Product Name     : TIBCO ActiveMatrix(R) Platform
Release Version  : 3.3.0_hotfix023
Release Date     : November 2018

================================================================================

Hotfixes are cumulative. This hotfix includes all previous generally
available hotfixes for TIBCO ActiveMatrix(R) Platform 3.3.0.

================================================================================

This hotfix applies to the following products and versions:

   - TIBCO ActiveMatrix Service Bus 3.3.0
   - TIBCO ActiveMatrix Service Grid 3.3.0
   - TIBCO ActiveMatrix BPM 2.2.0, 3.0.0, 3.1.0, 4.0.0, 4.1.0, 4.2.0
   - TIBCO Business Studio BPM Edition 3.6.0, 3.7.0, 3.8.0, 3.9.0, 4.0.0, 4.1.0
     4.2.0    
   - TIBCO ActiveMatrix BusinessWorks Service Engine 5.11.0 + Hotfix 005 (or
     higher).
   - TIBCO ActiveMatrix Policy Director 1.0.1 + Hotfix 001, 1.1.0
   - TIBCO Hawk ActiveMatrix(R) Plug-in for TIBCO Hawk(R) 5.2.0 with
     TIBCO ActiveMatrix 3.3.0 Hotfix 018 and above. Platforms supported
     are Microsoft Windows, Linux, and Solaris. For AIX support, refer to the
     "Known Issues" section of the TIBCO ActiveMatrix Readme Addendum.

NOTE:
- With TIBCO ActiveMatrix 3.3.0 Hotfix 013 and above as the platform,
  TIBCO ActiveMatrix BusinessWorks Service Engine 5.11.0 + Hotfix 006 (or higher)
  can now use TIBCO Enterprise Message Service(TM) 8.2.2 for TLS 1.2 Support.
- TIBCO Service Performance Manager (SPM) Dashboard, that was originally
  part of TIBCO SPM Server is moved to TIBCO ActiveMatrix Platform, and
  can now be installed using the TIBCO ActiveMatrix 3.3.0 Hotfix 010 or higher.
- TIBCO Service Performance Manager (SPM) Dashboard supports TIBCO Service
  Performance Manager versions 2.2.1 and 2.3.0.
- Existing TIBCO Service Performance Manager (SPM) Dashboard installations
  can be upgraded using TIBCO ActiveMatrix 3.3.0 Hotfix 012 or higher. While
  upgrading, the existing Dashboard configuration is used, eliminating
  the need for reconfiguring the Dashboard. To upgrade, install TIBCO
  ActiveMatrix 3.3.0 Hotfix 012 or higher on the same <TIBCO_HOME> where the
  Dashboard has been installed. For more information, refer to the "Upgrading
  TIBCO ActiveMatrix SPM Dashboard" section in the "TIBCO ActiveMatrix SPM
  Dashboard" chapter in the TIBCO ActiveMatrix Administration Addendum.
- Existing TIBCO ActiveMatrix 3.3.0 customers who have been using
  TIBCO ActiveMatrix with TIBCO Service Performance Manager 2.1.0 are
  affected by Hotfix 010 or higher. After Hotfix 010 or higher is applied to the
  TIBCO ActiveMatrix 3.3.0 installation, it is required that you use TIBCO
  Service Performance Manager 2.2.1.
- For TIBCO ActiveMatrix BusinessWorks Service Engine 5.11.0, HF005
  or above must be installed. TIBCO ActiveMatrix BusinessWorks
  Service Engine 5.11.0 HF005 fixed issue BWSE-3886 (BWSE
  application went in a 'Start failed' state after applying
  3.3.0 Hotfix-008).
- The Administrator and Runtime for TIBCO ActiveMatrix 3.3.0 Hotfix 023
  and higher support JRE 1.8 (certified with updates 172, 181, and 192).
  Refer to AMX-16650 for additional steps. Refer to the TIBCO ActiveMatrix
  Updater Tool for Java Runtime Environment (JRE) Documentation to update
  the JRE version to JRE 1.8.

================================================================================

Closed Issues in 3.3.0_hotfix023 (This release)

AMRP-5638
Currently if TIBCO ActiveMatrix Administrator is configured with LDAP Authentication
realm, the user is unable to set the search timeout for LDAP Authentication Resource
Template (RT) to a value less than 90000 milliseconds.

With this fix, the user is able to set the search timeout to a value less than 90000
milliseconds. If no value is specified by the user, the default is 90000 milliseconds.

AMX-16650
Previously with JRE 1.8 update 172, TIBCO ActiveMatrix tibcohost failed to start with
following error:
"java.security.UnrecoverableKeyException: Rejected by the jceks.key.serialFilter or jdk.serialFilter property"

This failure is now addressed with the addition of the property jceks.key.serialFilter.
If the property is added to end of
<TIBCO_HOME>/amx/3.3/scripts/rpflauncher_classpath_3.3.0.tra for all the <TIBCO_HOME>s
within the enterprise as follows, the error is no longer seen.
java.property.jceks.key.serialFilter=com.tibco.**;java.lang.Enum;java.security.KeyRep;java.security.KeyRep$Type;javax.crypto.spec.SecretKeySpec;!*

The same property must be added to the end of <TIBCO_HOME>/tct/1.4/TIBCOConfigurationTool.ini
when TIBCO Configure Tool (TCT)) is involved, that is:
-Djceks.key.serialFilter=com.tibco.**;java.lang.Enum;java.security.KeyRep;java.security.KeyRep$Type;javax.crypto.spec.SecretKeySpec;!*

BJMS-1575
When a JMS Message was sent to an ActiveMatrix Application containing a Promoted Service
with JMS Binding Type (BT) configured with In-Only operations, a NullPointerException
was seen in the logs. Moreover, no fault response was returned as the issue arises only
for In-Only operations, that is, operations with no reply.

With this fix, the NullPointerException is no longer seen and the message processing
is carried out by the configured Implementation Type (IT) as expected.

NOTE:     
As a workaround for this issue, it was advised to manually set the "Error Action" for
JMS Binding to "Retain Message in Service Destination" via TIBCO Business Studio, and
then rebuild the DAA. This workaround resulted in consequent errors. With above fix,
no other issues will occur and as such, no workarounds will be required for end-to-end
message processing.

DSS-975
Currently in TIBCO ActiveMatrix Administrator, the HTTP Client Resource Template (RT)
cannot be configured to connect to an HTTPs server that supports only TLSv1.2. The
"Configure SSL" wizard fails to connect to the HTTPs URL to get the certificates.

With this fix, user should be able to configure HTTP Client RT with SSL Client
Provider that supports TLSv1.2 protocol.

Additionally, HTTPs Connector supporting TLSv1.2 protocol can be created from ActiveMatrix
Administrator UI or CLI by configuring the SSL Server Provider "SSL Protocol" property
with "TLSv1.2" as the value. Even though the TLSv1.2 option is not available in the
Administrator UI drop down, the user can manually type in "TLSv1.2" in the value field.

PD-4363
In large scale ActiveMatrix enterprise setups with TIBCO Policy Director (PD) 1.1.0, it
was observed that while restarting the ActiveMatrix SystemNode, the PD Governance
Service was taking close to an hour to initialize. This was observed on a setup spanning
over 250 Hosts that managed an upward of 800 Nodes and hosted more than 1500 Applications.
The database queries related to initialization were taking very long to execute and the
TEMP table space usage grew close to 5 GB during the time.

The database queries have now been optimized to filter out unwanted Governance Objects
(GO), and with this fix, the initialization time for Governance Service has now
significantly reduced along with the TEMP table space usage. As a result, the SystemNode
restart time has reduced and is now within a reasonable range for an enterprise of this
size.

PER-2176
Previously, TIBCO ActiveMatrix BPM users were unable to log on to TIBCO ActiveMatrix
BPM Openspace/Workspace if the setup contained a Node which was created with the same
name as a previously force-uninstalled and force-deleted Node. This issue occurred
because the post-uninstall database cleanup was not being carried out by Administrator
in case of force option.

With this fix, the database entries associated with the particular Node are cleaned
up as expected, and users can successfully log on to the setup.

SDS-7745
Previously in TIBCO Business Studio, NullPointerException was seen during the 'Deploy Project'
workflow when 'Offline Server' was selected in the 'Administrator Connection Configuration'
tab. With this fix, no error is seen and deployment scripts are generated without any error.

TAP-15413
If the TIBCO ActiveMatrix Administrator database contained orphaned Endpoint or
CapabilityLink entities, then "ORA-02292: integrity constraint" error was observed when
force-deleting Applications. With this fix, Applications can be force-deleted successfully
even if orphaned Endpoint or CapabilityLink entities are present, as these entities are
deleted with Application itself.

TAP-15414
If the TIBCO ActiveMatrix Administrator database contained orphaned Endpoint or
CapabilityLink entities, then "ORA-02292: integrity constraint" error was observed when
force-undeploying Applications. With this fix, Applications can be force-undeployed
successfully even if orphaned Endpoint or CapabilityLink entities are present, as these
entities are deleted with Application itself.

TAP-15423
In case of large TIBCO ActiveMatrix BPM Applications, the Application deployment time was
significant, as a result of excessive capability validations for all Nodes which could be
skipped. With this fix, capabilities will be validated only for required Nodes, this
reducing the Application deployment time drastically.

TAP-15465
The task creation process for Application deployment in ActiveMatrix Administrator takes a
significant amount of time in case of large Applications, and previously, the creation
process did not record any actions in the logs, which made it difficult for users to track
the Application deployment process.

With this fix, task creation process will record important aspects of application deployment
in the logs to help users track Application deployment for large Applications easily.
Entries related to various deployment details are logged at INFO level in the SystemNode.log
using the "com.tibco.amx.admin.api.application" logger.

TAP-15466
Previously in TIBCO ActiveMatrix Administrator, when distributing an already-deployed
Application to a new Node, Administrator was performing validations for existing Nodes
even though the Application was in sync. Since these validations were unnecessary and
excessive, they have now been skipped as part of this fix.

TAP-15478
Previously when creating a new TIBCO ActiveMatrix BPM Node, NullPointerException was
thrown due to the use of custom Substitution Variables (SVARs) by existing Nodes for Shared
Resources. Moreover the failure was abrupt and the root cause was not revealed. With this
fix, the error is appropriately handled and NullPointerException is not seen.

TAP-15538, TAP-15752
When a user updates a Resource Template (RT) in TIBCO ActiveMatrix Administrator UI,
a dialog box pops up with which the user can select the affected Resource Instances (RI)
for reinstallation, and affected Applications for restart. Subsequently, selected
Resource Instances will be reinstalled and affected Applications will be restarted.

If the Resource Template (RT) is heavily used in the environment, Administrator will
take very long time to generate and execute the reinstallation and restart tasks. With
this fix, if the affected Applications have more than 1000 entities, a warning is given
to inform the user that the affected Nodes (that is, Nodes on which selected Resource
Instances are installed) will be restarted, instead of the Applications, in order to speed
up the entire process.

TAP-15631
Previously when TIBCO ActiveMatrix Administrator Server was configured with HTTPs using
TLSv1.2 protocol, Administrator Command Line (CLI) invocation failed with
SSLHandshakeException, because Administrator CLI did not support TLSv1.2. With the fix,
Administrator CLI can now successfully connect to Administrator server using TLSv1.2 protocol
without any additional configuration.

TAP-15660
Previously, the installation of JDBC Resource Instances (RI) in ActiveMatrix Administrator UI
would complete successfully even if the configuration of the underlying JDBC Resource
Template (RT) was invalid. For instance if the specified database credentials or connection
URL were invalid, the problem was not caught at the time of RI installation, but only
when the RI was actually used by the parent Application, thus causing potential business
impact in production.

With this enhancement, the underlying runtime layer validates the database configuration
parameters at the time of RI installation by performing a test connection. If the parameters
are incorrect, the RI installation will fail. This error will propagated back to the user via
Administrator thus giving the user an opportunity to correct the configuration before it causes
business disruption.

To disable this enhancement at a Resource Template level, set the
"disableValidateConnectionOnInit" attribute to "true" in the JDBC Resource Template
configuration via Administrator CLI as follows:

<ResourceTemplate name="JDBCResourceTemplate1"
    description="JDBC Resource Template"
    maxConnections="8888"
    sslJNDIName=""
    disableValidateConnectionOnInit="true"
    xsi:type="typ:JdbcResourceTemplate"
    xmlns:typ="http://tibco.com/amxadministrator/command/line/types">
    <TargetScope type="Enterprise"/>
        <Direct dbUrl="jdbc:oracle:thin:@dbhostname:1521:orcl"
        isTransactional="false"
        jdbcDriver="oracle.jdbc.OracleDriver"
        loginTimeOut="2"/>
        <InlineCredentials username="baduser"
        password=****/>
</ResourceTemplate>

The default value of this attribute is "false".

To disable this enhancement for all Resource Templates, set the the property
"com.tibco.admin.jdbc.disable.validate.connection.oninit" to 'true' in the SystemNode TRA file
as follows:
java.property.com.tibco.admin.jdbc.disable.validate.connection.oninit=true

The property can also be set for the SystemNode using the Administrator UI via
Infrastructure > Nodes > Select Node > Configuration > JVM Configuration
property: com.tibco.admin.jdbc.disable.validate.connection.oninit
value: true

The default value of this property is "false".

TAP-15685
For TIBCO ActiveMatrix Host and Node, the user was able to delete the root logger
configuration which resulted in incorrect logger configuration in runtime. With this fix,
the root logger can't be deleted and the exception "Not allowed to delete Root Logger"
is thrown when the user attempts to delete the root logger.

TAP-15699
Previously when user successfully logged on to the ActiveMatrix Administrator and the
logger 'com.tibco.amx.login' was set to level WARN, the SystemNode log showed a spurious
and incorrect WARN message of failed authentication. When logger 'com.tibco.amx.login'
was set to INFO level, no message was printed to indicate successful authentication.

This issue has now been fixed by introducing a check for authentication status before
printing log messages of any level. With this fix, failure message will be printed only
if there is an authentication failure when logging on to the administrator.

WSBT-1150
In an ActiveMatrix enterprise with Policy Director 1.1.0, when Health Check
was invoked on SOAP Binding Type (BT) endpoints secured with WSS Authentication
Signature Verification, the health check invocation failed with the exception:
Policy enforcement failed to authenticate the request.

This was a result of the internal request message processing for health check
execution, which resulted in tampering of the request message after it had
been signed by the client.

With this fix, the signature verification is carried out before the message is
internally modified for health check execution, and the exception is no longer seen.

For more information on Health Check behavior, refer to the "Health Check" Chapter
in the TIBCO ActiveMatrix Administration Addendum.

WSBT-1151
By default in TIBCO ActiveMatrix the SOAP/HTTP Reference Binding Type (BT), that is,
the SOAP/HTTP client, sets the SOAP Action header name to "soapaction" when constructing
a SOAP request. The value of the header is set to the SOAP Action of the targeted
service endpoint's operation. This created a problem when communicating with certain
third-party legacy service providers, that expected the SOAP Action header name to be
"SOAPAction".

To address this problem, the property
"com.tibco.amf.bindingtype.soap.httpclient.setHTTPHeaderAsSOAPAction" has been introduced
to set the SOAP Action header name to "SOAPAction" instead of "soapaction". When this
property is set to 'true', the header name is set to "SOAPAction", thus allowing successful
end-to-end communication with non-ActiveMatrix third-party legacy service providers.

To enable the fix, set the the property
"com.tibco.amf.bindingtype.soap.httpclient.setHTTPHeaderAsSOAPAction" to 'true' in the
Runtime Node's TRA file as follows:
java.property.com.tibco.amf.bindingtype.soap.httpclient.setHTTPHeaderAsSOAPAction=true

The property can also be set for the Runtime Node using the Administrator UI via
Infrastructure > Nodes > Select Node > Configuration > JVM Configuration
property: com.tibco.amf.bindingtype.soap.httpclient.setHTTPHeaderAsSOAPAction
value: true

================================================================================

See attached Readme document (TIB_amx_3.3.0-HF-023_readme.txt) for installation instructions
and issues resolved in previous hotfix releases.

Hotfix TIB_amx_3.3.0_hotfix023 is available for TIBCO ActiveMatrix(R) BPM 2.2.0 - 4.2.0 and TIBCO Business Studio BPM Edition 3.6.0 - 4.2.0

All Supported Operating Systems

TIBCO ActiveMatrix(R) BPM 2.2.0, 3.0.0, 3.1.0, 4.0.0, 4.1.0, 4.2.0 and
TIBCO Business Studio BPM Edition 3.6.0, 3.7.0, 3.8.0, 3.9.0, 4.0.0, 4.1.0, 4.2.0
Hotfix, TIB_amx_3.3.0_hotfix023, can be downloaded from the SFDC Customer Portal Web User Interface
using your username and password for the TIBCO Support Web.

Once logged on you can find the hotfix under the Downloads Menu:

AvailableDownloads/AMX_BPM/2.2.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/3.0.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/3.1.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/4.0.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/4.1.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/4.2.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/BusinessStudioBPMEdition/3.6.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/BusinessStudioBPMEdition/3.7.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/BusinessStudioBPMEdition/3.8.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/BusinessStudioBPMEdition/3.9.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/BusinessStudioBPMEdition/4.0.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/BusinessStudioBPMEdition/4.1.0/TIB_amx_3.3.0_hotfix023
AvailableDownloads/AMX_BPM/BusinessStudioBPMEdition/4.2.0/TIB_amx_3.3.0_hotfix023

TIB_amx_3.3.0-HF-023_readme.txt