IBM Security Directory ServerVersion 6.4

Product Overview

IBM

Note

Before using this information and the product it supports, read the general information under “Notices”on page 15.

Edition notice

Note: This edition applies to version 6.4 of IBM Security Directory Server (product number 5725-Y17 ) and to allsubsequent releases and modifications until otherwise indicated in new editions.© Copyright International Business Machines Corporation 2013, 2018.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract withIBM Corp.

Contents

About this publication............................................................................................vAccessibility .................................................................................................................................................vStatement of Good Security Practices.........................................................................................................v

Chapter 1. IBM Security Directory Server overview.................................................1

Chapter 2. What's new in this release.....................................................................3

Chapter 3. System requirements............................................................................5Customizing system requirements search..................................................................................................5

Chapter 4. Compatibility specifications.................................................................. 7

Chapter 5. Installation information........................................................................ 9

Chapter 6. Known issues......................................................................................11

Index.................................................................................................................. 13

Notices................................................................................................................15

iii

iv

About this publication

IBM® Security Directory Server, previously known as IBM Tivoli® Directory Server, is an IBMimplementation of Lightweight Directory Access Protocol for the following operating systems:

• Microsoft Windows• AIX®

• Linux® (System x, System z®, System p, and System i®)• Solaris

IBM Security Directory Server Product Overview provides information about new features in the release.

IBM Security Directory Server Product Overview also includes getting started information, releaseinformation, and the list of standards that are implemented in the release. It also includes the minimumhardware and software requirements for IBM Security Directory Server and its related software.

AccessibilityAccessibility features help users with a physical disability, such as restricted mobility or limited vision, touse software products successfully. With this product, you can use assistive technologies to hear andnavigate the interface. You can also use the keyboard instead of the mouse to operate all features of thegraphical user interface.

For more information, see the Accessibility Appendix in the IBM Security Directory Server ProductOverview.

Statement of Good Security PracticesIT system security involves protecting systems and information through prevention, detection, andresponse to improper access from within and outside your enterprise. Improper access can result ininformation being altered, destroyed, misappropriated, or misused or can result in damage to or misuseof your systems, including for use in attacks on others. No IT system or product should be consideredcompletely secure and no single product, service or security measure can be completely effective inpreventing improper use or access. IBM systems, products and services are designed to be part of acomprehensive security approach, which will necessarily involve additional operational procedures, andmay require other systems, products or services to be most effective. IBM DOES NOT WARRANT THATANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISEIMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.

© Copyright IBM Corp. 2013, 2018 v

vi IBM Security Directory Server: Product Overview

Chapter 1. IBM Security Directory Server overviewYou can use IBM Security Directory Server to provide a trusted identity data infrastructure forauthentication.

IBM Security Directory Server provides a server that stores directory information using a DB2® database.It also provides a proxy server for routing LDAP operations to directory servers with database. IBMSecurity Directory Server provides client utilities and graphical user interfaces (GUI), such as InstanceAdministration Tool (idsxinst) and Configuration Tool (idsxcfg), to manage servers.

IBM Security Directory Server provides the following features:

• A powerful and authoritative enterprise directory infrastructure that is a critical enabler for enterprisesecurity.

• An important part of the IBM Security Integrated Identity Management portfolio. It plays a key role inbuilding the enterprise identity data infrastructure for applications such as identity management,portals, and web services.

• The default directory for WebSphere® Application Server and Portal, IBM Security Identity Manager andAccess Manager, as well as the AIX operating system.

© Copyright IBM Corp. 2013, 2018 1

2 IBM Security Directory Server: Product Overview

Chapter 2. What's new in this release

Last Successful Authentication Time Stamp plug-inYou can record the time stamp that corresponds to the last successful authentication for a user sothat you can display it on a web portal or implement security policies.

Replication topology configuration toolUse the ldapreplcfg configuration tool to configure various replication topologies for IBM SecurityDirectory Server. This tool simplifies the process of setting up replication and reduces errors thatmight occur when you set up replication by using the graphical user interface or the ldif file.

Premium feature activationPremium feature activation is enforced through a Premium Feature Activation Package that you candownload from Passport Advantage. This package enables unlocking of the premium features of IBMSecurity Directory Server when you start the server. To download and install this package, you mustpurchase IBM® Security Directory Server explicitly through IBM Passport Advantage.

Processing password policy codes in pass-through authenticationYou can configure IBM Security Directory Server to process the password policy failure reason codesfrom pass-through directories and send normalized error codes to the client applications. Use thisfeature so that the client application can identify the reason for the failure and take the requiredaction to resolve the error.

