With V3R7’s Enhanced Integration for Novell NetWare product, you can perform a number of NetWare administrative, printing, and file server functions from within an AS/400 session. (For one example of how to use this feature, see “Combining AS/400 and NetWare Printing in V3R7” on page 1.) With Enhanced Integration, AS/400-NetWare coexistence has reached a new level, enabling you to change NetWare user passwords, manage NetWare volumes, import data from NDS trees into your client/server applications, and more—all from inside OS/400. The rub of it is that—in order to perform any of these advanced functions—your AS/400 first has to log in to a Novell NetWare server and establish an authenticated NetWare connection.

This article examines how IBM’s Enhanced Integration for Novell NetWare product breaks down the wall between your AS/400 running V3R7 and a Novell NetWare server by allowing authenticated NetWare logins from your AS/400 (For more information on NetWare logins, see “What Is an Authenticated NetWare Session?” on page 16.) I’ll also look at the different types of NetWare logins that can be performed in V3R7, how to set up your system security values, and the mechanics of logging in to NetWare from OS/400.

Three Ways to Authenticate

There are three ways you can create an authenticated OS/400 connection to NetWare by using the Enhanced Integration product. Your first choice is to create the connection manually by using the Start NetWare Connection (STRNTWCNN) command. You can also choose to create it automatically by using an OS/400-based NetWare authentication entry when a user makes a request to a NetWare Directory Services (NDS) tree or a NetWare 3.12 server. Finally, you can take advantage of a hybrid combination of manual and automatic connection techniques using both the STRNTWCNN command and

NetWare authentication entries. (An authentication entry is a record associated with an AS/400 user profile that automates that user’s access to NetWare services.)

The method you choose will depend on two factors. The first factor is whether or not you want to store NetWare passwords on your AS/400. If you prefer not to store NetWare passwords in your NetWare authentication entries, you must start your NetWare connection by using the manual or the hybrid method.

The second deciding factor will be whether or not you want several AS/400 batch or interactive jobs to use a single NetWare connection. If you want to start a single connection to NetWare and then want several batch, interactive, or printer jobs to use that connection, you must also use the manual or hybrid method. For most other situations, you can start your NetWare connection using any of the three techniques.

The Critical System Value

Your choice of OS/400 NetWare connection methods is heavily influenced by a single AS/400 system value—the Retain server security data value, QRETSVRSEC (Figure
1). QRETSVRSEC is a simple 0 or 1 (off or on) system value that tells your AS/400 whether passwords for other server systems can be stored in OS/400. For NetWare connections, OS/400 consults this value to determine whether passwords should be saved in NetWare authentication entries. If QRETSVRSEC is set to 0 (do not retain security data), passwords will not be stored in NetWare authentication entries even when they are entered. With QRETSVRSEC in the off position, any OS/400 job using a NetWare authentication entry to log in to a NetWare server must also use the STRNTWCNN command to verify the password. When you turn QRETSVRSEC off, by de-fault you are requiring a user to enter STRNTWCNN to log in to Novell NetWare. The default value for QRETSVRSEC is 0.

When QRETSVRSEC is set to 1 (retain security data), NetWare passwords can be stored in NetWare authentication entries. This means that any job using an OS/400 NetWare authentication entry can automatically log in to a NetWare server without any manual input at all.

If you want to change QRETSVRSEC to 1 so you can save NetWare passwords for automatic connection to NetWare, you would enter the following command:

CHGSYSVAL SYSVAL(QRETSVRSEC) VALUE(‘1’)

To turn off OS/400’s ability to save NetWare passwords inside authentication entries, you would enter the following command:

CHGSYSVAL SYSVAL(QRETSVRSEC) VALUE(‘0’)

Manually Starting a NetWare Connection

To manually start an OS/400-NetWare connection, you use STRNTWCNN. This command can be typed in from a command line or it can be used within a CL program. By default, STRNTWCNN uses several pieces of information from the AS/400 user’s NetWare authentication entry when one is present. STRNTWCNN can be used either as a supplement to or as a substitute for a NetWare authentication entry. There are two common situations in which you would use STRNTWCNN to start a NetWare connection in lieu of an authentication entry. The first situation would be one in which you want to limit the number of active connections to your NetWare server. When you start a manual connection, it can be used exclusively by the initiating job or it can be shared among several other jobs running under the STRNTWCNN AS/400 user profile. This means you can consolidate your NetWare connections so that, for example, two remote printer jobs that redirect AS/400 spool files to NetWare printer queues can use the same connection.

The second situation in which you would use STRNTWCNN would be one in which you need to provide password validation for AS/400 NetWare authentication entries in environments where the QRETSVRSEC value is set to 0. In those environments, the

STRNTWCNN command is used in conjunction with authentication entries to provide password validation for NetWare signons. This situation is discussed in the authentication entry section below.

To start a manual AS/400 login to a NetWare server, simply execute this command with the proper NetWare and OS/400 parameters filled in. To get to the command prompt for STRNTWCNN, type in the following command and press F4:

STRNTWCNN

This will give you the screens shown in Figures 2 and 3. To open a straight NetWare connection where all fields are defined on this screen, fill in the following parameters with the information for your system.

• Server: The name of the NetWare server you are logging in to. You can enter a specific server name or—for NDS servers—you can specify *ANY or *ALL. *ANY tells OS/400 to start a connection to any server within an NDS tree while *ALL means to start connections to all trees within the NDS tree specified on this command.
• Server type: The type of server you are logging in to. There are three possible parameters you can enter here: *SERVER—OS/400 automatically determines the type of NetWare server you are logging in to and makes the appropriate adjustments. You cannot use *SERVER if you specify *ANY or *ALL for the server parameter. *NetWare3—Use this to log in to a NetWare 3.12 server. *NDS—Use this to log in to a NetWare 4.1x/IntraNetWare server.
• NDS tree and NDS context: If you are attaching to an NDS server, specify the name of the NDS tree and the NDS context to be used for the connection. These parameters are not used when signing in to NetWare 3.12 servers.
• Authorized user profile: Specify the AS/400 user profile that can use this connection.
• NetWare user: Specify the NetWare user ID to be used for this connection. The default uses the NetWare user ID specified in the AS/400 user profile’s NetWare authentication entry, if one is present.
• Password: This is the password used by NetWare to verify the user’s authority. The possible values are *AUTE, which uses the password stored in the AS/400 user’s NetWare authentication entry, if present; *NONE; or a hard-coded password.
• Authorized job: This parameter specifies which jobs can use the connection. Your choices are as follows: *—Specifies only the current job. Use this value if you are using this connection to access the NetWare file system. *ANY—Any job can use this NetWare connection. Printing to a NetWare print server requires a value of *ANY.
• Connection idle time: This parameter specifies how long a NetWare connection can remain unused before OS/400 closes it down. The possible values are a numeric value specifying the amount of time in minutes the connection can be idle before it is automatically disconnected or *NOMAX, which forces the connection to remain open indefinitely. When used with the AUTJOB(*ANY) parameter, this retains the connection for any active job currently running or scheduled to run at a later time.

Automatically Starting a NetWare Connection

To automatically start a connection to a NetWare server, the Enhanced Integration product allows you to create user-based NetWare authentication entries inside OS/400. The authentication entries store the NetWare user name and password for each NDS tree or

NetWare 3.12 server an AS/400 user requires a connection to. Because a single person can sign in to many NetWare servers, an AS/400 user can have multiple NetWare authentication entries attached to his profile. However, he can have only one authentication entry per NDS tree or NetWare 3.12 server.

When your user enters a request to a NetWare server, OS/400 automatically searches for his authentication entry for that NDS tree or NetWare 3.12 server. If it finds one, it attempts to start a connection to NetWare. The NetWare server receives the connection request and—if the user name and password are valid—starts the connection and services all authorized administrative, printing, and file system requests. To view and work with a user’s NetWare authentication entries, type in the Work with NetWare Authentication Entries (WRKNTWAUTE) command as follows:

WRKNTWAUTE USRPRF(username)

This will display a screen similar to the one shown in Figure 4. On this screen, you can modify, create, display, remove, or start an authenticated connection to NetWare. To add another authentication entry for this user, select option 1 and press Enter to get the screen in Figure 5. The fields on this screen will be slightly different depending on whether you are adding an entry for a NetWare 3.12, NetWare 4.1x, or IntraNetWare server, but the general idea is the same. To enter an authentication entry, you enter the following information:

• Server type: The type of server you are accessing. As with the STRNTWCNN command, you specify either *NDS or *NetWare3.
• Server name: The name of the server for NetWare 3.12 servers.
• NDS tree and NDS context: For NDS servers, the NetWare connection information for their tree structure.
• User profile: The AS/400 user profile you are creating this entry for. Your choices are *CURRENT—where the entry is created for the user you are signed on as—or the name of the user you are creating the entry for.
• NetWare user name: The name of the user on the NetWare server. You can choose *USRPRF to use the same name as your AS/400 user profile or you can choose the name of the NetWare user you want to sign on as. You can sign on to your NetWare server with a different user name than your AS/400. You may want to do this for entries that will be used for NetWare administration or any other function where a group of people may sign on as a single NetWare user.
• Password (optional): The NetWare password for the user specified in the NetWare user name field. The use of this field is dependent on the QRETSVRSEC system value. If QRETSVRSEC is set to 1, the password will be saved. If QRETSVRSEC is set to 0, OS/400 will not save any NetWare password values, even if you enter one. As mentioned before, authentication entries can be saved with or without a password. If they are saved with a password, OS/400 will automatically use them to log in to a NetWare server whenever a NetWare request is made.

The Hybrid Approach

If the user password is not saved in the NetWare authentication entry as described above, the entry cannot be used by itself to log in to NetWare. In these situations, you must start a manual connection to the NetWare server by using the STRNTWCNN command.

As opposed to the straight manual connection described previously, if a user types in the STRNTWCNN command for a server he has an authentication entry for, he only needs to provide the server name and the password. OS/400 will fill in the rest of the information from the user’s authentication entry for that server.

For example, if user RALPHK has a NetWare authentication entry for a NetWare
4.1x file server named SERVER, he could start a connection to that server by typing in the following command:

STRNTWCNN SERVER(SERVER2) PASSWORD(XXXX)

The rest of the information would be taken from RALPHK’s authentication entry for SERVER2. In this case, STRNTWCNN works with the authentication entry to start a manual login that uses the predefined server information in the authentication entry. It’s slightly more work than having OS/400 automatically log RALPHK in to NetWare, but it provides consistent NetWare information in the security context of RALPHK’s AS/400.

Thanks, IBM

As you can see, starting a NetWare connection from OS/400 is fairly easy once you know the ropes. Plus, IBM gives you plenty of tools so you can start several different types of connections based on your needs.

Figure 1: The QRETSVRSEC System Value Determines whether OS/400 Will Save NetWare Passwords Figure 2: Starting the NetWare Connection with STRNTWCNN,Screen 1

Figure 3: Starting the Netware Connection with STRNTWCNN, Screen 2 Figure 4: The Work with Netware Authentication Entries Screen

Figure 5: The Add NetWare Authentication Entry Screen