To successfully configure network authentication service, understand the requirements and complete the necessary planning steps.
This topic provides a prerequisite worksheet and planning work sheet to ensure all necessary steps are completed. Use the following work sheets to aid in planning a Kerberos implementation and configuring network authentication service.
Prerequisite work sheet
Use this planning work sheet to ensure that all required prerequisites have been completed. You should be able to answer Yes to all prerequisite items before you perform any configuration tasks.
| Questions | Answers |
|---|---|
| Is your i5/OS® V5R3 (5722-SS1), or later? | |
|
If you are using i5/OS V5R3, is Cryptographic Access Provider (5722-AC3) installed on your systems? If you are using i5/OS V5R4, is Network Authentication Enablement (5722-NAE) installed on your systems? | |
| Is iSeries™ Access for Windows® (5722-XE1) installed on the administrator's PC and on your systems? | |
| Is the Security subcomponent of iSeries Navigator installed on the administrator's PC? | |
| Is the Network subcomponent of iSeries Navigator installed on the administrator's PC? | |
| Have you installed the latest IBM® eServer™ iSeries Access for Windows service pack? See the iSeries Access Web page for the latest service pack. | |
| Do you have *SECADM, *ALLOBJ, and *IOSYSCFG special authorities? | |
| Do you have one of the following installed on a secure system that will act as a Kerberos server? Which one?
| |
| For Windows 2000 Server and Windows Server 2003, do you have Windows Support Tools (which provides the ktpass tool) installed on the system being used as the key distribution center? | |
| If your Kerberos server is on a Windows 2000 or 2003 server, are all your PCs in your network configured in a Windows domain? | |
| Have you applied the latest program temporary fixes (PTFs)? | |
| Is the System i™ system time within five minutes of the Kerberos server's system time? If not see Synchronizing system times. |
| Questions | Answers |
|---|---|
| On which operating system do you plan to configure your Kerberos server?
| |
| What is the fully qualified domain name for the Kerberos server? | |
| Are times between the PCs and systems that connect to the Kerberos server synchronized? What is the maximum clock skew? |
| Questions | Answers |
|---|---|
| How many realms do you need? | |
| How do you plan to organize realms? | |
| What will be the naming convention used for realms? |
| Questions | Answers |
|---|---|
| What is the naming convention that you plan to use for Kerberos principals that represent users in your network? | |
| What is the naming convention for applications on your network? | |
| For which i5/OS services do you plan to use Kerberos authentication? | |
| What are the i5/OS principal names for each of these i5/OS services? |
| Question | Answer |
|---|---|
| Are the PCs and System i platform using the same DNS server to resolve host names? | |
| Are you using a local host table on the System i platform to resolve host names? | |
| Do your PC and your System i platform resolve the same host name for the System i platform? See Host name resolution considerations for assistance. |
The following planning work sheet illustrates the type of information you need before you begin configuring the Kerberos server in i5/OS PASE and network authentication service. All answers on the prerequisite work sheet should be answered before you proceed with configuring the Kerberos server in i5/OS PASE.
| Questions | Answers |
|---|---|
| Do you have PASE installed? | |
| What is the name of the default realm? | |
| What is the Kerberos server for this Kerberos default realm? What is the port on which the Kerberos server listens? | |
| What is the naming convention for your principals that represent users in your network? | |
| What are the principal names for your users in your network? |
Use the following planning work sheet to gather the information that you need before you begin configuring network authentication service. All answers on the prerequisite work sheet should be answered before you proceed with network authentication service configuration.
| Questions | Answers | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| What is the name of the Kerberos default realm to which your system will belong? A Windows 2000 domain is similar to a Kerberos realm. Microsoft® Active Directory uses Kerberos authentication as its default security mechanism.
| Are you using Microsoft Active Directory?
|
| What is the Kerberos server for this Kerberos default realm? What is the port on which the Kerberos server listens?
|
| Do you want to configure a password server for this default realm? If yes, answer the following questions:
| What is name of the password server for this Kerberos server?
| For which services do you want to create keytab entries?
|
| If you plan to create a service principal for i5/OS Kerberos Authentication, what is its password?
|
| If you plan to create a service principal for LDAP,
what is its password?
|
| If you plan to create a service principal for HTTP Server,
what is its password?
|
| If you plan to create a service principal for NetServer,
what is its password? | During the network authentication service wizard, several principals will be created for iSeries NetServer. Write these down here as they are displayed in the wizard. They will be needed when you add these principals to the Kerberos server.
| Do you want to create a batch file to automate adding the service principals to Microsoft Active Directory?
|
| Do you want to include passwords with the i5/OS service principals in the batch file?
| | |