CA eTrust® SiteMinder® Policy Server 6.0 SP 5, Web Agent 6.x QMR 5 Option Pack Readme

SiteMinder Federation Security Services
This option, which is separately-licensed from SiteMinder, supports:
- SAML 1.0, 1.1. 2.0 and WS-Federation (Policy Server-side)-- Configures the Policy Server to support federation, including the ability to generate and consume SAML assertions. The Web Agent Option Pack is also required to support these features.
- Federation Web Services (Web Agent at producing and consuming authority)-- Enables the consumption of SAML assertions or to send assertions to a SAML Affiliate Agent. The Policy Server Option Pack is required to support Federation Web Services.
  The SAML Affiliate Agent is a SAML consumer; however, it is not part of the SiteMinder stack. If you are using the SAML Affiliate Agent in your network, the Federation Web Services application functions to get the assertion back to the Agent.

eTelligent Rules variables (Policy Server-side)--Enables a SiteMinder administrator to define fine-grained access-control policy expressions, which are SiteMinder policy attributes, and can include operators and customer-defined variables that are evaluated at runtime, when a user actually needs to access a protected resource on a Web site. For more information, see CA eTrust SiteMinder Policy Design.
You can use eTelligent Rules by installing only the Policy Server Option Pack. To use POST variables, you must also install the Web Agent Option Pack.

Web service variables (Policy Server-side)--Lets you add variables to SiteMinder policies to make authorization decisions. They are resolved through web services calls to local or remote data sources.

C sample program smpolicyapi (Policy Server-side)--To be run, optionally, after you install the Policy Server Option Pack. It supports the manipulation of policy store data related to affiliates and affiliate domains. For more information, see the CA eTrust SiteMinder Developer's Guide for C.

2.0 System Requirements

For a list of supported platforms:

Search for SiteMinder 6.0 Platform Support Matrix.

Some platforms supported in previous releases may no longer be supported.

2.1 Minimum JDK/JRE Version for SiteMinder 6.0 SP 5/6.x QMR 5

SiteMinder requires the use of JDK/JRE 1.5.0_01 or later, but note the following caveats:

JDK 1.5.0_06 through JDK 1.5.0_08 leaks handles on Windows platforms.
This issue is a result of a Sun Microsystems bug. Refer to Sun bug number 6399321.

JDK 1.5.0_05 causes ServletExec to crash on dual processor machines.

3.0 Installation Considerations

The following sections contain helpful information regarding Option Pack installation.

The Policy Server v6.0 SP 5 Option Pack and the Web Agent v6.x QMR 5 Option Pack are compatible only with each other and will run only on the corresponding 6.0 SP 5 Policy Server and 6.x QMR 5 Web Agent respectively.

For details on using the Option Packs in a mixed mode environment, that is, an environment with SiteMinder 5.x and 6.x systems, see the CA eTrust SiteMinder Upgrade Guide.

3.2 Components Required for eTelligent Rules

Policy Server and Policy Server Option Pack

Web Agent and Web Agent Option Pack

3.3 Components Required for Federation Security Services

Policy Server and Policy Server Option Pack

Web Agent and Web Agent Option Pack

Web Server or Application Web Server for the Federation Web Services application installed by the Web Agent Option Pack

3.4 Installation Requirements for the Policy Server Option Pack

Option Pack License
This is a site license; you need one license for each Policy Server. Contact your CA account manager to obtain a license.

Policy Server v6.0 SP 5
This Policy Server must have a JRE, which is used by the Option Pack. For the specific JRE version, see the SiteMinder 6.0 Platform Matrix on the Technical Support site.

Session Server
To use the Policy Server Option Pack, upgrade the session server. For upgrade instructions, see the CA eTrust SiteMinder Upgrade Guide.

3.5 Installation Requirements for the Web Agent Option Pack

ServletExec or supported application server
For supported platforms, see the SiteMinder 6.0 Platform Matrix at https://support.netegrity.com/.

Note: Be sure to apply the most current hot fixes for ServletExec. Without the hot fixes, Federation Web Services will not work with ServletExec. To obtain the hot fixes, go to the New Atlanta Communications web site.

JDK
Check the SiteMinder 6.0 Platform Support Matrix for the supported JDK version. The matrix is located on the Technical Support site.

The Web Agent v6.x QMR 5 is not required to install the Web Agent Option Pack; however, the Web Agent must be installed at run time to use Federation Security Services.

3.5.1 Repair ServletExec's CLASSPATH for the Web Agent Option Pack (Windows)

If you install the Web Agent Option Pack on a Windows system with ServletExec ISAPI and get an error message, such as Class not found when you access an existing servlet or .jsp, verify that the ServletExec classpath is correct.

If your classpath is correct and you still get the error, you may need to repair your classpath.pref file, as follows:

Access the ServletExec Admin Web page by entering the following in a browser:
http://myserver.myorg.org/servlet/admin

Under the Virtual Machine menu, select classpath to open the Classpath page.

Click Submit.

Restart the Sun ONE Web server or IIS Admin services. This forces ServletExec to write the classpath.pref.
If you are using Windows 2000, stop the IIS Admin services, then start the World Wide Web Publishing service without manually starting the IIS Admin service.

On Windows 2000, if this procedure does not fix the classpath:

Open the classpath.pref in a text editor.

Collapse all entries to one line separated by a semi-colon(;).

Save the file.

Restart the Web server.

3.6 Environment Variables Added and Modified by the Policy Server Option Pack

The installation of the Policy Server Option Pack adds and modifies the following environment variables:

NETE_PS_OPACK = "INSTALLED"

NETE_JAVA_PATH = %NETE_JRE_ROOT%$/$bin;%NETE_JRE_ROOT%$/$bin$/$server

3.7 Environment Variables Added by the Web Agent Option Pack

The installation of the Web Agent Option Pack sets the following environment variables:

NETE_WA_OPACK = "INSTALLED"

NETE_WA_PATH = $NETE_WA_ROOT$$/$bin;$NETE_WA_ROOT$$/$bin$/$thirdparty;
$NETE_JRE_ROOT$$/$bin;$NETE_JRE_ROOT$$/$bin$/$server

NETE_WA_CLASSPATH = $NETE_WA_ROOT$$/$java$/$smconapi.jar

4.0 Installation Instructions for the Policy Server Option Pack

The Policy Server Option Pack can be installed using one of the following modes:

GUI mode—installation using the graphical user interface

Console mode—installation by executing the Option Pack binary file

Unattended mode—after an initial installation, you can run unattended installations using the nete-ps-opack-installer.properties file

To install the Policy Server Option Pack, go to one of the following sections:

Policy Server Option Pack GUI and Console Mode Installation

Policy Server Option Pack Unattended Mode Installation

4.1 Policy Server Option Pack GUI and Console Mode Installation

The installation instructions that follow reflect the GUI mode prompts. For UNIX systems, you can install the Policy Server Option Pack using Console mode by executing the Option Pack binary file with the -i console command argument. The command line installation prompts are similar to the GUI mode prompts.

Before you install the Policy Server Option Pack, be sure of the following:

The Policy Server v6.0 SP 5 is installed locally

The Policy Server is using a JRE, which will also be used by the Policy Server Option Pack.

To install the Policy Server Option Pack:

Stop the Web server and exit any applications that are running.

Insert the Option Pack DVD into the drive.
You can also download the software from the Technical Support site. Go to the folder for your operating system and download the installation file.

Navigate to the appropriate Windows or UNIX operating system directory:
- Windows: win32
- UNIX: rhel, hpux, solaris

Do one of the following:
- Windows: Skip to Step 6.
- UNIX: copy the appropriate binary file to a local directory then navigate to that directory:
  Solaris: nete-ps-opack-6.0-sp5-sol.bin
  
  Rhel: nete-ps-opack-6.0-sp5-rhel30.bin
  
  HP-UX: nete-ps-opack-6.0-sp5-hp.bin

Depending on your permissions, you may need to add execute permissions to the installation file by running the chmod command, for example:
chmod +x nete-ps-opack-6.0-sp5-sol.bin

Run the installation program as follows:
Windows: Double-click nete-ps-opack-6.0-sp5-win32.exe

UNIX: At the command prompt, enter:
- GUI mode: ./nete-ps-opack-6.0-sp5-<operating_system>.bin
- Console mode: ./nete-ps-opack-6.0-sp5-<operating_system>.bin -i console
  where <operating_system> can be rhel30, hp, sol.
For example, to run the installation in GUI mode on a Solaris platform enter:
```
./nete-ps-opack-6.0-sp5-sol.bin
```
The installation program starts and prepares the files.

Review the text in the Introduction dialog box and click Next.
The installation displays the License Agreement.

Read the License Agreement, then select the radio button to accept the terms. Click Next.
If you do not accept the terms, you cannot continue with the installation.

Read the notes in the Important Information dialog box, then click Next.

In the Import Affiliate Data dialog box, do one of the following:
- For new installations, accept the default option, Import affiliate data during install. If you deselect the check box, you will have to import this data later using the smobjimport command. For details, see Importing Federation Services Data After Option Pack Installation.
- For an upgrade, deselect this checkbox if you have made any changes or additions to the Federation Web Services policy store objects. Importing affiliate data overwrites policy store objects for Federation Web Services.

In the SM Admin Username and SM Admin Password fields, specify the SiteMinder administrator username and password that you used during the installation of the Policy Server. Re-confirm the password in the Re-enter password field, then click Next.

In the SM Key Database dialog, accept the default to create an smkeydatabase and enter a password to encrypt keys and certificate data in the smkeydatabase. Click Next.

In the second SM Key Database dialog, accept the default if you want to import the default CA certificates, then click Install.
The program installs the Option Pack files then displays the Install Complete dialog box.

Choose whether to reboot your system immediate or later on your own, then click Done.

To reinstall the Policy Server Option Pack, repeat this procedure.

4.2 (Optional) Import Federation Data After Option Pack Installation

You must import the ampolicy.smdiff file to see the Option Pack policy objects in the Policy Server User Interface.

If you did not import the ampolicy.smdif file during the Policy Server Option Pack installation, you can do this after the installation by entering the smobjimport command, where the arguments have the following meanings:

Argument	Meaning
siteminder_home	Installed location of the Policy Server
admin_name	SiteMinder administrator's user name
admin_pw	SiteMinder administrator's password
-f	Overrides duplicate objects.
-v	Enables verbose mode.
-l	Creates a log file.
-c	Indicates that the smdif input file contains unencrypted data.

Windows Systems Example for Importing ampolicy.smdif

smobjimport -i<siteminder_home>\db\smdif\ampolicy.smdif -d<admin_name>

-w<admin_pw> -f -v -l -c

On Windows systems, if an argument contains spaces, use double quotes around the entire argument. For example:

smobjimport -i"C:\Program Files\netegrity\siteminder\db\smdif\ampolicy.smdif"

-dsiteminder -wpassword -f -v -l -c

UNIX Systems Example for Importing ampolicy.smdif

smobjimport -i<siteminder_home>/db/smdif/ampolicy.smdif -d<admin_name>

-w<admin_pw> -f -v -l -c

For example:

smobjimport -i/export/smuser/siteminder/db/smdif/ampolicy.smdif -dsiteminder

-wpassword -f -v -l -c

5.0 Policy Server Option Pack Unattended Mode Installation

After you have installed the Policy Server Option Pack on one system, you can automate other installations using the Policy Server Option Pack's unattended installation feature. An unattended installation lets you install or uninstall the Policy Server Option Pack without any user interaction.

5.1 Prepare an Unattended Installation

Unattended installation uses the nete-ps-opack-installer.properties file to propagate the Policy Server Option Pack installation setup across all Policy Servers in your network. In this properties file, you define a set of installation parameters, then copy the file and the Policy Server Option Pack executable file to any web server in your network. After you copy the files to the web server, run an unattended installation.

The nete-ps-opack-installer.properties file is installed in the following location:

<siteminder_home>/install_config_info/nete-ps-opack-installer.properties

The default parameter values reflect the information you entered during the initial Option Pack installation.

Note: The nete-ps-opack-installer.properties file is case-sensitive. The parameter names must be all upper-case and their values are case-sensitive.

The following table lists parameters in the nete-ps-opack-installer.properties file.

