120 lines
8.1 KiB
HTML
120 lines
8.1 KiB
HTML
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
|
<!DOCTYPE html
|
||
|
|
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||
|
|
<html lang="en-us" xml:lang="en-us">
|
||
|
|
<head>
|
||
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||
|
|
<meta name="security" content="public" />
|
||
|
|
<meta name="Robots" content="index,follow" />
|
||
|
|
<meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' />
|
||
|
|
<meta name="DC.Type" content="concept" />
|
||
|
|
<meta name="DC.Title" content="Lookup operation examples: Example 4" />
|
||
|
|
<meta name="abstract" content="Use this example to learn how the search flow works for a lookup operation that returns a target user identity in a user registry that is a member of a group registry definition." />
|
||
|
|
<meta name="description" content="Use this example to learn how the search flow works for a lookup operation that returns a target user identity in a user registry that is a member of a group registry definition." />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzalveservereimmaplookup.htm" />
|
||
|
|
<meta name="copyright" content="(C) Copyright IBM Corporation 2002, 2006" />
|
||
|
|
<meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 2002, 2006" />
|
||
|
|
<meta name="DC.Format" content="XHTML" />
|
||
|
|
<meta name="DC.Identifier" content="rzalvlookupoperationexamplesexample4" />
|
||
|
|
<meta name="DC.Language" content="en-us" />
|
||
|
|
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
||
|
|
<!-- US Government Users Restricted Rights -->
|
||
|
|
<!-- Use, duplication or disclosure restricted by -->
|
||
|
|
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
||
|
|
<link rel="stylesheet" type="text/css" href="./ibmdita.css" />
|
||
|
|
<link rel="stylesheet" type="text/css" href="./ic.css" />
|
||
|
|
<title>Lookup operation examples: Example 4</title>
|
||
|
|
</head>
|
||
|
|
<body id="rzalvlookupoperationexamplesexample4"><a name="rzalvlookupoperationexamplesexample4"><!-- --></a>
|
||
|
|
<img src="./delta.gif" alt="Start of change" /><!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script>
|
||
|
|
<h1 class="topictitle1">Lookup operation examples: Example 4</h1>
|
||
|
|
<div><p>Use this example to learn how the search flow works for a lookup
|
||
|
|
operation that returns a target user identity in a user registry that is a
|
||
|
|
member of a group registry definition.</p>
|
||
|
|
<p>An administrator wants to map a Windows<sup>®</sup> user to an i5/OS™ user profile.
|
||
|
|
Kerberos is the authentication method that Windows uses and the name of the Kerberos
|
||
|
|
registry as the administrator defined it in Enterprise Identity Mapping (EIM)
|
||
|
|
is<samp class="codeph"> Desktop_A</samp>. The user identity that the administrator wants
|
||
|
|
to map from is a Kerberos principal named <samp class="codeph">jday</samp>. The name
|
||
|
|
of the i5/OS registry
|
||
|
|
definition as the administrator defined it in EIM is <samp class="codeph">Group_1</samp> and
|
||
|
|
the user identity that the adminstrator wants to map to is a user profile
|
||
|
|
named <samp class="codeph">JOHND</samp> which exists in three individual registries: <samp class="codeph">System_B,
|
||
|
|
System_C, and System_D</samp>. Each of the individual registries is a member
|
||
|
|
of the <samp class="codeph">Group_1</samp> group registry definition. </p>
|
||
|
|
<p>The administrator creates an EIM identifier named John Day. He then adds
|
||
|
|
two associations to this EIM identifier: </p>
|
||
|
|
<ul><li>A source association for the Kerberos principal named <samp class="codeph">jday</samp> in
|
||
|
|
the <samp class="codeph">Desktop_A</samp> registry. </li>
|
||
|
|
<li>A target association for the i5/OS user profile named <samp class="codeph">JOHND</samp> in
|
||
|
|
the Group_1 <samp class="codeph"></samp>registry. </li>
|
||
|
|
</ul>
|
||
|
|
<p>This configuration allows a mapping lookup operation to map from the Kerberos
|
||
|
|
principal to the i5/OS user
|
||
|
|
profile as follows:</p>
|
||
|
|
|
||
|
|
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" frame="border" border="1" rules="all"><thead align="left"><tr><th valign="top" id="d0e79">Source user identity and registry</th>
|
||
|
|
<th valign="top" id="d0e81">---></th>
|
||
|
|
<th valign="top" id="d0e83">EIM Identifier</th>
|
||
|
|
<th valign="top" id="d0e85">---></th>
|
||
|
|
<th valign="top" id="d0e87">Target user identity</th>
