Test authentication on the endpoint systems

Once the servers have been restarted, the systems will be using Kerberos for authentication and the trusted group for authorization. For a system to accept and carry out a request, that system will verify not only that the requesting system has a valid Kerberos principal, but also that it trusts that Kerberos principal by checking if that principal is in its trusted group list.

Note: You need to repeat these steps on each of the target systems, using the following i5/OS™ service principals:

krbsvr400/iseriesa.myco.com@MYCO.COM
krbsvr400/iseriesb.myco.com@MYCO.COM
krbsvr400/iseriesc.myco.com@MYCO.COM
krbsvr400/iseriesd.myco.com@MYCO.COM

To verify that Kerberos authentication is working on the endpoint systems, complete the following tasks:

Note: Be sure you have created a home directory for your i5/OS user profile before performing these tasks.

Close any sessions of iSeries™ Navigator.
On a command line, enter QSH to start the Qshell Interpreter.

Enter keytab list to display a list of principals registered in the keytab file. You should see results that are similar to this display:

Principal: krbsvr400/iseriesa.myc.com@MYCO.COM      
  Key version: 2                                                       
  Key type: 56-bit DES using key derivation                            
  Entry timestamp: 200X/05/29-11:02:58

Enter kinit -k krbsvr400/iseriesa.myco.com@MYCO.COM to request a ticket-granting ticket from the Kerberos server. This command verifies that your iSeries server has been configured properly and the password in the keytab file matches the password stored on the Kerberos server. If this is successful then the QSH command will display without errors.

Enter klist to verify that the default principal is krbsvr400/iseriesa.myco.com@MYCO.COM. This command displays the contents of a Kerberos credentials cache and verifies that a valid ticket has been created for the i5/OS service principal and placed within the credentials cache on the iSeries system.

 Ticket cache: FILE:/QIBM/USERDATA/OS400/NETWORKAUTHENTICATION/creds/krbcred
                                                                    
 Default principal: krbsvr400/iseriesa.myco.com@MYCO.COM  
                                                                            
Server: krbtgt/MYCO.COM@MYCO.COM              
  Valid 200X/06/09-12:08:45 to 20XX/11/05-03:08:45                          
$

You have now completed the tasks required to configure your Management Central server jobs to use Kerberos authentication between endpoint systems.