On the 8th of April 2025 IBM announced the new version of IBM i, called IBM i 7.6. This is the successor to IBM i 7.5, which has been available since May 2022. The new release will be available for download on April 18th and is compatible with Power10 servers and beyond.
The main theme in IBM i 7.6 is security, with IBM adding integrated multi-factor authentication to the operating system. The database receives support for FINAL TABLE with UPDATE and DELETE SQL statements, new and enhanced IBM i Services are added and Access Client Solutions is updated. For a full description of all the changes, please read the announcement letter. For other announcement material, see Steve Will’s blog entry. You can also read all documentation for the new release on IBM i 7.6 documentation site or scan the IBM i Technology Updates landing page.
As seen in the pages mentioned above, IBM i 7.5 has been enhanced with Technology Refresh 6 (TR6). This post will focus on IBM i 7.6 solely, because all new and enhanced features in IBM i 7.5 TR6 are also in the base IBM i 7.6.
Integrated multi-factor authentication #
Multi-factor authentication (MFA) has been available as a security feature in the IT market for decades and has in recent years seen widespread adoption for all kinds of services, e.g. email services. The additional factor to verify the user is often in the form of a time-based one-time password (TOTP) delivered by an authenticator app or device. IBM has been hard at work to implement TOTP in the operating system, since all the many external interfaces needed to be updated to allow the TOTP to be specified and validated. MFA has been available as add-on products for IBM i from different ISV’s, but is now integrated in the operating system.
MFA is a great enhancement to the security on IBM i, and you can use it with native IBM i userprofiles and/or with SST/DST (system/dedicated service tools) userprofiles. It can be activated on individual or a group of userprofiles, and I will strongly advice to activate MFA on sensitive high-level authority profiles like QSECOFR and similar administrative profiles as a minimum.
You can read about this new feature in the IBM i 7.6 documentation, but if you want to see a live demo of how it works, Tim Rowe and Scott Forstie have created a new, entertaining video titled “iSee – Integrated Multi-factor Authentication” in their famous iSee video blog (free, but requires registration). As seen in the video, you can use SQL, Navigator for i and CL to configure and activate the MFA feature. New SQL functions for MFA are the CHANGE_TOTP_KEY table function and CHECK_TOTP scalar function.
Database enhancements #
The main database enhancement in IBM i 7.6 (requiring structural changes and thus a new release) is the support for FINAL TABLE on UPDATE and DELETE SQL statements. This allow the programmer to retrieve the rows as they were before and after the operation. This feature has been available for the INSERT SQL statement for some years now, but is now also available for UPDATE and DELETE, bringing Db2 for IBM i on par with the other members in the Db2 database family.
A side effect of implementing FINAL TABLE support is that IBM i now allows parallel execution of the UPDATE and DELETE operation, thus improving the performance of these statements. This can be a huge time-saver for IBM i installations updating or deleting a large number of rows.
Other interesting new IBM i Services include
- QSYS2.VERIFY_NAME scalar function to verify a system object or SQL name
- SYSTOOLS.IFS_PATH scalar function to extract parts of a path string
- SYSTOOLS.DELETE_OLD_JOURNAL_RECEIVERS stored procedure for easier cleanup of journal receivers
- additional audit journal helper functions for the PO and SF audit journal entry types
I highly recommend looking into the audit journal entry services and start building an audit entry data mart for quick and easy retrieval of password and authority failures and other security events.
System management enhancements #
The IBM Navigator for i management tool has received a number of enhancements, with addition of MFA and TLS configuration, web administration, Digital Certificate Manager (DCM) enhancements and more.
As a member of the core team behind Code for IBM i and seeing all the issues with the Debug Service, I applaud IBM for integrating management of the Debug Service into IBM Navigator for i. I really hope this will make it easier to manage the debug service and the required certificates for the service, instead of the current situation where the certificates and start/stop of the service is handled by scripts in Code for IBM i.
New version of Access Client Solutions #
Access Client Solutions (ACS) is upgraded to version 1.1.9.8 (IBM is very, very modest in their version numbering, ACS has been in the 1.1.9.n range for years now! 😂) with my favorite enhancement being the formatting of numeric values in the results from Run SQL Scripts. In prior versions it could be difficult to interpret numbers with many digits, but now you can have ACS format the numbers with grouping separators, greatly enhancing the readability of the output.
This is how numbers is presented in ACS 1.1.9.7 and before:
and this is the same result in ACS 1.1.9.8 (if you enable number formatting):
ACS 1.1.9.8 supports MFA (of course) when connecting to an IBM i 7.6, the connection can be kept alive, the data transfer feature can update an existing Excel workbook without changing the existing data or formatting in the workbook, and the SQL Performance Center now has additional filtering. All ACS changes are shown in the IBM i 7.6 - Base Enhancements page.
The new ACS version is already available for download!
Withdrawals #
IBM has withdrawn some features and products for IBM i in the new 7.6 release, including
- Java 11 (Java 8 and Java 17 are still there, and Java 21 has been added)
- several language feature codes, including the Nordic languages Danish (2926), Finnish (2925), Norwegian (2933) and Swedish (2937)
- older communication protocols
- IBM Rational Application Management Toolset for i (5770-AMT)
- IBM i Access for Web (5770-XH2)
- IBM Facsimile Support for i (5798-FAX) (alternative solutions are mentioned in the announcement letter)
Developers should also be aware that developer tools like SDA and RLU is no longer available from IBM i 7.6 - but these tools have not been updated in years and all IBM i developers should have found alternatives by now. And we still have PDM and SEU…!
Final thoughts #
This post only mentions some of the many changes in the IBM i 7.6 release, and I encourage you to look in the documentation available for a complete list of the changes, verifying that your current IBM i release can be upgraded without any issues (like using products that have been withdrawn). Follow the links in the top of this post, if you don’t know where to start.
I think it’s great to see IBM raise the security level possible in IBM i with the multi-factor authentication integration. This will make IBM i even more secure (or rather securable - IBM i is not secure by default and need more configuration steps to be considered secure!). Developers will find the new FINAL TABLE support useful, and all IBM i administrators, developers and regular users will benefit from ACS 1.1.9.8.
I’m excited to download the new release on April 18th and start testing the new features, including MFA and the new IBM i Services. I’ve already downloaded the new ACS version and enjoy the formatted numbers in the SQL results.
Congratulations to IBM and the developers for a new, exciting release of IBM i!
Reply by Email