The intelligent agent platform uses Kerberos principals to authenticate users and services throughout the agent platform. Kerberos protocol, developed by Massachusetts Institute of Technology, allows a principal (a user or service) to prove its identity to another service within an insecure network.
Authentication of principals is completed through a centralized server called a key distribution center (KDC). The KDC authenticates a user with a Kerberos ticket. These tickets prove the principal's identity to other services in a network. After a principal is authenticated by these tickets, they can exchange encrypted data with a target service.
The platform uses Kerberos to authenticate user sign on and initial platform startup. To use Kerberos to secure your platform, either find an existing KDC, or create a working KDC that all parts of the platform use. Every system running a piece of the platform and every PC running a console that connects to this platform must be configured to use this KDC. You need to list all Kerberos principals in the ableplatform.preferences file that are used by the platform to authenticate users and services. Each platform Java™ Virtual Machine (agent pool) has a service principal associated with it, and each user logging onto the platform from a console needs a user principal. All of these principals need to be added to the KDC.
The agent platform does not require a KDC on i5/OS®. A KDC running on any platform will work. If you cannot find an existing KDC to use, you can create your own. In V5R3 or later, i5/OS supports a Kerberos server in i5/OS PASE. You can configure and manage a Kerberos server from your iSeries™ system. To configure a Kerberos server in i5/OS PASE, complete the following steps:
After you create a Kerberos server (KDC), you need to individually configure each client PC that will attempt to connect to the secure platform, and each system in your agent platform to point to your Kerberos server (KDC).
To configure a client PC, you need to create a text file called krb5.conf in the security folder of the JVM that runs your iSeries Navigator intelligent agents console located here (where C: is the drive where your iSeries Access driver is installed):
C:\Program Files\IBM\Client Access\JRE\Lib\Security
The krb5.conf file tells all JVMs started from this JRE which KDC to use when dealing with Kerberos. The following is an example of what a generic krb5.conf file might look like if the KDC realm is KDC_REALM.PASE.COM and is found on system1.ibm.com:
[libdefaults]
default_realm = KDC_REALM.PASE.COM default_tkt_enctypes = des-cbc-crc default_tgs_enctypes = des-cbc-crc
[realms]
KDC_REALM.PASE.COM = {
kdc = system1.rchland.ibm.com:88 }
[domain_realm]
.rchland.ibm.com = KDC_REALM.PASE.COM
To point your system to your KDC, you need to modify the following file:
/QIBM/userdata/OS400/networkauthentication/ krb5.conf
The krb5.conf file tells all JVMs started from this JRE which KDC to use when dealing with Kerberos. The following is an example of what a generic krb5.conf file might look like on the server if the KDC realm is KDC_REALM.PASE.COM and is found on system1.ibm.com:
??(libdefaults??)
default_realm = KDC_REALM.PASE.COM
??(appdefaults??)
??(realms??)
KDC_REALM.PASE.COM = {
kdc = system1.rchland.ibm.com:88
}
??(domain_realm??)
system1.rchland.ibm.com = KDC_REALM.PASE.COM
After you configure a KDC, you need to create the user and service principals you plan to use to secure the platform, and register these principals to the KDC:
You need to add a principal to the KDC for each service and user principal that your platform uses. To add your principals to your KDC if you are using the integrated KDC on the server, follow these steps:
If you are using the integrated KDC, see the following topics for more information on how to add principals to your KDC:
When you start up a secure platform, each agent pool uses the principal that it was defined to start with, and uses it to authenticate itself. This requires each pool JVM to have access to valid Kerberos credentials for the principal it is using. The i5/OS Start Agent Services (STRAGTSRV) command handles this, as long as there is an entry in the keytab file for the principal that is being used.
To add an entry to the keytab file for each service principal when you are running the integrated KDC on a system, do the following:
After you set up your KDC and create your user and service principals, you need to configure security in your ableplatform.preferences file.