You want to have all your Microsoft® Active Directory users on
the Windows® 2000
server map to the user profile, SYSUSERA, on iSeries™ A and to the user profile, SYSUSERB,
on iSeries B.
Fortunately,
you can use policy associations to create mappings directly between a group
of users and a single target user identity. In this case, you can create a
default registry policy association the maps all the user identities (for
which no identifier associations exist) in the MYCO.COM Kerberos registry
to a single i5/OS™ user
profile on iSeriesA.
You need two policy associations to accomplish
this goal. Each policy association uses the MYCO.COM user registry definition
as the source of the association. However, each policy association maps user
identities in this registry to different target user identities, depending
on which iSeries system
the Kerberos user accesses:
- One policy association maps the Kerberos principals in the MYCO.COM user
registry to a target user of SYSUSERA in the target registry of ISERIESA.MYCO.COM.
- The other policy association maps the Kerberos principals in the MYCO.COM
user registry to a target user of SYSUSERB in the target registry of ISERIESB.MYCO.COM.
Use the information from your planning works sheets to create
two default registry policy associations.
Note: Before you can use policy
associations, you must first enable the domain to use policy associations
for mapping lookup operations. You can do this as part of the process for
creating your policy associations, as follows: