In this scenario, you want to configure network authentication service and EIM to create a basic single signon test environment. Use this scenario to gain a basic understanding of what configuring a single signon environment involves on a small scale before implementing single signon across an entire enterprise.
You, John Day, are a network administrator for a large wholesale company. Currently you spend much of your time troubleshooting password and user identity problems, such as forgotten passwords. Your network is comprised of several System i™ models and a Windows® 2000 server, where your users are registered in Microsoft® Windows Active Directory. Based on your research, you know that Microsoft Active Directory uses the Kerberos protocol to authenticate Windows users. You also know that the System i platform provides a single signon solution based on an implementation of Kerberos authentication, called network authentication service, in conjunction with EIM.
You are excited about the benefits of using single signon. However, you want to thoroughly understand single signon configuration and usage before you begin using it across your entire enterprise. Consequently, you decide to configure a test environment first.
After considering the various groups in your company, you decide to create the test environment for the Order Receiving department. The employees in the Order Receiving department use multiple applications on one System i model to handle incoming customer orders. Consequently, the Order Receiving department provides an excellent opportunity for you to create a single signon test environment that you can use to better understand how single signon works and how to plan a single signon implementation across your enterprise.
As the network administrator at MyCo, Inc., you want to create a small single signon environment for testing that includes a small number of users and a single System i model. You want to perform thorough testing to ensure that user identities are correctly mapped within your test environment. Based on this configuration, you eventually want to expand the test environment to include the other systems and users in your enterprise.
The objectives of this scenario are as follows:
Refer to Domains to learn how an EIM domain and a Windows 2000 domain both fit into the single signon environment.
The following figure illustrates the network environment for this scenario.
The figure illustrates the following points relevant to this scenario.
EIM domain data defined for the enterprise
Windows 2000 server
System A
You can implement this scenario using a server that runs OS/400® V5R2 or i5/OS V5R3. However, some of the configuration steps will be slightly different due to i5/OS V5R4 enhancements.
Client PC used for single signon administration
Successful implementation of this scenario requires that the following assumptions and prerequisites are met:
To verify that the licensed programs have been installed, complete the following:
Instructions in this scenario are based on the assumption that the directory server has not been previously configured on System A. However, if you already configured the directory server, you can still use these instructions with only slight differences. These differences are noted in the appropriate places within the configuration steps.
The use of host tables with Kerberos authentication may result in name resolution errors or other problems..
You need to thoroughly understand the concepts related to single signon which include network authentication service and Enterprise Identity Mapping (EIM) concepts, before you implement this scenario. If you are ready to continue with this scenario complete the following steps: