To successfully configure network authentication service, you must understand the requirements and complete the necessary planning steps.
This topic provides a prerequisite worksheet and planning work sheet to ensure all necessary steps are completed. Use the following work sheets to aid in planning a Kerberos implementation and configuring network authentication service.
Prerequisite work sheet
Use this planning work sheet to ensure that all required prerequisites have been completed. You should be able to answer Yes to all prerequisite items before you perform any configuration tasks.
| Questions | Answers |
|---|---|
| Is your i5/OS™ V5R3 (5722-SS1) or later? | |
|
|
| Is iSeries Access for Windows® (5722-XE1) installed on the administrator's PC and on your iSeries systems? | |
| Is the Security subcomponent of iSeries Navigator installed on the administrator's PC? | |
| Is the Network subcomponent of iSeries Navigator installed on the administrator's PC? | |
Have you installed the latest IBM iSeries Access for Window service pack?
See the iSeries Access
web page for the latest service pack. |
|
| Do you have *SECADM, *ALLOBJ, and *IOSYSCFG special authorities? | |
Do you have one of the following installed
on a secure system that will act as a Kerberos server? Which one?
|
|
| For Windows 2000 Server and Windows Server 2003, do you have Windows Support Tools (which provides the ktpass tool) installed on the system being used as the key distribution center? | |
| If your Kerberos server is on a Windows 2000 or 2003 server, are all your PCs in your network configured in a Windows domain? | |
| Have you applied the latest program temporary fixes (PTFs)? | |
| Is the iSeries system time within five minutes of the Kerberos server's system time? If not see Synchronize system times. |
If you are using i5/OS V5R3, is
Cryptographic Access Provider (5722-AC3) installed on your iSeries™ systems? 
| Questions | Answers |
|---|---|
On which operating system do you plan to configure your
Kerberos server?
|
|
| What is the fully qualified domain name for the Kerberos server? | |
| Are times between the PCs and systems that connect to the Kerberos server synchronized? What is the maximum clock skew? |
| Questions | Answers |
|---|---|
| How many realms do you need? | |
| How do you plan to organize realms? | |
| What will be the naming convention used for realms? |
| Questions | Answers |
|---|---|
| What is the naming convention that you plan to use for Kerberos principals that represent users in your network? | |
| What is the naming convention for applications on your network? | |
| For which i5/OS services do you plan to use Kerberos authentication? | |
| What are the i5/OS principal names for each of these i5/OS services? |
| Question | Answer |
|---|---|
| Are the PCs and iSeries using the same DNS server to resolve host names? | |
| Are you using a local host table on the iSeries to resolve host names? | |
| Do your PC and your iSeries server resolve the same host name for the iSeries server? See Host name resolution considerations for assistance. |
The following planning work sheet illustrates the type of information you need before you begin configuring the Kerberos server in i5/OS PASE and network authentication service. All answers on the prerequisite work sheet should be answered before you proceed with configuring the Kerberos server in i5/OS PASE.
| Questions | Answers |
|---|---|
| Do you have PASE installed? | |
| What is the name of the default realm? | |
| What is the Kerberos server for this Kerberos default realm? What is the port on which the Kerberos server listens? | |
| What is the naming convention for your principals that represent users in your network? | |
| What are the principal names for your users in your network? |
Use the following planning work sheet to gather the information that you need before you begin configuring network authentication service. All answers on the prerequisite work sheet should be answered before you proceed with network authentication service configuration.
| Questions | Answers |
|---|---|
| What is the name of the Kerberos default
realm to which your iSeries will belong? Note: A Windows 2000
domain is similar to a Kerberos realm. Microsoft® Active Directory uses Kerberos
authentication as its default security mechanism.
|
|
| Are you using Microsoft Active Directory? | |
| What is the Kerberos server for this Kerberos default realm? What is the port on which the Kerberos server listens? | |
| Do you want to configure a password server for this
default realm? If yes, answer the following questions: What is name of the password server for this Kerberos server? |
|
For which services do you want to create
keytab entries?
|
|
| If you plan to create a service principal for i5/OS Kerberos Authentication, what is its password? | |
| If you plan to create a service principal for LDAP, what is its password? | |
| If you plan to create a service principal for HTTP Server, what is its password? | |
| If you plan to create a service principal for NetServer,
what is its password? Note: During the network authentication service wizard,
several principals will be created for iSeries NetServer. Write these down here as
they are displayed in the wizard. They will be needed when you add these principals
to the Kerberos server.
|
|
| Do you want to create a batch file to automate adding the service principals to Microsoft Active Directory? | |
| Do you want to include passwords with the i5/OS service principals in the batch file? |