Creating and joining a new remote domain

When you use the EIM Configuration wizard to create and join a new domain, you can choose to configure a directory server on a remote system to act as the EIM domain controller as part of creating your EIM configuration.

You must specify the appropriate information for connecting to the remote directory server to allow you to configure EIM. If Kerberos is not currently configured on the IBM® i platform, the wizard prompts you to start the Network Authentication Service Configuration wizard.
Note: The directory server on the remote system must provide EIM support. EIM requires that the domain controller be hosted by a directory server that supports Lightweight Directory Access Protocol (LDAP). Additionally, the directory server product must have the EIM schema configured. For example, the IBM Directory Server V5.1 provides this support. For more detailed information about EIM domain controller requirements, review Planning an Enterprise Identity Mapping domain controller.
When you complete the EIM Configuration wizard, you can accomplish these tasks:
  • Create a new EIM domain.
  • Configure a remote directory server to act as the EIM domain controller.
  • Configure network authentication service for the system.
  • Create EIM registry definitions for the local IBM i registry and the Kerberos registry.
  • Configure the system to participate in the new EIM domain.

To configure your system to create and join a new EIM domain, you must have all the following special authorities:

  • Security administrator (*SECADM).
  • All object (*ALLOBJ).
  • System configuration (*IOSYSCFG).

To use the EIM Configuration wizard to create and join a domain on a remote system, complete these steps:

  1. Verify that the directory server on the remote system is active.
  2. From IBM Navigator for i on the system for which you want to configure EIM, expand Security > Enterprise Identity Mapping (EIM).
  3. Click Setup wizard to start the EIM Configuration wizard.
  4. On the Welcome page, select Create and join a new domain and select On a remote directory server.
  5. Click Next.
    Note: If network authentication service is not currently configured on the IBM i platform, or additional network authentication configuration information is needed to configure a single sign-on environment, the Network Authentication Services Configuration page displays. This page allows you to start the Network Authentication Service Configuration wizard so that you can configure network authentication service. Or, you can configure Network Authentication Service at a later time by using the configuration wizard for this service through IBM Navigator for i. When you complete network authentication service configuration, the EIM Configuration wizard continues.
  6. To configure network authentication service, complete these steps:
    1. On the Configure Network Authentication Service page, select Yes to start the Network Authentication Service Configuration wizard. With this wizard, you can configure several IBM i interfaces and services to participate in a Kerberos realm as well as configure a single sign-on environment that uses both EIM and network authentication service.
    2. On the Welcome page, in the the Specify Realm Information portion of the page, specify the name of the default realm in the Default realm field. If you are using Microsoft Active Directory for Kerberos authentication, select Microsoft Active Directory is used for Kerberos authentication. Click Next.
    3. On the Specify KDC Information page, specify the fully qualified name of the Kerberos server for this realm in the KDC field, specify 88 in the Port field. Click Add then click Next.
    4. On the Specify Password Server Information page, select either Yes or No for setting up a password server. The password server allows principals to change passwords on the Kerberos server. If you select Yes, enter the password server name in the Password server field. In the Port field, accept the default value of 464. Click Add then click Next.
    5. On the Select Keytab Entries page, select IBM i Kerberos Authentication.
      Note: You can also create keytab entries for other services if you want these services to use Kerberos authentication. You may need to perform additional configuration for these services before they can use Kerberos authentication.

      In the Details portion of the page, enter and confirm a password, and click Next. This is the same password you will use when you add the IBM i principals to the Kerberos server.

    6. Optional: On the Create Batch File page, select Yes, specify the following information, and click Next:
      • In the Batch file field, update the directory path. Click Browse to locate the appropriate directory path, or edit the path in the Batch file field.
      • Select Include password in the batch file. This ensures that all passwords associated with the IBM i service principal are included in the batch file. It is important to note that passwords are displayed in clear text and can be read by anyone with read access to the batch file. Therefore, it is essential that you delete the batch file from the Kerberos server and from the IBM i platform immediately after you use it. If you do not include the password, you will be prompted for the password when you run the batch file.
        Note: You can also manually add the service principals that are generated by the wizard to Microsoft Active Directory. To learn how to do this, review Add IBM i principals to the Kerberos server
    7. On the Summary page, review the network authentication service configuration details, and click Finish to return to the EIM Configuration wizard.
  7. If the local directory server is not currently configured, the Configure Directory Server page displays when the EIM Configuration wizard resumes. Provide the following information to configure the local directory server:
    Note: If you configure the local directory server before you use the EIM Configuration wizard, the Specify User for Connection page displays instead. Use this page to specify the distinguished name and password for the LDAP administrator to ensure that the wizard has enough authority to administer the EIM domain and the objects in it and continue with the next step in this procedure.
    1. In the Port field, accept the default port number 389, or specify a different port number to use for nonsecure EIM communications with the directory server.
    2. In the Distinguished name field, specify the LDAP distinguished name (DN) that identifies the LDAP administrator for the directory server. The EIM Configuration wizard creates this LDAP administrator DN and uses it to configure the directory server as the domain controller for the new domain that you are creating.
    3. In the Password field, specify the password for the LDAP administrator.
    4. In the Confirm password field, specify the password a second time for validation purposes.
    5. Click Next.
  8. On the Specify Domain and Parent DN page, provide the following information:
    1. In the Domain field, specify the name of the EIM domain that you want to create. Accept the default name of EIM, or use any string of characters that makes sense to you. However, you cannot use special characters such as = + < > , # ; \ and *.
    2. In the Description field, enter text to describe the domain.
    3. Select Yes to specify the parent DN the wizard should use for the location of the EIM domain that you are creating.
      This is the DN that represents the entry immediately above your domain name entry in the directory information tree hierarchy. Or specify No to have EIM data stored in a directory location with a suffix whose name is derived from the EIM domain name.
      Note: When you use the wizard to configure a domain on a remote domain controller you should specify an appropriate parent DN for the domain. Because all necessary configuration objects for the parent DN must already exist or the EIM configuration may fail, you should browse for the appropriate parent DN rather than manually enter the DN information.
  9. On the Registry Information page, specify whether to add local user registries to the EIM domain as registry definitions. Select one or both of these user registry types:
    Note: You do not have to create the registry definitions at this time. If you choose to create the registry definitions later, view adding a system registry definition and EIM configuration properties.
    1. Select Local IBM i to add a registry definition for the local registry. In the field provide, accept the default value for the registry definition name or specify a different value for the registry definition name. The EIM registry name is an arbitrary string that represents the registry type and specific instance of that registry.
    2. Select Kerberos to add a registry definition for a Kerberos registry. In the field provided, accept the default value for the registry definition name or specify a different value for the registry definition name. The default registry definition name is the same as the realm name. By accepting the default name and using the same Kerberos registry name as the realm name, you can increase performance in retrieving information from the registry. Select Kerberos user identities are case sensitive, if necessary.
    3. Click Next.
  10. On the Specify EIM System User page, select a User type that you want the system to use when performing EIM operations on behalf of operating system functions.
    These operations include mapping lookup operations and deletion of associations when deleting a local IBM i user profile. You can select one of the following types of users: Distinguished name and password, Kerberos keytab file and principal, or Kerberos principal and password. Which user types you can select vary based on the current system configuration. For example, if Network Authentication Service is not configured for the system, then Kerberos user types may not be available for selection. The user type that you select determines the other information that you must provide to complete the page as follows:
    Note: You must specify a user that is currently defined in the directory server which is hosting the EIM domain controller. The user that you specify must have privileges to perform mapping lookup and registry administration for the local user registry at a minimum. If the user that you specify does not have these privileges, then certain operating system functions related to the use of single sign-on and the deletion of user profiles may fail.

    If you have not configured the directory server prior to running this wizard, the only user type you can select is Distinguished name and password and the only distinguished name you can specify is the LDAP administrator's DN.

    • If you select Distinguished name and password, provide the following information:
      • In the Distinguished name field, specify the LDAP distinguished name that identifies the user for the system to use when performing EIM operations.
      • In the Password field, specify the password for the distinguished name.
    • If you select Kerberos principal and password, provide the following information:
      • In the Principal field, specify the Kerberos principal name for the system to use when performing EIM operations
      • In the Realm field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal jsmith in the realm ordept.myco.com is represented in the keytab file as jsmith@ordept.myco.com.
      • In the Password field, enter the password for the user.
    • If you select Kerberos keytab file and principal, provide the following information:
      • In the Keytab file field, specify the fully qualified path and keytab file name that contains the Kerberos principal for the system to use when performing EIM operations. Or, click Browse to browse through directories in the IBM i integrated file system to select a keytab file.
      • In the Principal field, specify the Kerberos principal name for the system to use when performing EIM operations.
      • In the Realm field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal jsmith in the realm ordept.myco.com is represented in the keytab file as jsmith@ordept.myco.com.
    • Click Next.
  11. On the Summary page, review the configuration information that you have provided. If all information is correct, click Finish.

Finalize your EIM configuration for the domain

When the wizard finishes, it adds the new domain to Domain Management and you have created a basic EIM configuration for this server. However, you must complete these tasks to finalize your EIM configuration for the domain:
  1. Use the EIM Configuration wizard on each additional server that you want to have join an existing domain. Review the Joining an existing domain topic for more information.
  2. Add EIM registry definitions to the EIM domain, if necessary, for other non-IBM i platforms and applications that you want to participate in the EIM domain. These registry definitions refer to the actual user registries that must participate in the domain.
    Depending on your EIM implementation needs you should view eitherAdding a system registry definition or Adding an application registry definition.
  3. Based on your EIM implementation needs, determine whether to:
    1. Creating an EIM identifier for each unique user or entity in the domain and Creating EIM identifier association for them.
    2. Creating a policy association to map a group of users to a single target user identity.
    3. Create a combination of these.
  4. Use the EIM Testing EIM mappings function to test the identity mappings for your EIM configuration.
  5. If the only EIM user you have defined is the DN for the LDAP administrator, then your EIM user has a high level of authority to all data on the directory server.
    Therefore, you might consider creating one or more DNs as additional users that have more appropriate and limited access control for EIM data. To learn more about creating DNs for the directory server, review Distinguished names in the IBM i Information Center. The number of additional EIM users that you define depends on your security policy's emphasis on the separation of security duties and responsibilities. Typically, you might create at least the two following types of DNs:
    • A user that has EIM administrator access control

      This EIM administrator DN provides the appropriate level of authority for an administrator who is responsible for managing the EIM domain. This EIM administrator DN could be used to connect to the domain controller when managing all aspects of the EIM domain by means of IBM Navigator for i.

    • At least one user that has all of the following access controls:
      • Identifier administrator
      • Registry administrator
      • EIM mapping operations
      This user provides the appropriate level of access control required for the system user that performs EIM operations on behalf of the operating system.
    Note: To use this new DN for the system user instead of the LDAP administrator DN, you must change the EIM configuration properties for the IBM i platform. Review Managing EIM configuration properties to learn how to change the system user DN.

You might need to perform additional tasks if you created a basic network authentication service configuration, especially if you are implementing a single sign-on environment. You can find information about these additional steps by reviewing the complete configuration steps demonstrated by the scenario, Enable single sign-on for IBM i .