannelLogoutoptioninthelogoutinitiatedbytheAccessGatewayAppliance.
Formoreinformation,see"DefiningOptionsforLibertyorSAML2.
0"3.
2LinuxAccessGatewayApplianceFixedanissuewithRangerequestswheretheAccessGatewayAppliancesendsthesamerequesttwicetotheWebserver,resultinginrandomservercrashes.
FixedanissuewhereAccessGatewayAppliancecrasheswhentheWebserversentcontent-lengthresponseheadervaluesmallerthantheactualcontent.
FixedaloginissueintheclusterenvironmentwithAccessGatewayAppliancewhentheusernamecontaineddoublebytecharactersinit.
FixedanissuewiththeAccessGatewayAppliancewheretheusergotanerrormessage"403ForbiddenDescription:DetectedURLtampering.
"FixedamemoryleakissuethatcausedacoredumpwithAccessGatewayAppliance.
FixedanissuewiththeOpenHREloginpage.
Ifthevaluefortheformnumberwasconfiguredas0intheFormFillpolicy,theloginpagewastruncated.
FixedanissuewhererandomprocessrestartsoccurredinSP3.
FixedanissueintheauthorizationpolicywithmultipleLDAPOUevaluationfailuresafterupgradingfrom3.
1SP2to3.
1SP3.
Fixedanissuewherethe/var/novell/.
disableWSHealthtouchfilewasnotworking.
ThistouchfilehelpsavoidthedevicehealthbeingmarkedasbadbecauseofsomeunreachableWebservers.
Formoreinformation,see"disableWSHealth"Fixedanissuewheretheuser'sprivateinformationwasgettingloggedtothesoapmessageslogfileunderspecificconfigurations.
Fixeda403forbiddenissuethatresultedwhentheuserpostedlargedata(morethan56KiloBytesinsize)afterasessiontimeout.
TheAdministratorcanchangethepostdataparkingsizelimit.
Formoreinformation,see"ParkingSizeInKiloBytes"FixedanissuewherethesourceportoftheconnectiontotheWebserverwasincorrectintheics_dyn.
logfile.
FixedanissuewheretheAccessGatewayAppliancecrashedwhilebeingredirectedfromhttptohttpswhenthehostnameheaderexceeds4kbytes.
FixedacrashissuewithAccessGatewayincustomloginsequenceenvironmentwhere/nesp/app/ploginrequestreachesproxywithPOSTdata.
Fixedanissuewhere400badrequestswasobservedinthereliabilitytestsforlargefilescripts.
3.
3AccessGatewayServiceFixedanissuewheretheAccessGatewayServicerewriterremoved"%2"incorrectlyfromtheurlbeingrewritten.
6NovellAccessManager3.
1SP3IR2ReadmeFixedadelayissuewiththeAccessGatewayServicewhentheauditserverwasnotreachableornotresponding.
FixedaloginissuewiththeAccessGatewayServiceifuserswaitfor3+minattheIDPloginpageandthensubmitstheircredentials.
FixedanissuewhereAccessGatewayServicesessioncookiearchitecturewasdifferentfromAccessGatewayAppliancesessioncookiearchitecture.
FixedanissuewheretheAccessGatewayServiceperformancedropsby90%whentheauditserverisnotreachable.
4KnownIssuesinAccessManager3.
1SP3IR2Section4.
1,"StoppingthenauditServiceSubsequentlyStopsJCCandTomcatServices,"onpage6Section4.
2,"AuthenticationErrorIftheOverwriteRealUserorOverwriteTemporaryUserOptionIsEnabled,"onpage7Section4.
3,"TheSSLVPNCausesaWindowsExplorerCrashinKioskMode,"onpage7Section4.
4,"VulnerabilityIssuesinJRESecurity,"onpage7Section4.
5,"ServiceUnavailabilityCausedbyaSLES11Issue,"onpage7Section4.
6,"DNSResolutionbyUsingDNSServersPushedfromSSLVPNfailsonMacLeopard,"onpage8Section4.
