IBM Lotus Instant Messaging Gateway

Transcription

1 A Lotus Softare White Paper September 2004 softare IBM Lotus Instant Messaging Gateay G

2 Disclaimer THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS PROVIDED FOR INFORMA TIONAL PURPOSES ONLY. WHILE EFFORTS WERE MADE TO VERIFY THE COMPLETENESS AND ACCURACY OF THE INFORMATION CONTAINED IN THIS DOCUMENTATION, IT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. IN ADDITION, THIS INFORMATION IS BASED ON IBM S CURRENT PRODUCT PLANS AND STRATEGY, WHICH ARE SUBJECT TO CHANGE BY IBM WITHOUT NOTICE. IBM SHALL NOT BE RESPONSIBLE FOR ANY DAMAGES ARISING OUT OF THE USE OF, OR OTHERWISE RELATED TO, THIS DOCUMENTATION OR ANY OTHER DOCUMENTATION. NOTHING CONTAINED IN THIS DOCUMENTATION IS INTENDED TO, NOR SHALL HAVE THE EFFECT OF, CREATING ANY WARRANTIES OR REPRESENTATIONS FROM IBM (OR ITS SUPPLIERS OR LICENSORS), OR ALTERING THE TERMS AND CONDITIONS OF THE APPLICABLE LICENSE AGREEMENT GOVERNING THE USE OF IBM SOFTWARE. Copyright Copyright IBM Corporation 2004 All rights reserved. US Government Users Restricted Rights - Use, duplication or disclosure restricted by GS ADP Schedule Contract ith IBM Corp. Lotus Softare IBM Softare Group One Rogers Street Cambridge, MA List of Trademarks IBM, the IBM logo, AIX, Domino, Lotus, Lotus Notes, OS/400, PoerPC, iseries, pseries, and WebSphere are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. Intel and Pentium are trademarks of Intel Corporation in the United States, other countries, or both. Microsoft and Windos are registered trademarks of Microsoft Corporation in the United States, other countries, or both. Unix is a registered trademark of The Open Group in the United States and other countries. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. Linux is a trademark of Linus Torvalds in the United States, other countries, or both. AOL is a registered service mark of America Online, Inc. Other company, product, or service names may be trademarks or service marks of others.

3 Contents Introduction... 1 Supported instant messaging and aareness environments... 2 Supported LIMWC environments... 2 Supported LWP environment... 4 LIM Gateay functional overvie... 5 Ho the LIM Gateay orks ith LIMWC users... 5 Ho the LIM Gateay orks ith LWP users... 6 LIM Gateay connections to servers in the LWP and LIMWC environments... 7 Security... 9 LIM Gateay connections ith the LWP environment... 9 LIM Gateay connections ith the LIMWC environment... 9 Server failover Directory issues Supported directories Person entry and Internet address requirements Adding users and groups to client buddy lists Client functionality and the LIM Gateay Client functionality supported by the LIM Gateay LIM Gateay usage issues Avoiding unnecessary logins of LIMWC users to the LWP server Third-party SIP clients Buddy list changes are not synchronized across environments LIMWC external SIP communities are not supported AOL external communities are not supported Reverse proxies and firealls Client privacy issue End user issues Installation issue Deployment LWP environment LIMWC environment... 22

4 Installation Where to install the LIM Gateay Communication ith servers on other platforms System Requirements for the LIM Gateay Installation procedures Configuration Configuring the LIM Gateay Configuring the LWP server to operate ith the LIM Gateay Configuring the LIMWC server to operate ith the LIM Gateay Changing the jks files that support TLS encryption Stopping and starting the LIM Gateay Error/Trace message logs... 38

5

6 Introduction The IBM Lotus Instant Messaging Gateay (or LIM Gateay) is a softare gateay that allos users in an IBM Lotus Instant Messaging and Web Conferencing (Sametime ) environment and users in an IBM Lotus Workplace environment to communicate using online presence and instant messaging. Note: In this hite paper, the IBM Lotus Instant Messaging and Web Conferencing (Sametime) product is abbreviated as "LIMWC" and the IBM Lotus Workplace product is abbreviated as "LWP." An LIMWC server and an LWP server each use a different infrastructure to support presence and instant messaging functionality. The LIMWC server uses an infrastructure based on the proprietary IBM Lotus Virtual Places (VP) protocol hile the LWP server uses an infrastructure based on the open standard Session Initiation Protocol (SIP). The LIM Gateay serves as an intermediary, or translator, beteen the LIMWC and LWP platforms and performs operations that enable users connected to these to disparate platforms to communicate through presence and instant messaging. The LIM Gateay is designed primarily for an organization that uses both LIMWC servers and LWP servers. For example, if your organization deploys LWP servers in a test or pilot environment, but uses LIMWC servers in its production environment, you can deploy the LIM Gateay to enable users in these to environments to communicate through presence and instant messaging. This hite paper discusses the folloing topics pertaining to the LIM Gateay: Supported LIMWC and LWP environments LIM Gateay functional overvie Security Server failover Directory issues LIM Gateay usage issues Deployment Installation Configuration Error/trace message logs IBM Lotus Instant Messaging Gateay 1

