IBM(R) Directory Server Version 4.1 README Addendum

Eight (April 2003)

This edition applies to version 4, release 1, of the IBM Directory Server and to all subsequent releases and modifications until otherwise indicated in new editions.

Preface

This file contains information on changes and fixes that occurred after the product documentation had been translated. This file is in English only. This file can also be found by selecting library on the IBM Directory Server Web page located at http://www.software.ibm.com/network/directory.

Contents

Preface

1.0 Must read known problems and general information

2.0 Platform specific information

3.0 Corrections to documentation

Appendix A. Notices

1.0 Must read known problems and general information

This information applies to the AIX^(R), Windows NT^(R), Windows^(R) 2000, the Solaris Operating Environment Software, and Linux platforms.

1.1 Custom attributes cannot be deleted and added again

When you delete a custom attribute type that contained data, make sure you stop and restart not just the directory server, but also the DB2^(R) instance (using the db2start and db2stop commands), before adding a new custom attribute type that uses the same name as the attribute you just deleted. If you do not stop and restart DB2 after you delete the custom attribute, you will receive an error when you try to add another custom attribute using the same name.

Note:

Ensure that the environment variable DB2INSTANCE is set to ldapdb2 or to whatever you have named the Directory Server DB2 instance.

1.2 Supported cryptographic hardware

IBM Directory Server Version 4.1 supports hardware that uses the BSAFE Hardware API (BHAPI) interface including:

Rainbow Cryptoswift

For Windows NT and Sun 2.7 platforms.

nCipher nFast

For Win/NT and Sun 2.7 platforms.

Rainbow CS 200

For the AIX platform.

1.3 LDAP Kerberos service name change

An environment variable "LDAP_KRB_SERVICE_NAME" is used to determine the case of the LDAP Kerberos service name. If the variable is set to 'LDAP' then the uppercase LDAP Kerberos service name is used. If the variable is not set, then the lower case 'ldap' is used. This environment variable is used by both the ldap client and the server. By default this variable is not set.

1.4 CRAM-MD5 and SASL External not supported by the Directory Management Tool

At this time, if you select Secure Socket Layer (SSL) when you add a server using the Directory Management Tool, the

Authentication types CRAM MD5 (Challenge-Response Authentication Mechanism Message-Digest Algorithm) and SASL External (Simple Authentication Security Layer) are not available. You can still add a server using SSL with the Authentication types None or Simple.

1.5 Add server error with Directory Management Tool

If you have selected SSL and have specified incorrect information in the entry fields and try to add a server, the connection fails. If you correct the entry fields and then try to add the server, the connection fails again.

To correct this situation, you must exit from the Directory Management Tool. Doing this clears the Factory class information. You can now restart the Directory Management Tool and add the server with the correct information.

Note:

Conversely, if you add the server correctly the first time, the connection succeeds. If you disconnect the server and then add it again with incorrect information, the connection still succeeds. This behavior is also corrected by exiting the Directory Management Tool.

1.6 The Directory Management Tool cannot view entries when connected to a Domino(TM) server

The Directory Management Tool cannot view entries when connected to a Domino server. This is a temporary restriction until a version of the Java^(TM) Runtime Environment (JRE) 1.3 with a build date of 20020226 or later becomes available. See the IBM developer kit porting Web site at http://www.ibm.com/developerworks/java/jdk/index.html.

1.7 Configuration prerequisite on UNIX(R) platforms

The IBM Directory configuration programs (ldapcfg, ldapucfg, ldapxcfg) require that the UNIX Korn shell (ksh) be available on the system being configured.

1.8 InstallShield message problems on Linux and Solaris platforms

If you are using the InstallShield Graphical User Interface (GUI) for installations on Solaris or Linux platforms, to prevent messages from being cut off in the installation panels, set the following environment variable before running the setup program:

export JAVA2D_USEAWTFONTS=0

Setting this environment variable helps to prevent text truncation.

1.9 Supported locale settings for the Directory Management Tool on UNIX platforms

To enable the Directory Management Tool and to enable the Directory Management Tool helps, you must set the LC_ALL and LANG environment variables by issuing the following commands in the session where the Directory Management Tool is invoked. For example, if using the korn shell (ksh):

export LANG=xxxxx
export LC_ALL=xxxxx

where xxxxx is the locale taken from the following table.

Note:

Locale values are case sensitive.

Table 1.

Note:

On the Solaris 7 operating system, the Server Administration GUI requires a different code page in the Web server configuration file to run in Japanese and Traditional Chinese languages.

• Japanese - ja_JP.PCK
• Traditional Chinese - zh_TW.BIG5

1.10 Object classes cannot have the same name as the OID

If you want to create an object class, ensure that its name is not the same as the object identifier (OID) of the object class. Otherwise you will have problems with inheritance and be unable to delete the object class.

1.11 Migrating from SecureWay(R) Directory Version 3.1.1

If you are migrating from the from SecureWay Directory Version 3.1.1, you must do a complete migration to Version 3.2 (preferably Version 3.2.2) including starting the server and importing data. To be able to migrate to IBM Directory Version 4.1 you must export your data from Version 3.2.2.

1.12 Client utilities do not call bind functions on administrator DNs

The -D binddn -w passwd option does not call bind functions on administrator DNs for the following utilities:

• LDAPMODIFY, LDAPADD
• LDAPDELETE
• LDAPMODRDN
• LDAPSEARCH

1.13 Client migration problem

The client only package (ldap32client) for the IBM SecureWay Directory Version 3.2.2 creates two entries in the registry:

• The IBM SecureWay Directory client and its version
• The IBM SecureWay Directory Server and its version

This creates a problem when trying to migrate to the IBM Directory Server Version 4.1. The migration tool tries to migrate both the server and the client, although only the client is actually installed. To avoid this problem, you must use the regedit command to manually delete the SecureWay Directory Server and it version from the Registry.

1.14 Client connections must unbind when finished

When an LDAP client connects to a server, the connection and resources associated with it remain active until the client does an "unbind" operation or the TCP/IP connection is broken in some other way. It is very important that LDAP applications are designed to always do unbinds when they are finished with a connection to an LDAP server. This applies to Java applications as well as C applications.

1.15 Directory Management Tool and Java components must be installed when migrating to IBM Directory Server Version 4.1

When migrating to version 4.1, the Directory Management Tool and Java components must be installed for the migration to complete successfully. These components are:

For AIX systems:

4.1.0.0 IBM Directory Client DMT
4.1.0.0 IBM Directory Client Java

For Microsoft^(R) Windows-based systems:

DMT 4.1 and Java 1.3

For Solaris systems:

IBMldapdj IBM Directory DMT

For Linux (Intel-based) systems:

ldap-dmtjava-4.1-1.i386.rpm (no SSL)
ldap-dmtjavad-4.1-1.i386.rpm (SSL enabled)

Note:

This problem does not apply to Linux S/390^(R) because the components are installed as part of the client component.

1.16 Modify DN operations

The IBM Directory Server Version 4.1 supports renaming leaf entries only. It does not support

• changing the superior DN (move)
• renaming entries with children.

1.17 Directory returns attribute names in all lower case

The IBM Directory Server returns the attribute names of a search in lower case. This situation is fixed by installing IBM Directory Server Version 4.1 FixPak 1. You can download the appropriate FixPak for your operating system from the IBM Directory Server Support Web site at http://www.ibm.com/software/network/directory/server/support/efixes.html.

• AIX operating systems - FP410A-01
• HP-UX operating systems - FP410H-01
• Linux (Intel) operating systems - FP410L-01
• Linux S/390 operating systems - FP410T-01
• Solaris operating systems - FP410S-01
• Windows operating systems -FP411W-01

FixPak1 enables you to set an environment variable, IBM_ATTRCASE=YES, either in the slapd32.conf file or as an environment variable. This needs to be done before the slapd process is started.

To edit the slapd32.conf file, use a text editor to add the line:

ibm-slapdSetEnv: IBMLDAP_ATTRCASE=YES

to the stanza:

dn: cn=Front End, cn=Configuration

If the environment variable IBM_ATTRCASE is set to YES (must be in upper case), the server behaves the following way:

• On an ldapsearch without an attribute filter, the returning attributes are the same as they are defined in the schema files (that is, the same case sensitivity as when they were created). For example,

  # ldapsearch -b"o=ibm,c=us" -sbase objectclass=*
              o=IBM,c=US
              objectClass=top
              objectClass=organization
              o=IBM
   
  

  This is the same as the old search behavior or if IBM_ATTRCASE were set to NO.

• On an ldapsearch with an attribute filter, the case of the attributes match exactly what the client passed. For example,

  # ldapsearch -b"o=ibm,c=us" -sbase objectclass=* OBJECTclass
  	    o=IBM,c=US
  	    OBJECTclass=top
  	    OBJECTclass=organization
   
  

  Note:

  In previous releases, the attribute, objectclass, was always be returned in lowercase.

1.18 On UNIX systems you must configure the database in a location other than /home when /home is an NFS mount

If you use NFS automount, you must configure everything manually to create the database in a location other than /home. Performing manual configuration in this situation also avoids the problem of the ldapcfg command trying to write to /home.

Notes:

1. The following steps assume that you want to set up a database like the default ldapdb2 database, that is the instance owner is ldapdb2, DB2 instance is ldapdb2, and database name is ldapdb2.

2. It is strongly recommended to save a copy of any system file before editing it.

1. Create a group named dbsysadm for the database administrators:

   groupadd [-g <gid>] dbsysadm
   

   Note:

   The groupadd command on some Linux distributions requires that the group ID number (gid) be specified using the -g <gid> syntax. Type

   cat /etc/group
   

   to find an available group ID number. Red Hat automatically assigns the next available gid if the -g option is not specified.

2. Add users root and ldap to the dbsysadm group:

   usermod -G dbsysadm root 
   usermod -G dbsysadm ldap
   

3. Create a user account (ldapdb2) for the DB2 instance:

   useradd -g dbsysadm -m ldapdb2
   

4. Set the password for the user account (ldapdb2):

   passwd ldapdb2
   

   Enter the new password when prompted. Record your password for future reference.
5. Create the database instance:

   <LDAPHOME>/db2/instance/db2icrt -u ldapdb2 ldapdb2
   

   where <LDAPHOME> is:
   • AIX, Linux operating systems- /usr/ldap
   • Solaris operating systems - /opt/IBMldaps
   • HP-UX operating systems- /usr/IBMldap
6. Before performing this step save a copy of /etc/services.

   Update /etc/services to include a line for local loopback:

   echo "ldapdb2svc      3700/tcp" >> /etc/services  
   echo "ldapdb2svci     3701/tcp" >> /etc/services
   

7. Log in as the database user id:

   su - ldapdb2
   

8. Start the database manager:

   db2start
   

9. Create the database under the instance:

   db2 create db ldapdb2 on <location> using codeset UTF-8 territory US
   

   Note:

   If you omit the using codeset UTF-8 territory US the database is created in the local code page. However, using the local code page does affect performance. The database requires at least 80Mb of free space available on the filesystem. Use df -k to verify this before creating the database.

10. Enable multi-page file allocation:

    db2empfa ldapdb2
    

    Note:

    This is a performance enhancement, and cannot be undone after being run.

11. Update some of the DB2 tuning variables:

    db2 update db cfg for <databasename> using <parm> <newvalue>
    DB2 Parameter Minimum value allowed
    APPLHEAPSZ 2048
    PCKCACHESZ 360 
    SORTHEAP   256 
     
    

    For example:

    db2 update db cfg for ldapdb2 using APPLHEAPSZ 1280
    

    Note:

    At this point, the database is created. However, for IBM Directory Server Version 4.1, the use of a local loopback database connection is required. To enable local loopback perform the following steps:

    1. Update the database for local loopback connections:

       db2 update dbm cfg using SVCENAME ldapdb2svc 
       db2 catalog tcpip node ldapdb2n remote localhost server ldapdb2svc 
       db2 catalog db ldapdb2 as ldapdb2b at node ldapdb2n authentication client 
       db2set DB2COMM=TCPIP
       

    2. Restart the database manager:

       db2stop 
       db2start  
       

12. The database is fully configured, you can update the configuration file to use this database. In <LDAPHOME>etc/slapd32.conf, in the following stanza:

    dn: cn=Directory,cn=RDBM Backends,cn=IBM SecureWay,cn=Schemas,cn=Configuration 
    objectclass: top 
    objectclass: ibm-slapdRdbmBackend 
    cn: Directory 
    ibm-slapdPlugin:  database /bin/libback-rdbm.dll rdbm_backend_init 
    ibm-slapdDbConnections:  15 
    ibm-slapdSuffix:  cn=localhost 
    ibm-slapdReadOnly:  FALSE
    

    Add the following lines:

    ibm-slapdDbInstance: ldapdb2
    ibm-slapdDbAlias: ldapdb2b
    ibm-slapdDbUserId: ldapdb2
    ibm-slapdDbUserPw: <user pw>
    ibm-slapdDbLocation: <user defined location>
    

    The resulting stanza is:

    dn: cn=Directory,cn=RDBM Backends,cn=IBM SecureWay,cn=Schemas,cn=Configuration 
    objectclass: top 
    objectclass: ibm-slapdRdbmBackend 
    cn: Directory 
    ibm-slapdPlugin:  database /bin/libback-rdbm.dll rdbm_backend_init 
    ibm-slapdDbInstance: ldapdb2
    ibm-slapdDbAlias: ldapdb2b
    ibm-slapdDbUserId: ldapdb2
    ibm-slapdDbUserPw: <user pw>
    ibm-slapdDbLocation: <user defined location>
    ibm-slapdDbConnections:  15 
    ibm-slapdSuffix:  cn=localhost 
    ibm-slapdReadOnly:  FALSE
    

13. If you used a UTF-8 datastore as described in step 9, in the stanza: dn: cn=Front End, cn=Configuration, you must uncomment the line:

    #ibm-slapdSetEnv: DB2CP=1208
    

The database is ready for the Directory server to use. The first startup takes longer because the server must create its own tablespaces and bufferpools. For further reading and documentation, see the IBM(R) Directory Server Version 4.1 Tuning Guide.

1.19 /var requirements on UNIX platforms

Before you install on UNIX platforms, be sure that you have adequate space in the /var directory. A minimum of 100 MB of free space in /var is recommended.

1.20 Using Secure Sockets Layer (SSL) with the Directory Management Tool (DMT)

The following process describes what you need to do if you do not already have SSL enabled and configured on your Directory server. This process includes instructions on how to:

• Set up the key databases
• Set up java keystores
• Exchange certificates
• Set up the Directory for SSL
• Use the DMT to connect to the Directory server.

Connecting to SSL

This section discusses how to set up key databases, java keystores, and exchange certificates between the client and the server.

To enable SSL on the Directory Management Tool you must perform the following.

Notes:

1. The DMT no longer supports the use of .class files.

2. You can select to use several key database types. The following procedure is based on selecting the jks format. If you select a different format, the steps might vary. For additional information on the Java Secure Socket Extension (JSSE), or the Java Cryptography Extension (JCE) see the IBM Developerworks Security Documentation Web site at http://www.ibm.com/developerworks/java/jdk/security/index.html .

3. On the AIX operating systems, if you are prompted to set JAVA_HOME, you can set it to either the system-installed Java or the Java version included with the IBM Directory Server. If you use the IBM Directory Server version, you also need to set the LIBPATH environment variable as follows:

     export LIBPATH=/usr/ldap/java/bin:/usr/ldap/java/bin/classic:$LIBPATH
    
   

The following procedure are written in reference to the Windows platforms. If your DMT is going to be on a UNIX platform, please be aware of the difference in directory structures. LDAPHOME varies by operating system platform:

• AIX operating systems- /usr/ldap
• Linux operating systems- /usr/ldap
• Solaris operating systems - /usr/IBMldapc
• Windows operating systems - c:\Program Files\IBM\LDAP

  Notes:

  1. These are the default install locations. The actual LDAPHOME is determined during installation.

  2. DMT is not supported on HP-UX operating systems.

On the SSL server:

1. Start gsk5ikm.

   gsk5ikm
   

2. Create a new key database. Click KeyDatabase File -> New.
3. Fill in the following fields:
   • key database type: CMS
   • File Name: <servername>.kdb
   • Location: <LDAPHOME>\KeyRings\ .

     Note:

     The location and path specified must match the location and path specified in "key database path and file name" in Security -> SSL -> Settings on the Server Administration.

4. Click OK.
5. Enter a password. <password>
6. Confirm the password. <password>
7. Click OK.
8. Use the pull-down menu in the middle of the screen and select Personal Certificates.
9. Click the New Self Signed button and fill in the following fields:
   • key label: <servercertificatename>
   • Common Name: <servercertificatename>.autin.ibm.com
   • Organization: IBM

   Use the default settings for all the other fields.

10. Click OK.
11. Select <servercertificatename> in the list of personal certificates. Click the Extract Certificate button and fill in the following fields:
    • Data type: Base64-encoded ASCII data
    • Certificate file name: <servercertificatename>.arm
    • Location: <LDAPHOME>\keyrings\.
12. Click OK.
13. FTP <servercertificatename>.arm to a client system.

On the client:

1. Start the ikeyman tool:
   1. Move <LDAPHOME>\jre\lib\ext\ibmjcaprovider.jar to a different directory. For UNIX systems this is <LDAPHOME>/java/lib/ext/ibmjcaprovider.jar.
   2. Edit <LDAPHOME>\jre\lib\security\java.security file (for UNIX platforms this is the <LDAPHOME>/java/\lib/security/java.security file) to modify the statement security.provider.2=com.ibm.crypto.provider.IBMJCA to security.provider.2=com.ibm.crypto.provider.IBMJCE
   3. Go to the directory <LDAPHOME>\jre\bin or modify PATH to ensure that the java executable in <LDAPHOME>\jre\bin is used in this session. For UNIX systems this directory is /java/bin.
   4. Enter the following command to start ikeyman tool:

      java com.ibm.ikeyman.Ikeyman
      

2. Create a new key database. Click KeyDatabase File -> New.
3. Fill in the following fields:
   • key database type: jks
   • File Name: <clientname>.jks
   • Location: d:\ (for UNIX platforms use<LDAPHOME>/etc/).
4. Click OK.
5. Enter a password <password>.
6. Confirm the password <password>.

   Use the default settings for all the other fields.

