Living Without Client Access - NHMUG · – The core of the product is a Java client that is n ot platform specific. – Runs on most full featured client/server Operating Systems

12/5/2016

1

Welcome to the Waitless World

© 2015 IBM Corporation

Living WithoutClient Access

Wayne Bowers

[email protected]

IBM i Global Support Center



Times, they are a

Changing

12/5/2016

2



IBM 7.1 i Access Family

• IBM i Access for Windows (5770XE1)

– Client Access

– Most mature and widely used product

• IBM i Access for Web (5770XH2)

– IBM i System Hosted HTML based web product

– Very robust capability and increasingly deployed

o 5250 Display

o Print Access

o Database Access

• IBM i Access for Linux (5770XL1)

– ODBC provider

– 5250 Display

– Incoming Remote Command



New Client Product – 5733XJ1

• IBM i Access Client Solutions (5733XJ1)

– Consolidates commonly used tasks for accessing your IBM i into one simplified location

– The core of the product is a Java client that is not platform specific.

– Runs on most full featured client/server Operating Systems that support Java 6.0 or higher such as most versions of Windows, Macintosh and Linux.

– Same deployment, configuration, settings, problem determination across all platforms.

– Features include:

o Ease of Deployment

o 5250 Display and Printer Emulation

o Data Transfer

o 5250 LAN Console and Virtual Control Panel

o Links to HMC, Systems Director Navigator, and other consoles

12/5/2016

3



New Client Product

• Comes in three parts:

• Base Package offering contains platform-independent code

• Application packages offer platform-specific API's for applications.

• http://www.ibm.com/developerworks/ibmi/library/i-ibmi-access-client-solutions/



IBM i Access Family – New Product

� Access for Windows – Desktop

• 5250 display and printer emulator• Data transfer• Operations Console• System i Navigator

• Data drivers (ODBC, OLEDB, .Net)

• Printer drivers

� Access for Linux – Desktop

• 5250 emulator• ODBC driver

• A small subset of the IBM i Access API's

Base Package

Base Package

12/5/2016

4




� Access for Windows – Desktop• 5250 display and printer emulator

• Data transfer

• Operations Console

• System i Navigator• Data drivers (ODBC, OLEDB, .Net)

• Printer drivers

� Access for Linux – Desktop• 5250 emulator

• ODBC driver

• A small subset of the IBM i API's

Navigator for i (Web), ACS Base, & ARE





• Data transfer


• System i Navigator

• Data drivers (ODBC, OLEDB, .Net)• Printer drivers

� Access for Linux – Desktop• 5250 emulator

• ODBC driver• A small subset of the IBM i API's

Application Package

Application Package

12/5/2016

5



How does the change make you feel?



Why?

12/5/2016

6



IBM i Access for Windows - One Size Fits Most

• Windows only solution….mid 90’s• Primary interface for many• 5250 emulator• Console • OS Management • Much more

11



What did we have in the past

12

iAccess Windows- 5250 - Console- Data Transfer- GUI Navigator - Spool file - IFS file transfer- PTF Management- Dashboard - Run SQL Script- Visual Explain - API's- …

iAccess Linux- 5250 (it was terrible)

Windows no longer is the only OS or device that is required

12/5/2016

7



Where do we go for the future

13

ACS - 5250 - Console- Data Transfer- Spool file - IFS file transfer- Run SQL Script- Visual Explain

ACS AP- API's

Web Navigator - PDI - PTF - Database -Gui Interface

ARE- Multi System Mgt- PTF distribution


ACS AP- API's


ARE- Multi System Mgt- PTF distribution



ARE- Multi System Mgt - PTF distribution

IBM i Mobile Access- 5250 - GUI Management - DashBoard- Run SQL Statement



Why ?

14

Core issues • No support for Linux & Mac • No support for Mobile • Difficult to deploy for many users • Difficult to update • Development is costly • Existing support is OLD – The world has changed!

12/5/2016

8



Answers

15

Solution themes • Device & OS Neutral • Flexible • Easy to install and maintain • Simple for a single user or 1000’s • Improved administrator situation • Cost effective to create



Functional Overview:

12/5/2016

9



First, some common questions….

• What is it supported connecting to?

– Supported connecting to IBM i OS r7.3, r7.2, r7.1 and r6.1

• Do I need any extra licenses? Any extra ports, protocols?– No, IBM i OS supports IBM i Access Client Solutions exactly the same as IBM

i Access for Windows

– Checks out the same 57xxXW1 Licenses for 5250 and Data Transfer

– Connects to the same IBM i Access Host Servers on the same ports in the same wayo Exit programs will continue to have the same impact

o Application Administration local policies will still be applied

• Do I need to uninstall IBM i Access for Windows first?

– For ACS Base Package core offering, no

– For the Windows Application Package, yes.




Configuration

12/5/2016

10



• Use the System Configurations panel to store connection information on the IBM i Systems that will be used

System Configurations

Configuration



• Create, Edit or Delete connection information for IBM i Systems that are used.

– System Name: What is entered by the user to connect to this host– IP Address: What the PC’s DNS environment last returned when

connecting to the System Name– Service Host Name: The System’s Console host name or IP address as

configured– Description: Defined by the user when created

System Configurations

Configuration

12/5/2016

11



• OK - Saves the information entered and closes the panel• Save/New - Saves the information entered and clears the panel• Cancel - Closes the panel without saving anything

New System Configurations

Configuration



• Use SSL specifies that the connection will be secured• If the Certificate Authority negotiated is not trusted, the user will

be prompted to add to trusted list• There still is a Key Management utility if needed

Use SSL

Configuration

12/5/2016

12



• Use default user name to prompt once for each system

– Caches credentials for duration of desktop session

• Prompt for user name and password every time

• Use Shared credentials– First time for desktop session that a connection is

made to a System configuration using this option the user will be prompted to provide User name & Password

– These credentials will be cached for use by all System configurations set to this option

• Use kerberos authentication; do not prompt– No further IBM i Access Client Solutions

configuration needed

Authentication Options

Configuration




Console

12/5/2016

13



• 5250 Console – Opens a interactive console to the current System

• Virtual Control Panel – Opens a Virtual Control Panel

Console



• 5250 Console

Console

12/5/2016

14



• Virtual Control Panel

• Service Functions– Providing options for service

commands instead of providingthe up and down arrows and enter

• Starting in V1R1M3 supported withLAN and HMC console types

Console


Welcome to the Waitless WorldConsole

• Console Configuration

12/5/2016

15




5250 Emulation



• Opens an 5250 Telnet display emulation session to the current System

5250 Emulation

12/5/2016

16



• Provides nearly identical interaction, look and feel to theAccess for Windows PC5250 emulator

– Keyboard Mapping– Keystroke Macros– Edit Colors– Toolbar Customization– Pop-Up keypad– Window Setup– Hotspots– Printer Emulation

• Also some New features– Tabbed Sessions– Mouse Wheel– Simplified Codepage– Screen History– Watermarks– Default Session

5250 Emulation



• Tabbed Session support added in V1R1M4, made the default in V1R1M5

Tabbed Sessions

5250 Emulation

12/5/2016

17



• Allows the use of the Mouse Wheel to perform 5250 Aid Key Functions - Defaults to Page Up/Down

– Shift and Control options added in V1R1M4 and default to ‘No Action’

Mouse Wheel

5250 Emulation



34

Watermark

5250 Emulation

12/5/2016

18



35

Watermark

5250 Emulation




Data Transfer

12/5/2016

19



• Select the Data Transfer option– Will default to the current System

Data Transfer



• Displays the Data Transfer interaction panel– Starts out with a Data Transfer to IBM i and

Data Transfer from IBM i tab to the current System on the main panel

Data Transfer

12/5/2016

20



• Data Transfer interaction panel– Starts out with a Data Transfer to IBM i and

Data Transfer from IBM i tab to the current System on the main panel

– All active Data Transfer requests are displayed in a tab on this panel

– Open Saved Requests– Save Requests– Create IBM i Files– Data Transfer Migration

Data Transfer



• Data Transfer mechanism to interact directly with spreadsheet

– On a Data Transfer From IBM i Select “Active Excel Spreadsheet” for the output device.

– Data Options can be used to modify query

Data Transfer

12/5/2016

21




– The results of the data transfer are placed into the active Excel spreadsheet book at the currently selected cell.

Data Transfer




– On a Data Transfer to IBM i Select “Active Excel Spreadsheet” for the Input device.

– The selection from the Excel Spreadsheet will be uploaded to the file on the IBM i

Data Transfer

12/5/2016

22




Printer Output



• Lists and allows interaction with the printer output on the IBM i OS System

Printer Output

12/5/2016

23



• Printer Output user interface– Allows the user to view, and download spooled files.

Printer Output



• Edit -> Preferences– Download location

o Where the downloaded file will be stored on the local workstation

– Othero Determines if the printed output should be downloaded in PDF format

if available

- Requires IBM i OS r7.1 or later with the IBM Transform Services for i (5770TS1) product installed

- If this is unchecked a.txt file will be generated

Printer Output

12/5/2016

24



• View -> Set Filter– Allows the user to specify how the

list of printed output is generated.– Either the User, Output Queue or

both filters may be modified.

Printer Output




Integrated File System

12/5/2016

25



• Lists and allows interaction with the Integrated File System on the IBM i OS System




• Integrated File System user interface– Allows the user to interact with IFS files and directories.


12/5/2016

26



• Edit -> Preferences





Navigator

12/5/2016

27



TimeLine

Operations Navigator

iSeries/System i Navigator

IBM Navigator for i

Systems Director Navigator

1995

V5R3V6R1

Jan 2013Dec 2015



IBM Navigator for i

12/5/2016

28



• IBM i Access Client Solutions does not provide any Navigator interface instead relying on the IBM Navigator for i web based infrastructure that was introduced with IBM i OS r6.1 and has continually been enhanced since

– Name change from IBM Systems Director Navigator to IBM Navigator for i indicates a very large investment into improving the performance and usability of this interface

– Key IBM i OS solutions like Performance Data Investigator and HAS tools are only available in Navigator for I

– r7.2 GA timeframe introduces monitors and PTF interaction

– A few things have/had reliance on System i Navigatoro Run SQL Scripts (NOT Anymore, Delivered December 2015)

o Database Visual Explain (NOT Anymore, Delivered August 2016)

o Management Central Multiple System Interaction (Monitors, Fixes, etc.)

IBM i Access Client Solutions & Navigator



ACS & Navigator

56

No extra sign-on !!

12/5/2016

29



Run SQL Scripts

57

• Launch from Navigator to ACS• Super new Run SQL Scripts



Find what you are looking for

58

• New search menu • Enter a phrase, CL Command, idea • Corresponding options are displayed • Click and go directly there

12/5/2016

30



Favorites

59

• Create your own navigation list • Click on any Table, ‘Save as Favorites’ • Enter your tree node• Create the name



Create Monitors

60

• Monitor System Performance Metrics • Set thresholds • Take actions when threshold is reached • Or when it goes under• Monitor for Messages

12/5/2016

31




IBM i ARE

(Administration/Application

Runtime Expert)



IBM Application Runtime Expert for i – Why use it?• Enhanced Serviceability

– Run on failing system to identify and fix problems– One tool to check the entire software stack• Runtime Expert checks everything, every time

• Product Testing– Understand product installation• Build verification

• System Validation– Ensure your systems are in expected state– Help debug issues with your own systems

• Pre-requisite Checking– Most software products have pre-reqs – ARE can check these for you

• Schedule Automatic Verifications

12/5/2016

32



- Hundreds of native attributes!

- Think DSPOBJD



Call a SQL statement • Verify the results

• Number of entries

• Specific content!

12/5/2016

33



Select problems to fix

Click on ‘Fix’ to correct these selected issues on the target system



Monitor results as fix is completed on the remote system

12/5/2016

34



New Schedule icon added for each group. Click to configure scheduled verification of the group.



