Completing the planning work sheets
The following planning work sheets are tailored to fit this scenario based on the general single sign-on planning worksheets.
These planning work sheets demonstrate the information that
you need to gather and the decisions you need to make to prepare the
single sign-on implementation described by this scenario. To ensure
a successful implementation, you must be able to answer Yes to all
prerequisite items in the work sheet and you should gather all the
information necessary to complete the work sheets before you perform
any configuration tasks.
Note: You need to thoroughly understand the
concepts related to single sign-on which include network authentication
service and Enterprise Identity Mapping (EIM) concepts, before you
implement this scenario.
| Prerequisite work sheet | Answers |
|---|---|
Are the following options and licensed programs
installed on System A?
|
Yes |
| Have you installed an application
that is enabled for single sign-on on each of the PCs that will participate
in the single sign-on environment? Note: For this scenario,
all of the participating PCs have IBM i
Access Client Solutions (5733-XJ1) installed. See IBM i
Access Client Solutions: Getting Started
|
Yes |
| Do you, the administrator, have *SECADM, *ALLOBJ, and *IOSYSCFG special authorities? | Yes |
Do you have one of the following
systems acting as the Kerberos server (also known as the KDC)? If
yes, specify which system.
|
Yes, Windows server |
| Are all your PCs in your network configured in a Windows domain? | Yes |
| Have you applied the latest program temporary fixes (PTFs)? | Yes |
| Is the IBM i time within 5 minutes of the system time on the Kerberos server? If not see Synchronizing system times. | Yes |
You need this information to configure EIM and network authentication service to create a single sign-on test environment.
| Configuration planning work sheet for System A | Answers |
|---|---|
| Use the following information to complete the EIM Configuration wizard. The information in this work sheet correlates with the information you need to supply for each page in the wizard: | |
How do you want to configure EIM for your system?
|
Create and join a new domain |
| Where do you want to configure your EIM domain? | On the local directory server Note: This will
configure the directory server on the same system on which you are
currently configuring EIM.
|
| Do you want to configure network authentication
service? Note: You must configure network authentication service to
configure single sign-on.
|
Yes |
| The Network Authentication Service
wizard opens from the EIM Configuration wizard. Use the following
information to complete the Network Authentication Service wizard: Note: You
can launch the Network Authentication Service wizard independently
of the EIM Configuration wizard.
|
|
| What is the name of the Kerberos default realm
to which your IBM i
will belong? Note: A Windows domain
is similar to a Kerberos realm.
|
MYCO.COM |
| Are you using Microsoft Active Directory? | Yes |
| What is the Kerberos server, also known as a key distribution center (KDC), for this Kerberos default realm? What is the port on which the Kerberos server listens? | KDC: kdc1.myco.com
Port: 88 Note: This is the
default port for the Kerberos server.
|
| Do you want to configure a password server for
this default realm? If yes, answer the following questions: What is name of the password server for this Kerberos server?
What is the port on which the password server listens? |
Yes Password server: kdc1.myco.com
Port: 464 Note: This is the
default port for the password server.
|
For which services do you want to create keytab
entries?
|
IBM i Kerberos Authentication |
| What is the password for your service principal or principals? | SystemA123 Note: Any and all passwords
specified in this scenario are for example purposes only. To prevent
a compromise to your system or network security, you should never
use these passwords as part of your own configuration.
|
| Do you want to create a batch file to automate adding the service principals for System A to the Kerberos registry? | Yes |
| Do you want to include passwords with the IBM i service principals in the batch file? | Yes |
| As you exit the Network Authentication Service wizard, you will return to the EIM Configuration wizard. Use the following information to complete the EIM Configuration wizard: | |
| Specify user information that the wizard should
use when configuring the directory server. This is the connection
user. You must specify the port number, administrator distinguished
name, and a password for the administrator. Note: Specify the LDAP
administrator's distinguished name (DN) and password to ensure the
wizard has enough authority to administer the EIM domain and the objects
in it.
|
Port: 389
Distinguished name: cn=administrator Password: MyCoPwd Note: Any
and all passwords specified in this scenario are for example purposes
only. To prevent a compromise to your system or network security,
you should never use these passwords as part of your own configuration.
|
| What is the name of the EIM domain that you want to create? | MyCoEimDomain |
| Do you want to specify a parent DN for the EIM domain? | No |
| Which user registries do you want to add to the EIM domain? | Local IBM i--SYSTEMA.MYCO.COM
Kerberos--MYCO.COM Note: The Kerberos principals stored on
the Windows server are not
case sensitive; therefore you should not select Kerberos
user identities are case sensitive.
|
| Which EIM user do you want System A to use when
performing EIM operations? This is the system user. Note: If you have
not configured the directory server before configuring single sign-on,
the only distinguished name (DN) you can provide for the system user
is the LDAP administrator's DN and password.
|
User type: Distinguished name and password
User: cn=administrator Password: MyCoPwd Note: Any
and all passwords specified in this scenario are for example purposes
only. To prevent a compromise to your system or network security,
you should never use these passwords as part of your own configuration.
|
| After you complete the EIM Configuration wizard, use the following information to complete the remaining steps required for configuring single sign-on: | |
| What is the IBM i user profile name for the user? | JOHND |
| What is the name of the EIM identifier that you want to create? | John Day |
| What kinds of associations do you want to create? | Source association: Kerberos principal jday
Target association: IBM i user profile JOHND |
| What is the name of the user registry that contains the Kerberos principal for which you are creating the source association? | MYCO.COM |
| What is the name of the user registry that contains the IBM i user profile for which you are creating the target association? | SYSTEMA.MYCO.COM |
| What information do you need to supply to test EIM identity mapping? | Source registry: MYCO.COM
Source user: jday Target registry: SYSTEMA.MYCO.COM |