<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us" xml:lang="en-us"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="security" content="public" /> <meta name="Robots" content="index,follow" /> <meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' /> <meta name="DC.Type" content="task" /> <meta name="DC.Title" content="Join an existing domain" /> <meta name="abstract" content="This information explains how you can use the Enterprise Identity Mapping (EIM) Configuration wizard on one iSeries system to configure a domain controller and create an EIM domain, then use the wizard to configure other iSeries servers to participate in the domain." /> <meta name="description" content="This information explains how you can use the Enterprise Identity Mapping (EIM) Configuration wizard on one iSeries system to configure a domain controller and create an EIM domain, then use the wizard to configure other iSeries servers to participate in the domain." /> <meta name="DC.Relation" scheme="URI" content="rzalvcnfg.htm" /> <meta name="copyright" content="(C) Copyright IBM Corporation 2002, 2006" /> <meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 2002, 2006" /> <meta name="DC.Format" content="XHTML" /> <meta name="DC.Identifier" content="rzalvcnfgconfigwizard" /> <meta name="DC.Language" content="en-us" /> <!-- All rights reserved. Licensed Materials Property of IBM --> <!-- US Government Users Restricted Rights --> <!-- Use, duplication or disclosure restricted by --> <!-- GSA ADP Schedule Contract with IBM Corp. --> <link rel="stylesheet" type="text/css" href="./ibmdita.css" /> <link rel="stylesheet" type="text/css" href="./ic.css" /> <title>Join an existing domain</title> </head> <body id="rzalvcnfgconfigwizard"><a name="rzalvcnfgconfigwizard"><!-- --></a> <!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script> <h1 class="topictitle1">Join an existing domain</h1> <div><p>This information explains how you can use the Enterprise Identity Mapping (EIM) Configuration wizard on one iSeries™ system to configure a domain controller and create an EIM domain, then use the wizard to configure other iSeries servers to participate in the domain.</p> <div class="section"><p>After you create an EIM domain and configure a directory server as a domain controller on one system, you can configure all additional iSeries servers (V5R2 or later) to join the existing EIM domain. As you work through the wizard you must supply information about the domain, including connection information to the EIM domain controller. When you use the EIM Configuration wizard to join an existing domain, the wizard still provides you with the option of launching the Network Authentication Service Configuration wizard if you choose to configure Kerberos as part of configuring EIM on the system. </p> <div class="p">When you complete the EIM Configuration wizard to join an existing domain, you can accomplish these tasks: <ul><li>Configure network authentication service for the system.</li> <li>Create EIM registry definitions for the local i5/OS™ registry and the Kerberos registry.</li> <li>Configure the system to participate in an existing EIM domain.</li> </ul> </div> <p>To configure your system to join an existing EIM domain, you must have all of the following special authorities: </p> <ul><li>Security administrator (*SECADM).</li> <li>All object (*ALLOBJ). </li> </ul> <p>To start and use the EIM Configuration wizard to join an existing EIM domain, complete these steps: </p> </div> <ol><li class="stepexpand"><span>Verify that the directory server on the remote system is active.</span></li> <li class="stepexpand"><span>In iSeries Navigator, select the system for which you want to configure EIM and expand <span class="uicontrol">Network > Enterprise Identity Mapping</span>.</span></li> <li class="stepexpand"><span>Right-click <span class="uicontrol">Configuration</span> and select <span class="uicontrol">Configure...</span> to start the EIM Configuration wizard. </span> <div class="note"><span class="notetitle">Note:</span> This option is labeled <span class="uicontrol">Reconfigure...</span> if EIM has been previously configured on the system.</div> </li> <li class="stepexpand"><span>On the <span class="uicontrol">Welcome</span> page of the wizard, select <span class="uicontrol">Join an existing domain</span>, and click <span class="uicontrol">Next</span>. </span> <div class="note"><span class="notetitle">Note:</span> If network authentication service is not currently configured on the iSeries server, or additional network authentication configuration information is needed to configure a single signon environment, the <span class="uicontrol">Network Authentication Services Configuration</span> page displays. This page allows you start the Network Authentication Service Configuration wizard so that you can <a href="../rzakh/rzakhconfig.htm">configure network authentication service</a>. Or, you can configure Network Authentication Service at a later time by using the configuration wizard for this service through iSeries Navigator. When you complete network authentication service configuration, the EIM Configuration wizard continues.