IBM OpenPages GRC Platform Version 7.1 FP4. Patch ReadMe

IBM OpenPages GRC Platform Version 7.1 FP4 Patch ReadMe

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 2 of 33 NOTE Before using this information and the product it supports, read the information in the Notices section of this document. Product Information This document applies to IBM OpenPages GRC Platform 7.1 and may also apply to subsequent releases. Licensed Materials Property of IBM Corporation. Copyright IBM Corporation, 2003, 2017. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Documentation Release Information Last Modified: August 8, 2017 11:54:20 PM

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 3 of 33 Table of Contents About this Patch Installer...4 Enhancements, Defect Fixes and Known Issues...5 Enhancements...5 Known Issues...5 Before You Begin...7 Prerequisite Software...7 Information You Need...7 Backing Up the Existing IBM OpenPages GRC Platform Environment...8 Backup Solutions Helpers & Dojo tool kit...8 Selecting the Type of Installation...9 Patch Installation Tasks...10 Task 1: Use Scripts to Update the OpenPages Database...10 Task 2: Verify That Servers Are Running...12 Task 3: Load Updates...13 Task 4: Launch the Patch Installer Program...13 Task 5: Choose the Type of Installation...14 Task 6: Enter OpenPages Application Information...14 Task 7: Enter OpenPages Administrator Information...16 Task 8: Enter Reporting Server Information...16 Task 9: Enter WebSphere Java Home...17 Task 10: Enter OpenPages Database Server Information...17 Locating Patch Installation Log Files...18 Patch Log Files for the Application, Workflow, and Reporting Servers...18 Post-Installation Tasks...19 Task 1: Restore the filters on users that are not correctly returning data...19 Task 2: Apply the Modules Patch...19 Task 3: Merge openpages-ext.jar...20 Task 4: Restore Solutions Helpers & Dojo toolkit...20 Task 5: Enable Workflow Resubmission on Error [optional]...21 Task 6: Start Servers...21 Task 7: Remove X-Powered-By header [recommended]...22 Task 8: Drop and create Reporting Schema [Active Reporting Period]...22 Task 9: Update Trigger Configuration...23 Uninstalling This Patch...25 Task 1: Stop all Servers...25 Task 2: Run Patch Uninstaller...25 Task 3: Restore the Database...25 Task 4: Start all Servers...26 Task 5: Restore X-Powered-By header [not recommended]...26 Documentation Updates...27 Appendix A Silent Patch Installation and Uninstallation...28 Silent Patch Installation:...28 Task 1: Update Silent Installer Properties...28 Task 2: Run Patch Installer Silently...29 Task 3: Start Servers...30 Task 4: Complete Installation...30 Silent Patch Uninstallation:...30 Notices...31

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 4 of 33 About this Patch Installer This patch installer updates the IBM OpenPages GRC Platform environment from version 7.1.0.0.x, 7.1.0.1.x, 7.1.0.2.x, or 7.1.0.3.x to 7.1.0.4 for Windows, AIX, Red Hat Enterprise Linux (RHEL) installations. It is a cumulative update. Depending on your environment and preferences, you can update the database server by manually running SQL scripts directly on the database server or you can run the database scripts using the database client installed on the admin application server. Important! You must use the patch installer program to update all IBM OpenPages application servers (admin and non-admin) and reporting servers (primary and secondary).

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 5 of 33 Enhancements, Defect Fixes and Known Issues Enhancements Fix pack 1 added new feature to allow administrators to control which browser types can connect to the application. For more information, please see the page: http://www.ibm.com/support/docview.wss?uid=swg21959256 Fix pack 2 added a new registry setting that administrators should be aware of: /OpenPages/Solutions/IAM/Timesheet Entry/Prepopulate Timesheet Rows When the user goes to a new week, the timesheet helper can prepopulate a row in the new week for each row that exists in the timesheet for the previous week. A value of true automatically populates rows; a value of false does not automatically populate rows. The default is false, so administrators should switch this setting to true if they would like to enable this feature. Fix pack 3 added a new registry setting that administrators should be aware of: /Administration/Settings/Platform/Security/Enable Base64 Encoding This setting is set to false (disabled) by default. The purpose of this setting is to turn on a new feature that applies Base64 encoding to all GET requests used by the application. An administrator might wish to enable this setting if they are using strict blocking of possibly hazardous characters at their proxy or firewall. Since OpenPages uses RESTful services to enhance UI speed and functionality, the application might issue a GET request containing an encoded apostrophe (i.e. %27) or other symbol that might be in a blacklist used by the customer's proxy or firewall. If enabled, the query string for the request will be Base64 encoded prior to leaving the web browser. This will prevent any suspicious characters from appearing in the request sent to the server. Fix pack 4 added a new registry setting that administrators should be aware of: /OpenPages/Platform/Security/Headers/X-XSS-Protection Enables 'X-XSS-Protection' header on server responses. Permissible values are true false. Defect Fixes For more information, please see the IBM OpenPages 7.1 Fix pack 4 release page: http://www.ibm.com/support/docview.wss?uid=swg27045110#tab_71fp4 Known Issues Enabling debug logging in the OpenPagesSecurityProvider has been found to cause deadlocks in Cognos, rendering it unavailable (APAR PI38157). This debugging should only be enabled for active troubleshooting of authentication issues between Cognos and OpenPages. If currently enabled, this fix pack will disable the setting as a precaution. There have been infrequent reports of an inability to install the IBPM Workflow Studio kit due to a file not found error (APAR PI43800). As this has been a rare occurrence, the fix for this is not being included in the main fix pack download. If you have a workstation where this issue occurs, please see the Fix Pack 2 download page for a link to an updated Workflow Studio package.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 6 of 33 On the Enter WebSphere Java Home window, if you click the Previous button, Install Type Chose window will show (reasonable OpenPages Application Server Information should show). In order to go to "OpenPages Application Server Information window, you need to click the Next button.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 7 of 33 Before You Begin Prerequisite Software Prior to installing the IBM OpenPages GRC Platform 7.1.0.4, you should have OpenPages 7.1.0.0.x, 7.1.0.1.x, 7.1.0.2.x, or 7.1.0.3.x installed. Information You Need The 7.1.0.4 patch requires the following information. For the OpenPages application update: o The existing installation path of the IBM WebSphere server o The existing installation path of the OpenPages application server and the administrative server port number o The existing installation path of the Interstage BPM workflow server, application server port number and the administrative server port number o The status of WebSphere Global Security, and the username and password to allow access to the WebSphere console. WebSphere Global Security is enabled by default. o The number of cluster members configured on the machine (in a vertical cluster) o The user name and password of the OpenPages application super administrator. o Location of custom deliverables such as Help JSPs, images, dojo. These will be used for backup and restore. For the Oracle database update: o The existing location of the Oracle Client folder o The Oracle database alias name o The OpenPages database user name and password o The Interstage BPM workflow database user name and password o Base Currency o OpenPages_Storage location For the DB2 database update: o The existing location of the DB2 Client folder o The OpenPages database user name and password o The Interstage BPM workflow database user name and password o Base Currency o OpenPages_Storage location For the CommandCenter update (Primary Cognos server): o The existing installation path of the Cognos server o The existing installation path of the CommandCenter folder o The dispatcher URL for the CommandCenter

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 8 of 33 Backing Up the Existing IBM OpenPages GRC Platform Environment Before you start the patch update process, you must back up the OpenPages environment, the Cognos environment and the database. OPBackup Utility and OPCCBackup Utility Use the OPBackup utility on each application server. Use the OPCCBackup utility on each reporting server. Oracle database back up is accomplished using the OPBackup utility while DB2 database back up is accomplished using DB2 back up tools. Refer to the following sections in the IBM OpenPages GRC Platform Administrator s Guide. Using IBM OpenPages GRC Platform utilities with Oracle databases Using IBM OpenPages GRC Platform utilities with IBM DB2 databases Run the OpenPages and CommandCenter Backup Utilities Run the OpenPages backup (OPBackup) and CommandCenter backup (OPCCBackup) utilities to completely back up your OpenPages database and application, and CommandCenter Content Store and files. Note: If this is the first time you are using the CommandCenter backup utility (OPCCBackup), make sure you configure the Oracle datapump storage directory before running this utility. For details on how to configure the Oracle Data Pump directory for the first-time use, see the "The OPBackup utility" chapter and "Using the Cognos Backup utility" chapter in the IBM OpenPages GRC Platform Administrator s Guide. Backup Solutions Helpers & Dojo tool kit Perform these steps on each application server. 1. Create a backup folder for backing up solutions helpers and dojo toolkits Example: C:\OpenPages\patch\helper_backup 2. Copy the JSP helpers & dojo toolkits (both shipped with product and customized) to the backup folder. \toolkits\dojo\, \toolkits\dojox\, \toolkits\dijit\ These folders are found in: <openpages installation folder>\profiles\<node Name>#\installedApps\OpenPagesCell\op-apps.ear\sosa.war Notes: If you have deployed a customized toolkit or helpers (e.g. Helper JSPs, images etc.) in locations other than those listed above, please backup them up in order to restore after the patch installation is completed. The patch installer backs up and restores the session-timeout setting configured in the web.xml and the context-root setting configured in the application.xml. If you have made additional changes to the OpenPages web configuration xml files, then you need to backup these changes.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 9 of 33 Selecting the Type of Installation Before you update your system, use the following scenarios to help you decide where to run the patch installer in your particular environment: Scenario 1: The application and reporting servers are on separate machines Scenario 2: The application and reporting servers are on the same machine Note: In any of these scenarios, you need to manually upgrade the database server first, using SQL scripts. Scenario 1: The Application, Database, and Reporting Servers Are on Separate Machines If the application and reporting servers are each running on different machines (for example, the application server is on Machine-1 and the reporting server is on Machine-2), run the patch installer program as follows: To update Run the patch installer on And select this this machine An application server Application server Application A reporting server Reporting server Reporting Scenario 2: The Application, Database, and Reporting Servers Are on the Same Machine If the application and reporting servers are all running on the same machine (for example, Machine-1), use the following method. Run the patch installer program to automatically update the application and reporting servers as follows. To update The application and reporting on one system Run the patch installer on this machine The application/reporting server And select this Application and Reporting

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 10 of 33 Patch Installation Tasks To install the IBM OpenPages GRC Platform 7.1.0.4 patch, perform the following tasks. Important! Before installing the 7.1.0.4 patch, make sure you have all the required backup folders and files including those described in Backing Up the Existing IBM OpenPages GRC Platform Environment. Task 1: Use Scripts to Update the OpenPages Database Manually update the database server by running batch/shell scripts included in the media kit. Important: Run these scripts BEFORE using the 7.1.0.4 patch installer Scripts must be run while all OpenPages Servers are shutdown Stop OpenPages Servers Note: For details on starting and stopping servers, see the Starting and Stopping Servers chapter in the IBM OpenPages GRC Platform Administrator s Guide. For DB2 database, Steps: 1. Have the database administrator ensure there are no connections to the database with the db2 list applications command. For example: [user@server ]$ db2 list applications Auth Id Application Appl. Application Id DB # of Name Handle Name Agents -------- -------------- ---------- -------------------------------------------------------------- -------- ----- DB2INST1 db2bp 32912 *LOCAL.db2inst1.150611205154 OPX 1 Note that this shows only one connection, the current dba user. This database is safe to upgrade as long as the current dba connection does not have any active transactions. The following listing shows multiple connection and it is not safe to upgrade. If there are connections other than the current dba connection, then you must take steps to close the connections before proceeding with the database patch. Auth Id Application Appl. Application Id DB # of Name Handle Name Agents -------- -------------- ---------- -------------------------------------------------------------- -------- ----- OPENPAGE db2jcc_applica 30138 10.10.10.248.42542.150610124431 OPX 1 OPENPAGE db2jcc_applica 29243 10.10.10.248.39626.150610122936 OPX 1 OPENPAGE db2jcc_applica 3986 10.10.10.248.39361.150610052307 OPX 1 OPENPAGE db2jcc_applica 30137 10.10.10.248.42541.150610124429 OPX 1 OPENPAGE db2jcc_applica 3972 10.10.10.248.39356.150610052245 OPX 1 OPENPAGE db2jcc_applica 3985 10.10.10.248.39360.150610052306 OPX 1 OPENPAGE db2jcc_applica 30136 10.10.10.248.42540.150610124430 OPX 1 DB2INST1 db2bp 32912 *LOCAL.db2inst1.150611205154 OPX 1 WORKFLOW db2jcc_applica 30227 10.10.10.248.42874.150610133952 OPX 1 OPENPAGE db2jcc_applica 30132 10.10.10.248.42508.150610124425 OPX 1 One option to close connections to the DB2 instance is to stop and start the DB2 instance. For more information on how to stop and start the DB2 instance, see the "Install and configure DB2 text search" chapter in the IBM OpenPages GRC Platform Administrator s Guide.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 11 of 33 2. Copy the Scripts from <kit>\op_7.1.0.4_patch_scripts\db2\patch_scripts to the server where you will run the SQL scripts. NOTE: When editing shell scripts to be run on the UNIX platform, be sure to set fileformat=unix 3. Update properties in the OP-7-1-0-X-database-patch-properties.bat.sh OP_DATABASE_USERNAME=<OpenPages Database Username> OP_DATABASE_PASSWORD=<OpenPages Database Password> WF_DATABASE_USERNAME=<OpenPages Workflow Database Username> WF_DATABASE_PASSWORD=<OpenPages Workflow Database Password> DATABASE_HOST_NAME=<DB2 Host Name> DATABASE_INSTANCE_PORT=<DB2 Instance Port> DATABASE_NAME=<DB2 Name> 4. Update the following properties in sqlwrapper.sql to match the values for the installation you are upgrading. define opx_op_admin_name='openpagesadministrator' define opx_op_admin_pwd='openpagesadministrator' define super_admin_username='openpagesadministrator' define super_admin_password='openpagesadministrator' define opx_base_currency_iso_code='usd' define opx_dflt_stor_srv_root='c:\openpages\openpages-storage' 5. Run db2cmd command to launch CLP Window (for Windows ONLY) 6. If Upgrading from v7.1.0.0, Run OP-7-1-0-1-database-patch.bat.sh Run OP-7-1-0-2-database-patch.bat.sh Run OP-7-1-0-3-database-patch.bat.sh Run OP-7-1-0-4-database-patch.bat.sh If Upgrading from v7.1.0.1, Run OP-7-1-0-2-database-patch.bat.sh Run OP-7-1-0-3-database-patch.bat.sh Run OP-7-1-0-4-database-patch.bat.sh If Upgrading from v7.1.0.2, Run OP-7-1-0-3-database-patch.bat.sh Run OP-7-1-0-4-database-patch.bat.sh If Upgrading from v7.1.0.3, Run OP-7-1-0-4-database-patch.bat.sh 7. Remove passwords from configuration files to protect security. For Oracle database, Steps: 1. Copy the SQL Scripts from <kit>\op_7.1.0.4_patch_scripts\oracle\patch_scripts to the server where you will run the SQL scripts. Note: When editing shell scripts to be run on the UNIX platform, be sure to set fileformat=unix 2. Update properties in the OP-7-1-0-X-database-patch-properties.bat.sh OP_DATABASE_USERNAME=<OpenPages Database Username> OP_DATABASE_PASSWORD=<OpenPages Database Password>

