CA Identity Manager -...

142
版本说明 r12.5 SP1 CA Identity Manager

Transcript of CA Identity Manager -...

Page 1: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

版本说明

r12.5 SP1

CA Identity Manager

Page 2: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,CA 有权随时修改或撤销本文档。

未经 CA 事先书面许可,不得擅自复制、转让、翻印、透露、修改或转录本文档的全部或部分内容。本文档属于 CA 的保密和专

有信息,除非在与 CA 的单独保密协议中得到许可,否则不得透露或使用本文档。

尽管有上述规定,如果用户为本文档中所指的软件产品的经授权许可的用户,那么仍可打印合理数量的本文档副本供用户及与该

软件有关的用户雇员内部使用,但所有 CA 版权声明和标识必须附在每一份副本上。

打印本文档副本的权利仅限于本软件适用的许可协议的有效期内。如果该许可因任何原因终止,用户应负责向 CA 书面证明已将

本文档的所有完整和不完整的副本退回 CA 或销毁。

在所适用的法律允许的范围内,CA 按照“现状”提供本文档,不附带任何保证,包括但不限于商品适销性、适用于特定目的或不

侵权的默示保证。CA 在任何情况下对最终用户或其他第三方由于使用本文档所造成的直接或间接的损失或损害都不负任何责任,

包括但不限于利润损失、投资受损、业务中断、信誉损失或数据丢失,即使 CA 已经被提前明确告知这种损失或损害的可能性。

本文档中涉及的任何软件产品的使用均应遵照有关许可协议的规定且根据本声明中的条款不得以任何方式修改此许可协议。

本文档由 CA 制作。

本文档仅提供“有限权利”。美国政府使用、复制或透露本产品受 FAR Sections 12.212、52.227-14 和 52.227-19(c)(1)

- (2) 以及 DFARS Section 252.227-7014(b)(3) 的相关条款或其后续条款的限制。

版权所有 © 2010 CA。保留所有权利。此处涉及的所有商标、商品名称、服务标识和徽标均归其各自公司所有。

Page 3: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

CA 产品引用

本文档参考以下 CA 产品:

CA Identity Manager

CA SiteMinder® Web Access Manager

CA Directory

CA Enterprise Log Manager

CA Role & Compliance Manager (CA RCM)

联系技术支持

要获取在线技术帮助以及办公地址、主要服务时间和电话号码的完整列表,请

联系技术支持:http://www.ca.com/worldwide。

Page 4: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。
Page 5: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

目录 v

目录

第 1 章: CA Identity Manager r12.5 SP1 中的新功能 9

支持的平台和版本 ............................................................................... 9

Policy Xpress .................................................................................. 9

从 Option Pack 1 开始对 Policy Xpress 插件的更改 ........................................... 10

端点帐户的反向同步 ............................................................................ 10

批量任务 ...................................................................................... 11

电子邮件通知策略 .............................................................................. 11

预防性身份策略 ................................................................................ 12

工作流增强功能 ................................................................................ 12

全局事件级别基于策略的工作流映射............................................................ 13

任务级别的基于策略工作流 ................................................................... 13

升级批准模板 .............................................................................. 14

匹配属性确定程序........................................................................... 14

在批准屏幕中突出显示更改的属性 ............................................................. 15

部分属性级别的批准/拒绝 .................................................................... 15

批准策略说明 .............................................................................. 16

针对工作项的批量操作 ....................................................................... 16

Smart Provisioning 增强 ....................................................................... 16

在 Identity Manager 用户会话中更改语言......................................................... 17

第 2 章: CA Identity Manager r12.5 中的新功能 19

CA Role & Compliance Manager 集成 ........................................................... 19

Smart Provisioning ........................................................................ 20

Identity Manager 连接器 - 支持的端点 ....................................................... 21

Identity Manager 连接器 - 更新限制 ......................................................... 22

CA Enterprise Log Manager 集成 ............................................................... 23

CA Enterprise Log Manager 报告 ........................................................... 23

Identity Manager 目录配置向导 ................................................................. 24

帐户管理功能增强 .............................................................................. 24

需要配给管理器的端点类型 ....................................................................... 24

安装和升级功能增强 ............................................................................ 25

自动化的任务持久性无用单元收集和存档............................................................ 25

任务持久性迁移工具 ............................................................................ 26

Connector Xpress 增强 ........................................................................ 26

批加载程序允许多个操作 ......................................................................... 27

角色和任务导入功能增强 ......................................................................... 27

报告数据源 .................................................................................... 28

新的默认报告 .................................................................................. 28

工作流增强功能 ................................................................................ 29

WorkPoint 3.4.2 支持 ...................................................................... 29

Page 6: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

vi 版本说明

基于策略的工作流........................................................................... 29

工作流作业视图 ............................................................................ 30

“查看提交的任务”功能增强 ..................................................................... 31

配置文件屏幕增强 .............................................................................. 31

确认字段 .................................................................................. 31

动态字段显示 .............................................................................. 32

新对象选择器字段样式 ....................................................................... 32

对 Microsoft Visual Studio 2008 的支持 ......................................................... 32

身份策略功能增强 .............................................................................. 32

配给角色所有者任务 ............................................................................ 33

第 3 章: CA Identity Manager r12.5 SP1 中现有功能的更改 35

包括在角色定义文件中的其他对象 ................................................................. 35

现在在安装过程中部署本地化文件 ................................................................. 35

增强的工作项指派 .............................................................................. 35

增强的动态确定程序 ............................................................................ 36

新任务重现模型 ................................................................................ 36

第 4 章: CA Identity Manager r12.5 中现有功能的变化 37

快照数据库性能提高 ............................................................................ 37

快照参数 XML 文件增强 ........................................................................ 37

连接管理 ...................................................................................... 38

环境导出包括其他对象........................................................................... 38

CA Identity Manager 累积版本 (CR) 中的修补程序和增强 .......................................... 38

Active Directory 连接器现在支持 Win2003 R2 UNIX 属性 .......................................... 38

端点类型属性映射文件移动 ....................................................................... 39

默认 CleverPath 报告模板被删除 ................................................................ 39

已弃用的配给 SDK 和实用程序 ................................................................... 39

不再支持 iRecorder ............................................................................ 40

Web 服务对于新环境中的所有任务均为禁用状态 ..................................................... 41

第 5 章: 安装注意事项 43

支持的升级路径 ................................................................................ 43

将 ADAM 2008 作为用户存储 ................................................................... 43

JBoss Enterprise Application Platform 4.2 上的其他安装步骤....................................... 44

要求 Solaris 修补程序 .......................................................................... 44

Solaris 最低内核参数 ........................................................................... 44

非 ASCII 字符会导致非英语系统上的安装失败 ...................................................... 45

IPv6 支持 .................................................................................... 45

IPv6 JDK 要求 ............................................................................ 45

IPv6 配置注意事项 ......................................................................... 46

Windows 2008 上带有纯 IPv6 的配给目录不受支持 ................................................ 46

Linux 上的配给目录安装 ........................................................................ 47

使用 WebLogic 时 Identity Manager EAR 不自动部署 ............................................. 47

Page 7: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

目录 vii

防火墙阻止 Windows 2008 SP2 部署中与 Identity Manager 组件的通信 ............................. 47

Linux 64 位上的 CA Identity Manager 与 SiteMinder 连接错误 .................................... 48

第 6 章: 已知问题 49

常规.......................................................................................... 49

数据库未启动时 Identity Manager 以失败状态启动 ............................................. 49

搜索大用户存储时,可能发生“内存不够”错误 .................................................. 49

批加载程序工作流限制 ....................................................................... 49

创建带有配给的环境之后重新启动 CA Identity Manager ......................................... 50

JBoss 上的良性 JSF RI 错误 ................................................................ 50

CA Identity Manager 连接器需要连接器配置更改 ............................................... 51

配给角色名称更改不会在 CA RCM 中动态更新 .................................................. 51

在特定部署中创建新环境时的“未找到”错误 .................................................... 52

CA RCM 日志中的良性错误 .................................................................. 52

在 Identity Manager 中修改单值复合属性 ..................................................... 53

Linux 系统的 WebSphere 中的工作流启动问题 ................................................ 53

在工作流批准屏幕上突出显示为已更改的属性 .................................................... 53

建议在导入角色定义文件时其他选项卡存在于环境中时出错 ......................................... 54

升级.......................................................................................... 54

将群集从 CA Identity Manager r12 CR6 或更高版本进行升级时的问题 ............................ 54

升级之后重新映射 DYN 端点属性 ............................................................. 55

CA Directory 升级消息问题 ................................................................. 55

基于 WebLogic 9.2.1 升级时的错误 .......................................................... 55

环境迁移错误 .............................................................................. 56

升级 CA Directory 之前必要的修复 ........................................................... 56

用于 z/OS 连接器的升级后步骤 .............................................................. 57

如果 Identity Manager 用户存储无法联系,环境迁移则失败 ...................................... 58

(仅 WebLogic)更新选项包路径 ............................................................. 58

升级之后重新应用 WorkPoint 文件修改........................................................ 58

没有浏览和关联任务的搜索屏幕 ............................................................... 59

报告.......................................................................................... 59

用户帐户报告生成失败 ....................................................................... 59

使用 ExportAll.xml 捕获快照数据时出错 ...................................................... 60

捕获快照数据任务在完成时也显示为正在进行 .................................................... 60

报告限制 .................................................................................. 60

在 XML 文件中,Satisfy=All 运行不正常 ...................................................... 60

查看报告时会重定向到 Infoview 登录页 ....................................................... 60

为“查看我的报告”任务启用第三方 Cookie .................................................... 61

如果存在的记录多于 20,000 个,生成用户帐户则失败 ........................................... 61

对于 WebSphere,非快照报告需要日期选取器 .................................................. 62

配给.......................................................................................... 62

常规 ...................................................................................... 62

端点类型 .................................................................................. 66

Page 8: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

viii 版本说明

第 7 章: 已修复问题 83

第 8 章: 文档 85

总目录 ........................................................................................ 86

在线帮助功能增强 .............................................................................. 86

eTrust 到 CA 的品牌重塑 ....................................................................... 87

术语更改 ...................................................................................... 87

文档更改 ...................................................................................... 88

附录 A: 第三方声明 89

Apache ...................................................................................... 89

ANTLR 2.7.5H# ............................................................................... 96

ASM 3 ....................................................................................... 97

DOM4J ....................................................................................... 97

HSQLDB 1.7.3 ................................................................................ 99

HSQLDB 1.8.0 ............................................................................... 101

IBM DB2 Driver for JDBC and SQLJ ........................................................... 102

Jaxen 1.3 ................................................................................... 102

JDOM 1.11 .................................................................................. 104

JSON 1.0.................................................................................... 105

jtopen 5.1.1 ................................................................................. 105

libcurl 7.15.0 ................................................................................ 106

MX4J 3.0.2 .................................................................................. 107

Oracle JDBC Driver 10g Release 2 ............................................................ 109

Rhino 1.5R5 ................................................................................. 110

Rhino 1.7R1 ................................................................................. 119

SAAJ 1.2 .................................................................................... 131

SAXPath 1.1................................................................................. 132

SpiderMonkey 1.5 ........................................................................... 133

Sun JDK 1.6.0 ............................................................................... 134

Xinha .96 Beta 2 ............................................................................ 142

Page 9: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

第 1 章: CA Identity Manager r12.5 SP1 中的新功能 9

第 1 章: CA Identity Manager r12.5

SP1 中的新功能

此部分包含以下主题:

支持的平台和版本 (p. 9)

Policy Xpress (p. 9)

端点帐户的反向同步 (p. 10)

批量任务 (p. 11)

电子邮件通知策略 (p. 11)

预防性身份策略 (p. 12)

工作流增强功能 (p. 12)

Smart Provisioning 增强 (p. 16)

在 Identity Manager 用户会话中更改语言 (p. 17)

支持的平台和版本

在 CA Identity Manager r12.5 SP1 中,对支持的应用程序服务器版本、目

录和数据库进行了一些更改。

注意:有关支持平台和版本的完整列表,请参阅 CA 支持站点中的 CA

Identity Manager 支持表。

Policy Xpress

通过 Policy Xpress 您可以创建复杂的业务逻辑(策略),无需开发自定义代

码。Policy Xpress 任务位于“策略”选项卡下,在默认情况下,与 Policy

Xpress 管理者角色和系统管理者角色相关联。

先前,Policy Xpress 是 Option Pack 1 的一部分。在该版本中,Policy

Xpress 已并入到核心 CA Identity Manager 产品并可以从“策略”选项卡

下访问。

此外,请注意以下该版本中对 Policy Xpress 的改进与提高:

使用范围规则搜索策略。

策略具有已提交任务和反向侦听程序。

创建、修改、查看和删除策略在“查看提交的任务”中作为事件被捕获。可

以在发生错误时重新提交这些事件。此外,您可以为这些事件配置工作流。

Policy Xpress 审核“查看提交的任务”中的所有活动,包括评估的策

略、执行的操作以及故障。

几个对插件所做的可用性改进。

Page 10: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

端点帐户的反向同步

10 版本说明

策略可以在提交任务之前验证数据。

在策略生成错误时,细化行为控制。

注意:有关 Policy Xpress 的详细信息,请参阅《Administration Guide》

(《管理指南》)。

从 Option Pack 1 开始对 Policy Xpress 插件的更改

CA Identity Manager r12.5 SP1 实施下列的 Policy Xpress 插件更改:

数据元素

已经更改帐户属性 - 已删除

端点对象 - 已删除

帐户值和帐户值 (按标识符) - 已移到“帐户”类别

比较器,比较字符串 - 添加了区分大小写选项

比较器,比较日期 - 添加了日期格式参数

日期 - 添加了日期格式参数

时间 - 添加了时间格式参数

列表筛选 - 添加了列表大小功能

工作流 - 现在可以返回全名、用户名或电子邮件地址

操作

设置帐户数据和按标识符设置帐户数据 - 已移到“帐户”类别

添加了“移动帐户”操作

端点帐户的反向同步

端点系统用户可以在端点上创建、删除或修改帐户。 例如,用户使用外部工具

可以在 Active Directory 域中创建或修改帐户。CA Identity Manager 必

须注意到这种潜在的安全问题。 在端点上直接创建或修改帐户会绕过 CA

Identity Manager 的批准流程和审核。

通过识别 Identity Manager 帐户和端点帐户之间的区别,反向同步可以帮助

确保对端点帐户的控制。您创建反向同步策略来处理更改。然后,使用“浏览

和关联”更新 CA Identity Manager 来触发执行策略。

先前,反向同步是 Option Pack 1 的一部分。在该版本中,反向同步并入到

核心 CA Identity Manager 产品并可以在用户控制台的“端点”选项卡上访

问。

注意:有关反向同步的详细信息,请参阅《Administration Guide》(《管理

指南》)中的“Managed Endpoint Accounts”(管理端点帐户)一章。

Page 11: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

批量任务

第 1 章: CA Identity Manager r12.5 SP1 中的新功能 11

批量任务

通过批量任务(Option Pack 1 中的排定任务)CA Identity Manager 用户

可以执行以下操作:

修改用户对象,基于属性筛选,如部门、城市、终止日期等等。

周期性运行特定对象中的任务,如每个星期六。

产生批量用户更改,如修改选定部门内的所有用户。

该功能不同于 CA Identity Manager 中通过提供群体筛选的排定任务功能。

与排定任务不同,在配置批量任务时,受批量任务影响的对象群体为未知。此

外,批量任务影响许多对象,而排定任务仅影响一个对象。

注意:有关批量任务的详细信息,请参阅《Administration Guide》(《管理

指南》)。

电子邮件通知策略

电子邮件通知会通知系统中任务和事件的 CA Identity Manager 用户。例如,

CA Identity Manager 在事件或任务需要批准时,可以给批准人发送邮件。

CA Identity Manager r12.5 SP1 为创建电子邮件通知提供两种方式:

电子邮件模板(现有的功能)

管理员使用安装有 CA Identity Manager 的默认模板来创建电子邮件通

知。要自定义那些模板,管理员使用电子邮件模板 API。

电子邮件通知策略(新的功能)

CA Identity Manager r12.5 SP1 包括其他的方式,允许企业用户通过

使用管理控制台中的电子邮件管理任务创建、查看、修改和删除电子邮件通

知。这些用户不需要知道任何配置电子邮件通知的代码。

管理员可以定义电子邮件的内容、何时发送、何人接收。电子邮件的内容可

以包含动态信息,如当前日期或事件信息,在发送电子邮件时,CA Identity

Manager 将进行填充。例如,您可以配置在创建新用户时发送给批准人的

电子邮件通知。电子邮件可以包含登录信息、雇用日期以及管理者。

然而,电子邮件通知策略是 Policy Xpress 策略,使用用户控制台中的单

独一套任务来创建和管理这些电子邮件通知策略。

注意:有关电子邮件模板策略的详细信息,请参阅《Administration

Guide》(《管理指南》)。

Page 12: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

预防性身份策略

12 版本说明

预防性身份策略

预防性身份策略是一种身份策略,它会阻止用户接收可能会导致利益冲突或欺

骗的权限。这些策略支持公司的职责隔离 (SOD) 要求。

通过在提交任务之前执行的这些预防性身份策略,管理员可以在分配权限或更

改配置文件属性之前检查策略违规。如果违规存在,在提交任务之前,管理员

可以清除违规。

例如,公司可以创建一个预防性身份策略,来阻止具有用户经理角色的用户同

时具有用户批准人角色。如果管理员使用修改用户任务为用户管理者提供用户

批准人角色,CA Identity Manager 则会显示一条关于违规的消息。管理员

可以更改角色分配以便在提交任务之前清除该违规。

预防性身份策略也可以触发工作流流程,这个流程是:在 CA Identity

Manager 执行任务之前,需要获得指定批准人的批准。

注意:有关预防性身份策略的详细信息,请参阅《Administration Guide》(《管

理指南》)。

工作流增强功能

在此版本中,对工作流进行了以下几项新增强:

全局事件级别基于策略的工作流映射 (p. 13)

任务级别的基于策略工作流 (p. 13)

升级批准模板 (p. 14)

匹配属性确定程序 (p. 14)

在批准屏幕中突出显示更改的属性 (p. 15)

部分属性级别的批准/拒绝 (p. 15)

批准策略说明 (p. 16)

针对工作项的批量操作 (p. 16)

Page 13: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

工作流增强功能

第 1 章: CA Identity Manager r12.5 SP1 中的新功能 13

全局事件级别基于策略的工作流映射

事件可以被映射到管理控制台的工作流流程,或与特定任务中的基于策略的工

作流批准策略关联。通过新的“为事件配置基于全局策略的工作流”任务,管

理员可以在环境级别为事件设置基于策略的工作流映射。不同于为管理任务中

的事件设置基于策略工作流,所配置的基于策略工作流映射应用于生成该事件

的所有任务。

注意:只有在启用工作流时,“为事件配置全局基于策略工作流”任务才可用。

在禁用工作流时执行该任务会抛出错误。

此新任务已经被添加到“系统”选项卡。提交任务时,会以下列方式检索该任

务中每个事件的工作流流程:

为该管理任务的事件配置的任何工作流具有优先权。针对基于策略或不基于策

略的工作流可以配置事件。如果针对该管理任务的事件配置了基于策略的工作

流,那么会调用与该策略关联的工作流流程。如果没有规则匹配,则该事件不

调用工作流。同样,如果针对该管理任务的事件配置了不基于策略的工作流,

那么会调用与该策略关联的工作流流程。如果针对该管理任务的事件没有配置

工作流,那么该事件的全局工作流配置具有优先权。

任务级别的基于策略工作流

通过任务级别的基于策略工作流,您可以将任务与基于规则评估的工作流流程

相关联。这意味着,与任务总是启动工作流流程不同,仅当与该任务相关联的

规则为真时,工作流流程才会运行并生成工作项。

例如,创建新组时,您可以定义一个规则,规定:仅当新组是指定父组织的一

部分时才将创建组任务置于工作流控制之下并且创建工作项。如果新组不属于

该组织,工作流流程则不会运行,也不会创建任何工作项。

如果任务有多个规则,则针对要批准的任务,需要批准与该任务关联的所有工

作流流程。与之相似,如果与该任务相关联的某一个工作流流程被拒绝,则该

任务本身也会遭到拒绝。工作流规则可以被赋予优先级值,以便确定规则评估

和工作流执行的顺序。

针对任务级别的基于策略工作流,仅默认的 CA Identity Manager 工作流模

板支持工作流规则。另外,还可以创建自定义工作流流程以便与工作流规则一

起使用。

注意:有关基于策略工作流的详细信息,请参阅《Administration Guide》(《管

理指南》)中的“Workflow”(工作流)一章。

Page 14: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

工作流增强功能

14 版本说明

升级批准模板

已经添加了新的流程模板,包括从主要批准人到升级批准人的同步转换批准节

点。如果找不到主要参与人,则该用户可以批准或拒绝该请求。

注意:有关升级批准模板的详细信息,请参阅《Administration Guide》(《管

理指南》)中的“Workflow”(工作流)一章。

匹配属性确定程序

该确定程序仅针对“用户”类型的对象。来自任何可用对象的值与用户对象中

的字段匹配。使用以下选项设置匹配属性规则的限制:

批准人

指定批准该任务的用户类型。

用户或对象

指定可以从中找到批准人的用户或对象。

与事件关联的对象 - 工作流控制下的事件。

该任务的启动人 - 启动管理任务的用户。

该任务的主要对象 - 由任务正在创建/修改的对象(仅可用于任务级别

的事件映射)。

该任务的先前批准人 - 该任务以前的批准人。

Page 15: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

工作流增强功能

第 1 章: CA Identity Manager r12.5 SP1 中的新功能 15

使用或对象属性

指定包含批准人的属性。

批准人搜索属性

指定在搜索中用于匹配以上识别的值的属性。

在批准屏幕中突出显示更改的属性

为了让批准人了解已经修改哪些属性或让批准人在必要时撤销对那些属性的更

改,已经在批准人配置文件屏幕中添加了撤销图标,通过它批准人可以了解已

经更改了该属性。

批准人可以通过单击撤销按钮查看可编辑属性的原始值,也可以将属性值更改

为任何其他值。

部分属性级别的批准/拒绝

批准人可以选择部分批准或拒绝批准配置文件屏幕上的属性更改。如果批准人

决定拒绝对批准屏幕上 可见 属性所做的更改,那么批准人可以单击拒绝按钮,

且只将那些属性恢复到其原始值。在先前版本中,如果批准人单击拒绝按钮,

则会拒绝整个事件。同样,如果批准人单击批准按钮,仅批准对批准屏幕上可

见属性所做的更改。

注意:这仅适用于带有 OnChange 评估类型的批准策略的事件级别的基于策

略工作流。有关该功能的详细信息,请参阅《Administration Guide》(《管

理指南》)中的“Policy-Based Workflow”(基于策略工作流)一节。

Page 16: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Smart Provisioning 增强

16 版本说明

批准策略说明

对于批准策略管理的对象,增加了一个非强制性的、不可搜索的字符串说明属

性,并且将出现在生成的工作项中。

默认值:255 个字符

您可以使用以下格式输入 bundle、key 的信息进行说明:

$ (bundle=<fully qualified resource bundles name> : key=<key>)

注意:如果批准策略说明超过 255 个字符,则会显示错误消息。

要使用该新功能,必须使用脚本对对象数据存储进行手动升级。

针对工作项的批量操作

对于该版本的 CA Identity Manager,可以针对选定的工作项执行下列批量

操作:

批准

拒绝

保留

释放

在用户控制台中, “配置工作列表”选项卡得以增强,现在包括一个新的支持

批量工作流操作复选框。如果启用该复选框,用户则可以批量批准、拒绝、释

放和保留他们拥有的工作项,或“查看我的工作列表”屏幕中指派人的工作项。

然而,管理员只能代表管理用户工作项屏幕上的现有用户执行批量保留或释放。

Smart Provisioning 增强

建议角色功能现在可用于创建用户任务以及修改用户任务(CA Identity

Manager r12.5 中已支持)。

CA Identity Manager 与 CA Role and Compliance Manager (CA RCM)

集成时,建议角色功能向管理员提供可适于分配给用户的配给角色列表。配给

角色列表是 CA RCM 根据管理员输入的条件确定的。

建议配给角色有助于确保用户具有正确的权限,同时能够保持公司的角色模型。

注意:有关建议角色的详细信息,请参阅《Administration Guide》(《管理

指南》)。

Page 17: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

在 Identity Manager 用户会话中更改语言

第 1 章: CA Identity Manager r12.5 SP1 中的新功能 17

在 Identity Manager 用户会话中更改语言

CA Identity Manager r12.5 SP1 包括新的功能,在环境支持多种语言时,

允许用户更改显示在登录屏幕和用户控制台中的语言。

用户可以在登录屏幕和用户控制台的“选择语言”字段中选择要查看的语言。

用户不需要为了使显示的更改生效而注销环境。

注意:有关更改语言的详细信息,请参阅《User Console Design Guide》(《用

户控制台设计指南》)。

Page 18: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。
Page 19: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

第 2 章: CA Identity Manager r12.5 中的新功能 19

第 2 章: CA Identity Manager r12.5 中

的新功能

此部分包含以下主题:

CA Role & Compliance Manager 集成 (p. 19)

CA Enterprise Log Manager 集成 (p. 23)

Identity Manager 目录配置向导 (p. 24)

帐户管理功能增强 (p. 24)

需要配给管理器的端点类型 (p. 24)

安装和升级功能增强 (p. 25)

自动化的任务持久性无用单元收集和存档 (p. 25)

任务持久性迁移工具 (p. 26)

Connector Xpress 增强 (p. 26)

批加载程序允许多个操作 (p. 27)

角色和任务导入功能增强 (p. 27)

报告数据源 (p. 28)

新的默认报告 (p. 28)

工作流增强功能 (p. 29)

“查看提交的任务”功能增强 (p. 31)

配置文件屏幕增强 (p. 31)

对 Microsoft Visual Studio 2008 的支持 (p. 32)

身份策略功能增强 (p. 32)

配给角色所有者任务 (p. 33)

CA Role & Compliance Manager 集成

CA Role & Compliance Manager (CA RCM) 是一个身份生命周期管理产

品,使用该产品可以快速准确地开发、维护和分析角色模型。该产品还提供了

集中式的身份遵从策略控制,并对与符合遵从性和安全需求有关的过程进行了

自动化。使用 CA RCM,可执行以下操作:

验证用户是否具有适当授权

确保授予的权限符合安全策略

监控身份管理控制的效率

了解组织中存在哪些角色,然后建立适合您的组织的角色模型

随着业务的不断发展分析和维护该角色模型

Page 20: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

CA Role & Compliance Manager 集成

20 版本说明

CA Identity Manager 与 CA RCM 以两种方式进行集成:

CA Identity Manager 连接器

CA Identity Manager 连接器对 CA Identity Manager 和 CA RCM

之间的基于角色的权限数据进行同步。通过使用该连接器,可以将数据从

CA Identity Manager 导入 CA RCM,或将数据从 CA RCM 导出到 CA

Identity Manager。

注意:注意: 有关 CA Identity Manager 连接器的详细信息 ,请参阅《CA

RCM Connector for CA Identity Manager Guide》。

Smart Provisioning

将 CA Identity Manager 与 CA RCM 集成后,还可以配置其他功能,

从而使您能够使用角色和遵从性信息(位于角色模型中)来支持身份管理日

常操作。在 CA Identity Manager 所作的更改会动态更新 CA RCM 中

的角色模型。

Smart Provisioning

Smart Provisioning 是一个功能集,它简化了 CA Identity Manager 与

CA RCM 集成后的配给角色分配。功能包括:

建议配给角色

CA Identity Manager 可向管理员提供一个适合分配给用户的配给角色

列表。配给角色列表是 CA RCM 根据管理员输入的条件确定的。

建议配给角色将确保用户具有正确的权限,同时能够保持公司的角色模型。

策略验证

CA Identity Manager 管理员可以在提交更改之前根据 CA RCM 中的

角色模型验证提议的更改。提交更改前先进行验证有助于公司维护为其运作

所定义的角色模型。

用户可以验证对配给角色的已建议更改(对其分配或删除)以及用户属性的

更改。

CA Identity Manager 执行两种类型的策略验证:

遵从

根据 CA RCM 角色模型来验证提议更改,看这些更改是否违反 CA

RCM 中明确的、预先定义的业务策略规则。

模式

将已建议更改和 CA RCM 角色模型作比较,以查看这些更改是否有可

能变为“非模式”。CA Identity Manager 也将确保这些更改不会明

显改变该角色模型中已建立的模式。

您可以对 CA Identity Manager 进行配置,使其在用户执行特定任务时

自动执行验证,或者让用户手工启动验证。

一旦 CA RCM 中已建立角色模型(基于 Identity Manager 数据),即可在

Identity Manager 环境中实施 Smart Provisioning。

Page 21: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

CA Role & Compliance Manager 集成

第 2 章: CA Identity Manager r12.5 中的新功能 21

Identity Manager 连接器 - 支持的端点

在该版本中, Identity Manager 连接器支持以下端点。其中某些端点是通过

预定义的端点处理程序实现支持的,就像 CA Identity Manager r12 一样,

而其他端点则使用在该版本中引进的可自定义的基于 xml 的端点处理程序。

端点 支持 资源 备注

Unix (ETC) 可自定义处理程序 UNIXETC 组 无已知限制

Windows

(N16)

可自定义处理程序 NT 组 更新限制

Oracle 数据库

(ORA)

用户软件包,用户角

色,用户过程,以及

管理软件包

导出局限于特定的

端点规则。

OS400 (AS4) 可自定义处理程序 配置文件组和成员

用户必须具有主要

组才能具有常规组。

必须首先配置主要

组,然后才能向用户

添加常规组。与之相

似,请首先删除所有

常规组,然后再删除

主要组。

Microsoft SQL 可自定义处理程序 DBAccess 和服务

器角色

要从帐户模板删除

资源或删除用户,请

首先删除数据库访

问权限。

LDAP

注意:LDAP 不

是配给中所支持

的连接程序类型

可自定义处理程序 组 无已知限制

SAP 预定义处理程序 授权和角色 授权,但用户 - 资

源检索链接操作除

外。

角色,但下列操作之

外:

帐户模板 - 资

源检索链接

用户 - 资源检

索链接

已删除用户 -

资源更新链接

DB2 预定义处理程序 索引,架构,表,表

空间,以及视图

用户-资源链接未导

Page 22: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

CA Role & Compliance Manager 集成

22 版本说明

端点 支持 资源 备注

Active

Directory

(ADS)

可自定义处理程序 Active Directory

CA RCM 帐户模板

处理必须基于 AD

帐户策略或 AD 联

系策略。

连接器仅能轮询和

更新这些策略类型

之一。

帐户模板仅应参考

一个端点。

在数据导出期间,连

接器无法精确解析

审核卡中的一些更

改条目。

配置连接器时,必须

对于导出的每种数

据类型都分配一个

DN 字段。

Identity Manager 连接器 - 更新限制

使用可自定义端点处理程序的端点数据的成功更新需要完全了解目标端点类型

的数据结构、语法和规则。为了避免出现问题,当您配置处理程序和定义数据

映射时必须考虑端点类型规定的数据结构。

当您使用可自定义端点处理程序将更新发送给 CA Identity Manager 时,经

常会出现以下问题:

目标端点限制 - Identity Manager 允许密码保护配置,和端点和端点类

型的其他验证限制。这些限制可能会导致在 Identity Manager 上创建实

体失败。CA RCM 在更新期间不会验证新实体的创建是否成功,CA RCM

连接器可能不会在日志中记录这些活动。

帐户模板 - 下列限制与 CA RCM 和 Identity Manager 如何处理资

源、端点和帐户模板有关:

不要在 CA RCM 中重命名帐户模板。重命名帐户模板时,CA RCM 会

尝试通过删除现有模板并创建新的模板的方式来更新端点。这会意外修

改许多模板属性。

一个端点的资源更改会反映到同类型的所有端点中。例如,如果您删除

了某个帐户模板中的“管理权限”资源,并向某个、特定的 Microsoft

SQL Server 端点发送该模板的更新,则该“管理权限”资源将从具有

该资源的每个 Microsoft SQL Server 端点删除。

CA RCM 不会验证某个 Identity Manager 帐户模板是否可用于某

个目标端点或端点类型。您必须首先确认该帐户模板可用,然后再更新

某个特定类型的端点。

Page 23: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

CA Enterprise Log Manager 集成

第 2 章: CA Identity Manager r12.5 中的新功能 23

默认帐户模板(被 CA RCM 参考为新帐户模板模型的 Identity

Manager 帐户模板)在静态配置文件中指定。CA RCM 不验证该设

置,也不检测该默认帐户模板是否已在 Identity Manager 中被删除

或更改。

错误记录 - 在某些情况下,更新期间的错误不会记录在连接器作业的日志

文件中。

CA Enterprise Log Manager 集成

CA Enterprise Log Manager 使用 CA Common Event Grammar (CEG)

将源自各种系统的事件映射为一个标准格式,并储存所有事件以便进行复查和

分析,即使那些尚未映射的事件也会储存。而且,CA Enterprise Log Manager

向用户提供了大量的解决方案,用于管理和报告收集的数据以及使用可配置数

据库查询和/或报告来搜索各种类型的信息和事件。

CA Enterprise Log Manager 对于非管理系统以及超出 CA Identity

Manager 能力和控制之外的系统提供了更好、更宽和更深的洞察,并且还能让

您深入调查身份。

通过与 CA Identity Manager 进行集成,您可以使用 Identity Manager 用

户控制台查看 CA Enterprise Log Manager 用户控制台中的 CA

Enterprise Log Manager 以身份中心的报告和/或动态查询。在该用户控制

台中,您可以配置查看和修改现有 CA Identity Manager/Enterprise Log

Manager 报告和/或查询的方式,同时还能深入调查某个特定的身份。

CA Enterprise Log Manager 报告

默认情况下 CA Enterprise Log Manager 角色定义附带了以下 CA

Enterprise Log Manager 报告:

任务 调用报告

系统所有事件 (按用户) CA Identity Manager - 按用户 ID

筛选的系统所有事件

帐户管理 (按主机) 帐户管理 (按主机)

帐户创建 (按帐户) 帐户创建 (按帐户)

帐户删除 (按帐户) 帐户删除 (按帐户)

帐户锁定 (按帐户) 帐户锁定 (按帐户)

认证过程活动 (按主机) CA Identity Manager - 过程活动

(按主机)

密码策略修改活动 CA Identity Manager - 策略修改活

Page 24: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Identity Manager 目录配置向导

24 版本说明

Identity Manager 目录配置向导

在该版本中提供了一个新的向导,该向导将引导管理员完成为其 LDAP 用户存

储或配给服务器创建 Identity Manager 目录的过程,并且有助于减少配置错

误。 启动该向导之前,必须首先上载一个 Identity Manager LDAP 目录配

置模板。这些模板预先配置了一些常用属性和必需属性。为您的 LDAP 用户存

储或配给服务器输入连接详细信息之后,可以选择 LDAP 属性、映射常用属性,

以及为这些属性输入元数据。完成属性映射时,单击“完成”即可创建该目录。

帐户管理功能增强

在用户控制台中,您现在可以执行大多数帐户管理任务。例如,您现在可以执

行下列操作:

浏览端点的内容并关联其帐户,您也可以选择要浏览的端点子集。

创建并修改端点,以便可以在帐户模板中使用这些端点

为所有端点创建并修改帐户模板

管理端点上的各个帐户以便对其进行解锁、将其分配给新用户,或执行几项

其他任务。

此外,您现在可以使用管理控制台来定义端点类型。您可以为该端点类型导入

包含屏幕、任务和角色的角色定义文件。您可以定义的端点类型包括在

Connector Xpress 中创建的动态端点类型。

以前这些功能仅在配给管理器中提供。

需要配给管理器的端点类型

您现在可以使用用户控制台来管理大多数端点类型,但下列端点类型仍在配给

管理器中进行管理:

Entrust PKI

CA SSO

CA EEM

Novell Netware

Ingres

NSK Safeguard

Page 25: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

安装和升级功能增强

第 2 章: CA Identity Manager r12.5 中的新功能 25

安装和升级功能增强

我们对 CA Identity Manager r12.5 安装程序进行了以下功能改善:

安装:

– 安装前先决条件检查

– 现在所有连接器都是默认安装的

升级:

– 新的升级向导具有下列功能:

发现已安装的 CA Identity Manager 组件

提供已安装组件的版本信息

指出组件是否是最新的,或是否有可用升级

升级先决条件检查

提供配给组件安装程序的直接启动

通过错误检查验证升级是否成功

– 自动化 CA Directory 升级从 Ingres 技术转移至 DXGrid 技术

– 自动化 Identity Manager 目录和环境迁移

– 自动化任务持久性迁移

– JDBC 驱动程序自动添加

– 自动化 WorkPoint 工作流升级,并且可以选择人工升级(如果有必要)

– 自动化数据源升级

– 新功能和帐户屏幕角色定义文件的自动化导入

自动化的任务持久性无用单元收集和存档

在该版本中,管理员能够使用特定参数对作业进行排定和修改,以便通过“清

除已提交的任务”任务来清除和存档任务持久性数据库中的任务和事件信息,

以及根据需要删除这些周期任务。

在“系统”选项卡中,可以通过选择“清除已提交任务”启动一个向导。然后,

该向导将引导您完成设置和排定作业,以及是否存档数据的过程。必要时,您

还可以通过选择“系统”选项卡中的“删除周期任务”选择删除这些周期作业。

通过对任务进行排定以清理和存档任务数据,可以大大降低性能问题或系统运

行中断的可能性。通过使用存档功能,您可以首先将任务备份到存档数据库中,

然后再将其从运行时数据库删除。如果您需要返回来查看这些删除的任务,请

选择“查看提交的任务” 中的 “搜索存档”复选框,来搜索和查看所有已删

除和存档任务的列表。

Page 26: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

任务持久性迁移工具

26 版本说明

任务持久性迁移工具

对于该版本,增加了一个新的迁移工具,用于将任务持久性数据库从 r8.1 SP2

或 r12 迁移到 r12.5。该命令行工具是 Identity Manager 管理工具的一部

分,位于以下位置:

admin_Tools/tools/tpmigration

admin_tools 的默认位置为:

Windows:<安装路径>/tools

UNIX:<安装路径 2>/tools

Connector Xpress 增强

在 Connector Xpress 中,您现在可以执行以下操作:

使用可多值 JDBC 连接器 - 一个表的多个列中的值可以填充一个属性值,

而不用使用一个列中的值。

使用 JDBC 结构化类和辅助类。

使用一个灵活的新映射过程,其中包括一个类和属性映射树,代替了以前的

连续向导过程。这是您能够根据需要添加和编辑属性。

指定任意两个对象类之间的直接关联

指定对象之间的间接关联。例如,两个对象之间的关联是双向的且包含在一

个第三方实体(如表)中,该实体将保存对象之间的关联链接。

创建方法和脚本样式操作绑定

将操作绑定到其他对象和类组合

将两个或两个以上 opbinding 绑定到同一个计时,即同一个操作用于同样

的目标对象类。例如,您可以对于帐户对象类的 Before Add 操作具有两

个或两个以上的 opbinding。

Page 27: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

批加载程序允许多个操作

第 2 章: CA Identity Manager r12.5 中的新功能 27

批加载程序允许多个操作

CA Identity Manager 中的批加载程序功能现在使您能够为不存在的对象指

定备选操作映射。

以前 CA Identity Manager 允许您选择针对主要对象执行的操作。如果该主

要对象不存在,并且指定的操作是修改或删除,则会出现错误。此外,如果您

对一个已存在于 CA Identity Manager 中的主要对象指定创建操作,也会出

现错误。

在 CA Identity Manager r12.5 中,如果主要对象不存在,您可以选择执行

备选的创建(或自行创建)操作。

角色和任务导入功能增强

管理控制台现在提供了选择一个或多个预定义角色定义文件,以便创建或更新

Identity Manager 环境时从可用文件列表进行导入的功能。这样就大大减少

了设置环境的配置步骤。

Page 28: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

报告数据源

28 版本说明

预定义的角色定义文件会针对 CA Identity Manager 功能创建角色和任务,

其中包括:

Smart Provisioning

Enterprise Log Manager 集成

帐户管理

注意:有关导入角色定义文件的详细信息,请参阅《Configuration Guide》。

报告数据源

在 CA Identity Manager r12.5 中可以为报告指定不同的数据源,而不是快

照数据库。 例如,如果要访问审核信息,现在您可以将审核数据库的连接信息

提供给报告,而报告将从审核数据库中获取其数据。

同样,为数据源指定连接信息(针对报告)已经从管理控制台移至用户控制台

(位于“系统”, “JDBC 连接管理”下)。

注意:有关报告的详细信息,请参阅《Administration Guide》。

新的默认报告

CA Identity Manager 中添加了下列报告:

报告 说明 源

帐户详细信息 显示帐户模板及其关联的配给角色、

端点类型、端点和帐户的列表。

快照数据库

管理 显示管理员及其管理权限的列表。 快照数据库

审核-分配/吊销配给角

显示配给角色事件的列表。 审核数据库

审核-取消配给 显示用户及其被取消配给帐户的列

表。

审核数据库

审核详细信息 显示任何核事件及其相关状态详细

信息。

审核数据库

审核-未决批准任务 显示待批准任务的列表。 审核数据库

审核-重置密码 显示某个特定的时间段已重置的用

户密码的列表。

审核数据库

Page 29: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

工作流增强功能

第 2 章: CA Identity Manager r12.5 中的新功能 29

报告 说明 源

端点详细信息 显示所有端点类型、端点和端点属性

的列表。

快照数据库

工作流增强功能

CA Identity Manager r12.5 包括了对于工作流功能的以下增强。

WorkPoint 3.4.2 支持

CA Identity Manager r12.5 支持 Workpoint 3.4.2。以前的 CA Identity

Manager r12 支持 Workpoint 3.3.2。

基于策略的工作流

通过基于策略的工作流,可以根据规则评估将事件与工作流流程相关联。这意

味着,与之前事件总是启动工作流流程不同,仅当与该事件相关联的规则为真

时,工作流流程才会运行并生成工作项。

例如,创建新组时,您可以定义一个规则,规定:仅当新组属于指定的父组织

时才将 CreateGroupEvent 置于工作流控制之下并且创建工作项。如果新组

不属于该组织,工作流流程则不会运行,也不会创建任何工作项。

如果事件有多个规则,那么与事件关联的所有工作流流程需要为要批准的事件

获取批准。与之相似,如果与该事件相关联的某一个工作流流程被拒绝,则该

事件本身也会遭到拒绝。工作流规则可以被赋予优先级值,以便确定规则评估

和工作流执行的顺序。

所有的默认 Identity Manager 工作流模板和预定义流程都支持工作流规则。

另外,还可以创建自定义工作流流程以便与工作流规则一起使用。

注意:有关基于策略的工作流详细信息,请参阅《Administration Guide》。

Page 30: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

工作流增强功能

30 版本说明

工作流作业视图

在该版本中,您现在可以通过以下内容在用户控制台中查看任务和事件级工作

流的 Workpoint 作业的运行时状态图形表示:

批准任务

查看提交的任务

您还可以查看模板和旧式流程定义。

在新环境中,批准任务默认包括“查看作业”选项卡。只有对于在本版本中创

建的事件或任务,您才能在“查看提交的任务”中查看其作业映像。对于在早

期版本中创建的事件,不能查看其作业映像。

Page 31: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

“查看提交的任务”功能增强

第 2 章: CA Identity Manager r12.5 中的新功能 31

“查看提交的任务”功能增强

“查看提交的任务”选项卡现在将显示由于 Identity Manager 用户控制台发

起的操作而导致的更改相关信息。例如,当管理员在用户控制台中将配给角色

分配给用户时,“查看提交的任务”将显示哪些帐户创建成功、可能已经发生

的任何错误或失败的相关信息。

这些信息出现在“事件详细信息”屏幕的“相关任务”部分中。

下列的示例显示了一个分配用户配给角色事件的事件详细信息屏幕:

注意:有关“查看提交的任务”选项卡的详细信息,请参阅《Administration

Guide》。

配置文件屏幕增强

在 CA Identity Manager r12.5 中,“配置文件”选项卡包括了几个新配置

设置以支持新功能。这些新设置将在以下各部分中进行说明。

确认字段

CA Identity Manager r12.5 现在支持确认字段,您可以使用配置字段来验

证配置文件屏幕上的两个字段值是否匹配。例如,“确认密码”和“确认电子

邮件”就是两个确认屏幕。

注意:有关详细信息,请参阅《User Console Design Guide》。

Page 32: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

对 Microsoft Visual Studio 2008 的支持

32 版本说明

动态字段显示

CA Identity Manager 可以根据配置文件屏幕中其他字段的值,来设置某些

特定的字段显示属性。使用 JavaScript,您可以隐藏和显示某个字段,或者启

用和禁用某个字段。例如,如果“员工类型”设置为“临时”,则可以使用

JavaScript 显示“代理”字段。“如果”员工“类型”为“全职”或“兼职”,

则隐藏“代理”字段。

注意:有关使用该功能的信息,请参见《User Console Design Guide》。

新对象选择器字段样式

CA Identity Manager r12.5 为配置文件屏幕上的字段包括了一个新的对象

选择器样式选项。该选项会显示一个控件,管理员可以使用该控件来搜索并选

择管理对象。该样式通常用于帐户管理屏幕。

注意:有关使用该功能的信息,请参见《User Console Design Guide》。

对 Microsoft Visual Studio 2008 的支持

CA Identity Manager 完全支持 Microsoft Visual Studio 2008 SP1。这

意味着对于针对以前版本的 CA Identity Manager(支持 Microsoft Visual

Studio 2003)编写的所有自定义代码,必须使用 Visual Studio 2008 SP1

重新编译。受影响的自定义代码可能包括以下内容:

C++ 自定义连接器

Java 自定义连接器的配给管理器插件

公共程序出口

Universal Provisioning Option (UPO) 程序出口

Pluggable Authentication Module (PAM) DLL

Universal Feed Option 程序出口

身份策略功能增强

您可以为策略集创建成员规则,以便策略集仅适用于某些用户。在评估集中的

身份策略之前评估该规则,这可以节省不少时间。例如,如果成员规则限制的

身份策略评估为用户的 10%,那么该规则将会节省 90% 的评估时间。

Page 33: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给角色所有者任务

第 2 章: CA Identity Manager r12.5 中的新功能 33

配给角色所有者任务

在用户控制台中,可以使用一个新任务:创建配给角色的所有者策略。您可以

选择一个或多个配给角色,然后分配所有者策略以便控制有权修改角色的用户。

该任务是重置配给角色所有者任务的备选,后者一次只能针对一个角色使用。

Page 34: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。
Page 35: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

第 3 章: CA Identity Manager r12.5 SP1 中现有功能的更改 35

第 3 章: CA Identity Manager r12.5

SP1 中现有功能的更改

此部分包含以下主题:

包括在角色定义文件中的其他对象 (p. 35)

现在在安装过程中部署本地化文件 (p. 35)

增强的工作项指派 (p. 35)

增强的动态确定程序 (p. 36)

新任务重现模型 (p. 36)

包括在角色定义文件中的其他对象

现在使用角色定义文件将以下其他对象导入和导出:

Policy Xpress 策略

批量任务定义

电子邮件通知策略

反向(新建和修改)帐户策略

现在在安装过程中部署本地化文件

在 CA Identity Manager 的先前版本中,可用于显示不同语言的 CA

Identity Manager 的翻译资源绑定示例可以从“管理工具”中获取。

现在默认情况下,会安装这些已翻译的资源绑定。

注意:有关创建本地化版本的 CA Identity Manager 的详细信息,请参阅

《User Console Design Guide》(《用户控制台设计指南》)。

增强的工作项指派

在以前版本中,您可以指定指派的开始时间,但不能指定结束时间。新创建的

指派则将其指派日期均设置为真,其中默认开始日期设置为现在。

修改时,开始和结束日期均可更改。默认结束时间是从开始日期起一周。

另外,您还可以在创建或修改用户时,从“指派工作项”选项卡执行同样操作。

Page 36: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

增强的动态确定程序

36 版本说明

增强的动态确定程序

动态确定程序已得到增强,将上一批准人添加到所支持的对象列表中。如果选

择了存储管理者信息的物理属性,该配置则会将批准路由给管理者。

将上一批准人添加到确定程序的支持对象列表中实现动态确定程序与升级批准

流程的结合使用。因为所做的修改只是为了与升级批准流程一起使用,所以不

会单独列出真正执行批准的人员。对于标识为当前作业上一工作项批准人的所

有用户,都会检查所请求的信息(管理者 UID 等)。标识进行此检查的所有

个人都是当前工作项(升级)的批准人。

新任务重现模型

新的、全局重现模型可用于“执行浏览和关联”任务和“捕获快照数据”任务。

新模型充当向导,有以下两个步骤:

1. 重现 - 允许您排定任务或立即执行任务。

2. 任务 - 允许您指定任务参数。

注意:有关新重现模型的详细信息,请参阅《Administration Guide》(《管

理指南》)中的“Recurrence Tab”(“重现”选项卡)。

Page 37: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

第 4 章: CA Identity Manager r12.5 中现有功能的变化 37

第 4 章: CA Identity Manager r12.5 中

现有功能的变化

此部分包含以下主题:

快照数据库性能提高 (p. 37)

快照参数 XML 文件增强 (p. 37)

连接管理 (p. 38)

环境导出包括其他对象 (p. 38)

CA Identity Manager 累积版本 (CR) 中的修补程序和增强 (p. 38)

Active Directory 连接器现在支持 Win2003 R2 UNIX 属性 (p. 38)

端点类型属性映射文件移动 (p. 39)

默认 CleverPath 报告模板被删除 (p. 39)

已弃用的配给 SDK 和实用程序 (p. 39)

不再支持 iRecorder (p. 40)

Web 服务对于新环境中的所有任务均为禁用状态 (p. 41)

快照数据库性能提高

将数据导出到快照数据库时,性能得以很大提高。

要进一步改善性能,请使用针对特定数据需求的快照参数 XML 文件,如针对

用于生成端点帐户报告的 Identity Manager 对象。

快照参数 XML 文件增强

导出端点对象时,现在可以使用 <exportattr> 和 <objattr> 元素来定义

将与某个特定端点类型一起导出的帐户属性,如下所示:

<exportattr objecttype="endpoint_type">

<objattr name="description"/>

<objattr name="fullName"/>

<objattr name="lastLogin"/>

</exportattr>

Page 38: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

连接管理

38 版本说明

连接管理

连接管理在 CA Identity Manager 中被替换为 JDBC 连接管理。

通过 JDBC 连接管理,可以指定用于在 Identity Manager 中进行报告的备

用数据源。该功能允许您为不同的数据库提供连接详细信息,并将其归为各种

连接类型。另外,对于每种连接类型还可以指定一个默认连接。

重要说明!由于性能方面的原因,我们建议您不要使用 Identity Manager 对

象存储数据库作为生成报告的数据源。

环境导出包括其他对象

下列环境特定的管理对象现在将与角色和任务一起导出:

连接(包括 CA RCM 的连接对象,CA Enterprise Log Manager 和报

告)

快照定义

导出和关联定义

如果导出包括具有 attributelevelencrypt 或 sensitive 数据分类的属性,

CA Identity Manager 则会在导出的文件中加密这些属性。

CA Identity Manager 累积版本 (CR) 中的修补程序和增强

CA Identity Manager r12.5 包括 CA Identity Manager r12 CR 1 - 6

中的修补程序和增强。

Active Directory 连接器现在支持 Win2003 R2 UNIX 属性

通过 Windows 2003 R2 UNIX 扩展与 CA Access Control UNIX 身份验

证代理的结合,您可以使用 Active Directory 来管理 UNIX 计算机和帐户。

CA Identity Manager 会通过在 Active Directory 上填充这些属性来配给

UNIX 访问权限,而不是配给每个 UNIX 服务器。这样就大大简化了 UNIX 环

境的配给和身份管理。

注意:该功能自从 CA Identity Manager r12 就已经合并,仅在配给管理器

中可用。

Page 39: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

端点类型属性映射文件移动

第 4 章: CA Identity Manager r12.5 中现有功能的变化 39

端点类型属性映射文件移动

在 CA Identity Manager r12 中,用于将 Identity Manager 扩展到 JIAM

属性的属性映射文件位于

IdentityMinder.ear\custom\provisioning\im2jiammapping。

在 CA Identity Manager r12.5 中,这些属性映射文件已经移到了各自的端

点类型 jar 中。这些 JAR 文件位于

IdentityMinder.ear\user_console.war\WEB-INF\lib。

默认 CleverPath 报告模板被删除

CA Identity Manager r12.5 中删除了默认 CleverPath 报告模板支持。CA

Identity Manager 现在支持 Business Objects Report Server。

CA Identity Manager r12.5 包括一系列用于 Business Objects Report

Server 的报告模板。有关详细信息,请参见《Administration Guide》中的

报告相关章节。

注意:您可以使用 Crystal Reports Developer 创建自定义报告模板,该产

品可从 Business Objects 购买。

已弃用的配给 SDK 和实用程序

下列配给服务器 SDK 和接口在 CA Identity Manager r12.5 SP1 中已弃

用;然而,它们仍然能够按照文档所描述的那样继续运行。

要使用 C++ 连接器 SDK 和 JIAM SDK,请下载和安装 CA Identity

Manager 12.5 SP1 旧版组件包。其中包括《Programming Guide for

Provisioning》,该指南描述了这些 SDK。

C++ 连接器 SDK

通过该 SDK 可以编写自定义静态 C++ 连接器。现有的 C++ 连接器将

继续用于 CA Identity Manager r12.5 SP1。

注意:应当使用 Java 连接器 SDK 开发新的连接器,如《Programming

Guide for Java Connector Server》中所述。

Java Identity and Access Management (JIAM) SDK

JIAM SDK 在 CA Identity Manager 的先前版本中提供以下功能:

– 配给服务器的 Java 接口

– 开发自定义客户端应用程序的配给服务器功能抽象

– 一个为多个客户端提供身份和访问管理功能访问权限的统一接口

之所以弃用该 API,是因为它只能提供对于部分 CA Identity Manager

功能的访问。

Page 40: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

不再支持 iRecorder

40 版本说明

该功能已被以下 CA Identity Manager 12.5 功能代替:

– 用户控制台中的管理任务

您可以使用管理任务对 Identity Manager 管理的大部分对象进行操

作。

– 任务执行 Web 服务 (TEWS)

CA Identity Manager 任务执行 Web 服务 (TEWS) 是一个 Web

服务接口,使得第三方客户端应用程序将远程任务提交给 CA Identity

Manager 进行执行。该接口实施 WSDL 和 SOAP 开放标准,从而

提供对 CA Identity Manager 的远程访问。

– 管理对象接口

CA Identity Manager 为管理对象提供了多个接口,可通过 CA

Identity Manager 应用程序接口来访问。

有关管理任务的详细信息,请参阅《Administration Guide》。有关 TEWS

和管理对象接口的详细信息,请参阅《Programming Guide for Java》。

etautil

使用 etautil 批处理实用程序可执行与配给管理器同样的任务,只是它是

基于命令行界面的。etautil 实用程序是所安装 r12.5 SP1 软件的一部分。

此内容在《Provisioning Reference Guide》中说明。

该功能已被任务执行 Web 服务 (TEWS) 代替,这部分内容位于

《Programming Guide for Java》。

Universal Provisioning Connector (UPC)

UPC 为 Identity Manager 提供了一个机制,用于在收到用户配给请求

时调用用户指定的外部程序。它使用程序出口来发送关于非管理系统(非管

理模式)的报警,以便管理员可以手动执行请求并更新帐户请求状态。它还

以同步模式(管理模式)使用出口,以便提供对于远程端点类型的直接管理

接口。

不再支持 iRecorder

CA Identity Manager r12.5 中不再支持 iRecorder。iRecorder 功能已替

换为 CA Enterprise Log Manager。

Page 41: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Web 服务对于新环境中的所有任务均为禁用状态

第 4 章: CA Identity Manager r12.5 中现有功能的变化 41

Web 服务对于新环境中的所有任务均为禁用状态

从 CA Identity Manager 12.5 开始,在环境创建期间通过使用“选择默认

角色”选项创建的新任务,或者通过导入可选角色定义插件创建的新任务,在

默认情况下会将 Web 服务设置为 false。在以前的 CA Identity Manager

版本中,在默认情况下所有任务的 Web 服务都是启用的。

升级到 CA Identity Manager 12.5 之后,以前启用了 Web 服务的现有环

境中的任务,将继续启用 Web 服务,因为它们是以前版本的。如果现有环境

应用任何升级角色定义插件,这些新的 12.5 任务在默认情况下会将 Web 服

务标志设置为 false。

Page 42: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。
Page 43: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

第 5 章: 安装注意事项 43

第 5 章: 安装注意事项

此部分包含以下主题:

支持的升级路径 (p. 43)

将 ADAM 2008 作为用户存储 (p. 43)

JBoss Enterprise Application Platform 4.2 上的其他安装步骤 (p. 44)

要求 Solaris 修补程序 (p. 44)

Solaris 最低内核参数 (p. 44)

非 ASCII 字符会导致非英语系统上的安装失败 (p. 45)

IPv6 支持 (p. 45)

Windows 2008 上带有纯 IPv6 的配给目录不受支持 (p. 46)

Linux 上的配给目录安装 (p. 47)

使用 WebLogic 时 Identity Manager EAR 不自动部署 (p. 47)

防火墙阻止 Windows 2008 SP2 部署中与 Identity Manager 组件的通信 (p. 47)

Linux 64 位上的 CA Identity Manager 与 SiteMinder 连接错误 (p. 48)

支持的升级路径

以下是针对到 CA Identity Manager r12.5 SP1 的升级有支持路径的产品

和版本列表:

CA Identity Manager r8.1 SP2

CA Identity Manager r12

CA Identity Manager r12 Option Pack 1

CA Identity Manager r12.5

注意:不支持从 ACE 到 r12.5 SP1 的升级。

如果在群集环境中升级 CA Identity Manager,请确保在开始升级过程之前

查看《Upgrade Guide》。总目录中有《Upgrade Guide》,您可以从 CA 支

持站点下载。

将 ADAM 2008 作为用户存储

如果您使用 ADAM 2008 作为 Identity Manager 用户存储,且将 CA

Identity Manager 与 SiteMinder 集成,则需要 SiteMinder r6.0

SP6/r6.x QMR6。

Page 44: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

JBoss Enterprise Application Platform 4.2 上的其他安装步骤

44 版本说明

JBoss Enterprise Application Platform 4.2 上的其他安装步骤

在 JBoss Enterprise Application Platform (EAP) 4.2 上安装 CA

Identity Manager r12.5 SP1 之后,在您启动 Identity Manager 服务器

之前请修改 JBoss 部署说明。

注意:有关完整说明,请参阅 CA 支持站点上的技术说明 (TEC509570)。

如果您不修改部署说明,则可以安装 CA Identity Manager 并创建环境,但

是尝试登录该环境会失败。

要求 Solaris 修补程序

在 Solaris 9 或 10 上安装配给软件之前,请下载并安装所需的修补程序。

为配给 SDK 下载 Sun Studio 10 修补程序

1. 转到以下 URL:

http://developers.sun.com/prodtech/cc/downloads/patches/ss10_patches.html

2. 下载并安装修补程序 117830。

注意:Sun Studio 11 不需要修补程序。

为所有配给组件下载 Solaris 9 修补程序

1. 转到以下 URL:

http://search.sun.com/search/onesearch/index.jsp

2. 下载并安装 9_recommended.zip

Solaris 最低内核参数

在 Solaris 上安装配给服务器时,检查 /etc/system 并验证下列最小 IPC 内

核参数值:

set msgsys:msginfo_msgmni=32

set semsys:seminfo_semmni=256

set semsys:seminfo_semmns=512

set semsys:seminfo_semmnu=256

set semsys:seminfo_semume=128

set semsys:seminfo_smmsl=128

set shmsys:shminfo_shmmni=128

set shmsys:shminfo_shmmin=4

Page 45: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

非 ASCII 字符会导致非英语系统上的安装失败

第 5 章: 安装注意事项 45

非 ASCII 字符会导致非英语系统上的安装失败

在 CA Identity Manager 安装过程中,安装程序会将文件提取到一个 Temp

目录中。在某些本地化系统中,该 Temp 目录的默认路径包含非 ASCII 字符。

例如,在西班牙语 Windows 系统上,Temp 目录的默认路径如下所示:

C:\Documents and Settings\Administrador\Configuración

local\Temp

非 ASCII 字符会导致安装程序显示空白的“安装前摘要”页面,这会导致安

装失败。

变通方法

将 TMP 环境变量更改为指向仅包含 ASCII 字符的文件夹。

IPv6 支持

CA Identity Manager 将在下列操作系统上支持 IPv6:

Solaris 9 或更高版本

Windows XP SP2 或更高版本

Windows 2003 SP2 或更高版本

Windows 2008 或更高版本

注意:Java 连接器服务器不支持 Microsoft Windows 平台上的 IPv6。截

止到 CA Identity Manager r12.5 SP1 的发布时间,没有可用于 IPv6 的

JDK。如果发布了可用于 IPv6 的 JDK,则将在 CA 支持站点上更新 CA

Identity Manager 支持表。

IPv6 JDK 要求

需要以下 JDK 支持 IPv6:

应用程序服务器 JDK 要求

JBoss (独立) JDK 1.5

JBoss 群集使用 IPv4/IPv6

堆栈

JDK 1.5

JBoss 群集 仅 JDK 1.5 for Solaris。

注意:对于 Windows,没有 JDK 可用来与 IPv6 合

作。如果发布了可用于 IPv6 的 JDK,则将在 CA 支

持站点上更新 CA Identity Manager 支持表。

WebLogic JDK 1.5

Page 46: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Windows 2008 上带有纯 IPv6 的配给目录不受支持

46 版本说明

WebSphere 至少 JDK 1.5 SR9

IPv6 配置注意事项

配置支持 IPv6 的 Identity Manager 环境之前请注意以下内容:

要使得 CA Identity Manager 能够支持 IPv6 地址,CA Identity

Manager 实施中的所有组件(包括操作系统、JDK、目录服务器和数据

库)也必须支持 IPv6 地址。

如果 CA Identity Manager 与 SiteMinder 进行集成,则用于应用程序

服务器的 Web 服务器插件也必须支持 IPv6。

使用 JDBC 连接从 CA Identity Manager 连接 SiteMinder 或任何数

据库时,请指定主机名而不要指定 IP 地址。

报告服务器可以安装在双堆栈主机上(支持 IPv4 和 IPv6),但与该服务

器的通信必须是 IPv4。

在管理控制台中配置报告服务器连接时,服务器名称须为 IPv4 格式。

CA Identity Manager 不支持 IPv6 链接本地地址。

在 IPv4/6 环境中,如果要将 CA Directory DSA 配置为侦听多个地

址,则必须将附加地址添加到 DSA 知识文件中。有关详细信息,请参阅

CA Directory 文档。

Windows 2008 上带有纯 IPv6 的配给目录不受支持

由于某个 Sun Java 系统限制,不支持在卸载了 IPv6 网络服务的 Windows

2008 服务器上安装配给目录。

要规避该问题,请在该系统上安装 IPv6 服务并将其保持禁用状态。

Page 47: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Linux 上的配给目录安装

第 5 章: 安装注意事项 47

Linux 上的配给目录安装

如果您在 Linux 系统上安装配给目录,即使打算在该系统上使用 IPv4,系统

也会自动使用 IPv6 地址。所有 DSA 正在运行,但是在您尝试通过 Jxplorer

连接到 DSA 或安装配给服务器时,拒绝连接错误可能出现。

在 Linux 上禁用 IPv6

1. 在配给目录安装之前,请遵循 Red Hat 知识库文章中的步骤禁用 LINUX

上的 IPv6。

2. 请确保 /etc/hosts 没有针对该地址的条目:

127.0.0.1 hostname

使用 WebLogic 时 Identity Manager EAR 不自动部署

如果在生产模式中使用 WebLogic 9 或 WebLogic 10,则安装或升级

Identity Manager EAR 后首次启动该应用程序服务器时,Identity

Manager EAR 可能不会自动部署。如果出现此种情况,请从

user_projects\applications 文件夹中手工部署 IdentityMinder.ear。

防火墙阻止 Windows 2008 SP2 部署中与 Identity Manager

组件的通信

在 Windows 2008 SP2 部署的安装期间,与 Identity Manager 组件(如

配给服务器、Java 连接程序服务器和 C++ 连接程序服务器)的通信由防火

墙阻挡。

变通方法

添加端口异常或禁用 Windows 防火墙以在 Windows 2008 SP2 部署中访

问分布式 Identity Manager 组件。

Page 48: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Linux 64 位上的 CA Identity Manager 与 SiteMinder 连接错误

48 版本说明

Linux 64 位上的 CA Identity Manager 与 SiteMinder 连接

错误

选择“连接到 SiteMinder”时,安装程序使用 Linux 64 位上的 CA Identity

Manager 报告错误。SiteMinder 中必要的代理配置不正确

注意:SiteMinder 策略服务器可以在任何硬件/软件上且没有关联。

重要说明!在部署任何目录/环境之前执行变通方法步骤。

变通方法

1. 请记住您在安装期间提供的代理名称和密码。另外,您可以读取以下

“AgentName”属性值:

\IdentityMinder.ear\policyserver.rar\META-INF\ra.xml

2. 打开 SiteMinder WAM 用户界面,并且使用代理名称创建代理。验证您

是否选中“4.x 代理”复选框。

3. 启动应用程序服务器,并验证您没有发现策略服务器连接问题。

您应当查看行中没有任何异常,如下所示:

13:40:43,156 WARN [default] * Startup Step 2 : Attempting to start

PolicyServerService

Page 49: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

第 6 章: 已知问题 49

第 6 章: 已知问题

此部分包含以下主题:

常规 (p. 49)

升级 (p. 54)

报告 (p. 59)

配给 (p. 62)

常规

下面是 CA Identity Manager r12.5 SP1 中的常规已知问题。

数据库未启动时 Identity Manager 以失败状态启动

如果在您启动 Identity Manager 服务器时 CA Identity Manager 所需要

的运行时数据库未启动,CA Identity Manager 则不管怎样都会尝试初始化,

并保持失败状态。

搜索大用户存储时,可能发生“内存不够”错误

针对大用户存储执行通配符 (*) 搜索时,该任务可能会失败,并出现

java.lang.OutOfMemoryError: Java heap space 错误。将许多对象(如

用户)加载到内存时,就会发生该问题。

变通方法

增加应用程序服务器启动脚本中的堆设置。考虑将堆大小增加到 1000 MB 分

配值,1400 MB 最高值。

批加载程序工作流限制

默认情况下 CA Identity Manager 目前不支持批加载程序的事件级工作流过

程。

变通方法

您可以为批加载程序启用任务级工作流,然后使用常规的批准任务来实现同样

的功能。

Page 50: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

常规

50 版本说明

创建带有配给的环境之后重新启动 CA Identity Manager

创建了包括配给的环境之后,请重新启动 CA Identity Manager 安装于的应

用程序服务器。如果您在不重新启动应用程序服务器的情况下启动该环境,则

正如 Configuration Guide 中所描述的那样,该环境不会注册到配给服务器。

如果该环境不包括配给,则可以在不重新启动应用程序服务器的情况下启动该

环境。

JBoss 上的良性 JSF RI 错误

在 JBoss 上实施 JSF RI 时,应用程序服务器日志中会出现以下错误:

ERROR [org.apache.myfaces.shared_impl.config.MyfacesConfig] Both MyFaces and the

RI are on your classpath. 请确保仅使用两个 JSF 实施之一。

这是一个良性错误,不需要修复。

Page 51: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

常规

第 6 章: 已知问题 51

CA Identity Manager 连接器需要连接器配置更改

默认情况下附带的 CA Identity Manager 连接器是 r12 连接器,与 r12.5

SP1 不兼容。因此,需要下列连接器配置更改:

SourceName:代理计算机上的数据源名称 - imsauditevent12

AnchorSQL:select max(id) from imsauditevent12

AnchorField:IMS_EVENTID

EventSQL: select imsauditevent12.id as

IMS_EVENTID ,imsauditevent12.audit_time as

IMS_AUDITTIME ,imsauditevent12.envname as

ENVNAME ,imsauditevent12.admin_name as

ADMINUNIQUENAME ,imsauditevent12.admin_dn as

ADMINID ,imsauditevent12.tasksession_oid as

TRANSACTIONID ,imsauditevent12.event_description as

EVENTINFO ,imsauditevent12.event_state as

EVENTSTATE ,imsauditevent12.tasksession_oid as

TASKOID ,imsaudittasksession12.task_name as

TASKNAME ,imsauditeventobject12.object_type as

OBJECTTYPE , imsauditeventobject12.object_name as

OBJECTUNIQUENAME ,imsauditobjectattributes12.attribute_na

me as

ATTRNAME ,imsauditobjectattributes12.attribute_oldvalue as

ATTROLDVALUE ,imsauditobjectattributes12.attribute_newvalue

as

ATTRNEWVALUE ,imsauditobjectattributes12.attribute_newvalu

e as ATTRVALUE from imsaudittasksession12, imsauditevent12,

imsauditeventobject12, imsauditobjectattributes12 where

imsauditevent12.id >? and imsauditevent12.tasksession_id =

imsaudittasksession12.id and imsauditevent12.tasksession_oid

= imsaudittasksession12.tasksession_oid and

imsauditeventobject12.parent_event_id = imsauditevent12.id

and imsauditobjectattributes12.parent_object_id =

imsauditeventobject12.id ORDER BY imsauditevent12.id ASC;

注意:CA Enterprise Log Manager Identity Manager 连接器仅在

Windows 系统上运行。

配给角色名称更改不会在 CA RCM 中动态更新

如果在 CA Identity Manager 中重命名某个配给角色,该名称更改不会通过

动态通知与 CA RCM 进行交流。这可能会影响建议角色功能以及遵从性和策

略验证。

变通方法

使用 Identity Manager 连接器将 Identity Manager 数据导入到 CA

RCM。

Page 52: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

常规

52 版本说明

在特定部署中创建新环境时的“未找到”错误

如果 CA Identity Manager 与 CA SiteMinder 6.0.5 CR 31 或更高版本

进行了集成,则当用户试图浏览某个新环境 URL 时,可能会显示“错误 404

- 未找到”。

该问题是由于策略服务器中的高速缓存问题引起的。

变通方法

要解决该错误,请执行以下步骤:

对于 Windows:

1. 在 SiteMinder 注册表中添加一个关键字:

a. 导航到

\\HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\Siteminder\

CurrentVersion\ObjectStore

b. 添加带有以下设置的“ServerCmdMsec”键:

类型:DWORD

值:1

c. 重新启动策略服务器。

2. 重新启动应用程序服务器。

3. 关闭所有浏览器实例。然后,使用新浏览器实例来访问该环境 URL。

对于 Solaris:

1. 向 <CA_HOME

folder>/netegrity/siteminder/registry/sm.registry 文件添加一行

ServerCmdMsec= 0x1 REG_DWORD

2. 重新启动策略服务器。

3. 重新启动应用程序服务器。

4. 关闭所有浏览器实例。然后,使用新浏览器实例来访问该环境 URL。

CA RCM 日志中的良性错误

当 CA RCM 服务器收到来自 CA Identity Manager 的创建或修改用户或角

色的请求时,在 CA RCM 服务器日志中会显示以下错误:

ERROR [Call] No returnType was specified to the Call object! You must call

setReturnType() if you have called addParameter().

该错误是良性的,可以安全忽略。这些更改会在 CA RCM 中成功执行。

Page 53: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

常规

第 6 章: 已知问题 53

在 Identity Manager 中修改单值复合属性

如果在 CA Identity Manager 修改动态端点的单值复合属性,请仅指定一个

值。如果指定多个值,现有值将被清除,并且不会为属性提供值。在配给管理

器中不会发生这个问题。

Linux 系统的 WebSphere 中的工作流启动问题

如果将 LANG 在 Linux 系统上设置为 xxxUTF-8,在工作流启动过程中则可

能出现 sun.io.MalformedInputException 错误。在 Linux 的

WebSphere 中会有此类情况。

有关该错误的详细信息,请参阅以下内容并且搜索

sun.io.MalformedInputException:

http://www.ibm.com/developerworks/java/jdk/linux/142/runtimeg

uide.lnx.en.html

变通方法:

请在启动应用程序服务器之前将 LANG 变量设置为非 UTF8 (例如,设置成

en_US 而不是 en_US.UTF-8),或者在用户配置文件中设置该变量。

例如:

[root@linux bin]# echo $LANG

en_US.UTF-8

[root@linux bin]# LANG=en_US

[root@linux bin]# export LANG

[root@linux bin]# echo $LANG

en_US

[root@linux bin]# ./startServer.sh server1

在工作流批准屏幕上突出显示为已更改的属性

在批准屏幕上,即使管理员没有在原始任务中更改其他属性,他们也可能突出

显示为已更改。这是因为屏幕可以包含脚本,这些脚本可以更改包含在该屏幕

中的各种属性值,针对某些其他属性的更改作为屏幕初始化或屏幕验证的一部

分。

Page 54: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

升级

54 版本说明

建议在导入角色定义文件时其他选项卡存在于环境中时出错

症状:

我使用 Connector Xpress 生成 CA Identity Manager 用户控制台帐户屏

幕,且在我把角色定义文件导入 CA Identity Manager 时,收到一条错误消

息:Identity Manager 环境中存在具有相同名称的其他选项卡

解决方案:

将关联类型属性放置在相同选项卡时,角色定义生成器试图以相同的名称创建

两个选项卡。例如,将关联属性成员和成员置于相同选项卡时。

我们建议,在您将角色定义文件导入 CA Identity Manager 环境之前,将关

联类型属性置于 Connector Xpress 的独立选项卡上。

升级

下面是与 CA Identity Manager r12.5 SP1 升级相关的一些问题。

将群集从 CA Identity Manager r12 CR6 或更高版本进行升级时的问题

如果将群集从 CA Identity Manager r12 CR6 或更高版本升级为 CA

Identity Manager r12.5 SP1,该升级可能会由于安装文件中的一些群集属

性被清除而失败。

变通方法

升级之前请验证 im-installer.properties 文件中是否存在下列属性:

WebSphere:检查群集名称是否填充到了 DEFAULT_WAS_CLUSTER

中。如果没有,请手动添加。

WebLogic:检查群集名称是否填充到了 DEFAULT_BEA_CLUSTER

中。如果没有,请手动添加。

注意:该问题不影响 JBoss 群集。

默认情况下,安装文件位于以下位置:

Windows:C:\Program Files\CA\CA Identity

Manager\install_config_info\im-installer.properties

Unix:

/opt/CA/CA_Identity_Manager/install_config_info/im-installer.pr

operties

Page 55: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

升级

第 6 章: 已知问题 55

升级之后重新映射 DYN 端 点属性

如果有在 r8.1SP2 或 r12 中创建的现有 DYN 命名空间,那么您必须执行以

下额外步骤以从 Identity Manager 用户控制台启用帐户管理。

变通方法

使用 Connector Xpress 将任何 DYN 端点属性重新映射到帐户屏幕,如下

所示:

1. 升级之后,在 Connector Xpress 中打开旧的 DYN JDBC 项目。

2. 将这些属性重新映射到帐户屏幕。

3. 重新部署元数据。

4. 运行角色定义生成器。

5. 将相应的文件复制到应用程序服务器。

6. 重新启动 CA Identity Manager。

注意:有关使用 Connector Xpress 映射端点属性的详细信息,请参阅

《Connector Xpress Guide》。

CA Directory 升级消息问题

升级 CA Directory 时,安装程序可能会请您关闭 cmd.exe,但升级时要使

用 cmd.exe。如果您遇到该消息,请单击“忽略”并且继续升级。

基于 WebLogic 9.2.1 升级时的错误

基于 WebLogic 9.2.1 从 CA Identity Manager r12 进行升级时,可能会

发生以下错误:

Unable to deploy EJB:

C:\bea\user_projects\domains\base_domain\applications\Identi

tyMinder.ear\wpServer.jar from wpServer.jar: Unable to load a

class specified in your ejb-jar.xml:

com.workpoint.server.ejb.SchemaPvtHome.

Error while parsing the Tag Library Descriptor at

"C:\bea\user_projects\domains\base_domain\servers\AdminSer

ver\tmp\_WL_user\IdentityMinder\wfq3pk\war\WEB-INF\lib\sta

ndard.jar!/META-INF/c-rt.tld".

Page 56: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

升级

56 版本说明

变通方法

1. 删除 WL_User 临时文件夹,例如,

domains\base_domain\servers\AdminServer\tmp\_WL_user。

注意:对于 WebLogic 群集,需要清除每个管理节点上的缓存。要清除的

缓存位置为 WebLogic_folder\

common\nodemanager\servers\server\tmp\ _WL_user。

2. 编辑位于 C:\bea\user_projects\domains\base_domain\bin 的

setDomainEnv.cmd 文件并添加下列行:

set IDM_OPTS= %IDM_OPTS%

-Djavax.xml.stream.XMLInputFactory=weblogic.xml.stax.XMLStreamInputFactor

y

3. 重新启动应用程序服务器。

环境迁移错误

如果您要从 CA Identity Manager r8.1 SP2,或 r12 CR1、CR2 或 CR3

进行升级,则在导入环境时可能会看到以下错误:

Attribute "accumulateroleeventsenabled" is not allowed to appear

in element "Provisioning".