</div> </li> <li class="stepexpand"><span>To configure network authentication service, complete these steps:</span><ol type="a"><li class="substepexpand"><span>On the <span class="uicontrol">Configure Network Authentication Service</span> page, select <span class="uicontrol">Yes</span> to start the Network Authentication Service Configuration wizard. With this wizard, you can configure several i5/OS interfaces and services to participate in a Kerberos realm as well as configure a single signon environment that uses both EIM and network authentication service.</span></li> <li class="substepexpand"><span>On the <span class="uicontrol">Specify Realm Information</span> page, specify the name of the default realm in the <span class="uicontrol">Default realm</span> field. If you are using Microsoft<sup>®</sup> Active Directory for Kerberos authentication, select <span class="uicontrol">Microsoft Active Directory is used for Kerberos authentication</span>, and click <span class="uicontrol">Next</span>.</span></li> <li class="substepexpand"><span>On the <span class="uicontrol">Specify KDC Information</span> page, specify the fully qualified name of the Kerberos server for this realm in the <span class="uicontrol">KDC</span> field, specify <tt>88</tt> in the <span class="uicontrol">Port</span> field, and click <span class="uicontrol">Next</span>.</span></li> <li class="substepexpand"><span>On the <span class="uicontrol">Specify Password Server Information</span> page, select either <span class="uicontrol">Yes</span> or <span class="uicontrol">No</span> for setting up a password server. The password server allows principals to change passwords on the Kerberos server. If you select <span class="uicontrol">Yes</span>, enter the password server name in the <span class="uicontrol">Password server</span> field. In the <span class="uicontrol">Port</span> field, accept the default value of <samp class="codeph">464</samp>, and click Next.</span></li> <li class="substepexpand"><span>On the <span class="uicontrol">Select Keytab Entries</span> page, select <span class="uicontrol">i5/OS Kerberos Authentication</span>, and cllick <span class="uicontrol">Next</span>.</span> <div class="note"><span class="notetitle">Note:</span> In addition you can also create keytab entries for the IBM<sup>®</sup> Directory Server for iSeries (LDAP), iSeries NetServer™, and iSeries HTTP server if you want these services to use Kerberos authentication. You may need to perform additional configuration for these services before they can use Kerberos authentication.</div> </li> <li class="substepexpand"><span>On the <span class="uicontrol">Create i5/OS Keytab Entry</span> page, enter and confirm a password, and click <span class="uicontrol">Next</span>. This is the same password you will use when you add the i5/OS principals to the Kerberos server.</span></li> <li class="substepexpand"><strong>Optional: </strong><span>On the <span class="uicontrol">Create Batch File</span> page, select <span class="uicontrol">Yes</span>, specify the following information, and click <span class="uicontrol">Next</span>:</span> <ul><li>In the <span class="uicontrol">Batch file</span> field, update the directory path. Click <span class="uicontrol">Browse</span> to locate the appropriate directory path, or edit the path in the <span class="uicontrol">Batch file</span> field.</li> <li>In the <span class="uicontrol">Include password</span> field, select <span class="uicontrol">Yes</span>. This ensures that all passwords associated with the i5/OS service principal are included in the batch file. It is important to note that passwords are displayed in clear text and can be read by anyone with read access to the batch file. Therefore, it is essential that you delete the batch file from the Kerberos server and from the PC immediately after you use it. If you do not include the password, you will be prompted for the password when you run the batch file.<div class="note"><span class="notetitle">Note:</span> You can also manually add the service principals that are generated by the wizard to Microsoft Active Directory. To learn how to do this, see <a href="../rzakh/rzakhdefineiseries.htm">Add i5/OS principals to the Kerberos server</a></div> </li> <li>On the <span class="uicontrol">Summary</span> page, review the network authentication service configuration details, and click <span class="uicontrol">Finish</span> to return to the EIM Configuration wizard.</li> </ul> </li> </ol> </li> <li class="stepexpand"><span>On the <span class="uicontrol">Specify Domain Controller</span> page provide the following information: </span> <div class="note"><span class="notetitle">Note:</span> The directory server that acts as the domain controller must be active to successfully complete this EIM configuration.</div> <ol type="a"><li class="substepexpand"><span>In the <span class="uicontrol">Domain controller name</span> field, specify the name of the system that serves as the domain controller for the EIM domain that you want the iSeries server to join. </span></li> <li class="substepexpand"><span>Click <span class="uicontrol">Use secure connection (SSL or TLS)</span> if you want to use a secure connection to the EIM domain controller. When this is selected, the connection uses either Secure Sockets Layer (SSL) or Transport Layer Security (TLS) to establish a secure connection to protect EIM data transmission over an untrusted network, such as the Internet.</span> <div class="note"><span class="notetitle">Note:</span> You must verify whether the EIM domain controller is configured to use a secure connection. Otherwise, the connection to the domain controller may fail.