Icons for the status of last verification

Icons for scheduler status

A scheduled group

12/5/2016

35



NEW!! Configure email

settings in "Runtime properties"



List of previous verification results of a group

12/5/2016

36



71

Tools for Managing PTF's

• Compare PTF levels across systems• Compare PTF levels against IBM cloud• Send PTF's from one system to another via *SAVF• Load PTF's from image catalogs• Scheduled PTF verifications• Send an email when something is wrong• Compare an endless number of other system attributes



Central system – image catalog dist. (multiple releases)

6.1

7.2

7.1

g

ImageCatalo

g

12/5/2016

37



How do you get it• GUI is an skip ship LPP – 5733ARE

– Runs on IBM i 7.1, 7.2 & 7.3

• Core is part of the base OS– Available on IBM i 5.4 and newer– Apply latest HTTP & Java Groups

6.1: SF99115 and SF995627.1: SF99368 and SF99572

• Articles– Turning Big Problems Into Small Ones

http://www.ibmsystemsmag.com/ibmi/application_runtime_expert/33004p1.aspx– You and i – ARE Solving Problems http://ibmsystemsmag.blogs.com/you_and_i/2010/07/you-and-i-are-

solving-problems.html– Do You Need an Application Runtime Expert? http://ibmsystemsmag.blogs.com/idevelop/2010/07/do-

you-need-an-application-runtime-expert.html

• Product Web site contains install instructions, fix information, and documentation– http://www.ibm.com/systems/power/software/i/are/index.html



Deployment

12/5/2016

38



• IBM i Access Client Solutions is not installed to the client operating system, it is deployed.

– There is no Windows Based Installer (setup.exe) installation program for the core of the product.

• Access Client Solutions Deployment– The deployment involves the client bundle being placed wherever it is

desired to be executed from, and determining where the product settings are going to be stored.

• Client Bundle– Contains the Java executable Jar, properties file, platform specific

start executables and javascript start samples, product documentation, and licensing notices.

– All that is required to be deployed is the Java executable Jar– The rest is optional

• No JRE distributed– IBM i Access Client Solutions does not deploy a specific JRE– Relies on a Java 1.6 or higher (Java 1.8 recommended) JRE to be

accessible on the client OS

Deployment



• When thinking about deployment, ask yourself where you want to put:

1. the product image? (jar file)

2. the user’s settings? (system configurations,

5250 sessions, etc.)

Initial Questions

Deployment

12/5/2016

39



Computer (local)

Network Share

USB Thumb Drive

Intranet (http:// URL)

Options

Deployment



What you get in the package

Deployment

12/5/2016

40



Start Programs – Operating System specific

launch executables

Deployment



Start Programs – Operating System specific

launch executables

Deployment

12/5/2016

41



• IBM i Access Client Solutions v1r1m4 provided Operating System specific Application deployment scripts to make deployment easier for an user

• Javascript will copy the IBM i Access Client Solutions deployment to a specific location that makes sense for the Operating System being used.

Provided Deployment Scripts

Deployment



• Provided install_acs script on Windows will copy the IBM i Access Client Solutions deployment to C:\Users\<WindowsUser>\IBM\ClientSolutions.

• Provided install_acs_*_allusers script will copy the IBM i Access Client Solutions deployment to C:\Users\Public\IBM\ClientSolutions

• Deployment will ask the user which functions they want to use, if it should create shortcuts on the Desktop for the Main User Interface and 5250 Session Manager. It will also create file associations for the .hod, .bchx, .dttx & .dtfx if they haven’t already been created.


Deployment

12/5/2016

42



• Deployment Prompts


Deployment





Deployment

12/5/2016

43





Deployment





Deployment

12/5/2016

44





Deployment





Deployment

12/5/2016

45





Deployment





Deployment

12/5/2016

46





Deployment





Deployment

12/5/2016

47





Deployment





Deployment

12/5/2016

48





Deployment



• IBM i Access Client Solutions v1r1m4 Update 3 (October 2015) provided an update to these deployment scripts for Windows to allow an Administrator to control some of the deployment behavior and how the client behaves for the user.

– An Administrator runs the script passing a parameter of /AdminConfig

o The Administrator is then presented with a series of questions about the deployment, like if ACS should be ran locally or remotely, what functions will the user have, and if desktop icons should be created.

– The IBM i Access Client Solutions product files are placed in a central location

– Users run the deployment script and IBM i Access Client Solutions is deployed to their Windows workstation.

• More Details

– https://www.ibm.com/developerworks/ibmi/library/i-ibmi-access-client-solutions-customization-trs/

– http://www-01.ibm.com/support/docview.wss?uid=nas8N1020967


Deployment

12/5/2016

49



• Administrator Preparing Deployment


Deployment





Deployment

12/5/2016

50





Deployment





Deployment

12/5/2016

51



• Where should the product be ran from?