7 Supported instant messaging and aareness environments LIMWC servers can be deployed either by themselves or ith other IBM products to support a presence and instant messaging community. To operate ith an LIMWC environment, the LIM Gateay connects to and interacts ith the LIMWC servers in that environment. The LIM Gateay does not interact ith any other servers (such as IBM Lotus Portal servers) that are deployed in the LIMWC environment to support presence and instant messaging clients. Because the LIM Gateay interacts only ith the LIMWC servers, the deployment and configuration procedures for the LIM Gateay are the same regardless of hether LIMWC servers are deployed by themselves or ith other IBM products. Similarly, to operate ith an LWP environment, the LIM Gateay interacts only ith components of the LWP servers. The deployment and configuration procedures for the LIM Gateay are the same for all LWP environments that support presence and instant messaging. Revie the topics in this section for detailed information on the supported LIMWC and LWP environments. Supported LIMWC environments You can use the LIM Gateay ith any of the folloing LIMWC environments: An environment here only LIMWC servers are deployed to support instant messaging and presence. An environment here LIMWC servers are deployed ith IBM Lotus Portal servers to support instant messaging and presence for portlet clients. An environment here LIMWC servers are deployed ith Lotus Domino servers to support instant messaging and presence for Lotus Notes clients. An environment here LIMWC servers are deployed ith both Lotus Domino servers and Lotus Portal servers to support portlets that combine Lotus Domino and LIMWC functionality. Note: In this hite paper, the term "LIMWC environment" is a generic reference to any of the environments listed above. This hite paper assumes that you already have one of these LIMWC environments up and running. 2 IBM Lotus Instant Messaging Gateay

8 Supported servers in the LIMWC environment In your LIMWC environment, the folloing server versions are required for the environment to function ith the LIM Gateay: Sametime 3.1 (or higher) servers that operate on Windos, AIX, Solaris, and OS/400 platforms. If your Sametime servers are Sametime 3.0 (or earlier), you must upgrade your servers to use them ith the LIM Gateay. Note: The platforms listed above include all platforms supported by the LIMWC (Sametime) server at the publication date of this hite paper. If the LIMWC server is built on an additional platform in the future, check ith an IBM representative to determine if the LIM Gateay operates ith the server on the additional platform. IBM Lotus Portal 5.0 (or higher) servers. If your LIMWC environment includes IBM Lotus Portal servers, the portal servers must be version 5.0 or higher. Only portlet presence and instant messaging clients that operate ith portal server versions 5.0 or higher can be used ith the LIM Gateay. Lotus Domino 6.5 (or higher) servers. If your LIMWC environment includes Lotus Domino servers, they must be version 6.5 or higher. Only Lotus Notes clients that operate ith versions 6.5 or higher can be used ith the LIM Gateay. Supported clients and toolkits in the LIMWC environment All instant messaging and aareness clients that operate ith the server versions listed above are supported. Users in the LIMWC environment can use any of the folloing clients to communicate ith users in the LWP environment: Sametime Connect (both the Windos and broser versions) Any client developed ith a Sametime Links toolkit that is created for use ith Sametime 3.1 or higher servers. These clients include: Any portlet provided in the Collaboration Center of a Portal 5.0 (or higher) server that supports instant messaging and presence, such as a Lotus Team Workplaces portlet or a buddy list portlet. Any portlet (5.0 or higher) developed by IBM Lotus that operates ith a Lotus Domino and LIMWC server to combine Domino functionality and LIMWC presence and instant messaging functionality, such as the Web Access (inotes) portlet. Sametime links (or "live names") embedded into a Lotus Notes 6.5.x client to integrate instant messaging and aareness ith the Notes client. Any other presence and instant messaging client built ith any IBM Lotus developer toolkit created for use ith Sametime 3.1 or higher servers. No modifications to these presence and instant messaging clients are required to operate ith the LIM Gateay. IBM Lotus Instant Messaging Gateay 3

9 Note: A Sametime Connect 3.1 client includes technology that enables a Sametime Connect user to communicate ith AOL users through presence and instant messaging. LWP users cannot communicate ith these AOL users through the LIM Gateay. For more information, see the "LIM Gateay usage issues" section later in this hite paper. Supported LWP environment This section discusses the server, client, and toolkit requirements for an LWP environment. Supported server in the LWP environment The LIM Gateay can operate ith LWP (or higher) servers that operate on the Windos, AIX, or Linux operating system. Note: The platforms listed above include all supported platforms for the LWP server as of the publication date of this hite paper. If the LWP server is built on an additional platform in the future, check ith an IBM representative to determine if the LIM Gateay operates ith the server on the additional platform. Supported clients and toolkits in the LWP environment All instant messaging and presence clients that operate ith an LWP 2.0 (or higher) server are supported. These clients include: Any portlet provided ith an LWP 2.0 (or higher) server that supports instant messaging and presence. Workplace Client Technology (WCT) clients (for example, the Lotus Workplace rich client for Messaging and Documents) Any other instant messaging and presence client built ith any IBM Lotus developer toolkit created for use ith the LWP 2.0 (or higher) server. No modifications to these presence and instant messaging clients are required to operate ith the LIM Gateay. This hite paper assumes that you already have an LWP environment up and running. 4 IBM Lotus Instant Messaging Gateay

