Welcome to episode #38 of the IBM i Update, your monthly digest into what’s happening within the IBM i community.
In this episode, we’re still in Lyon, but for this second part, we look at a couple of the technical announcements, including Mapepire [pronounced MAH-pup-ee], the second technology refresh for 7.6 and the announcement of a new Power11.
Mapepire – The new way to access DB2 for the IBM i?
So, while at COMMON Europe, I joined a session on Mapepire, the new way to access DB2, which dramatically improves upon conventional technologies.
This technology presentation was completed by IBM’s very own inimitable Jesse Gorzinski, MBA.
So, what is Mapepire? Well, this technology is a cloud-friendly, database access layer technology that runs on IBM i and communicates with clients through secure WebSockets and is built with simplicity and performance in mind. It consists of a server component on IBM i and a set of SDKs for languages including Java, Python and TypeScript with more languages planned in the future.
And why the name Mapepire [pronounced MAH-pup-ee]? Well, Jessie explained that we have programming languages such as Cobra, Viper and (of course, the ever popular) Python, so when Jesse was thinking about creating a venom fast database connector, the South American pit snake seemed apt.
Now, traditionally, JDBC and ODBC connections can involve several different services and network flows before the first database operation takes place. Mapepire simplifies this by using a single port and a single server entry point. Jesse explained that it’s four main design principles involved:
- Portability – It can be used from environments where traditional IBM i drivers may be difficult or impossible to deploy
- Encryption – Connections are encrypted, with TLS providing both encryption and server authentication. Mapepire is intended to simplify certificate configuration considerably compared with traditional database connectivity.
- Performance – The performance demonstrations in the presentation show Mapepire completing queries more quickly and consistently than the Node.js ODBC driver in the examples tested. Connection pooling can further reduce overhead by reusing database jobs.
- Consistency – The SDKs are intended to behave similarly across languages, using consistent class names, methods, configuration options, parameters and error handling too.
This sounds like a utopian data connection layer!
Mapepire runs locally on IBM i, which can help reduce uncontrolled JDBC and ODBC connection sprawl.
Existing IBM i security controls still apply, including:
- Object authority
- Database server exit points
- User-profile controls
- Workload and subsystem management
A new configuration file also allows administrators to permit or deny connections based on user profiles and IP addresses.
Or in other words, it’s secure by design.
Ok, but JDBC and ODBC already do most of the work, right?
Well, when you compare Mapepire with traditional JDBC and ODBC connectivity, the biggest difference is simplicity.
Mapepire uses a single port and encrypts data by default, which immediately reduces some of the complexity normally associated with securing database connections. It still works with familiar IBM i controls, including system exit points, so organisations are not losing the security and governance mechanisms they already rely on.
It also offers enhanced CCSID support and is designed to work in more modern environments. Another important advantage is direct support for multiple client languages, making it easier for developers to access Db2 for i from a wider range of applications and platforms.
So the real appeal of Mapepire is that it keeps the IBM i controls customers already understand, while making secure, portable Db2 access much simpler for modern development.
And, while we’re still officially in a technology preview, plans are afoot for further enhancements. The near-term plans include Kerberos support, improved handling of large objects, a PHP client, a full JDBC client and more complete API documentation.
Beyond that, there are longer-term possibilities such as C# support, an improved Go client and data compression.
As always with roadmap items, these plans are forward-looking and may change, but they do show the direction of travel.
But, now confirmed – within OS7.6 TR2, Mapepire will be delivered as part of the IBM i operating system itself, which will be a significant step towards standardising it as a key component within the platform.
I’m excited, and IBM clearly sees Mapepire as a broader, more secure and portable access layer for Db2 for i across a growing range of languages and development environments.
Clearly, this is a technology to watch!
Technology refresh 2 for IBM i 7.6
Mid July saw the release of OS 7.6 TR2, and this version enjoys some useful additions…
This release is a broad update focused on security, resilience, modern development, system administration and support for the latest Power hardware. There is no single headline feature dominating the release.
Instead, IBM has delivered a substantial collection of practical enhancements aimed at making IBM i easier to secure, manage, develop on and modernise.
One of the strongest themes is external key management.
IBM i Cryptographic Services can now integrate natively with IBM Key Protect for IBM Cloud, allowing organisations to export, store, wrap and use encryption keys through an external key management service.
IBM has also strengthened protection for IBM i master keys.
The Save/Restore key can now be removed from the partition load source, meaning encrypted master keys remain unavailable until the appropriate key is supplied during or after the IPL.
When combined with system ASP encryption, this can prevent the partition from completing an IPL without the required key. Keys can be retrieved from a Platform Keystore or supplied manually through a Remote Key Agent.
*RPG continues to gain useful new capabilities for building more robust and maintainable applications.
ASSERT-F and ASSERT-T allow developers to validate conditions and take an appropriate action, such as raising an exception, recording a warning or calling a test procedure.
Generic message IDs simplify ON-EXCP handling by allowing related groups of messages to be monitored together. LIKE(EXT) can now define an individual field directly from an externally described file, reducing duplicate definitions.
And the new %LOOKUPNE and %TLOOKUPNE functions make it easier to find the first array or table entry that does not match a specified value.
Navigator for i receives another sizeable update. It can now use Java 21 where available and includes improvements across performance monitoring, networking, security, work management and file system administration.
Notable additions include a multi-system CVE overview, support for performance notebooks, new Performance Data Investigator charts, improved TLS configuration tools and the ability to configure SMTP OAuth authentication.
The open source Code for IBM i ecosystem continues to move quickly.
The main extension now includes MFA support for IBM i 7.6, password expiry checking, password changes, SSH key passphrase authentication and a new Environment view for managing actions, profiles and variables.
And, as highlighted in the previous article, TR2 has also moved to Mapepire as its SQL runner, with IBM reporting improved performance.
A number of security improvements have been introduced, including component signature checking, safer temporary directories and checks on home directory permissions.
Other extension updates improve RPG and CL language support, SQL development, automated testing and debugging.
A new IBM i FileSystem extension provides more detailed access to QSYS objects, authorities, locks, usage information and object-specific actions directly from VS Code.
Db2 for i receives several functional and security enhancements, including a new SQL error log, trigger pseudo columns, URL encoding and functions for converting values to and from system timestamps.
IBM has also expanded its range of SQL based IBM i Services. Particularly useful additions include services for:
- Identifying relevant CVEs
- Checking local Group PTF currency
- Examining audit journal entries
- Reading data journal information
- Viewing geographic mirroring status
- Managing Service Tools Server configuration
- Checking CL command syntax
- Reporting on external key management
- Examining job names, users and numbers
The growing number of IBM i Services continues IBM’s strategy of making operating system information and administration functions accessible through SQL.
Power11 S1112 entry-level server release
Also in July, we saw the OFFICIAL announcement of the S1112 Server.
This is IBM’s new entry-level, one-socket Power11 server, designed for smaller environments, and is available in both rack-mounted and deskside configurations.
The biggest point for IBM i customers is that the S1112 sits within the P05 software tier. IBM i partitions can use up to four cores and 64 GB of memory, which makes it quite the flexible powerhouse for the SME’s.
This could genuinely be a game changer – Enterprise-grade technology no longer needs an enterprise-sized footprint… or cost.
And that’s it for your two-part, IBM i Update report from COMMON Europe.
I’m Andrew Nicholson, and we’re Proximity, your application support, maintenance and development partners that are in your corner.
If you missed it, you can check out Part 1 of July’s upate here, or access all the IBM i Updates in one place.
Alternatively, if you’d like to receive the latest IBM i Update hot off the press to your inbox, subscribe to the IBM i Update on LinkedIn.
