Db2 for i - Services (new)

• QSYS2.SQLSTATE_INFO

Db2 for i - Services (enhanced)

• QSYS2.DUMP_PLAN_CACHE()

• IBM i Integrated Multi-factor authentication (MFA) extends password authentication to include an additional authentication factor used to verify your identity.
  • Time-based one-time password (TOTP) implementation extends password authentication to include an additional authentication factor used to verify your identity
  • QIBM_RUN_UNDER_USER_NO_AUTH function usage ID prevents a user profile from being used without supplying the user profile’s credentials
  • New user profiles: QPGMR_NC, QSECOFR_NC, QSYSOPR_NC and QUSER_NC
    • IBM-supplied user profiles with names that end in _NC, for “not changeable” are used by the operating system and applications
  • Single authentication exit point QIBM_QSY_AUTH enables customizable additional authentication processing
  • “Enhanced profile token” incorporates purpose and network origination into the generation and subsequent use of the profile token
  • System service tools (SST) and dedicated service tools (DST) MFA TOTP implementation
  • Navigator provides several enhancements for managing Multi-factor Authentication from configuration to user profile management.  See Using IBM Navigator for i to Manage MFA.

Navigator

System Management  The Access Client Solutions and the new Web based Navigator continue to be enhanced as we strive to help the IBM i Administrator manage and update their IBM i systems.

  

• Web Administration migration
  • TLS Connections - Host Server port information and launch to wizard for host servers
  • Test TLS in the wizard to verify all host servers have correct certificates
  • DCM - TLS configuration wizard is new (under TLS Configuration > ADMIN3)
  • TLS Configuration > Deactive Unsecure Ports
    • Will also set Global TLS for system and turn on TLS for DCM by default
  • Application Servers now has all the data populated in each row for the server:
    • Subject Alternative Name verification - verifies hostname on certificate
    • Assigned Certificate information
    • 
• Security
  • Navigator simplifies MFA Configuration  - see Using IBM Navigator for i to Manage MFA
    • 
    • MFA System Administration page - one page for all the MFA information
      • Security Configuration provides all the security settings for MFA
      • Users allows you to check MFA Key, Authentication, Exit Program Authentication, and Impersonation status
      • Authentication Exit Point to add and remove exit points
        • 
    • My Work > My Additional Authentication Factor > Manage My MFA Key
      • Warning will be shown if you have not configured your system date to be synchronized
        • 
      • Users can generate and validate their MFA code.  Setup is easy with QR code:
        • 
• Serviceability
  • Connection Properties > TLS Connection
    • Turning on TLS will also test all the host servers and provide certificate information:
    • 
  • Digital Certificate Manager (DCM) has a tab to enable and test TLS:
    • 
• Stop monitor server command has changed!  Refer to Monitor Stop and Start
• New GUI Preferences panel for TLS Override and Localhost Override
  • TLS handling - Added "tlsOverride" option to preferences to override an user preferences for TLS.  This is a safety measure to allow easier non-TLS log in when certificate issues occur (expired, not updated, etc).  Will also require removal of any port restrictions (via 5250) that might be on.
  • Localhost override - For port forwarding and cloud environment.
    • The preference file for this can also be manually edited.  See Navigator for i in a Cloud environment.
• Users - New function to disable a user profile across multiple systems
  • Actions > Disable on system
  • 
• System > System Status
  • new Firmware card
    • 
• Network
  • SNTP Connection Status action is now supported
    • 
  • Alternative Subsystem Routing
    • Route by User
    • Route by IP - interface changes for Navigator
    • Added column for Number of Configured IPs
• Performance Data Investigator (PDI)
  • Ability to view Incomplete collections
  • New Graph History charts for Job Count
    • Batch Jobs CPU Utilization - Number of Batch Jobs
      • 
    • Interactive Jobs CPU Utilization - Number of Interactive Jobs
      • 
• System Debug - Debug Service
  • Can now regenerate certificates for the Debug Service, requires v3+ of Debug Service (PTF number TBD)
    • This requires a user with *ALLOBJ and *SECADM, and the *SYSTEM store needs to be properly set up with a valid certificate
    • Start and stopping the service has been updated for v3, it will also continue to work for older versions of the Debug Service
• Bookmarks - Improved handling for TLS
  • Added TLS column and port information

• Support for providing an Additional Factor when MultiFactor Authentication (MFA) is enabled on an IBM i 7.6 partition
  • 
• Keep ACS host server connections from being disconnected due to inactivity
• Launch ACS showing System Groups when that was the last active view

General Operating System

• Updates to base year support for 2-digit year date formats.
• Workload groups added to RTVSYSINF and UPDSYSINF

• IBM Power E1080 (9080-HEX)
• IBM Power S1012 (9028-21B)
• IBM Power S1014 (9105-41B)
• IBM Power S1022 (9105-22A)
• IBM Power S1022s (9105-22B)
• IBM Power S1024 (9105-42A)
• IBM Power L1022 (9786-22H)
• IBM Power L1024 (9786-42H)