Ldap

z/OS SSL support includes the ability for applications to create multiple SSL environments within a single process. An application can now modify environment attributes without terminating any SSL sessions already underway.

•IPv6 Support: This support allows System SSL to be used in an IPv6 network conﬁ guration. It also enables System SSL to support both IPv4 and IPv6 Internet pro- tocol addresses.

•Performance is improved with CRL Caching: Today, SSL supports certiﬁ cate revocation lists (CRLs) stored in an LDAP server. Each time a certiﬁ cate needs to be validated, a request is made to the LDAP server to get the list of CRLs. CRL Caching enables applications to request that the retrieved list of CRLs be cached for a deﬁ ned length of time.

•Support for the AES Symmetric Cipher for SSL V3 and TLS Connections: System SSL supports the Advanced Encryption Standard (AES), which provides data encryp- tion using 128-bit or 256-bit keys for SSL V3.0 and TLS V1.0 connections.

•Support for DSS (Digital Signature Standard) Certiﬁ - cates: System SSL has been enhanced to support Digi- tal Signature Standard certiﬁ cates deﬁ ned by the FIPS (Federal Information Processing Standard) 186-1 Stan- dard.

•System SSL of RSA Private Keys Stored in ICSF: With z/OS 1.4, support is introduced that is designed to allow a certiﬁ cate’s private key to reside in ICSF thus lifting

a restriction where the private key had to reside in the RACF database.

•Failover LDAP provides greater availability: You can now specify a list of Security Server-LDAP servers to be used for storing certiﬁ cate revocation lists (CRLs). When certiﬁ cate validation is being performed, this list will be used to determine which LDAP server to connect to for the CRL information.

•Simpliﬁ ed administration with the ability to export and import certiﬁ cate chains using PKCS#7 format ﬁ les.deﬁ ned length of time.

z/OS provides industry-standard Lightweight Directory Pro- tocol (LDAP) services supporting thousands of concurrent clients. Client access to information in multiple directories is supported with the LDAP protocol. The LDAP server supports thousands of concurrent clients, increasing the maximum number of concurrently connected clients by an order of magnitude.

Enhancements

•Mandatory Authentication Methods (required by IETF RFC 2829) are supported in z/OS 1.4: The CRAM-MD5 and DIGEST-MD5 authentication methods have been added. The methods avoid ﬂ owing the user’s password over the connection to the server. The LDAP Server, the C/C++ APIs, and the utilities are updated with this sup- port. Interoperability is improved for any applications that make use of these methods.

•TLS: z/OS LDAP now provides support for TLS (Trans- port Layer Security) as deﬁ ned in IETF RFC 2830 as an alternative to SSL support. It also provides support, via an LDAP extended operation, that allows applications to selectively activate TLS for certain LDAP operations at the application’s discretion.