10 LIM Gateay functional overvie This section briefly discusses the functionality and operational details of the LIM Gateay. An administrator installs the LIM Gateay and configures the gateay to interact ith servers in both the LIMWC and LWP environments. (The installation and configuration procedures for the LIM Gateay are provided later in this hite paper.) Once it is installed and configured, the LIM Gateay performs four basic functions to enable instant messaging and presence communications beteen the LIMWC environment and the LWP environment, including: Monitoring client logins to one environment and logging users into the other environment Detecting changes in a user's presence status and reflecting those changes in the other environment Handling instant messages that are sent beteen users in the to environments Monitoring the client logouts in one environment and logging users out of the other environment By performing the functions above, the LIM Gateay enables end users in the LIMWC and LWP environments to perform these actions: Detect the presence status of a user from the other environment Exchange instant messages ith a user from the other environment Note: The issues associated ith adding users and groups from the other environment to client buddy lists are discussed in the "Directory issues" section later in this hite paper. Read folloing topics in this section for additional information on the functionality of the LIM Gateay: Ho the LIM Gateay orks ith LIMWC users Ho the LIM Gateay orks ith LWP users LIM Gateay connections to the LWP and LIMWC servers Ho the LIM Gateay orks ith LIMWC users To enable LIMWC users to communicate ith LWP users, the LIM Gateay logs LIMWC users into the LWP environment and transmits presence status information and instant messages from those users into the LWP environment. To optimize performance and scalability, the LIM Gateay does not automatically log every online LIMWC user into the LWP server. The LIM Gateay logs an LIMWC IBM Lotus Instant Messaging Gateay 5

11 server user into the LWP server only if an LWP user has "subscribed on" the LIMWC user. An LWP user "subscribes on" an LIMWC user in either of these scenarios: The LWP user adds the LIMWC user to a buddy list in an LWP instant messaging client. An LIMWC user initiates a chat session by sending an instant message to an LWP user. (In this scenario, the chat indo that opens on the LWP user's computer programmatically subscribes on the LIMWC user. The chat indo subscribes on the LIMWC user even if no LWP users have added the LIMWC user to a buddy list.) The steps belo summarize the operations that occur to log LIMWC users into the LWP environment: 1. When the LIM Gateay starts, it connects to servers in both the LIMWC and LWP environments. 2. An LWP server sends the LIM Gateay lists of all LIMWC users and groups that are subscribed on by all LWP users. 3. The LIM Gateay sends SIP register requests to an LWP server to register the subscribed on LIMWC users into the LWP environment. After registering an LIMWC user into the LWP environment, the LIM Gateay performs the folloing activities on behalf of the LIMWC user: Detects the LIMWC user's presence status (for example, "I am active" or "I am aay") on the LIMWC server and communicates the user's presence status to the LWP environment. If an LIMWC user changes presence status, the LIM Gateay detects this status change on the LIMWC server and transmits this change to the LWP server. The LWP server notifies the interested LWP users of this status change. Handles instant messages sent from the LIMWC user to an LWP user. When an LIMWC user sends an instant message to an LWP user, the message is sent from the LIMWC client to the LIM Gateay and transmitted from the LIM Gateay to the LWP server. The LWP server transmits the message to the LWP user. Detects the user logouts on the LIMWC server and logs the users out of the LWP environment. Ho the LIM Gateay orks ith LWP users To enable LWP users to communicate ith LIMWC users, the LIM Gateay logs the LWP users into the LIMWC environment. After logging LWP users into the LIMWC environment, the LIM Gateay transmits presence status information and instant messages from those users into the LIMWC environment. 6 IBM Lotus Instant Messaging Gateay

12 The LIMWC server has a larger user-handling capacity than the LWP server. Because of this larger user-handling capacity, the LIM Gateay logs all online LWP instant messaging and presence users into the LIMWC server. The steps belo summarize the operations that occur to log LWP users into the LIMWC environment: 1. When the LIM Gateay starts, it connects to servers in both the LIMWC and LWP environments. 2. The LWP server notifies the LIM Gateay each time an LWP user logs in. 3. The LIM Gateay logs the LWP user into the LIMWC server. The LIM Gateay uses standard LIMWC log in functionality and authentication by token to accomplish this log in process. After logging an LWP user into the LIMWC environment, the LIM Gateay performs the folloing activities on behalf of the LWP user: Detects the LWP user's presence status and communicates the user's presence status to the LIMWC environment. If an LWP user changes presence status, the LIM Gateay detects this status change on the LWP server and transmits this change to the LIMWC server. The LIMWC server notifies the interested users of this change. Handles instant messages sent from an LWP user to a user in the LIMWC environment. These messages are sent from the LWP user to the LIM Gateay and transmitted from the LIM Gateay to an LIMWC server. The LIMWC server transmits the message to the LIMWC user. Detects the user logouts on the LWP server and logs the users out of the LIMWC environment. LIM Gateay connections to servers in the LWP and LIMWC environments As noted above, the LIM Gateay connects to servers in both the LIMWC and LWP environments. This section discusses the connections beteen the LIM Gateay and the LWP and LIMWC servers and the operations that occur over these connections. Much of the configuration associated ith the LIM Gateay involves configuring the connectivity beteen the LIM Gateay and the LWP and LIMWC servers. An administrator should have a clear understanding of this connectivity before configuring the LIM Gateay. Configuring LIM Gateay connections to the LWP servers During the LIM Gateay installation, the administrator configures the LIM Gateay to connect to the LWP server(s) in the environment. IBM Lotus Instant Messaging Gateay 7

13 The administrator configures the LIM Gateay to establish a connection ith the Stateless SIP Proxy (SLSP) component on one LWP server in the environment. Over this connection, the LIM Gateay sends the SIP methods that register LIMWC users into the LWP environment. The administrator also configures the LIM Gateay to establish a connection to the Presence server component on each LWP server in the environment. Over these connections, the LIM Gateay receives the folloing information about user activity on each of the LWP servers in the environment: LWP user logins and logouts occurring on each LWP server LWP user presence status changes occurring on each LWP server LIMWC users that are subscribed on by the LWP users connected to each LWP server Notes: If an environment consists of a single LWP server, the administrator configures the LIM Gateay to establish to connections to that LWP server: one connection to the SLSP component and a separate connection to the Presence server component. If an environment consists of multiple LWP servers, and the administrator deploys a single LIM Gateay, the administrator configures the LIM Gateay to connect to the SLSP component on one LWP server in the cell and the Presence server components on every LWP server in the cell. If an environment consists of multiple LWP servers, the administrator can also deploy multiple LIM Gateays to optimize performance. See the "Deployment" and "Configuration" sections later in this hite paper for more information about deploying multiple LIM Gateays. Configuring LIM Gateay connection to the LIMWC servers During the installation, the administrator also configures the LIM Gateay to establish a single connection to one server in the LIMWC environment to support all communications beteen the LIM Gateay and the LIMWC environment. Only a single connection to one server in the LIMWC environment is needed regardless of hether the LIMWC environment consists of a single LIMWC server or multiple LIMWC servers. This configuration is also discussed in the "Configuration" section later in this hite paper. 8 IBM Lotus Instant Messaging Gateay

14 Security This section discusses the security issues associated ith the LIM Gateay connections to the LWP and LIMWC environments. LIM Gateay connections ith the LWP environment The LIM Gateay connects to every LWP server in an LWP environment. When establishing these connections, the LIM Gateay must transmit a name (Internet address) and passord to each LWP server so that each LWP server can authenticate the connection from the LIM Gateay. An administrator must do the folloing to support the authentication of LIM Gateay connections into the LWP environment: Create a unique LDAP directory entry for each LWP server in the environment. For example, if there are three LWP servers in the environment, you must create three unique LDAP directory entries. Each of these LDAP directory entries must include a different user name, Internet address, and passord. Enter the Internet addresses and passords associated ith the LDAP directory entries above into the IMAProxy.properties file during the LIM Gateay installation. This process is discussed in the "Configuration" section later in this hite paper. All data transmitted beteen the LIM Gateay and the LWP servers is encrypted ith Transport Layer Security (TLS). To enable this encryption, the administrator specifies TLS as the connection protocol for LIM Gateay connections to the LWP server hen configuring the LIM Gateay. To support TLS encryption of the communication beteen the LIM Gateay and the LWP server, the LIM Gateay installation places a DummyClientKeyFile.jks file and a DummyClientTrustFile.jks file in the installation directory on the LIM Gateay computer. These are the same jks files that IBM provides by default ith all WebSphere servers. You have the option of using different key store and trust store jks files to support the TLS encryption. For more information, see "Changing the key files that support TLS encryption" in the "Configuration" section later in this hite paper. LIM Gateay connections ith the LIMWC environment Connections from the LIM Gateay to the LIMWC server are authenticated using the IP address of the LIM Gateay. IBM Lotus Instant Messaging Gateay 9

15 To log LWP users into the LIMWC server, the LIM Gateay uses the standard "light log-in" functionality provided for LIMWC Web-based clients in the LIMWC server developer toolkits. All data transmitted beteen the LIM Gateay and the LIMWC servers is encrypted using RC 2 ith a 128-bit key for symmetric encryption. No configurations are required by the administrator to encrypt this data. 10 IBM Lotus Instant Messaging Gateay

16 Server failover The LIM Gateay performs failover functions if it loses communication ith either an LIMWC server or an LWP server. If the LIM Gateay loses communication ith an LIMWC server, the gateay logs all users of that LIMWC server off of the LWP server(s) to hich the LIM Gateay is connected. Similarly, if the LIM Gateay loses communication ith an LWP server, the gateay logs all users of that LWP server off of the LIMWC servers to hich the LIM Gateay is connected. When the LIM Gateay loses communication to either an LIMWC server or an LWP server, the LIM Gateay automatically attempts to reconnect to the server at 60 second intervals. IBM Lotus Instant Messaging Gateay 11

17 Directory issues This section discusses directory issues associated ith the LIM Gateay, including: Supported directories Person entry and Internet address requirements Adding users and groups to client buddy lists Supported directories You can use the LIM Gateay ith any type of directory that is supported by an LIMWC or LWP environment. The LIM Gateay interacts directly ith the LIMWC servers and LWP servers in the to environments, but does not access the directories used in those environments. This hite paper assumes that you have both an LIMWC environment and an LWP environment currently in operation. The type of directory used in each environment is irrelevant to the LIM Gateay. If the directory is supported by that environment, and the environment functions appropriately ith that directory, the LIM Gateay ill also function correctly hen orking ith the environment. For example, the LIM Gateay ill operate successfully ith any of these directory configurations (assuming that the directories used are supported in each environment): An LIMWC environment that operates ith a native Domino directory and an LWP environment that operates ith an LDAP directory. An LIMWC environment that operates ith an LDAP directory and an LWP environment that operates ith a different LDAP directory. (For example, one environment operates ith a Netscape LDAP directory hile the other environment operates ith an IBM LDAP directory.) An LIMWC environment and an LWP environment that operate ith the same LDAP directory. Note: In a typical enterprise deployment, the LIMWC environment and the LWP environment use the same LDAP directory. Using the same LDAP directory in both environments eliminates the directory issues discussed in the "Person entry and Internet address requirements" topic later in this section. If an environment uses multiple directories, and the environment functions appropriately ith the multiple directory configuration, the LIM Gateay ill also function correctly hen orking ith the environment. 12 IBM Lotus Instant Messaging Gateay