</div> </li> <li class="substepexpand"><span>In the <span class="uicontrol">Port</span> field, specify the TCP/IP port on which the directory server listens. If <span class="uicontrol">Use secure connection</span> is selected, the default port is <samp class="codeph">636</samp>; otherwise, the default port is <samp class="codeph">389</samp>.</span></li> <li class="substepexpand"><span>Click <span class="uicontrol">Verify Connection</span> to test that the wizard can use the specified information to successfully establish a connection to the EIM domain controller. </span></li> <li class="substepexpand"><span>Click <span class="uicontrol">Next</span>.</span></li> </ol> </li> <li class="stepexpand"><span>On the <span class="uicontrol">Specify User For Connection</span> page, select a <span class="uicontrol">User type</span> for the connection. You can select one of the following types of users: </span> <span class="uicontrol">Distinguished name and password</span>, <span class="uicontrol">Kerberos keytab file and principal</span>, <span class="uicontrol">Kerberos principal and password</span>, or <span class="uicontrol">User profile and password</span>. The two Kerberos user types are available only if network authentication service is configured for the local iSeries system. The user type that you select determines the other information that you must provide to complete the dialog as follows:<div class="note"><span class="notetitle">Note:</span> To ensure that the wizard has enough authority to create the necessary EIM objects in the directory, select <span class="uicontrol">Distinguished name and password</span> as the user type and specify the LDAP administrator DN and password as the user.<p>You can specify a different user for the connection; however, the user you specify must have the equivalent of LDAP administrator authority for the remote directory server.</p> </div> <ul><li>If you select <span class="uicontrol">Distinguished name and password</span>, provide the following information: <ul><li>In the <span class="uicontrol">Distinguished name</span> field, specify the LDAP distinguished name (DN) that identifies the user who is authorized to create objects in the local namespace of the LDAP server. If you used this wizard to configure the LDAP server in an earlier step, you should enter the distinguished name of the LDAP administrator that you created in that step. </li> <li>In the <span class="uicontrol">Password</span> field, specify the password for the distinguished name.</li> <li>In the <span class="uicontrol">Confirm password</span> field, specify the password a second time for validation purposes.</li> </ul> </li> <li>If you select <span class="uicontrol">Kerberos keytab file and principal</span>, provide the following information: <ul><li>In the <span class="uicontrol">Keytab file</span> field, specify the fully qualified path and keytab file name that contains the Kerberos principal for the wizard to use when connecting to the EIM domain. Or, click <span class="uicontrol">Browse...</span> to browse through directories in the iSeries integrated file system to select a keytab file. </li> <li>In the <span class="uicontrol">Principal</span> field, specify the name of the Kerberos principal to be used to identify the user.</li> <li>In the <span class="uicontrol">Realm</span> field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal <samp class="codeph">jsmith</samp> in the realm <samp class="codeph">ordept.myco.com</samp>, is represented in the keytab file as <samp class="codeph">jsmith@ordept.myco.com</samp>.</li> </ul> </li> <li>If you select <span class="uicontrol">Kerberos principal and password</span>, provide the following information: <ul><li>In the <span class="uicontrol">Principal</span> field, specify the name of the Kerberos principal for the wizard to use when connecting to the EIM domain. </li> <li>In the <strong>Realm</strong> field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal <samp class="codeph">jsmith</samp> in the realm <samp class="codeph">ordept.myco.com</samp> is represented in the keytab file as <samp class="codeph">jsmith@ordept.myco.com</samp>.</li> <li>In the <strong>Password</strong> field, specify the password for the Kerberos principal.</li> <li>In the <strong>Confirm password</strong> field, specify the password a second time for validation purposes. </li> </ul> </li> <li>If you select <span class="uicontrol">User profile and password</span>, provide the following information: <ul><li>In the <span class="uicontrol">User profile</span> field, specify the user profile name for the wizard to use when connecting to the EIM domain. </li> <li>In the <span class="uicontrol">Password</span> field, specify the password for the user profile.</li> <li>In the <span class="uicontrol">Confirm password</span> field, specify the password a second time for validation purposes.</li> </ul> </li> <li>Click <span class="uicontrol">Verify Connection</span> to test that the wizard can use the specified user information to successfully establish a connection to the EIM domain controller.</li> <li>Click <span class="uicontrol">Next</span>.</li> </ul> </li> <li class="stepexpand"><span>On the <span class="uicontrol">Specify Domain</span> page, select the name of the domain that you want to join and click <span class="uicontrol">Next</span>.