• No => Copy the IBM i ACS deployment to Windows User’s Home Directory

– To update the product, update the central location and re-run install script

• Yes => Run the product from the location the install script is being ran from

– May be a Network orLocal location

– To update the product justupdate the deploymentlocation via file copy


Deployment





Deployment

12/5/2016

52





Deployment



• August 2016 update supports a /Q option to be passed to the script to silently deploy the client. Automatically accepting the End User License Agreement and not showing this completion message.

• User Running Deployment


Deployment

12/5/2016

53



• Provided install_acs Javascript on Mac will copy the IBM iAccess Client Solutions deployment to the Mac OS Applications folder.


Deployment



• Provided install_acs Javascript on Linux will copy the IBM iAccess Client Solutions deployment to the locations of

– /usr/share/applications/

– /opt/ibm/iAccessClientSolutions/


Deployment

12/5/2016

54



Questions?

BREAK TIME………



• IBM i Access Client Solutions uses a product configuration file, named “AcsConfig.properties”

• AcsConfig.properties is simply a list of configuration properties and values.

• These properties may also be specified on the command line-D<property>=<value>

• One such property iscom.ibm.iaccess.AcsBaseDirectory

AcsConfig.properties

12/5/2016

55



• The value of this property determines:– The location of user settings– The location of service logs/dumps/etc– The default directory used by the 5250 session manager (this

can be configured separately if desired)

• The value is expected, therefore, to be a directory name on a filesystem. It can be

– Left blank (which leaves behavior at the default location)– The path of a hardcoded directory name (fully-qualified is highly

recommended)– A constructed path using special keywords (next slide)

Tip: use forward slashes (‘/’), not backslashes (‘\’)

AcsBaseDirectory



• {USER} : would be the current username (valid anywhere in the path)

• {PRODUCTDIR} : would mean the product’s location in the file system (valid only at the beginning)

• {TEMPDIR} : would be the temporary directory (valid only at the beginning)

• {ROOT} : the root of the file system where the product is located (valid only at the beginning)

• {CWD} : the current working directory (valid only at the beginning) • {HOME} : the user's home directory (valid only at the beginning) • {DEFAULT} : the default place the product normally puts its settings

(valid only at the beginning)

AcsBaseDirectory:Keywords

12/5/2016

56


Welcome to the Waitless WorldVerifying Location



Default (“My Documents” on Windows, home dir otherwise)

com.ibm.iaccess.AcsBaseDirectory=

Network share

com.ibm.iaccess.AcsBaseDirectory=

com.ibm.iaccess.AcsBaseDirectory={PRODUCTDIR}/config_directory/{USER}

Thumb drive!

com.ibm.iaccess.AcsBaseDirectory={PRODUCTDIR}/config_directory

Cliff’s Notes:Common Configurations

12/5/2016

57



• There are two approaches to limiting the functions that the user has access to when running IBM i Access Client Solutions

– List of Excluded Components tied to the product deployment

– Runtime restrictions stored on the client workstation

Limiting Functions



• Deployed via AcsConfig.properties file next to or within acsbundle.jar– Property must be set:

com.ibm.iaccess.ExcludeComps

– Set this property to a comma-separated list of function keywords

• The function keywords which may be specified are:– DATAXFER - Data Transfer to/from IBM I– EMULATOR - 5250 Display/Print emulation and 5250 Session

Manager– KEYMAN - SSL certificate management– OPCONSOLE - Operations console and Virtual Control Panel– RMTCMD - Remote Command (available from the command line)– SPLF - Printer Output– HWCONSOLE - Hardware management interface– L1CPLUGIN - Navigator for i

Excluding Components

12/5/2016

58



• Can be set via the IBM i Access Client Solutions application when ran with Administrator or Root level authority.

• GUI interface from Edit -> Preferences

Runtime Restrictions



• Can be set via the IBM i Access Client Solutions application when ran with Administrator or Root level authority.

