These release notes contain important information available at the time of the Service Pack 2 release of Netscape Enterprise Server (NES) Version 6.1. New features and enhancements, installation notes, known problems, and other late-breaking issues are addressed here. Read this document before you begin using Enterprise Server.
Check the Enterprise Server Documentation page prior to installing and setting up your software and then periodically thereafter to obtain the latest release notes and manuals.
These release notes contain the following sections:
These release notes describe changes made since Version 6.1. For information regarding changes made prior to this release, see also:
The new magnus.conf directive DisableMethods can be used to disable HTTP methods that you choose not to process. Specify the methods you want to disable in a comma-separated list. For example, to disable the methods TRACE and OPTIONS, you would use:
DisableMethods TRACE,OPTIONS
No methods are disabled by default.
When you disable methods, error log messages similar to the following are generated:
[27/Jan/2003:09:38:33] info (14552): HTTP Method TRACE disabled.
[27/Jan/2003:09:40:08] info (14552): HTTP Method OPTIONS disabled.
NOTE: Methods that are part of the HTTP RFC (2068) should not be disabled lightly. If you disable these methods, your server will not be RFC-compliant, which could result in unexpected behavior from clients.
The new magnus.conf directive ACLCacheStrictPassword invalidates an ACL cacheentry if a request contains an invalid password. This mechanism allows the LDAP policy to be invoked when unauthorized accesses are attemped.
The default setting is on.
See the Netscape Enterprise Server NSAPI Programmer's Guide for more information on tuning the ACL cache.
The magnus.conf directive NetWriteTimeout controls how long Enterprise Server should wait for a call to the net_write() function to complete. A valid value is an integer specifying the number of seconds to wait. The default value is 1800 (30 minutes).
Use the magnus.conf directive EnforceValidCerts to indicate how Enterprise Server should respond if the check of its certificate chain fails upon startup. The check verifies that:
When the check of the certificate chain fails upon startup:
The default setting is on.
The new magnus.conf directive ParentAcceptLanguage allows you to change how Enterprise Server checks the Accept-Language HTTP header for possible localized language versions.
When the server.xml attribute acceptlanguage is set to on, Enterprise Server parses the Accept-Language header and sends an appropriate language version based on which language the client can accept.
When the new magnus.conf directive ParentAcceptLanguage is set to off (or in previous versions), Enterprise Server takes the list from the Accept-Language header, sorts the list items, and for any items that contain a hyphen (for example, fr-ca, en-US) the parent/prefix language is added to the end of the list. For example, if the Accept-Language header is:
Accept-Language: fr-ca, de, en-US
the language list generated by Enterprise Server is:
fr_ca, de, en_US, fr, en
When ParentAcceptLanguage is set to on, Enterprise Server inserts the parent/prefix language into the language list after the associated hyphenated item. For example, if the Accept-Language header is:
Accept-Language: fr-ca, de, en-US
the language list generated by Enterprise Server is:
fr_ca, fr, de, en_US, en
The default setting is off.
Note that Enterprise Server still checks the value of the DefaultLanguage directive. DefaultLanguage specifies the default language for the server. The default language is used for both the client responses and administration. See the Netscape Enterprise Server NSAPI Programmer's Guide for details.
The new magnus.conf directive LDAPClientAuth is part of Enterprise Server's new support for LDAPS client authentication to ACLs. Previous versions of Enterprise server supported only username/password authentication to the LDAP(S) database.
In order for client authentication to work, the instance's certificate database that holds the client certificate must be opened. It must be opened because Enterprise Server is initiating an SSL connection as a client in this case. The database can be opened because either:
The default setting is off.
If the database is not opened and someone tries to access the server, the connection to the LDAPS server fails with this message in the error log:
Client authentication bind failed: bad key or key password (89)
See "Importing the Client Certificate" for instructions on importing your client certificate into the the certificate database of the server.
Importing the Client Certificate
To import your client certificate into the certificate database of the server, perform the following steps:
The client certificate must be authorized to connect to the remote secure LDAP server and exported into the PKCS#12 file format. (Most browsers export certificate files in the PKCS#12 format.) Merely installing the client certificate into the server's database is not sufficient. The private key is also necessary, because this certificate is used to initiate an SSL connection.
Use the pk12util utility to import the client certificate into the certificate database of the server. The pk12util utility is located in server_root/bin/https/admin/bin/. The following example assumes that you saved the PKCS#12 file in the cert.p12 file:
% cd server_root/alias
% pk12util -P https-instance_name-host_name- -d . -i cert.p12
Provide the database password and then the client certificate password when prompted to do so.
Provide the client certificate password, when prompted to do so.
Use the certutil utility to verify that the certificate was imported successfully. The certutil utility is located in server_root/bin/https/admin/bin.
% certutil -P https-instance_name-host_name- -L -d . Server-Cert u,u,u client_cert_CA CT,, client_cert u,u,u
You can also use the Administration Console to verify that the certificate was imported successfully:
If you imported the client certificate successfully, it will be listed among the certificates displayed.
Once you have imported the client certificate, update the LDAPS server entry in dbswitch.conf to specify the nickname of the client certificate to use:
database:clauthnickname nickname
In the examples shown in step 5, the nickname of the client certificate is client_cert.
Once you have imported the client certificate and updated dbswitch.conf, set up certificate mapping in your LDAP server. See Certificate Mapping Considerations for additional information.
Certificate Mapping Considerations
Set up certificate mapping in your LDAP server to map the client certificate to an entry in your LDAP server. This is separate from the client-authentication mapping performed by Enterprise Server. See the Netscape Directory Server documentation for details.
Note: If the certificate mapping is misconfigured, no errors appear at startup. However, when someone attempts to authenticate to the web server protected by this database, the following error appears:
Client authentication bind failed: client certificate mapping failed (49)
The optional flex-log parameter, %duration%, logs the amount of time in microseconds Enterprise Server spent executing a request. Statistics must be enabled for %duration% to work.
For information about other flex-log options, see Table 7-1 in the Netscape Enterprise Server NSAPI Programmer's Guide.
ForceReload controls the handling of files that have outlived the MaxAge value of the file cache.
The default setting is off.
Enterprise Server now checks the IP address and/or hostname of requests before prompting for a username and password. You can use the Administration Console to change the hostnames and IP addresses to allow:
See the Administration Console help for details.
Three new SAFs help you manipulate variables:
These SAFs are applicable in all stage directives. See the Netscape Enterprise Server NSAPI Programmer's Guide for details.
As of Version 6.1, Netscape Enterprise Server no longer supports JSP 0.9. If you have a previous version of Enterprise Server, edit the obj.conf file and remove the entire <Object>/</Object> entry for the object jsp092. (603854)
For each patch, use the listed revision or a higher revision. For example, if you need patch 111111-01, the later revision 111111-03 will also work.
Note that if you are using a JDK, you may need additional patches.
The following patch is required to run Enterprise Server 6.1 SP2 on Solaris 2.6: 105591-09
Note: You can determine if you have a patch by running the following command:
% showrev -p | grep 105591
Use the latest Solaris patches for Solaris 7.
Use the "Recommended Solaris Patch Cluster" for Solaris 8 plus the following patches: 108827-19, 109472-07, 109234-05
Note: You can determine if you have the patch by running the following command:
% showrev -p | grep patch_id
The following Solaris 2.6 patch is recommended when using the CC4.2 compiler: 104668-09.
You can find a list of patches for Java 1.2.2.07 at:
http://www.unix.hp.com/java/java2/sdkrte/infolibrary/release_notes_SDK_1-2-2-07.html
Windows 2000 Server SP1 or later is required for running Enterprise Server 6.1 SP2.
| Platform | JRE / JVM / JIT Version | Comments |
|---|---|---|
| Solaris 2.8 | Solaris VM (build Solaris_JDK_1.4.0_00) |
Comment out the -Xrs flag in config/jvm12.conf to generate stack traces. For more details, see the section "Generating a Stack Trace for Debugging" in the Netscape Enterprise Server Installation and Migration Guide.
For JVMPI-based profiling (such as hprof) or debugging purposes (such as attaching Solaris dbx), use the reference implementation downloadable from: |
| Windows NT 4.0 | Java version 1.4.0_00 Classic VM | |
| Windows 2000 | Java version 1.4.0_00 Classic VM | |
| HP-UX | Java version 1.3.1_05
JRE 1.3.1.05 Standard Edition (build 1.3.1.05-020425-12:07) Java HotSpot™ Server VM (build 1.2.1 1.3.1.05_20020425 PA2.0, mixed mode) |
|
| RedHat Linux 7.2 | Java version 1.4.0_00 Classic VM |
The following table summarizes the supported platforms for Enterprise Server 6.1 SP2. All platforms, except for Microsoft Windows 2000, require a minimum of 128 MB memory (256 MB recommended) and 150 MB disk space. Windows 2000 requires at least 512 MB of memory and 2GB of disk space to run Enterprise Server 6.1 SP2 successfully.
* Supported via binary compatibility.
**As of Enterprise Server 6.x, older SPARC CPUs are not supported. Enterprise Server 6.1 SP2 continues to support the UltraSPARC architecture.