7,"OnWindowsServer2008,YouCannotUninstalltheAdministrationConsole,"onpage8Section4.
8,"ErrorwhileUploadingLargeFilestoanIIS7.
xback-endWebServerthroughtheLinuxAccessGatewayAppliance,"onpage8Section4.
9,"ErrorinSecondaryIPaddressesafterPushingConfigurationUpdates,"onpage8Section4.
10,"The"includethesessiontimeoutattributeintheassertion"FeatureDoesNotWork,"onpage8Section4.
11,"IssuewithSSLVPNWhileValidatingServerCertificates,"onpage8Section4.
12,"LinuxAccessGatewayApplianceDoesNotSupportRFC5746,"onpage94.
1StoppingthenauditServiceSubsequentlyStopsJCCandTomcatServicesOccasionally,whenthenauditserviceisstoppedbyusing/etc/init.
d/novell-nauditstopcommand,otherimportantservicessuchasTomcatandJCCalsostop,whichcausesinterruptionofservices.
Toworkaroundthisissue,manuallyrestarttheTomcatandJCCservices.
Forinformation,see(http://www.
novell.
com/support/php/search.
docmd=displayKC&docType=kc&externalId=7008991&sliceId=1&docTypeID=DT_TID_1_1&dialogID=120228708&stateId=0%200%20247101813)intheTID.
NovellAccessManager3.
1SP3IR2Readme74.
2AuthenticationErrorIftheOverwriteRealUserorOverwriteTemporaryUserOptionIsEnabledIfyouhavetwocontracts,andtheOverwriteRealUseroptionisenabledforoneofthem,thefirstuserauthenticationdoesnotoverwritetheseconduserauthentication.
Itdisplaysthefollowingerrormessage:"Unabletoauthenticate.
(409-esp-7271673232708786).
"ThisissueisnotobservedwiththeLinuxAccessGateway.
Formoreinformation,see(http://www.
novell.
com/support/php/search.
docmd=displayKC&docType=kc&externalId=7008992&sliceId=1&docTypeID=DT_TID_1_1&dialogID=120228779&stateId=0%200%20247101935)intheTID.
4.
3TheSSLVPNCausesaWindowsExplorerCrashinKioskModeTheSSLVPNclientworksproperlyinEnterprisemode,butcrashesWindowsExplorerusingActiveX.
Ifyourestore/downgradetheWindowsXPclienttoWindowsXPSP3,theSSLVPNclientworksproperlyinKioskmode.
ThisissueisnotobservedwithFirefoxusingJava.
4.
4VulnerabilityIssuesinJRESecurityToworkaroundtheJREsecurityvulnerabilityissue,see(http://www.
novell.
com/support/php/search.
docmd=displayKC&docType=kc&externalId=7008129&sliceId=1&docTypeID=DT_TID_1_1&dialogID=216290409&stateId=0%200%20216288812)intheTID.
4.
5ServiceUnavailabilityCausedbyaSLES11IssueInSLES11,theoperatingsystemreturnsthe27.
0.
0.
2entrywhenthehostnameisresolved.
Thiscausesthe127.
0.
0.
2tobethedefaultaddressofthelistenerwhenthedeviceisaddedtothecluster.
Toworkaroundthisissue:1Gototheproxyservicepage.
ChangethelisteningIPaddresstotheotherclustermember,thenselectthecorrectIPaddressagain.
2ClickUpdatetosavethechanges.
3Verifythecorrectaddress,thenaddthedevicetothecluster.
IMPORTANT:DonotrefertothedeploymentscenariosinthecontextsensitivehelpavailablewiththeAccessManager3.
1.
3build.
RefertothisinformationintheIdentityServerGuide.
Formoreinformation,see(http://www.
novell.
com/support/php/search.
docmd=displayKC&docType=kc&externalId=7008978&sliceId=1&docTypeID=DT_TID_1_1&dialogID=120230000&stateId=0%200%20247107319)intheTID.