Parameter	Meaning
DEFAULT_IMPORT_CHOICE	Indicates whether affiliate policy objects are imported automatically during installation or imported manually after installation. Select true to allow an automatic import or false to do a manual import. The value must be entered in lower-case text.
DEFAULT_ADMIN_USER	Identifies the SiteMinder administrator defined at the Policy Server. Enter a user name in lower-case text
DEFAULT_ADMIN_PW	Identifies the SiteMinder administrator's password in clear text. To modify the password, uncomment this line and enter the password in clear text. It cannot be encrypted. You cannot modify the encrypted password in the ENCRYPTED_ADMIN_PW parameter
ENCRYPTED_ADMIN_PW	Encrypted SiteMinder administrator's password entered during the initial installation of the Option Pack.
DEFAULT_SMKEYDB_CHOICE	Indicates whether an smkeydatabase is created during installation or after installation. Select true to allow an automatic creation. Select false not to create the database. The value must be entered in lower-case text.
DEFAULT_SMKEYDB_PW	Identifies the smkeydatabase password in clear text. To modify the password, uncomment this line and enter the password in clear text. It cannot be encrypted. You cannot modify the encrypted password in the ENCRYPTED SMKEYDB_PW parameter
ENCRYPTED SMKEYDB_PW	Encrypted password for the smkeydatabase entered during the initial installation of the Option Pack.
DEFAULT_SMKEYDB_IMPORT_CHOICE	Indicates whether the CA default certificates are imported into the database during installation. Select true to allow the certificates to be imported. Select false not to import the certificates. The value must be entered in lower-case text.

To install the nete-ps-opack-installer.properties file:

Install the Policy Server Option Pack in GUI or Console mode. For instructions, see Policy Server Option Pack GUI and Console Mode Installation.

Open the nete-ps-opack-installer.properties file and if needed, modify it.

Save the file.

5.2 Run the Unattended Installation Program

You should have completed an initial Policy Server Option Pack installation and, if necessary, modified the nete-ps-opack-installer.properties file. Now you can use the file to run subsequent Policy Server Option Pack installations.

To run an unattended installation:

From a system where the Policy Server is already installed, copy the following files to a local directory.
- nete-ps-opack-6.0-sp5-win32.exe (Windows) or the binary nete-ps-opack-6.0-sp5-<operating_system>.bin (UNIX) from the SiteMinder DVD or from your system.
- nete-ps-opack-installer.properties file from <policy_server_home>/install_config_info

Place these files onto your local system.

Open a console window and navigate to the directory where you copied the two files.

Run the Policy Server Option Pack executable with the -f and -i silent options, as follows:
<siteminder_executable> -f <properties_file> -i silent

Assuming that you run the installation from the directory where the executable and properties file are located, the command is:

Windows:
```
nete-ps-opack-6.0-sp5-win32.exe -f nete-ps-opack-installer.properties -i silent
```
Note: If you are not running the command from the location where the files reside, specify the complete path to these files. If there are spaces in the path to the directory, enclose the entire path between quotation marks.

UNIX (Solaris example):
```
./nete-ps-opack-6.0-sp5-sol.bin -f nete-ps-opack-installer.properties -i silent
```
The status dialog box opens and shows the unattended installation in process.

Check if the installation completed successfully by looking at the CA_SiteMinder_Option_Pack_v6.0_SP5 for_Policy_Server_InstallLog.log file, located in the <policy_server_home>/install_config_info directory. This log file contains the results of the installation.

5.3 Stop an Unattended Installation in Progress

To stop the installation manually, follow the instructions for your platform:

Windows: Open the Windows Task Manager and stop the nete-ps-opack-6.0-sp5-win32.exe and ps_install.exe processes.

UNIX: Type Ctrl+C.

6.0 Policy Server Option Pack Uninstallation

Uninstalling the Policy Server automatically removes the Policy Server Option Pack.

To uninstall the Policy Server, see the CA eTrust SiteMinder Policy Server Installation Guide.

7.0 Web Agent Option Pack Installation

The Web Agent Option Pack can be installed on a Web server running ServletExec or an application server (WebLogic, WebSphere, or JBoss).

There are several installation modes:

GUI mode—installation using the graphical user interface

Console mode—installation by executing the Option Pack binary file

Unattended mode—after an initial installation, you can run unattended installations using the nete-wa-opack-installer.properties file

To install the Web Agent Option Pack, go to one of the following sections:

Web Agent Option Pack GUI and Console Mode Installation

Web Agent Option Pack Unattended Mode Installation

7.1 Web Agent Option Pack GUI and Console Mode Installation

The installation instructions that follow reflect the GUI mode installation prompts. For UNIX systems, you can install the Web Agent Option Pack using console mode by executing the Option Pack binary file with the -i console command argument. The command line installation prompts are similar to the GUI mode prompts.

Important! If you are installing the Web Agent Option Pack on a Windows system immediately after installing the Web Agent, reboot your machine first.

To install the Web Agent Option Pack:

Stop the Web or application server and exit any applications that are running.

Insert the Option Pack DVD into the drive.
You can also download the software from the Technical Support site. Go to the folder for your operating system and download the installation file.

Navigate to the appropriate Windows or UNIX operating system directory:
Windows: win32

UNIX: solaris, aix, hpux, linux (for Linux 2.1), rhel30 (for Linux 3.0)

Do one of the following:
Windows: Skip to Step 6.

UNIX: Copy the appropriate binary file to a local directory; then, navigate to that directory:
- AIX: nete-wa-opack-6qmr5-aix.bin
- Linux 2.1: nete-wa-opack-6qmr5-linux.bin
- Linux 3.0: nete-wa-opack-6qmr5-rhel30.bin
- HP-UX: nete-wa-opack-6qmr5-hp.bin
- HP-UX Itanium: nete-wa-opack-6qmr5-itan.bin
- Solaris: nete-wa-opack-6qmr5-sol.bin

You may need to add execute permissions to the installation file using chmod command, for example:
chmod +x nete-wa-opack-6qmr5-sol.bin

Run the installation program according to the instructions for your platform:
Windows: Double-click nete-wa-opack-6qmr5-win32.exe

UNIX: At the command prompt, enter one of the following commands:
- GUI mode
  ./nete-wa-opack-6qmr5-<operating_system>.bin
- Console mode
  ./nete-wa-opack-6qmr5-<operating_system>.bin -i console
For example, to run the GUI mode on an AIX platform, enter ./nete-wa-opack-6qmr5-aix.bin

Note: The Web Agent Option Pack can be installed as a stand-alone product. If the installer cannot find a Web Agent, it asks if you want to continue or cancel. If you continue, the installer asks for an installation path and installs the Option Pack in the location you specify.

In the Introduction dialog box, review the text then click Next.
The installation displays the License Agreement.

Read the License Agreement, then select the option to accept the terms.
If you do not accept the terms, the installation will not continue.

