z/OS LDAP Changelog Connector

The z/OS LDAP Changelog Connector is a specialized instance of the LDAP Connector. It is configured for usage with a z/OS Directory Server, accessed using the LDAP protocol over TCP/IP ("zLDAP").

There are some differences in the way the changes to password policy operational attributes are logged to cn=changelog in IBM Security Directory Server on z/OS and in Distributed IBM Security Directory Server (which runs on other platforms). See Differences between changelog on distributed TDS and z/OS TDS for details on the currently known differences in behavior between the two versions.

This connector supports Delta Tagging, at the Entry level, the Attribute level and the Attribute Value level. It is the LDIF Parser that provides delta support at the Attribute and Attribute Value levels.

This connector is able to intercept changes from the changelog of a RACF® (Resource Access Control Facility) LDAP server. RACF is the security manager of z/OS and it maintains a database containing usernames and passwords. Changes to this database can be logged in the changelog of an LDAP server such as IBM Security Directory Server. The changelog of this server can be accessed trough the GDBM LDAP interface and the RACF database itself - through the SDBM interface. This connector is suitable for propagating changes of sensitive information (usernames, passwords, and so forth) across LDAP servers on different z/OS machines or other distributed platforms.

The Connector will detect modrdn operations in the Server's changelog, see Detect and handle modrdn operation for more information.