Micro Focus Frequent Contributor
Micro Focus Frequent Contributor
943 views

How uninstall EBA in eDirectory 9.1

Hi,

My customer have a eDirectory 9.1 server (called oldServer-002) with master partitions and EBA enabled.

They need change master partitions to new eDirectory server 9.1 without EBA. (called 002-newServer)

Exists any procedure for uninstall or deconfigure EBA in eDirectory 9.1 in old server (oldServer-002) for this task ?

Information
------------

# ndsconfig --version
Configuration utility for NetIQ eDirectory 9.1 v40101.39

# ndsrepair -P -Ad -A

[1] Instance at /etc/opt/novell/eDirectory/conf/nds.conf: oldServer-002.OU=Services.O=data.CUSTOMER-TREE
Repair utility for NetIQ eDirectory 9.0 - 9.1 v40101.31
DS Version 40101.29 Tree name: CUSTOMER-TREE
Server name: .oldServer-002.Services.data

Size of /var/opt/novell/eDirectory/log/ndsrepair.log = 419839 bytes.

This list shows information for each replica stored on this server. Select a replica to display an options menu.
Finding all replicas on this server
Please Wait...
Total number of replicas = 2

PARTITION NAME REPLICA TYPE REPLICA STATE
(1).DriverSet-02.Services.data Master On
(2).[Root]. Master On



# ndscheck

[1] Instance at /etc/opt/novell/eDirectory/conf/nds.conf: oldServer-002.OU=Services.O=data.CUSTOMER-TREE

Enter the admin name with context: admin.administrators.data
Enter the password for admin.administrators.data:
Thu Aug 2 17:08:27 2018
Performing health check on the eDirectory server ".CN=oldServer-002.OU=Services.O=data.T=CUSTOMER-TREE." ...
-------------------------------------------------------------------------------------------------------------------------
Checking eDirectory LDAP and HTTP services...
Checking health of partitions ...

Status of partition ".CN=DriverSet-02.OU=Services.O=data.T=CUSTOMER-TREE." ...
Checking the status of the replica ring...
Number of replicas = 3
+---------------------------------+-------+-------------------------+---------------+------------------+
Server Name Status Time Sync Time Delta Replica State
+---------------------------------+-------+-------------------------+---------------+------------------+

.CN=oldServer-002.OU=Servic... UP YES 0 m:0 s ON
.CN=002-newServer.OU=Services UP YES 0 m:0 s ON
.CN=server3.OU=Services.O=data UP YES 0 m:0 s ON
+---------------------------------+-------+-------------------------+---------------+------------------+

Checking replication delta on the partition...
Maximum replica ring delta "0:0:3 (hh:mm:ss)"
Perishable delta on this server: "0:0:0 (hh:mm:ss)"

Status of partition ".T=CUSTOMER-TREE." ...
Checking the status of the replica ring...
Number of replicas = 3
+---------------------------------+-------+-------------------------+---------------+------------------+
Server Name Status Time Sync Time Delta Replica State
+---------------------------------+-------+-------------------------+---------------+------------------+

.CN=oldServer-002.OU=Servic... UP YES 0 m:0 s ON
.CN=002-newServer.OU=Services. UP YES 0 m:0 s ON
.CN=server3.OU=Services.O=data UP YES 0 m:0 s ON
+---------------------------------+-------+-------------------------+---------------+------------------+

Checking replication delta on the partition...
Maximum replica ring delta "0:8:51 (hh:mm:ss)"
Perishable delta on this server: "0:8:24 (hh:mm:ss)"

EBAHealthCheck:
Server is EBA enabled
EBA mechanisms:
* EBATLS

INFO: EBACA = true
INFO: NCPCA validity start = Mon Dec 5 17:02:31 2016
INFO: NCPCA validity end = Thu Dec 3 17:02:31 2026
INFO: CRL validity start = Thu Aug 2 13:05:53 2018
INFO: CRL validity end = Thu Aug 9 13:05:53 2018
INFO: EBACA certificate validity start = Mon Dec 5 17:02:31 2016
INFO: EBACA certificate validity end = Thu Dec 3 17:02:31 2026

eDirectory health check completed.

TIA
Labels (1)
0 Likes
7 Replies
Knowledge Partner
Knowledge Partner

Re: How uninstall EBA in eDirectory 9.1

You can disable it via an environment variable, but it is only supported
to do so for troubleshooting, and doing so and then changing the Master of
a partition is probably a sure way to do terrible things when EBA is
re-enabled.

Out of curiosity why would you want to go back?


--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.
0 Likes
Knowledge Partner
Knowledge Partner

Re: How uninstall EBA in eDirectory 9.1

ab;2485101 wrote:
You can disable it via an environment variable, but it is only supported
to do so for troubleshooting, and doing so and then changing the Master of
a partition is probably a sure way to do terrible things when EBA is
re-enabled.

Out of curiosity why would you want to go back?


--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.


I've been tangling with this lately, and I'm not convinced that the documentation on this is correct. Looking specifically at TID 7017232 on this.


Once EBA is turned on it cannot be turned off. However, it can be temporarily disabled for troubleshooting purposes or to fix an issue. Once disabled, server to server communications falls back to the older background authentication protocol. Once the issue is resolved EBA should be re-enabled as soon as possible.

DISABLE_EBA is a new environment variable that will temporarily disable EBA functionality on an eDirectory 9.0 server as well as on NCP client applications.


I haven't yet found a way to determine if server to server communication is using EBA. I guess it must do so, or at least try to do so, but this fallback mechanism to the traditional methods is in there so if EBA isn't working, the servers can still talk to each other.



Linux:

Export this environment variable and restart NDSD.
Example: DISABLE_EBA=true /etc/init.d/ndsd restart

NOTE: if running on a systemd OS, such as SLES 12 or RHEL 7.4 first export the variable then use ndsmanage to start the eDirectory instance(s) as shown below:
export DISABLE_EBA=true
ndsmanage startall


I've done this, and haven't seen it have any affect so far. I've also added it to the pre_ndsd_start script, and that didn't seem to do anything either. It may be that I'm testing it incorrectly though. My test is to use "ndslogin admin.system". This is on a server that seems to have EBA enabled, but it is broken. So ndslogin fails with a -641 error. With or without DISABLE_EBA being set for ndsd, ndslogin still fails.

But, if I have it set for the client (ndslogin), that does work.

It's possible that EBA on this server is broken, so it is internally falling back to traditional background authentication for its own communication with the other servers in the tree.



Additional Information
This environment variable can also be set before running 'ndslogin' to prevent 'ndslogin' from using any EBA functionality.

The parameter, n4u.server.eba_enabled, in the nds.conf file is what ndsconfig uses to determine if EBA is enabled on the server. This setting does not actually configure EBA on the server but utilities will check this setting to see if it has. If this is enabled the following conditions apply:
- The admin is no longer prompted on whether to enable EBA.
- Ndsconfig will no longer accept the "--configure-eba-now=no" argument.
- eDirectory utilities will prevent partition operations that could potentially break EBA. (An example would be iManager refusing to allow a replica of root to be removed from the current EBACA server.)


I found this part interesting. It would seem that changing (or removing) n4u.server.eba_enabled would have the same effect as setting DISABLE_EBA. If I read this correctly, ndsd doesn't use this setting, so whether its true or false or missing doesn't matter, ndsd will carry on doing what it was configured to do. This setting is for client utilities, like ndslogin, to check to see if they should attempt to use EBA or not.

That would imply that the EBA configuration bits are actually stored elsewhere, possibly on the pseudo server object or some other equally difficult to change location.

I've yet to find any other good information on debugging EBA, or fixing it when it goes wrong.
0 Likes
Knowledge Partner
Knowledge Partner

Re: How uninstall EBA in eDirectory 9.1

> Code:
> --------------------
>
> Once EBA is turned on it cannot be turned off. However, it can be temporarily disabled for troubleshooting purposes or to fix an issue. Once disabled, server to server communications falls back to the older background authentication protocol. Once the issue is resolved EBA should be re-enabled as soon as possible.
>
> DISABLE_EBA is a new environment variable that will temporarily disable EBA functionality on an eDirectory 9.0 server as well as on NCP client applications.
>
> --------------------
>
>
> I haven't yet found a way to determine if server to server communication
> is using EBA. I guess it must do so, or at least try to do so, but this
> fallback mechanism to the traditional methods is in there so if EBA
> isn't working, the servers can still talk to each other.

There is a EBCA flag in ndstrace now, perhaps enable that and see what
it says? Post some snippets, since I have never seen it in action before.
0 Likes
Knowledge Partner
Knowledge Partner

Re: How uninstall EBA in eDirectory 9.1

geoffc;2485125 wrote:
> Code:
> --------------------
>
> Once EBA is turned on it cannot be turned off. However, it can be temporarily disabled for troubleshooting purposes or to fix an issue. Once disabled, server to server communications falls back to the older background authentication protocol. Once the issue is resolved EBA should be re-enabled as soon as possible.
>
> DISABLE_EBA is a new environment variable that will temporarily disable EBA functionality on an eDirectory 9.0 server as well as on NCP client applications.
>
> --------------------
>
>
> I haven't yet found a way to determine if server to server communication
> is using EBA. I guess it must do so, or at least try to do so, but this
> fallback mechanism to the traditional methods is in there so if EBA
> isn't working, the servers can still talk to each other.

There is a EBCA flag in ndstrace now, perhaps enable that and see what
it says? Post some snippets, since I have never seen it in action before.


I've seen it in action. I've yet to see it working.


1364961024 EBA : [2018/08/03 10:56:04.698] GSSAPI context not found on dclient context
1364961024 EBA : [2018/08/03 10:56:04.699] Client: EBA BA attempt returned -700
1364961024 EBA : [2018/08/03 10:56:04.699] Failing over to old BA as remote server does not support UAP
1364961024 EBA : [2018/08/03 10:56:04.705] GSSAPI context not found on dclient context
1364961024 EBA : [2018/08/03 10:56:04.705] Client: EBA BA attempt returned -700
1364961024 EBA : [2018/08/03 10:56:04.705] Failing over to old BA as remote server does not support UAP


So that's fun. What's a "-700" error, and what does it indicate?
What's "UAP"? "Upgraded Authentication Protocol"? "Use After Passover"? "Unilateral Alpine Pork"?



1341564672 EBA : [2018/08/03 10:56:56.234] Server: EBA BA attempt failed: -641

1555781376 EBA : [2018/08/03 10:56:56.361] verify_callback() called at depth 1
1555781376 EBA : [2018/08/03 10:56:56.361] Verifying certificate for /UID=1CFAB6
92-CE8B-674F-5192-1CFAB692CE8B
1555781376 EBA : [2018/08/03 10:56:56.361] TLS handshake failed: unable to get local issuer certificate
1555781376 EBA : [2018/08/03 10:56:56.361] GSSAPI authentication (client) failed - 851968(20)
1555781376 EBA : [2018/08/03 10:56:56.361] GSSAPI context not found on dclient context
1555781376 EBA : [2018/08/03 10:56:56.361] Client: EBA BA attempt returned -669
1555781376 EBA : [2018/08/03 10:56:56.361] UAPAuthenticateConnection for [ffffffff] <>, failed, failed authentication (-669)
1551570688 EBA : [2018/08/03 10:56:58.045] ASN.1 parsing failed
1551570688 EBA : [2018/08/03 10:56:58.045] Server: EBA BA attempt failed: -641

1364961024 EBA : [2018/08/03 10:57:04.715] GSSAPI context not found on dclient context
1364961024 EBA : [2018/08/03 10:57:04.715] Client: EBA BA attempt returned -641
1364961024 EBA : [2018/08/03 10:57:04.715] Failing over to old BA as remote server does not support UAP


There's my old friend, "-641" (invalid request). What's it mean in this context?

Looks like -669 has been overloaded again. Means "password fail", but clearly there's not a password failure here.