7. Click OK.
8. Use the pull-down menu in the middle of the screen and select Signer Certificates.
9. Click the Add button and fill in the following fields:
   • Data type: Base64-encoded ASCII data
   • Certificate file name: <servercertificatename>. (This is the file copied from the server.)
   • Location: d:\ (for UNIX platforms use <LDAPHOME>/etc/).
10. Click OK.
11. Enter a label: <servercertificatename>.
12. Click OK.
13. Use the pull-down menu in the middle of the screen and select Personal Certificates.
14. Click the New Self Signed button and fill in the following fields:
    • key label: <clientcertificatename>
    • Common Name: <clientcertificatename>
    • Organization: IBM

      Use the default settings for all the other fields.

15. Click OK.
16. Select <clientcertificatename> in the list of personal certificates and click View/Edit. Write down the Serial Number : (for example, 10:13:11:16:47)
17. Select <clientcertificatename> in the list of personal certificates and click the Extract Certificate button and fill in the following fields:
    • Data type: Base64-encoded ASCII data
    • Certificate file name: <clientcertificatename>.arm
    • Location: d:\ (for UNIX platforms use <LDAPHOME>/etc/).
18. Click OK.

    Note:

    You might have to click KeyDatabase File-> Save as to save the data without exiting the ikeyman tool.

19. FTP <clientcertificatename>.arm to the server system.
20. Move jcaprovider.jar back to its original location, <LDAPHOME>\jre\lib\ext\. For UNIX systems this is <LDAPHOME>/java/lib/ext/.

On the SSL Server:

1. Start gsk5ikm.

   gsk5ikm
   

2. Open <LDAPHOME>\etc\keyrings\<servercertificatename>.kdb.
3. Use pull-down menu in the middle of screen and select Signer certificates.
4. Click the Add button and fill in the following fields:
   • Data type: Base64-encoded ASCII data
   • Certificate file name: <clientcertificatename>.arm (This is the file copied from the client.)
   • Location: <LDAPHOME>\etc\keyrings\ .
5. Click OK.
6. Enter a label: <clientcertificatename>
7. Click OK.
8. Exit the gsk5ikm tool.

Setting up the Directory server for SSL

For all non-Linux platforms use either the Server Administration utility or the command line to enable the IBM Directory Server to use SSL . Linux platforms must use the command line.

Using Server Administration:

1. Login into the Web Administrator.
2. Click the arrow to the left of Security in the navigation area, then click the arrow to the left of SSL, then click Settings.
3. Select the SSL status. Select either:
   • SSL Only - Clients are not permitted to conduct non-secure communications. This is the most secure way to configure your server.
   • SSL On - Clients can accept both secure and unsecured connections.
4. Select the Authentication method:
   • Server Authentication - validates the server to the client so that the client knows it is communicating with a valid server.
   • Server and Client Authentication - validates the server to the client so that the client knows it is communicating with a valid server and validates the client to the server so that the server knows it is communicating with a valid client.
5. Enter the Secure port number. The default secure port is 636.
6. Enter the Key database path and file name. For example: <LDAPHOME>\KeyRings\server.kdb.
7. Enter the Key label.
8. Enter a Key password if there is no password stash file for the key database or if you want to override an existing password stash.
9. If you entered a Key password, enter the password again in Confirm password to confirm there are no typographical errors.
10. Click Update.
11. After a message displays the settings were successfully updated, you must restart the server using the Restart icon in the upper right corner for the changes to take effect.

Using command line:

1. Stop slapd.
2. Using a text editor, update slapd32.conf to include the following:
   • Change ibm-slapdsecurity to ssl or sslonly.
   • Change ibm-slapdsslauth to serverAuth or serverClientAuth.
   • Change ibm-slapdsslkeydatabase to path and filename of the .kdb file you created on the Directory server in Connecting to SSL.
   • Add ibm-slapdsslkeydatabasePW with a the password of the .kdb file referenced in the value for ibm-slapdsslkeydatabase
3. Save your changes and exit the slapd32.conf file.
4. Start slapd.

Setting up DMT to connect to the IBM Directory Server

To add a new server, click Add server at the bottom of the navigation area.

1. Enter the Server name of the server you want to connect to. Use either the IP address in quadruple format, for example, 9.53.92.149, or the domain name in the format hostname.domainname, for example, TEST.AUSTIN.IBM.COM.
2. Select the Use SSL checkbox, which automatically changes the port to 636. If you want to use a port number other than the default 636, you must manually enter the number in the Port field.
3. Select an Authentication type

   Note:

   No matter what Authentication type you choose, you must fill in the Keystore and Truststore fields, even though the file might be the same for each field, otherwise the DMT fails to connect.

   • If you select None or SASL External:
     1. Enter the Keystore filename - The fully qualified path to a client-side certificate file name which is used for mutual (server and client) authentication. For example: <LDAPHOME>\clientkr\client.jks.
     2. Enter the Keystore file password - The password for the Keystore file.
     3. Enter the Keystore file type - The keystore file format for example, jks, pkcs12, and so forth.
     4. Enter the Truststore file name - The fully qualified path to a trusted CA certificates database file. For example: <LDAPHOME>\clientkr\client.jks .
     5. Enter the Truststore file password - The password for the Truststore file.
     6. Enter the Truststore file type - The truststore file format for example, jks, pkcs12, and so forth.
   • If you select Simple or CRAM MD5:
     1. Enter the User DN - The DN used to connect to the server. If no User DN is specified, the connection is anonymous.
     2. Enter the User Password - The password used to provide access to the server if you specified a User DN.
     3. Enter the Keystore filename - The fully qualified path to a client-side certificate file name which is used for mutual (server and client) authentication. For example: <LDAPHOME>\clientkr\client.jks.
     4. Enter the Keystore file password - The password for the Keystore file.
     5. Enter the Keystore file type - The keystore file format for example, jks, pkcs12, and so forth.
     6. Enter the Truststore file name - The fully qualified path to a trusted CA certificates database file. For example: <LDAPHOME>\clientkr\client.jks.
     7. Enter the Truststore file password - The password for the Truststore file.
     8. Enter the Truststore file type - The truststore file format for example, jks, pkcs12, and so forth.
4. Click OK to add the server, if you selected an authentication of none or simple you can click Save to save the server information to the dmt.conf file, or click Cancel to return to Browse tree without saving changes. To make changes to an existing server, delete the server, then add a new server with the updated information.

Notes:

1. This does not enable you to be able to use the client tools such as ldapsearch, ldapmodify, and so forth from the client to the directory server.

2. This process must be done even if you intend to use the DMT locally on the directory server over SSL. In other words, the DMT is not able to use the .kdb file that you created and configured the Directory server with. You must create a keystore as indicated in this process.

1.21 Password Guidelines

The following document provides details of the supported values of the IBM Directory Server (IDS) password attribute for user entries in the IBM Directory Server, as well as the accounts used to administer the LDAP environment. It also provides guidelines of what characters to avoid to reduce confusion attempting to run using the Directory Server command line tools and C-API interfaces.

The Directory Server has two types of user accounts:

• Administration accounts (LDAP Administrator, cn=root or the LDAP DB2 user) that are stored in the /etc/slapd32.conf file.
• User Entries (iNetOrgPerson) that have a password attribute used with Directory Server C and java (JNDI) APIs. These are the interfaces that applications, such as Policy Director and WebSphere use. While the Directory Server supports a wide variety of values for password entries, you need to review the application documentation to confirm what guidelines or restrictions apply.

The following provides details and recommendations of the supported password values using the IBM Directory Server 4.1 release.

Passwords for User Entries (InetOrgPerson) stored in the IBM Directory Server using the C or java Software Development Kits

Using the 4.1 release, the following characters are supported for the userPassword attribute field to be stored in the Directory Server using the C and java APIs. Applications, such as Policy Director, WebSphere, and so on, that are using the Directory Server might have additional restrictions on password values. Please review these specific product documentation for additional information.

• All upper and lower case English alpha and numeric characters.
• All other ASCII English characters are supported.
• Double-byte characters are supported for languages specified in the IBM Directory Server Version 4.1 Release Notes documentation.
• Passwords are case sensitive. (For example, if the password = TeSt, using a password of TEST or test fails. Only the exact case, TeSt, works.)

LDAP slapd32.conf users:

Using the 4.1 release, the following are the supported passwords for users that are in the <LDAP_DIR>/etc/slapd32.conf file.

• All upper and lower case English alpha and numeric characters.
• All other ASCII single-byte characters are supported.
• Passwords are case sensitive. (For example, if the password = TeSt, using a password of TEST or test fails. Only the exact case, TeSt, works.)

Notes:

1. The Users in the slapd32.conf file may include the following:
   • LDAP Administrator (cn=root)
   • Master ID for Replication (cn=MASTER)
   • LDAP DB2 users for LDAP DB entry and change log databases (LDAPDB2)

2. Double-byte characters in the administrator passwords are not supported.

Using the IDS Directory Management Tool and Server Administration Tools to modify password attributes:

Using the Directory Management Tool in the 4.1 release, the following characters are supported for adding/modifying the password attribute field:

• All upper and lower case English alpha and numeric characters.
• All other ASCII single-byte characters are supported, with the following exception:
  • The Directory Management Tool does allow users to create a password with the { as the first character in the 4.1 release. However, when you attempt to authenicate using a password with this value, you are unable to logon.

    Note:

    This limitation no longer exists after Version 4.1 eFix 2.

• Passwords are case sensitive. (For example, if the password = TeSt, using a password of TEST or test fails. Only the exact case, TeSt, works.)

Notes:

1. Double-byte characters are not supported for the administrator password.

2. Double-byte characters are supported for the user password.

Additional Recommendations:

It is recommended that you avoid using the following characters because the operating shell might interpret these "special" characters:

	`
	'
	\
	"
	|
 
 

For example, Using the 4.1 Directory Management Tool to assign a user password attribute to the value:

	"\"test\'

requires the following password from the command line to be used:

-w\"\\\"test\' 

Here is an example search:

ldapsearch -b" " -sbase  -Dcn=newEntry,o=ibm,c=us   -w\"\\\"test\' objectclass=*

Note:

This password works in the Directory Management Tool/java application using the original password without the escape character. In the previous example, the Directory Management Tool bind password is the same as the one that was entered when assigning the password in the Directory Management Tool:

	"\"test\'

2.0 Platform specific information

2.1 For AIX only

The following information applies only to the AIX operating system.

2.1.1 Supported levels of the AIX operating system

The IBM Directory Server Version 4.1 is supported on the following levels of the AIX operating system:

• On the AIX operating system Release 4.3.3 and on higher maintenance levels of AIX Release 4.3
• On the AIX operating system Release 5.1L and on higher maintenance levels of AIX Release 5.1

2.1.2 Additional prerequisite for the AIX Version 4.3.3 operating system

Before installing the IBM Directory Server Version 4.1 on the AIX Version 4.3.3 operating system, ensure that the following file sets have been installed:

bos.adt.prof.4.3.3.3
bos.adt.prof.4.3.3.15

2.1.3 Additional requirements for the InstallShield GUI on the AIX operating system

The InstallShield GUI uses Java 1.3.1, and requires the following operating levels of AIX:

For AIX Version 4.3.3, Java 1.3.1 requires the AIX 4330-09 Recommended Maintenance Level. This maintenance package is intended for customers who already have AIX 4.3.3 installed. The AIX 4330-09 maintenance package can be downloaded from http://techsupport.services.ibm.com/rs6000/fixes/, using APAR number IY22024. If you are a licensee of AIX 4.3.3, you can obtain an Update CD by contacting your point of sale and requesting feature code 0838.

For AIX Version 5.1, Java 1.3.1 requires the AIX 5100-01 Recommended Maintenance Level. This maintenance package is intended for customers who already have AIX 5.1.0 installed. The AIX 5100-01 maintenance package can be downloaded from http://techsupport.services.ibm.com/rs6000/fixes/, using APAR number IY21957. If you are a licensee of AIX 5.1, you can obtain an Update CD by contacting your point of sale.

Note:

Before updating your AIX 5.1.0 system to the AIX 5100-01 maintenance level, you must first apply and commit APAR IY19375 (which includes bos.mp64 5.1.0.1, bos.mp 5.1.0.1, and bos.up 5.1.0.1). Run smitty update and pick IY19375 to install. When the installation is completed, you must restart your system. After the system has restarted, you can then install the AIX 5100-01 maintenance level. After the maintenance level has been installed, you must again restart your system. See the AIX 5L^(TM) for POWER Version 5.1 Release Notes for more information. APAR IY19375 can be obtained from the AIX Electronic Fix Distribution site: http://techsupport.services.ibm.com/rs6000/fixes/.

2.1.4 The InstallShield GUI does not support Catalan and Slovakian languages

The InstallShield Graphical User Interface (GUI) for AIX does not have language support for Catalan and Slovakian. You can still use the InstallShield GUI to install the IBM Directory Server Version 4.1 with the English files. If you want to install the translated version of the IBM Directory Server , you must use the smit utility. See the IBM Directory Server Version 4.1 Installation and Configuration Guide for Multiplatforms for details on using smit to install the IBM Directory Server.

2.1.5 The ldapxcfg utility fails if issued from a nonwritable network drive

The ldapxcfg configuration utility fails if issued from a nonwritable network drive. You must change to a writable, nonnetwork drive (for example, /tmp), before running the configuration program.

2.1.6 Incremental installations do not support partial removals

When installing using the InstallShield GUI, all the components that you want to install (for example: server, client, DB2, and so forth) need to be installed at the same time, if at a later time you might want to remove a component. If incremental installations are done, that is the client is installed, and later the server is installed , then all components must be uninstalled together, otherwise the uninstall process fails, although it indicates success.

2.1.7 No readmes or license panels are displayed

No readmes or license panels are displayed during the InstallShield GUI installation. The readmes, server.pdf or .htm and client.pdf or .htm, can be found in the /usr/ldap/language/readme/ directory on the installation CD. After the installation, the license files are in the directory /usr/ldap/license.

2.1.8 Space requirements for the /tmp directory

Because the InstallShield GUI uses a significant amount of /tmp space on AIX. It is recommended that you increase the amount of /tmp space from 400 MB to at least 650 MB.

2.1.9 The 64-bit client is missing the symbolic link /lib/libldapiconv64.a

The IBM Directory Version 4.1 64-bit client is missing the symbolic link /lib/libldapiconv64.a . The libibmldap64.a file is needed in the /lib directory to run 64 bit Kerberos on AIX 5.1. To create this link, issue the following command:

ln -s /usr/ldap/lib/aix5/libldapiconv64.a 	/lib/libldapiconv64.a 

2.2 For Windows NT, Windows 2000 and Windows 98 only:

The following information applies only to theWindows NT and Windows 2000 platforms.

2.2.1 The PATH environment variable must be set manually on Windows 98

The installation process for the Windows 98 client does not automatically set the PATH environment variable. You must manually set this variable to:

<installation drive>:\<installation path>\bin

2.2.2 Pop-up options do not function

When installing on Windows operating systems, if you already have some IBM Directory Server files on your system, you might receive a pop-up that says, "The program xxx exists on this system and is newer than the one being installed. Do you want to replace this file?" You cannot select any option on this pop-up. You must click the x to close this pop-up box so that the install can continue. Please note that the files mentioned in this pop-up are not replaced.

When installing in a directory other than C:\Program Files\IBM\LDAP, the start icons are not created on the desktop.

2.3 For Solaris Operating Environment Software only:

The following information applies only to the Solaris Operating Environment Software.

2.3.1 Solaris 8 patches

You need to install the recommended patches for the Solaris 8 operating system, to ensure correct execution of LDAP utility functions (such as ldif2db, db2lidf and bulkload). You can download Solaris patches directly from Sun Microsystems, Inc. at the following Web site: http://sunsolve.Sun.COM.

2.3.2 Viewing InstallShield license file problem

When installing the IBM Directory Server in a language other than English, if you select the View in English button on the license agreement panel for the InstallShield utility, the install ends. This is a known problem and a permanent restriction for this release.

2.3.3 Cleaning up /tmp space

Using the InstallShield GUI might leave tempory directories in the /tmp directory. To free this space you need to delete any directories with ismp* from the /tmp directory after you have completed installing the IBM Directory Server Version 4.1 on your machine.

2.3.4 Solaris kernel configuration parameters

Running DB2 on the Solaris operating system might require updating Solaris kernel configuration parameters.

To set a kernel parameter, add a line at the end of the /etc/system file as follows:

set <paramter_name> = <value>

For example, to set the value of the msgsys:msginfo_msgmax parameter, add the following lines to the end of the /etc/system file:

set msgsys:msginfo_msgmax = 65535
set msgsys:msginfo_msgmnb = 65535
set msgsys:msginfo_msgmap = 258
set msgsys:msginfo_msgmni = 256 
set msgsys:msginfo_msgssz = 16
set msgsys:msginfo_msgtql = 512
set msgsys:msginfo_msgseg = 32768
 
set shmsys:shminfo_shmmax = 268435456
set shmsys:shminfo_shmseg = 64
set shmsys:shminfo_shmmni = 300
set semsys:seminfo_semmni = 512
set semsys:seminfo_semmap = 514
set semsys:seminfo_semmns = 1024
set semsys:seminfo_semmnu = 1024
set semsys:seminfo_semmsl = 50
 
set max_nprocs = 65535
set maxuprc = 65535

Sample files with recommended configuration parameters are provided in the /opt/IBMdb2/V7.1/cfg directory.

Note:

At the time of this release DB2 Version 7.2 is functionally equivalent to DB2 Version 7.1 with FixPak 3. DB2 maintains the Version 7.1 package names in Version 7.2.

The file names are (based on the amount of physical memory on your system):

• kernel.param.64 for systems with 64 MB through 128 MB of physical memory
• kernel.param.128 for systems with 128 MB through 256 MB of physical memory
• kernel.param.256 for systems with 256 MB through 512 MB of physical memory
• kernel.param.512 for systems with more than 512 MB of physical memory

2.3.5 Solaris 7 locales for Server Administration and the Directory Management Tool

For the Server Administration utility, use the following locales in the Web server's configuration file. These locales are case sensitive.

Table 2. Server Administration locales

For the Directory Management Tool utility, use the following locales in the session where the Directory Management Tool is invoked. These locales are case sensitive.

Table 3. Directory Management Tool locales

2.3.6 Cannot use ldapcfg or ldapxcfg to configure the Directory after migration

When migrating to IBM Directory Server Version 4.1 from a previous release of the IBM SecureWay Directory, the uninstallation of the previous directory does not always remove all the files.

