Novell DirXML 1.1a for Windows NT/2000

1.0 Documentation

For information about DirXML^® and the drivers, refer to the documentation located at the Novell Product Documentation site.

You can view the documentation online in HTML, or download a copy in PDF format.

The latest readme file is also available online at the same location.

2.0 ZENworks for Desktops Environment and Workstation Manager

If the Windows* NT/2000 server is running in a Novell^® ZENworks^® for Desktops environment, be sure that the Workstation Manager component of the Novell Client^TM is either not installed or is disabled. For information on how to not install or how to disable Workstation Manager or if Workstation Manager is required on the server, see the information below, 3.0 For ZENworks Environment: Installing the Novell Client When Workstation Manager is Required.

3.0 For ZENworks Environment: Installing the Novell Client When Workstation Manager is Required

eDirectory allows only a single system-level authentication from a node at one time. Novell products, such as ZENworks for Desktops, DirXML, or OnDemand/DeFrame run as services on Windows NT/2000. Those services may each do an eDirectory authentication when starting up, and each service can use a different username and password. Generally, these services are started alphabetically, and you cannot control the order. After any service starts, and authenticates to eDirectory, subsequent services trying to log in will fail. (The login behavior of the service depends on the configuration of the service.)

For example, if a machine has been imported using ZENworks for Desktops 3 and a workstation object is created in eDirectory, Workstation Manager will need to authenticate to eDirectory during startup. If a service such as DirXML is then installed, Workstation Manager will no longer be able to authenticate because the DirXML service starts first and performs its own eDirectory authentication. If this conflict in authentication happens, you might experience high CPU utilization as the service tries to authenticate, a growing PAGEFILE.SYS, or failure of the feature controlled by the failing service. In addition, DirXML will stop functioning if this authentication conflict occurs.

To avoid this problem, refer to the appropriate scenario below before installing DirXML.

• Novell Client for Windows NT/2000 has not been installed yet.

  Solution: When running the Novell Client for Windows NT/2000 install, select the Custom installation option and uncheck the option for Workstation Manager.

• Novell Client for NT/2000 has already been installed with Workstation Manager enabled.

  Solution: Disable Novell Workstation Manager.

  1. On Windows 2000, right-click My Network Places > select Properties.

  2. Right-click Local Area Connection > select Properties.

  3. Right-click Workstation Manager > select Properties > remove the check mark to disable Workstation Manager.

• Novell Client for NT/2000 has already been installed with Workstation Manager enabled, but you have a Novell product installed, such as OnDemand/DeFrame, that requires Workstation Manager.

  Solution: Prevent the Windows server from importing as a Workstation object in eDirectory.

  • If the Windows server is already imported as a Workstation object, delete the Workstation object through ConsoleOne.
  • Run UNREG32.EXE on the Windows server to remove the Registry entries and clean out the WSREG32.LOG file.
  • To prevent the Windows server from being automatically re-imported, edit the local HOSTS file on the Windows server (C:\WINNT\SYSTEM32\DRIVERS\ETC\HOSTS) and either:

    Remove the entry for zenwsimport

    or

    If DNS is configured to provide the address of the Workstation Import Service, modify the hosts file so that the entry for the ZENworks Workstation Import Service points the Windows server to its own loopback address, such as 127.0.0.1 zenwsimport. This prevents the Windows server from being imported again in the future.

  NOTE:  There can be problems with using the loopback address. If you use a loopback in a local HOSTS file, and the ZENworks Workstation Import Service is running on that Windows server, the server will still be imported as a Workstation object in eDirectory. It is best to remove or disable Workstation Manager, unless you are running a product on the Windows server that requires Workstation Manager.

4.0 Special Instructions

• If you use Novell^® iManager 1.5 to administer User objects and you also use the DirXML Driver for GroupWise^® (or if you have used it in the past), refer to TID #NOVL82926 and download the patch for iManager. The patch is necessary for maintaining correct Group Lists, GroupWise PO memberships, and GroupWise Distribution Lists.