变通方法

打开导出的 Env.zip 中的 envsettings.xml 文件,将

accumulateroleeventsenabled 更新为 acumulateroleeventsenabled

(删除 accumulate 中的第二个“c”)。

升级 CA Directory 之前必要的修复

要升级 Windows 系统上的 CA Directory,必须在开始升级过程之前为 CA

Directory 应用许可补丁程序。

如果不应用修补程序,则升级过程可能会删除其他 CA 产品所需的许可文件。

可以在 CA 支持站点下载补丁程序。

查找补丁程序

1. 登录 support.ca.com。

将打开 CA 支持站点。

2. 单击该页面左侧的链接列表中的“Licensing”。

Page 57: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

升级

第 6 章: 已知问题 57

3. 单击“License Package 1.8 is Now Available”。

将打开一个说明许可包更改的页面,其中包括下载许可包的链接。

4. 按照说明下载并安装 Windows 补丁程序。

注意:如果计划手动卸载 eTrust Directory r8,也需要该补丁程序。

用于 z/OS 连接器的升级后步骤

由于性能原因,已重新设计了 z/OS 连接器(CA ACF2、CA Top Secret 和

RACF)的架构,现在可以使用 CA LDAP Server for z/OS 来替代 CA DSI

Server on z/OS。

尝试配置任何 z/OS 连接器之前,必须安装 CA LDAP Server for z/OS r12

(可从 support.ca.com 上下载)。

升级到 CA Identity Manager r12.5 SP1 之后,请对定义到系统的每个端点

执行以下操作:

1. 在“对象类型”中选择端点“CA ACF2”、“CA Top Secret”或“RACF”。

2. 单击“搜索”按钮。右键单击“端点”,然后选择“属性”。 填写以下信

息:

在“大型机服务器信息”部分中:

IP 地址/计算机名称指定配置和运行 CA LDAP 服务器所在的

RACF 管理系统的 IP 地址。

LDAP 端口指定在安装 CA LDAP Server for z/OS 时指定的端口

号。如果不确定大型机 LDAP 端口,请参阅“Checking your CA

LDAP Server for z/OS Configuration Information”(查看 CA

LDAP Server for z/OS 配置信息)一节。

LDAP 后缀指定要用于此端点的后缀。单击“获取后缀”按钮后,将

自动使用所有有效的可用后缀填充此组合框。为“大型机 IP 地址/计

算机名称”字段和“大型机 LDAP 端口”字段提供有效值之后,即可

检索后缀。

Page 58: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

升级

58 版本说明

如果 Identity Manager 用户存储无法联系,环境迁移则失败

从 CA Identity Manager r8.1 SP2 进行升级时的环境迁移期间,如果

Identity Manager 用户存储无法联系,该环境将保持为未完成状态。例如,

基础 URL 可能会缺失,或者无法设置系统管理者。

变通方法

1. 删除受影响的环境。

2. 将文件环境名称 EnvironmentMigrated.properties 重命名为 环境名称

EnvironmentAutoMigrate.properties

该文件位于应用程序服务器部署位置

/IdentityMinder.ear/user_console.war/META-INF/

3. 重新启动应用程序服务器。

(仅 WebLogic)更新选项包路径

如果您正在使用 WebLogic,请更新 Identity Manager 服务器的 Option

Pack 文件夹的路径以成功启动。

更新 Option Pack 文件夹路径

1. 转到 weblogic_home\user_projects\domains\domain_name\bin。

2. 打开 setDomainEnv.cmd.bak 文件并复制始于“set

JAVA_OPTIONS=%JAVA_OPTIONS% -DidFocusHomeDir”的行。

3. 编辑 setDomainEnv.cmd 文件,并粘贴以上第二步中复制的行“set

JAVA_OPTIONS=%JAVA_OPTIONS%”。

setDomainEnv.cmd 文件应读取如下:

set JAVA_OPTIONS=%JAVA_OPTIONS% -DidFocusHomeDir="<OP home folder>".

set JAVA_OPTIONS=%JAVA_OPTIONS%

升级之后重新应用 WorkPoint 文件修改

如果从 CA Identity Manager r8.1 SP2 或 r12 升级,则将以下

WorkPoint 文件重命名为 filename.bak 并安装新版本文件。升级之后重新

应用对这些文件所做的任何修改:

从 Workpoint/bin 目录:Archive.bat/.sh、Designer.bat/.sh、

init.bat/.sh

从 Workpoint/conf 目录:workpoint-client.properties

Page 59: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

报告

第 6 章: 已知问题 59

没有浏览和关联任务的搜索屏幕

如果从 CA Identity Manager r12 升级或如果从 CA Identity Manager

r12.5 升级并将浏览和关联任务迁移到新的重现模型 (p. 36),那么浏览和关

联任务中的“浏览”按钮不会正常工作。

变通方法

为任务配置搜索屏幕,以便单击新的“浏览”按钮时出现搜索屏幕。

报告

下面是与 CA Identity Manager r12.5 SP1 报告相关的一些问题。

用户帐户报告生成失败

如果记录数超过 20,000,用户帐户报告则失败。

变通方法

1. 打开业务对象中央管理控制台。

2. 单击“服务器”,然后选择 servername.pageserver。

3. 对于条目“预览或刷新报告时要读取的数据库记录”,请选择“无限记录”。

4. 使用 Crystal Reports Designer,打开用户帐户报告。

5. 在“数据库”、“设置数据库源位置”下,将数据库位置设置为 CA Identity

Manager 快照数据库。

6. 单击“保存”。

7. 在“数据库”、“数据源专家”下,右键单击窗口右侧的“命令”。

8. 输入报告模板的“参数字段”中显示的参数名。

9. 更改左侧的查询并将该参数添加到查询,例如,如果您有“reportid”参数,

查询则显示如下:

Select * from endPointAttributes, endpointview, imreport6

where endPointAttributes.imr_endpointid = endpointview.imr_endpointid and

endPointAttributes.imr_reportid = endpointview.imr_reportid

and endpointview.imr_reportid = imreport6.imr_reportid and

imreport6.imr_reportid = {?reportid}

10. 保存该报告。

Page 60: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

报告

60 版本说明

使用 ExportAll.xml 捕获快照数据时出错

使用 ExportAll.xml 快照定义捕获快照数据时,该过程会失败,并显示错误

“java.lang.OutOfMemoryError: Java heap space”。当大量对象(如用

户)加载到内存时,就会发生该问题。

变通方法

增加应用程序服务器启动脚本中的堆设置。考虑将堆大小增加到 1000 MB 分

配值,1400 MB 最高值。

此外,在快照定义 XML 文件中,考虑将对象的筛选条件拆分成多个条件。 例

如,请不要使用通配符 (*) 筛选器来加载所有用户,而应指定多筛选,如“用

户 ID 开始于‘a’”,“用户 ID 开始于‘b’”,等。

捕获快照数据任务在完成时也显示为正在进行

选中“查看提交的任务”的情况下,尽管捕获快照数据任务已经完成,但仍可

能标记为“正在进行”。然而,如果您深入浏览捕获快照数据任务的详细信息

部分,则正确显示该任务已完成。

报告限制

与单个报告任务关联的多个快照不能使用同一重现时间。

在 XML 文件中,Satisfy=All 运行不正常

在快照参数 XML 文件中,satisfy=all 和 satisfy=any 均按照 satisfy=any

(类似于 OR 运算符)运行。

查看报告时会重定向到 Infoview 登录页

在 CA Identity Manager 中查看报告时,您可能会被重定向到 Business

Objects Infoview 登录页。

变通方法

1. 请确保使用 CA Report Server (Business Objects) 的完全限定域名。

2. 右键单击 Infoview 登录网页并且选择“查看源文件”。

3. 查找该报告的 URL。

4. 将该 URL 复制并粘贴到新的浏览器窗口。

Page 61: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

报告

第 6 章: 已知问题 61

5. 如果看不到该报告,则使用 http 跟踪工具来提供更多信息。

6. 如果能看到该报告,则尝试以下操作来修复浏览器设置:

接受第三方 Cookie。

允许会话 Cookie。

删除高安全性设置。

为“查看我的报告”任务启用第三方 Cookie

要使用“查看我的报告”任务查看 CA Identity Manager 中的报告,请在浏

览器中启用第三方会话 Cookie。

如果存在的记录多于 20,000 个,生成用户帐户则失败

如果存在的记录多于 20,000 个,生成用户帐户报告则失败。

变通方法

1. 打开 Business Objects Central Management 控制台。

2. 单击 Servers,然后选择 servername.pageserver。

3. 对于条目 Database Records To Read When Previewing Or

Refreshing a Report 选择 Unlimited 记录数。

4. 使用 Crystal Reports 设计器,打开用户帐户报告。

5. 使用 Database,Set Datasource Location,将数据库位置设置为您的

快照数据库。

6. 保存该更改。

7. 使用 Database,Datasource Expert,右键单击窗口右侧的

Command。

此时将在左侧显示 SQL 语法,以及 Parameter 列表。

8. 输入报告模板的 Parameters 字段中的属性名。

9. 更改左侧的查询,并在查询中添加该参数。

例如,如果您有 reportid 参数,该查询将为:

Select * from endPointAttributes, endpointview, imreport6

where endPointAttributes.imr_endpointid = endpointview.imr_endpointid and

endPointAttributes.imr_reportid = endpointview.imr_reportid

endpointview.imr_reportid = imreport6.imr_reportid and

imreport6.imr_reportid = {?reportid}

10. 保存该报告。

Page 62: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

62 版本说明

对于 WebSphere,非快照报告需要日期选取器

非快照报告使用当前系统日期和时间值作为开始日期时间和结束日期时间。然

而,这些值对于 WebSphere 不起作用。当您单击“排定报告”时,会出现错

误。

变通方法

使用日期选取器控件选择开始和结束日期时间。

配给

下面是与 CA Identity Manager r12.5 SP1 配给相关的一些问题。

常规

下面是 CA Identity Manager r12.5 SP1 中的常规配给问题。

高于 INFO 级别的 Solaris ECS 日志可能会影响配给服务器的性能

启用高于 INFO 级别的 ECS 日志会导致在收到响应之前写入日志。这会导致

在写入日志时延迟请求。

变通方法

如果遇到配给服务器性能不良时,请将 ECS 日志关闭。

如果 JIAM 指定了错误的对象类名称,SPML 更新将失败

JIAM API 有时可能会开始在发送至配给服务器的请求中使用错误、删减的对

象类名称,配给服务器将拒绝该请求,并生成错误“配给服务器中内部一致性

出错”。 例如,执行“eTSBLDirectory”对象更新时,会将错误的对象类

“eTDirectory”发送至配给服务器。可以通过重新启动 SPML 服务来解决此

问题。

全局用户名称中的特殊字符

通过配给管理器,您可以创建包含特殊字符(例如反斜杠字符 [\])的全局用

户名称。不过,Identity Manager 服务器不支持带有特殊字符的用户名。

在配给管理器中创建名称中带有特殊字符的全局用户时,Identity Manager

将尝试在 Identity Manager 用户存储中创建相应用户。Identity Manager

用户存储中将出现错误,并且“创建用户”任务将失败。

如果尝试在配给管理器中删除名称中带有特殊字符的全局用户,也会出现错误。

Page 63: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 63

添加端点时的已存在错误

如果删除并重新添加名称完全相同的端点,配给服务器有时会报告错误,表明

具有该名称的端点已存在。如果将多个连接器服务器配置为管理该端点,就会

出现该错误。该错误是由于在端点删除过程中出现问题 - 未向所有连接器服务

器通知此删除。

变通方法

重新启动所有已配置为管理该端点的连接器服务器。

配给服务器首选非本地 DNS 设置

即使您将操作系统配置为首先采用本地主机表,而非 DNS,配给服务器安装程

序仍然首选配给目录主机的 DNS 结果。

全局用户名的 SiteMinder 登录名限制

如果某个全局用户需要登录 SiteMinder 策略服务器,则该用户名不能包含下

列字符或字符串:

&

*

:

()

变通方法

避免在全局用户名中使用这些字符。

某些 WebSphere 节点可能丢失对象

在 WebSphere 群集中,环境的更改可能不会显示在群集的一些节点上。例如,

修改配给角色之后,该更改可能不会显示在该 WebSphere 群集的其他节点

上。

变通方法

将服务集成总线从群集移至专用服务器上。请参阅 Connecting Applications

on the Service Integration Bus 上的 WebSphere 文档。

在 64 位 Linux 上更改密码不触发 UNIX PAM 服务

PAM 仅在 32 位 Linux 系统上受支持。

配给服务器包括过时的 SAWI/DAWI 引用

配给服务器包括对于不再支持的 SAWI 和 DAWI 功能有控件的对话框。使用

CA Identity Manager 自助功能,而不是 SAWI 或 DAWI。

Page 64: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

64 版本说明

帐户同步在 CA Identity Manager 用户控制台中不可用

症状:

我无法验证帐户同步或无法同步 CA Identity Manager 用户控制台中的端点

帐户。

解决方案:

CA Identity Manager 用户控制台不支持检查帐户同步或初始化帐户同步。

使用配给管理器为全局用户或角色验证帐户同步,或为全局用户或角色启动帐

户同步。

如果要为角色中的大量用户验证帐户同步,那么请在父配给角色上验证同步。

这会检查包含在配给角色中的所有帐户模板上的同步。

要仅为一个端点同步帐户,请创建端点帐户模板的一个配给角色,并为该角色

验证帐户同步。配给管理器仅同步指定的端点帐户。

如果有不同步的帐户,那么您可以同步所有帐户,或从列表中选择要同步的帐

户。

注意:有关帐户同步的详细信息,请参阅配给管理器联机帮助。

创建链接到帐户模板的配给角色在 CA Identity Manager 中失败

症状:

我在 CA Identity Manager 12.5 到 CA Identity Manager 之前部署了使

用 Connector Xpress 创建的 JNDI 项目并执行了浏览和关联。

我创建了帐户模板并添加了两个关联属性,例如:管理者。根据帐户模板创建

配给角色并将配给角色分配给用户时,我得到一条错误消息,关联的帐户创建

或更新失败

解决方案:

CA Identity Manager 12.5 SP1 不支持在使用关联类型属性的 CA

Identity Manager 12.5 之前使用 Connector Xpress 创建的 JNDI 项目。

我们建议您使用配给管理器来创建帐户模板。

Page 65: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 65

影响挂起属性的反向同步策略

如果您创建检测新建帐户并将其挂起的反向同步策略,该挂起可遭到相关反向

同步策略的拒绝。请考虑以下示例:

1. 管理员创建两个策略:

检测新 Windows 帐户并挂起那些帐户的策略

检测对 Windows 帐户中 N16SecurityFlag 属性所做的更改并拒绝

该更改的策略

N16SecurityFlag 属性涉及帐户挂起。

2. 端点用户使用端点上的本地工具创建 Windows 帐户。

3. 新帐户策略将新帐户挂起。

4. 浏览和关联再次运行时,它将检测帐户是否修改。

5. 修改帐户策略检测对 N16SecurityFlag 属性所做的更改并拒绝该更改。

帐户不再被挂起。

该情况影响处理帐户挂起的任何端点类型。在此示例中,修改帐户策略应检测

etSuspend 中的更改而不是 n16SecurityFlag 中的更改。 因此,由于更改

来自 etSuspend,而 N16SecurityFlag 仅在端点上被更改且没有将其选为

更改的属性。

Java 连接器服务器 (Java CS)

下面是与 CA Identity Manager r12.5 SP1 中的 Java 连接器服务器相关

的一些问题。

升级过程中 connector.xml 文件重命名

将 Java Connector Server 从 r8.1 SP2 升级到 r12.5 SP1 时,

JCS_HOME/conf/override/* 之下的所有 connector.xml 文件将重命名为

connector.xml.orig。

如果您使用这些 connector.xml 文件,请在升级之后将这些文件重命名回原

来的名称。

使用 " / 字符序列表示识别名时,浏览 Java 连接器失败

处理以下两字符序列时,Java CS 中存在未解决的问题:

"/

以 JNDI API 标准使用的组合名称来表示跨越多种技术的识别名,这种处理方

法这非常重要。

Page 66: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

66 版本说明

有关传递给 Java CS 的识别名中其他特殊字符的详细信息,请参阅

http://ietf.org

上和 javax.naming.ldap.LdapName 的 JavaDoc 中的 LDAP RFC

2253

使用 Windows 服务重新启动 Java CS 服务失败

使用 Windows 服务重新启动 Java CS 服务时,可能会在其尚未完全关闭之

前启动 Java CS 服务,从而导致该服务失败。

变通方法

请使用 Windows 服务控制面板中的停止和开始按钮,而不要使用重新启动按

钮。

在 JNDI 帐户名称中不应使用保留字符

创建 JNDI 帐户时,请不要在帐户名称中使用保留字符,包括反斜线 (/)。尝

试删除这些字符时,会发生错误。

JNDI 帐户管理屏幕 - 使用多个结构化对象类创建帐户失败

不能使用多个结构化对象类创建帐户。

端点类型

下面是与 CA Identity Manager r12.5 SP1 中管理端点类型相关的一些问

题。

常规

以下各节描述各种连接器的已知问题:

使用重试自动锁定的端点必须配置较大的重试限制

对于具有“N”次重试自动锁定行为的端点,用于使用 Java CS 连接该端点的

帐户应配置为较大的(或者不受限制的)“N”次数,因为连接尝试次数会被 Java

CS 很快用完。

当帐户由于超过“N”次数而被本机锁定时,可能需要使用本机工具对其进行解

锁,然后才能重新获取该端点。这取决于该端点的具体本机“锁定”行为。

Page 67: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 67

对于用户控制台中的创建或修改任务,帐户模板与帐户不同步

使用用户控制台时,不支持显式帐户同步。

变通方法

使用配给管理器将帐户与帐户模板进行同步。

在端点和配给服务器之间导入时,直接修改端点会导致故障

直接修改端点时(不使用配给服务器),由于端点和配给服务器之间的数据不

一致,所以在导入时会返回故障。两个示例包括:

有人使用本地工具从 MSSQL 端点中删除表,这样会导致一些用户得到不

再存在的资源。

要解决这个故障,请使用配给服务器再次浏览端点。

有人删除端点上的某些服务器角色,仍旧分配那些服务器角色的帐户模板就

会收到在端点上不再存在的额外角色。

要解决这个故障,请从帐户模板中手工删除那些“已删除”的服务器角色。

Active Directory

以下各节描述 Active Directory 连接器的已知问题:

使用 Active Directory 连接器搜索子树时的不正确结果

对包含多个组织单元(每个组织单元中包含大量对象)的子树执行子树搜索时,

搜索可能错误地不返回任何对象。例如,如果搜索限制大小设置为 500,而每

个组织单元中的对象数均超过该限制,将不返回任何结果。即使搜索筛选将搜

索限制大小缩小到 500 以内,搜索可能仍错误地不返回任何对象。

变通方法

增加搜索限制大小。

ADS2008 端点的端点说明显示为数字

使用用户控制台查看或修改 ADS2008 端点时,该“ADS 服务器”选项卡上

的“域控制器”、“域”和“林”字段值均显示作为数字。

将 Office Communication Server 属性设置为真时的所需字段

如果将“启用 Office Communication Server 属性”设置为真,则需要以下

三个字段,并在使用 ADS 端点时将他们进行设置:

主服务器

SIP

URI

Page 68: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

68 版本说明

DB2 和 DB2 for z/OS

以下各节描述 DB2 和 DB2 for z/OS 连接器的已知问题:

获取 DB2 z/OS 端点导致 CCS 崩溃

DB2 UDB 连接器和 DB2 z/OS 连接器必须将请求路由至不同的 C++ 连接

器服务器 (CCS)。

变通方法

在一台单独的计算机上另安装一个 CCS,以便每个 DB2 UDB 连接器和 DB2

z/OS 连接器都在各自的 C++ 连接器服务器上进行托管。

DB2 帐户模板中授权机构授予的属性是功能属性

配给服务器中 DB2 帐户模板中授权机构授予的属性当前显示为初始属性,但

实际上是功能属性。

UNIX ETC 和 UNIX NIS

以下各节描述 UNIX ETC 和 UNIX NIS 连接器的已知问题:

S390 上运行的 Linux 操作系统上的 ETC 远程代理出现故障

在 S390 主机上运行的 Linux 操作系统上尝试安装 ETC 远程代理时出现故

障,出现以下错误:

# ./IdentityManager.LinuxS390.sh lsm.exe: error while loading

shared libraries: libncurses.so.4: cannot open shared object file: No

such file or directory."

变通方法

您需要找到并安装用于该操作系统的版本 4 ncurse。

OpenVMS

以下各节描述 OpenVMS 连接器的已知问题

使用 SPML 对 VMS 的删除帐户权限进行修改时失败

您无法使用 SPML 删除 VMS 帐户上 accountRights 属性中的值。SPML 客

户端将返回一条成功消息,但是帐户不会更新。

变通方法

使用配给管理器来执行此类修改。

Page 69: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 69

无法为 OpenVMS 帐户设置辅助密码

OpenVMS 远程代理工具“vmsautil”不会强制执行用户帐户的 OpenVMS 主

要/辅助密码的语义。如果在未设置主要密码的情况下尝试指定辅助密码,操作

将失败,并显示错误消息“密码太短”。

变通方法

尝试为帐户设置辅助密码之前,总是首先重置主要密码。

VMS 属性 eTVMSPWDLifeTime 显示为不同步

如果将帐户模板属性“永不过期”设置为“True”(选中),则执行“检查帐

户同步”操作之后,“密码使用期”(eTVMSPWDLifeTime) 属性将显示为不

同步。

无法设置 VMS 密码标志

如果帐户添加或修改操作请求未对 eTVMSAccessFlags 设置值,则执行此类

操作时,不会正确设置 eTVMSPwdFlags 属性。

变通方法

添加或修改请求应包含 eTVMSAccessFlags 属性和 eTVMSPwdFlags 属性

的值。

VMS 迁移密码属性显示为不同步

字段 MIGRATEPW 设置为“True”(选中)的所有 VMS 帐户或帐户模板在

执行“检查帐户同步”操作之后,都会将 eTVMSPwdFlags 显示为不同步。

权限属性

由于连接器问题,权限属性不在反向同步策略中发挥作用。避免在反向同步策

略中使用该属性。

NDS

以下各节描述 NDS 连接器的已知问题

NDS 连接器无法浏览新容器

获取 NDS 端点后,首次浏览尝试找到并添加容器。如果使用 NDS 本地工具

添加容器,然后尝试重新浏览端点,则新添加的容器及其子条目将不显示在树

中。

变通方法

从配给服务器删除该端点,然后重新获取并浏览该端点,以查看这些新容器。

Page 70: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

70 版本说明

NDS 连接器说明为单值字段

在 NDS 连接器中,帐户说明为单值字段,但在 NDS 端点中,帐户说明为多

值字段。

E2Kx

以下各节描述 E2Kx 连接器的已知问题:

管理邮箱权限时显示 E2K CAFT 错误

管理邮箱权限时可能会返回错误消息“CAFT 消息:访问被拒绝 - 或无法执行

命令”(即使正确配置了 Exchange 远程代理)。

如果邮箱权限列表中存在针对同一对象的多个权限,可能会出现此问题,如果

受管理的 Exchange 对象从父对象继承权限,通常会发生此问题。

初始创建后 E2K7 邮箱不同步

在选中“使用强同步”的情况下创建帐户模板并将某个全局用户与该帐户模板

同步之后,右键单击该全局用户,然后选择“帐户同步”。此时“邮箱权限”不

会同步。

变通方法

选择“Exchange 高级”,“邮箱权限”,“添加”(使用 SHIFT+“添加”

方式),“NT 授权\已验证用户”,仅“读取权限”。

启用电子邮件组中未设置电子邮件地址

创建组并选中“创建 Exchange 电子邮件地址”的情况下,不会为该组设置

电子邮件地址。

变通方法

创建该组之后,转到“电子邮件地址”选项卡,在此处应用新的电子邮件地址。

尝试修改一个具有 E27K 邮箱的帐户时显示错误消息

尝试修改一个具有 E27K 邮箱的帐户时显示错误消息。该错误是良性的,可以

忽略。

尝试创建 E2Kx 邮箱时错误消息显示“不足”

对于 INT 字段中的字符显示一条“不足”错误消息。错误 [-]?[\d]* 表示该

必填字段必须是数字。

Page 71: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 71

消息限制不允许在配给管理器中同时选择“Only From”和“From Everyone Except”

Exchange Server 2007 允许管理员同时选择“仅接受来自下列列表中发件

人的邮件”和“拒绝来自下列列表中”。配给管理器则只允许选择一个。这是

Exchange 2003 中的行为。如果在 Exchange 2007 中就已经两个都选中,

该功能在配给管理器中将失效。

PKI

以下各节描述 PKI 连接器的已知问题:

PKI 帐户显示为重复

PKI 连接器不支持 Entrust PKI 层级端点,并将所有帐户存储在展开列表中。

因此,具有相同名称的一个唯一 Entrust PKI 帐户将显示为 PKI 连接器的重

复内容。

创建 PKI 帐户时显示电子邮件通知警告

如果获取了使用代理配置文件的 PKI 端点,并打开了电子邮件通知,则在未指

定“创建配置文件”选项的情况下无法创建新的 PKI 帐户。

变通方法

请执行下列操作之一:

不使用代理配置文件获取该端点。

获取该端点时禁用电子邮件通知,然后转至该端点手工查看参考编号

PKI 连接器不支持国际化

配给管理器中无法正确显示带有非 7 位 ASCII 字符的帐户,因为 PKI 连接

器不支持国际化。

SAP

以下各节描述 SAP 连接器的已知问题

分配 SAP 合约用户类型

在“许可数据”选项卡中将合约用户类型分配给用户时,更改只能应用于主系

统,而无法应用于任何子系统。

变通方法

您可以在本地为这些子系统更改合约许可类型。

Page 72: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

72 版本说明

SAP 端点不从 SAPlogon.ini 文件进行预填充

配给管理器在 Windows 2008 上运行时,SAP 的端点详细信息不会从

SAPlogon.ini 文件进行预填充。

注意:该问题仅针对运行在 Windows 2008 上的配给管理器。

变通方法

您必须将 SAPlogon.ini 的内容手动输入到配给管理器中。

SAP 合约用户类型属性中的强制字段

对于可在帐户的“许可数据”选项卡上指定的合约用户类型,除“LIC_TYPE”

字段之外不能具有其他强制字段。例如,如果必须指定 SAP R3 系统 (SYSID)

的名称才能使用合约用户类型,则分配将失败,并将出现错误,表明 SAP R3 系

统的名称中缺少一个值。

“帐户许可数据”选项卡中的合约用户类型属性无法用于所有许可类型

从可用列表中选择某个用户类型时,只有一些用户类型起作用。一些许可类型

会出现“BAPI”函数引用错误。原因是一些用户类型包含无法识别的多余字段。

Siebel

以下各节描述 Siebel 连接器的已知问题

在多个端点上创建帐户时的 SBL 错误

列出多个端点的帐户模板只能列出存在于所有端点上的 Siebel 组。

Lotus Notes/Domio

以下各节描述 Lotus Notes/Domino 连接器的已知问题:

注册过程中不创建 LND 帐户邮件文件

在配给管理器 LND 帐户创建窗口的“配置文件”选项卡页面中,包含一个称

为“创建副本”的复选框。

管理群集环境中的 Domino 端点时,如果选中了“创建副本”复选框,则应

在群集环境中创建帐户的副本及其相关联的邮件文件。在此版本中,不在注册

过程中创建副本邮件文件。

Page 73: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 73

CA SSO Connector for Advanced Policy Server

以下各节描述 CA SSO Connector for Advanced Policy Server 的已知问

题:

指定 eTPLSCountry 的情况下 PLS 帐户搜索返回不存在的帐户

在 PLS 帐户的搜索请求中包括 eTPLSCountry 属性时,该搜索响应将返回

条目,即使在端点或配给存储库中不存在具有该名称的帐户也是如此。

PLS 连接器无法向应用程序添加 2000 以上的帐户

您一次不得向应用程序添加 2000 以上的帐户。如果您有超过 2000 的帐户

要进行添加,则必须将这些帐户拆分成多个操作。

ACF2、RACF 和 CA Top Secret

以下各节描述大型机连接器的已知问题:

CA LDAP Server for z/OS 在使用 RACF 连接器或在 r12.0 和以上版本中使用创建/删除别名处理之

前必须应用适当维护。

如果您正在使用 RACF 连接器的任何功能,或如果您正在使用 ACF2 或 TSS

连接器中的创建/删除别名处理,请联系技术支持进行适当维护。当您联系技术

支持时,请确保指定正在使用哪个 r12.5 版本的 CA Identity Manager,以

及正在使用 CA LDAP Server for z/OS 的哪个版本。CA LDAP Server r12

和 CA LDAP Server r14 有不同的修正,我们要确保提供正确的模块。

用户控制台中创建的 ACF2 和 TSS 帐户模板不支持用户定义的字段

使用用户控制台对于 ACF2 和 TSS 用户定义的字段的支持不可用。您可以使

用配给管理器继续管理这些字段。

RSA SecurId 7

以下各节描述 RSA SecurId 7 连接器的已知问题:

Page 74: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

74 版本说明

将配给角色分配给全局用户以创建 RSA 信任用户帐户失败

在 Windows 和 Solaris 上有效

症状:

将配给角色分配给全局用户以在 CA Identity Manager 中创建 RSA 信任用

户时,帐户创建失败。

解决方案:

帐户创建失败的原因是帐户模板包含不是 RSA 信任用户所需的默认规则字符

串 %P%、%UL% 和 %XD%。

在您首次创建模板并删除不必要的规则字符串时,规则字符串会在分配模板时

再次出现。

为 RSA 信任用户创建模板时,请执行以下内容。

1. 使用默认规则字符串创建模板,然后单击“提交”。

2. 修改帐户模板,并在“帐户”选项卡上删除“密码和启动日期”字段中

的 %P%、%XD% 规则字符串。

3. 在“用户”选项卡上删除“启动日期”字段中的规则字符串 %UL%。

4. 提交模板。

5. 将配给角色重新分配给全局用户。

Salesforce.com

以下各节描述 Salesforce.com 连接器的已知问题。

Salesforce.com - 帐户删除和挂起

本部分包含以下主题:

删除 Salesforce.com 帐户时出现错误消息 (p. 74)

帐户挂起 (p. 75)

“端点设置”选项卡的联机帮助不与屏幕上的选项匹配 (p. 75)

删除 Salesforce.com 帐户时出现错误消息

症状:

在我试图删除 Salesforce.com 帐户时,收到错误消息,无法执行

“DeleteSalesforceUser”。

尝试进行直接或间接删除 Salesforce.com 帐户的操作时,错误就会发生。例

如,删除创建该帐户的角色。

Page 75: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 75

解决方案:

如果在 CA Identity Manager 用户控制台中的“端点设置”选项卡上选择“帐

户将从配给目录和管理端点中删除(Salesforce 不支持)”选项,则会生成该

消息。

该选项不适用于 Salesforce.com 连接器,因为 Salesforce.com 不支持帐

户删除。

默认情况下,要执行 Salesforce.com 帐户上的删除操作,应选择“将挂起帐

户”选项。

要指定 Salesforce.com 帐户上启动的所有删除操作将挂起

Salesforce.com 端点上的帐户,请执行以下操作:

1. 在 CA Identity Manager 用户控制台中的“端点设置”选项卡上,请选

择“将挂起帐户”。

这指定在 Salesforce.com 帐户上启动的所有将来的删除操作将挂起

Salesforce.com 端点上帐户,并将其置于 DeletePending 状态。

2. 重新删除帐户。

该帐户在 Salesforce.com 端点上挂起,并在 CA Identity Manager 中

显示为 DeletePending 状态。

帐户挂起

您不得使用 Salesforce.com 连接器来删除 Salesforce.com 用户,因为

Salesforce.com 不支持帐户删除。

默认情况下,已将 CA Identity Manager 配置为挂起 Salesforce.com 端

点上的帐户,并在尝试直接或间接删除 Salesforce.com 帐户的任何操作发生

时将该帐户置于 DeletePending 状态。例如,删除创建该帐户的角色。默认

情况下,“将挂起帐户”选项在 CA Identity Manager 用户控制台的“端点

设置”选项卡上为选中状态。

注意:有关挂起和恢复用户帐户的详细信息,请参阅 CA Identity Manager 用

户控制台联机帮助。

“端点设置”选项卡的联机帮助不与屏幕上的选项匹配

症状:

在我显示有关 Salesforce.com 端点的“端点设置”选项卡的联机帮助时,联

机帮助中显示的字段与我在屏幕上看到的选项不匹配。

解决方案:

正确的字段是:

将挂起帐户

(默认)指定在 Salesforce.com 帐户上启动的任何删除操作会挂起

Salesforce.com 端点上的帐户。帐户被放入 CA Identity Manager 的

DeletePending 状态。

Page 76: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

76 版本说明

帐户将从配给目录和管理的端点中删除(Salesforce 不支持)

重要说明!Salesforce.com 不支持删除帐户。我们建议您不使用该选项用于

Salesforce.com 帐户。

Salesforce.com - 配给管理器中不支持帐户和端点管理

配给管理器不支持 Salesforce.com 对象的管理。使用 CA Identity

Manager 用户控制台来管理 Salesforce.com 对象。

Salesforce.com - 用户在密码重置时不会从 Salesforce.com 接收到带有临时密码的电子邮件

症状:

我使用 CA Identity Manager 用户控制台中的 Salesforce.com 连接器的

“帐户”选项卡中的“重置密码”复选框重置用户密码。用户没有从

Salesforce.com 接收到带有临时密码的电子邮件。用户帐户被锁定。

解决方案:

Salesforce.com 存在已知问题,防止您通过 CA Identity Manager 用户控

制台重置用户密码。

通过 CA Identity Manager 用户控制台的“帐户”选项卡上的“密码”和“确

认密码”字段设置用户密码。于是您可以手工将新密码传递给用户。

Salesforce.com - 将配给角色分配给挂起的帐户不会自动恢复该帐户

症状:

在我将配给角色分配给 CA Identity Manager 中的挂起帐户时,配给角色获

得重新分配,但不会自动恢复。

如果您使用“端点设置”选项卡中的“将挂起帐户”选项,会发生该错误。

解决方案:

CA Identity Manager 在将配给角色重新分配给帐户时不支持恢复挂起的帐

户。

将角色分配给 Salesforce.com 连接器的 CA Identity Manager 帐户之后,

请执行以下操作:

1. 在 CA Identity Manager 中,找到“修改用户的端点帐户”,并选择要

恢复的端点帐户。

2. 单击“恢复”。

3. 系统提示确认要恢复的帐户时,请单击“是”。

即恢复该帐户。

Page 77: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 77

Salesforce.com - 创建 Salesforce.com 帐户时出现错误消息

症状:

在我创建 Salesforce.com 帐户时,我收到错误消息:无法执行已经创建的

Salesforce.com 用户 CreateSalesforceUser,但一些其他操作失败。

我找不到在 CA Identity Manager 用户控制台中创建的帐户。

解决方案:

您创建用户帐户时,在以下情况下会发生错误:

您指定的密码没有满足 Salesforce.com 最小的密码复杂性要求。例如,

您指定的密码长度不到八个字符。

这发生的原因是因为 Salesforce.com 允许您创建帐户,而没有指定密

码。

该帐户在 CA Identity Manager 中创建,但是由于没有与全局用户关联,

而无法查看。该帐户出现在 Salesforce.com 组织中,但是尚未设置密码。

您将该用户指定为不存在公共组的成员。在以下情况下会发生这种情况:

– 该组在 Salesforce.com 端点上被删除,但是您没有在 CA Identity

Manager 中执行浏览和关联。

– 用来创建用户的帐户模板指定不存在的组。

CA Identity Manager 忽略所有无效的组成员身份。

请执行下列操作之一:

如果您收到错误消息,说明在创建帐户时指定的密码没有满足最小的密码复

杂性要求,那么请在 CA Identity Manager 用户控制台中设置满足最小

的密码复杂性要求的密码。

您创建的用户帐户在 CA Identity Manager 中与全局用户关联并立即可

见。

如果您收到错误消息,说明用户是不存在公共组的成员,则将用户添加到正

确的组中。

Salesforce.com - 会话超时

本部分包含以下主题:

错误:无法将字符串转换到 Salesforce.com 或在 SessionHeader 中发现无效会话

ID (p. 78)

配置 Salesforce.com 连接器会话超时值 (p. 78)

指定验证活动会话的方式 (p. 79)

错误消息 - 主机不接受在 nnnn 毫秒超时之内的连接 (p. 79)

Page 78: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

78 版本说明

错误:无法将字符串转换到 Salesforce.com 或在 SessionHeader 中发现无效会话 ID

症状:

在我创建 Salesforce.com 帐户时,我收到消息:无法将字符串转换到

Salesforce.com 或在 SessionHeader 中发现无效会话 ID。

解决方案:

默认情况下,CA Identity Manager 不验证 Salesforce.com 会话的有效性,

该会话可以超时。

为了减少会话超时的可能性,我们建议您按照以下顺序尝试以下解决方案:

1. 配置 Salesforce.com 连接器会话超时值 (p. 78)

2. 如果配置 Salesforce.com 连接器会话超时值没有解决这个问题,您可以

尝试指定验证活动会话的方式 (p. 79)。

配置 Salesforce.com 连接器会话超时值

为了减少会话超时的问题,我们建议您首先验证值不冲突,这些值指定 CA

Identity Manager 和 Salesforce.com 之间的会话仍然有效的时间长度。

在 Salesforce.com 连接器的 connector.xml 文件中指定的会话超时应等

于或小于 Salesforce.com 组织中指定的会话超时。

配置 Salesforce.com 会话超时值

1. 在您的 Salesforce.com 组织中,获取为 Salesforce.com 组织指定的

会话超时值。

注意:有关详细信息,请参阅 Salesforce.com 组织中“管理设置”下的

“会话设置”。

2. 在 Salesforce.com 的 connector.xml 文件中,请验证

minEvictableIdleTimeMillisis 值等于或小于在 Salesforce.com 组织

中指定的会话超时。

例如,如果 Salesforce.com 会话超时值是 15 分钟,那么在

connector.xml 文件中指定的会话超时值应等于或小于 900000 毫秒。

3. 如果会话超时值大于在 Salesforce.com 组织中指定的会话超时值,则在

connector.xml 文件中编辑 minEvictableIdleTimeMillis 值。

注意:有关自定义 connector.xml 文件的详细信息,请参阅《 Java

Connector Server Implementation Guide》(《Java 连接器服务器

实施指南》)。

4. 如果继续体验会话超时,请尝试指定验证活动会话的方式 (p. 79)。

Page 79: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 79

指定验证活动会话的方式

要减少会话超时,您可以指定验证活动会话的方式。

减少会话超时

1. 如果配置 Salesforce.com 连接器会话超时值 (p. 78)没有解决超时问

题,那么我们建议您首先尝试指定会话在池中空闲时不时对其进行验证。

在 connector.xml 中,请设置以下属性:

testOnBorrow = false

testWhileIdle= true

就 API 调用而言,此解决方案比指定为每次从池中借用会话时对其进行

验证的方法要便宜,且可以解决会话超时的问题。

2. 如果前面的解决方案没有解决该问题,则请尝试指定每次从池中借用会话时

对其进行验证的方法。这种方法解决该问题的同时,它也是相当昂贵的;因

为每次从池中借用会话时都会执行一次其他 API 调用。在针对用户的单个

操作过程中可以多次借用连接。

在 connector.xml 中,请设置以下属性:

testOnBorrow = true

testWhileIdle= false

注意:我们建议您不要将两个属性均设置为 true,否则这会增加 API 调

用的次数。

注意:有关自定义 connector.xml 文件的详细信息,请参阅《 Java

Connector Server Implementation Guide》(《Java 连接器服务器

实施指南》)。

错误消息 - 主机不接受在 nnnn 毫秒超时之内的连接

症状:

我收到错误消息,说明主机没有接受在 nnnn 毫秒超时之内的连接。

解决方案:

SOAP 客户端已经超时。

增加 Salesforce.com connector.xml 文件中 timeOutInMilliSeconds 属

性值一分钟,直到解决这个问题。

这会增加 Axis2 客户端超时值,并可以解决该问题。

注意:有关自定义 connector.xml 文件的详细信息,请参阅《 Java

Connector Server Implementation Guide》(《Java 连接器服务器实施

指南》)。

Page 80: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

80 版本说明

Salesforce.com - 对象显示为 CA Identity Manager 用户控制台中的 Salesforce

症状:

在 CA Identity Manager 用户控制台中,我仅看到 Salesforce 对象,而不

是下拉列表中的 Salesforce.com 对象。

解决方案:

在 CA Identity Manager 用户控制台中,使用 Salesforce 作为描述符显示

Salesforce.com 对象,而不是 Salesforce.com。例如,Salesforce.com 端

点在下拉列表中显示为 Salesforce。

该错误是显示错误,并不影响对 Salesforce.com 端点的管理。

RSA ACE (SecurID) 连接器

以下各节描述 RSA ACE (SecurID) 连接器的已知问题:

Page 81: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

第 6 章: 已知问题 81

安装或者升级 RSA 远程代理时由于 ECS 问题而失败

在 Windows 和 Solaris 上有效

症状:

在我安装或升级 RSA 远程代理时,由于 ECS 问题有时会失败。

远程代理升级和全新安装失败,消息为“应用转换时发生错误。请验证指定的

转换路径是否有效”。

安装回滚,且没有安装代理。

解决方案:

1. 请执行以下操作:

a. 在尝试安装 ECS 之前重新启动计算机。

b. 检查是否有足够的磁盘空间。

c. 确保没有其他会话的安装软件包正在运行。

d. (Windows) 验证在后台没有 Windows 自动更新正在运行。

2. 如果在启动升级 RSA 代理之前,ECS 安装损坏,则请执行以下操作:

a. (Windows) cd RemoteAgent\RSA\windows\

CA Enterprise Common Services.exe

CA Enterprise Common Services Setup Maintenance 程序启

动。

选择“删除”,然后遵循提示操作。

(Solaris) 卸载 ECS:

cd /opt/CA/eCS/scripts

./eCSuninstall.sh

b. (Solaris) 如果卸载脚本失败,请手工删除 ECS:

rm -rf /opt/CA/eCS

rm -f /etc/.ecspath

rm -f /opt/CA/SharedComponents/lib

c. 找到 ECS:

(Windows) cd RemoteAgent\RSA\windows\

(Solaris) cd RemoteAgent/RSA/solaris/ecs-installation

d. 运行 ECS:

(Windows) CA Enterprise Common Services.exe

CA Enterprise Common Services Setup Maintenance 程序启

动。

选择“修复”,请遵循提示,使用默认选项。

Page 82: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

82 版本说明

(Solaris) ./eCSinstall.sh /opt/CA/eCS

ECS 完成。

3. 运行 RSA 代理安装程序。

本地副本即升级。

Page 83: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

第 7 章: 已修复问题 83

第 7 章: 已修复问题

CA Identity Manager r12.5 SP1 包括下表中的修正。该版本也包括来自

CA Identity Manager r12 CR 1-8 的修正和增强。

支持票据 摘要

1697804

7

从 eTrust Admin 8.1 SP2 升级至 Identity Manager r12.5

后,升级之前获取的所有 Microsoft SQL 或 Oracle 端点均需要使

用配给管理器手工重新配置,以使用 JDBC URL 替代数据源名称

(DSN)。

1714500

5

尝试在配给管理器中打开 PKI 组属性页时,将显示错误消息“无法

显示请求的属性页”。

1866409

2

在单独的服务器上安装 SiteMinder 扩展时,系统仅为 SiteMinder

安装目录提示用户。

1875837

3

使用 Connector Xpress 来为 Oracle Internet 目录建立连接器

时,在映射过程中出现错误。

1872621

0

到 SiteMinder 的 CA Identity Manager 扩展在 Linux 上不可

用。

1872685

0

在 WebSphere 群集上部署 CA Identity Manager 后,JDBC 密

码被存储为纯文本。

1874518

3

本地化示例包含本地化和 location2 文件夹,令人混淆。

1875108

7

添加到 AD 连接器的新选项卡在配给管理器中可见,但不在用户控

制台中。

1824071

8

将“imr_attrvalue”列设置为 20 个字符长度时,捕获快照任务失

败。

1862443

6

使用 RoleDefGenerator 为 LDAP DYN 端点类型生成屏幕、任务

和角色时,发生异常。

1894218

2

针对“启用/禁用用户”或“修改用户”任务,将帐户同步设置为

“OnEveryEvent”,且更新了用户的启用状态,那么发送到配给服

务器的请求丢失 eTSyncAccounts=1,因此没有同步新值与关联的

帐户。

不可用 如果将 LANG 在 Linux 系统上设置为 xxxUTF-8,在工作流启动

过程中则可能出现 sun.io.MalformedInputException 错误。在

Linux 的 WebSphere 中会有此类情况。

不可用 第一次单击“查看用户活动”任务中“用户启动”选项卡时,会发生

错误。

Page 84: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

配给

84 版本说明

不可用 如果在 CA Identity Manager 升级期间尝试目录和环境的自动迁

移 ,则可能会收到一个 SiteMinder 错误。如果更改了默认的

SiteMinder 身份验证端口 (44442),安装程序则会错误检测到

SiteMinder 未在运行,并不允许您继续。

不可用 如果更改其中一个指定的配给服务器,CA Identity Manager 可能

会将故障转移请求发送到最初的配给服务器,而不是新的配给服务

器。

不可用 安装 CA Identity Manager 时,必须使用完全限定 URL。

不可用 如果在生产模式中使用 WebLogic 9 或 WebLogic 10,则安装或

升级 Identity Manager EAR 后首次启动该应用程序服务器时,

Identity Manager EAR 可能不会自动部署。

不可用 升级、映射 DYN 属性、将元数据重新部署到 DYN 端点类型中之后,

使用 RoleDef 生成器工具生成的端点屏幕上的第一个选项卡不会显

示。

不可用 在配给管理器中,在包含日语字符的组织和组织单元中创建的帐户不

在“成员”选项卡中显示其组员资格。

Page 85: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

第 8 章: 文档 85

第 8 章: 文档

以下是 CA Identity Manager 指南的文件名称:

指南名 文件名

版本说明 im_release_chs.pdf

Implementation Guide im_impl_enu.pdf

Installation Guide for

WebLogic

im_install_weblogic_enu.pdf

Installation Guide for

WebSphere

im_install_websphere_enu.pdf

Installation Guide for JBoss im_install_jboss_enu.pdf

Upgrade Guide im_upgrade_enu.pdf

Configuration Guide im_config_enu.pdf

Administration Guide im_admin_enu.pdf

User Console Design Guide im_uc_design_enu.pdf

Programming Guide for Java im_dev_enu.pdf

Provisioning Reference Guide im_provisioning_reference_enu.pdf

Connectors Guide im_connectors_enu.pdf

Connector Xpress Guide im_connector_xpress_enu.pdf

Java Connector Server

Implementation Guide

im_jcs_impl_enu.pdf

Programming Guide for Java

Connector Server

im_jcsProg_Enu.pdf

Glossary im_glossary.pdf

总目录 im_bookshelf_enu.zip

此部分包含以下主题:

总目录 (p. 86)

在线帮助功能增强 (p. 86)

eTrust 到 CA 的品牌重塑 (p. 87)

术语更改 (p. 87)

文档更改 (p. 88)

Page 86: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

总目录

86 版本说明

总目录

通过总目录,可从一个界面访问所有 CA Identity Manager 文档。总目录包

括以下内容:

所有 HTML 格式的指南内容的可展开列表

所有指南的全文搜索,其中搜索结果分级排序,搜索术语在内容中突出显示

允许您链接到更高级别主题的页面地址导航

所有指南中主题的单一 HTML 索引

用于打印的 PDF 版本指南的链接

使用总目录

1. 从 CA 支持站点下载总目录。

2. 提取总目录 ZIP 文件的内容。

注意:要获得最佳性能,在远程系统上安装总目录时,请将总目录设置为可

以从 Web 服务器进行访问。

3. 按以下方式查看总目录:

如果总目录位于本地系统上,且您使用的是 Internet Explorer,请打

开 Bookshelf.hta 文件。

如果总目录位于远程系统上,或如果您使用的是 Mozilla Firefox,请

打开 Bookshelf.html 文件。

注意:要获得最佳性能,在远程系统上安装总目录时,请将总目录设置

为可以从 Web 服务器进行访问。

总目录需要使用 Internet Explorer 6、Internet Explorer 7 或 Mozilla

Firefox 2。要查看 PDF 指南的链接,需要使用 Adobe Reader 7 或 Adobe

Reade 8。可以从 www.adobe.com 下载 Adobe Reader。

注意:r12 和 r6.0 SP5 的 CA SiteMinder 总目录已使用 CA Identity

Manager 所使用的同一总目录格式发布到 CA 支持站点上。

在线帮助功能增强

现在,用户控制台在线帮助和管理控制台在线帮助具有以下功能:

页面地址导航

指明您在帮助层次结构中的位置,使导航更加便捷。 它们位于帮助页面的

顶部。

Page 87: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

eTrust 到 CA 的品牌重塑

第 8 章: 文档 87

搜索突出显示

在结果页面中,用黄色突出显示您搜索的上下文。

导航按钮

显示上一页和下一页箭头按钮,使导航更加便捷。 它们位于帮助页面的顶

部,页面地址导航下方。

eTrust 到 CA 的品牌重塑

目前,某些 CA 安全产品的品牌正从“eTrust”转变为“CA”。 在此转变期

间,文档中可能会同时提及 eTrust 产品和 CA 产品。 例如,eTrust

Directory 现在的品牌名称为 CA Directory。文档内提及的任何 eTrust 产

品相当于使用新 CA 品牌的同一产品。

术语更改

现在的 eTrust Admin 客户可能会注意到,由于 eTrust Admin 成为了 CA

Identity Manager 的一部分,现在某些术语已经发生了变化。 下表对这些变

化进行了说明:

eTrust Admin 术语 Identity Manager 中的新术语

eTrust Admin 服务器 配给服务器

eTrust Admin 管理器 配给管理器

目录 端点

命名空间 端点类型

策略或配给策略 帐户模板

角色 配给角色

分布式超级代理框架 连接器服务器框架

超级代理 C++ 连接器服务器

选项 连接器

管理目录或管理存储库 配给目录

Identity Manager 企业目录 Identity Manager 用户存储

企业用户 入站管理员

Page 88: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

文档更改

88 版本说明

文档更改

以下内容是我们从 CA Identity Manager r12.5 起对文档集做出的更改。

Installation Guide 和 High Availability Guide

CA Identity Manager 的高可用性内容已合并到了每种应用程序服务器

的《Installation Guide》中。 不再提供单独的指南来介绍高可用性内容。

Upgrade Guide

CA Identity Manager r12.5 中的一个新指南。所有与 CA Identity

Manager 升级有关的内容均已从《Installation Guide》中分离出来,被

单独放入到了《Upgrade Guide》中。

User Console Design Guide

该新指南主要面向在安装之后初次配置 Identity Manager 环境的系统管

理员。

该指南包括自定义任务(包括任务导航和屏幕设计)、商标和本地化方面的

信息。

Programming Guide for Provisioning

该指南描述了一些已弃用的配给 API (p. 39),已从总目录中删除。现在

该指南与这些 API 的安装包一起提供。

Page 89: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

附录 A: 第三方声明 89

附录 A: 第三方声明

此部分包含以下主题:

Apache (p. 89)

ANTLR 2.7.5H# (p. 96)

ASM 3 (p. 97)

DOM4J (p. 97)

HSQLDB 1.7.3 (p. 99)

HSQLDB 1.8.0 (p. 101)

IBM DB2 Driver for JDBC and SQLJ (p. 102)

Jaxen 1.3 (p. 102)

JDOM 1.11 (p. 104)

JSON 1.0 (p. 105)

jtopen 5.1.1 (p. 105)

libcurl 7.15.0 (p. 106)

MX4J 3.0.2 (p. 107)

Oracle JDBC Driver 10g Release 2 (p. 109)

Rhino 1.5R5 (p. 110)

Rhino 1.7R1 (p. 119)

SAAJ 1.2 (p. 131)

SAXPath 1.1 (p. 132)

SpiderMonkey 1.5 (p. 133)

Sun JDK 1.6.0 (p. 134)

Xinha .96 Beta 2 (p. 142)

Apache

Portions of this product include software developed by the Apache

Software Foundation.

Apache Ant 1.6.5

Apache Axis 1.1

Apache Axis 1.2

Apache Axis 1.2.1

Apache Axis 1.4

Apache Axis2/Java 1.5

Apache Bean Scripting Framework 2.4.0

Apache Jakarta Commons BeanUtils 1.6.1 and 1.7

Apache Commons Cli 1.0

Page 90: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Apache

90 版本说明

Apache Jakarta Commons Codec 1.3

Apache Jakarta Commons Collections 3.1

Apache Jakarta Commons DBCP 1.2.1

Apache Jakarta Commons Validator 1.2

Apache Commons Digester 1.7

Apache Commons Discovery 0.2

Apache Commons EL 1.0

Apache Commons File Upload 1.2

Apache Commons IO 1.3.1

Apache Commons Lang 2.1

Apache Commons Logging 1.0.4

Apache Commons Pool 1.3

Apache Derby 10.4.2

Apache ehcache 1.2.4

Apache Jakarta Taglibs 1.0.6

Apache Jakarta ORO 2.0.8

Apache Jakarta Slide 2.1

Apache Log4j 1.2.8

Apache HttpClient 3.0

Apache MyFaces 1.1.5

Apache JSTL Taglib 1.1

Apache POI 3.2

Apache Quartz 1.5.2

Apache Spring Framework 1.2.8

Apache StAX 1.2

Page 91: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Apache

附录 A: 第三方声明 91

Apache Struts 1.2.7 and 1.2.9

Apache Velocity 1.4

Apache Xalan-C 1.9.0

Apache Xalan-J 2.6.0

Apache xmltask 1.13

The Apache software is distributed in accordance with the following

license agreement.

Apache License Version 2.0, January 2004

http://www.apache.org/licenses/

TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND

DISTRIBUTION

1. Definitions.

'License' shall mean the terms and conditions for use,

reproduction,and distribution as defined by Sections 1 through 9 of

this document.

'Licensor' shall mean the copyright owner or entity authorized by

the copyright owner that is granting the License.

'Legal Entity' shall mean the union of the acting entity and all other

entities that control, are controlled by, or are under common

control with that entity. For the purposes of this definition, 'control'

means (i) the power, direct or indirect, to cause the direction or

management of such entity, whether by contract or otherwise, or

(ii) ownership of fifty percent (50%) or more of the outstanding

shares, or (iii) beneficial ownership of such entity.

'You' (or 'Your') shall mean an individual or Legal Entity exercising

permissions granted by this License.

'Source' form shall mean the preferred form for making

modifications, including but not limited to software source code,

documentation source, and configuration files.

'Object' form shall mean any form resulting from mechanical

transformation or translation of a Source form, including but not

limited to compiled object code, generated documentation, and

versions to other media types.

Page 92: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Apache

92 版本说明

'Work' shall mean the work of authorship, whether in Source or

Object form, made available under the License, as indicated by a

copyright notice that is included in or attached to the work(an

example is provided in the Appendix below).

'Derivative Works' shall mean any work, whether in Source or

Object form, that is based on (or derived from) the Work and for

which the editorial revisions, annotations, elaborations, or other

modifications represent, as a whole, an original work of authorship.

For the purposes of this License, Derivative Works shall not include

works that remain separable from, or merely link (or bind by name)

to the interfaces of, the Work and Derivative Works thereof.

'Contribution' shall mean any work of authorship, including the

original version of the Work and any modifications or additions to

that Work or Derivative Works thereof, that is intentionally

submitted to Licensor for inclusion in the Work by the copyright

owner or by an individual or Legal Entity authorized to submit on

behalf of the copyright owner. For the purposes of this definition,

'submitted' means any form of electronic, verbal, or written

communication sent to the Licensor or its representatives, including

but not limited to communication on electronic mailing lists, source

code control systems, and issue tracking systems that are

managed by, or on behalf of, the Licensor for the purpose of

discussing and improving the Work, but excluding communication

that is conspicuously marked or otherwise designated in writing by

the copyright owner as 'Not a Contribution.'

'Contributor' shall mean Licensor and any individual or Legal Entity

on behalf of whom a Contribution has been received by Licensor

and subsequently incorporated within the Work.

2. Grant of Copyright License. Subject to the terms and conditions

of this License, each Contributor hereby grants to You a perpetual,

worldwide, non-exclusive, no-charge, royalty-free, irrevocable

copyright license to reproduce, prepare Derivative Works of,

publicly display, publicly perform, sublicense, and distribute the

Work and such Derivative Works in Source or Object form.

Page 93: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Apache

附录 A: 第三方声明 93

3. Grant of Patent License. Subject to the terms and conditions of

this License, each Contributor hereby grants to You a perpetual,

worldwide, non-exclusive, no-charge, royalty-free, irrevocable

(except as stated in this section) patent license to make, have

made, use, offer to sell, sell, import, and otherwise transfer the

Work, where such license applies only to those patent claims

licensable by such Contributor that are necessarily infringed by

their Contribution(s) alone or by combination of their

Contribution(s)with the Work to which such Contribution(s) was

submitted. If You institute patent litigation against any entity

(including a cross-claim or counterclaim in a lawsuit) alleging that

the Work or a Contribution incorporated within the Work constitutes

direct or contributory patent infringement, then any patent licenses

granted to You under this License for that Work shall terminate as

of the date such litigation is filed.

4. Redistribution. You may reproduce and distribute copies of the

Work or Derivative Works thereof in any medium, with or without

modifications, and in Source or Object form, provided that You

meet the following conditions: (a) You must give any other

recipients of the Work or Derivative Works a copy of this License;

and (b) You must cause any modified files to carry prominent

notices stating that You changed the files; and (c) You must retain,

in the Source form of any Derivative Works that You distribute, all

copyright, patent, trademark, and attribution notices from the

Source form of the Work, excluding those notices that do not

pertain to any part of the Derivative Works; and (d) If the Work

includes a 'NOTICE' text file as part of its distribution, then any

Derivative Works that You distribute must include a readable copy

of the attribution notices contained within such NOTICE file,

excluding those notices that do not pertain to any part of the

Derivative Works, in at least one of the following places: within a

NOTICE text file distributed as part of the Derivative Works; within

the Source form or documentation, if provided along with the

Derivative Works; or, within a display generated by the Derivative

Works, if and wherever such third-party notices normally appear.

The contents of the NOTICE file are for informational purposes only

and do not modify the License. You may add Your own attribution

notices within Derivative Works that You distribute, alongside or as

an addendum to the NOTICE text from the Work, provided that

such additional attribution notices cannot be construed as

modifying the License. You may add Your own copyright statement

to Your modifications and may provide additional or different

license terms and conditions for use, reproduction, or distribution

of Your modifications, or for any such Derivative Works as a whole,

provided Your use, reproduction, and distribution of the Work

otherwise complies with the conditions stated in this License.

Page 94: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Apache

94 版本说明

5. Submission of Contributions. Unless You explicitly state

otherwise, any Contribution intentionally submitted for inclusion in

the Work by You to the Licensor shall be under the terms and

conditions of this License, without any additional terms or

conditions. Notwithstanding the above, nothing herein shall

supersede or modify the terms of any separate license agreement

you may have executed with Licensor regarding such Contributions.

6. Trademarks. This License does not grant permission to use the

trade names, trademarks, service marks, or product names of the

Licensor, except as required for reasonable and customary use in

describing the origin of the Work and reproducing the content of

the NOTICE file.

7. Disclaimer of Warranty. Unless required by applicable law or

agreed to in writing, Licensor provides the Work (and each

Contributor provides its Contributions) on an 'AS IS' BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either

express or implied, including, without limitation, any warranties or

conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or

FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible

for determining the appropriateness of using or redistributing the

Work and assume any risks associated with Your exercise of

permissions under this License.

8. Limitation of Liability. In no event and under no legal theory,

whether in tort (including negligence), contract, or otherwise,

unless required by applicable law (such as deliberate and grossly

negligent acts) or agreed to in writing, shall any Contributor be

liable to You for damages, including any direct, indirect, special,

incidental, or consequential damages of any character arising as a

result of this License or out of the use or inability to use the Work

(including but not limited to damages for loss of goodwill, work

stoppage, computer failure or malfunction, or any and all other

commercial damages or losses), even if such Contributor has been

advised of the possibility of such damages.

Page 95: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Apache

附录 A: 第三方声明 95

9. Accepting Warranty or Additional Liability. While redistributing

the Work or Derivative Works thereof, You may choose to offer,

and charge a fee for, acceptance of support, warranty, indemnity,

or other liability obligations and/or rights consistent with this

License. However, in accepting such obligations, You may act only

on Your own behalf and on Your sole responsibility, not on behalf of

any other Contributor, and only if You agree to indemnify, defend,

and hold each Contributor harmless for any liability incurred by, or

claims asserted against, such Contributor by reason of your

accepting any such warranty or additional liability.

APPENDIX: How to apply the Apache License to your work.

To apply the Apache License to your work, attach the following

boilerplate notice, with the fields enclosed by brackets "[]" replaced

with your own identifying information. (Don't include the brackets!)

The text should be enclosed in the appropriate comment syntax for

the file format. We also recommend that a file or class name and

description of purpose be included on the same "printed page" as

the copyright notice for easier identification within third-party

archives.

Copyright [yyyy] [name of copyright owner]

Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either

express or implied. See the License for the specific language

governing permissions and limitations under the License.

Page 96: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

ANTLR 2.7.5H#

96 版本说明

ANTLR 2.7.5H#

Portions of this product include software developed by the

ANTLR.org. The ANTLR software is distributed in accordance with

the following license agreement.

ANTLR 2.7.5H# License

[The BSD License]

Copyright (c) 2005, Terence Parr All rights reserved.

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions

are met: Redistributions of source code must retain the above

copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright

notice, this list of conditions and the following disclaimer in the

documentation and/or other materials provided with the

distribution. Neither the name of the author nor the names of its

contributors may be used to endorse or promote products derived

from this software without specific prior written permission. THIS

SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND

CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY

DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER

IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

OF SUCH DAMAGE.

Page 97: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

ASM 3

附录 A: 第三方声明 97

ASM 3

This product includes ASM v.3, which is distributed in accordance

with the following license:

Copyright (c) 2000-2005 INRIA, France Telecom

All rights reserved.

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions

are met:

1. Redistributions of source code must retain the above copyright

notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above

copyright notice, this list of conditions and the following

disclaimer in the documentation and/or other materials

provided with the distribution.

3. Neither the name of the copyright holders nor the names of its

contributors may be used to endorse or promote products

derived from this software without specific prior written

permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND

CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY

DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER

IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

OF SUCH DAMAGE.

DOM4J

Portions of this product include software developed by the DOM4J

Project (http://dom4j.org/) and is distributed in accordance with

the following license agreement.

Page 98: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

DOM4J

98 版本说明

BSD Style License

Redistribution and use of this software and associated

documentation ("Software"), with or without modification, are

permitted provided that the following conditions are met:

Redistributions of source code must retain copyright statements

and notices.

Redistributions must also contain a copy of this document.

Redistributions in binary form must reproduce the above copyright

notice, this list of conditions and the following disclaimer in the

documentation and/or other materials provided with the

distribution.

The name "DOM4J" must not be used to endorse or promote

products derived from this Software without prior written

permission of MetaStuff, Ltd. For written permission, please contact

[email protected].

Products derived from this Software may not be called "DOM4J" nor

may "DOM4J" appear in their names without prior written

permission of MetaStuff, Ltd. DOM4J is a registered trademark of

MetaStuff, Ltd.

Due credit should be given to the DOM4J Project -

http://www.dom4j.org THIS SOFTWARE IS PROVIDED BY

METASTUFF, LTD. AND CONTRIBUTORS "AS IS" AND ANY

EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY

AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

NO EVENT SHALL METASTUFF, LTD. OR ITS CONTRIBUTORS BE

LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF SUCH DAMAGE.

Copyright 2001-2005 (C) MetaStuff, Ltd. All Rights Reserved.

Page 99: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

HSQLDB 1.7.3

附录 A: 第三方声明 99

HSQLDB 1.7.3

This product includes HSQLDB v.1.7.3, which is distributed in

accordance with the following license:

For content, code, and products originally developed by Thomas

Mueller and the Hypersonic SQL Group:

Copyright (c) 1995-2000 by the Hypersonic SQL Group.

All rights reserved.

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions

are met:

Redistributions of source code must retain the above copyright

notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright

notice, this list of conditions and the following disclaimer in the

documentation and/or other materials provided with the

distribution.

Neither the name of the Hypersonic SQL Group nor the names of its

contributors may be used to endorse or promote products derived

from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND

CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

HYPERSONIC SQL GROUP, OR CONTRIBUTORS BE LIABLE FOR ANY

DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER

IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

OF SUCH DAMAGE.

This software consists of voluntary contributions made by many

individuals on behalf of the Hypersonic SQL Group.

For work added by the HSQL Development Group (a.k.a.

hsqldb_lic.txt): Copyright (c) 2001-2005, The HSQL Development

Group All rights reserved.

Page 100: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

HSQLDB 1.7.3

100 版本说明

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions

are met:

Redistributions of source code must retain the above copyright

notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright

notice, this list of conditions and the following disclaimer in the

documentation and/or other materials provided with the

distribution.

Neither the name of the HSQL Development Group nor the names

of its contributors may be used to endorse or promote products

derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND

CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL

HSQL DEVELOPMENT GROUP, HSQLDB.ORG, OR CONTRIBUTORS

BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF SUCH DAMAGE.

Page 101: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

HSQLDB 1.8.0

附录 A: 第三方声明 101

HSQLDB 1.8.0

This product includes HSQLDB v.1.8.0, which is distributed in

accordance with the following license:

For content, code, and products originally developed by Thomas

Mueller and the Hypersonic SQL Group:

Copyright (c) 1995-2000 by the Hypersonic SQL Group.

All rights reserved.

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions

are met:

Redistributions of source code must retain the above copyright

notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright

notice, this list of conditions and the following disclaimer in the

documentation and/or other materials provided with the

distribution.

Neither the name of the Hypersonic SQL Group nor the names of its

contributors may be used to endorse or promote products derived

from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND

CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

HYPERSONIC SQL GROUP, OR CONTRIBUTORS BE LIABLE FOR ANY

DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER

IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

OF SUCH DAMAGE.

This software consists of voluntary contributions made by many

individuals on behalf of the Hypersonic SQL Group.

For work added by the HSQL Development Group (a.k.a.

hsqldb_lic.txt): Copyright (c) 2001-2005, The HSQL Development

Group All rights reserved.

Page 102: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

IBM DB2 Driver for JDBC and SQLJ

102 版本说明

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions

are met:

Redistributions of source code must retain the above copyright

notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright

notice, this list of conditions and the following disclaimer in the

documentation and/or other materials provided with the

distribution.

Neither the name of the HSQL Development Group nor the names

of its contributors may be used to endorse or promote products

derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND

CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL

HSQL DEVELOPMENT GROUP, HSQLDB.ORG, OR CONTRIBUTORS

BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF SUCH DAMAGE.

IBM DB2 Driver for JDBC and SQLJ

"CONTAINS Runtime Modules of IBM DB2 Driver for JDBC and SQLJ

(c) Copyright IBM Corporation 2006 All Rights Reserved"

Jaxen 1.3

Portions of this product include software developed by the Jaxen

Project (http://www.jaxen.org/) and is distributed in accordance

with the following license agreement.

/*

$Id: LICENSE.txt,v 1.3 2003/06/29 18:22:02 ssanders Exp $

Copyright 2003 (C) The Werken Company. All Rights Reserved.

Page 103: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Jaxen 1.3

附录 A: 第三方声明 103

Redistribution and use of this software and associated

documentation ("Software"), with or without modification, are

permitted provided that the following conditions are met:

1. Redistributions of source code must retain copyright statements

and notices. Redistributions must also contain a copy of this

document.

2. Redistributions in binary form must reproduce the above

copyright notice, this list of conditions and the following disclaimer

in the documentation and/or other materials provided with the

distribution.

3. The name "jaxen" must not be used to endorse or promote

products derived from this Software without prior written

permission of The Werken Company. For written permission, please

contact [email protected].

4. Products derived from this Software may not be called "jaxen"

nor may "jaxen" appear in their names without prior written

permission of The Werken Company. "jaxen" is a registered

trademark of The Werken Company.

5. Due credit should be given to The Werken Company.

(http://jaxen.werken.com/).

THIS SOFTWARE IS PROVIDED BY THE WERKEN COMPANY AND

CONTRIBUTORS "AS IS" AND ANY EXPRESSED OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

WERKEN COMPANY OR ITS CONTRIBUTORS BE LIABLE FOR ANY

DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER

IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

OF SUCH DAMAGE.

*/

Page 104: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

JDOM 1.11

104 版本说明

JDOM 1.11

This product includes software developed by the JDOM Project

(http://www.jdom.org/). The JDOM software is distributed in

accordance with the following license agreement.

$Id: LICENSE.txt,v 1.11 2004/02/06 09:32:57 jhunter Exp $

Copyright (C) 2000-2004 Jason Hunter & Brett McLaughlin. All

rights reserved.

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions

are met:

1. Redistributions of source code must retain the above copyright

notice, this list of conditions, and the following disclaimer.

2. Redistributions in binary form must reproduce the above

copyright notice, this list of conditions, and the disclaimer that

follows these conditions in the documentation and/or other

materials provided with the distribution.

3. The name "JDOM" must not be used to endorse or promote

products derived from this software without prior written

permission. For written permission, please contact .

4. Products derived from this software may not be called "JDOM",

nor may "JDOM" appear in their name, without prior written

permission from the JDOM Project Management . In addition, we

request (but do not require) that you include in the end-user

documentation provided with the redistribution and/or in the

software itself an acknowledgement equivalent to the following:

"This product includes software developed by the JDOM Project

(http://www.jdom.org/)." Alternatively, the acknowledgment may

be graphical using the logos available at

http://www.jdom.org/images/logos.

THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR

IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

JDOM AUTHORS OR THE PROJECT CONTRIBUTORS BE LIABLE FOR

ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER

IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

OF SUCH DAMAGE.

Page 105: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

JSON 1.0

附录 A: 第三方声明 105

This software consists of voluntary contributions made by many

individuals on behalf of the JDOM Project and was originally created

by Jason Hunter and Brett McLaughlin . For more information on

the JDOM Project, please see .

JSON 1.0

Portions of this product include software developed by JSON.org.

The JSON software is distributed in accordance with the following

license agreement.

Copyright (c) 2002 JSON.org

Permission is hereby granted, free of charge, to any person

obtaining a copy of this software and associated documentation

files (the "Software"), to deal in the Software without restriction,

including without limitation the rights to use, copy, modify, merge,

publish, distribute, sublicense, and/or sell copies of the Software,

and to permit persons to whom the Software is furnished to do so,

subject to the following conditions:

The above copyright notice and this permission notice shall be

included in all copies or substantial portions of the Software.

The Software shall be used for Good, not Evil.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF

ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED

TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A

PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT

SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR

ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE

OR OTHER DEALINGS IN THE SOFTWARE.

jtopen 5.1.1

JTOpen is distributed by CA for use with the CA product without

any Contribution or change, addition or modification to the Program.

The source code for JTOpen may be found here

http://prdownloads.sourceforge.net/jt400/jtopen_5_1_1_source.zip

?download or here http://opensrcd.ca.com/ips/3279_1.

Page 106: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

libcurl 7.15.0

106 版本说明

libcurl 7.15.0

Copyright - License

Curl and libcurl are true Open Source/Free Software and meet all

definitions as such. It means that you are free to modify and

redistribute all contents of the curl distributed archives. You may

also freely use curl and libcurl in your commercial projects. Curl

and libcurl are licensed under a MIT/X derivate license, see below.

Curl and libcurl does not contain any GPL source. I don't agree with

the "viral" aspects of GPL. Another reason it doesn't contain GPL

source is that it would limit users of libcurl. There are other

computer-related projects using the name curl as well. For details,

check out our position on the curl name issue.

COPYRIGHT AND PERMISSION NOTICE Copyright (c) 1996 - 2004,

Daniel Stenberg, .

All rights reserved.

Permission to use, copy, modify, and distribute this software for

any purpose with or without fee is hereby granted, provided that

the above copyright notice and this permission notice appear in all

copies.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF

ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED

TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A

PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY

RIGHTS. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT

HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR

OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH

THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

SOFTWARE.

Except as contained in this notice, the name of a copyright holder

shall not be used in advertising or otherwise to promote the sale,

use or other dealings in this Software without prior written

authorization of the copyright holder.

Page 107: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

MX4J 3.0.2

附录 A: 第三方声明 107

MX4J 3.0.2

This product includes software developed by the MX4J project

(http://mx4j.sourceforge.net)." The MX4J software is distributed in

accordance with the following license agreement.

/*

=========================================

===========================

* The MX4J License, Version 1.0

*

* Copyright (c) 2001-2004 by the MX4J contributors. All rights

reserved.

*

* Redistribution and use in source and binary forms, with or

without

* modification, are permitted provided that the following conditions

* are met:

*

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

*

* 2. Redistributions in binary form must reproduce the above

copyright

* notice, this list of conditions and the following disclaimer in

* the documentation and/or other materials provided with the

* distribution.

*

* 3. The end-user documentation included with the redistribution,

* if any, must include the following acknowledgment:

* "This product includes software developed by the

* MX4J project (http://mx4j.sourceforge.net)."

Page 108: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

MX4J 3.0.2

108 版本说明

* Alternately, this acknowledgment may appear in the software

itself,

* if and wherever such third-party acknowledgments normally

appear.

*

* 4. The name "MX4J" must not be used to endorse or promote

* products derived from this software without prior written

* permission.

* For written permission, please contact

[email protected]

*

* 5. Products derived from this software may not be called "MX4J",

* nor may "MX4J" appear in their name, without prior written

* permission of Simone Bordet.

*

* THIS SOFTWARE IS PROVIDED ``AS IS|&"&| AND ANY

EXPRESSED OR IMPLIED

* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES

* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

PURPOSE ARE

* DISCLAIMED. IN NO EVENT SHALL THE MX4J CONTRIBUTORS

* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

(INCLUDING, BUT NOT

* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

SERVICES; LOSS OF

* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND

* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

LIABILITY,

Page 109: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Oracle JDBC Driver 10g Release 2

附录 A: 第三方声明 109

* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING

IN ANY WAY OUT

* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF

* SUCH DAMAGE.

*

=========================================

===========================

*

* This software consists of voluntary contributions made by many

* individuals on behalf of the MX4J project. For more information

on

* MX4J, please see

* http://mx4j.sourceforge.net.

*/

Oracle JDBC Driver 10g Release 2

This Product is distributed with Oracle JDBC Driver 10G Release 2

(10.2.0.1.0)from Oracle USA, Inc. (?Oracle?) The following

additional terms and conditions apply to your use of the Oracle

software product ("Oracle Product"):

(1) you may only use the Oracle Product to run the CA Product; (2)

to the extent permitted by applicable law, Oracle disclaims liability

for any damages, whether direct, indirect, incidental, or

consequential, arising from your use of the Oracle Product; (3) at

the termination of this Agreement, you must discontinue use and

destroy or return to CA all copies of the Product; (4) Oracle is not

obligated to provide technical support, phone support, or updates

to the Oracle Product hereunder; (5) CA reserves the right to audit

your use of the Oracle Product and report such use to Oracle or to

assign this right to audit your use of the Oracle Product to Oracle;

(6) Oracle shall be a third party beneficiary of this Agreement.

Page 110: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.5R5

110 版本说明

Rhino 1.5R5

Rhino 1.5R5

Rhino is distributed by CA for use with this CA product in

unmodified, object code form in accordance with the Netscape

Public License 1.0. Source code for Rhino may be obtained from its

authors at http://www.mozilla.org/rhino/download.html. Any

provisions in the CA license agreement that differ from the NPL are

offered by CA alone and not by any other party.

NETSCAPE PUBLIC LICENSE

Version 1.0

---------------------------------------------------------------------------

-----

1. Definitions.

1.1. ``Contributor|&"&| means each entity that creates or

contributes to the creation of Modifications.

1.2. ``Contributor Version|&"&| means the combination of the

Original Code, prior Modifications used by a Contributor, and the

Modifications made by that particular Contributor.

1.3. ``Covered Code|&"&| means the Original Code or

Modifications or the combination of the Original Code and

Modifications, in each case including portions thereof.

1.4. ``Electronic Distribution Mechanism|&"&| means a mechanism

generally accepted in the software development community for the

electronic transfer of data.

1.5. ``Executable|&"&| means Covered Code in any form other

than Source Code.

1.6. ``Initial Developer|&"&| means the individual or entity

identified as the Initial Developer in the Source Code notice

required by Exhibit A.

1.7. ``Larger Work|&"&| means a work which combines Covered

Code or portions thereof with code not governed by the terms of

this License.

1.8. ``License|&"&| means this document.

Page 111: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.5R5

附录 A: 第三方声明 111

1.9. ``Modifications|&"&| means any addition to or deletion from

the substance or structure of either the Original Code or any

previous Modifications. When Covered Code is released as a series

of files, a Modification is: A. Any addition to or deletion from the

contents of a file containing Original Code or previous Modifications.

B. Any new file that contains any part of the Original Code or

previous Modifications.

1.10. ``Original Code|&"&| means Source Code of computer

software code which is described in the Source Code notice

required by Exhibit A as Original Code, and which, at the time of its

release under this License is not already Covered Code governed by

this License.

1.11. ``Source Code|&"&| means the preferred form of the

Covered Code for making modifications to it, including all modules

it contains, plus any associated interface definition files, scripts

used to control compilation and installation of an Executable, or a

list of source code differential comparisons against either the

Original Code or another well known, available Covered Code of the

Contributor's choice. The Source Code can be in a compressed or

archival form, provided the appropriate decompression or

de-archiving software is widely available for no charge.

1.12. ``You|&"&| means an individual or a legal entity exercising

rights under, and complying with all of the terms of, this License or

a future version of this License issued under Section 6.1. For legal

entities, ``You|&"&| includes any entity which controls, is

controlled by, or is under common control with You. For purposes

of this definition, ``control|&"&| means (a) the power, direct or

indirect, to cause the direction or management of such entity,

whether by contract or otherwise, or (b) ownership of fifty percent

(50%) or more of the outstanding shares or beneficial ownership of

such entity.

2. Source Code License.

2.1. The Initial Developer Grant. The Initial Developer hereby

grants You a world-wide, royalty-free, non-exclusive license,

subject to third party intellectual property claims: (a) to use,

reproduce, modify, display, perform, sublicense and distribute the

Original Code (or portions thereof) with or without Modifications, or

as part of a Larger Work; and (b) under patents now or hereafter

owned or controlled by Initial Developer, to make, have made, use

and sell (``Utilize|&"&|) the Original Code (or portions thereof),

but solely to the extent that any such patent is reasonably

necessary to enable You to Utilize the Original Code (or portions

thereof) and not to any greater extent that may be necessary to

Utilize further Modifications or combinations.

2.2. Contributor Grant. Each Contributor hereby grants You a

world-wide, royalty-free, non-exclusive license, subject to third

party intellectual property claims:

Page 112: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.5R5

112 版本说明

(a) to use, reproduce, modify, display, perform, sublicense and

distribute the Modifications created by such Contributor (or portions

thereof) either on an unmodified basis, with other Modifications, as

Covered Code or as part of a Larger Work; and

(b) under patents now or hereafter owned or controlled by

Contributor, to Utilize the Contributor Version (or portions thereof),

but solely to the extent that any such patent is reasonably

necessary to enable You to Utilize the Contributor Version (or

portions thereof), and not to any greater extent that may be

necessary to Utilize further Modifications or combinations.

3. Distribution Obligations.

3.1. Application of License. The Modifications which You create or to

which You contribute are governed by the terms of this License,

including without limitation Section 2.2. The Source Code version of

Covered Code may be distributed only under the terms of this

License or a future version of this License released under Section

6.1, and You must include a copy of this License with every copy of

the Source Code You distribute. You may not offer or impose any

terms on any Source Code version that alters or restricts the

applicable version of this License or the recipients' rights hereunder.

However, You may include an additional document offering the

additional rights described in Section 3.5.

3.2. Availability of Source Code. Any Modification which You create

or to which You contribute must be made available in Source Code

form under the terms of this License either on the same media as

an Executable version or via an accepted Electronic Distribution

Mechanism to anyone to whom you made an Executable version

available; and if made available via Electronic Distribution

Mechanism, must remain available for at least twelve (12) months

after the date it initially became available, or at least six (6)

months after a subsequent version of that particular Modification

has been made available to such recipients. You are responsible for

ensuring that the Source Code version remains available even if the

Electronic Distribution Mechanism is maintained by a third party.

3.3. Description of Modifications. You must cause all Covered Code

to which you contribute to contain a file documenting the changes

You made to create that Covered Code and the date of any change.

You must include a prominent statement that the Modification is

derived, directly or indirectly, from Original Code provided by the

Initial Developer and including the name of the Initial Developer in

(a) the Source Code, and (b) in any notice in an Executable version

or related documentation in which You describe the origin or

ownership of the Covered Code.