• Command Line option to restrict, unrestrict, list, export/import

Runtime Restrictions

12/5/2016

59



• Easy GUI option!– Only supported on Windows– Must launch via acslaunch*.exe Start

Program or acsbundle.jar from default product file structure

File Associations

• Can also be done by the command lineacslaunch_win-32.exe /plugin=fileassoc



Migration

12/5/2016

60



• IBM i Access Client Solutions provide several tools to assist with migrating from the IBM i Access for Windows client environment to IBM iAccess Client Solutions

– 5250 Migration Tools

o Workstation file and keyboard map migration

o Macro migration

o Legacy File Associations

– Data Transfer

o Saved Data Transfer migration

– System Connections

Migration



• 5250 Session Manager

5250 Migration

12/5/2016

61



Migration – 5250 session profiles

5250 Migration




5250 Migration

12/5/2016

62




• Keyboard map, toolbar, and popup keypad files are also converted. The converted .kmp, .bar, or .pmpfiles will be saved in the same location that the new .hod file is created and will be referenced by that .hod file.

5250 Migration



Macro Migration

5250 Migration

12/5/2016

63



• Create File Association for IBM i Access for Windows saved .ws or .bch file to be opened withIBM i Access Client Solutions

5250 Migration


Welcome to the Waitless WorldData Transfer Migration

12/5/2016

64



Migration – Data Transfer saved requests

Data Transfer Migration



• Migrates saved .dtt and .dtf files to IBM i Access Client Solutions .dttx and .dtfx files


12/5/2016

65



• Results of Migration– Green check indicates success– Red x indicates failure and there are more details




• IBM i Access Client Solutions Copy Connections can be used to move System Configurations

System Connections

12/5/2016

66




Windows Application

Package



Another Piece of the Puzzle


• Data transfer


• System i Navigator

• Data drivers (ODBC, OLEDB, .Net)• IBM i Access APIs• Printer drivers

Application Package

12/5/2016

67



• Install technology

• Living without System i Navigator

• Incoming Remote Command

• Command-line utilities



Back to the Windows Installer

12/5/2016

68



Windows Application Package uses Windows Installer

– Beginning in V6R1 Access for Windows changed the installer program featuring the Windows Installer technology.

– Windows Installer has become the industry standard for installations on the Windows platform.

– Windows Installer provides administrators with standard mechanisms to manage installations, customize install packages, set install policies and install service packs.

– Using Windows Installer allows product to be deployed to multiple desktop users with several deployment systems, such as Microsoft® Active Directory® and Microsoft Systems Management Server.



Advantages of using Windows Installer

– Standard installation technology.

– Customizing an installation package is standardized with transforms.

– Silent installs are simpler. No response files needed.

– Ability to plug into deployment mechanisms

– IBM i Access Client Solutions Windows Application Package can leverageall of the install mechanisms available

– But since it only installs Application Enablement code just a simple Complete, Silent install is all that is required.

12/5/2016

69



Installation Setup types

– Complete

Installs everything

– Custom

Allows end user to select what to install



User Interface Levels

Level Command line option

UILevel value

Description

Full (default) /qf 5 The Install Wizard is launched. User can change all installation options.

Reduced /qr 4 Displays all dialogs except the Wizard dialogs. Users can not change installation options.

Basic /qb 3 Only progress bar and error messages are shown. User still can cancel instalation.

Silent /qn 2 No dialogs displayed. There’s no indication about installation in progress.

– In Windows Installer, an installation's user interface can have several levels:

Full user interface Basic user interface

12/5/2016

70



User Interface Levels (continued)

• By default, launching setup.exe will initiate with full user interface.

• The level of user interface can be changed in several ways:

– At the command line

o Type setup /v/”… q[f|r|b|n]”

– In setup.ini:

o Append the string /q[f|r|b|n] to the CmdLine key.

– With a transform

o Create a transform that modifies the value of property UILevel in the Property table.



User Interface Levels (continued)

• Silent and basic UI installations do not require a response file as in previous releases.

• Default settings defined in the MSI package are used. The defaults can be overridden via public properties and transforms.

• A full UI allows users to change installation settings.

• A basic UI is useful if you don’t want your users to change installation settings but you still want to get error messages.

• A silent install is useful if you don't want users to change any settings and no visual notifications are needed, like in overnight installations.

