Add iSeries A service principal to the Kerberos server

You can use one of two methods to add the necessary i5/OS™ service principal to the Kerberos server. You can manually add the service principal or, as this scenario illustrates, you can use a batch file to add it. You created this batch file in Step 2. To use this file, you can use File Transfer Protocol (FTP) to copy the file to the Kerberos server and run it.

Follow these steps to use the batch file to add principals to the Kerberos server:

FTP batch file created by the wizard

  1. On the Windows® 2000 workstation that you used to configure network authentication service, open a command prompt and type ftp kdc1.myco.com to start an FTP session on your PC. You will be prompted for the administrator's user name and password.
  2. At the FTP prompt, enter lcd "C:\Documents and Settings\All Users\Documents\IBM\Client Access". Press Enter. You should receive the message Local directory now C:\Documents and Settings\All Users\Documents\IBM\Client Access.
  3. At the FTP prompt, type cd \mydirectory, where mydirectory is a directory located on kdc1.myco.com.
  4. At the FTP prompt, type put NASConfigiseriesa.bat. You should receive this message: 226 Transfer complete.
  5. Type quit to exit the FTP session.
Run the batch file on kdc1.myco.com
  1. On your Windows 2000 server, open the directory where you transferred the batch file.
  2. Find the NASConfigiseriesa.bat file and double-click the file to run it.
  3. After the file runs, verify that the i5/OS principal has been added to the Kerberos server by completing the following:
    1. On your Windows 2000 server, expand Administrative Tools > Active Directory Users and Computers > Users.
    2. Verify the iSeries™ has a user account by selecting the appropriate Windows 2000 domain.
      Note: This Windows 2000 domain should be the same as the default realm name that you specified in the network authentication service configuration.
    3. In the list of users that is displayed, find iseriesa_1_krbsvr400. This is the user account generated for the i5/OS principal name.
    4. (Optional) Access the properties on your Active Directory user. From the Account tab, select the Account is trusted for delegation.
      Note: This optional step enables your system to delegate, or forward, a user's credentials to other systems. As a result, the i5/OS service principal can access services on multiple systems on behalf of the user. This is useful in a multi-tier network.

Now that you have added the iSeries A service principal to the Kerberos server, you can create a home directory for John Day.

Parent topic: Scenario: Create a single signon test environment
Previous topic: Create a basic single signon configuration for iSeries A
Next topic: Create home directory for John Day on iSeries A