TM1 Forum

I just wanted to confirm my understanding of the SSL feature added in 9.1

1) Disabling the SSL requirement in a 9.1 server, enables both 9.0 and 9.1 clients to connect to a 9.1 server
2) The 9.1 admin server communicates on different ports for SSL and non-SSL communications
3) The 9.1 client can ONLY connect using SSL - thus a 9.1 client cannot connect to a 9.0 server


I am running a 9.0 server/client installation was contemplating upgading clients before the server - looks like that's not possible
Any comments?

Thanks
IanB

Hi Ian,

I'll try to answer your questions here as best I can.

IanB wrote:1) Disabling the SSL requirement in a 9.1 server, enables both 9.0 and 9.1 clients to connect to a 9.1 server
2) The 9.1 admin server communicates on different ports for SSL and non-SSL communications
3) The 9.1 client can ONLY connect using SSL - thus a 9.1 client cannot connect to a 9.0 server

1. I have been able to do this as you describe (9.0 SP2 client, for example, connecting to 9.1 SP3 server with SSL disabled is what I've tested). Note, however, that I don't think Applix/Cognos/IBM has ever said they'd support connections across major point releases, but rather only within them. So, I'd be very careful about running this way for very long since 9.1 has had enough problems historically on its own without cross-versions getting in the way.

2. There are definitely 2 ports involved with the Admin server in 9.1: 5495 (also used in earlier versions) and 5498 (I think) which is the SSL-related port. I haven't traced the activity on both, however, to know whether they are used exclusively in the manner you describe. In other words, if you block 5495 in some way you could run into problems even if SSL is switched on.

3. I have not had any luck connecting a 9.1 client to a 9.0 server (my test was 9.1 SP3 client to 9.0 SP3 server). To be honest, I can't remember if I've ever had a lot of luck connecting newer clients to older server versions. It is possible that there is a general prohibition agains this or that the 9.1 API (which the TM1 client uses) has something SSL related in it that just won't allow it to make the connection to 9.0, for example.

In terms of upgrading, I've generally approached it from the server first (if not all the clients can be done at the same time). It's usually possible to get the server running on that new release and then hit the clients with the upgrade as you can. If you've been using 9.0 (and earlier) releases for quite a long time, it will be interesting to hear what your users think (good or bad) after getting them fully onto 9.1.

Regards,
Mike

Mike Cowie wrote: 3. I have not had any luck connecting a 9.1 client to a 9.0 server (my test was 9.1 SP3 client to 9.0 SP3 server). To be honest, I can't remember if I've ever had a lot of luck connecting newer clients to older server versions. It is possible that there is a general prohibition agains this or that the 9.1 API (which the TM1 client uses) has something SSL related in it that just won't allow it to make the connection to 9.0, for example.

It's a general prohibition; you'll find it mentioned in the TM1s.cfg page of the help file, specifically under the ClientVersionMaximum parameter.

Alan Kirk wrote:It's a general prohibition; you'll find it mentioned in the TM1s.cfg page of the help file, specifically under the ClientVersionMaximum parameter.

Good catch on the documentation note. I guess I've gotten in the habit of testing first/not trusting everything in the manuals. For example, the 9.1 SP3 API documentation still says that the TM1 C/VB API only requires 3 API DLLs when there are actually 2 additional DLLs for 9.1 (LIBEAY32.DLL and SSLEAY32.DLL) and an SSL subfolder required. That was a fun one to work out...

Regards,
Mike

Mike Cowie wrote:

Alan Kirk wrote:It's a general prohibition; you'll find it mentioned in the TM1s.cfg page of the help file, specifically under the ClientVersionMaximum parameter.

Good catch on the documentation note.

Weeeelll... I have to admit that I didn't pick that one up from having the help files as my bedside reading. It was something that I found when we were first testing 9.1 and I was trying to determine whether I could still connect to our 8.2.12 production server while I was in testing mode. As it turned out... not.

Mike Cowie wrote: I guess I've gotten in the habit of testing first/not trusting everything in the manuals. For example, the 9.1 SP3 API documentation still says that the TM1 C/VB API only requires 3 API DLLs when there are actually 2 additional DLLs for 9.1 (LIBEAY32.DLL and SSLEAY32.DLL) and an SSL subfolder required. That was a fun one to work out...

Yeah, I've learnt the hard way not to trust the API manuals...

Useful to know about those extra DLL's too... {scribbles notes for future reference...}

Oh wait, I don't have to. We finally have a forum which will endure!

Oh wait, I don't have to. We finally have a forum which will endure!

So Alan still hasn't gotten the job at Big Blue