389 lines
28 KiB
HTML
389 lines
28 KiB
HTML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE html
|
|
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html lang="en-us" xml:lang="en-us">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|
<meta name="security" content="public" />
|
|
<meta name="Robots" content="index,follow" />
|
|
<meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' />
|
|
<meta name="DC.Type" content="task" />
|
|
<meta name="DC.Title" content="Join an existing domain" />
|
|
<meta name="abstract" content="This information explains how you can use the Enterprise Identity Mapping (EIM) Configuration wizard on one iSeries system to configure a domain controller and create an EIM domain, then use the wizard to configure other iSeries servers to participate in the domain." />
|
|
<meta name="description" content="This information explains how you can use the Enterprise Identity Mapping (EIM) Configuration wizard on one iSeries system to configure a domain controller and create an EIM domain, then use the wizard to configure other iSeries servers to participate in the domain." />
|
|
<meta name="DC.Relation" scheme="URI" content="rzalvcnfg.htm" />
|
|
<meta name="copyright" content="(C) Copyright IBM Corporation 2002, 2006" />
|
|
<meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 2002, 2006" />
|
|
<meta name="DC.Format" content="XHTML" />
|
|
<meta name="DC.Identifier" content="rzalvcnfgconfigwizard" />
|
|
<meta name="DC.Language" content="en-us" />
|
|
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
|
<!-- US Government Users Restricted Rights -->
|
|
<!-- Use, duplication or disclosure restricted by -->
|
|
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
|
<link rel="stylesheet" type="text/css" href="./ibmdita.css" />
|
|
<link rel="stylesheet" type="text/css" href="./ic.css" />
|
|
<title>Join an existing domain</title>
|
|
</head>
|
|
<body id="rzalvcnfgconfigwizard"><a name="rzalvcnfgconfigwizard"><!-- --></a>
|
|
<!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script>
|
|
<h1 class="topictitle1">Join an existing domain</h1>
|
|
<div><p>This information explains how you can use the Enterprise Identity
|
|
Mapping (EIM) Configuration wizard on one iSeries™ system to configure a domain
|
|
controller and create an EIM domain, then use the wizard to configure other iSeries servers
|
|
to participate in the domain.</p>
|
|
<div class="section"><p>After you create an EIM domain and configure a directory server
|
|
as a domain controller on one system, you can configure all additional iSeries servers
|
|
(V5R2 or later) to join the existing EIM domain. As you work through the wizard
|
|
you must supply information about the domain, including connection information
|
|
to the EIM domain controller. When you use the EIM Configuration wizard to
|
|
join an existing domain, the wizard still provides you with the option of
|
|
launching the Network Authentication Service Configuration wizard if you choose
|
|
to configure Kerberos as part of configuring EIM on the system. </p>
|
|
<div class="p">When
|
|
you complete the EIM Configuration wizard to join an existing domain, you
|
|
can accomplish these tasks: <ul><li>Configure network authentication service for the system.</li>
|
|
<li>Create EIM registry definitions for the local i5/OS™ registry and the Kerberos registry.</li>
|
|
<li>Configure the system to participate in an existing EIM domain.</li>
|
|
</ul>
|
|
</div>
|
|
<p>To configure your system to join an existing EIM domain, you must
|
|
have all of the following special authorities: </p>
|
|
<ul><li>Security administrator (*SECADM).</li>
|
|
<li>All object (*ALLOBJ). </li>
|
|
</ul>
|
|
<p>To start and use the EIM Configuration wizard to join an existing
|
|
EIM domain, complete these steps: </p>
|
|
</div>
|
|
<ol><li class="stepexpand"><span>Verify that the directory server on the remote system is active.</span></li>
|
|
<li class="stepexpand"><span>In iSeries Navigator,
|
|
select the system for which you want to configure EIM and expand <span class="uicontrol">Network
|
|
> Enterprise Identity Mapping</span>.</span></li>
|
|
<li class="stepexpand"><span>Right-click <span class="uicontrol">Configuration</span> and select <span class="uicontrol">Configure...</span> to
|
|
start the EIM Configuration wizard. </span> <div class="note"><span class="notetitle">Note:</span> This option is labeled <span class="uicontrol">Reconfigure...</span> if
|
|
EIM has been previously configured on the system.</div>
|
|
</li>
|
|
<li class="stepexpand"><span>On the <span class="uicontrol">Welcome</span> page of the wizard, select <span class="uicontrol">Join
|
|
an existing domain</span>, and click <span class="uicontrol">Next</span>. </span> <div class="note"><span class="notetitle">Note:</span> If network authentication service is not currently configured
|
|
on the iSeries server,
|
|
or additional network authentication configuration information is needed to
|
|
configure a single signon environment, the <span class="uicontrol">Network Authentication
|
|
Services Configuration</span> page displays. This page allows you start
|
|
the Network Authentication Service Configuration wizard so that you can <a href="../rzakh/rzakhconfig.htm">configure network
|
|
authentication service</a>. Or, you can configure Network Authentication
|
|
Service at a later time by using the configuration wizard for this service
|
|
through iSeries Navigator.