Advanced password policy settingsYou can extend the password policy capabilities of IBM Security Directory Server to enforce rules foradvanced password syntax checking in addition to the standard default rules. Password complexityrules help to strengthen the security of authentication mechanisms.

The idsmonitor script

Use the idsmonitor script to gather monitoring data while IBM® Security Directory Server is running.You can use this monitoring data to troubleshoot resource usage.

Log management configuration attributes

Set the value of ibm-slapdLogEventQRadarEnabled attribute to true to enable log managementintegration with QRadar. See Configuring QRadar log integration by using the command line andConfiguring QRadar log integration by using Web Administration Tool.

Set the value of ibm-slapdLogEventCognosEnabled attribute to true to enable log managementintegration with Cognos. See Configuring log management through command line and Configuring logmanagement through Web Administration Tool.

Deprecated or removed

• The Active Directory Synchronization feature is deprecated and no longer included with IBM SecurityDirectory Server, Version 6.4. Use the LDAPSync feature instead.

• Embedded WebSphere Application Server is no longer supported for use with IBM Security DirectoryServer, Version 6.4. You must download WebSphere Application Server, Version 8.5.5 from PassportAdvantage and install it separately.

© Copyright IBM Corp. 2013, 2018 3

4 IBM Security Directory Server: Product Overview

Chapter 3. System requirementsYou must choose a computer that meets the minimum system requirements for the installation of IBMSecurity Directory Server.

You can use the Software Product Compatibility Reports to view the following information about IBMSecurity Directory Server:

• Operating systems• Prerequisites• Hypervisors• Translations• Detailed system requirements• Hardware requirements• End of service

See the detailed system requirements for IBM Security Directory Server for the following supportedoperating systems:

• AIX• Linux• Solaris• Microsoft Windows

Customizing system requirements searchYou can customize your system requirements search for IBM Security Directory Server, that match yourfilter criteria.

Procedure

1. Open the Software Product Compatibility Reports website.2. Select the required report option for which you want to view the report.

You can choose one of the following options:

• Operating systems• Prerequisites• Hypervisors• Translations• Detailed system requirements• Hardware requirements• End of service

3. To generate a report for detailed system requirements, select the Create a report link for the searchcriteria, Detailed system requirements.

4. On the Detailed system requirements for a specific product page, provide the following values:a) In the Full or partial product name field, enter the product name, Security DirectoryServer.

b) From the Search results list, select the appropriate product name.c) From the Version list, select the appropriate version number.d) For Scope of report, select the appropriate option.

© Copyright IBM Corp. 2013, 2018 5

e) From the Operating system family list, select an appropriate operating system.f) Click Submit.

ResultsThe Software Product Compatibility Reports website generates a report that match your search criteria.

6 IBM Security Directory Server: Product Overview

Chapter 4. Compatibility specificationsIBM Security Directory Server implements a set of RFC standards that provides compatibility with otherLDAP servers.

Table 1. The list of RFCs implemented in IBM Security Directory Server

RFC standards

RFC 1274 The COSINE and Internet X.500 Schema

RFC 1777 Lightweight Directory Access Protocol (V2)

RFC 1778 String Representation of Standard Attribute Syntax

RFC 1779 String Representation of Distinguished Names

RFC 1823 LDAP Application Program Interface (V2)

RFC 2052 A DNS RR for specifying the location of services (DNS SRV)

RFC 2219 Use of DNS Aliases for Network Services

RFC 2222 Simple Authentication and Security Layer (SASL)

RFC 2247 Using Domains in LDAP/X.500 Distinguished Names

RFC 2251 Lightweight Directory Access Protocol (V3)

RFC 2252 Lightweight Directory Access Protocol (V3): Attribute SyntaxDefinitions

RFC 2253 Lightweight Directory Access Protocol (V3): UTF-8 StringRepresentation of Distinguished Names

RFC 2254 The String Representation of LDAP Search Filters

RFC 2255 The LDAP URL Format

RFC 2256 A Summary of the X.500(96) User Schema for use with LDAPv3

RFC 2596 Use of Language code in LDAP

RFC 2696 LDAP Control Extension for Simple Paged Results Manipulation

RFC 2829 Authentication Methods for LDAP RFC 2830, (V3) Extension forTransport Layer Security (TLS)

RFC 2831 Using DIGEST authentication as a SASL Mechanism

RFC 2849 The LDAP Data Interchange Format (LDIF) - Technical Specification

RFC 2891 LDAP Control Extension for Server Side Sorting of Search Results

The Open Group schema for liPerson and liOrganization (NAC/LIPS)

RFC 2307 (Directory Schema Only) - Posix Unix Account authentication

RFC 3062 - Password Modify Extended Operation

RFC 3673 All Operational Attributes

RFC 3674 Feature Discovery in LDAP

RFC 4370 Lightweight Directory Access Protocol (LDAP) Proxied AuthorizationControl

© Copyright IBM Corp. 2013, 2018 7

8 IBM Security Directory Server: Product Overview

Chapter 5. Installation package informationDownload the appropriate IBM Security Directory Server installation packages and select an appropriateinstallation mode that is applicable for your operating system.

