iPlanet Directory Access Router Service Pack 1

Release Notes

Updated May 17, 2002

---

These release notes contain important information about iPlanet™ Directory Access Router Service Pack 1. New features and enhancements, installation notes, known problems, and other late-breaking issues are addressed here. Read this document before you begin using iPlanet Directory Access Router (DAR).

These release notes contain the following sections:

• What's New in Directory Access Router, Version 5.0 SP1




• DAR Documentation




• Installation Notes




• Important Notes




• Known Problems and Limitations




• How to Report Problems




• For More Information

What's New in Directory Access Router, Version 5.0 SP1

• The supported platforms list has changed; check the DAR Installation Guide for details.




• Java based GUI consoles, called the DAR Server Console and DAR Configuration Editor Console, to aid in the configuration of DAR. It is recommended that you use the DAR consoles to configure and maintain new installations of DAR.




• Several performance improvements and bug fixes; see section Resolved Bugs.

DAR Documentation

• iPlanet Directory Access Router Release Notes (this document) -- The release notes contain information on new features of this release, software/ hardware requirements for installing the product, important notes and known bugs, last-minute product information, and how to send feedback.




• iPlanet Directory Access Router Installation Guide -- This document describes how to plan for and install DAR. Read this document next, after you have read these release notes. Both HTML and PDF versions of this document are provided.




• iPlanet Directory Access Router Administrator's Guide -- This document provides detailed information on configuring and maintaining DAR. Both HTML and PDF versions of this document are provided.




• iPlanet Directory Access Router Frequently Asked Questions -- This document contains answers to frequently asked questions, clarifications on DAR features, and troubleshooting information. Both HTML and PDF versions of this document are provided. Note that the same document is included as an appendix in the DAR Administrator's Guide.

For the latest information about DAR, including current release notes, technical notes, and deployment information, check this web site:

http://docs.iplanet.com/docs/manuals/dar.html

Installation Notes

• Software and hardware requirements and installation instructions are documented in the DAR Installation Guide.




• If you have an existing installation of DAR, before installing this version of DAR, save any configuration files in the file system to a place outside of the DAR install directory. Then uninstall the existing DAR unless your intent is to install DAR's patch.




• After installing DAR on a Windows NT system, make sure to reboot the system; you can do this from the Start menu.

Important Notes

• Migrating Configuration From DAR 2.1 To DAR 5.0




• Configuring DAR For SSL/Certificates




• Generating Core Files




• Using the Support Tool

Migrating Configuration From DAR 2.1 To DAR 5.0

You can find the configuration tool in the following directory:

<server-root>/bin/idar/admin/script

Note that configuration objects are expected to appear in a known location in the directory (currently ou=dar-config, o=netscaperoot) and conform to a predefined structure. The tool is invoked as follows:

• ImportConfigurationLdif <options> ldif where, ldif is a required directive indicating where the tool is to find the LDIF file containing DAR configuration objects and options can be substituted with the following:




• -C <configuration name> The name of configuration to create/augment. Defaults to "imported-configuration".




• -h <host> The hostname of the configuration directory. If omitted, the utility assumes "localhost".




• -p <port number> The port number of the configuration directory. If omitted, the utility assumes 389.




• -D <bind dn> The bind DN of the Directory user. If omitted, the utility will bind anonymously, but you may not be able to make updates.




• -w <password> The password of the Directory user.

ImportConfigurationLdif -D uid=admin,ou=Administrators,ou=TopologyManagement, o=netscaperoot -w admin sample.ldif

Configuring DAR For SSL/Certificates

• If DAR is configured to verify client certificates (see Step 4 of "Steps to Configure TLS/SSL Support") the client cannot use SASL EXTERNAL to authenticate based on the subject DN of the client certificate. Instead, the client will have to use simple BIND, CRAM-MD5, or DIGEST-MD5, unless an anonymous BIND is sufficient.




• While it is possible to configure DAR to present its certificate to a directory server, the clients of DAR will still have to perform simple BINDs in order to present valid credentials over the SSL connection between DAR and the directory server. The point is that simply validating DAR to the directory server does not implicitly authenticate the DAR client to the directory. DAR does not use the proxy authentication control.




• When using certificates, make sure that the appropriate root certificates are known to the appropriate entities: to DAR, to the directory servers, and to the LDAP clients. If any of these entities can't verify the root certificate path while validating a certificate, then it fails to communicate with the entity that presented the certificate.

 

In DAR, the file <server-root>/idar-<hostname>/etc/rootcerts.pem contains a list of root certificates in the PEM format. This list includes most of the common root CA certificates, but certificates such as "Thawte TEST CA" will have to be added as needed.