|
||
|
|
</tr>
|
||
|
|
</thead>
|
||
|
|
<tbody><tr><td valign="top" headers="d0e79 "><samp class="codeph">jday </samp> in <samp class="codeph">Desktop_A </samp> registry</td>
|
||
|
|
<td valign="top" headers="d0e81 ">---></td>
|
||
|
|
<td valign="top" headers="d0e83 "><samp class="codeph">John Day</samp></td>
|
||
|
|
<td valign="top" headers="d0e85 ">---></td>
|
||
|
|
<td valign="top" headers="d0e87 "><samp class="codeph">JOHND</samp> (in <samp class="codeph">Group_1</samp> group
|
||
|
|
registry definition)</td>
|
||
|
|
</tr>
|
||
|
|
</tbody>
|
||
|
|
</table>
|
||
|
|
</div>
|
||
|
|
<p>The lookup operation search flows in this manner:</p>
|
||
|
|
<ol><li>The user (<samp class="codeph">jday</samp>) logs on and authenticates to Windows on <samp class="codeph">Desktop_A</samp>.</li>
|
||
|
|
<li>The user opens iSeries™ Navigator to access data on <samp class="codeph">System_B</samp>. </li>
|
||
|
|
<li>i5/OS uses
|
||
|
|
an EIM API to perform an EIM lookup operation with a source user identity
|
||
|
|
of <samp class="codeph">jday</samp>, a source registry of <samp class="codeph">Desktop_A</samp>,
|
||
|
|
and a target registry of System_B. </li>
|
||
|
|
<li>The EIM lookup operation checks whether mapping lookups are enabled for
|
||
|
|
the source registry (<samp class="codeph">Desktop_A</samp>) and target registry (<samp class="codeph">System_B</samp>). </li>
|
||
|
|
<li>The lookup operation checks for a specific individual source association
|
||
|
|
that matches the supplied source user identity of <samp class="codeph">jday</samp> in
|
||
|
|
a source registry of <samp class="codeph">Desktop_A</samp>. </li>
|
||
|
|
<li>The lookup operation uses the matching source association to determine
|
||
|
|
the appropriate EIM identifier name, which is <samp class="codeph">John Day</samp>. </li>
|
||
|
|
<li>The lookup operation uses this EIM identifier name to search for an individual
|
||
|
|
target association for the EIM identifier that matches the specified target
|
||
|
|
EIM registry definition name of <samp class="codeph">System_B</samp>. (There is none.) </li>
|
||
|
|
<li>The lookup operation checks to see if the source registry (<samp class="codeph">Desktop_A</samp>)
|
||
|
|
is a member of any group registry definitions. (It is not.) </li>
|
||
|
|
<li>The lookup operation checks to see if the target registry (<samp class="codeph">System_B</samp>)
|
||
|
|
is a member of any group registry definitions. It is a member of the <samp class="codeph">Group_1</samp> group
|
||
|
|
registry definition. </li>
|
||
|
|
<li>The lookup operation uses the EIM identifier name to search for an individual
|
||
|
|
target association for the EIM identifier that matches the specified target
|
||
|
|
EIM registry definition name of <samp class="codeph">Group_1</samp>. </li>
|
||
|
|
<li>There is such an individual target association and the lookup operation
|
||
|
|
returns the target user identity of <samp class="codeph">JOHND</samp> as defined in the
|
||
|
|
target association. </li>
|
||
|
|
</ol>
|
||
|
|
<div class="note"><span class="notetitle">Note:</span> In some cases, the EIM lookup operation returns <a href="rzalvambiguousgroupregistry.htm">ambiguous
|
||
|
|
results </a>when more than one target user identity matches the specified
|
||
|
|
lookup operation criteria. Because EIM cannot return a single target user
|
||
|
|
identity, EIM-enabled applications, including i5/OS applications and products, that are
|
||
|
|
not designed to handle these <a href="rzalvambiguousgroupregistry.htm">ambiguous
|
||
|
|
results</a> may fail or give unexpected results. You may need to take action
|
||
|
|
to resolve this situation. For example, you may need to either change your
|
||
|
|
EIM configuration or define <a href="rzalvaddlookupinfo.htm">lookup information</a> for
|
||
|
|
each target user identity to prevent multiple matching target user identities.
|
||
|
|
You can <a href="rzalvtestmappings.htm">test a mapping</a> to determine
|
||
|
|
whether the changes you make work as expected.</div>
|
||
|
|
</div>
|
||
|
|
<div>
|
||
|
|
<div class="familylinks">
|
||
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="rzalveservereimmaplookup.htm" title="This information explains the process for Enterprise Identity Mapping (EIM) mapping and view examples.">EIM lookup operations</a></div>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<img src="./deltaend.gif" alt="End of change" /></body>
|
||
|
|
</html>
|