  If you don't download the patch, you will experience errors after you view Group Memberships on a User object. If you select any other tabs from the Modify Object task after viewing Group Memberships (such as Login Script, See Also, or Postal Address), you will see a message indicating that the GroupWise Post Office DN is not a group. You cannot exit iManager until you delete the offending DN. If you delete the offending DN, the User's association with his or her post office and distribution lists will be lost.

• If you are running Novell eDirectory^TM 8.7 and the DirXML Driver for eDirectory on Solaris, refer to TID #NOVL83005 and download the patch for Novell eDirectory.

  If you do not install this patch you might encounter the following error when starting the driver: "IOException: Implementation NOT supported on current platform."

• After you install the iManager DirXML plug-ins, you must stop and restart the Web server.

5.0 Known Issues

• Migration events being dropped: If you experience a -734 cache error, virus protection software might be corrupting Novell cache files. These are the symptoms:
  • A cache error -734 occurs.
  • A message in the trace says that the event cache has been deleted, and events that are in the cache are dropped.
  • The driver can begin processing again and succeeds until another cache error occurs.

  To resolve the issue, make sure your virus protection software is excluding TAO files. In addition, exclude from virus protection the Novell\NDS folder and all the subfolders below it.

• Due to limitations of the Netscape* browser, you cannot administer DirXML with iManager. This will be fixed in a future release.
• The Remote Loader will not run with JVM/JRE version 1.4 or higher. You should use a previous release of the JVM/JRE.
• If you create passwords that contain extended foreign characters such as accented or double-byte characters, we recommend that you manage passwords from only one of the administration tools. If you are using both ConsoleOne^® and iManager, you might have problems authenticating through one of them if you created your password in the other administration tool. Each handles extended characters differently and submits different hash values to eDirectory.

  If you need to create passwords in both administration tools, you should restrict passwords to the lower 128 ASCII characters.

• When entering the Remote Loader parameters, ensure that you only use one space between the hostname, port, and kmo values. The DirXML engine treats the extra white space as the next value and causes the driver to generate an error.
• If your display resolution is set at 600x800, you might have a problem closing help screens because the help screens display in a larger dialog box than the program you are running. In this case, you can close the help screen by pressing ALT+ F4.
• DirXML 1.1a export files are not fully backwards compatible with DirXML 1.0. DirXML 1.0 exports and imports the driver filter as a single string of encoded data. DirXML 1.1a decodes the driver filter into a set of human-readable XML tags that are much easier to handle. DirXML 1.1a will accept either the encoded form or the human-readable form on import, but will only export the human-readable form. As a result, you cannot export a DirXML 1.1a configuration and import it into a DirXML 1.0 driver. Similarly, standard import files for the DirXML 1.1a release might not be compatible with DirXML 1.0.
• If you experience authentication problems during the installation, and if you are certain your authentication information is correct, you should ensure that the NCP packet signature level is not set to 3. If the parameter value is set to 3, you will see a -864 error in DSTrace. You should set the value to 1, reboot your computer, run the installation program, and then set the value back to 3 to maintain the same security level.

  NCP packet signatures determine the level of enhanced security support. Enhanced security includes the use of a message digest algorithm and a per connection/per request session state. The values are as follows: 0=disabled, 1=enabled but not preferred, 2=preferred, and 3=required. Setting this parameter to 2 or 3 increases security, but decreases performance.

6.0 Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes.

You may not export or re-export this product in violation of any applicable laws or regulations including, without limitation, U.S. export regulations or the laws of the country in which you reside.

Copyright ^© 2003 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.

Patents Pending.

ConsoleOne, DirXML, GroupWise, Novell, and ZENworks are registered trademarks of Novell, Inc. in the United States and other countries.

eDirectory is a trademark of Novell, Inc.

All third-party trademarks are the property of their respective owners.