Do one of the following:
- GUI mode: Read the notes in the Important Information dialog box, then click Next.
- Console mode: Read the notes in the Important Information dialog box, then specify the location where you want to install the Option Pack. To accept the default location, press ENTER.

Review the Pre-Installation Summary then click Install.
You will get a message indicating when the installation is complete.

Choose whether to reboot your system now or later, then click Done.

To reinstall the Option Pack, repeat this procedure.

8.0 Web Agent Option Pack Unattended Mode Installation

After you have installed the Web Agent Option Pack on one system, you can automate installations on other web or application servers using the Web Agent Option Pack's unattended installation feature. An unattended installation lets you install or uninstall the Web Agent Option Pack without any user interaction.

8.1 Prepare an Unattended Installation

Unattended installation uses the nete-wa-opack-installer.properties file to propagate the Option Pack installation set-up across all servers in your network. In this properties file, you define installation parameters, then copy the file and the Web Agent Option Pack executable file to any applicable server in your network. After the files are copied, you can run an unattended installation.

The nete-wa-opack-installer.properties file is installed in the following location: <web_agent_opack_home>/install_config_info

The default parameter and path in the file reflect the information you entered during the initial Option Pack installation.

To install the nete-wa-opack-installer.properties file:

Run an initial installation of the Web Agent Option Pack. For instructions, see Web Agent Option Pack GUI and Console Mode Installation.

Open the nete-wa-opack-installer.properties file and if needed, modify the following settings:
- USER_INSTALL_DIR--specifies the location where you would like to install the Web Agent Option Pack.
- USER_REQUESTED_RESTART--restarts the machine after installation.

Save the file.

8.2 Run an Unattended Installation

Prior to running an unattended installation, you should have:

completed an initial Web Agent Option Pack installation

modified the nete-wa-opack-installer.properties file, if necessary

You can now use the nete-wa-opack-installer.properties file to run subsequent Web Agent Option Pack installations.

Note: You can run an unattended installation to reinstall the Web Agent on the same system where you initially performed an installation in GUI or console mode.

To run an unattended installation:

From a system where the Web Agent Option Pack is already installed, copy the following files to a local directory on your system.
- Windows: nete-wa-opack-6qmr5-win32.exe
  or
  
  UNIX: nete-wa-opack-6qmr5-<operating_system>.bin
  
  from the SiteMinder DVD or from your system.
- nete-wa-opack-installer.properties file from <web_agent_opack_home>/install_config_info

Open a console window and navigate to the location where you copied the files.

Run the Agent executable using the -f and -i silent options, as follows:
<agent_executable> -f <properties_file> -i silent

Assuming that you run the installation from the directory where the executable and properties file are located, the command syntax is shown in the following examples:

Windows example:
```
nete-wa-opack-6qmr5-win32.exe -f nete-wa-opack-installer.properties -i silent
```
Note: If you are not at the location where the executable and properties file reside, specify the full path to these files. If there are spaces in the directory paths, enclose the entire path with quotation marks.

Solaris example:
```
./nete-wa-opack-6qmr5-sol.bin -f nete-wa-opack-installer.properties -i silent
```
The status dialog box displays, which shows the unattended installation in process.

When the installation is complete, you return to the command prompt.

Check to see if the installation completed successfully by looking in the CA_SiteMinder_Option_Pack_v6qmr5_for_Web_Agent_ InstallLog.log file, located in the <web_agent_opack_home>/install_config_info directory. This log file contains the results of the installation.

8.3 Stop an Unattended Installation in Progress

To stop the installation manually, follow the instructions for your platform:

Windows: Open the Windows Task Manager and stop the nete-wa-opack-6qmr5-win32.exe and wa_option_pack.exe processes.

UNIX: Type Ctrl+C.

9.0 Web Agent Option Pack Uninstallation

The instructions for uninstalling the Web Agent Option Pack are different for Windows and UNIX platforms.

9.1 Uninstall the Web Agent Option Pack from Windows Systems

To uninstall the Web Agent Option Pack:

Stop the Web server and exit applications that are running.

Open up the Windows Control Panel.

Double-click on Add/Remove Programs.
The control panel opens.

Select CA SiteMinder Option Pack v6QMR5 for Web Agent then click Change/ Remove.
The program displays a dialog box confirming the uninstallation.

Click Uninstall.
The Option Pack is removed.

Stop and restart the Web server.

9.2 Uninstall the Web Agent Option Pack from UNIX Systems

The uninstallation instructions that follow reflect the GUI mode prompts. For UNIX systems, you can uninstall the Option Pack using Console mode by executing the Option Pack binary file with the -i console command argument. The command line installation prompts are similar to GUI mode prompts.

To uninstall the Web Agent Option Pack

Stop the Web server and exit any applications that are running.

Open a console window.

Add the location of the JDK to the PATH environment variable to uninstall the Option Pack as follows:
PATH=/<jdk_home>/bin:${PATH}

export PATH

where <jdk_home> is the location of the JDK

This avoids an error message that the Java virtual machine could not be found.

Navigate to the installed location of the Web Agent—for example
/opt/netegrity/webagent/

At the prompt, enter one of the following:
GUI mode: ./nete-wa-opack-uninstall.sh

Console mode: ./nete-wa-opack-uninstall.sh -i console

Review the dialog that confirms the removal of the Option Pack, then click Uninstall.

The Web Agent Option Pack is now removed from your system.

10.0 Upgrade the Policy Server Option Pack

Different features require different versions of the Policy Server and its Option Pack, as follows:

For SAML 1.1 POST profile--the Policy Server must be at version 6.0 SP 2 or higher.

For SAML 2.0 features--the Policy Server must be at version 6.0 SP 3 or higher.

For WS-Federation--the Policy Server must be at version 6.0 SP 5 or higher.

10.1 Version Compatibility for Upgrades

The Policy Server Option Pack v6.0 SP 5 is compatible only with Policy Server v6.0 SP 5. You can upgrade the Option Pack from a previous version, but you must also upgrade the Policy Server.

Important! When you upgrade, the upgrade program automatically creates back-up configuration files and overwrites the existing configuration files.

10.2 Preserve the smkeydatabase.properties File Before an Upgrade

When reinstalling the Policy Server Option Pack as part of an upgrade, the smkeydatabase.properties file gets replaced with a new properties file that has some revised settings from the existing file. Also, the EncryptedPassword from the existing file is not preserved.

To ensure the smkeydatabase. properties file uses the correct EncryptedPassword value, the value from the old file needs to be placed into the new file.

To ensure the smkeydatabase.properties file is upgraded properly

Back up the existing smkeydatabase and the smkeydatabase.properties file.

Upgrade the Policy Server and the Policy Server Option Pack by installing the new versions.

Edit the smkeydatabase.properties file and insert the EncryptedPassword value from the back-up copy of the file. The file is located in the directory <policy_server_home>/config/properties/

10.3 Upgrade Procedure for the Policy Server Option Pack

To upgrade the Policy Server Option Pack to v6.0 SP 5

Stop the Policy Server.

Upgrade the Policy Server to v6.0 SP 5.
For instructions, see CA eTrust SiteMinder Policy Server Installation Guide.

Upgrade the Policy Server Option Pack to v6.0 SP 5.
The installation program will also run as an upgrade. For instructions, go to one of these sections in this readme:
- Policy Server Option Pack GUI and Console Mode Installation
- Policy Server Option Pack Unattended Mode Installation

10.4 Upgrade Procedure for the Web Agent Option Pack

The Web Agent v6.x QMR 5 Option Pack is compatible only with Web Agent v6.x QMR 5. You can upgrade from any previous version of the Web Agent Option Pack to v6.x QMR 5, but you must also upgrade the Web Agent.

Important! When you upgrade, the upgrade program automatically creates back-up configuration files and overwrites the existing configuration files.

To upgrade the Web Agent Option Pack to v6.x QMR 5:

Uninstall the current Option Pack. For instructions, go to one of these sections:
- Uninstall the Web Agent Option Pack from Windows Systems
- Uninstall the Web Agent Option Pack from UNIX Systems

Upgrade the Web Agent to v6.x QMR 5.
For instructions, see the CA eTrust SiteMinder Web Agent Installation Guide.

Upgrade the Web Agent Option Pack to v6.x QMR 5.
The installation program will also run as upgrade. For instructions, go to one of the upgrade sections in this readme.

11.0 Defects Fixed for Option Packs 6.x QMR 5 and 6.0 SP 5

The following sections list defects fixed for both Option Packs.

11.1 Fixes that Apply to Both Option Packs

The following sections list fixed defects that apply to the Web Agent and Policy Server Option Packs.

11.1.1 SiteMinder Rejects Assertion if <NameIdentifier> Element is Embedded in the <SubjectConfirmation> Value (51696)

Problem: SiteMinder rejects a SAML assertion if the <NameIdentifier> element is put in the XML assertion within the <SubjectConfirmation> value.

Resolution: The search for the <NameIdentifier> has been restricted to only the immediate next child level so this is no longer a problem.

11.2 Fixes for the Web Agent 6.x QMR 5 Option Pack

The following sections list defects fixed for the Web Agent Option Pack.

11.2.1 User Not Authorized Before Redirection to the Target Resource (46918)

Problem: If you configure a SAML authentication scheme and select Server Redirect as the mode by which the user is redirected to the target resource, the authentication scheme fails to check if the authenticated user is also authorized before redirecting the user to the target resource.

Resolution: To fix this problem, the administrator must define realms, rules, and policies to protect target resources. In Server Redirect mode, the target URL is defined with respect to the context of the FWS servlet that consumes the assertion and not the root of the hosting web or application server. Specifically, realm definitions must start with /affwebservices in the resource filter of the realm.

11.2.2 Assertions Did Not Support Multi-byte Characters (47360)

Problem: SiteMinder did not support multi-byte characters in assertions.

Resolution: A SiteMinder SAML producer can now create appropriate SAML assertions containing UTF-8 strings. SiteMinder SAML consumers are now able to consume SAML assertions containing UTF-8 strings.

11.2.3 SAML 2.0 SSO Service Doing IP Checking When the Option Is Not Enabled (53983)

Problem: The SAML 2.0 Single Sign-on Service was performing IP checking even though the IP checking feature was not configured.

Resolution: IP checking is no longer performed unless the feature is configured.

11.2.4 Service Provider using SAML 2.0 artifact scheme Fails when It Sits Behind a Proxy Server (54391)

Problem: The Service Provider configured to use a SAML 2.0 artifact authentication scheme fails when the Service Provider sits behind a proxy server.

Resolution: This is no longer an issue.

11.2.5 Web Agent Option Pack Log Shows Incorrect Product Update Version (54584)

Problem: In the AffWebServices log, the Web Agent Option Pack was showing the incorrect product update version.

Resolution: This is no longer a problem.

11.2.6 Web Agent Option Pack on Apache 2.x/Linux Fails to Load When the Web Server Starts (54795)

Problem: The SAML Affiliate Agent installed on an Apache 2.0 server running Linux fails to load when the Apache web server starts up.

Resolution: The Web Server and Agent start up with no problem.

11.2.7 Target Query String is Not Included in SAML 1.x and 2.0 IsProtected Call (55418)

Problem: When a SAML 1.x Consumer and SAML 2.0 Service Provider makes an IsProtected call, they do not not include the target query string.

Resolution: The target query string is now included in the call.

11.2.8 Ampersand (&) Missing Between SAMLART and RelayState Query Parameters (55479)

Problem: The SAML 2.0 redirection to an Assertion Consumer URL is missing an ampersand (&) between the SAMLART and RelayState query parameters.

Resolution: The ampersand character is no longer missing.

11.2.9 Identity Provider Discovery Redirect is Failing When an AuthNRequest Initiates Authentication (55678)

Problem: The Identity Provider Discovery redirect is failing when using an AuthNRequest to initiate SAML 2.0 authentication.

Resolution: This is no longer a problem.

11.3 Fixes for the Policy Server v6.0 SP 5 Option Pack

The following sections list defects fixed for the Policy Server Option Pack.

11.3.1 SAML 2.0 Exchanges Are Failing When Assertion Consumer Service URL Contains Port Number (47252)

Problem: On Windows platforms, SAML 2.0 transactions are failing when a valid port is appended to the Assertion Consumer Service URL.

Resolution: You can now have a valid port appended to the Assertion Consumer Service.

11.3.2 AuthenticationInstant Attribute Value Set Incorrectly (48584)

Problem: The SAML assertion's AuthenticationInstant attribute was not being set to the time the user authenticated at the Identity Provider.

Resolution: The AuthenticationInstant attribute is now set to the correct time.

11.3.3 SmPolicySrv Process Crashing on UNIX When Trying to View FederationWSCustomUser Directory (48846)

Problem: On UNIX platforms, the smpolicysrv process is crashing when a SiteMinder administrator tries to view users in the FederationWSCustomUser directory.

Resolution: This is no longer a problem.

11.3.4 SAML Authentication Scheme Needs Optional <dsig:KeyInfo> Attribute (44815)

Problem: The SAML authentication scheme requires that signed SAML 1.1 assertions contain the optional <dsig:KeyInfo> attribute when trying to consume the assertion.

Resolution: SiteMinder no longer requires the optional attribute.

11.3.5 Multiple User Stores Defined by IP Address are Not Searched Properly During Authentication (52772)

Problem: Multiple user stores identified by IP addresses are not searched properly during SAML authentication.

Resolution: This is no longer a problem.

11.3.6 When SAML 2.0 Authentication is Configured with the Single Use Policy Feature, the Policy Server Fails (53113)

Problem: On Solaris, when the Policy Server is acting as a Service Provider, it was crashing when a SAML 2.0 authentication scheme was configured with the Enforce Single Use Policy option enabled.

Resolution: One of the parameters being passed from the SAML authentication scheme to the logging mechanism was NULL causing the crash. The SAML authentication scheme has been modified to ensure that it does not pass the null argument.

11.3.7 Require Signed AuthnRequests Option Fails on Solaris-based Identity Provider (53693)

Problem: If you configure a SAML Service Provider and check the Require Signed AuthnRequests option, the requests are failing.

Resolution: The requests are no longer failing.

11.3.8 Signature Processing for SAML Post Profile Fails When TransactionMinder is Installed (54217)

Problem: When the Policy Server Option Pack and TransactionMinder are installed and configured together, signing functionality does not work.

Resolution: Signature processing is now successful regardless of whether or not TransactionMinder is installed with the Policy Server Option Pack or not.

11.3.9 Sample Class Missing from SDK Installation (54230)

Problem: The sample class directory, sdk/samples/authextensionsaml20 is missing from the 6.0 SDK installation.

Resolution: The directory is now part of the SDK kit.

11.3.10 Policy Server Fails When Several Failover Servers Exist for SAML 1.1 POST Authentication (54624)

Problem: The Policy Server was failing during a SAML 1.1 Post authentication process when a user directory had a large number of failover servers configured.

Resolution: The Policy Server no longer fails. The number of failover servers allowed has been increased.

11.3.11 Apply Button Deletes the XPATH query for XML Body Variable (54839)

Problem: Clicking the Apply button at the bottom of the XML Body Variable Editor in the Policy Server User Interface removes the XPATH query when the variable is configured using the Advanced Query option on the Advanced tab.

Resolution: This is no longer an issue.

11.3.12 SAML 2.0 Authentication Scheme with Server Redirect Mode Set Ignores Assertion Attributes with a Certain Name Formats (54517)

Problem: When an assertion contains attributes with a Name Format of unspecified or url, the Service Provider at the consumer ignores the assertion attributes if the SAML 2.0 authentication scheme is configured the Server Redirect mode. Specifically, the following attributes are ignored:

urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified

urn:oasis:names:tc:SAML:2.0:attrname-format:uri

It only sets attributes with a name format of urn:oasis:names:tc:SAML:2.0:attrname-format:basic.

Resolution: The unspecified and url attributes are no longer ignored in Server Redirect mode.

11.3.13 SiteMinder Fails to Process a Third-party Assertion with Multi-valued Attributes (54562)

Problem: When a third-party generates a SAML assertion with an attribute that has multiple values from the user store, the Policy Server is not processing the assertion correctly.

Resolution: The Policy Server can now process assertions from third-parties with multiple values.

11.3.14 Unattended Upgrade of the Policy Server Option Pack on Windows 2003 Causes a System Reboot (55548)

Problem: When upgrading the Policy Server Option Pack in unattended mode, the Windows 2003 system was rebooting.

Resolution: This is no longer occuring.

12.0 Defects Fixed for Option Pack 6.x QMR 4 and 6.0 SP 4

The following sections list defects fixed for the Web Agent and Policy Server Option Packs.

12.1 Fixes that Apply to Both Option Packs

The following sections list defects fixed for both Option Packs.

12.1.1 SiteMinder 6.0 SP 3/6.x QMR 3 SAML 1.x Consumer Cannot Consume Assertions from a Producer of a Previous SiteMinder Version (45279)

Problem: A SAML 1.x consumer running SiteMinder 6.0 SP 3/6.x QMR 3 or later is unable to consume SAML assertions generated by a producer of an earlier version of SiteMinder.

Resolution: This is no longer an issue.

12.1.2 Relative URL Cannot Be Specified as the Target for Server Redirect Mode (41967)

Problem: When configuring the Server Redirect Mode for a SAML authentication scheme, you cannot specify a relative URL for the TARGET parameter.

Resolution: You can now specify a relative URL.

12.2 Fixes for Web Agent 6.x QMR 4 Option Pack

The following sections list defects fixed for the Web Agent Option Pack.

12.2.1 SAML 1.x Assertion Not Returned if Affiliate Name has Mixed or Upper Case Letters (44705)

Problem: Federation Web Services fails to return an assertion using the SAML 1.x artifact profile if the affiliate name is specified using mixed or upper case characters at the producer or consumer sites.

Resolution: The affiliate name is no longer case sensitive.

12.2.2 Web Server Appends Invalid Character as Part of SAML Response Body (47535)

Problem: SiteMinder appears to generate assertions with invalid characters appended to the SAML response body.

Resolution: The invalid characters are appended by web servers or network devices between SiteMinder and the assertion consumer. If SiteMinder is also acting as the consumer, SiteMinder removes the extra characters before parsing the XML body.

12.3 Fixes for Policy Server 6.0 SP 4 Option Pack

The following sections list defects fixed for the Policy Server Option Pack.

12.3.1 100 Character Limit for User and DN Attributes Included in an Assertion (46237)

Problem: When you specify an Affiliate-HTTP-Cookie-Variable at the producer/Identity Provider to be included in an assertion sent to a consumer/Service Provider, there is a 100 character limit for a User Attribute or a DN Attribute. This limit does not occur when you configure a Static attribute.

Resolution: The character limit has been extended to 1000 characters.

12.3.2 Policy Server Option Pack Variables are Not Accessible in Mixed Mode (44395)

Problem: Policy Server Option Pack variables are not accessible from a SiteMinder Policy Server User Interface when the system is running in mixed mode (a 6.x Policy Server running against a 5.x policy store).