3.4. Intellectual Property Matters

Page 113: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.5R5

附录 A: 第三方声明 113

(a) Third Party Claims. If You have knowledge that a party claims

an intellectual property right in particular functionality or code (or

its utilization under this License), you must include a text file with

the source code distribution titled ``LEGAL|&"&| which describes

the claim and the party making the claim in sufficient detail that a

recipient will know whom to contact. If you obtain such knowledge

after You make Your Modification available as described in Section

3.2, You shall promptly modify the LEGAL file in all copies You

make available thereafter and shall take other steps (such as

notifying appropriate mailing lists or newsgroups) reasonably

calculated to inform those who received the Covered Code that new

knowledge has been obtained.

(b) Contributor APIs. If Your Modification is an application

programming interface and You own or control patents which are

reasonably necessary to implement that API, you must also include

this information in the LEGAL file.

3.5. Required Notices. You must duplicate the notice in Exhibit A in

each file of the Source Code, and this License in any documentation

for the Source Code, where You describe recipients' rights relating

to Covered Code. If You created one or more Modification(s), You

may add your name as a Contributor to the notice described in

Exhibit A. If it is not possible to put such notice in a particular

Source Code file due to its structure, then you must include such

notice in a location (such as a relevant directory file) where a user

would be likely to look for such a notice. You may choose to offer,

and to charge a fee for, warranty, support, indemnity or liability

obligations to one or more recipients of Covered Code. However,

You may do so only on Your own behalf, and not on behalf of the

Initial Developer or any Contributor. You must make it absolutely

clear than any such warranty, support, indemnity or liability

obligation is offered by You alone, and You hereby agree to

indemnify the Initial Developer and every Contributor for any

liability incurred by the Initial Developer or such Contributor as a

result of warranty, support, indemnity or liability terms You offer.

Page 114: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.5R5

114 版本说明

3.6. Distribution of Executable Versions. You may distribute

Covered Code in Executable form only if the requirements of

Section 3.1-3.5 have been met for that Covered Code, and if You

include a notice stating that the Source Code version of the

Covered Code is available under the terms of this License, including

a description of how and where You have fulfilled the obligations of

Section 3.2. The notice must be conspicuously included in any

notice in an Executable version, related documentation or collateral

in which You describe recipients' rights relating to the Covered

Code. You may distribute the Executable version of Covered Code

under a license of Your choice, which may contain terms different

from this License, provided that You are in compliance with the

terms of this License and that the license for the Executable version

does not attempt to limit or alter the recipient's rights in the Source

Code version from the rights set forth in this License. If You

distribute the Executable version under a different license You must

make it absolutely clear that any terms which differ from this

License are offered by You alone, not by the Initial Developer or

any Contributor. You hereby agree to indemnify the Initial

Developer and every Contributor for any liability incurred by the

Initial Developer or such Contributor as a result of any such terms

You offer.

3.7. Larger Works. You may create a Larger Work by combining

Covered Code with other code not governed by the terms of this

License and distribute the Larger Work as a single product. In such

a case, You must make sure the requirements of this License are

fulfilled for the Covered Code.

4. Inability to Comply Due to Statute or Regulation. If it is

impossible for You to comply with any of the terms of this License

with respect to some or all of the Covered Code due to statute or

regulation then You must:

(a) comply with the terms of this License to the maximum extent

possible; and

(b) describe the limitations and the code they affect. Such

description must be included in the LEGAL file described in Section

3.4 and must be included with all distributions of the Source Code.

Except to the extent prohibited by statute or regulation, such

description must be sufficiently detailed for a recipient of ordinary

skill to be able to understand it.

5. Application of this License. This License applies to code to which

the Initial Developer has attached the notice in Exhibit A, and to

related Covered Code.

6. Versions of the License.

Page 115: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.5R5

附录 A: 第三方声明 115

6.1. New Versions. Netscape Communications Corporation

(``Netscape|&"&|) may publish revised and/or new versions of the

License from time to time. Each version will be given a

distinguishing version number.

6.2. Effect of New Versions. Once Covered Code has been published

under a particular version of the License, You may always continue

to use it under the terms of that version. You may also choose to

use such Covered Code under the terms of any subsequent version

of the License published by Netscape. No one other than Netscape

has the right to modify the terms applicable to Covered Code

created under this License.

6.3. Derivative Works. If you create or use a modified version of

this License (which you may only do in order to apply it to code

which is not already Covered Code governed by this License), you

must (a) rename Your license so that the phrases ``Mozilla|&"&|,

``MOZILLAPL|&"&|, ``MOZPL|&"&|, ``Netscape|&"&|, ``NPL|&"&|

or any confusingly similar phrase do not appear anywhere in your

license and (b) otherwise make it clear that your version of the

license contains terms which differ from the Mozilla Public License

and Netscape Public License. (Filling in the name of the Initial

Developer, Original Code or Contributor in the notice described in

Exhibit A shall not of themselves be deemed to be modifications of

this License.)

7. DISCLAIMER OF WARRANTY. COVERED CODE IS PROVIDED

UNDER THIS LICENSE ON AN ``AS IS|&"&| BASIS, WITHOUT

WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,

INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT THE

COVERED CODE IS FREE OF DEFECTS, MERCHANTABLE, FIT FOR A

PARTICULAR PURPOSE OR NON-INFRINGING. THE ENTIRE RISK AS

TO THE QUALITY AND PERFORMANCE OF THE COVERED CODE IS

WITH YOU. SHOULD ANY COVERED CODE PROVE DEFECTIVE IN

ANY RESPECT, YOU (NOT THE INITIAL DEVELOPER OR ANY OTHER

CONTRIBUTOR) ASSUME THE COST OF ANY NECESSARY

SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER OF

WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS LICENSE.

NO USE OF ANY COVERED CODE IS AUTHORIZED HEREUNDER

EXCEPT UNDER THIS DISCLAIMER.

8. TERMINATION. This License and the rights granted hereunder

will terminate automatically if You fail to comply with terms herein

and fail to cure such breach within 30 days of becoming aware of

the breach. All sublicenses to the Covered Code which are properly

granted shall survive any termination of this License. Provisions

which, by their nature, must remain in effect beyond the

termination of this License shall survive.

Page 116: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.5R5

116 版本说明

9. LIMITATION OF LIABILITY. UNDER NO CIRCUMSTANCES AND

UNDER NO LEGAL THEORY, WHETHER TORT (INCLUDING

NEGLIGENCE), CONTRACT, OR OTHERWISE, SHALL THE INITIAL

DEVELOPER, ANY OTHER CONTRIBUTOR, OR ANY DISTRIBUTOR OF

COVERED CODE, OR ANY SUPPLIER OF ANY OF SUCH PARTIES, BE

LIABLE TO YOU OR ANY OTHER PERSON FOR ANY INDIRECT,

SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY

CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR

LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR

MALFUNCTION, OR ANY AND ALL OTHER COMMERCIAL DAMAGES

OR LOSSES, EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED

OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF

LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR

PERSONAL INJURY RESULTING FROM SUCH PARTY'S NEGLIGENCE

TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH LIMITATION.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR

LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO

THAT EXCLUSION AND LIMITATION MAY NOT APPLY TO YOU.

10. U.S. GOVERNMENT END USERS. The Covered Code is a

``commercial item,|&"&| as that term is defined in 48 C.F.R. 2.101

(Oct. 1995), consisting of ``commercial computer software|&"&|

and ``commercial computer software documentation,|&"&| as such

terms are used in 48 C.F.R. 12.212 (Sept. 1995). Consistent with

48 C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through 227.7202-4

(June 1995), all U.S. Government End Users acquire Covered Code

with only those rights set forth herein.

11. MISCELLANEOUS. This License represents the complete

agreement concerning subject matter hereof. If any provision of

this License is held to be unenforceable, such provision shall be

reformed only to the extent necessary to make it enforceable. This

License shall be governed by California law provisions (except to

the extent applicable law, if any, provides otherwise), excluding its

conflict-of-law provisions. With respect to disputes in which at least

one party is a citizen of, or an entity chartered or registered to do

business in, the United States of America: (a) unless otherwise

agreed in writing, all disputes relating to this License (excepting

any dispute relating to intellectual property rights) shall be subject

to final and binding arbitration, with the losing party paying all

costs of arbitration; (b) any arbitration relating to this Agreement

shall be held in Santa Clara County, California, under the auspices

of JAMS/EndDispute; and (c) any litigation relating to this

Agreement shall be subject to the jurisdiction of the Federal Courts

of the Northern District of California, with venue lying in Santa

Clara County, California, with the losing party responsible for costs,

including without limitation, court costs and reasonable attorneys

fees and expenses. The application of the United Nations

Convention on Contracts for the International Sale of Goods is

expressly excluded. Any law or regulation which provides that the

language of a contract shall be construed against the drafter shall

not apply to this License.

Page 117: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.5R5

附录 A: 第三方声明 117

12. RESPONSIBILITY FOR CLAIMS. Except in cases where another

Contributor has failed to comply with Section 3.4, You are

responsible for damages arising, directly or indirectly, out of Your

utilization of rights under this License, based on the number of

copies of Covered Code you made available, the revenues you

received from utilizing such rights, and other relevant factors. You

agree to work with affected parties to distribute responsibility on an

equitable basis.

AMENDMENTS

Additional Terms applicable to the Netscape Public License.

I. Effect. These additional terms described in this Netscape Public

License -- Amendments shall apply to the Mozilla Communicator

client code and to all Covered Code under this License.

II. ``Netscape's Branded Code|&"&| means Covered Code that

Netscape distributes and/or permits others to distribute under one

or more trademark(s) which are controlled by Netscape but which

are not licensed for use under this License.

III. Netscape and logo. This License does not grant any rights to

use the trademark ``Netscape|&"&|, the ``Netscape N and

horizon|&"&| logo or the Netscape lighthouse logo, even if such

marks are included in the Original Code.

IV. Inability to Comply Due to Contractual Obligation. Prior to

licensing the Original Code under this License, Netscape has

licensed third party code for use in Netscape's Branded Code. To

the extent that Netscape is limited contractually from making such

third party code available under this License, Netscape may choose

to reintegrate such code into Covered Code without being required

to distribute such code in Source Code form, even if such code

would otherwise be considered ``Modifications|&"&| under this

License.

V. Use of Modifications and Covered Code by Initial Developer.

V.1. In General.

The obligations of Section 3 apply to Netscape, except to the extent

specified in this Amendment, Section V.2 and V.3.

V.2. Other Products. Netscape may include Covered Code in

products other than the Netscape's Branded Code which are

released by Netscape during the two (2) years following the release

date of the Original Code, without such additional products

becoming subject to the terms of this License, and may license

such additional products on different terms from those contained in

this License.

Page 118: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.5R5

118 版本说明

V.3. Alternative Licensing. Netscape may license the Source Code

of Netscape's Branded Code, including Modifications incorporated

therein, without such additional products becoming subject to the

terms of this License, and may license such additional products on

different terms from those contained in this License.

VI. Arbitration and Litigation. Notwithstanding the limitations of

Section 11 above, the provisions regarding arbitration and litigation

in Section 11(a), (b) and (c) of the License shall apply to all

disputes relating to this License.

EXHIBIT A.

``The contents of this file are subject to the Netscape Public

License Version 1.0 (the "License"); you may not use this file

except in compliance with the License. You may obtain a copy of

the License at http://www.mozilla.org/NPL/ Software distributed

under the License is distributed on an "AS IS" basis, WITHOUT

WARRANTY OF ANY KIND, either express or implied. See the

License for the specific language governing rights and limitations

under the License.

The Original Code is Mozilla Communicator client code, released

March 31, 1998.

The Initial Developer of the Original Code is Netscape

Communications Corporation. Portions created by Netscape are

Copyright (C) 1998 Netscape Communications Corporation. All

Rights Reserved.

Contributor(s):

______________________________________.|&"&|

[NOTE: The text of this Exhibit A may differ slightly from the text of

the notices in the Source Code files of the Original Code. This is

due to time constraints encountered in simultaneously finalizing the

License and in preparing the Original Code for release. You should

use the text of this Exhibit A rather than the text found in the

Original Code Source Code for Your Modifications.]

Page 119: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

附录 A: 第三方声明 119

Rhino 1.7R1

Rhino 1.7R1

Rhino is distributed by CA for use with this CA product in

unmodified, object code form in accordance with the Mozilla Public

License 1.1. Source code for Rhino may be obtained from its

authors at http://www.mozilla.org/rhino/download.html. Any

provisions in the CA license agreement that differ from the MPL are

offered by CA alone and not by any other party.

MOZILLA PUBLIC LICENSE

Version 1.1

1. Definitions.

1.0.1. "Commercial Use" means distribution or otherwise making

the Covered Code available to a third party.

1.1. "Contributor" means each entity that creates or contributes to

the creation of Modifications.

1.2. "Contributor Version" means the combination of the Original

Code, prior Modifications used by a Contributor, and the

Modifications made by that particular Contributor.

1.3. "Covered Code" means the Original Code or Modifications or

the combination of the Original Code and Modifications, in each

case including portions thereof.

1.4. "Electronic Distribution Mechanism" means a mechanism

generally accepted in the software development community for the

electronic transfer of data.

1.5. "Executable" means Covered Code in any form other than

Source Code.

1.6. "Initial Developer" means the individual or entity identified as

the Initial Developer in the Source Code notice required by Exhibit

A.

1.7. "Larger Work" means a work which combines Covered Code or

portions thereof with code not governed by the terms of this

License.

1.8. "License" means this document.

1.8.1. "Licensable" means having the right to grant, to the

maximum extent possible, whether at the time of the initial grant

or subsequently acquired, any and all of the rights conveyed

herein.

Page 120: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

120 版本说明

1.9. "Modifications" means any addition to or deletion from the

substance or structure of either the Original Code or any previous

Modifications. When Covered Code is released as a series of files, a

Modification is:

A. Any addition to or deletion from the contents of a file containing

Original Code or previous Modifications.

B. Any new file that contains any part of the Original Code or

previous Modifications.

1.10. "Original Code" means Source Code of computer software

code which is described in the Source Code notice required by

Exhibit A as Original Code, and which, at the time of its release

under this License is not already Covered Code governed by this

License.

1.10.1. "Patent Claims" means any patent claim(s), now owned or

hereafter acquired, including without limitation, method, process,

and apparatus claims, in any patent Licensable by grantor.

1.11. "Source Code" means the preferred form of the Covered Code

for making modifications to it, including all modules it contains,

plus any associated interface definition files, scripts used to control

compilation and installation of an Executable, or source code

differential comparisons against either the Original Code or another

well known, available Covered Code of the Contributor's choice. The

Source Code can be in a compressed or archival form, provided the

appropriate decompression or de-archiving software is widely

available for no charge.

1.12. "You" (or "Your") means an individual or a legal entity

exercising rights under, and complying with all of the terms of, this

License or a future version of this License issued under Section 6.1.

For legal entities, "You" includes any entity which controls, is

controlled by, or is under common control with You. For purposes

of this definition, "control" means (a) the power, direct or indirect,

to cause the direction or management of such entity, whether by

contract or otherwise, or (b) ownership of more than fifty percent

(50%) of the outstanding shares or beneficial ownership of such

entity.

2. Source Code License.

2.1. The Initial Developer Grant.

The Initial Developer hereby grants You a world-wide, royalty-free,

non-exclusive license, subject to third party intellectual property

claims:

(a) under intellectual property rights (other than patent

or

Page 121: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

附录 A: 第三方声明 121

trademark) Licensable by Initial Developer to use,

reproduce,

modify, display, perform, sublicense and distribute the

Original

Code (or portions thereof) with or without Modifications,

and/or

as part of a Larger Work; and

(b) under Patents Claims infringed by the making, using

or

selling of Original Code, to make, have made, use,

practice,

sell, and offer for sale, and/or otherwise dispose of the

Original Code (or portions thereof).

(c) the licenses granted in this Section 2.1(a) and (b) are

effective on the date Initial Developer first distributes

Original Code under the terms of this License.

(d) Notwithstanding Section 2.1(b) above, no patent

license is

granted: 1) for code that You delete from the Original

Code; 2)

separate from the Original Code; or 3) for infringements

caused

by: i) the modification of the Original Code or ii) the

combination of the Original Code with other software or

devices.

2.2. Contributor Grant.

Subject to third party intellectual property claims, each Contributor

hereby grants You a world-wide, royalty-free, non-exclusive license

(a) under intellectual property rights (other than patent

or

trademark) Licensable by Contributor, to use, reproduce,

modify,

Page 122: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

122 版本说明

display, perform, sublicense and distribute the

Modifications

created by such Contributor (or portions thereof) either

on an

unmodified basis, with other Modifications, as Covered

Code

and/or as part of a Larger Work; and

(b) under Patent Claims infringed by the making, using,

or

selling of Modifications made by that Contributor either

alone

and/or in combination with its Contributor Version (or

portions

of such combination), to make, use, sell, offer for sale,

have

made, and/or otherwise dispose of: 1) Modifications

made by that

Contributor (or portions thereof); and 2) the combination

of

Modifications made by that Contributor with its

Contributor

Version (or portions of such combination).

(c) the licenses granted in Sections 2.2(a) and 2.2(b) are

effective on the date Contributor first makes Commercial

Use of

the Covered Code.

(d) Notwithstanding Section 2.2(b) above, no patent

license is

granted: 1) for any code that Contributor has deleted

from the

Contributor Version; 2) separate from the Contributor

Version;

3) for infringements caused by: i) third party

modifications of

Page 123: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

附录 A: 第三方声明 123

Contributor Version or ii) the combination of

Modifications made

by that Contributor with other software (except as part

of the

Contributor Version) or other devices; or 4) under Patent

Claims

infringed by Covered Code in the absence of Modifications

made by

that Contributor.

3. Distribution Obligations.

3.1. Application of License.

The Modifications which You create or to which You contribute are

governed by the terms of this License, including without limitation

Section 2.2. The Source Code version of Covered Code may be

distributed only under the terms of this License or a future version

of this License released under Section 6.1, and You must include a

copy of this License with every copy of the Source Code You

distribute. You may not offer or impose any terms on any Source

Code version that alters or restricts the applicable version of this

License or the recipients' rights hereunder. However, You may

include an additional document offering the additional rights

described in Section 3.5.

3.2. Availability of Source Code.

Any Modification which You create or to which You contribute must

be made available in Source Code form under the terms of this

License either on the same media as an Executable version or via

an accepted Electronic Distribution Mechanism to anyone to whom

you made an Executable version available; and if made available

via Electronic Distribution Mechanism, must remain available for at

least twelve (12) months after the date it initially became available,

or at least six (6) months after a subsequent version of that

particular Modification has been made available to such recipients.

You are responsible for ensuring that the Source Code version

remains available even if the Electronic Distribution Mechanism is

maintained by a third party.

3.3. Description of Modifications.

Page 124: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

124 版本说明

You must cause all Covered Code to which You contribute to

contain a file documenting the changes You made to create that

Covered Code and the date of any change. You must include a

prominent statement that the Modification is derived, directly or

indirectly, from Original Code provided by the Initial Developer and

including the name of the Initial Developer in (a) the Source Code,

and (b) in any notice in an Executable version or related

documentation in which You describe the origin or ownership of the

Covered Code.

3.4. Intellectual Property Matters

(a) Third Party Claims.

If Contributor has knowledge that a license under a third

party's

intellectual property rights is required to exercise the

rights

granted by such Contributor under Sections 2.1 or 2.2,

Contributor must include a text file with the Source Code

distribution titled "LEGAL" which describes the claim and

the

party making the claim in sufficient detail that a recipient

will

know whom to contact. If Contributor obtains such

knowledge after

the Modification is made available as described in Section

3.2,

Contributor shall promptly modify the LEGAL file in all

copies

Contributor makes available thereafter and shall take

other steps

(such as notifying appropriate mailing lists or

newsgroups)

reasonably calculated to inform those who received the

Covered

Code that new knowledge has been obtained.

(b) Contributor APIs.

Page 125: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

附录 A: 第三方声明 125

If Contributor's Modifications include an application

programming

interface and Contributor has knowledge of patent

licenses which

are reasonably necessary to implement that API,

Contributor must

also include this information in the LEGAL file.

(c) Representations.

Contributor represents that, except as disclosed pursuant

to

Section 3.4(a) above, Contributor believes that

Contributor's

Modifications are Contributor's original creation(s) and/or

Contributor has sufficient rights to grant the rights

conveyed by

this License.

3.5. Required Notices.

You must duplicate the notice in Exhibit A in each file of the Source

Code. If it is not possible to put such notice in a particular Source

Code file due to its structure, then You must include such notice in

a location (such as a relevant directory) where a user would be

likely to look for such a notice. If You created one or more

Modification(s) You may add your name as a Contributor to the

notice described in Exhibit A. You must also duplicate this License

in any documentation for the Source Code where You describe

recipients' rights or ownership rights relating to Covered Code.

You may choose to offer, and to charge a fee for, warranty, support,

indemnity or liability obligations to one or more recipients of

Covered Code. However, You may do so only on Your own behalf,

and not on behalf of the Initial Developer or any Contributor. You

must make it absolutely clear than any such warranty, support,

indemnity or liability obligation is offered by You alone, and You

hereby agree to indemnify the Initial Developer and every

Contributor for any liability incurred by the Initial Developer or such

Contributor as a result of warranty, support, indemnity or liability

terms You offer.

3.6. Distribution of Executable Versions.

Page 126: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

126 版本说明

You may distribute Covered Code in Executable form only if the

requirements of Section 3.1-3.5 have been met for that Covered

Code, and if You include a notice stating that the Source Code

version of the Covered Code is available under the terms of this

License, including a description of how and where You have fulfilled

the obligations of Section 3.2. The notice must be conspicuously

included in any notice in an Executable version, related

documentation or collateral in which You describe recipients' rights

relating to the Covered Code. You may distribute the Executable

version of Covered Code or ownership rights under a license of

Your choice, which may contain terms different from this License,

provided that You are in compliance with the terms of this License

and that the license for the Executable version does not attempt to

limit or alter the recipient's rights in the Source Code version from

the rights set forth in this License. If You distribute the Executable

version under a different license You must make it absolutely clear

that any terms which differ from this License are offered by You

alone, not by the Initial Developer or any Contributor. You hereby

agree to indemnify the Initial Developer and every Contributor for

any liability incurred by the Initial Developer or such Contributor as

a result of any such terms You offer.

3.7. Larger Works.

You may create a Larger Work by combining Covered Code with

other code not governed by the terms of this License and distribute

the Larger Work as a single product. In such a case, You must

make sure the requirements of this License are fulfilled for the

Covered Code.

4. Inability to Comply Due to Statute or Regulation.

If it is impossible for You to comply with any of the terms of this

License with respect to some or all of the Covered Code due to

statute, judicial order, or regulation then You must: (a) comply

with the terms of this License to the maximum extent possible; and

(b) describe the limitations and the code they affect. Such

description must be included in the LEGAL file described in Section

3.4 and must be included with all distributions of the Source Code.

Except to the extent prohibited by statute or regulation, such

description must be sufficiently detailed for a recipient of ordinary

skill to be able to understand it.

5. Application of this License.

This License applies to code to which the Initial Developer has

attached the notice in Exhibit A and to related Covered Code.

6. Versions of the License.

6.1. New Versions.

Page 127: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

附录 A: 第三方声明 127

Netscape Communications Corporation ("Netscape") may publish

revised and/or new versions of the License from time to time. Each

version will be given a distinguishing version number.

6.2. Effect of New Versions.

Once Covered Code has been published under a particular version

of the License, You may always continue to use it under the terms

of that version. You may also choose to use such Covered Code

under the terms of any subsequent version of the License published

by Netscape. No one other than Netscape has the right to modify

the terms applicable to Covered Code created under this License.

6.3. Derivative Works.

If You create or use a modified version of this License (which you

may only do in order to apply it to code which is not already

Covered Code governed by this License), You must (a) rename

Your license so that the phrases "Mozilla", "MOZILLAPL", "MOZPL",

"Netscape", "MPL", "NPL" or any confusingly similar phrase do not

appear in your license (except to note that your license differs from

this License) and (b) otherwise make it clear that Your version of

the license contains terms which differ from the Mozilla Public

License and Netscape Public License. (Filling in the name of the

Initial Developer, Original Code or Contributor in the notice

described in Exhibit A shall not of themselves be deemed to be

modifications of this License.)

7. DISCLAIMER OF WARRANTY.

COVERED CODE IS PROVIDED UNDER THIS LICENSE ON AN "AS

IS" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER

EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION,

WARRANTIES THAT THE COVERED CODE IS FREE OF DEFECTS,

MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE OR

NON-INFRINGING. THE ENTIRE RISK AS TO THE QUALITY AND

PERFORMANCE OF THE COVERED CODE IS WITH YOU. SHOULD

ANY COVERED CODE PROVE DEFECTIVE IN ANY RESPECT, YOU

(NOT THE INITIAL DEVELOPER OR ANY OTHER CONTRIBUTOR)

ASSUME THE COST OF ANY NECESSARY SERVICING, REPAIR OR

CORRECTION. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN

ESSENTIAL PART OF THIS LICENSE. NO USE OF ANY COVERED

CODE IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS

DISCLAIMER.

8. TERMINATION.

Page 128: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

128 版本说明

8.1. This License and the rights granted hereunder will terminate

automatically if You fail to comply with terms herein and fail to cure

such breach within 30 days of becoming aware of the breach. All

sublicenses to the Covered Code which are properly granted shall

survive any termination of this License. Provisions which, by their

nature, must remain in effect beyond the termination of this

License shall survive.

8.2. If You initiate litigation by asserting a patent infringement

claim (excluding declatory judgment actions) against Initial

Developer or a Contributor (the Initial Developer or Contributor

against whom You file such action is referred to as "Participant")

alleging that:

(a) such Participant's Contributor Version directly or

indirectly

infringes any patent, then any and all rights granted by such

Participant to You under Sections 2.1 and/or 2.2 of this

License

shall, upon 60 days notice from Participant terminate

prospectively,

unless if within 60 days after receipt of notice You either: (i)

agree in writing to pay Participant a mutually agreeable

reasonable

royalty for Your past and future use of Modifications made by

such

Participant, or (ii) withdraw Your litigation claim with respect

to

the Contributor Version against such Participant. If within 60

days

of notice, a reasonable royalty and payment arrangement are

not

mutually agreed upon in writing by the parties or the litigation

claim

is not withdrawn, the rights granted by Participant to You

under

Sections 2.1 and/or 2.2 automatically terminate at the

expiration of

the 60 day notice period specified above.

