This Patch Update resolves specific previous issues. This document outlines why you should install this Patch Update.
Many of these improvements were made in direct response to suggestions from our customers. We thank you for your time and valuable input. We hope you continue to help us ensure that our products meet all your needs. You can post feedback in the Self Service Password Reset forum on Micro Focus Forums, our online community that also includes product information, blogs, and links to helpful resources.
The following outlines the issues resolved in this release:
Self Service Password Reset includes the following security updates:
If you are running the Self Service Password Reset Appliance, this patch update contains operating system and security updates.
For the appliance and Windows versions of Self Service Password Reset, Java and Tomcat have been updated to the latest versions. (Bug 1034697)
Java: JRE-8u131
Tomcat: 8.0.43
Self Service Password Reset 4.1 Patch Update 3 includes the following software enhancements and fixes for this release:
Self Service Password Reset Patch Update 3 contains all of the security updates and fixes included in Patch Update 1. For more information, see:
You can install Patch Update 3 without installing the previous patches it contains all of the fixes in the previous patches.
Issue: The randompassword REST API requires a profileID|userDN syntax and this option should be optional. (Bug 1031161, 969643)
Solution: Patch Update 3 resolves this issue.
Issue: The User Profile confirmation screen displays the values of the attributes instead of the proper display information. For example, instead of displaying Enabled, the confirmation screen displays TRUE. (Bug 1030555)
Solution: Patch Update 3 resolves this issue.
Issue: The Forgotten Password module returns an error of 4033 Password change too soon. This happened because the Forgotten Password module initiates the check for minimum password lifetime by checking the last login time, not the last password modified use time. This caused the error to occur. (Bug1029209)
Solution: Patch Update 3 resolves this issue by having the Forgotten Password module use the last password modified use time to initiate the check for minimum password lifetime.
Issue: After adding a new attribute to display in the People Search module, the People Search module does not display the new attributes. (Bug 1030943)
Solution: Patch Update 3 resolves this issue.
Issue: Unable to edit the HTML of the email templates in the Configuration Editor. (Bug 1030557)
Solution: Patch Update 3 resolves this issue for Firefox browsers. Chrome browsers cannot edit the HTML due to the HTML editor library Self Service Password Reset uses.
Issue: Users are unable to reset their password using the Forgotten Password module, if the password minimum age option is enabled when using Oracle Directory Server as the LDAP user store. (Bug 1031390)
Solution: Patch Update 3 resolves this issue. Plus, ensure to add the following information in the Configuration Editor:
Log in to the Configuration Editor as an administrator.
Click Settings > Application > Application > App Property Overrides.
Click Add Value.
Specify the following exactly:
ldap.oracle.postTempPasswordUseCurrentTime=true
Click Save changes.
Issue: If you have select Token as an optional verification method, Self Service Password Reset allows the token to be used multiple times. (Bug 1034516)
Solution: Patch Update 3 resolves this issue.
Issue: Self Service Password Reset does not properly purge the toke database table over time. This leads to the tokens being reused when they should not be reused. (Bug 1034668)
Solution: Patch Update 3 resolves this issue.
Issue: With the Password Change Agreement Message enabled, a user clicks cancel on the password change agreement and receives a 5034 error. This only occurs if you enabled the Settings > Security > Web Security > Enable Form option. (Bug 1035028)
Solution: Patch Update 3 resolves this issue whether the option is set or not.
Issue: There was an internal file on the appliance that filled up all of the disk space. (Bug 1035527)
Solution: Patch Update 3 resolves this issue.
Self Service Password Reset includes support for the following operating system versions:
Red Hat Enterprise Linux Server 7.3 or later (64-bit)
SUSE Linux Enterprise Server 12 SP 2 or later (64-bit)
SUSE Linux Enterprise Server 11 SP 4 (64-bit)
Windows Server 2012 R2 (64-bit)
Self Service Password Reset is also available as an appliance since the 4.0 release. The appliance runs on the following virtual systems:
Hyper-V 4.0 and 3.0
VMware 5.5 or later
Self Service Password Reset also supports the Edge browse in this release.
For detailed information on system requirements, supported operating systems, and browsers, see Installing Self Service Password Reset
in the Self Service Password Reset 4.1 Administration Guide.
Installing the Patch Update is different for each platform that Self Service Password Reset support. You must follow the step for your specific deployment to install the Patch Update 3. For more information, see Adding a Patch Update
in the Self Service Password Reset 4.1 Administration Guide.
Complete the following steps to verify that the installation was successful.
To check the installed version:
Log in the Self Service Password Reset administration console as an administrator.
In the toolbar, click your name, then click Administration.
Click the About tab, then verify the SSPR Version is v4.1.0.3 b321 r39084.
NetIQ Corporation strives to ensure our products provide quality solutions for your enterprise software needs. The following issues are currently being researched. If you need further assistance with any issue, please contact Technical Support.
Issue: Self Service Password Reset 3.3 and above contains a new configuration option for forgotten password verification methods. If you upgrade without reviewing these new options, when you access the Forgotten Password Module it returns an error of SSPR Error 5006 - The username is not valid or is not eligible to use this feature. (Bug 979153)
Solution: To fix the error, you must review the forgotten password verification methods and change these options for your environment.
To review the forgotten password verification methods:
Log in to Self Service Password Reset at https://dns-name/sspr as an administrator.
In the toolbar, click your name.
Click Configuration Editor > Modules > Forgotten Password > Forgotten Password Profiles > default > Verification Methods.
If you have created a different profile, select that name instead of default.
Review the verification methods and change these options for your environment.
Click Save changes.
Our goal is to provide documentation that meets your needs. If you have suggestions for improvements, please email Documentation-Feedback@netiq.com. We value your input and look forward to hearing from you.
For detailed contact information, see the Support Contact Information website.
For general corporate and product information, see the NetIQ Corporate website.
For interactive conversations with your peers and NetIQ experts, become an active member of our community. The NetIQ online community provides product information, useful links to helpful resources, blogs, and social media channels.
For information about legal notices, trademarks, disclaimers, warranties, export and other use restrictions, U.S. Government rights, patent policy, and FIPS compliance, see https://www.netiq.com/company/legal/.
Copyright © 2017 NetIQ Corporation. All Rights Reserved.