Note that there can be up to three certificate paths involved, each with potentially different root certificates: the certificate list which DAR presents to the LDAP client and to the directory server; the certificate list which the client presents to DAR; and the certificate list which the directory server presents to DAR. DAR 5.0 currently does not support having different certificate lists for communication to clients from that which it uses to authenticate to the directory server.

• If you configure iPlanet Directory Server (versions 4.11 or later) to require client authentication (this option is under the Encryption tab in the console), then you must also set the ids-proxy-con-send-cert-as-client attribute to TRUE in the DAR configuration.




• iPlanet Directory Server 4.11 only supports RSA certificates. If you are going to configure Directory Server to require client authentication, you must ensure that the DAR certificate has an RSA public key and an RSA signature. This consideration is relevant when using a DSA certificate for DAR to be used with non-RSA clients over SSL or TLS.

Generating Core Files

Using the Support Tool

<server-root>/bin/idar/server/scripts/

The utility takes the following options. Both options are required.

• -t <tailor filename> Where <tailor filename> is the path to the startup configuration file on disk.




• -o <output file> Where <output file> is the path of file where you want the configuration to be stored.

 

 

iDARPrintConfig -t tailor.txt -o tailor.ldif

Note that the command does not actually print anything. It downloads the configuration for further consideration.
 

---

Known Problems and Limitations

• Installation




• Miscellaneous




• UI (Console Interface)




• Uninstallation




• Resolved Bugs

 

 

Installation

• DAR installation assumes that you are always installing DAR on a server root that already has an instance of iPlanet Administration Server installed or you are installing it in conjunction with an Administration Server.




• Only one instance of DAR can be installed on a given host. [548588]




• The DAR console installation does not handle server root paths that possess "special" characters that are key word characters in TCL. For example, [ ] characters instruct TCL to perform a command. Thus, if the server root path possesses [ ] within it, it would cause certain parts of the installation to act improperly. The characters that should be avoided are as follows: ? " ' [ ] ( ) # . ~ $ ^ * +




• iPlanet Administration Server Console refuses to start if the <server-root> possesses an embedded space. Thus, it is recommended that you do not install using a <server-root> with an embedded space. [543176]




• iPlanet Administration Server that ships with DAR cannot be installed on the same server root as an iPlanet Web Server 6.0 installation. This implies iPlanet Directory Server 5.1 server roots should be avoided as the iPlanet Directory Server 5.1 uses iPlanet Web Server 6.0 for its Administration Server.




• The DAR Installation Guide describes how to disable ports other than TCP 389 on Windows NT using the TCP/IP Properties on the Network Control Panel. Please be aware that disabling UDP may prevent DNS lookups from occurring properly. If your configuration makes use of domain names which DAR must resolve using DNS, you should allow UDP as well as the TCP port for LDAP.




• On Windows, the installation routine is not capable of sensing that the user has told DAR to listen on the same port number as the iPlanet Administration Server. Thus, be sure to use a unique port to avoid complications. [541046]




• If you uninstall DAR and plan to reinstall it on the same machine, make sure to follow either of the procedures listed below. Failure to do so may cause DAR to fail to start or to not function properly. [548593] Before installation, delete the configuration associated with the machine name on which you are installing DAR. (You can delete the configuration either via the console or in the configuration directory itself.) After installation, open the DAR Server Console, go to the Configuration tab, enable the Save button by choosing configuration object <NONE>, select the configuration associated with the machine name, and click Save.

Miscellaneous

• DAR supports a maximum of 32 back end directory servers across any single group.




• While processing a referral, DAR does not recognize the ldaps url form.




• In the case where one of the back-end LDAP directory server hosts becomes unreachable from the host on which DAR is running, clients that were virtually connected to that host may seem to hang as they wait for DAR to time out its back-end connection. A fail over is performed by DAR when the connection gets timed out. The time-out is modifiable on Solaris systems. (Check the details about the idsktune utility. The utility gets installed at <server-root>/shared/bin and is explained in section "Operating System Requirements" of Chapter 2, "Computer System Requirements" in the DAR Installation Guide.)

UI (Console Interface)

• The DAR Configuration Editor Console fails to warn the user that a configuration reload is required (by recycling the server or by HUP) of all subscribing DARs if a configuration object (Group, Action, Rule, Property, or System) is deleted.




• The DAR Configuration Editor Console fails to warn the user that a configuration reload is required (by recycling the server or by HUP) of all subscribing DARs if the user changes the priority of groups by using the Up/Down arrow buttons in the Group Object View.