12/5/2016

71









Task: Create or edit a "connection"

Create

12/5/2016

72




Edit




• Two non-iNav ways to do this:

1. Use command line tool

2. Use ACS core offering

12/5/2016

73




• Command-line tool: cwbcfg.exe




• Create a connection for "common2.idevcloud.com that uses Windows logon and ssl

12/5/2016

74




• Edit a connection for "common2.idevcloud.com that uses Windows logon and ssl (the key here is /r)




If you have ACS core offering handy……

1) Create/edit a system configuration ("connection") in core ACS

Create/Edit

12/5/2016

75







2) Go to "File->Copy Connections"

12/5/2016

76



"Copy Connections" note

• What about "User Windows user name and password"?

• ACS has "Use shared credentials." This maps to the "Use Windows user name and password" option in Windows



Task: Verify connectivity

12/5/2016

77








1. ACS Core offering GUI

2. ACS Core offering command line

12/5/2016

78





1) Go to create/edit a system configuration ("connection") in core ACS




2) verify connection

12/5/2016

79






Task: Trust an SSL certificate

Edit

12/5/2016

80








1. cwbcossl.exe utility

2. ACS Core offering

12/5/2016

81







12/5/2016

82







Default password: ca400

12/5/2016

83





1) Go to create/edit a system configuration ("connection") in core ACS




2) Enable SSL and verify connection

12/5/2016

84




3) Accept the certificate




3) Accept the certificate

12/5/2016

85




4) "Tools->Key Management"




5) Select the certificate and click the "Push to Windows" button

12/5/2016

86









12/5/2016

87









Incoming Remote Command

• IBM i OS CL command - RUNRMTCMD

– Send workstation command and workstation credentials to REXEC daemon running on the workstation TCP/IP Port 512

– IBM i Access for Windows Incoming Remote Command service was such a REXEC daemon

– Windows Server OS also provided an REXEC daemon

– REXEC spec has significant issues, key being that it does not provide for SSL communications so credentials and command are passed in clear text

– Microsoft last provided their REXEC daemon in theWindows Server 2003 SDK, and documents that it is deprecated and not guaranteed to work in newer Windows OS environments

– IBM does not include it’s Incoming Remote Command withIBM i Access Client Solutions Windows Application Package

12/5/2016

88



Incoming Remote Command - Options

• IBM i OS CL commands - STRPCO and STRPCCMD

– Also sends workstation command

– Uses active 5250 Telnet connection from compatible 5250 emulator

– If 5250 Telnet connection is SSL Enabled, command is sent encrypted

– No credentials provided or required as 5250 Telnet connection is already authenticated and runs under account that launched 5250 emulator

– IBM i OS CL commands STRPCO and STRPCCMD must be ran from the interactive job that was started from the 5250 emulator on the workstation that the command will be ran on

– Supported by the IBM i Access Client Solutions Base Package5250 emulator




• IBM i Access For Windows r7.1 is still supported on Windows Server 2012 R2 and Windows 8.1 and earlier Windows OS versions

• Still includes now deprecated Incoming Remote Command REXEC daemon

• Install and use the Microsoft Windows Server 2003 SDK provided REXEC daemon

12/5/2016

89




• OpenSSH also possible

– Run OpenSSH daemon on PC

– "Desktop" not available







12/5/2016

90



Command-line utilities: cwbback/cwbrest

• cwbback offers a way to back up your list of connections

• cwbrest offers a way to restore that list of connections

• Upgrading from IBM i Access for Windows? The steps are:

1. Run cwbback

2. Uninstall Access for Windows

3. Install the ACS Application Package

4. Run cwbrest



Command-line utilities: cwbenv

• Combines the backup and restore features of cwbback and cwbrest, but lets you back up secondary environments

12/5/2016

91



What have we learned?

• IBM i Access for Windows?

– Future not so bright

• Replacement for functions (big picture)?

– Combination of ACS core offering, ACS application packages, Navigator for i, Application Runtime Expert (ARE), IBM i Access for Web/Mobile

• How to live without iNav?

– Common "access" tasks can be completed with only the AP

– Others can be easily done with command-line utilities or the ACS base offering



Questions?

12/5/2016

92



Useful links

• Access Client Solutions

– http://www-03.ibm.com/systems/power/software/i/access/solutions.html

• Administration Runtime Expert (ARE)

– http://www-03.ibm.com/systems/power/software/i/are/

• IBM RFE community (submit requests to the "IBM i" product)

– https://www.ibm.com/developerworks/rfe/