Scenario: Enabling single sign-on for IBM i

View this scenario to learn how to configure network authentication service and EIM to create a single sign-on environment across multiple systems in an enterprise. This scenario expands on the concepts and tasks presented in the previous scenario which demonstrates how to create a simple single sign-on test environment.

Situation

You are a network administrator that manages a network and network security for your company, including the Order Receiving department. You oversee the IT operations for a large number of employees who take customer orders over the telephone. You also supervise two other network administrators who help you maintain the network.

The employees in the Order Receiving department use Windows and IBM® i and require multiple passwords for the different applications they use every day. Consequently, you spend a lot of time managing and troubleshooting problems related to passwords and user identities, such as resetting forgotten passwords.

As the company's network administrator, you are always looking for ways to improve the business, starting with the Order Receiving department. You know that most of your employees need the same type of authority to access the application that they use to query inventory status. It seems redundant and time consuming for you to maintain individual user profiles and numerous passwords that are required in this situation. In addition, you know that all of your employees can benefit by using fewer user IDs and passwords. You want to do these things:
  • Simplify the task of password management for the Order Receiving department. Specifically, you want to efficiently manage user access to the application your employees routinely use for customer orders.
  • Decrease the use of multiple user IDs and passwords for the department employees, as well as for the network administrators. However, you do not want to make the Windows IDs and IBM i user profiles the same nor do you want to use password caching or synching.
Based on your research, you know that IBM i supports single sign-on, a solution that allows your users to log on once to access multiple applications and services that normally require them to log on with multiple user IDs and passwords. Because your users do not need to provide as many user IDs and passwords to do their jobs, you have fewer password problems to solve for them. Single sign-on seems to be an ideal solution because it allows you to simplify password management in the following ways:
  • For typical users that require the same authority to an application, you can create policy associations. For example, you want the order clerks in the Order Receiving department to be able to log on once with their Windows user name and password and then be able to access a new inventory query application in the manufacturing department without having to be authenticated again. However, you also want to ensure that the level of authorization that they have when using this application is appropriate. To attain this goal, you decide to create a policy association that maps the Windows user identities for this group of users to a single IBM i user profile that has the appropriate level of authority for running the inventory query application. Because this is a query-only application in which users cannot change data, you are not as concerned about detailed auditing for this application. Consequently, you feel confidant that using a policy association in this situation conforms to your security policy.

    You create a policy association to map the group of order clerks with similar authority requirements to a single IBM i user profile with the appropriate level of authority for the inventory query application. Your users benefit by having one less password to remember and one less logon to perform. As the administrator, you benefit by having to maintain only one user profile for user access to the application instead of multiple user profiles for everyone in the group.

  • For each of your network administrators who have user profiles with special authorities, such as *ALLOBJ and *SECADM, you can create identifier associations. For example, you want all of the user identities for a single network administrator to be precisely and individually mapped to one another because of the administrator's high level of authority.

    Based on your company's security policy, you decide to create identifier associations to map specifically from each network administrator's Windows identity to his IBM i user profile. You can more easily monitor and trace the activity of the administrator because of the one-to-one mapping that identifier associations provide. For example, you can monitor the jobs and objects that run on the system for a specific user identity. Your network administrator benefits by having one less password to remember and one less logon to perform. As the network administrator, you benefit by tightly controlling the relationships between all of your administrator's user identities.

This scenario has the following advantages:
  • Simplifies authentication process for users.
  • Simplifies managing access to applications.
  • Eases the overhead of managing access to servers in the network.
  • Minimizes the threat of password theft.
  • Avoids the need for multiple signons.
  • Simplifies user identity management across the network.

Objectives

In this scenario, you are the administrator at MyCo, Inc. who wants to enable single sign-on for the users in the Order Receiving department.

The objectives of this scenario are as follows:

  • System A and System B must participate in the MYCO.COM realm to authenticate the users and services that are participating in this single sign-on environment. To enable the systems to use Kerberos, System A and System B must be configured for network authentication service.
  • The IBM Tivoli® Directory Server for IBM i (LDAP) on System A must function as the domain controller for the new EIM domain.
    Note: Refer to domains to learn how two different types of domains, an EIM domain and a Windows domain, fit into the single sign-on environment.
  • All user identities in the Kerberos registry must map successfully to a single IBM i user profile with appropriate authority for user access to the inventory query application.
  • Based on your security policy, two administrators, John Day and Sharon Jones, who also have user identities in the Kerberos registry, must have identifier associations to map these identities to their IBM i user profiles which have *SECADM special authority. These one-to-one mappings enable you to closely monitor the jobs and objects that run on the system for these user identities.
  • A Kerberos service principal must be used to authenticate the users to the IBM i Access Client Solutions applications.

Details

The following figure illustrates the network environment for this scenario.

Single sign-on environment diagram

The figure illustrates the following points relevant to this scenario.

