Use these worksheets to ensure that you have met all of the prerequisites for single signon and that you have considered all of the aspects of your particular system and its security requirements.
Before you use these configuration planning worksheets, you need to plan your overall single signon implementation. Use these configuration planning worksheets to ensure that you have met all of the prerequisites, and that you have taken into consideration all of the aspects of your particular iSeries™ system.
This detailed work sheet is provided to help you ensure that you meet all hardware and software prerequisites for implementing single signon. To ensure a successful implementation, be able to answer Yes to all prerequisite items in the work sheet and you should gather all the information necessary to complete the work sheets before you perform any configuration tasks.
| Prerequisite work sheet | Answers | ||||||||||||||
| Is your i5/OS® V5R4 (5722-SS1)? | |||||||||||||||
| Are the following options and licensed products installed on your server?
| |||||||||||||||
| Have you installed an application that is enabled for single signon on each of the PCs that will participate in the single signon environment? For the scenarios in this information, all of the PCs have iSeries Access for Windows (5722-XE1) installed.
| Is iSeries Navigator installed on the administrator's PC?
|
| Have you installed the latest iSeries Access for Windows service pack? For the latest service pack see iSeries Access.
|
| Do you, the administrator, have *SECADM,
*ALLOBJ, and *IOSYSCFG special authorities?
|
| Do you have one of the following systems acting as the Kerberos server (also known as the KDC)? If yes, specify which system.
|
|
This is a configuration planning worksheets, designed to ensure that you have met all of the hardware and software prerequisites for single signon. Additionally, this worksheet ensures that you have completed those Enterprise Identity Mapping (EIM) and network authentication service configuration tasks that are required for a successful single signon environment.
The single signon configuration planning worksheet is designed to assist you with the implementation of a single signon environment based on Enterprise Identity Mapping (EIM) and network authentication services. If you intend to use a different authentication mechanism, such as IBM® Directory Server for System i™ (LDAP) or digital certificates, you may need to adapt portions of this work sheet to better suit your needs.
| Configuration planning work sheet | Answers | ||||||||||||||||||||||||||||||||||||||||||
| Use the following information to complete the EIM Configuration wizard: | |||||||||||||||||||||||||||||||||||||||||||
| How do you want to configure EIM for your system?
| |||||||||||||||||||||||||||||||||||||||||||
| Where do you want to configure your EIM domain? | |||||||||||||||||||||||||||||||||||||||||||
| Do you want to configure network authentication service? | |||||||||||||||||||||||||||||||||||||||||||
| The Network Authentication Service wizard launches from the EIM Configuration wizard. Use the following information to complete the Network Authentication Service wizard: The Network Authentication Service wizard can also be launched independently of the EIM Configuration wizard. What is the name of the Kerberos default realm to which your iSeries will belong? | A Windows 2000 domain is similar to a Kerberos realm. Microsoft Windows Active Directory uses Kerberos authentication as its default security mechanism.
| Are you using Microsoft Active Directory?
|
| What is the Kerberos server, also known as a key distribution center (KDC), for this Kerberos default realm? What is the port on which the Kerberos server listens?
|
| Do you want to configure a password server for this default realm? If yes, answer the following questions:
| What is name of the password server for this Kerberos server?
| For which services do you want to create keytab entries?
|
| What is the password for your service principal or principals?
|
| Do you want to create a batch file to automate adding the service principals for System A to the Kerberos registry?
|
| Do you want to include passwords with the i5/OS service principals in the batch file?
|
| As you exit the Network Authentication Service wizard, you will return to the EIM Configuration wizard. Use the following information to complete the EIM Configuration wizard:
| Specify user information that the wizard should use when configuring the directory server. This is the connection user. You must specify the port number, administrator distinguished name, and a password for the administrator.
|
| What is the name of the EIM domain that you want to create?
|
| Do you want to specify a parent DN for the EIM domain?
|
| Which user registries do you want to add to the EIM domain?
|
| Which EIM user do you want System A to use when performing EIM operations? This is the system user.
|
| After you complete the EIM Configuration wizard, use the following information to complete the remaining steps required for configuring single signon:
| What is the i5/OS user profile name for the user?
|
| What is the name of the EIM identifier that you want to create?
|
| What kinds of associations do you want to create?
|
| What is the name of the user registry that contains the Kerberos principal for which you are creating the source association?
|
| What is the name of the user registry that contains the i5/OS user profile for which you are creating the target association?
|
| What information do you need to supply to test EIM identity mapping?
| | | |||