Scenario: Enable single signon for i5/OS

Use the following scenario to become familiar with the prerequisites and objectives for enabling single signon for i5/OS™.

Situation

You are a network administrator that manages a network and network security for your company, including the Order Receiving department. You oversee the IT operations for a large number of employees who take customer orders over the telephone. You also supervise two other network administrators who help you maintain the network.

The employees in the Order Receiving department use Windows® 2000 and i5/OS and require multiple passwords for the different applications they use every day. Consequently, you spend a lot of time managing and troubleshooting problems related to passwords and user identities, such as resetting forgotten passwords.

As the company's network administrator, you are always looking for ways to improve the business, starting with the Order Receiving department. You know that most of your employees need the same type of authority to access the application that they use to query inventory status. It seems redundant and time consuming for you to maintain individual user profiles and numerous passwords that are required in this situation. In addition, you know that all of your employees can benefit by using fewer user IDs and passwords. You want to do these things:
  • Simplify the task of password management for the Order Receiving department. Specifically, you want to efficiently manage user access to the application your employees routinely use for customer orders.
  • Decrease the use of multiple user IDs and passwords for the department employees, as well as for the network administrators. However, you do not want to make the Windows 2000 IDs and i5/OS user profiles the same nor do you want to use password caching or synching.
Based on your research, you know that i5/OS supports single signon, a solution that allows your users to log on once to access multiple applications and services that normally require them to log on with multiple user IDs and passwords. Because your users do not need to provide as many user IDs and passwords to do their jobs, you have fewer password problems to solve for them. Single signon seems to be an ideal solution because it allows you to simplify password management in the following ways:
  • For typical users that require the same authority to an application, you can create policy associations. For example, you want the order clerks in the Order Receiving department to be able to log on once with their Windows user name and password and then be able to access a new inventory query application in the manufacturing department without having to be authenticated again. However, you also want to ensure that the level of authorization that they have when using this application is appropriate. To attain this goal, you decide to create a policy association that maps the Windows 2000 user identities for this group of users to a single i5/OS user profile that has the appropriate level of authority for running the inventory query application. Because this is a query-only application in which users cannot change data, you are not as concerned about detailed auditing for this application. Consequently, you feel confidant that using a policy association in this situation conforms to your security policy.

    You create a policy association to map the group of order clerks with similar authority requirements to a single i5/OS user profile with the appropriate level of authority for the inventory query application. Your users benefit by having one less password to remember and one less logon to perform. As the administrator, you benefit by having to maintain only one user profile for user access to the application instead of multiple user profiles for everyone in the group.

  • For each of your network administrators who have user profiles with special authorities, such as *ALLOBJ and *SECADM, you can create identifier associations. For example, you want all of the user identities for a single network administrator to be precisely and individually mapped to one another because of the administrator's high level of authority.

    Based on your company's security policy, you decide to create identifier associations to map specifically from each network administrator's Windows identity to his i5/OS user profile. You can more easily monitor and trace the activity of the administrator because of the one-to-one mapping that identifier associations provide. For example, you can monitor the jobs and objects that run on the system for a specific user identity. Your network administrator benefits by having one less password to remember and one less logon to perform. As the network administrator, you benefit by tightly controlling the relationships between all of your administrator's user identities.

This scenario has the following advantages:
  • Simplifies authentication process for users.
  • Simplifies managing access to applications.
  • Eases the overhead of managing access to servers in the network.
  • Minimizes the threat of password theft.
  • Avoids the need for multiple signons.
  • Simplifies user identity management across the network.

Objectives

In this scenario, you are the administrator at MyCo, Inc. who wants to enable single signon for the users in the Order Receiving department.

The objectives of this scenario are as follows:

Details

The following figure illustrates the network environment for this scenario.


Single signon environment diagram

The figure illustrates the following points relevant to this scenario.

EIM domain data defined for the enterprise
  • Three registry definition names:
    • A registry definition name of MYCO.COM for the Windows 2000 server registry. You will define this when you use the EIM configuration wizard on iSeries A.
    • A registry definition name of ISERIESA.MYCO.COM for the i5/OS registry on iSeries A. You will define this when you use the EIM configuration wizard on iSeries A.
    • A registry definition name of ISERIESB.MYCO.COM for the i5/OS registry on iSeries B. You will define this when you use the EIM configuration wizard on iSeries B.
  • Two default registry policy associations:
    Note: EIM lookup operation processing assigns the highest priority to identifier associations. Therefore, when a user identity is defined as a source in both a policy association and an identifier association, only the identifier association maps that user identity. In this scenario, two network administrators, John Day and Sharon Jones, both have user identities in the MYCO.COM registry, which is the source of the default registry policy associations. However, as shown below, these administrators also have identifier associations defined for their user identities in the MYCO.COM registry. The identifier associations ensure that their MYCO.COM user identities are not mapped by the policy associations. Instead, the identifier associations ensure that their user identities in the MYCO.COM registry are individually mapped to other specific individual user identities.
    • One default registry policy association maps all user identities in the Windows 2000 server registry called MYCO.COM, to a single i5/OS user profile called SYSUSERA in the ISERIESA.MYCO.COM registry on iSeries A. For this scenario, mmiller and ksmith represent two of these user identities.
    • One default registry policy association maps all user identities in the Windows 2000 server registry called MYCO.COM, to a single i5/OS user profile called SYSUSERB in the ISERIESB.MYCO.COM registry on iSeries B. For this scenario, mmiller and ksmith represent two of these user identities.
  • Two EIM identifiers named John Day and Sharon Jones to represent the two network administrators in the company who have those names.
  • For the John Day EIM identifier, these identifier associations are defined:
    • A source association for the jday user identity, which is a Kerberos principal in the Windows 2000 server registry.
    • A target association for the JOHND user identity, which is a user profile in the i5/OS registry on iSeries A.
    • A target association for the DAYJO user identity, which is a user profile in the i5/OS registry on iSeries B.
  • For the Sharon Jones EIM identifier, these identifier associations are defined:
    • A source association for the sjones user identity, which is a Kerberos principal in the Windows 2000 server registry.
    • A target association for the SHARONJ user identity, which is a user profile in the i5/OS registry on iSeries A.
    • A target association for the JONESSH user identity, which is a user profile in the i5/OS registry on iSeries B.
Windows 2000 server
  • Acts as the Kerberos server (kdc1.myco.com), also known as a key distribution center (KDC), for the network.
  • The default realm for the Kerberos server is MYCO.COM.
  • All Microsoft® Windows Active Directory users that do not have identifier associations are mapped to a single i5/OS user profile on each of the iSeries systems.
iSeries A
  • Start of changeRuns i5/OS Version 5 Release 3 (V5R3) or later with the following options and licensed products installed:End of change
    • i5/OS Host Servers (5722-SS1 Option 12)
    • Qshell Interpreter (5722-SS1 Option 30)
    • iSeries Access for Windows (5722-XE1)
    • Start of changeNetwork Authentication Enablement (5722-NAE) if you are using V5R4End of change
    • Start of changeCryptographic Access Provider (5722-AC3) if you are using V5R3End of change
    Note: You can implement this scenario using a server that runs V5R2. However, some of the configuration steps will be slightly different. In addition, this scenario demonstrates some of the single signon function that is only available in V5R3 Start of changeand laterEnd of change, such as policy associations.
  • The directory server on iSeries A will be configured to be the EIM domain controller for the new EIM domain, MyCoEimDomain.
  • Participates in the EIM domain, MyCoEimDomain.
  • Has the service principal name of krbsvr400/iseriesa.myco.com@MYCO.COM.
  • Has the fully qualified host name of iseriesa.myco.com. This name is registered in a single Domain Name System (DNS) to which all PCs and servers in the network point.
  • Home directories on iSeries A store the Kerberos credentials caches for i5/OS user profiles.
iSeries B
  • Start of changeRuns i5/OS Version 5 Release 3 (V5R3) or later with the following options and licensed products installed:End of change
    • i5/OS Host Servers (5722-SS1 Option 12)
    • Qshell Interpreter (5722-SS1 Option 30)
    • iSeries Access for Windows (5722-XE1)
    • Start of changeNetwork Authentication Enablement (5722-NAE) if you are using V5R4 or laterEnd of change
    • Start of changeCryptographic Access Provider (5722-AC3) if you are running V5R3End of change
  • Has the fully qualified host name of iseriesb.myco.com. This name is registered in a single Domain Name System (DNS) to which all PCs and servers in the network point.
  • The principal name for iSeries B is krbsvr400/iseriesb.myco.com@MYCO.COM.
  • Participates in the EIM domain, MyCoEimDomain.
  • Home directories on iSeries B store the Kerberos credentials caches for i5/OS user profiles.
Administrative PC
  • Runs Microsoft Windows 2000 operating system.
  • Runs iSeries Access for Windows (5722-XE1).
  • Runs iSeries Navigator with the following subcomponents installed:
    • Network
    • Security
    • Users and Groups
  • Serves as the primary logon system for the administrator.
  • Configured to be part of the MYCO.COM realm (Windows domain).
Note: Start of changeThe KDC server name, kdc1.myco.com, and the hostname, iseriesa.myco.com are fictitious names used in this scenario.End of change

Prerequisites and assumptions

Successful implementation of this scenario requires that the following assumptions and prerequisites are met:

  1. All system requirements, including software and operating system installation, have been verified.
    To verify that these licensed programs have been installed, complete the following:
    1. In iSeries Navigator, expand your iSeries server > Configuration and Service > Software > Installed Products.
    2. Ensure that all the necessary licensed programs are installed.
  2. All necessary hardware planning and setup are complete.
  3. TCP/IP and basic system security are configured and tested on each system.
  4. The directory server and EIM should not be previously configured on iSeries A.
    Note: Instructions in this scenario are based on the assumption that the directory server has not been previously configured on iSeries A. However, if you already configured the directory server, you can still use these instructions with only slight differences. These differences are noted in the appropriate places within the configuration steps.
  5. A single DNS server is used for host name resolution for the network. Host tables are not used for host name resolution.
    Note: The use of host tables with Kerberos authentication may result in name resolution errors or other problems. For more detailed information about how host name resolution works with Kerberos authentication, see Host name resolution considerations.

Configuration steps

Note: You need to thoroughly understand the concepts related to single signon, which include network authentication service and Enterprise Identity Mapping (EIM) concepts, before you implement this scenario. See the following information to learn about the terms and concepts related to single signon:

To configure single signon on your system, complete these steps.

  1. Complete the planning work sheets
  2. Create a basic single signon configuration for iSeries A
  3. Configure iSeries B to participate in the EIM domain and configure iSeries B for network authentication service
  4. Add both i5/OS service principals to the Kerberos server
  5. Create user profiles on iSeries A and iSeries B
  6. Create home directories on iSeries A and iSeries B
  7. Test network authentication service on iSeries A and iSeries B
  8. Create EIM identifiers for two administrators, John Day and Sharon Jones
  9. Create identifier associations for John Day
  10. Create identifier associations for Sharon Jones
  11. Create default registry policy associations
  12. Enable registries to participate in lookup operations and to use policy associations
  13. Test EIM identity mappings
  14. Configure iSeries Access for Windows applications to use Kerberos authentication
  15. Verify network authentication service and EIM configuration
  16. Post configuration considerations
Parent topic: Scenarios