"BA" seems to mean Background Authentication. And here we see it "failing over to old BA", which is good, I guess. But the message here is somewhat less than helpful, because this is Server2 (the broken one). The remote server, Server1, does in fact support whatever UAP is and EBA over there is working:


1966335744 EBA : [2018/08/03 11:01:52.006] Checking EBATreeConfiguration for changes
1966335744 EBA : [2018/08/03 11:01:52.007] Tree configuration has changed. Refreshing server credentials
1966335744 EBA : [2018/08/03 11:01:52.016] Client: Requesting SSL BA material from server
1966335744 EBA : [2018/08/03 11:01:52.016] Server: Processing request for SSL BA material
1966335744 EBA : [2018/08/03 11:01:52.021] Server: Issued SSL BA material for .CN=Server1.OU=servers.O=system.T=TREE.
1966335744 EBA : [2018/08/03 11:01:52.022] Client: Received SSL BA material from server


So far, I'm not liking this new feature. It may be great, eventually, but it needs a lot more documentation and I'd like a lot more experience with it before I'd recommend it for production use. But that's just me.
0 Likes
Knowledge Partner
Knowledge Partner

Re: How uninstall EBA in eDirectory 9.1

On 08/03/2018 09:14 AM, dgersic wrote:
>
> Code:
> --------------------
>
> 1364961024 EBA : [2018/08/03 10:56:04.698] GSSAPI context not found on dclient context
> 1364961024 EBA : [2018/08/03 10:56:04.699] Client: EBA BA attempt returned -700
> 1364961024 EBA : [2018/08/03 10:56:04.699] Failing over to old BA as remote server does not support UAP
> 1364961024 EBA : [2018/08/03 10:56:04.705] GSSAPI context not found on dclient context
> 1364961024 EBA : [2018/08/03 10:56:04.705] Client: EBA BA attempt returned -700
> 1364961024 EBA : [2018/08/03 10:56:04.705] Failing over to old BA as remote server does not support UAP
>
> --------------------
>
> So that's fun. What's a "-700" error, and what does it indicate?
> What's "UAP"? "Upgraded Authentication Protocol"? "Use After Passover"?


UAP was the name before it was renamed to EBA; during the eDirectory 9.x
beta the environment variable was actually DISABLE_UAP, FWIW. It stood
for Universal Authentication Protocol as I recall, but was renamed
sometime in the 2014/2015 timeframe. At one point it was even on the
roadmap for 8.8, but was pushed back because, well, good decisions happen.

> Code:
> --------------------
>
> 1341564672 EBA : [2018/08/03 10:56:56.234] Server: EBA BA attempt failed: -641
>
> 1555781376 EBA : [2018/08/03 10:56:56.361] verify_callback() called at depth 1
> 1555781376 EBA : [2018/08/03 10:56:56.361] Verifying certificate for /UID=1CFAB6
> 92-CE8B-674F-5192-1CFAB692CE8B
> 1555781376 EBA : [2018/08/03 10:56:56.361] TLS handshake failed: unable to get local issuer certificate
> 1555781376 EBA : [2018/08/03 10:56:56.361] GSSAPI authentication (client) failed - 851968(20)
> 1555781376 EBA : [2018/08/03 10:56:56.361] GSSAPI context not found on dclient context
> 1555781376 EBA : [2018/08/03 10:56:56.361] Client: EBA BA attempt returned -669
> 1555781376 EBA : [2018/08/03 10:56:56.361] UAPAuthenticateConnection for [ffffffff] <>, failed, failed authentication (-669)
> 1551570688 EBA : [2018/08/03 10:56:58.045] ASN.1 parsing failed
> 1551570688 EBA : [2018/08/03 10:56:58.045] Server: EBA BA attempt failed: -641
>
> 1364961024 EBA : [2018/08/03 10:57:04.715] GSSAPI context not found on dclient context
> 1364961024 EBA : [2018/08/03 10:57:04.715] Client: EBA BA attempt returned -641
> 1364961024 EBA : [2018/08/03 10:57:04.715] Failing over to old BA as remote server does not support UAP
>
> --------------------
>
> There's my old friend, "-641" (invalid request). What's it mean in this
> context?
>
> Looks like -669 has been overloaded again. Means "password fail", but
> clearly there's not a password failure here.


I'm not so sure about that; how do you think servers authenticate to
eachother?

> "BA" seems to mean Background Authentication. And here we see it


Yes, meaning the way authentication among servers has happened for
decades, as opposed to the new TLS-enalbed Enhanced Background
Authentication (EBA).

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.
0 Likes
Knowledge Partner
Knowledge Partner

Re: How uninstall EBA in eDirectory 9.1

ab;2485136 wrote:
On 08/03/2018 09:14 AM, dgersic wrote:
>
> Code:
> --------------------
>
> 1364961024 EBA : [2018/08/03 10:56:04.698] GSSAPI context not found on dclient context
> 1364961024 EBA : [2018/08/03 10:56:04.699] Client: EBA BA attempt returned -700
> 1364961024 EBA : [2018/08/03 10:56:04.699] Failing over to old BA as remote server does not support UAP
> 1364961024 EBA : [2018/08/03 10:56:04.705] GSSAPI context not found on dclient context
> 1364961024 EBA : [2018/08/03 10:56:04.705] Client: EBA BA attempt returned -700
> 1364961024 EBA : [2018/08/03 10:56:04.705] Failing over to old BA as remote server does not support UAP
>
> --------------------
>
> So that's fun. What's a "-700" error, and what does it indicate?
> What's "UAP"? "Upgraded Authentication Protocol"? "Use After Passover"?


UAP was the name before it was renamed to EBA; during the eDirectory 9.x
beta the environment variable was actually DISABLE_UAP, FWIW. It stood
for Universal Authentication Protocol as I recall, but was renamed
sometime in the 2014/2015 timeframe. At one point it was even on the
roadmap for 8.8, but was pushed back because, well, good decisions happen.

> Code:
> --------------------
>
> 1341564672 EBA : [2018/08/03 10:56:56.234] Server: EBA BA attempt failed: -641
>
> 1555781376 EBA : [2018/08/03 10:56:56.361] verify_callback() called at depth 1
> 1555781376 EBA : [2018/08/03 10:56:56.361] Verifying certificate for /UID=1CFAB6
> 92-CE8B-674F-5192-1CFAB692CE8B
> 1555781376 EBA : [2018/08/03 10:56:56.361] TLS handshake failed: unable to get local issuer certificate
> 1555781376 EBA : [2018/08/03 10:56:56.361] GSSAPI authentication (client) failed - 851968(20)
> 1555781376 EBA : [2018/08/03 10:56:56.361] GSSAPI context not found on dclient context
> 1555781376 EBA : [2018/08/03 10:56:56.361] Client: EBA BA attempt returned -669
> 1555781376 EBA : [2018/08/03 10:56:56.361] UAPAuthenticateConnection for [ffffffff] <>, failed, failed authentication (-669)
> 1551570688 EBA : [2018/08/03 10:56:58.045] ASN.1 parsing failed
> 1551570688 EBA : [2018/08/03 10:56:58.045] Server: EBA BA attempt failed: -641
>
> 1364961024 EBA : [2018/08/03 10:57:04.715] GSSAPI context not found on dclient context
> 1364961024 EBA : [2018/08/03 10:57:04.715] Client: EBA BA attempt returned -641
> 1364961024 EBA : [2018/08/03 10:57:04.715] Failing over to old BA as remote server does not support UAP
>
> --------------------
>
> There's my old friend, "-641" (invalid request). What's it mean in this
> context?
>
> Looks like -669 has been overloaded again. Means "password fail", but
> clearly there's not a password failure here.


I'm not so sure about that; how do you think servers authenticate to
eachother?

> "BA" seems to mean Background Authentication. And here we see it


Yes, meaning the way authentication among servers has happened for
decades, as opposed to the new TLS-enalbed Enhanced Background
Authentication (EBA).

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.


I think it's not "password" failure because this seems to be the root failure:


1555781376 EBA : [2018/08/03 10:56:56.361] TLS handshake failed: unable to get local issuer certificate
0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: How uninstall EBA in eDirectory 9.1

esilva;2485098 wrote:
Hi,

My customer have a eDirectory 9.1 server (called oldServer-002) with master partitions and EBA enabled.

They need change master partitions to new eDirectory server 9.1 without EBA. (called 002-newServer)

Exists any procedure for uninstall or deconfigure EBA in eDirectory 9.1 in old server (oldServer-002) for this task ?

Information
------------

# ndsconfig --version
Configuration utility for NetIQ eDirectory 9.1 v40101.39

# ndsrepair -P -Ad -A

[1] Instance at /etc/opt/novell/eDirectory/conf/nds.conf: oldServer-002.OU=Services.O=data.CUSTOMER-TREE
Repair utility for NetIQ eDirectory 9.0 - 9.1 v40101.31
DS Version 40101.29 Tree name: CUSTOMER-TREE
Server name: .oldServer-002.Services.data

Size of /var/opt/novell/eDirectory/log/ndsrepair.log = 419839 bytes.

This list shows information for each replica stored on this server. Select a replica to display an options menu.
Finding all replicas on this server
Please Wait...
Total number of replicas = 2

PARTITION NAME REPLICA TYPE REPLICA STATE
(1).DriverSet-02.Services.data Master On
(2).[Root]. Master On



# ndscheck

[1] Instance at /etc/opt/novell/eDirectory/conf/nds.conf: oldServer-002.OU=Services.O=data.CUSTOMER-TREE

Enter the admin name with context: admin.administrators.data
Enter the password for admin.administrators.data:
Thu Aug 2 17:08:27 2018
Performing health check on the eDirectory server ".CN=oldServer-002.OU=Services.O=data.T=CUSTOMER-TREE." ...
-------------------------------------------------------------------------------------------------------------------------
Checking eDirectory LDAP and HTTP services...
Checking health of partitions ...

Status of partition ".CN=DriverSet-02.OU=Services.O=data.T=CUSTOMER-TREE." ...
Checking the status of the replica ring...
Number of replicas = 3
+---------------------------------+-------+-------------------------+---------------+------------------+
Server Name Status Time Sync Time Delta Replica State
+---------------------------------+-------+-------------------------+---------------+------------------+

.CN=oldServer-002.OU=Servic... UP YES 0 m:0 s ON
.CN=002-newServer.OU=Services UP YES 0 m:0 s ON
.CN=server3.OU=Services.O=data UP YES 0 m:0 s ON
+---------------------------------+-------+-------------------------+---------------+------------------+

Checking replication delta on the partition...
Maximum replica ring delta "0:0:3 (hh:mm:ss)"
Perishable delta on this server: "0:0:0 (hh:mm:ss)"

Status of partition ".T=CUSTOMER-TREE." ...
Checking the status of the replica ring...
Number of replicas = 3
+---------------------------------+-------+-------------------------+---------------+------------------+
Server Name Status Time Sync Time Delta Replica State
+---------------------------------+-------+-------------------------+---------------+------------------+

.CN=oldServer-002.OU=Servic... UP YES 0 m:0 s ON
.CN=002-newServer.OU=Services. UP YES 0 m:0 s ON
.CN=server3.OU=Services.O=data UP YES 0 m:0 s ON
+---------------------------------+-------+-------------------------+---------------+------------------+

Checking replication delta on the partition...
Maximum replica ring delta "0:8:51 (hh:mm:ss)"
Perishable delta on this server: "0:8:24 (hh:mm:ss)"

EBAHealthCheck:
Server is EBA enabled
EBA mechanisms:
* EBATLS

INFO: EBACA = true
INFO: NCPCA validity start = Mon Dec 5 17:02:31 2016
INFO: NCPCA validity end = Thu Dec 3 17:02:31 2026
INFO: CRL validity start = Thu Aug 2 13:05:53 2018
INFO: CRL validity end = Thu Aug 9 13:05:53 2018
INFO: EBACA certificate validity start = Mon Dec 5 17:02:31 2016
INFO: EBACA certificate validity end = Thu Dec 3 17:02:31 2026

eDirectory health check completed.

TIA


I've recently been tangling with EBA myself. According to the documentation, once configured, EBA cannot be disabled or removed, and it appears that eDir will actively resist any attempt to do so. You'll need to configure the new server for EBA, then move the EBACA to the new server.

Reference: https://www.netiq.com/documentation/edirectory-9/edir_admin/data/b1gyn37y.html
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.