</span></li> <li class="stepexpand"><span>On the <span class="uicontrol">Registry Information</span> page, specify whether to add local user registries to the EIM domain as registry definitions. Select one or both of these user registry types:</span> <ul><li>Select <span class="uicontrol">Local i5/OS</span> to add a registry definition for the local registry. In the field provide, accept the default value for the registry definition name or specify a different value for the registry definition name. The EIM registry name is an arbitrary string that represents the registry type and specific instance of that registry. <div class="note"><span class="notetitle">Note:</span> You do not have to create the local i5/OS registry definition at this time. If you choose to create the i5/OS registry definition later, you need to <a href="rzalvadminaddusrreg.htm#rzalvadminaddusrreg">add the system registry definition</a> and <a href="rzalvmanageconfigprops.htm#manage_config_props">update the EIM configuration properties</a>.</div> </li> <li>Select <span class="uicontrol">Kerberos</span> to add a registry definition for a Kerberos registry. In the field provided, accept the default value for the registry definition name or specify a different value for the registry definition name. The default registry definition name is the same as the realm name. By accepting the default name and using the same Kerberos registry name as the realm name, you can increase performance in retrieving information from the registry. Select <span class="uicontrol">Kerberos user identities are case sensitive</span>, if necessary.<div class="note"><span class="notetitle">Note:</span> If you have used the EIM Configuration wizard on another system to add a registry definition for the Kerberos registry for which this iSeries system has a service principal, then you do not need to add a Kerberos registry definition as part of this configuration. However, you will need to specify the name of that Kerberos registry in the configuration properties for this system after you finish the wizard.</div> </li> <li>Click <span class="uicontrol">Next</span>.</li> </ul> </li> <li class="stepexpand"><span>On the <span class="uicontrol">Specify EIM System User</span> page, select a <span class="uicontrol">User type</span> that you want the system to use when performing EIM operations on behalf of operating system functions.</span> These operations include mapping lookup operations and deletion of associations when deleting a local i5/OS user profile. You can select one of the following types of users: <span class="uicontrol">Distinguished name and password</span>, <span class="uicontrol">Kerberos keytab file and principal</span>, or <span class="uicontrol">Kerberos principal and password</span>. Which user types you can select vary based on the current system configuration. For example, if Network Authentication Service is not configured for the system, then Kerberos user types may not be available for selection. The user type that you select determines the other information that you must provide to complete the page as follows: <div class="note"><span class="notetitle">Note:</span> You must specify a user that is currently defined in the directory server which is hosting the EIM domain controller. The user that you specify must have privileges to perform mapping lookup and registry administration for the local user registry at a minimum. If the user that you specify does not have these privileges, then certain operating system functions related to the use of single signon and the deletion of user profiles may fail.</div> <ul><li>If you select <span class="uicontrol">Distinguished name and password</span>, provide the following information: <ul><li>In the <span class="uicontrol">Distinguished name</span> field, specify the LDAP distinguished name that identifies the user for the system to use when performing EIM operations.</li> <li>In the <span class="uicontrol">Password</span> field, specify the password for the distinguished name.</li> <li>In the <span class="uicontrol">Confirm password</span> field, specify the password a second time for verification purposes.</li> </ul> </li> <li>If you select <span class="uicontrol">Kerberos principal and password</span>, provide the following information: <ul><li>In the <span class="uicontrol">Principal</span> field, specify the Kerberos principal name for the system to use when performing EIM operations</li> <li>In the <span class="uicontrol">Realm</span> field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal <samp class="codeph">jsmith</samp> in the realm <samp class="codeph">ordept.myco.com</samp> is represented in the keytab file as <samp class="codeph">jsmith@ordept.myco.com</samp>.</li> <li>In the <span class="uicontrol">Password</span> field, enter the password for the user.</li> <li>In the <span class="uicontrol">Confirm password</span> field, specify the password a second time for verification purposes. </li> </ul> </li> <li>If you select <span class="uicontrol">Kerberos keytab file and principal</span>, provide the following information: <ul><li>In the <span class="uicontrol">Keytab file</span> field, specify the fully qualified path and keytab file name that contains the Kerberos principal for the system to use when performing EIM operations. Or, click <span class="uicontrol">Browse...</span> to browse through directories in the iSeries integrated file system to select a keytab file.</li> <li>In the <span class="uicontrol">Principal</span> field, specify the Kerberos principal name for the system to use when performing EIM operations.</li> <li>In the <span class="uicontrol">Realm</span> field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal <samp class="codeph">jsmith</samp> in the realm <samp class="codeph">ordept.myco.com</samp> is represented in the keytab file as <samp class="codeph">jsmith@ordept.myco.com</samp>.</li> </ul> </li> <li>Click <span class="uicontrol">Verify Connection</span> to ensure that the wizard can use the specified user information to successfully establish a connection to the EIM domain controller.</li> <li>Click <span class="uicontrol">Next</span>.</li> </ul> </li> <li class="stepexpand"><span>On the <span class="uicontrol">Summary</span> page, review the configuration information that you have provided. If all information is correct, click <span class="uicontrol">Finish</span>. </span></li> </ol> </div> <div> <div class="familylinks"> <div class="parentlink"><strong>Parent topic:</strong> <a href="rzalvcnfg.htm" title="Use this information to learn how to use the Enterprise Identity Mapping (EIM) Configuration wizard to configure EIM for your iSeries servers.">Configure Enterprise Identity Mapping</a></div> </div> </div><div class="nested1" xml:lang="en-us" id="finalizeyoureimconfigurationforthedomain3"><a name="finalizeyoureimconfigurationforthedomain3"><!-- --></a><h2 class="topictitle2">Finalize your EIM configuration for the domain</h2> <div><div class="section">When the wizard finishes, it adds the domain to the <span class="uicontrol">Domain Management</span> folder and you have created a basic EIM configuration for this server. However, you may need to complete these tasks to finalize your EIM configuration for the domain: </div> <ol><li class="stepexpand"><span>Add EIM registry definitions to the EIM domain, if necessary, for other non-iSeries servers and applications that you want to participate in the EIM domain.</span> These registry definitions refer to the actual user registries that must participate in the domain. You can either <a href="rzalvadminaddusrreg.htm#rzalvadminaddusrreg">Add system registry definitions</a> or <a href="rzalvadminaddappreg.htm#rzalvadminaddappreg">Add application registry definitions</a> depending on your EIM implementation needs.</li> <li class="stepexpand"><span>Based on your EIM implementation needs, determine whether to: </span> <ul><li><a href="rzalvadminidentcreate.htm#rzalvadminidentcreate">Create EIM identifiers</a> for each unique user or entity in the domain and <a href="rzalvcrtidentifierassoc.htm#create_id_assoc">create identifier associations</a> for them.</li> <li><a href="rzalvcrtpolassoc.htm#create_pol_assoc">Create policy associations</a> to map a group of users to a single target user identity.</li> <li>Create a combination of these. </li> </ul> </li> <li class="stepexpand"><span>Use the EIM <a href="rzalvtestmappings.htm#testmapping">test a mapping</a> function to test the identity mappings for your EIM configuration. </span></li> <li class="stepexpand"><span>If the only EIM user you have defined is the DN for the LDAP administrator, then your EIM user has a high level of authority to all data on the directory server.</span> Therefore, you might consider creating one or more DNs as additional users that have more appropriate and limited <a href="../rzalv/rzalveservereimauths.htm">access control</a> for EIM data. To learn more about creating DNs for the directory server, see <a href="../rzahy/rzahyunderdn.htm">Distinguished names</a> in the IBM Directory Server for iSeries (LDAP) topic. The number of additional EIM users that you define depends on your security policy's emphasis on the separation of security duties and responsibilities. Typically, you might create at least the two following types of DNs:<ul><li><strong>A user that has EIM administrator access control</strong><p>This EIM administrator DN provides the appropriate level of authority for an administrator who is responsible for managing the EIM domain. This EIM administrator DN could be used to connect to the domain controller when managing all aspects of the EIM domain by means of iSeries Navigator.</p> </li> <li><strong>At least one user that has all of the following access controls</strong>:<ul><li>Identifier administrator</li> <li>Registry administrator</li> <li>EIM mapping operations</li> </ul> This user provides the appropriate level of access control required for the system user that performs EIM operations on behalf of the operating system.</li> </ul> <div class="note"><span class="notetitle">Note:</span> To use this new DN for the system user instead of the LDAP administrator DN, you must change the EIM configuration properties for the iSeries server. See <a href="../rzalv/rzalvmanageconfigprops.htm">Manage EIM configuration properties</a> to learn how to change the system user DN.</div> </li> </ol> <div class="section"><p>You might need to perform additional tasks if you created a basic network authentication service configuration, especially if you are implementing a single signon environment. You can find information on these additional steps by reviewing the complete configuration steps demonstrated by the scenario, <a href="../rzamz/rzamzenablessoos400.htm">Enable single signon for i5/OS</a>.</p> </div> </div> </div> </body> </html>