Network authentication service

Network authentication service allows the iSeries™ server and several iSeries services, such as iSeries eServer™ Access for Windows^®, to use a Kerberos ticket as an optional replacement for a user name and password for authentication.

A user authenticates with a principal and a password that is stored in the Kerberos server. Once a principal is authenticated, the Kerberos server issues a ticket-granting ticket (TGT) to the user. When a user needs access to an application or service on the network, the Kerberos client application on the user's PC sends the TGT back to the Kerberos server to obtain a service ticket for the target service or application. The Kerberos client application then sends the service ticket to the service or application for authentication. Once the service or application accepts the ticket a security context is established and the user's application can then exchange data with a target service. Applications can authenticate a user and securely forward his or her identity to other services on the network. Once a user is known, separate functions are needed to verify the user's authorization to use the network resources.

Network authentication service implements the following specifications:

• Kerberos Version 5 protocol Request for Comment (RFC) 1510
• Many of the de facto standard Kerberos protocol application programming interfaces (APIs) prevalent in the industry today
• Generic Security Service (GSS) APIs as defined by RFCs 1509, 1964, and 2743

i5/OS™ implementation of network authentication service operates with authentication, delegation, and data confidentiality services compliant with these RFCs and Microsoft's Windows 2000 Security Service Provider Interface (SSPI) APIs. Microsoft^® Windows Active Directory uses Kerberos as its default security mechanism. When users are added to Microsoft Windows Active Directory, their Windows identification is equivalent to a Kerberos principal. Network authentication service provides for interoperability with Microsoft Windows Active Directory and its implementation of the Kerberos protocol.

• What's new for V5R4
  This topic highlights changes to network authentication service for V5R4.
• Printable PDF
  Use this to view and print a PDF of this information.
• Concepts
  Network authentication service supports Kerberos protocols and Generic Security Service (GSS) APIs that provide user authentication in a network.
• Scenarios
  Use these scenarios to learn about network authentication service.
• Plan network authentication service
  Before implementing network authentication service or a Kerberos solution on your network it is essential to complete the necessary planning tasks.
• Configure network authentication service
  Network authentication service allows the iSeries server to participate in an existing Kerberos network. As such, network authentication service assumes you have a Kerberos server configured on a secure system in your network.
• Manage network authentication service
  Manage network authentication service by requesting tickets, working with key table files, and administering host name resolution. You can also work with credentials files and back up configuration files.
• Troubleshoot
  This section provides links to troubleshooting information about common problems for network authentication service, Enterprise Identity Mapping (EIM), and IBM-supplied applications that support Kerberos authentication.
• Network authentication service commands
  Use these commands to configure and use network authentication service.
• Related information for network authentication service
  Listed below are several related Information Center topics as well as external web sites that relate to network authentication service.
• Special terms and conditions
  This information contains special terms, conditions, and trademarks applicable to network authentication service.