IBM Security Directory Server, Version 6.4 is available on the IBM Passport Advantage website in the formof eAssembly packages for supported operating systems.

To download the appropriate installation packages of IBM Security Directory Server for your operationsystem, see the download documents:

AIXhttp://www.ibm.com/support/docview.wss?uid=swg24039313

Linuxhttp://www.ibm.com/support/docview.wss?uid=swg24039315

Solarishttp://www.ibm.com/support/docview.wss?uid=swg24039316

Windowshttp://www.ibm.com/support/docview.wss?uid=swg24039314

You can use the ISO image of IBM Security Directory Server, Version 6.4 to create a DVD of the productand use it for installation. The .iso file contains the following components:

• IBM Security Directory Server, Version 6.4• DB2, Version 10.5.0.4• GSKit, Version 8.0.50.34• IBM SDK Java™ Technology Edition, Version 6 SR 16• IBM Installation Manager, Version 1.8.0

Note:

WebSphere Application Server is not provided with the IBM Security Directory Server installationpackage. You must download WebSphere Application Server, Version 8.5.5 from Passport Advantage andinstall it separately. For more information, see the IBM Knowledge Center for WebSphere ApplicationServer.

DB2, Version 10.5.0.4 is shipped with IBM Security Directory Server, Version 6.4. However, the minimumsupported version that you can use with IBM Security Directory Server, Version 6.4 is DB2, Version10.1.0.2.

GSKit, Version 8.0.50.34 is shipped with IBM Security Directory Server, Version 6.4. However, theminimum supported version that you can use with IBM Security Directory Server, Version 6.4 is GSKit,Version 8.0.14.24.

For installation instructions, see the Installing and Configuring section of IBM Knowledge Center for IBMSecurity Directory Server.

© Copyright IBM Corp. 2013, 2018 9

10 IBM Security Directory Server: Product Overview

Chapter 6. Known issuesFor a list of known issues with IBM Security Directory Server, Version 6.4, see the technical note andtroubleshooting information.

• IBM Security Directory Server 6.4 Known Issues• Troubleshooting and support

© Copyright IBM Corp. 2013, 2018 11

12 IBM Security Directory Server: Product Overview

Index

Aaccessibility v

Ddirectory server, installation

general information 9directory server, new features

general information 3directory server, overview

general information 1directory server, system requirements

general information 5search customization 5

IIBM Security Directory Server

overview 1IBM Security Directory Server, installation

general information 9IBM Security Directory Server, new features

general information 3IBM Security Directory Server, system requirements

general information 5search customization 5

Ssystem requirements

custom search 5general information 5

Index 13

14 IBM Security Directory Server: Product Overview

Notices

This information was developed for products and services offered in the U.S.A.

IBM may not offer the products, services, or features discussed in this document in other countries.Consult your local IBM representative for information on the products and services currently available inyour area. Any reference to an IBM product, program, or service is not intended to state or imply that onlythat IBM product, program, or service may be used. Any functionally equivalent product, program, orservice that does not infringe any IBM intellectual property right may be used instead. However, it is theuser's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in thisdocument. The furnishing of this document does not give you any license to these patents. You can sendlicense inquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle DriveArmonk, NY 10504-1785 U.S.A.

For license inquiries regarding double-byte character set (DBCS) information, contact the IBM IntellectualProperty Department in your country or send inquiries, in writing, to:

Intellectual Property LicensingLegal and Intellectual Property LawIBM Japan, Ltd.19-21, Nihonbashi-Hakozakicho, Chuo-kuTokyo 103-8510, Japan

The following paragraph does not apply to the United Kingdom or any other country where suchprovisions are inconsistent with local law :

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS"WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR APARTICULAR PURPOSE.

Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore,this statement might not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodicallymade to the information herein; these changes will be incorporated in new editions of the publication.IBM may make improvements and/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not inany manner serve as an endorsement of those Web sites. The materials at those Web sites are not part ofthe materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate withoutincurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) theexchange of information between independently created programs and other programs (including thisone) and (ii) the mutual use of the information which has been exchanged, should contact:

IBM Corporation2Z4A/10111400 Burnet RoadAustin, TX 78758 U.S.A.