Page 129: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

附录 A: 第三方声明 129

(b) any software, hardware, or device, other than such

Participant's

Contributor Version, directly or indirectly infringes any patent,

then

any rights granted to You by such Participant under Sections

2.1(b)

and 2.2(b) are revoked effective as of the date You first made,

used,

sold, distributed, or had made, Modifications made by that

Participant.

8.3. If You assert a patent infringement claim against Participant

alleging that such Participant's Contributor Version directly or

indirectly infringes any patent where such claim is resolved (such

as by license or settlement) prior to the initiation of patent

infringement litigation, then the reasonable value of the licenses

granted by such Participant under Sections 2.1 or 2.2 shall be

taken minto account in determining the amount or value of any

payment or license.

8.4. In the event of termination under Sections 8.1 or 8.2 above,

all end user license agreements (excluding distributors and

resellers) which have been validly granted by You or any distributor

hereunder prior to termination shall survive termination.

9. LIMITATION OF LIABILITY.

UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY,

WHETHER TORT (INCLUDING NEGLIGENCE), CONTRACT, OR

OTHERWISE, SHALL YOU, THE INITIAL DEVELOPER, ANY OTHER

CONTRIBUTOR, OR ANY DISTRIBUTOR OF COVERED CODE, OR

ANY SUPPLIER OF ANY OF SUCH PARTIES, BE LIABLE TO ANY

PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR

CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING,

WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK

STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND

ALL OTHER COMMERCIAL DAMAGES OR LOSSES, EVEN IF SUCH

PARTY SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF

SUCH DAMAGES. THIS LIMITATION OF LIABILITY SHALL NOT

APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY RESULTING

FROM SUCH PARTY'S NEGLIGENCE TO THE EXTENT APPLICABLE

LAW PROHIBITS SUCH LIMITATION. SOME JURISDICTIONS DO

NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR

CONSEQUENTIAL DAMAGES, SO THIS EXCLUSION AND

LIMITATION MAY NOT APPLY TO YOU.

10. U.S. GOVERNMENT END USERS.

Page 130: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Rhino 1.7R1

130 版本说明

The Covered Code is a "commercial item," as that term is defined

in 48 C.F.R. 2.101 (Oct. 1995), consisting of "commercial computer

software" and "commercial computer software documentation," as

such terms are used in 48 C.F.R. 12.212 (Sept. 1995). Consistent

with 48 C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through

227.7202-4 (June 1995), all U.S. Government End Users acquire

Covered Code with only those rights set forth herein.

11. MISCELLANEOUS.

This License represents the complete agreement concerning subject

matter hereof. If any provision of this License is held to be

unenforceable, such provision shall be reformed only to the extent

necessary to make it enforceable. This License shall be governed by

California law provisions (except to the extent applicable law, if any,

provides otherwise), excluding its conflict-of-law provisions. With

respect to disputes in which at least one party is a citizen of, or an

entity chartered or registered to do business in the United States of

America, any litigation relating to this License shall be subject to

the jurisdiction of the Federal Courts of the Northern District of

California, with venue lying in Santa Clara County, California, with

the losing party responsible for costs, including without limitation,

court costs and reasonable attorneys' fees and expenses. The

application of the United Nations Convention on Contracts for the

International Sale of Goods is expressly excluded. Any law or

regulation which provides that the language of a contract shall be

construed against the drafter shall not apply to this License.

12. RESPONSIBILITY FOR CLAIMS.

As between Initial Developer and the Contributors, each party is

responsible for claims and damages arising, directly or indirectly,

out of its utilization of rights under this License and You agree to

work with Initial Developer and Contributors to distribute such

responsibility on an equitable basis. Nothing herein is intended or

shall be deemed to constitute any admission of liability.

13. MULTIPLE-LICENSED CODE.

Initial Developer may designate portions of the Covered Code as

"Multiple-Licensed". "Multiple-Licensed" means that the Initial

Developer permits you to utilize portions of the Covered Code

under Your choice of the NPL or the alternative licenses, if any,

specified by the Initial Developer in the file described in Exhibit A.

EXHIBIT A -Mozilla Public License.

``The contents of this file are subject to the Mozilla Public License

Version 1.1 (the "License"); you may not use this file except in

compliance with the License. You may obtain a copy of the License

at http://www.mozilla.org/MPL/

Page 131: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

SAAJ 1.2

附录 A: 第三方声明 131

Software distributed under the License is distributed on an "AS IS"

basis, WITHOUT WARRANTY OF ANY KIND, either express or

implied. See the License for the specific language governing rights

and limitations under the License.

The Original Code is

______________________________________.

The Initial Developer of the Original Code is

________________________.

Portions created by ______________________ are Copyright (C)

_____________________________. All Rights Reserved.

Contributor(s): ______________________________________.

Alternatively, the contents of this file may be used under the terms

of the _____ license (the "[___] License"), in which case the

provisions of [______] License are applicable instead of those

above. If you wish to allow use of your version of this file only

under the terms of the [____] License and not to allow others to

use your version of this file under the MPL, indicate your decision

by deleting the provisions above and replace them with the

notice and other provisions required by the [___] License. If you

do not delete the provisions above, a recipient may use your

version of this file under either the MPL or the [___] License."

[NOTE: The text of this Exhibit A may differ slightly from the text of

the notices in the Source Code files of the Original Code. You

should use the text of this Exhibit A rather than the text found in

the Original Code Source Code for Your Modifications.]

SAAJ 1.2

SAAJ v.1.2

For the above software the following terms and conditions shall

apply:

This product contains certain files (the CDDL Files) which are

governed by the Common Development and Distribution License,

Version 1.0. The source code for the CDDL Files may be found here:

http://opensrcd.ca.com.

Page 132: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

SAXPath 1.1

132 版本说明

SAXPath 1.1

This product includes SAXPath 1.0 distributed in accordance with

the following terms:

/*--

$Id: LICENSE,v 1.1 2002/04/26 17:43:56 jstrachan Exp $

Copyright (C) 2000-2002 werken digital.

All rights reserved.

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions

are met:

1. Redistributions of source code must retain the above copyright

notice, this list of conditions, and the following disclaimer.

2. Redistributions in binary form must reproduce the above

copyright notice, this list of conditions, and the disclaimer that

follows these conditions in the documentation and/or other

materials provided with the distribution.

3. The name "SAXPath" must not be used to endorse or promote

products derived from this software without prior written

permission. For written permission, please contact

[email protected].

4. Products derived from this software may not be called

"SAXPath", nor may "SAXPath" appear in their name, without

prior written permission from the SAXPath Project Management

([email protected]).

In addition, we request (but do not require) that you include in

the end-user documentation provided with the redistribution

and/or in the software itself an acknowledgement equivalent to

the following:

"This product includes software developed by the SAXPath

Project (http://www.saxpath.org/)."

Alternatively, the acknowledgment may be graphical using the

logos available at http://www.saxpath.org/

Page 133: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

SpiderMonkey 1.5

附录 A: 第三方声明 133

THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR

IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

SAXPath AUTHORS OR THE PROJECT CONTRIBUTORS BE LIABLE

FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,

OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER

IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

OF SUCH DAMAGE.

This software consists of voluntary contributions made by many

individuals on behalf of the SAXPath Project and was originally

created by bob mcwhirter and James Strachan . For more

information on the SAXPath Project, please see .

*/

SpiderMonkey 1.5

This product includes SpiderMonkey 1.5. The source code version of

SpiderMonkey 1.5 is licensed under the Mozilla Public License,

Version 1.1 and is available at

http://www.mozilla.org/js/spidermonkey/.

Page 134: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Sun JDK 1.6.0

134 版本说明

Sun JDK 1.6.0

SUN JDK v.1.6

This product contains files from the Sun Java Development Kit

v.1.6, which is licensed and distributed in accordance with the

following terms:

Sun Microsystems, Inc. Binary Code License Agreementfor the

JAVA SE DEVELOPMENT KIT (JDK), VERSION 6SUN

MICROSYSTEMS, INC. ("SUN") IS WILLING TO LICENSE THE

SOFTWARE IDENTIFIED BELOW TO YOU ONLY UPON THE

CONDITION THAT YOU ACCEPT ALL OF THE TERMS CONTAINED IN

THIS BINARY CODE LICENSE AGREEMENT AND SUPPLEMENTAL

LICENSE TERMS (COLLECTIVELY "AGREEMENT"). PLEASE READ

THE AGREEMENT CAREFULLY. BY DOWNLOADING OR INSTALLING

THIS SOFTWARE, YOU ACCEPT THE TERMS OF THE AGREEMENT.

INDICATE ACCEPTANCE BY SELECTING THE "ACCEPT" BUTTON AT

THE BOTTOM OF THE AGREEMENT. IF YOU ARE NOT WILLING TO

BE BOUND BY ALL THE TERMS, SELECT THE "DECLINE" BUTTON AT

THE BOTTOM OF THE AGREEMENT AND THE DOWNLOAD OR

INSTALL PROCESS WILL NOT CONTINUE.

1. DEFINITIONS. "Software" means the identified above in binary

form, any other machine readable materials (including, but not

limited to, libraries, source files, header files, and data files), any

updates or error corrections provided by Sun, and any user

manuals, programming guides and other documentation provided

to you by Sun under this Agreement. "Programs" mean Java

applets and applications intended to run on the Java Platform,

Standard Edition (Java SE) on Java-enabled general purpose

desktop computers and servers.

2. LICENSE TO USE. Subject to the terms and conditions of this

Agreement, including, but not limited to the Java Technology

Restrictions of the Supplemental License Terms, Sun grants you a

non-exclusive, non-transferable, limited license without license fees

to reproduce and use internally Software complete and unmodified

for the sole purpose of running Programs. Additional licenses for

developers and/or publishers are granted in the Supplemental

License Terms.

Page 135: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Sun JDK 1.6.0

附录 A: 第三方声明 135

3. RESTRICTIONS. Software is confidential and copyrighted. Title to

Software and all associated intellectual property rights is retained

by Sun and/or its licensors. Unless enforcement is prohibited by

applicable law, you may not modify, decompile, or reverse engineer

Software. You acknowledge that Licensed Software is not

designed or intended for use in the design, construction, operation

or maintenance of any nuclear facility. Sun Microsystems, Inc.

disclaims any express or implied warranty of fitness for such uses.

No right, title or interest in or to any trademark, service mark, logo

or trade name of Sun or its licensors is granted under this

Agreement. Additional restrictions for developers and/or publishers

licenses are set forth in the Supplemental License Terms.

4. LIMITED WARRANTY. Sun warrants to you that for a period of

ninety (90) days from the date of purchase, as evidenced by a copy

of the receipt, the media on which Software is furnished (if any)

will be free of defects in materials and workmanship under normal

use. Except for the foregoing, Software is provided "AS IS". Your

exclusive remedy and Sun's entire liability under this limited

warranty will be at Sun's option to replace Software media or

refund the fee paid for Software. Any implied warranties on the

Software are limited to 90 days. Some states do not allow

limitations on duration of an implied warranty, so the above may

not apply to you. This limited warranty gives you specific legal

rights. You may have others, which vary from state to state.

5. DISCLAIMER OF WARRANTY. UNLESS SPECIFIED IN THIS

AGREEMENT, ALL EXPRESS OR IMPLIED CONDITIONS,

REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED

WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR

PURPOSE OR NON-INFRINGEMENT ARE DISCLAIMED, EXCEPT TO

THE EXTENT THAT THESE DISCLAIMERS ARE HELD TO BE LEGALLY

INVALID.

6. LIMITATION OF LIABILITY. TO THE EXTENT NOT PROHIBITED

BY LAW, IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE

FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR SPECIAL,

INDIRECT, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES,

HOWEVER CAUSED REGARDLESS OF THE THEORY OF LIABILITY,

ARISING OUT OF OR RELATED TO THE USE OF OR INABILITY TO

USE SOFTWARE, EVEN IF SUN HAS BEEN ADVISED OF THE

POSSIBILITY OF SUCH DAMAGES. In no event will Sun's liability

to you, whether in contract, tort (including negligence), or

otherwise, exceed the amount paid by you for Software under this

Agreement. The foregoing limitations will apply even if the above

stated warranty fails of its essential purpose. Some states do not

allow the exclusion of incidental or consequential damages, so

some of the terms above may not be applicable to you.

Page 136: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Sun JDK 1.6.0

136 版本说明

7. TERMINATION. This Agreement is effective until terminated.

You may terminate this Agreement at any time by destroying all

copies of Software. This Agreement will terminate immediately

without notice from Sun if you fail to comply with any provision of

this Agreement. Either party may terminate this Agreement

immediately should any Software become, or in either party's

opinion be likely to become, the subject of a claim of infringement

of any intellectual property right. Upon Termination, you must

destroy all copies of Software.

8. EXPORT REGULATIONS. All Software and technical data

delivered under this Agreement are subject to US export control

laws and may be subject to export or import regulations in other

countries. You agree to comply strictly with all such laws and

regulations and acknowledge that you have the responsibility to

obtain such licenses to export, re-export, or import as may be

required after delivery to you.

9. TRADEMARKS AND LOGOS. You acknowledge and agree as

between you and Sun that Sun owns the SUN, SOLARIS, JAVA, JINI,

FORTE, and iPLANET trademarks and all SUN, SOLARIS, JAVA, JINI,

FORTE, and iPLANET-related trademarks, service marks, logos and

other brand designations ("Sun Marks"), and you agree to comply

with the Sun Trademark and Logo Usage Requirements currently

located at http://www.sun.com/policies/trademarks. Any use you

make of the Sun Marks inures to Sun's benefit.

10. U.S. GOVERNMENT RESTRICTED RIGHTS. If Software is being

acquired by or on behalf of the U.S. Government or by a U.S.

Government prime contractor or subcontractor (at any tier), then

the Government's rights in Software and accompanying

documentation will be only as set forth in this Agreement; this is in

accordance with 48 CFR 227.7201 through 227.7202-4 (for

Department of Defense (DOD) acquisitions) and with 48 CFR 2.101

and 12.212 (for non-DOD acquisitions).

11. GOVERNING LAW. Any action related to this Agreement will be

governed by California law and controlling U.S. federal law. No

choice of law rules of any jurisdiction will apply.

12. SEVERABILITY. If any provision of this Agreement is held to be

unenforceable, this Agreement will remain in effect with the

provision omitted, unless omission would frustrate the intent of the

parties, in which case this Agreement will immediately terminate.

Page 137: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Sun JDK 1.6.0

附录 A: 第三方声明 137

13. INTEGRATION. This Agreement is the entire agreement

between you and Sun relating to its subject matter. It supersedes

all prior or contemporaneous oral or written communications,

proposals, representations and warranties and prevails over any

conflicting or additional terms of any quote, order, acknowledgment,

or other communication between the parties relating to its subject

matter during the term of this Agreement. No modification of this

Agreement will be binding, unless in writing and signed by an

authorized representative of each party.

SUPPLEMENTAL LICENSE TERMS

These Supplemental License Terms add to or modify the terms of

the Binary Code License Agreement. Capitalized terms not defined

in these Supplemental Terms shall have the same meanings

ascribed to them in the Binary Code License Agreement . These

Supplemental Terms shall supersede any inconsistent or conflicting

terms in the Binary Code License Agreement, or in any license

contained within the Software.

A. Software Internal Use and Development License Grant. Subject

to the terms and conditions of this Agreement and restrictions and

exceptions set forth in the Software "README" file incorporated

herein by reference, including, but not limited to the Java

Technology Restrictions of these Supplemental Terms, Sun grants

you a non-exclusive, non-transferable, limited license without fees

to reproduce internally and use internally the Software complete

and unmodified for the purpose of designing, developing, and

testing your Programs.

B. License to Distribute Software. Subject to the terms and

conditions of this Agreement and restrictions and exceptions set

forth in the Software README file, including, but not limited to the

Java Technology Restrictions of these Supplemental Terms, Sun

grants you a non-exclusive, non-transferable, limited license

without fees to reproduce and distribute the Software, provided

that (i) you distribute the Software complete and unmodified and

only bundled as part of, and for the sole purpose of running, your

Programs, (ii) the Programs add significant and primary

functionality to the Software, (iii) you do not distribute additional

software intended to replace any component(s) of the Software, (iv)

you do not remove or alter any proprietary legends or notices

contained in the Software, (v) you only distribute the Software

subject to a license agreement that protects Sun's interests

consistent with the terms contained in this Agreement, and (vi) you

agree to defend and indemnify Sun and its licensors from and

against any damages, costs, liabilities, settlement amounts and/or

expenses (including attorneys' fees) incurred in connection with

any claim, lawsuit or action by any third party that arises or results

from the use or distribution of any and all Programs and/or

Software.

Page 138: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Sun JDK 1.6.0

138 版本说明

C. License to Distribute Redistributables. Subject to the terms and

conditions of this Agreement and restrictions and exceptions set

forth in the Software README file, including but not limited to the

Java Technology Restrictions of these Supplemental Terms, Sun

grants you a non-exclusive, non-transferable, limited license

without fees to reproduce and distribute those files specifically

identified as redistributable in the Software "README" file

("Redistributables") provided that: (i) you distribute the

Redistributables complete and unmodified, and only bundled as

part of Programs, (ii) the Programs add significant and primary

functionality to the Redistributables, (iii) you do not distribute

additional software intended to supersede any component(s) of the

Redistributables (unless otherwise specified in the applicable

README file), (iv) you do not remove or alter any proprietary

legends or notices contained in or on the Redistributables, (v) you

only distribute the Redistributables pursuant to a license agreement

that protects Sun's interests consistent with the terms contained in

the Agreement, (vi) you agree to defend and indemnify Sun and its

licensors from and against any damages, costs, liabilities,

settlement amounts and/or expenses (including attorneys' fees)

incurred in connection with any claim, lawsuit or action by any third

party that arises or results from the use or distribution of any and

all Programs and/or Software.

D. Java Technology Restrictions. You may not create, modify, or

change the behavior of, or authorize your licensees to create,

modify, or change the behavior of, classes, interfaces, or

subpackages that are in any way identified as "java", "javax", "sun"

or similar convention as specified by Sun in any naming convention

designation.

Page 139: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Sun JDK 1.6.0

附录 A: 第三方声明 139

E. Distribution by Publishers. This section pertains to your

distribution of the Software with your printed book or magazine (as

those terms are commonly used in the industry) relating to Java

technology ("Publication"). Subject to and conditioned upon your

compliance with the restrictions and obligations contained in the

Agreement, in addition to the license granted in Paragraph 1 above,

Sun hereby grants to you a non-exclusive, nontransferable limited

right to reproduce complete and unmodified copies of the Software

on electronic media (the "Media") for the sole purpose of inclusion

and distribution with your Publication(s), subject to the following

terms: (i) You may not distribute the Software on a stand-alone

basis; it must be distributed with your Publication(s); (ii) You are

responsible for downloading the Software from the applicable Sun

web site; (iii) You must refer to the Software as JavaTM SE

Development Kit 6; (iv) The Software must be reproduced in its

entirety and without any modification whatsoever (including,

without limitation, the Binary Code License and Supplemental

License Terms accompanying the Software and proprietary rights

notices contained in the Software); (v) The Media label shall

include the following information: Copyright 2006, Sun

Microsystems, Inc. All rights reserved. Use is subject to license

terms. Sun, Sun Microsystems, the Sun logo, Solaris, Java, the

Java Coffee Cup logo, J2SE, and all trademarks and logos based on

Java are trademarks or registered trademarks of Sun Microsystems,

Inc. in the U.S. and other countries. This information must be

placed on the Media label in such a manner as to only apply to the

Sun Software; (vi) You must clearly identify the Software as Sun's

product on the Media holder or Media label, and you may not state

or imply that Sun is responsible for any third-party software

contained on the Media; (vii) You may not include any third party

software on the Media which is intended to be a replacement or

substitute for the Software; (viii) You shall indemnify Sun for all

damages arising from your failure to comply with the requirements

of this Agreement. In addition, you shall defend, at your expense,

any and all claims brought against Sun by third parties, and shall

pay all damages awarded by a court of competent jurisdiction, or

such settlement amount negotiated by you, arising out of or in

connection with your use, reproduction or distribution of the

Software and/or the Publication. Your obligation to provide

indemnification under this section shall arise provided that Sun: (a)

provides you prompt notice of the claim; (b) gives you sole control

of the defense and settlement of the claim; (c) provides you, at

your expense, with all available information, assistance and

authority to defend; and (d) has not compromised or settled such

claim without your prior written consent; and (ix) You shall provide

Sun with a written notice for each Publication; such notice shall

include the following information: (1) title of Publication, (2)

author(s), (3) date of Publication, and (4) ISBN or ISSN numbers.

Such notice shall be sent to Sun Microsystems, Inc., 4150 Network

Circle, M/S USCA12-110, Santa Clara, California 95054, U.S.A ,

Attention: Contracts Administration.

Page 140: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Sun JDK 1.6.0

140 版本说明

F. Source Code. Software may contain source code that, unless

expressly licensed for other purposes, is provided solely for

reference purposes pursuant to the terms of this Agreement.

Source code may not be redistributed unless expressly provided for

in this Agreement.

G. Third Party Code. Additional copyright notices and license terms

applicable to portions of the Software are set forth in the

THIRDPARTYLICENSEREADME.txt file. In addition to any terms and

conditions of any third party opensource/freeware license identified

in the THIRDPARTYLICENSEREADME.txt file, the disclaimer of

warranty and limitation of liability provisions in paragraphs 5 and 6

of the Binary Code License Agreement shall apply to all Software

in this distribution.

H. Termination for Infringement. Either party may terminate this

Agreement immediately should any Software become, or in either

party's opinion be likely to become, the subject of a claim of

infringement of any intellectual property right.

I. Installation and Auto-Update. The Software's installation and

auto-update processes transmit a limited amount of data to Sun (or

its service provider) about those specific processes to help Sun

understand and optimize them. Sun does not associate the data

with personally identifiable information. You can find more

information about the data Sun collects at http://java.com/data/.

For inquiries please contact: Sun Microsystems, Inc., 4150 Network

Circle, Santa Clara, California 95054, U.S.A.

ADDITIONAL TERMS AND CONDITIONS FOR THE USE OF

Sun JDK 1.6

(JAVA 2 PLATFORM STANDARD EDITION RUNTIME ENVIRONMENT

6.0)

Licensee agrees that the following terms (in addition to the

applicable provisions above) shall apply with respect to any open

source code provided by Sun Microsystems, Inc. contained within

the Product. Notwithstanding anything contained in the CA End

User License Agreement, solely with respect to such open source,

these terms are not superseded by any written agreement between

CA and Licensee:

"Software" means Java' 2 Platform Standard Edition Version 1.6_X

and any user manuals, programming guides and other

documentation provided to Licensee.

Page 141: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Sun JDK 1.6.0

附录 A: 第三方声明 141

Title to Software and all associated intellectual property rights is

retained by Sun Microsystems, Inc. ('Sun') and/or its licensors.

Licensee acknowledges that Software is not designed or intended

for use in the design, construction, operation or maintenance of

any nuclear facility. Sun disclaims any express or implied warranty

of fitness for such uses. No right, title or interest in or to any

trademark, service mark, logo or trade name of Sun or its licensors

is granted under this agreement.

The Software is provided "AS IS". As to any claim made by

Licensee against Sun respecting Software, Licensee's exclusive

remedy and Sun's entire liability under this limited warranty will be

at Sun's option to replace Software media or refund the fee paid for

Software by Licensee to Sun which Licensee acknowledges is $0.

UNLESS SPECIFIED IN THIS AGREEMENT, ALL EXPRESS OR

IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES,

INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,

FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT

ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT THESE

DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. The foregoing

limitations shall not affect any warranties provided in any other

applicable agreement between Licensee and CA.

TO THE EXTENT NOT PROHIBITED BY LAW, IN NO EVENT WILL

SUN OR ITS LICENSORS BE LIABLE FOR ANY LOST REVENUE,

PROFIT OR DATA, OR FOR SPECIAL, INDIRECT, CONSEQUENTIAL,

INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER CAUSED

REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF OR

RELATED TO THE USE OF OR INABILITY TO USE SOFTWARE, EVEN

IF SUN HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES. In no event will Sun's liability to you, whether in

contract, tort (including negligence), or otherwise, exceed the

amount paid for Software by Licensee to Sun which Licensee

acknowledges is $0. The foregoing limitations will apply even if the

above stated warranty fails of its essential purpose.

Licensee acknowledges that Licensee's use of the Software will

terminate immediately without notice if Licensee fails to comply

with any provision of this agreement. Licensee acknowledges that

Sun may terminate this agreement immediately should the

Software become, or in Sun's opinion be likely to become, the

subject of a claim of infringement of any intellectual property right.

Upon termination, Licensee must destroy all copies of Software.

Licensee acknowledges and agrees as between Licensee and Sun

that Sun owns the SUN, SOLARIS, JAVA, JINI, FORTE, and iPLANET

trademarks and all SUN, SOLARIS, JAVA, JINI, FORTE, and

iPLANET-related trademarks, service marks, logos and other brand

designations ("Sun Marks"), and Licensee agrees to comply with

the Sun Trademark and Logo Usage Requirements currently located

at http://www.sun.com/policies/trademarks. Any use Licensee

makes of the Sun Marks inures to Sun's benefit.

Page 142: CA Identity Manager - 版本说明本文档和相关的计算机软件帮助程序(以下简称“本文档”)仅供用户参考,ca 有权随时修改或撤销本文档。

Xinha .96 Beta 2

142 版本说明

Notwithstanding anything to the contrary contained in any

agreement between Licensee and CA, any action related to this

agreement in which Sun is a party will be governed by California

law and controlling U.S. federal law. No choice of law rules of any

jurisdiction will apply.

Licensee acknowledges that additional copyright notices and license

terms applicable to portions of the Software are set forth in the

THIRDPARTYLICENSEREADME.txt file.

For inquiries please contact: Sun Microsystems, Inc., 4150 Network

Circle, Santa Clara, California 95054, U.S.A.

Xinha .96 Beta 2

Copyright (c) 2002-2004, interactivetools.com, inc.

Copyright (c) 2003-2004 dynarch.com

All rights reserved. Redistribution and use in source and binary

forms, with or without modification, are permitted provided that

the following conditions are met:

1) Redistributions of source code must retain the above copyright

notice, this list of conditions and the following disclaimer.

2) Redistributions in binary form must reproduce the above

copyright notice, this list of conditions and the following disclaimer

in the documentation and/or other materials provided with the

distribution.

3) Neither the name of interactivetools.com, inc. nor the names of

its contributors may be used to endorse or promote products

derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND

CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY

DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER

IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

OF SUCH DAMAGE.