If you are running an earlier version of this product, see the table below to determine how to upgrade to Netscape Enterprise Server 6.1 SP2.
| If you are running... | Then... |
|---|---|
| iPlanet™ Web Server 6.x | Install Netscape Enterprise Server 6.1 SP2 in the same server root. |
| iPlanet Web Server 4.x | Install Netscape Enterprise Server 6.1 SP2 in a different server root then migrate your data to the new server. |
| Netscape Enterprise Server 6.0 | Install Netscape Enterprise Server 6.1 SP2 in the same server root. |
| Netscape Enterprise Server 3.x or earlier | Install Netscape Enterprise Server 6.1 SP2 in a different server root. There is no migration path. |
See the Netscape Enterprise Server Installation and Migration Guide for details.
Some Netscape and SunONE/iPlanet servers install libraries into the System32 directory. This can cause Enterprise Server to function incorrectly. It is not recommended that multiple Netscape, SunONE, or iPlanet servers be installed on a single Windows host.
When including servlet output in SHTML documents, use the <servlet...> method instead of the #include method. Using #include can lead to unexpected results from the servlet(s).
When the installer is started on Windows 2000, a message reports erroneously that there is not enough space on the hard disk to extract the package, even though adequate space may be available.
A problem with the variable SSLClientAuthTimeout causes NSS to use an inappropriate timeout interval. To work around this problem, set the magnus.conf directive AcceptTimeout to 3600 seconds.
If an Enterprise Server instance name has the suffix .SSL, the names of databases created by the Adminstration Server based on the instance name will not match the names Enterprise Server will use to search for databases.
When a web application is deployed to a Windows NT/2000 directory with spaces in its name, a "Bad Request" error message can result.
Changing the Administration Server UID causes file permission problems that can prevent the Administration Server from starting.
In order to use distributed administration, you must use LDAP, not LDAP over SSL.
Due to problems with the drivers, Rainbow SSL hardware accelerators do not work with Enterprise Server 6.1 SP2.
When a virtual server is defined under a user-created class and access control is disabled, a server error page displays when a user's browser attempts to access the virtual server.
To work around this problem, always leave Access Control ON under Restrict Access.
If you renew then import the Enterprise Server security certificate using the old key and subject name, Enterprise Server fails to start afterward. The resulting error message says the certificate or key necessary for authentication could not be found. To work around this problem, use a new key.
If the environment variables SHLIB_PATH or LD_LIBRARY_PATH are set to something other than what is set in the Enterprise Server start script, unpredictable behavior can result (including being unable to start Enterprise Server at all).
If Enterprise Server fails to start and logs an error indicating a dlopen failure and/or undefined symbol errors, check to see if these environment variables have been incorrectly set. You may choose to explicitly unset these environment variables in the start script.
If CGI code returns a location header but does not set a status header and if the location header is not a URL, lost data (including path-info) can generate what appears to be a PathCheck problem but is not.
To work around this problem, have the CGI that is returning the internal redirect append $PATH_INFO to Location before returning.
Enterprise Server 6.1 SP2 supports Optimizeit 4.x. The instructions for enabling remote profiling with OptimizeIt have been updated. See the Netscape Enterprise Server Programmer's Guide to Servlets for details.
j2sdk_home/bin;j2sdk_home/jre/bin/server;j2sdk_home/jre/bin/classic
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q257592
j2sdk_home/bin;j2sdk_home/jre/bin/server;j2sdk_home/jre/bin/classic
Note: References in the Enterprise Server 6.1 documentation to cert7.db should now be interpreted to mean cert7.db (if migrated), cert8.db, or both.
For more information see http://www.mozilla.org/
Netscape Enterprise Server documentation includes the following manuals, which are available online in HTML and PDF format:
Netscape Enterprise Server does not directly support the PHP scripting language. Support for the PHP scripting language can be added to Enterprise Server through two APIs supported by the PHP development team: CGI and NSAPI. For performance and scalability reasons, Netscape recommends that users interested in PHP utilitize the NSAPI implementation.
For more information on PHP see:
So that we can best assist you in resolving problems, please be sure to include the following information:
You might also find it useful to subscribe to the following newsgroups:
snews://secnews.netscape.com
snews://secnews.netscape.server
snews://secnews.netscape.devs-server.technical
snews://secnews.netscape.devs.jsp
snews://secnews.netscape.security
snews://secnews.netscape.server.enterprise
snews://secnews.netscape.devs-nsapi
snews://secnews.netscape.devs-java
Use of Netscape Enterprise Server is subject to the terms described in the license agreement accompanying it.
Software applications: © 2001 Sun Microsystems,Inc. Some software code: © 1999, 2003 Netscape Communications Corporation. All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their respective owners.