8NovellAccessManager3.
1SP3IR2Readme4.
6DNSResolutionbyUsingDNSServersPushedfromSSLVPNfailsonMacLeopardIftheIPaddressandDNSserversareconfiguredstaticallyonMACLeopardandasuccessfulSSLVPNconnectionisestablished,theDNSresolutionfailstousetheDNSserverIPaddresspushedfromtheSSLVPNserver.
4.
7OnWindowsServer2008,YouCannotUninstalltheAdministrationConsoleWhenyouinstalltheAdministrationConsoleandtheIdentityServeronaWindows2008machine,youcannotcompletelyuninstallthecomponents.
Theuninstallprogramhangsbeforeitcleansallthefilesandtheregistryentries.
Toworkaroundthisissue,see(http://www.
novell.
com/documentation/novellaccessmanager31/readme/accessmanager_readme_sp2_ir3.
html#br1og3r)intheNovellAccessManager3.
1SP2IR3aReadme.
4.
8ErrorwhileUploadingLargeFilestoanIIS7.
xback-endWebServerthroughtheLinuxAccessGatewayApplianceYoucannotuploadlargefilestoanIIS7.
xWebserverwhereSSLisenabledbetweentheLinuxAccessGatewayandIIS7server.
Themaximumuploadsizedependsonthenetworksetup.
Forinformation,see(http://www.
novell.
com/support/php/search.
docmd=displayKC&docType=kc&externalId=7008505&sliceId=1&docTypeID=DT_TID_1_1&dialogID=120156265&stateId=0%200%20246847206)intheTID.
4.
9ErrorinSecondaryIPaddressesafterPushingConfigurationUpdatesWithsecuritypatchesinstalledontheSLES11LinuxAccessGatewaymachine,thesecondaryIPaddressismissingafterpushingconfigurationupdatesfromtheAdministrationConsoletotheLinuxAccessGatewaydevice.
Toworkaroundthisissue:1Backupthefile/etc/sysconfig/network/ifcfg-eth-id-thenremoveitfromthedirectory.
2PushtheconfigurationfromtheAdministrationConsole.
4.
10The"includethesessiontimeoutattributeintheassertion"FeatureDoesNotWorkToworkaroundthisissue,keeptheSPRemotecontracttimeoutthesameastheremoteidentityprovidersessiontimeout.
4.
11IssuewithSSLVPNWhileValidatingServerCertificatesTheSSLVPNclientcannotvalidateservercertificateifthetrustchainincludesoneormoreintermediaterootcertificates.
Formoreinformation,see(http://www.
novell.
com/support/php/search.
docmd=displayKC&docType=kc&externalId=7008465&sliceId=2&docTypeID=DT_TID_1_1&dialogID=247083053&stateId=0%200%20247079487)intheTID.
NovellAccessManager3.
1SP3IR2Readme94.
12LinuxAccessGatewayApplianceDoesNotSupportRFC5746UntilaLinuxAcessGatewayversionincludingsupportforRFC5746willnotbereleased,theworkaroundistousetheLinuxAccessGatewayService,insteadoftheappliance.
Forinformation,see(http://www.
novell.
com/support/viewContent.
doexternalId=7008600&sliceId=1)intheTID.
5LegalNoticesNovell,Inc.
,makesnorepresentationsorwarrantieswithrespecttothecontentsoruseofthisdocumentation,andspecificallydisclaimsanyexpressorimpliedwarrantiesofmerchantabilityorfitnessforanyparticularpurpose.
Further,Novell,Inc.
,reservestherighttorevisethispublicationandtomakechangestoitscontent,atanytime,withoutobligationtonotifyanypersonorentityofsuchrevisionsorchanges.
Further,Novell,Inc.
,makesnorepresentationsorwarrantieswithrespecttoanysoftware,andspecificallydisclaimsanyexpressorimpliedwarrantiesofmerchantabilityorfitnessforanyparticularpurpose.
Further,Novell,Inc.
,reservestherighttomakechangestoanyandallpartsofNovellsoftware,atanytime,withoutanyobligationtonotifyanypersonorentityofsuchchanges.
AnyproductsortechnicalinformationprovidedunderthisAgreementmaybesubjecttoU.
S.
exportcontrolsandthetradelawsofothercountries.
Youagreetocomplywithallexportcontrolregulationsandtoobtainanyrequiredlicensesorclassificationtoexport,re-exportorimportdeliverables.
Youagreenottoexportorre-exporttoentitiesonthecurrentU.
S.
exportexclusionlistsortoanyembargoedorterroristcountriesasspecifiedintheU.
S.
exportlaws.
Youagreetonotusedeliverablesforprohibitednuclear,missile,orchemicalbiologicalweaponryenduses.
SeetheNovellInternationalTradeServicesWebpage(http://www.
novell.
com/info/exports/)formoreinformationonexportingNovellsoftware.
Novellassumesnoresponsibilityforyourfailuretoobtainanynecessaryexportapprovals.
Copyright2011Novell,Inc.
Allrightsreserved.
Nopartofthispublicationmaybereproduced,photocopied,storedonaretrievalsystem,ortransmittedwithouttheexpresswrittenconsentofthepublisher.
ForNovelltrademarks,seetheNovellTrademarkandServiceMarklist(http://www.
novell.
com/).
Allthird-partytrademarksarethepropertyoftheirrespectiveowners.
georgedatacenter怎么样?georgedatacenter这次其实是两个促销,一是促销一款特价洛杉矶E3-1220 V5独服,性价比其实最高;另外还促销三款特价vps,大家可以根据自己的需要入手。georgedatacenter是一家成立于2019年的美国vps商家,主营美国洛杉矶、芝加哥、达拉斯、新泽西、西雅图机房的VPS、邮件服务器和托管独立服务器业务。georgedatacen...
搬瓦工最近新增了荷兰机房中国联通(AS9929、AS4837)线路的VPS产品,选项为NL - China Unicom Amsterdam(ENUL_9),与日本软银和洛杉矶(DC06)CN2 GIA配置一致可以互换,属于高端系列,2.5Gbps-10Gbps大带宽,最低季付46.7美元起。搬瓦工VPS隶属于老牌IT7公司旗下,主要提供基于KVM架构VPS主机,数据中心包括美国洛杉矶、凤凰城、纽...
快云科技已稳步运行进两年了 期间没出现过线路不稳 客户不满意等一系列问题 本司资质齐全 持有IDC ICP ISP等正规手续 有独特的网站设计理念 在前几天刚是参加过魔方系统举行的设计大赛拿获最佳设计奖第一名 本公司主营产品 香港弹性云服务器,美国vps和日本vps,香港物理机,国内高防物理机以及美国日本高防物理机 2020年的国庆推出过一款香港的回馈用户特惠机 已作为传家宝 稳定运行 马上又到了...
403forbidden为你推荐
支付宝蜻蜓发布支付宝蜻蜓f4,可以让没有支付宝的人刷脸付款?cuteftp什么是 CuteFtp Flashfxp Leapftp FlashGet360免费建站我用的360免费建站,但自己买的一级域名要先备案,360不提供备案,我要怎么做才能把我的域名绑定网站啊?阅读http温州商标注册温州商标注册?玖融网泰和网理财可信吗,泰和网理财是不是骗人的啊????????tumblr上不去百度为什么经常打不开电子商务世界电子商务最先起源于那个国家,什么时间厦门三五互联科技股份有限公司厦门三五互联科技股份有限公司怎么样?35邮箱邮箱地址怎么写
高防服务器租用 中国万网虚拟主机 什么是域名地址 GGC webhostingpad cpanel主机 香港主机 海外服务器 紫田 directadmin 国外php空间 镇江联通宽带 免费smtp服务器 网通ip 合肥鹏博士 灵动鬼影 创梦 最好的免费空间 hkt 香港亚马逊 更多