• On Unix variants, the Console's "helper" functions used to determine if DAR is up and running won't see DAR if the ldapfwd DAR is running is a symbolic link. This is only an issue if DAR installation has been manually manipulated post installation. (In other words, do not rename the DAR executable or convert it to a symbolic link.)

Uninstallation

• During uninstallation, DAR does not remove all entries subordinate to

ou=dar-config, o=NetscapeRoot. [548593]
• On Windows, the correct way to uninstall DAR is to remove DAR first and then subsequently uninstall the iPlanet Administration Server. [540694]

The DAR uninstallation must not be done simultaneously with the removal of its corresponding Administration Server. The reason for this is that when everything is being removed, the uninstall program stops the Administration Server and removes its service manager entry prior to the DAR uninstall routines being given the opportunity to remove its configuration. Because DAR depends on the Administration Server to carry out an uninstallation task, the Administration Sever should be up and functioning when DAR is being uninstalled. If DAR is uninstalled simultaneously with the Administration Server, it leaves its configuration subordinate to ou=dar-config, o=NetscapeRoot in the configuration repository untouched. This could cause undesired behavior with DAR, should you reinstall DAR on the same host and use the same configuration repository subsequently as it could see residual "belongs to" entries.

Manual remedy should you not heed this advice: find all entries subordinate
to ou=dar-config, o=NetscapeRoot whose ids-proxy-sch-belongs-to matches the host in question and remove the attribute. Note that the entry may be removed only if the entry no longer possesses any value for the ids-proxy-sch-belongs-to attribute.
 

Resolved Bugs

Bugs/enhancements fixed with 5.0 SP1:

 

Bug Number	Description
4537392	On bind evaluation now requires non zero length password before an action will occur.
4535792	Installation of DAR without a console now supported on NT.
4632706	Suspend heartbeat monitoring for SSL only servers.
4632716	Second bind over v2 connection not being passed to backend server.
4674645	Allow zero length attributes in searches.
4675022	Console configuration omitted "never" case on SSL configuration.
4678584	Copyright on console touched.
4680128	Gethostname failing on Solaris.
4680138	DAR could fail when changing group to a group that uses same server set.
4680142	RC4 ciphers have returned to DAR's supported cipher list.
4680145:	Corrected blocking socket issue for large packets sent over SSL
4680150	When receiving an ldap:/// referral without a host, nor port number, stipulated: DAR uses the host name and port number of the referring server.

 

Bugs fixed with 5.0 base:

 

Bug Number	Description
440769	hopcount on referrals is not working
441849	TCL configuration tool and iDS ldif idiosyncrasies
441869	TCL configuration tool always decomposes DN
442009	TCL configuration tool does not handle quoted suffix
512817	certreq invoked with no option returns with file open errors
520001	StartTLS interoperability problem with iDS5.0
520002	Application error if directory server is not running
520063	Windows configuration tool only supports default install path
531360	Typos in configuration script error message
531361	LDIF file contains RDN values of parent entries
533854	Improve Logging in DAR
534287	DAR core dumps on referral following
534288	DAR crash
540631	Security hole reported by CERT affects DAR too
541798	NT files do not have access control restrictions
541891	CRTL-C kills ldapfw if started with /etc/rc.d/S93 DAR
542760	Support URL ldap:///
542807	Encoding error for large entries
543331	Crash on failover for server with 0 priority
546990	Reverse-DNS lookup fails in DARv2.1, IP-addresses do work

 
 
 
 

---

How to Report Problems

• iPlanet online support web site at http://www.iplanet.com/support/support_services_10_0.html

From this location, the CaseTracker and CaseView tools are available for logging problems.
 
 

• The telephone dispatch number associated with your maintenance contract

 

 

• Description of the problem, including the situation where the problem occurs and its impact on your operation




• Machine type, operating system version, and product version, including any patches and other software that might be affecting the problem




• Detailed steps on the methods you have used to reproduce the problem




• Any error logs or core dumps

 

 

snews://secnews.netscape.com/netscape.dev.directory
 
 
 

---

For More Information

• iPlanet release notes and other documentation — http://docs.iplanet.com/docs/manuals/




• iPlanet product status — http://www.iplanet.com/support/technical_resources/




• iPlanet Professional Services information — http://www.iplanet.com/services/professional_services_3_3.html




• iPlanet developer information — http://developer.iplanet.com/




• iPlanet learning solutions — http://www.iplanet.com/learning/index.html




• iPlanet product data sheets — http://www.iplanet.com/products/product_map/product_name_2_0a.html

 

 

Copyright © 2002 Sun Microsystems, Inc. All rights reserved.