© Copyright IBM Corp. 2013, 2018 15

Such information may be available, subject to appropriate terms and conditions, including in some casespayment of a fee.

The licensed program described in this document and all licensed material available for it are provided byIBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or anyequivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, theresults obtained in other operating environments may vary significantly. Some measurements may havebeen made on development-level systems and there is no guarantee that these measurements will be thesame on generally available systems. Furthermore, some measurement may have been estimatedthrough extrapolation. Actual results may vary. Users of this document should verify the applicable datafor their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, theirpublished announcements or other publicly available sources. IBM has not tested those products andcannot confirm the accuracy of performance, compatibility or any other claims related to non-IBMproducts. Questions on the capabilities of non-IBM products should be addressed to the suppliers ofthose products.

All statements regarding IBM's future direction or intent are subject to change or withdrawal withoutnotice, and represent goals and objectives only.

All IBM prices shown are IBM's suggested retail prices, are current and are subject to change withoutnotice. Dealer prices may vary.

This information is for planning purposes only. The information herein is subject to change before theproducts described become available.

This information contains examples of data and reports used in daily business operations. To illustratethem as completely as possible, the examples include the names of individuals, companies, brands, andproducts. All of these names are fictitious and any similarity to the names and addresses used by anactual business enterprise is entirely coincidental.

COPYRIGHT LICENSE:

This information contains sample application programs in source language, which illustrate programmingtechniques on various operating platforms. You may copy, modify, and distribute these sample programsin any form without payment to IBM, for the purposes of developing, using, marketing or distributingapplication programs conforming to the application programming interface for the operating platform forwhich the sample programs are written. These examples have not been thoroughly tested under allconditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of theseprograms. You may copy, modify, and distribute these sample programs in any form without payment toIBM for the purposes of developing, using, marketing, or distributing application programs conforming toIBM's application programming interfaces.

Each copy or any portion of these sample programs or any derivative work, must include a copyrightnotice as follows:

© (your company name) (year). Portions of this code are derived from IBM Corp. Sample Programs. ©Copyright IBM Corp. _enter the year or years_. All rights reserved.

If you are viewing this information in softcopy form, the photographs and color illustrations might not bedisplayed.

Terms and conditions for product documentation

Permissions for the use of these publications are granted subject to the following terms and conditions.Applicability

These terms and conditions are in addition to any terms of use for the IBM website.

16 Notices

Personal useYou may reproduce these publications for your personal, noncommercial use provided that allproprietary notices are preserved. You may not distribute, display or make derivative work of thesepublications, or any portion thereof, without the express consent of IBM.

Commercial useYou may reproduce, distribute and display these publications solely within your enterprise providedthat all proprietary notices are preserved. You may not make derivative works of these publications,or reproduce, distribute or display these publications or any portion thereof outside your enterprise,without the express consent of IBM.

RightsExcept as expressly granted in this permission, no other permissions, licenses or rights are granted,either express or implied, to the publications or any information, data, software or other intellectualproperty contained therein.IBM reserves the right to withdraw the permissions granted herein whenever, in its discretion, the useof the publications is detrimental to its interest or, as determined by IBM, the above instructions arenot being properly followed.You may not download, export or re-export this information except in full compliance with allapplicable laws and regulations, including all United States export laws and regulationsIBM MAKES NO GUARANTEE ABOUT THE CONTENT OF THESE PUBLICATIONS. THE PUBLICATIONSARE PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE.

Trademarks

IBM, the IBM logo, and ibm.com® are trademarks or registered trademarks of International BusinessMachines Corp., registered in many jurisdictions worldwide. Other product and service names might betrademarks of IBM or other companies. A current list of IBM trademarks is available on the web at http://www.ibm.com/legal/copytrade.shtml.

Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registered trademarks ortrademarks of Adobe Systems Incorporated in the United States, other countries, or both.

IT Infrastructure Library is a registered trademark of the Central Computer and TelecommunicationsAgency which is now part of the Office of Government Commerce.

Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon,Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation orits subsidiaries in the United States and other countries.

Linux is a trademark of Linus Torvalds in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in theUnited States, other countries, or both.

ITIL is a registered trademark, and a registered community trademark of the Office of GovernmentCommerce, and is registered in the U.S. Patent and Trademark Office.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Java and all Java-based trademarks and logos are trademarks or registeredtrademarks of Oracle and/or its affiliates.

Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, othercountries, or both and is used under license therefrom.

Notices 17

Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. andQuantum in the U.S. and other countries.

18 IBM Security Directory Server: Product Overview

IBM®