IBM Support

Checking and Modifying ACS WinAP System Configurations

How To


Summary

How to view and change the IBM i system connections defined in the IBM i Access Client Solutions Windows Application Package

Steps

One downside to removing the graphical interfaces other than the ODBC data source dialog from the Windows client is we no longer have an easy way to view the system configurations for the Windows client.  Being a bit-head, I find it easiest to query the registry where the data is stored to see how the system connections are configured.  To do that, I start a windows command line as administrator and run the command:
reg query "hkcu\Software\IBM\Client Access Express\CurrentVersion\Environments\My Connections" /s
Which displays the connections, recursing through all the keys.
And you would see something like the following, which shows two of the systems that connections are defined for.

HKEY_CURRENT_USER\Software\IBM\Client Access Express\CurrentVersion\Environments\My Connections\RCH720A

HKEY_CURRENT_USER\Software\IBM\Client Access Express\CurrentVersion\Environments\My Connections\RCH720A\Communication
    Description    REG_SZ
    Secure Sockets Layer    REG_DWORD    0x0
    Signon Mode    REG_DWORD    0x3
    User ID    REG_SZ
    IP address lookup mode    REG_DWORD    0x0
    Port lookup mode    REG_DWORD    0x0
    IP Address    REG_SZ    9.5.65.133
    IP Address cache timeout    REG_DWORD    0x5d08ea3f

HKEY_CURRENT_USER\Software\IBM\Client Access Express\CurrentVersion\Environments\My Connections\MCEI5L1.MAINZ.DE.IBM.COM

HKEY_CURRENT_USER\Software\IBM\Client Access Express\CurrentVersion\Environments\My Connections\MCEI5L1.MAINZ.DE.IBM.COM\Communication
    Description    REG_SZ
    Secure Sockets Layer    REG_DWORD    0x0
    Signon Mode    REG_DWORD    0x1
    User ID    REG_SZ    US2D3749
    IP address lookup mode    REG_DWORD    0x0
    Port lookup mode    REG_DWORD    0x0
    IP Address    REG_SZ    9.155.11.89
    IP Address cache timeout    REG_DWORD    0x5cf7fa61
    Version Release Level    REG_DWORD    0x70300
    Admin System Indicator    REG_DWORD    0x0

What is of particular interest here is the Signon Mode values
0x1 = Default user (specified by the user ID string) prompt once per windows logon and cache the password.
0x2 = Prompt for ID and password every time a connection is made
0x3 = Use Windows logon credentials (cache them)
0x4 = Use single signon (Kerberos)

Our client caches the ID and password for values 1 and 3.  To clear that cache, log out of Windows and log back in.
If you want to view this information in a GUI interface, you can do that with the IBM i Access Client Solutions base package.  I'm going to show an example here because with my new Windows 10 machine I can no longer use the 0x3 option because we use PINs instead of passwords.  I want to change the setting for system RCH720A so that it uses my default user of MIKSWENS.  How do I make this change? You really have two clients when you are using the IBM i Access Client Solutions base package (Java-based client deployed on Windows) and the Windows Application Package. To make the change by using the GUI interface, I launch IBM i Access Client Solutions.  Then, open the System Configurations and it shows the Java client connection.  In this case, it is defined to use the same connection information but it wouldn't have to be the same...it is two separate clients.  RCH720A is already defined in the base package so I select it and click Edit then click the Connection tab

The possible values here are mostly easy to understand other than 'Use shared credentials', which for the WinAP means use Windows logon credentials.  I change to use default user and then click OK

Now that's great for the Java client, doesn't do a thing to the WinAP though.  To make that change I need to close the System Configurations and click the File menu in the main IBM i Access Client Solutions GUI and select 'Copy Connections'
Then, I click RCH720A on the left side and copy it over to the right side.  This action updates the Windows configuration so that it now uses a default ID of MIKSWENS and it prompts only once per Windows logon for the password.

As a double check, use the registry query again:

HKEY_CURRENT_USER\Software\IBM\Client Access Express\CurrentVersion\Environments\My Connections\RCH720A

HKEY_CURRENT_USER\Software\IBM\Client Access Express\CurrentVersion\Environments\My Connections\RCH720A\Communication
    Description    REG_SZ
    Secure Sockets Layer    REG_DWORD    0x0
    Signon Mode    REG_DWORD    0x1
    User ID    REG_SZ    MIKSWENS
    IP address lookup mode    REG_DWORD    0x0
    Port lookup mode    REG_DWORD    0x0
    IP Address    REG_SZ
    IP Address cache timeout    REG_DWORD    0x5d08ea3f

You could also make the change the other way around. Copy the Windows configuration for the system to the Java side, then open it in the system configuration editor to see what the settings are.
We also have a utility that you can use to clear the cached password for one or more systems.  From a Windows command line, use the CWBLOGON tool.  Let's say that I changed the password for RCH720A and want to clear the IBM i Access Client Solutions WinAP cached password.  I run the command: 
cwblogon rch720a /c
And my next connection to that system prompts me for a password.

Document Location

Worldwide

[{"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SSRQKY","label":"IBM i Access Client Solutions"},"Component":"Windows Application Package","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB66","label":"Technology Lifecycle Services"}}]

Document Information

Modified date:
07 July 2021

UID

ibm10888103

Page Feedback