Domains

Use this information to learn about the differences between EIM domains and Windows^® domains, both of which are part of a single signon environment.

Two types of domains play key roles in the single signon environment: EIM domain and Windows 2000 domain. Although both of these terms contain the word domain, these entities have very different definitions. Use the following descriptions to understand the differences between these two types of domains.

EIM domain

An EIM domain is a collection of data, which includes the EIM identifiers, EIM associations, and EIM user registry definitions that are defined in that domain. This data is stored in a Lightweight Directory Access Protocol (LDAP) server, such as the IBM^® Directory Server for iSeries™, which can run on any system in the network, defined in that domain. Administrators can configure systems (EIM clients), such as i5/OS^®, to participate in the domain so that systems and applications can use domain data for EIM lookup operations and identity mapping.

Windows 2000 domain

In the context of single signon, a Windows 2000 domain is a Windows network that contains several systems operating as clients and servers and a variety of services and applications used by the systems. The following are some of the components pertinent to single signon that you may find within a Windows 2000 domain:

Realm

A realm is a collection of machines and services. The main purpose of a realm is to authenticate clients and services. Each realm uses a single Kerberos server to manage the principals for that particular realm.

Kerberos server

A Kerberos server, also known as a key distribution center (KDC), is a network service that resides on the Windows 2000 server and provides tickets and temporary session keys for network authentication service. The Kerberos server maintains a database of principals (users and services) and their associated secret keys. It is composed of the authentication server and the ticket granting server. A Kerberos server uses Microsoft^® Windows Active Directory to store and manage the information in a Kerberos user registry.

Microsoft Windows Active Directory

Microsoft Windows Active Directory is an LDAP server that resides on the Windows 2000 server along with the Kerberos server. The Active Directory is used to store and manage the information in a Kerberos user registry. Microsoft Windows Active Directory uses Kerberos authentication as its default security mechanism. Therefore, if you are using Microsoft Active Directory to manage your users, you are already using Kerberos technology.

Parent topic: