Single sign-on planning worksheets
Complete these worksheets to ensure that you have met all of the prerequisites for single sign-on and that you have considered all of the aspects of your particular system and its security requirements.
Before you use these configuration planning worksheets, you need to plan your overall single sign-on implementation. Use these configuration planning worksheets to ensure that you have met all of the prerequisites, and that you have taken into consideration all of the aspects of your particular System i® environment.
Single sign-on prerequisite worksheet
This detailed work sheet is provided to help you ensure that you meet all hardware and software prerequisites for implementing single sign-on. To ensure a successful implementation, you must be able to answer Yes to all prerequisite items in the work sheet and you should gather all the information necessary to complete the work sheets before you perform any configuration tasks.
Prerequisite work sheet | Answers |
Is your system running IBM® i V5R4, or later? | |
Are the following options and licensed programs installed
on your server?
Note: 5722 is the product code for IBM i options
and products, prior to V6R1.
|
|
Have you installed an application that is
enabled for single sign-on on each of the PCs that will participate in the
single sign-on environment? Note: For the scenarios in this information, all
of the PCs have IBM i
Access for Windows (5761-XE1)
installed.
|
|
Is System
i Navigator installed
on the administrator's PC?
|
|
Have you installed the latest IBM i Access for Windows service pack? For the latest service pack, see System i Access. | |
Do you, the administrator, have *SECADM, *ALLOBJ, and *IOSYSCFG special authorities? | |
Do you have one of the following systems
acting as the Kerberos server (also known as the KDC)? If yes, specify which
system.
|
|
Are all your PCs in your network configured in a Windows 2000 domain? | |
Have you applied the latest program temporary fixes (PTFs)? | |
Is the System i model time within 5 minutes of the system time on the Kerberos server? If not, see Synchronize system times. |
Single sign-on configuration planning worksheet
This is a configuration planning worksheets, designed to ensure that you have met all of the hardware and software prerequisites for single sign-on. Additionally, this worksheet ensures that you have completed those Enterprise Identity Mapping (EIM) and network authentication service configuration tasks that are required for a successful single sign-on environment.
Configuration planning work sheet | Answers |
Use the following information to complete the EIM Configuration wizard: | |
How do you want to configure EIM for your system?
|
|
Where do you want to configure your EIM domain? | |
Do you want to configure network authentication service? | |
The Network Authentication
Service wizard launches from the EIM Configuration wizard. Use the following
information to complete the Network Authentication Service wizard: Note: The
Network Authentication Service wizard can also be launched independently of
the EIM Configuration wizard.
|
|
What is the name of the Kerberos default realm to which
your system will belong? Note: A Windows 2000 domain
is similar to a Kerberos realm. Microsoft Windows Active Directory uses Kerberos
authentication as its default security mechanism.
|
|
Are you using Microsoft Active Directory? | |
What is the Kerberos server, also known as a key distribution center (KDC), for this Kerberos default realm? What is the port on which the Kerberos server listens? | |
Do you want to configure a password server for this
default realm? If yes, answer the following questions: What is name of the password server for this Kerberos server? |
|
For which services do you want to create keytab entries?
|
|
What is the password for your service principal or principals? | |
Do you want to create a batch file to automate adding the service principals for System A to the Kerberos registry? | |
Do you want to include passwords with the IBM i service principals in the batch file? | |
As you exit the Network Authentication Service wizard, you will return to the EIM Configuration wizard. Use the following information to complete the EIM Configuration wizard: | |
Specify user information that the wizard should use when configuring the directory server. This is the connection user. You must specify the port number, administrator distinguished name, and a password for the administrator. | |
What is the name of the EIM domain that you want to create? | |
Do you want to specify a parent DN for the EIM domain? | |
Which user registries do you want to add to the EIM domain? | |
Which EIM user do you want System A to use when performing EIM operations? This is the system user. | |
After you complete the EIM Configuration wizard, use the following information to complete the remaining steps required for configuring single sign-on: | |
What is the IBM i user profile name for the user? | |
What is the name of the EIM identifier that you want to create? | |
What kinds of associations do you want to create? | |
What is the name of the user registry that contains the Kerberos principal for which you are creating the source association? | |
What is the name of the user registry that contains the IBM i user profile for which you are creating the target association? | |
What information do you need to supply to test EIM identity mapping? |