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 12 of 33 WF_DATABASE_USERNAME=<OpenPages Workflow Database Username> WF_DATABASE_PASSWORD=<OpenPages Workflow Database Password> DATABASE_ALIAS=<OpenPages database Alias> 3. Update the following properties in sqlwrapper.sql to match the values for the installation you are upgrading. define opx_op_admin_name='openpagesadministrator' define opx_op_admin_pwd='openpagesadministrator' define opx_base_currency_iso_code='usd' define opx_dflt_stor_srv_root='c:\openpages\openpages-storage' 4. If Upgrading from v7.1.0.0, Run OP-7-1-0-1-database-patch.bat.sh Run OP-7-1-0-2-database-patch.bat.sh Run OP-7-1-0-3-database-patch.bat.sh Run OP-7-1-0-4-database-patch.bat.sh If Upgrading from v7.1.0.1, Run OP-7-1-0-2-database-patch.bat.sh Run OP-7-1-0-3-database-patch.bat.sh Run OP-7-1-0-4-database-patch.bat.sh If Upgrading from v7.1.0.2, Run OP-7-1-0-3-database-patch.bat.sh Run OP-7-1-0-4-database-patch.bat.sh If Upgrading from v7.1.0.3, Run OP-7-1-0-4-database-patch.bat.sh 5. Remove passwords from configuration files to protect security. Task 2: Verify That Servers Are Running All servers need to be running during installation of the IBM OpenPages GRC Platform 7.1.0.4 patch. This is required so the patch installer program can validate user input. Verify that all administrative and managed servers are running, including database and reporting servers (both CommandCenter and Framework Manager). If this is a horizontal clustered environment then verify all managed servers are running on all non-administrative servers. Note: For details on starting and stopping servers, see the Starting and stopping servers chapter in the IBM OpenPages GRC Platform Administrator s Guide.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 13 of 33 Task 3: Load Updates This step may be skipped if you previously completed the task while applying 7.1.0.3. This step will load any new strings or settings required by this fix pack. 1. On the primary OpenPages server, copy the loader-data folder to a temp folder. 2. Open a command prompt. 3. Navigate to <OP_Home>/bin 4. Use ObjectManger to load updates, for example: objectmanager l c OpenPagesAdministrator <password> <path to loader-data folder> OpenPages-upgrade-registry-entries-7103 Task 4: Launch the Patch Installer Program Launch the OpenPagesPatchSetup installer program to run the patch installation. Notes Prior to running the installer you must first update the database server. See the task, Use Scripts to Update the Database Server, if the database has not yet been updated If this is a horizontal clustered environment, the patch installer must run on the administrative server first, and then on all non-administrative servers. If the reporting server is in a separate machine from the application server, Make sure JAVA_HOME is pointing to the Java used by Cognos If you need to set the JAVA_HOME, be sure Cognos is working fine after the JAVA_HOME is set and you restarted the Reporting server. Navigate to the <OpenPages Installation Folder>/bin directory and verify that the following two properties in the ObjectManager.properties file are set to false: configuration.manager.force.update.object.strings=false configuration.manager.force.update.application.strings=false Steps: 1. Log on to the server where you will perform the patch install as a user with administrative privileges and full access to the local server drives. Note: For Unix installs, log in as a non-root user, such as the user you created for the reporting server installation, for example: opuser. 2. From the IBM OpenPages GRC Platform Patch Installer 7.1.0.4 installation kit, copy the entire OP_7.1.0.4_Installer\IBM OpenPages GRC Platform Patch Installer directory to the application server. 3. Open a Command Prompt window (using the Run as Administrator option) or Unix shell, and do the following: Navigate to the IBM OpenPages GRC Platform Patch Installer directory you just copied. Navigate to the patch installer in the IBM OpenPages GRC Platform Patch Installer directory: Windows: Disk1\InstData\WIN64\NoVM Linux: Disk1/InstData/Linux64/VM AIX: Disk1/InstData/AIX64/VM Launch the IBM OpenPages GRC Platform patch installer program as follows: Windows AIX/Linux OpenPagesPatchSetup.exe OpenPagesPatchSetup.bin

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 14 of 33 4. On the Introduction screen, click next. Task 5: Choose the Type of Installation These instructions assume that you have read the section Selecting the Type of Installation and know which installation options you want to choose. 1. On the Installation Type screen, do the following. Depending on your requirements, select from the following options to automatically update your environment: For this server Select this Perform these Tasks option Admin Application server Application Task 5; Task 6; Task 7; Task 10; Non-Admin Application server Application Task 5; Task 7; Reporting server Reporting Task 5; Task 7; Task 8; Application/ Reporting server Application AND Reporting Task 5; Task 6; Task 7; Task 8; Task 10; When finished, click Next to continue. Task 6: Enter OpenPages Application Information These screens will appear when applying the patch to an OpenPages application server. Use the following instructions to update the OpenPages application server using the patch installer program. 1. On the Installation Directory screen, do the following. a. Enter information for the following fields: In this field OpenPages GRC Platform Installation directory Enter this The installation location of the existing OpenPages application. Example: Windows c:\openpages AIX or Linux /opt/openpages Workflow(Interstage BPM) Installation Folder The installation location of the existing Fujitsu Interstage BPM workflow server. Example: Windows c:\fujitsu\interstagebpm AIX or Linux /opt/fujitsu/interstagebpm b. When finished, click Next. 2. On the OpenPages Application Server Information screen, do the following.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 15 of 33 a. Enter information for the following fields: In this field How many cluster members do you have configured on this machine? Is Security Enabled? a. When finished, click Next. Enter this The number of cluster members on the current machine. Select one of the following: No if WebSphere Global Security is not enabled. No further information needed. Yes (Default state for OpenPages 7.1) if WebSphere Global Security is enabled, and then proceed to the following fields: o Admin Server User Name - enter the user name for accessing the IBM WebSphere Integrated Solutions Console. o Admin Server User Password - enter the password for the IBM WAS admin account. o Confirm Password - reenter the above password for confirmation.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 16 of 33 Task 7: Enter OpenPages Administrator Information This screen will appear when applying the patch to an OpenPages admin application server. Use the following instructions to update the admin server using the patch installer program. 1. On the OpenPages Application User Information screen, do the following. a. Enter information for the following fields: In this field OpenPages Application User Enter this The administrative user name for accessing the OpenPages application. By default, this is: OpenPagesAdministrator OpenPages Application Password Confirm Password The password for the OpenPages administrator account. Re-enter the above password. b. Click Next. Task 8: Enter Reporting Server Information This screen will appear when applying a patch to a CommandCenter reporting server. Use the following instructions to update the reporting server using the patch installer program. 5. On the OpenPages Reporting Server Information screen, enter information for the following fields: In this field Cognos Installation Directory Enter this The installation location of the Cognos application. Example: Windows C:\OpenPages\Cognos\cognos\c10_64 OpenPages CommandCenter Directory AIX or Linux /opt/openpages/cognos/cognos/c10_64 The location of the OpenPages CommandCenter folder. Example: Windows C:\OpenPages\CommandCenter CommandCenter Dispatcher URL AIX or Linux /opt/openpages/commandcenter The Dispatcher URL for the OpenPages CommandCenter Example: http://<fully qualified server name>:9300/p2pd/servlet/dispatch 6. When finished, click Next.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 17 of 33 Task 9: Enter WebSphere Java Home This screen will appear when applying the patch on AIX and Linux platform.. 1. On the WebSphere Java Home screen, enter the WAS Java Home Folder. Example: <WAS_HOME>/java_1.7.1_64 2. When finished, click Next. Task 10: Enter OpenPages Database Server Information This screen will appear when applying a patch to the OpenPages admin application server. Steps: For Oracle Database: 1. On the OpenPages Database Information screen, do the following: a. Enter information for the following fields: In this field Oracle Client Directory Enter this The location on the OpenPages application server where the Oracle Client software is installed. This should be the same as the ORACLE_HOME value. Example In this example, the database and application servers are on different machines: Windows C:\openpages_data\repository\ client112_ac_x64\software AIX or Linux /opt/oracle/openpages_data/repository/ client112_ac_x64/software Database Alias Name OpenPages Database User Name The TNS name of the OpenPages database instance. The user name for accessing the OpenPages database. By default, this is: openpages OpenPages Database Password Workflow Database User Name The password for the OpenPages database account. The user name for accessing the Workflow (Interstage BPM) database. By default, this is: opworkflow Workflow Database Password The password for the Workflow (Interstage BPM) database account. b. When finished, click Next. For DB2 Database:

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 18 of 33 1. On the OpenPages Database Information screen, do the following: Enter information for the following fields: In this field DB2 Client Directory Enter this The location on the OpenPages application server where the DB2 Client software is installed. This should be the same as the DB2_HOME value. Example In this example, the database and application servers are on different machines: Windows C:\db2inst1\sqllib AIX or Linux /home/db2inst1/sqllib OpenPages Database User Name The user name for accessing the OpenPages database. By default, this is: openpages OpenPages Database Password Workflow Database User Name The password for the OpenPages database account. The user name for accessing the Workflow (Interstage BPM) database. By default, this is: opworkflow Workflow Database Password The password for the Workflow (Interstage BPM) database account. When finished, click Next. Locating Patch Installation Log Files If errors occur during the patch installation process, you can review the following patch installer log files for troubleshooting. Patch Log Files for the Application, Workflow, and Reporting Servers Log files related to the OpenPages application, workflow, and reporting servers can be found on the server where you ran the patch installer: <OP_Home>\patch\V7104\logs\OpenPages_Patch_Installer_Debug.log <OP_Home>\patch\V7104\logs\OpenPages_Patch_Installer_Error.log Where: <OP_Home> is the installation location of the IBM OpenPages GRC Platform application. By default, the path is: Windows AIX or Linux C:\OpenPages /opt/openpages

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 19 of 33 Post-Installation Tasks Perform the following tasks after completing the patch to 7.1.0.4. Task 1: Restore the filters on users that are not correctly returning data To address "APAR PI71595 Filters using End User not returning data", the following utility needs to be run to restore the filters on Users that are not correctly returning data: Important: Run these scripts AFTER using the 7.1.0.4 patch installer Scripts must be run while all OpenPages Servers are shutdown Stop OpenPages Servers Note: For details on starting and stopping servers, see the Starting and Stopping Servers chapter in the IBM OpenPages GRC Platform Administrator s Guide. To run this utility from the patch scripts folder to restore filter(s) using ActorInGroup condition to Simple condition: 1. Run the "restore-actoringroup-to-simple-filter.sql" utility from the patch scripts folder as follows: Oracle: Copy files from the <kit>\op_7.1.0.4_patch_scripts\oracle\patch_scripts folder to a folder on the server. DB2: Copy files from the <kit>\op_7.1.0.4_patch_scripts\db2\patch_scripts folder to a folder on the server. 2. Open a connection to the database using openpages user. Oracle: sqlplus <openpages user>/<openpages user password>@<openpages database SID> DB2: clpplus -nw <openpages user>/<openpages user password>@<db2 server name>:<db2 server port number>/<openpages database name> In SQL> prompt, run SQL>@restore-actoringroup-to-simple-filter.sql; Note: if there is no data to be restored, the script will exit right away. Task 2: Apply the Modules Patch This task is required for all OpenPages application servers if you have installed the optional Solutions. <OpenPages 7.1.0.4 Kit>\Modules contains solutions update files Steps: 1. Ensure that all OpenPages services are stopped. If the application and reporting servers are running, then follow the instructions in the IBM OpenPages GRC Platform Administrator s Guide in the Starting and stopping servers chapter to stop all application, workflow and reporting servers. 2. Copy "solutions-sosa-files.zip" from Modules patch kit into <OP_HOME>/applications 3. Also extract this zip into <OP_Home>/profiles/<HOST_NAME>-OPNode#/installedApps/OpenPagesCell/opapps.ear/sosa.war (Select to override if prompted) 4. Repeat steps 1-3 on all OpenPages application servers and nodes. 5. Start OpenPages services. 6. On the primary OpenPages server, copy the Modules/loader folder to a temp folder. 7. Open a command prompt. 8. Navigate to <OP_Home>/bin 9. Use ObjectManger batch load command to load module updates, for example:

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 20 of 33 objectmanager b c OpenPagesAdministrator <password> <path to loader folder> <path to loader folder>/7_1_0_2_modules.txt Note: 1. OpenPages 7.1.0.2 added a new registry setting that administrators should be aware of: /OpenPages/Solutions/IAM/Timesheet Entry/Prepopulate Timesheet Rows When the user goes to a new week, the timesheet helper can prepopulate a row in the new week for each row that exists in the timesheet for the previous week. A value of true automatically populates rows; a value of false does not automatically populate rows. The default is false, so administrators should switch this setting to true if they would like to enable this feature. 2. OpenPages 7.1.0.4 added a new registry setting that administrators should be aware of: /OpenPages/Platform/Security/Headers/X-XSS-Protection Enables 'X-XSS-Protection' header on server responses. Permissible values are true false. Task 3: Merge openpages-ext.jar This task is required for all OpenPages application servers if you have installed the optional Solutions. Steps: 1. Backup openpages-ext.jar from <OP_HOME>/aurora/lib/ 2. Extract "openpages-ext.jar" from <OP_HOME>/aurora/lib/ to <OP_HOME>/merge/ 3. Extract openpages-ext.jar from <OpenPages 7.1.0.4 Kit>/Modules to <OP_HOME>/merge/ [allow/choose to overwrite existing file) 4. Zip/Jar the files and folders under the merge folder as openpages-ext.jar 5. Copy the Updated openpages-ext.jar to <OP_HOME>/aurora/lib/ [allow/choose to overwrite the file] Task 4: Restore Solutions Helpers & Dojo toolkit This task is required for each OpenPages application server. After applying patch, revert back the Solutions helpers and Dojo toolkits Copy the solutions helpers and dojo toolkits from the backup folder to \toolkits\dojo\, \toolkits\dojox\, \toolkits\dijit\ Under <openpages installation folder>\profiles\<node Name>#\installedApps\OpenPagesCell\sosa.war Note: Please restore the toolkits and helpers deployed in the non-default location which you backed during the Backup Solutions Helper & Dojo tool kit step. If you backed up additional changes to the OpenPages web configuration xml files, then you need to restore these changes.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 21 of 33 Task 5: Enable Workflow Resubmission on Error [optional] APAR PI25797 documents a problem where a parent job may fail to be restarted when all child jobs have completed. While we work with the workflow engine vendor on a root cause solution to PI25797, we are providing this mitigation. Should processing of a parent notification task fail (parent workflow is not restarted after all children complete), enabling this option will retry the operation up to the configured number of tries. The retry interval is 5 minutes. 1. Navigate to <op-home>\aurora\conf 2. Edit aurora.properties 3. A the bottom of the file, add the following line: workflow.iflow.filelistener.retry=10 4. Save and close aurora.properties 5. Repeat this step on all application servers Task 6: Start Servers Once the patch installation is completed successfully and the post-installation steps are completed, follow the steps below to start the servers. Note: For details on starting and stopping servers, see the Starting and stopping servers chapter in the IBM OpenPages GRC Platform Administrator s Guide. Steps: 1. Start all application and workflow servers using the StartAllServers script. 2. Start the reporting server (including the CommandCenter and OpenPages Framework Model Generator services).

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 22 of 33 Task 7: Remove X-Powered-By header [recommended] This is an optional task that will increase the security of your application server by removing the X-Powered-By header from responses sent from the server to the client. Attackers could use this header to learn which application server you are using and launch targeted attacks for that platform. 1. In the WebSphere administrative console click Servers > Server Types > WebSphere application servers > server_name > Web Container Settings > Web container. 2. Under Additional Properties select Custom Properties. 3. On the Custom Properties page, click New. 4. On the settings page, enter the: Name: com.ibm.ws.webcontainer.disablexpoweredby Value: true 5. Click Apply or OK. 6. Click Save on the console task bar to save your configuration changes. 7. Repeat same steps on all the Nodes 8. Restart the server. Task 8: Drop and create Reporting Schema [Active Reporting Period] This step may be skipped if you do not use Active Reporting periods, or previously completed the task while applying 7.1.0.2. If you had an Active Reporting Period before applying the 7.1.0.2 patch, you may not have been able to finalize the Reporting Period. Affected customers will need to drop and create the Reporting Schema and then will be able to finalize the reporting period. With a fix introduced in 7.1.0.2, you can now finalize the Reporting Period after you drop and recreate the Reporting Schema. Future Active Reporting periods will not require you to drop and create the Reporting Schema in order to finalize the Active Reporting Period. This change does not require an Update to the Reporting Framework. For information on how to drop and create the reporting schema, see chapter "Managing the reporting schema and framework" in the IBM OpenPages GRC Platform Administrator s Guide.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 23 of 33 Task 9: Update Trigger Configuration This step is only needed if you make use of Solutions or custom triggers and did not previously make this change in a 7.1.0.1.x interim fix. Traditionally, trigger execution was performed in a serial fashion due to there being no facility to update objects in bulk in a parallel manner. With the new bulk update functionality of the Grid View, this is no longer the case. If multiple objects are updated, the update occurs in parallel in order to enhance performance. It has been found that there are trigger use cases where these parallel updates can cause inconsistent trigger behavior. For example, if a trigger were designed to: 1. Get a list of all peer objects assigned to it's parent. 2. Update a parent field if all child objects (peers of the object being updated) are in a specific state. In this scenario, the update to the parent might never occur if several of the peers were being updated in parallel, as no peer would see all the other peers in the correct state. For users of Solutions Triggers If you use the Risk Approval Submission Create and/or Risk Approval Submission Update triggers, please perform the following steps: 1. Check out the file _trigger_config_.xml from the OpenPages repository (see Configuring Triggers in the IBM OpenPages GRC Platform Trigger Developer Guide) 2. Open the file in a text editor. 3. Search for the string: trigger name="risk Approval Submission Create" 4. Scroll down until you find the line beginning with: exclusiveoperationby 5. Change the value from: com.openpages.ext.solutions.triggers.riskapprovalsubmissiontriggeraction to: com.openpages.ext.solutions.triggers.riskapprovalexclusiveoperationkey 6. Search for the string : 7. Scroll down until you find the line beginning with: exclusiveoperationby 8. Change the value from: com.openpages.ext.solutions.triggers.riskapprovalsubmissiontriggeraction to: com.openpages.ext.solutions.triggers.riskapprovalexclusiveoperationkey 9. Save the file 10. Check in the file to the OpenPages repository. An example _trigger_config_.xml is included in this kit and it has the above patch applied. For users of Custom Triggers To alleviate parallel execution issue there is a trigger configuration mechanism to force trigger execution to be performed serially. It should be noted that this will slow down bulk updates on objects that have a trigger set to serial execution. Enabling this behavior is done in the trigger configuration file. 1. Check out the file _trigger_config_.xml from the OpenPages repository (see Configuring Triggers in the IBM OpenPages GRC Platform Trigger Developer Guide) 2. Locate the definition of the trigger you would like to force to run serially. 3. Locate the <action type> tag. 4. Add a new attribute to this tag: exclusiveoperationby="uniquekeystring" The value uniquekeystring can be any string that uniquely identifies a key (or queue) for trigger serialization. Typically, each trigger will receive their own key. If two triggers might adversely interact if run in parallel, they can use the same exclusiveoperationby key to make both triggers run serially in the same queue. A suggested key format is to use the name of the trigger class. For example, if a trigger

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 24 of 33 class was called com.mycompany.mytriggerclass, the key name could be com.mycompany.mytriggerclasskey. 5. Repeat as needed for other triggers. 6. Save the file. 7. Check the file back into the OpenPages repository.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 25 of 33 Uninstalling This Patch Uninstalling the 7.1.0.4 patch will revert the system to the previous 7.1 version, including the data in the database. To uninstall the IBM OpenPages GRC Platform 7.1.0.4 patch perform the following tasks. Task 1: Stop all Servers Stop all servers including the following: OpenPages application and workflow servers IBM Cognos servers OpenPages Framework Model Generator servers Note: For details on stopping services, see the Starting and stopping servers chapter in the IBM OpenPages GRC Platform Administrator s Guide. Task 2: Run Patch Uninstaller Run the following steps on all application servers, admin application server first, then nonadmin application servers. Steps: 1. Log on to the admin server as a user with administrative privileges and full access to the local server drives. For Unix, use non-root user, such as the user you created for the IBM OpenPages GRC Platform installation, for example opuser. 2. Navigate to the <OP_Home> patch uninstallation directory. Where: <OP_Home> represents the installation location of the OpenPages application, by default: Windows AIX or Linux C:\OpenPages\Patch\V7104\Uninstall_OpenPages_Patch /opt/openpages/patch/v7104/uninstall_openpages_patch 3. Run Patch Uninstaller a. OpenPagesPatchUninstall.exe for Windows b. OpenPagesPatchUninstall.bin for Unix Task 3: Restore the Database Oracle Databases Run the OpenPages restore (OPRestore) utility on each application server. Run the CommandCenter restore (OPCCRestore) utility on each reporting server to restore the database to the previous IBM OpenPages GRC Platform version. Note: For details on using the restore utilities, see the The OpenPages GRC Platform restore utility on the Oracle database chapter and the Using the Cognos restore utility chapter in the IBM OpenPages GRC Platform Administrator s Guide. DB2 Databases Run the OpenPages restore (OPRestore) utility along with DB2 database restore tools on each application server. Run the Command Center restore (OPCCRestore) utility together with the DB2 database restore tools to restore the database to the previous IBM OpenPages Platform version.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 26 of 33 Note: For details on using the restore utilities, see the The OpenPages GRC Platform restore utility on the DB2 database chapter and the Using the Cognos restore utility chapter in the IBM OpenPages GRC Platform Administrator s Guide. Task 4: Start all Servers Start all servers including the following: OpenPages application and workflow servers IBM Cognos servers OpenPages Framework Model Generator servers Note: For details on starting services, see the Starting and stopping servers chapter in the IBM OpenPages GRC Platform Administrator s Guide. Task 5: Restore X-Powered-By header [not recommended] This is an optional task that will decrease the security of your application server by restoring the X-Powered-By header from response sent from the server to the client. Attackers could use this header to learn which application server you are using and launch targeted attacks for that platform. 1. In the WebSphere administrative console click Servers > Server Types > WebSphere application servers > server_name > Web Container Settings > Web container. 2. Under Additional Properties select Custom Properties. 3. On the Custom Properties page, click New. 4. On the settings page, enter the: Name: com.ibm.ws.webcontainer.disablexpoweredby Value: false 5. Click Apply or OK. 6. Click Save on the console task bar to save your configuration changes. 7. Do the same steps on all the Nodes 8. Restart the server.