18 Person entry and Internet address requirements Although the type of directory used in an environment is irrelevant to the LIM Gateay, there are specific requirements regarding the person entries and Internet addresses that appear in the directories used in the LIMWC and LWP environments. A single user must have a person entry in both the directory used in the LIMWC environment and the directory used in the LWP environment. These duplicate directory entries are mandatory regardless of hether the user accesses the clients from only one environment or both environments. For example, the user John Smith must be entered in both the LIMWC and LWP directories to enable the LIM Gateay to represent him in both environments. If John Smith uses only LWP clients, he still must have a directory entry in the LIMWC directory to communicate ith the LIMWC users. Similarly, if John Smith uses only LIMWC clients, he must have a directory entry in the LWP directory to communicate ith the LWP users. The Internet address for each user must be identical in both directories. For example, if John Smith has an the Internet address of John_Smith@acme.com in the LIMWC directory, he must have this same Internet address specified in the LWP directory. If necessary, the administrator must manually edit the directory entries or use script files to ensure that each user has an identical Internet address in each directory. Adding users and groups to client buddy lists When the LIM Gateay is deployed, an LIMWC client can only access the directory used in the LIMWC environment and an LWP client can only access the directory used in the LWP environment. To enable an end user to add a user or group name to a client buddy list, the user or group name must exist in the directory used in the environment to hich the client belongs. For example, a Sametime Connect user can add John Smith to a buddy list only if John Smith has a person record in the directory accessed by the LIMWC servers. The Sametime Connect user cannot access the directory used in the LWP environment and add John Smith from the LWP directory. Similarly, John Smith must have a person entry in the LWP directory to enable an LWP portlet client user to add John Smith to a buddy list. Groups are handled in a similar manner. To enable a user to add a group from one environment to a client that operates in the other environment, the administrator must ensure that the group exists in the directory used in the other environment. IBM Lotus Instant Messaging Gateay 13

19 For example, if you have a Marketing group in the LIMWC directory, and you ant to allo LWP users to add this Marketing group to the buddy lists of the LWP clients, you must do the folloing: Manually create a Marketing group in the LWP directory. Populate the Marketing group in the LWP directory ith the same set of users as the Marketing group in the LIMWC directory. Each user in the Marketing group must have an individual person entry in the directories used in both environments. The person entries in each environment must also contain identical Internet addresses, as noted earlier. Note: Deploying the LIM Gateay does not affect the end user procedures required to add users or groups to a client buddy list. End users add a user or group name to a buddy list using the same procedures and user interface options that they ould use if the LIM Gateay ere not deployed. Also, an end user is not aare that the user or group they are adding is connected to a server in the other environment. Group aareness issue Administrators should be aare that a user can add a group to a buddy list, and receive aareness on a member of that group, even hen there is not an identical group listed in the directory of the other environment. To illustrate this issue, assume the folloing: John Smith has a person entry in both the LIMWC directory and the LWP directory John Smith is listed as a group member in the Engineering group in the LIMWC directory. There is no duplicate Engineering group in the LWP directory If a Sametime Connect client user adds the Engineering group to the Sametime Connect client, the Sametime Connect client user ill have aareness of John Smith from the Engineering group if John Smith is logged into the LWP server. The Sametime Connect client user has this aareness of John Smith even hen there is not a duplicate Engineering group in the LWP environment. This aareness is possible because John Smith has a person entry in both the LIMWC directory and LWP directory. 14 IBM Lotus Instant Messaging Gateay

20 Client functionality and the LIM Gateay This section discusses the client functionality supported by the LIM Gateay. Note: For information about the specific clients supported by the LIM Gateay, see the "Supported instant messaging and aareness environments" section earlier in this hite paper. Client functionality supported by the LIM Gateay Users ho communicate ith the other environment through the LIM Gateay can use instant messaging and presence client features to engage in the activities listed belo: One-to-one chat - A user in one environment can engage a single user from the other environment in a one-on-one chat session. Add an individual user or a public group to a buddy list - Users can add an individual user or a public group to buddy lists. (Public groups are groups that are defined in a directory accessed by either an LIMWC server or an LWP server.) As noted earlier, a user can only add another user or group to a buddy list if the user or group name appears in the directory used in that environment. Change presence status (I am active, I am aay, Do not disturb) - When a user changes his presence status on a client connected to a server in one environment, this change is also reflected in the buddy lists of clients connected to a server in the other environment. Alert me hen - A user in the LIMWC environment can use an "Alert me hen" client feature to receive alerts hen a user in the LWP environment comes online. Note: LWP clients do not have an "Alert me hen" feature. Auto aay - Users in both environments can use client features that change a user's status to aay after a specified period of keyboard and mouse inactivity on the user's local computer. When the user's status changes, the gateay detects the change and communicates the ne status to the other environment. Any client functionality not included in the list above is not supported by the LIM Gateay. For example, a user in one environment cannot start an instant hiteboard or application sharing meeting ith a user in the other environment. IBM Lotus Instant Messaging Gateay 15

21 LIM Gateay usage issues The administrator should be aare of these usage issues concerning the LIM Gateay: Avoiding unnecessary logins of LIMWC users to the LWP server Third-party SIP clients Buddy lists are not synchronized across environments LIMWC external communities are not supported AOL external communities are not supported Reverse proxies and firealls (includes TCP port usage) Client privacy issues End user issues Installation issue Avoiding unnecessary logins of LIMWC users to the LWP server As discussed in the "Ho the gateay orks ith LIMWC users" topic earlier in this hite paper, the LIM Gateay logs an LIMWC user into the LWP server only if the LIMWC user is subscribed on by an LWP user. This characteristic of the LIM Gateay can result in unnecessary logins of LIMWC users to the LWP server. If an LWP user subscribes on a public group that includes all members of the LIMWC server community, the LIM Gateay may log all members of the LIMWC server community into the LWP server. This scenario may result in an unnecessary drain on the system resources of the LWP server. Administrators should ork to avoid situations here LWP users subscribe on large public groups hen the users are only interested in chatting ith a fe members ithin the group. For example, if a user subscribes on a public group that contains 150 people, but is only interested in chatting ith 15 of these group members, this user can create up to 135 unnecessary logins to the LWP server. Administrators may ant to caution LWP users against adding large groups to the buddy lists or break larger groups into smaller groups as necessary to prevent this unnecessary drain on the system resources of the LWP server. Third-party SIP clients If users in your LWP environment use third-party SIP clients to access an LWP server, the third-party SIP client users may be unable to respond to chat messages initiated by users from the LIMWC environment. 16 IBM Lotus Instant Messaging Gateay

22 This problem can occur hen both of the folloing are true: No LWP users have subscribed on the LIMWC user ho initiates the chat session. The third-party SIP client is not designed to programmatically subscribe on a user ho initiates a chat session. When both of the conditions above are true, the LIMWC user initiating the chat session is not subscribed on by any LWP user, and therefore is not registered into the LWP environment by the LIM Gateay. The third-party SIP client user cannot communicate ith the LIMWC user through the LIM Gateay if the LIMWC user is not registered into the LWP environment. Note: The SIP clients developed by IBM Lotus for use ith the LWP server avoid this problem because these clients are designed to programmatically subscribe on users ho initiate chat sessions ith them. Buddy list changes are not synchronized across environments If a user operates clients in both the LIMWC environment and the LWP environment, the buddy list changes a user makes in one environment are not reflected in the other environment. Users must manage buddy lists independently in the to environments. Buddy lists are stored on the respective servers and are maintained independently in each environment. The LIM Gateay does not synchronize these lists beteen the environments. For example, if the user John Smith deletes a user name (or group name) from a buddy list in his Sametime Connect client, that user name is not also deleted from buddy lists in his LWP server clients. To delete the same user or group name from the LWP client, he must manually open the LWP client and delete the name from the buddy list in that client. LIMWC external SIP communities are not supported The LIMWC servers provide support for external SIP communities. This external SIP community support does not extend to the LWP environment through the LIM Gateay. The LIMWC external community support enables users in an LIMWC community to communicate ith users in a different LIMWC community using SIP. To support these external communities, an administrator installs an LIMWC feature called the "SIP Connector" in each LIMWC community. When SIP Connectors are used to connect to different LIMWC communities, users in one LIMWC community can use SIP to share presence and instant messaging capabilities ith users in another LIMWC community. You cannot install a SIP Connector in an LIMWC environment and then use this SIP Connector to communicate ith an LWP server environment. You must use the LIM Gateay to enable presence and instant messaging capabilities beteen an LIMWC environment and an LWP environment. IBM Lotus Instant Messaging Gateay 17

23 Also note that if you use a SIP Connector to connect your LIMWC environment to a separate LIMWC community (for example, LIMWC Community B), LWP users ho connect to your LIMWC environment through the LIM Gateay cannot share presence and instant messaging capabilities ith users in LIMWC Community B. AOL external communities are not supported The Sametime Connect 3.1 client provides support for external AOL user communities. This external AOL community support does not extend to the LWP environment through the LIM Gateay. A Sametime Connect 3.1 for the desktop client includes technology that enables a user to log in to an AOL instant messaging server and communicate ith AOL users through presence and instant messaging. The technology that enables this communication resides in the Sametime Connect client and not in the LIMWC server. The LIM Gateay does not interact ith the Sametime Connect client in any ay to support communications ith AOL users. An LWP user cannot communicate through the LIM Gateay ith an AOL user ho can communicate ith a Sametime Connect client user. Note: Support for external AOL user aareness as discontinued after the Sametime 3.1 release. This functionality is not available ith LIMWC and later releases. Reverse proxies and firealls The LIM Gateay must establish connections ith both LWP servers and LIMWC servers. You cannot use a reverse proxy server ith the LIM Gateay. The LIM Gateay cannot connect to an LWP server or an LIMWC server through a reverse proxy server. The ports used for connections beteen the LIM Gateay and the LWP and LIMWC environments are discussed belo. These ports must be open on all netorks beteen the LIM Gateay and the respective environment. Note: The ports listed belo are default ports and can be changed by the administrator. For more information, see the "Configuration" section later in this hite paper. 18 IBM Lotus Instant Messaging Gateay

24 Ports used for LWP connections If a fireall exists beteen the LIM Gateay and the LWP servers, the folloing ports must be open through the fireall to enable the LIM Gateay to communicate ith the LWP servers: Port 5061 (using TLS) - The LIM Gateay communicates ith the SLSP component of an LWP server on this port by default. Port 1516 (using TCP) - The LIM Gateay communicates ith the Presence server component of an LWP server on this port by default. Any available port on the LIM Gateay computer (using TLS) - A port must be available to transmit instant messages beteen the LIM Gateay and the LWP environment. When an LWP user sends an instant message to an LIMWC user, the instant message must be transmitted on a connection from the LWP server to the LIM Gateay. The administrator selects the port used for this connection hen configuring the LIM Gateay. The administrator can select a specific port for this purpose or configure the LIM Gateay to dynamically select any available port on the LIM Gateay computer. Ports used for LIMWC connections If a fireall exists beteen the LIM Gateay and the LIMWC servers, TCP port 1516 must be open through the fireall to enable the LIM Gateay to communicate ith the LIMWC servers. All communications beteen the LIM Gateay and the LIMWC environment occur using port Client privacy issue LIMWC supports the "Who can see me" feature (or privacy feature) hile LWP does not. LIMWC users cannot use this feature to prevent specific LWP users from detecting their online status. In some cases, an LWP user may be able to detect the presence status of an LIMWC user, hile the LIMWC user cannot detect the presence of the LWP user (this scenario is called "lurking"). This scenario may occur if an LIMWC user restricts the "Who Can See If I Am Online" list to specific users. End user issues If an end user attempts an action in respect to a user from the other environment, and that action is not supported by the LIM Gateay, the user receives no error message or notification that the action is not supported. For example, if a Sametime Connect client user right-clicks on an LWP user's name in the Sametime Connect buddy list, and selects the "Collaborate" option to start an instant IBM Lotus Instant Messaging Gateay 19

25 meeting ith the LWP user, the Sametime Connect user receives no notification that instant meetings are not supported for that user. The LWP user ill not join the instant meeting. Installation issue As part of the LIM Gateay installation, you must manually replace a file on all LWP servers in the LWP environment. Specifically, you must replace the presenceimservices.jar file located in the <root>\websphere\workplaceserver\ps_extdir directory on the LWP servers ith the presenceimservices.jar file that is provided ith the LIM Gateay package. This step is discussed in the "Configuring the LWP server to operate ith the LIM Gateay" topic in the "Configuration" section later in this hite paper. 20 IBM Lotus Instant Messaging Gateay

26 Deployment This section discusses the LIM Gateay deployment issues associated ith the LWP and LIMWC server environments. LWP environment When deploying the LIM Gateay to operate ith the LWP environment, note the folloing: The Presence server component on each LWP server must connect to one (and only one) LIM Gateay. You cannot connect one LWP server to multiple LIM Gateays. Multiple LWP servers can connect to a single LIM Gateay. Taking both of these rules into consideration, and assuming that you have an environment consisting of three LWP servers, you could deploy one, to, or three LIM Gateays to support the three LWP servers. Performance is best if you deploy one LIM Gateay for each LWP server. Configuring connectivity beteen the LIM Gateay and the LWP servers is an important part of the LIM Gateay configuration. The three examples belo illustrate ho to configure the connectivity beteen the LIM Gateay and the LWP environment. This configuration is slightly different depending on the number of LIM Gateays that you deploy. Note: For more information about LIM Gateay connectivity, see the "LIM Gateay connections to servers in the LWP and LIMWC environments" section earlier in this hite paper. One LIM Gateay is deployed If you deploy one LIM Gateay into an environment that includes a single LWP server, the LIM Gateay must establish to connections to the LWP server: one connection to the SLSP component of the LWP server and one connection to the Presence server component of the LWP server. If you deploy one LIM Gateay into an environment that includes multiple LWP servers you can configure the connections in the folloing ay: LIM Gateay 1 connects to the SLSP component on LWP server 1. LIM Gateay 1 connects to the Presence server components on all LWP servers in the environment, including the Presence server component of LWP server 1. IBM Lotus Instant Messaging Gateay 21

27 To LIM Gateays deployed to support three LWP servers If you deploy to LIM Gateays to support three LWP servers you can configure the connections in the folloing ay: LIM Gateay 1 can connect to both the SLSP component and the Presence server component on LWP server 1. LIM Gateay 2 can connect to the SLSP component on LWP server 2. LIM Gateay 2 can connect to the Presence server components on both LWP server 2 and LWP server 3. Three LIM Gateays are deployed to support three LWP servers If you deploy three LIM Gateays to support three LWP servers you can configure each LIM Gateay to establish its connections ith a different LWP server. Configuring the connections in the folloing ay provides the most efficient performance: LIM Gateay 1 can connect to both the SLSP component and the Presence server component on LWP server 1. LIM Gateay 2 can connect to both the SLSP component and the Presence server component on LWP server 2. LIM Gateay 3 can connect to both the SLSP component and the Presence server component on LWP server 3. The "Configuration" section later in this hite paper discusses the settings that control this connectivity. LIMWC environment The issues associated ith deploying the LIM Gateay to operate ith the LIMWC servers are summarized belo: If only one LIM Gateay is deployed, but there are multiple LIMWC servers configured to operate together as an LIMWC community, the LIM Gateay must connect to only one of the LIMWC servers. If multiple LIM Gateays are deployed, each LIM Gateay can connect to the same LIMWC server in the LIMWC community, or each LIM Gateay can connect to a different LIMWC server. Note that there are no performance advantages gained by connecting each LIM Gateay to a different LIMWC server. An LIM Gateay functions the same hen connected to one or multiple LIMWC servers. The "Configuration" section later in this hite paper discusses the settings that control this connectivity. Note: When multiple LIMWC servers operate together as a community, all LIMWC community events are handled on a single events channel. This single events channel is available on all LIMWC servers in the community through intraserver connections 22 IBM Lotus Instant Messaging Gateay

28 beteen the LIMWC servers. This design enables the LIM Gateay to connect to a single LIMWC server in the community and communicate ith all LIMWC servers in the community. IBM Lotus Instant Messaging Gateay 23

29 Installation This section includes the folloing topics concerning the LIM Gateay installation: Where to install the LIM Gateay Communication ith servers on other platforms System requirements for the LIM Gateay Step-by-step installation procedures Where to install the LIM Gateay You have several options for installing the LIM Gateay. The installation options and restrictions are listed belo: You can install the LIM Gateay on the same computer as an LWP server, an LIMWC server, or an IBM Lotus Portal server. You can install the LIM Gateay on a dedicated computer. The computer on hich the LIM Gateay is installed must run either the AIX or Windos operating system. Communication ith servers on other platforms After you have installed the LIM Gateay on an AIX or Windos operating system, the LIM Gateay can communicate ith servers running on these platforms: Sametime 3.1 (or higher) servers running on Windos, AIX, Solaris, or OS/400 LWP (or higher) servers running on Windos, AIX, or Linux. For example, an LIM Gateay running on a Windos computer can communicate ith an iseries (OS/400) Sametime 3.1 server and a Linux LWP server. Note: The platforms listed above include all supported platforms for the LIMWC (Sametime) server and LWP server at the publication date of this hite paper. If either of these servers is built on an additional platform in the future, check ith an IBM representative to determine if the LIM Gateay operates ith the additional platform. 24 IBM Lotus Instant Messaging Gateay

30 System Requirements for the LIM Gateay If you install the LIM Gateay on a dedicated computer, the computer should meet the basic system requirements listed belo. Note: If you are installing the LIM Gateay on the same computer as an LWP server, an LIMWC (Sametime) server, or an IBM Lotus Portal server, the computer should exceed these requirements to the extent necessary to accommodate both the functionality of the LIM Gateay and the functionality of the other server application. Windos system requirements Hardare: CPU: Pentium II 400 MHz Memory: 512MB (minimum), 1 GB (recommended) Operating System: Windos 2000 Advanced Server Windos 2003 Note: The LIM Gateay also requires the IBM JVM This JVM is installed by the LIM Gateay installation. AIX system requirements Hardare: Server: An IBM pseries server based on PoerPC (RISC) technology Memory: 512MB (minimum), 1 GB (recommended) Operating System: IBM AIX 5.1 ith patch level 4 ( ) IBM AIX 5.2 ith patch level 2 ( ) Note: The LIM Gateay also requires the IBM JVM This JVM is installed by the LIM Gateay installation. IBM Lotus Instant Messaging Gateay 25

31 Installation procedures The procedures for installing the LIM Gateay on both the AIX and Windos operating systems are provided belo: Installing the LIM Gateay on Windos You can use these instructions regardless of hether you are installing the LIM Gateay on a dedicated Windos computer or on the same Windos computer as another server. This installation procedure requires you to configure settings in the IMAProxy.properties file that is installed ith the LIM Gateay files, and also make configuration changes to the LIMWC and LWP servers themselves. To understand all configurations required to complete this installation, you should revie both the installation instructions belo and the "Configuration" section of this hite paper before beginning the LIM Gateay installation. To install the LIM Gateay on a Windos operating system: 1. Verify that the computer that ill host the LIM Gateay meets the Windos system requirements specified earlier in this section. 2. Log in to the Windos operating system as a user ith Administrator rights. 3. Donload the Windos version of the LIM Gateay package (or C59L8ML.zip package) from the Donloads page of the IBM Lotus Developer Domain Web site (.lotus.com/ldd/don.nsf). 4. Extract the contents of the C59L8ML.zip package to the root (C:\) of the Windos computer. Extracting the contents of this package to the root (C:\) automatically creates a C:\IMGateay directory on the Windos computer. The LIM Gateay files are placed in the C:\IMGateay directory. 5. Run the install.bat file provided in the C:\IMGateay directory to install the LIM Gateay as a Windos service. For example, enter this command from the server command prompt: C:\IMGateay>install.bat 6. Use the Services options in the Windos Control Panel (or Windos Administrative Tools) to install the IMGateayLaunch.exe file as a Windos service. Note: The IMGateayLaunch.exe file is located in the C:\IMGateay directory. 7. Use a text editor to open the IMAProxy.properties file located in the C:\IMGateay\config directory and configure the settings in the IMAProxy.properties file so that they are appropriate for your environment. For assistance ith configuring the IMAProxy.properties file, see the topic "Configuring the LIM Gateay" in the "Configuration" section later in this hite paper. 26 IBM Lotus Instant Messaging Gateay