EIM domain data defined for the enterprise
  • Three registry definition names:
    • A registry definition name of MYCO.COM for the Windows server registry. You will define this when you use the EIM configuration wizard on System A.
    • A registry definition name of SYSTEMA.MYCO.COM for the IBM i registry on System A. You will define this when you use the EIM configuration wizard on System A.
    • A registry definition name of SYSTEMB.MYCO.COM for the IBM i registry on System B. You will define this when you use the EIM configuration wizard on System B.
  • Two default registry policy associations:
    Note: EIM lookup operation processing assigns the highest priority to identifier associations. Therefore, when a user identity is defined as a source in both a policy association and an identifier association, only the identifier association maps that user identity. In this scenario, two network administrators, John Day and Sharon Jones, both have user identities in the MYCO.COM registry, which is the source of the default registry policy associations. However, as shown below, these administrators also have identifier associations defined for their user identities in the MYCO.COM registry. The identifier associations ensure that their MYCO.COM user identities are not mapped by the policy associations. Instead, the identifier associations ensure that their user identities in the MYCO.COM registry are individually mapped to other specific individual user identities.
    • One default registry policy association maps all user identities in the Windows server registry called MYCO.COM, to a single IBM i user profile called SYSUSERA in the SYSTEMA.MYCO.COM registry on System A. For this scenario, mmiller and ksmith represent two of these user identities.
    • One default registry policy association maps all user identities in the Windows server registry called MYCO.COM, to a single IBM i user profile called SYSUSERB in the SYSTEMB.MYCO.COM registry on System B. For this scenario, mmiller and ksmith represent two of these user identities.
  • Two EIM identifiers named John Day and Sharon Jones to represent the two network administrators in the company who have those names.
  • For the John Day EIM identifier, these identifier associations are defined:
    • A source association for the jday user identity, which is a Kerberos principal in the Windows server registry.
    • A target association for the JOHND user identity, which is a user profile in the IBM i registry on System A.
    • A target association for the DAYJO user identity, which is a user profile in the IBM i registry on System B.
  • For the Sharon Jones EIM identifier, these identifier associations are defined:
    • A source association for the sjones user identity, which is a Kerberos principal in the Windows server registry.
    • A target association for the SHARONJ user identity, which is a user profile in the IBM i registry on System A.
    • A target association for the JONESSH user identity, which is a user profile in the IBM i registry on System B.
Windows server
  • Acts as the Kerberos server (kdc1.myco.com), also known as a key distribution center (KDC), for the network.
  • The default realm for the Kerberos server is MYCO.COM.
  • All Microsoft Windows Active Directory users that do not have identifier associations are mapped to a single IBM i user profile on each of the IBM i models.
System A
  • Runs IBM i 5.4, or later, with the following options and licensed programs installed:
    • IBM i Host Servers (5770-SS1 Option 12)
    • Qshell Interpreter (5770-SS1 Option 30)
  • The directory server on System A will be configured to be the EIM domain controller for the new EIM domain, MyCoEimDomain.
  • Participates in the EIM domain, MyCoEimDomain.
  • Has the service principal name of krbsvr400/systema.myco.com@MYCO.COM.
  • Has the fully qualified host name of systema.myco.com. This name is registered in a single Domain Name System (DNS) to which all PCs and servers in the network point.
  • Home directories on System A store the Kerberos credentials caches for IBM i user profiles.
System B
  • Runs IBM i 5.4, or later, with the following options and licensed programs installed:
    • IBM i Host Servers (5770-SS1 Option 12)
    • Qshell Interpreter (5770-SS1 Option 30)
  • Has the fully qualified host name of systemb.myco.com. This name is registered in a single Domain Name System (DNS) to which all PCs and servers in the network point.
  • The principal name for System B is krbsvr400/systemb.myco.com@MYCO.COM.
  • Participates in the EIM domain, MyCoEimDomain.
  • Home directories on System B store the Kerberos credentials caches for IBM i user profiles.
Administrative PC
  • Runs Microsoft Windows operating system.
  • Serves as the primary logon system for the administrator.
  • Configured to be part of the MYCO.COM realm (Windows domain).

Prerequisites and assumptions

Successful completion of this scenario requires that the following assumptions and prerequisites are met:

  1. All system requirements, including software and operating system installation, have been verified.
    To verify that these licensed programs have been installed, complete the following:
    1. In IBM Navigator for i, expand IBM i Management > Configuration and Service > Software.
    2. Click Installed Products.
    3. Ensure that all the necessary licensed programs are installed.
  2. All necessary hardware planning and setup are complete.
  3. TCP/IP and basic system security are configured and tested on each system.
  4. The directory server and EIM should not be previously configured on System A.
    Note: Instructions in this scenario are based on the assumption that the directory server has not been previously configured on System A. However, if you already configured the directory server, you can still use these instructions with only slight differences. These differences are noted in the appropriate places within the configuration steps.
  5. A single DNS server is used for host name resolution for the network. Host tables are not used for host name resolution.
    Note: The use of host tables with Kerberos authentication might result in name resolution errors or other problems.

Configuration steps

Note: You need to thoroughly understand the concepts related to single sign-on, which include network authentication service and Enterprise Identity Mapping (EIM) concepts, before you accomplish this scenario. If you are ready to continue with this scenario complete the following steps: