Scenario: Set up cross realm trust

Use the following scenario to become familiar with the prerequisites and objectives of setting up cross realm trust on your network.

Situation

You are a security administrator for a large wholesale company. Currently you manage security for systems used by employees of the Order Receiving Department and the Shipping Department. You have configured a Kerberos server for the Order Receiving Department. You have configured network authentication service on the iSeries™ system in that department to point to that Kerberos server. The Shipping Department consists of an iSeries system that has a Kerberos server configured in i5/OS™ PASE. You have also configured network authentication service on this iSeries system to point to the Kerberos server in i5/OS PASE.

Since users in both realms need to use services stored on iSeries systems located in each department, you want both of the Kerberos servers in each department to authenticate users regardless of which Kerberos realm they are located in.

Objectives

In this scenario, MyCo, Inc. wants to establish a trust relationship between two already existing Kerberos realms. One realm consists of a Windows® 2000 server acting as the Kerberos server for the Order Receiving Department. This server authenticates users within that department to services located on an iSeries server. The other realm consists of a Kerberos server configured in i5/OS PASE on one iSeries, which provides services for the users within the Shipping Department. Your users need to be authenticated to services in both departments.

The objectives of this scenario are as follows:
  • To give clients and hosts on each network access to the other's network
  • To simplify authentication across networks
  • To allow ticket delegation for users and services in both networks

Details

Detailed description of the environment that this scenario describes, including a figure that shows the topology and all major elements of that environment and how they relate to each other.


Cross realm trust diagram

Order Receiving Department

iSeries A

Windows 2000 server

Client PCs

Shipping Department

iSeries B

Client PCs

Note: Start of changeThe KDC server name, kdc1.myco.com, and the hostname, iseriesa.myco.com are fictitious names used in this scenario.End of change

Prerequisites and assumptions

In this scenario, the following assumptions have been made to focus on the tasks that involve establishing a trust relationship between two pre-existing Kerberos realms.

iSeries A prerequisites
  1. All system requirements, including software and operating system installation, have been verified.
    To verify that the required licensed programs have been installed, complete the following:
    1. In iSeries Navigator, expand your iSeries server > Configuration and Service > Software > Installed Products.
    2. Ensure that all the necessary licensed programs are installed.
  2. All necessary hardware planning and setup have been completed.
  3. TCP/IP and basic system security have been configured and tested on iSeries A.
  4. Network authentication service has been configured and tested.
  5. A single DNS server is used for host name resolution for the network. Host tables are not used for host name resolution.
    Note: The use of host tables with Kerberos authentication may result in name resolution errors or other problems. For more detailed information about how host name resolution works with Kerberos authentication, see Host name resolution considerations.
iSeries B prerequisites
  1. All system requirements, including software and operating system installation, have been verified.
    To verify that the required licensed programs have been installed, complete the following:
    1. In iSeries Navigator, expand your iSeries server > Configuration and Service > Software > Installed Products.
    2. Ensure that all the necessary licensed programs are installed.
  2. All necessary hardware planning and setup have been completed.
  3. TCP/IP and basic system security have been configured and tested on your iSeries server.
  4. Network authentication service has been configured and tested.
Windows 2000 server prerequisites
  1. All necessary hardware planning and setup have been completed.
  2. TCP/IP has been configured and tested on your server.
  3. Microsoft Active Directory has been configured and tested.
  4. Each user within the Order Department has been defined in Microsoft Active Directory with a principal name and password.

Configuration steps

To set up a trust relationship between two realms, complete these steps.

  1. Complete the planning work sheets
  2. Ensure that the Kerberos server in i5/OS PASE on iSeries B has started
  3. Create realm trust principal on the i5/OS PASE Kerberos server
  4. Change encryption values on i5/OS PASE Kerberos server
  5. Configure the Windows 2000 server to trust SHIPDEPT.MYCO.COM
  6. Add the SHIPDEPT.MYCO.COM realm to iSeries A
Parent topic: Scenarios