Before configuring the Kerberos server and network authentication service in i5/OS® PASE, complete these planning work sheets.
All answers on the prerequisite sheet should be Yes before you proceed with network authentication service setup.
| Questions | Answers |
|---|---|
| Is your i5/OS V5R3, or later (5722-SS1)? | Yes |
| Are the following options and licensed programs installed on System A:
| Yes |
| Have you installed Windows 2000 or Windows XP on all of your PCs? | Yes |
| Have you installed Windows 2000 Support Tools (which provides the ksetup command) on all of your PCs? | Yes |
| Is iSeries Access for Windows (5722-XE1) installed on the administrator's PC? | Yes |
| Have you installed iSeries Navigator on the administrator's PC?
|
Yes
|
| Have you installed the latest iSeries Access for Windows service pack? See iSeries Access for the latest service pack. | Yes |
| Do you have *SECADM, *ALLOBJ, and *IOSYSCFG special authorities? You must have these special authorities to use the Network Authentication Service wizard for this scenario. | Yes |
| Do you have your DNS configured and do you have the correct host names for your System i™ product and Kerberos server? | Yes |
| On which operating system do you want to configure the Kerberos server?
| i5/OS PASE |
| Have you applied the latest program temporary fixes (PTFs)? | Yes |
| Is the System i system time within five minutes of the Kerberos server's system time? If not, see Synchronizing system times. | Yes |
For this scenario, specify a number of different passwords. The following planning worksheet provides a list of the passwords you need to use for this scenario. Refer to this table as you perform the configuration steps for setting up the Kerberos server in i5/OS PASE.
| Entity | Password | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| i5/OS PASE administrator: admin/admin i5/OS PASE specifies admin/admin as the default user name for the administrator. secret
| i5/OS PASE Database Master
| pasepwd
| Windows 2000 workstations:
|
| secret1
Kerberos user principals:
|
| 123day
| i5/OS service principal for System A:
systema123 | |
The following planning work sheet illustrates the type of information you need before you begin configuring the Kerberos server in i5/OS PASE and network authentication service. All answers on the prerequisite work sheet and password planning work sheet should be answered before you proceed with configuring the Kerberos server in i5/OS PASE.
| Questions | Answers | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| What is the name of the Kerberos default realm? | MYCO.COM | ||||||||||||||||||||
| Is this default realm located on Microsoft® Active Directory? | No | ||||||||||||||||||||
| What is the Kerberos server, also known as a key distribution center (KDC), for this Kerberos default realm? What is the port on which the Kerberos server listens? |
KDC: kdc1.myco.com
This is the default port for the Kerberos server. Do you want to configure a password server for this default realm?
| No | Currently password servers are not supported by i5/OS PASE or AIX. For which services do you want to create keytab entries?
|
i5/OS Kerberos Authentication
| Do you want to create a batch file to automate adding the service principals to Microsoft Active Directory?
| Not applicable
| What is the default user name for the i5/OS PASE administrator?
| What is the password you want to specify for the i5/OS PASE administrator?
| User name: admin/admin
What is the naming convention for your principals that represent users in your network?
| Principals that represent users will be lowercase family name followed by the uppercase realm name
| What are the Kerberos user principal names for these users:
|
| day@MYCO.COM
What are the i5/OS user profile names for these users:
|
| JOHND
What are the Windows 2000 user names for these users:
|
| johnday
What are the host names for these Windows 2000 workstations:
|
| pc1.myco.com
What is the name of the i5/OS service principal for System A?
| krbsvr400/systema.myco.com@MYCO.COM | The name of this service principal is for example purposes only. In your configuration, specify the host name and domain of your i5/OS in the name of the service principal. |