On the Solaris operating system, if you use the pkgrm command to uninstall the SecureWay Directory and DB2, you might encounter problems trying to configure the IBM Directory Version 4.1.

If you have successfully installed the updated DB2 and Directory 4.1 and are unable to run ldapcfg or ldapxcfg to configure the Directory. Check if the following symbolic links were left behind from the previous version of the Directory:

lrwxrwxrwx 1 root other 30 Aug 20 16:56 /opt/IBMldaps/lib/libdb2.so ->
                      /opt/IBMdb2/V6.1/lib/libdb2.so 
 
lrwxrwxrwx 1 root other 32 Aug 20 16:56 /opt/IBMldaps/lib/libdb2.so.1 ->
                    /opt/IBMdb2/V6.1/lib/libdb2.so.1

If these symbolic links were not removed when the previous version of the Directory was removed or they were not overwritten when Directory 4.1 was installed, you must either of the following:

• Manually remove the stale symbolic links from the /opt/IBMldaps/lib directory after uninstalling the old version of Directory.
• Remove and create the proper symbolic links to the new version of DB2 after the Directory 4.1 is installed.

2.4 For Linux only:

The following information applies only to the Linux operating systems.

2.4.1 Additional memory requirements on the Linux S/390 operating system

If you are operating the Directory Management Tool on the same machine that you installed the IBM Directory Server, you might need to increase your memory from the minimum requirement of 256 MB to the strongly recommended level of 512 MB.

2.4.2 CRAM-MD5 implementation on Linux S/390

At this time CRAM-MD5 implementations on Linux S/390 do not interact with non-LinuxS/390 platforms.

2.4.3 Audit logging fails on Linux S/390 when migrating

If you are migrating from the SecureWay Directory Version 3.2.2, to enable audit logging to function, users on Linux S/390 need to manually add a line to the slapd32.conf file. In the stanza that begins with the dn:

dn: cn=SchemaDB,cn=LDCF Backends,cn=IBM SecureWay,cn=Schemas,cn=Configuration

add the line:

ibm-slapdPlugin: audit /lib/libldapaudit.so audit_init

2.4.4 The configuration GUI and Directory Management Tool might display incorrectly on TurboLinux Version 7.0 for double-byte languages

Currently in double-byte languages, any IBM Directory Server applications that have a GUI and are using Java coding, might display corrupted text on TurboLinux 7.0. These applications display correctly on TurboLinux 6.5.

2.4.5 Directory Management Tool support is available on the Japanese version of Linux Red Hat 7.1

In the IBM Directory Server Version 4.1 server readme, section 6.2.4 stated that trying to start the Directory Management Tool on the Japanese version of Linux Red Hat 7.1 resulted in an 'mprotect' error message. This condition has been corrected.

2.4.6 Installing the IBM Directory Server Version 4.1 with DB2 Version 8

If you you have DB2 Version 8 installed and are installing the IBM Directory Server Version 4.1 using the native RPM installation, you must specify the --nodeps flag. For example:

rpm -i --nodeps ldap-server-4.1-1.i386.rpm

After installing the IBM Directory Server with either the InstallShield GUI installation or the native RPM installation, the following links and modifications need to be made:

ln -fs /opt/IBM/db2/V8.1/lib/libdb2.so    /usr/ldap/lib/libdb2.so
    chown    ldap.ldap    /usr/ldap/lib/libdb2.so

ln -fs /opt/IBM/db2/V8.1      /usr/ldap/db2
    chown    ldap.ldap    /usr/ldap/db2

2.4.7 On SuSe 7.2 Directory Management Tool panels display supported languages.

In the IBM Directory Server Version 4.1 server readme, section 6.8.2 stated that only English panels were displayed for the Directory Management Tool on SuSe 7.2. This condition has been corrected and the Directory Management Tool panels are displayed in the supported languages.

2.4.8 The server must be stopped before removing the IBM Directory Server on Linux S/390

You must stop the server before uninstalling the IBM Directory Server. If you attempt to uninstall the IBM Directory Server while the server is running, you can complete the operation, but the server continues to run.

2.4.9 No separate packages for the Directory Management Tool on Linux S/390

IBM(R) Directory Server Version 4.1 Installation and Configuration Guide for Multiplatforms lists in the chapter 'Installing using Linux utilities' the lists following packages for Linux S/390:

• ldap-dmtjava-4.1-1.s390.rpm (no SSL)
• ldap-dmtjavad-4.1-1.s390.rpm (SSL enabled)

These packages do not exist for Linux S/390, they apply only to Linux (Intel-based distributions). The Directory Management Tool for Linux S/390 is included in the client packages.

2.4.10 Directory Management Tool supported on Linux S/390

IBM Directory Server 4.1 Release Notes says that the Directory Management Tool interoperates with the IBM Directory Server on Linux (Intel-based distributions). The restriction is no longer true. The Directory Management Tool interoperates with the IBM Directory Server on Linux Intel-based distributions and Linux S/390.

2.4.11 Configuration utilities fail on Linux S/390 with 2.4 kernel

The java supplied with the IBM Directory Server Version 4.1 in the /usr/ldap/java directory fails on Linux S/390 with 2.4 kernel. It returns the error:

**Out of memory, exiting**

To avoid this error use either the IBM JDK or JRE Version 1.3.1.

After installing the IBM Directory Server Version 4.1, perform the following:

1. Either rename or remove the /usr/ldap/java dir and create a link to the 131 version of java.
   • For example, if you are using the default JRE,

     ln -s /opt/IBMJava2-s390-131/jre /usr/ldap/java
     

2. Edit the /usr/ldap/bin/ldapcfg file need to remove the comment ( # ) from the line:

   # export LD_PRELOAD=/usr/lib/libstdc++-libc6.2.2.so.3
   

The ldapcfg, ldapxcfg, and ldapucfg utilities can now be used.

2.5 For HP-UX only

This information applies to the HP-UX operating system only.

2.5.1 Additional memory requirements for the HP-UX operating system

The minimum memory requirement for the IBM Directory Server is upgraded from 256 MB to 512 MB.

2.5.2 Mounting the cd

To mount the cd, issue the following commands:

1. pfs_mountd &
2. pfsd &
3. mkdir /cdrom
4. pfs_mount <cd-rom device name> /cdrom

An example of a <cd-rom device name> is /dev/rdsk/c0t2d0.

Note:

swinstall does not automatically read the CD. You need to supply the full path to the install image. The path to the SSL enabled client-server package is /cdrom/ldap41_us/hpux11_ibmldap41servers.depot.

3.0 Corrections to documentation

Attention: Links to the Library page on the IBM Directory Web site, might change. If the documentation links do not function correctly go to http://www.ibm.com/software/network/directory/ and select library from the referenced page.

The following information became available after the documentation was translated.

3.1 IBM Directory Server Version 4.1 Administration Guide

This information applies to the Administration Guide:

3.1.1 Peer-to-peer example correction

In the Example section of Using peer-to-peer replication the following stanzas have been changed by removing the machine reference from the replicaHost attribute and the addition of several other attributes:

A replica object is added to the machine 1 database through the following ldif file:

dn: cn=machine2, cn=localhost
cn: machine2
replicaBindDN: cn=peer
replicaCredentials: <machine2password>
replicaPort: 389
replicaHost: <fully-qualified-hostname>
replicaBindMethod: Simple 
replicaUseSSL: FALSE 
replicaUpdateTimeInterval: 0
objectclass: replicaObject 
objectclass: top
 

and the stanza:

A replica object is added to the machine 2 database through the following ldif file:

dn: cn=machine1, cn=localhost
cn: machine1
replicaBindDN: cn=peer
replicaCredentials:  <machine1password>
replicaPort: 389
replicaHost: <fully-qualified-hostname>
replicaBindMethod: Simple 
replicaUseSSL: FALSE 
replicaUpdateTimeInterval: 0
objectclass: replicaObject 
objectclass: top
 

3.1.2 Undocumented parameters for the bulkload command

These previously undocumented parameters are supported by the bulkload command:

-R <yes|no>

Specifies whether to remove the directory which was used for temporary data. Default is yes.

Note:

This directory is the default directory ore the one specified by the -L parameter.

-x|-X <yes|no>

Specifies whether to translate entry data to database code page. Default is no.

Note:

This parameter is only necessary when using a non-UTF-8 database.

3.1.3 The -n option is no longer supported on ldapadd and ldapmodify

Beginning with the Version 4.1 release the -n option for the ladpadd and ldapmodify commands is no longer supported. Ignore any references to it in the IBM Directory Server Version 4.1 Administration Guide command line utilities documentation.

3.2 IBM Directory Server Version 4.1 Installation and Configuration Guide for Multiplatforms

The following information applies to the Installation Guide:

3.2.1 Incorrect path of Java directory in the migration documentation

In "Chapter 11. Migration" in the IBM Directory Server Version 4.1 Installation and Configuration Guide for Multiplatforms, the "Migration from SecureWay Directory Version 3.2.x for Windows 2000 or Windows NT InstallShield GUI installations" and "Migration from SecureWay Directory Version 3.2.x for UNIX installations" sections refer to the following JNDI related directory paths:

• etc/java/bin
• etc/java/lib

These paths are incorrect. On a UNIX operating system, the correct JNDI related directory paths are:

Source (copy from):

• <install path>/java/bin/*
• <install path>/java/bin/*
• <install path>/java/lib/*

Target (copy to):

• <install path>/etc/userV41/java
• <install path>/etc/userV41/java/bin
• <install path>/etc/userV41/java/lib

For a Windows 2000 or Windows NT operating system, use back slashes instead of forward slashes:

<install path>\java\bin\* 

3.2.2 Incorrect Web server default paths and configuration file names

In the IBM Directory Server Version 4.1 Installation and Configuration Guide for Multiplatforms, 'Chapter 9. Configuration' contains some incorrect Web server default paths and configuration file names. The correct paths and file names are:

• IBM HTTP Server on a Solaris operating system:

  /opt/IBMHTTPD/conf/httpd.conf
  

• iPlanet Web server on AIX and Solaris operating systems:

  /usr/netscape/server4/https-<fully qualified domain name>/config/obj.conf
  

• Domino Web server on an AIX operating system:

  /local/notesdata/httpd.cnf
  

• Apache Server on an AIX operating system

  /usr/local/apache/conf/httpd.conf
  

3.2.3 Location of the Setup.exe file

In Chapter 3 under the section Installing IBM Directory 4.1 on a Windows 98, Windows 2000 or Windows NT platform, step 1 of both the typical and custom installations does not specify the location of the Setup.exe file. The following is the correct text for both steps.

To begin installing IBM Directory 4.1:

1. Insert the CD in your CD-ROM drive.

   If the CD-ROM does not automatically start, click Start->Run. Depending on whether you are installing locally from a CD or remotely from the network, select the drive for your CD-ROM or for the appropriate network path. In the \ismp folder, double-click the Setup.exe icon.

   A language panel is displayed.

3.2.4 Correction to silent installation

The correct first step is:

1. At a command prompt, type the following:

   d:
   cd \ismp
   setup -is:silent -options d:\ismp\optionsFiles\InstallServer.txt
   

   where d: is the CD-ROM drive or the drive from which you are installing the IBM Directory Server.

3.3 IBM Directory Server Version 4.1 Server README

The following information applies to the Server README.

Clarification for section 5.9.7 Support for Linux for S/390

This release supports Linux for S/390. Using DB2 fixpack7 with either DB2 7.1 fixpack3 or DB2 7.2, enables Suse SLES 7.0 and Red Hat 7.2 to be supported with the 2.4 kernel. To enable the ldap client operations to work with the 2.4 kernel, set the environment variable LD_PRELOAD to /usr/lib/libstdc++-libc6.1-2.so.3. TurboLinux is supported with the 2.2.19 kernel.

Appendix A. Notices

This information was developed for products and services offered in the U.S.A. IBM might not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to:

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the information. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this information at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurement may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only.

All IBM prices shown are IBM's suggested retail prices, are current and are subject to change without notice. Dealer prices may vary.

Trademarks

The following terms are trademarks of International Business Machines Corporation in the United States, or other countries, or both:

     AIX      DB2        IBM      SecureWay     S/390

Domino is a trademark of the Lotus^(R) Development Corporation

Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries.

Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.

UNIX is a registered trademark in the United States and/or other countries licensed exclusively through X/Open Company Limited.

Other company, product, and service names may be trademarks or service marks of others.