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 27 of 33 Documentation Updates You can download the latest revision to the IBM OpenPages GRC Platform 7.1 documentation set from the IBM information server at: http://www.ibm.com/support/docview.wss?uid=swg27042264 Or you can use the IBM OpenPages GRC Platform 7.1 Knowledge Center at OpenPages GRC Platform 7.1.0 Documentation

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 28 of 33 Appendix A Silent Patch Installation and Uninstallation Silent Patch Installation: The process for using Silent Install requires all of the Backing up and Database steps that are required for the interactive patch install. The procedure below assumes that all of the steps described in these sections have completed successfully: Before you Begin, Backing up the Existing IBM OpenPages GRC Platform Environment, Backup Solutions Helper and Dojo Toolkits Patch Installation Task 1: Use Scripts to update the Database Server Patch Installation Task 2: Verify that Servers are Running Task 1: Update Silent Installer Properties 1. Log on to the server where you will perform the patch as a user with administrative privileges and full access to the local server drives. Note: For Unix installs, log in as a non-root user, such as the user you created for the reporting server installation, for example: opuser. 2. From the IBM OpenPages GRC Platform Patch Installer 7.1.0.4 installation kit, copy the entire OP_7.1.0.4_Installer\IBM OpenPages GRC Platform Patch Installer directory to the application server. 3. Navigate to the IBM OpenPages GRC Platform Patch Installer directory you just copied. 4. Navigate to the patch installer in the IBM OpenPages GRC Platform Patch Installer directory: OP_7.1.0.4_Installer\silent-install 5. Update Silent Installer properties file. Note: On Windows environments, paths must be entered with double slashes. For example: c:\\openpages Edit op-silentinstaller-patch-was.properties file with the right values and copy it to: AIX or Linux: Disk1\InstData\[Linux64 AIX64]\VM Windows: Disk1\InstData\WIN64\NoVM

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 29 of 33 Task 2: Run Patch Installer Silently Silently Launch the OpenPagesPatchSetup installer program to run the patch installation. Notes If this is a horizontal clustered environment, the patch installer must be installed on the administrative server first, and then on all non-administrative servers. You must use the patch installer program to update the OpenPages application, workflow, and reporting servers. Steps: 1. Open a Command Prompt window (using the Run as Administrator option) or Unix shell, and do the following: Navigate to the IBM OpenPages GRC Platform Patch Installer directory you just copied. Navigate to the patch installer in the IBM OpenPages GRC Platform Patch Installer directory: AIX or Linux: Disk1\InstData\[Linux64 AIX64]\VM Windows: Disk1\InstData\WIN64\NoVM Launch the IBM OpenPages GRC Platform patch installer program silently as follows: For IBM WebSphere Windows OpenPagesPatchSetup.exe -i silent -f op-silentinstaller-patch- WAS.properties AIX/Linux OpenPagesPatchSetup.bin -i silent -f op-silentinstaller-patch- WAS.properties 1. Stop all servers including the following: OpenPages application and workflow servers IBM Cognos servers OpenPages Framework Model Generator servers Note: For details on stopping services, see the Starting and stopping servers chapter in the IBM OpenPages GRC Platform Administrator s Guide 1. Perform the following Post Installation tasks as described in Post-Installation Task 1: Apply the Modules Patch Post-Installation Task 2: Restore Solutions Helpers and Dojo Toolkits Optionally, perform these tasks Post-Installation Task 3: Enable Workflow Resubmission on Error Post-Installation Task 4: Remove X-Powered-By Header

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 30 of 33 Task 3: Start Servers This task applies in all patch scenarios. Note: For details on starting and stopping servers, see the Starting and stopping servers chapter in the IBM OpenPages GRC Platform Administrator s Guide. Steps: 1. Start all application and workflow servers using the StartAllServers script. 2. Start the reporting server (including the CommandCenter and OpenPages Framework Model Generator services). Task 4: Complete Installation Complete the tasks Locating Patch Installation Log Files from the interactive installation tasks. Silent Patch Uninstallation: If you have run the Patch Installer silently, then the Uninstaller will automatically run silently. Follow all the instructions under Uninstalling this Patch

IBM OpenPages GRC Platform 7.1 FP4 ReadMe 31 of 33 Notices This information was developed for products and services offered worldwide. This material may be available from IBM in other languages. However, you may be required to own a copy of the product or product version in that language in order to access it. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. This document may describe products, services, or features that are not included in the Program or license entitlement that you have purchased. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan Ltd. 19-21, Nihonbashi-Hakozakicho, Chuo-ku Tokyo 103-8510, Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation Location Code FT0 550 King Street