Resolution: In mixed mode, the Option Pack variables are now properly accessed without error.

12.3.3 Affiliate Domain Objects Are Not Retrieved and Displayed Correctly (45693)

Problem: The affiliate objects are not retrieved and displayed correctly in the Policy Server User Interface.

Resolution: Affiliate domain objects are now correctly retrieved and displayed in the Policy Server User Interface.

The contents of any affiliate domain that were created on a version of the Policy Server running on a Japanese OS prior to 6.0 SP1 will not be displayed as a result of an upgrade to 6.0 SP 4. This is a known limitation of the product.

12.3.4 Error Occurs Using SMKeytool to List Microsoft Client Certificates (47337)

Problem: When you try to list Microsoft client certificates using SiteMinder's SMKeytool utility a "No Certificates available.Exception: 15" message is generated. The Microsoft certificates are imported, but they cannot be viewed or used properly with POST profile at the consumer/Service Provider.

Certificates that are created by a Sun Java Systems/Sun ONE Certificate Authority and Open SSL do not have the same issue.

Resolution: This is no longer a problem.

13.0 Defects Fixed for Option Packs 6.x QMR 3 and 6.0 SP 3

The following sections list defects fixed for the Web Agent and Policy Server Option Packs.

13.1 Fixes for Web Agent 6.x QMR 3 Option Pack

The following sections list defects fixed for the Web Agent Option Pack.

13.1.1 SAML Credential Collector Redirects Users to Incorrect Targets (40123)

Problem: For SAML 1.x communication, the SAML credential collector redirects users to target destinations that are outside of the credential collector's own cookie domain.

Resolution: The SAML credential collector now only redirects within its cookie domain.

13.1.2 FWS Attribute Data is Not Propagated (41770)

Problem: The Federation Web Services (FWS) application does not propagate user attribute data if it is specified in a generic format in the SAML assertion.

Resolution: Attribute data may be propagated to target applications. In 302 - cookie data redirect mode, Federation Web Services issues a cookie for each generic attribute in a SAML assertion. In server side redirect mode, Federation Web Services passes a HashMap to the target application. The HashMap contains entries for each generic attribute in a SAML assertion; the name of the request attribute is Netegrity.AttributeInfo.

For the following assertion sample, SiteMinder can set attribute values for FristName and LastName:

<saml:AttributeStatement>
        .
        .
        .
 <saml:Attribute AttributeName="FirstName"    AttributeNamespace="AttributeNS">
   <saml:AttributeValue>JOHN</saml:AttributeValue>
     </saml:Attribute>
 <saml:Attribute AttributeName="LastName"    AttributeNamespace="AttributeNS">
    <saml:AttributeValue>SMITH</saml:AttributeValue>
 </saml:Attribute>
</saml:AttributeStatement>

13.1.3 Server Certificates with a Key Usage Extension Rejected by SAML Assertion Retrieval Component (42663)

Problem: The Web Agent Option Pack expects the SSL server certificate to have digital signature extension set. The SSL standard specifies that digital signature key extension is optional for server certificates.

Resolution: This problem has been fixed.

13.2 Fixes for Policy Server 6.0 SP3 Option Pack

The following sections list defects fixed for the Policy Server Option Pack.

13.2.1 SAML POST Authentication Scheme GUI Requires ISSUER URL to Start with HTTP (42578)

Problem: The SAML Post Authentication Scheme GUI Properties require the ISSUER URL to begin with http. The GUI will not let you enter an ISSUER URL that does not begin with http.

Resolution: The label on SAML POST authentication scheme was changed from "Issuer URL" to "Issuer". Edit constraints were changed so that Issuer to was no longer required to start with http to reflect the fact that issuer is not a URL according to the SAML specification.

14.0 Defects Fixed for Option Packs 6.x QMR 2 and 6.0 SP 2

The following sections list defects fixed for both Option Packs.

14.1 Fix that Applies for Both Option Packs

The following sections list defects fixed for the Web Agent and Policy Server Option Packs.

14.1.1 SAML ID Values Do Not Conform with XML Scheme (34371)

Problem: Assertions contain SAML ID values that do not conform with the XML schema type NCName.

Resolution: The values now conform.

14.2 Fixes for Web Agent v6.x QMR 2 Option Pack

The following sections list defects fixed for the Web Agent Option Pack.

14.2.1 Assertions with Multiple HTTP Status Headers Are Not Consumed (34218)

Problem: SiteMinder fails to consume SAML assertions if multiple HTTP status headers are found. Also, Federation Web Services fails to connect with WebLogic Application Server over SSL.

Resolution: These issues are no longer a problem.

14.2.2 HTTP Response Body with Extra Characters Prevents SiteMinder from Consuming Assertions (30799)

Problem: SiteMinder fails to consume SAML assertions if the HTTP response body includes extra characters. Also, SiteMinder produces SOAP request messages with single quote instead of double quote characters, which cannot be consumed by some SAML consumers.

Resolution: Federation Web Services has been modified so that SiteMinder consumes SAML assertions with extra characters and produces SAML assertions with double quotes.

14.2.3 Back-channel Cert-based Authentication Fails on IIS 5.0 (30929)

Problem: Because of a known limitation, the IIS 5.0 Web Agent does not handle in-line client certificates over an SSL connection. When Federation Web Services (FWS) is installed and configured to consume assertions and the customer requires certificate authentication for back-channel requests to the SAML credential collector, the Web Agent is unable to protect FWS.

Resolution: Use the IIS 5.0 Web server to do client certificate authentication. FWS has been modified to obtain the client certificate from the HTTP request on IIS 5.0. This solution requires that the client certificate's subject DN value contain the affiliate name in the CN attribute field.

14.2.4 Federation Web Services Ignores CookieDomain and CookieDomainScope Settings (38373)

Problem: The Federation Web Services application ignores the CookieDomain and CookieDomainScope Web Agent parameters, which causes single sign-on to fail in certain configurations.

Resolution: Federation Web Services now uses these configuration parameters.

14.2.5 Federation Web Services Creates SMSESSION Cookie with Missing Data for Secure Proxy Agent (38419)

Problem: The Federation Web Services application generates an SMSESSION cookie that lacks the data required for interoperability with the Secure Proxy Agent.

Resolution: The SMSESSION cookie generated by Federation Web Services now contains the necessary data for the Secure Proxy Agent.

15.0 Known Issues

The following sections describe know issues for the Policy Server and Web Agent Option Packs.

15.1 Web Agent Protecting Federation Web Services Must Trust Default Security Zone (56704)

If you are using Federation Security Services in an environment with SiteMinder security zones, you must configure the Web Agent that is protecting the Federation Web Services application to trust the default security zone, called SM. Therefore, include the default security zone SM when configuring the SSOTrustedZone parameter for this Web Agent.

15.2 Policy Server Installed on Japanese OS Platform Cannot Display Affiliate Domain Objects After Upgrade to 6.0 SP 4 or higher

The contents of any affiliate domain objects that were created on a version of the Policy Server running on a Japanese OS prior to 6.0 SP1 will not be displayed as a result of an upgrade to 6.0 SP 4.

15.3 Single Logout Services Log Errors if ODBC/SQLError Component Enabled (41324)

If the ODBC/SQLError component is enabled in the Policy Server trace log, Single Logout Services may cause the following errors to be written to the trace log:

[13:42:44.0][CSmDbODBC.cpp:189][CSmDbConnectionODBC::MapResult][][][-1][[Microsoft][ODBC SQL Server Driver][SQL Server]Violation of PRIMARY KEY constraint 'PK__ss_sessionvar5__571DF1D5'. Cannot insert duplicate key in object 'ss_sessionvar5'.][][][] [13:42:44.0][CSmDbODBC.cpp:277][CSmDbConnectionODBC::MapResult][][Mapped Result: -1059 Error Message: "[Microsoft][ODBC SQL Server Driver][SQL Server]Violation of PRIMARY KEY constraint 'PK__ss_sessionvar5__571DF1D5'. Cannot insert duplicate key in object 'ss_sessionvar5'." SQL State: 23000.][][][][][] [13:42:44.0][CSmDbODBC.cpp:189][CSmDbConnectionODBC::MapResult][][][-1][[Microsoft][ODBC SQL Server Driver][SQL Server]The statement has been terminated.][][][] [13:42:44.0][CSmDbODBC.cpp:277][CSmDbConnectionODBC::MapResult][][Mapped Result: -1059 Error Message: "[Microsoft][ODBC SQL Server Driver][SQL Server]The statement has been terminated." SQL State: 01000.][][][][][] [13:42:44.0][CSmDbODBC.cpp:189][CSmDbConnectionODBC::MapResult][][][-1][][][][] [13:42:44.0][CSmDbODBC.cpp:277][CSmDbConnectionODBC::MapResult][][Mapped Result: -1059 Error Message: "" SQL State: .][][][][][]

This is normal and the data is ultimately written to the session server database.

15.4 Incompatible SiteMinder Releases for Federation Security Services (44790)

SiteMinder versions 6.0 SP 3/6.x QMR 3 configured as a SAML 1.X consumer and the SAML Affiliate Agent 6.x QMR 3 are incompatible with SiteMinder versions 6.0 SP 2/v6.x QMR 2 and earlier configured as a SAML 1.X producer. The incompatibility is due to changes made in SiteMinder 6.0 SP 3/6.x QMR 3 to ensure conformance to the SAML specification based on the PingID certification tests.

16.0 International Support

An internationalized product is an English product that runs correctly on local language versions of the required operating system and required third-party products, and supports local language data for input and output. Internationalized products also support the ability to specify local language conventions for date, time, currency and number formats.

A translated product (sometimes referred to as a localized product) is an internationalized product that includes local language support for the product's user interface, online help and other documentation, as well as local language default settings for date, time, currency, and number formats.

In addition to the English release of this product, CA supports only those languages listed in the following table.

Language	Internationalized	Translated
Brazilian-Portuguese	Yes	No
Chinese (Simplified)	Yes	No
Chinese (Traditional)	Yes	No
Czech	Yes	No
Danish	Yes	No
Dutch	Yes	No
Finnish	Yes	No
French	Yes	No
German	Yes	No
Greek	Yes	No
Hungarian	Yes	No
Italian	Yes	No
Japanese	Yes	No
Korean	Yes	No
Norwegian	Yes	No
Polish	Yes	No
Russian	Yes	No
Spanish	Yes	No
Swedish	Yes	No
Turkish	Yes	No

Note: If you run the product in a language environment not listed in the table, you may experience problems.

17.0 Documentation

The file names for the SiteMinder 6.0 SP 5/6.x QMR 5 guides are as follows:

Guide Name	File Name
SiteMinder Release Summary	siteminder_release_enu.pdf
Developer's Reference for Java	siteminder_java_dev_enu.zip
Developer's Guide for Java	siteminder_java_dev_enu.pdf
Developer's Guide for C	siteminder_c_dev_enu.pdf
Federation Security Services Guide	siteminder_fs_config_enu.pdf
Policy Server Installation Guide	siteminder_ps_install_enu.pdf
Policy Design Guide	siteminder_ps_config_enu.pdf
Policy Server Management	siteminder_ps_sysmgmt_enu.pdf
Policy Server Readme	readme-policy-server.html
Policy Server, Web Agent Option Pack Readme	readme-option-packs.html
Scripting Guide for Perl	siteminder_perl_scripting_enu.pdf
SDK Overview	siteminder_sdk_overview_enu.pdf
SDK Readme	readme-sdk.html
SAML Affiliate Agent Guide	siteminder_saa_config_enu.pdf
SAML Affiliate Agent Readme	readme-saml-affiliate-agent.html
SiteMinder Upgrade Guide	siteminder_upgrade_enu.pdf
SiteMinder Integrated Documents	siteminder_integdocs_ref.enu.zip
Tier II Directory Configuration Guide	siteminder_dir_config_enu.pdf
Web Agent Guide	siteminder_wa_config_enu.pdf
Web Agent Installation Guide	siteminder_wa_install_enu.pdf
Web Agent Readme	readme-web-agent.html

To view PDF files, you must download and install the Adobe Reader from the Adobe website if it is not already installed on your computer.

Updated guides will be available at the CA Technical Support site.

17.1 Integrated Documentation

Integrated Documents lets you access all of the SiteMinder documentation from a central location. Viewing Integrated Documents requires an Internet browser.

Integrated Documents includes a:

Single expandable list of contents for all manuals

Full text search across all manuals

Single index across all manuals

18.0 Contact Customer Support

For online technical assistance and a complete list of locations, primary service hours, and telephone numbers, contact Technical Support at http://ca.com/support.