|
|
When you complete network authentication service configuration, the EIM Configuration
|
|
wizard continues.</div>
|
|
</li>
|
|
<li class="stepexpand"><span>To configure network authentication service, complete these steps:</span><ol type="a"><li class="substepexpand"><span>On the <span class="uicontrol">Configure Network Authentication Service</span> page,
|
|
select <span class="uicontrol">Yes</span> to start the Network Authentication Service
|
|
Configuration wizard. With this wizard, you can configure several i5/OS interfaces
|
|
and services to participate in a Kerberos realm as well as configure a single
|
|
signon environment that uses both EIM and network authentication service.</span></li>
|
|
<li class="substepexpand"><span>On the <span class="uicontrol">Specify Realm Information</span> page,
|
|
specify the name of the default realm in the <span class="uicontrol">Default realm</span> field.
|
|
If you are using Microsoft<sup>®</sup> Active Directory for Kerberos authentication,
|
|
select <span class="uicontrol">Microsoft Active Directory is used for Kerberos authentication</span>,
|
|
and click <span class="uicontrol">Next</span>.</span></li>
|
|
<li class="substepexpand"><span>On the <span class="uicontrol">Specify KDC Information</span> page,
|
|
specify the fully qualified name of the Kerberos server for this realm in
|
|
the <span class="uicontrol">KDC</span> field, specify <tt>88</tt> in the <span class="uicontrol">Port</span> field,
|
|
and click <span class="uicontrol">Next</span>.</span></li>
|
|
<li class="substepexpand"><span>On the <span class="uicontrol">Specify Password Server Information</span> page,
|
|
select either <span class="uicontrol">Yes</span> or <span class="uicontrol">No</span> for
|
|
setting up a password server. The password server allows principals to change
|
|
passwords on the Kerberos server. If you select <span class="uicontrol">Yes</span>,
|
|
enter the password server name in the <span class="uicontrol">Password server</span> field.
|
|
In the <span class="uicontrol">Port</span> field, accept the default value of <samp class="codeph">464</samp>,
|
|
and click Next.</span></li>
|
|
<li class="substepexpand"><span>On the <span class="uicontrol">Select Keytab Entries</span> page, select <span class="uicontrol">i5/OS
|
|
Kerberos Authentication</span>, and cllick <span class="uicontrol">Next</span>.</span> <div class="note"><span class="notetitle">Note:</span> In addition you can also create keytab entries for the IBM<sup>®</sup> Directory
|
|
Server for iSeries (LDAP), iSeries NetServer™,
|
|
and iSeries HTTP
|
|
server if you want these services to use Kerberos authentication. You may
|
|
need to perform additional configuration for these services before they can
|
|
use Kerberos authentication.</div>
|
|
</li>
|
|
<li class="substepexpand"><span>On the <span class="uicontrol">Create i5/OS Keytab Entry</span> page,
|
|
enter and confirm a password, and click <span class="uicontrol">Next</span>. This
|
|
is the same password you will use when you add the i5/OS principals to the Kerberos server.</span></li>
|
|
<li class="substepexpand"><strong>Optional: </strong><span>On the <span class="uicontrol">Create Batch File</span> page,
|
|
select <span class="uicontrol">Yes</span>, specify the following information, and
|
|
click <span class="uicontrol">Next</span>:</span> <ul><li>In the <span class="uicontrol">Batch file</span> field, update the directory path.
|
|
Click <span class="uicontrol">Browse</span> to locate the appropriate directory path,
|
|
or edit the path in the <span class="uicontrol">Batch file</span> field.</li>
|
|
<li>In the <span class="uicontrol">Include password</span> field, select <span class="uicontrol">Yes</span>.
|
|
This ensures that all passwords associated with the i5/OS service principal are included in
|
|
the batch file. It is important to note that passwords are displayed in clear
|
|
text and can be read by anyone with read access to the batch file. Therefore,
|
|
it is essential that you delete the batch file from the Kerberos server and
|
|
from the PC immediately after you use it. If you do not include the password,
|
|
you will be prompted for the password when you run the batch file.<div class="note"><span class="notetitle">Note:</span> You
|
|
can also manually add the service principals that are generated by the wizard
|
|
to Microsoft Active
|
|
Directory. To learn how to do this, see <a href="../rzakh/rzakhdefineiseries.htm">Add i5/OS principals to the Kerberos server</a></div>
|
|
</li>
|
|
<li>On the <span class="uicontrol">Summary</span> page, review the network authentication
|
|
service configuration details, and click <span class="uicontrol">Finish</span> to
|
|
return to the EIM Configuration wizard.</li>
|
|
</ul>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
<li class="stepexpand"><span>On the <span class="uicontrol">Specify Domain Controller</span> page provide
|
|
the following information: </span> <div class="note"><span class="notetitle">Note:</span> The directory server that acts
|
|
as the domain controller must be active to successfully complete this EIM
|
|
configuration.</div>
|
|
<ol type="a"><li class="substepexpand"><span>In the <span class="uicontrol">Domain controller name</span> field,
|
|
specify the name of the system that serves as the domain controller for the
|
|
EIM domain that you want the iSeries server to join. </span></li>
|
|
<li class="substepexpand"><span>Click <span class="uicontrol">Use secure connection (SSL or TLS)</span> if
|
|
you want to use a secure connection to the EIM domain controller. When this
|
|
is selected, the connection uses either Secure Sockets Layer (SSL) or Transport
|
|
Layer Security (TLS) to establish a secure connection to protect EIM data
|
|
transmission over an untrusted network, such as the Internet.</span> <div class="note"><span class="notetitle">Note:</span> You
|
|
must verify whether the EIM domain controller is configured to use a secure
|
|
connection. Otherwise, the connection to the domain controller may fail.</div>
|
|
</li>
|
|
<li class="substepexpand"><span>In the <span class="uicontrol">Port</span> field, specify the TCP/IP
|
|
port on which the directory server listens. If <span class="uicontrol">Use secure connection</span> is
|
|
selected, the default port is <samp class="codeph">636</samp>; otherwise, the default
|
|
port is <samp class="codeph">389</samp>.</span></li>
|
|
<li class="substepexpand"><span>Click <span class="uicontrol">Verify Connection</span> to test that
|
|
the wizard can use the specified information to successfully establish a connection
|
|
to the EIM domain controller. </span></li>
|
|
<li class="substepexpand"><span>Click <span class="uicontrol">Next</span>.</span></li>
|
|
</ol>
|
|
</li>
|
|
<li class="stepexpand"><span>On the <span class="uicontrol">Specify User For Connection</span> page,
|
|
select a <span class="uicontrol">User type</span> for the connection. You can select
|
|
one of the following types of users: </span> <span class="uicontrol">Distinguished
|
|
name and password</span>, <span class="uicontrol">Kerberos keytab file and principal</span>, <span class="uicontrol">Kerberos
|
|
principal and password</span>, or <span class="uicontrol">User profile and password</span>.
|
|
The two Kerberos user types are available only if network authentication service
|
|
is configured for the local iSeries system. The user type that you select determines
|
|
the other information that you must provide to complete the dialog as follows:<div class="note"><span class="notetitle">Note:</span> To
|
|
ensure that the wizard has enough authority to create the necessary EIM objects
|
|
in the directory, select <span class="uicontrol">Distinguished name and password</span> as
|
|
the user type and specify the LDAP administrator DN and password as the user.<p>You
|
|
can specify a different user for the connection; however, the user you specify
|
|
must have the equivalent of LDAP administrator authority for the remote directory
|
|
server.</p>
|
|
</div>
|
|
<ul><li>If you select <span class="uicontrol">Distinguished name and password</span>,
|
|
provide the following information: <ul><li>In the <span class="uicontrol">Distinguished name</span> field, specify the LDAP
|
|
distinguished name (DN) that identifies the user who is authorized to create
|
|
objects in the local namespace of the LDAP server. If you used this wizard
|
|
to configure the LDAP server in an earlier step, you should enter the distinguished
|
|
name of the LDAP administrator that you created in that step. </li>
|
|
<li>In the <span class="uicontrol">Password</span> field, specify the password for
|
|
the distinguished name.</li>
|
|
<li>In the <span class="uicontrol">Confirm password</span> field, specify the password
|
|
a second time for validation purposes.</li>
|
|
</ul>
|
|
</li>
|
|
<li>If you select <span class="uicontrol">Kerberos keytab file and principal</span>,
|
|
provide the following information: <ul><li>In the <span class="uicontrol">Keytab file</span> field, specify the fully qualified
|
|
path and keytab file name that contains the Kerberos principal for the wizard
|
|
to use when connecting to the EIM domain. Or, click <span class="uicontrol">Browse...</span> to
|
|
browse through directories in the iSeries integrated file system to select
|
|
a keytab file. </li>
|
|
<li>In the <span class="uicontrol">Principal</span> field, specify the name of the
|
|
Kerberos principal to be used to identify the user.</li>
|
|
<li>In the <span class="uicontrol">Realm</span> field, specify the fully qualified
|
|
Kerberos realm name for which the principal is a member. The name of the principal
|
|
and realm uniquely identify the Kerberos users in the keytab file. For example,
|
|
the principal <samp class="codeph">jsmith</samp> in the realm <samp class="codeph">ordept.myco.com</samp>,
|
|
is represented in the keytab file as <samp class="codeph">jsmith@ordept.myco.com</samp>.</li>
|
|
</ul>
|
|
</li>
|
|
<li>If you select <span class="uicontrol">Kerberos principal and password</span>,
|
|
provide the following information: <ul><li>In the <span class="uicontrol">Principal</span> field, specify the name of the
|
|
Kerberos principal for the wizard to use when connecting to the EIM domain. </li>
|
|
<li>In the <strong>Realm</strong> field, specify the fully qualified Kerberos realm
|
|
name for which the principal is a member. The name of the principal and realm
|
|
uniquely identify the Kerberos users in the keytab file. For example, the
|
|
principal <samp class="codeph">jsmith</samp> in the realm <samp class="codeph">ordept.myco.com</samp> is
|
|
represented in the keytab file as <samp class="codeph">jsmith@ordept.myco.com</samp>.</li>
|
|
<li>In the <strong>Password</strong> field, specify the password for the Kerberos principal.</li>
|
|
<li>In the <strong>Confirm password</strong> field, specify the password a second time
|
|
for validation purposes. </li>
|
|
</ul>
|
|
</li>
|
|
<li>If you select <span class="uicontrol">User profile and password</span>, provide
|
|
the following information: <ul><li>In the <span class="uicontrol">User profile</span> field, specify the user profile
|
|
name for the wizard to use when connecting to the EIM domain. </li>
|
|
<li>In the <span class="uicontrol">Password</span> field, specify the password for
|
|
the user profile.</li>
|
|
<li>In the <span class="uicontrol">Confirm password</span> field, specify the password
|
|
a second time for validation purposes.</li>
|
|
</ul>
|
|
</li>
|
|
<li>Click <span class="uicontrol">Verify Connection</span> to test that the wizard
|
|
can use the specified user information to successfully establish a connection
|
|
to the EIM domain controller.</li>
|
|
<li>Click <span class="uicontrol">Next</span>.</li>
|
|
</ul>
|
|
</li>
|
|
<li class="stepexpand"><span>On the <span class="uicontrol">Specify Domain</span> page, select the name
|
|
of the domain that you want to join and click <span class="uicontrol">Next</span>.</span></li>
|
|
<li class="stepexpand"><span>On the <span class="uicontrol">Registry Information</span> page, specify
|
|
whether to add local user registries to the EIM domain as registry definitions.
|
|
Select one or both of these user registry types:</span> <ul><li>Select <span class="uicontrol">Local i5/OS</span> to add a registry definition
|
|
for the local registry. In the field provide, accept the default value for
|
|
the registry definition name or specify a different value for the registry
|
|
definition name. The EIM registry name is an arbitrary string that represents
|
|
the registry type and specific instance of that registry. <div class="note"><span class="notetitle">Note:</span> You do not
|
|
have to create the local i5/OS registry definition at this time. If you choose
|
|
to create the i5/OS registry
|
|
definition later, you need to <a href="rzalvadminaddusrreg.htm#rzalvadminaddusrreg">add the system registry definition</a> and <a href="rzalvmanageconfigprops.htm#manage_config_props">update the EIM configuration properties</a>.</div>
|
|
</li>
|
|
<li>Select <span class="uicontrol">Kerberos</span> to add a registry definition for
|
|
a Kerberos registry. In the field provided, accept the default value for the
|
|
registry definition name or specify a different value for the registry definition
|
|
name. The default registry definition name is the same as the realm name.
|
|
By accepting the default name and using the same Kerberos registry name as
|
|
the realm name, you can increase performance in retrieving information from
|
|
the registry. Select <span class="uicontrol">Kerberos user identities are case sensitive</span>,
|
|
if necessary.<div class="note"><span class="notetitle">Note:</span> If you have used the EIM Configuration wizard
|
|
on another system to add a registry definition for the Kerberos registry for
|
|
which this iSeries system
|
|
has a service principal, then you do not need to add a Kerberos registry definition
|
|
as part of this configuration. However, you will need to specify the name
|
|
of that Kerberos registry in the configuration properties for this system
|
|
after you finish the wizard.</div>
|
|
</li>
|
|
<li>Click <span class="uicontrol">Next</span>.</li>
|
|
</ul>
|
|
</li>
|
|
<li class="stepexpand"><span>On the <span class="uicontrol">Specify EIM System User</span> page, select
|
|
a <span class="uicontrol">User type</span> that you want the system to use when performing
|
|
EIM operations on behalf of operating system functions.</span> These operations
|
|
include mapping lookup operations and deletion of associations when deleting
|
|
a local i5/OS user
|
|
profile. You can select one of the following types of users: <span class="uicontrol">Distinguished
|
|
name and password</span>, <span class="uicontrol">Kerberos keytab file and principal</span>,
|
|
or <span class="uicontrol">Kerberos principal and password</span>. Which user types
|
|
you can select vary based on the current system configuration. For example,
|
|
if Network Authentication Service is not configured for the system, then Kerberos
|
|
user types may not be available for selection. The user type that you select
|
|
determines the other information that you must provide to complete the page
|
|
as follows: <div class="note"><span class="notetitle">Note:</span> You must specify a user that is currently defined in the
|
|
directory server which is hosting the EIM domain controller. The user that
|
|
you specify must have privileges to perform mapping lookup and registry administration
|
|
for the local user registry at a minimum. If the user that you specify does
|
|
not have these privileges, then certain operating system functions related
|
|
to the use of single signon and the deletion of user profiles may fail.</div>
|
|
<ul><li>If you select <span class="uicontrol">Distinguished name and password</span>,
|
|
provide the following information: <ul><li>In the <span class="uicontrol">Distinguished name</span> field, specify the LDAP
|
|
distinguished name that identifies the user for the system to use when performing
|
|
EIM operations.</li>
|
|
<li>In the <span class="uicontrol">Password</span> field, specify the password for
|
|
the distinguished name.</li>
|
|
<li>In the <span class="uicontrol">Confirm password</span> field, specify the password
|
|
a second time for verification purposes.</li>
|
|
</ul>
|
|
</li>
|
|
<li>If you select <span class="uicontrol">Kerberos principal and password</span>,
|
|
provide the following information: <ul><li>In the <span class="uicontrol">Principal</span> field, specify the Kerberos principal
|
|
name for the system to use when performing EIM operations</li>
|
|
<li>In the <span class="uicontrol">Realm</span> field, specify the fully qualified
|
|
Kerberos realm name for which the principal is a member. The name of the principal
|
|
and realm uniquely identify the Kerberos users in the keytab file. For example,
|
|
the principal <samp class="codeph">jsmith</samp> in the realm <samp class="codeph">ordept.myco.com</samp> is
|
|
represented in the keytab file as <samp class="codeph">jsmith@ordept.myco.com</samp>.</li>
|
|
<li>In the <span class="uicontrol">Password</span> field, enter the password for the
|
|
user.</li>
|
|
<li>In the <span class="uicontrol">Confirm password</span> field, specify the password
|
|
a second time for verification purposes. </li>
|
|
</ul>
|
|
</li>
|
|
<li>If you select <span class="uicontrol">Kerberos keytab file and principal</span>,
|
|
provide the following information: <ul><li>In the <span class="uicontrol">Keytab file</span> field, specify the fully qualified
|
|
path and keytab file name that contains the Kerberos principal for the system
|
|
to use when performing EIM operations. Or, click <span class="uicontrol">Browse...</span> to
|
|
browse through directories in the iSeries integrated file system to select
|
|
a keytab file.</li>
|
|
<li>In the <span class="uicontrol">Principal</span> field, specify the Kerberos principal
|
|
name for the system to use when performing EIM operations.</li>
|
|
<li>In the <span class="uicontrol">Realm</span> field, specify the fully qualified
|
|
Kerberos realm name for which the principal is a member. The name of the principal
|
|
and realm uniquely identify the Kerberos users in the keytab file. For example,
|
|
the principal <samp class="codeph">jsmith</samp> in the realm <samp class="codeph">ordept.myco.com</samp> is
|
|
represented in the keytab file as <samp class="codeph">jsmith@ordept.myco.com</samp>.</li>
|
|
</ul>
|
|
</li>
|
|
<li>Click <span class="uicontrol">Verify Connection</span> to ensure that the wizard
|
|
can use the specified user information to successfully establish a connection
|
|
to the EIM domain controller.</li>
|
|
<li>Click <span class="uicontrol">Next</span>.</li>
|
|
</ul>
|
|
</li>
|
|
<li class="stepexpand"><span>On the <span class="uicontrol">Summary</span> page, review the configuration
|
|
information that you have provided. If all information is correct, click <span class="uicontrol">Finish</span>. </span></li>
|
|
</ol>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="rzalvcnfg.htm" title="Use this information to learn how to use the Enterprise Identity Mapping (EIM) Configuration wizard to configure EIM for your iSeries servers.">Configure Enterprise Identity Mapping</a></div>
|
|
</div>
|
|
</div><div class="nested1" xml:lang="en-us" id="finalizeyoureimconfigurationforthedomain3"><a name="finalizeyoureimconfigurationforthedomain3"><!-- --></a><h2 class="topictitle2">Finalize your EIM configuration for the domain</h2>
|
|
<div><div class="section">When the wizard finishes, it adds the domain to the <span class="uicontrol">Domain
|
|
Management</span> folder and you have created a basic EIM configuration
|
|
for this server. However, you may need to complete these tasks to finalize
|
|
your EIM configuration for the domain: </div>
|
|
<ol><li class="stepexpand"><span>Add EIM registry definitions to the EIM domain, if necessary, for
|
|
other non-iSeries servers and applications that you want to participate in
|
|
the EIM domain.</span> These registry definitions refer to the actual
|
|
user registries that must participate in the domain. You can either <a href="rzalvadminaddusrreg.htm#rzalvadminaddusrreg">Add system registry definitions</a> or <a href="rzalvadminaddappreg.htm#rzalvadminaddappreg">Add application registry
|
|
definitions</a> depending on your EIM implementation needs.</li>
|
|
<li class="stepexpand"><span>Based on your EIM implementation needs, determine whether to: </span> <ul><li><a href="rzalvadminidentcreate.htm#rzalvadminidentcreate">Create EIM
|
|
identifiers</a> for each unique user or entity in the domain and <a href="rzalvcrtidentifierassoc.htm#create_id_assoc">create identifier associations</a> for
|
|
them.</li>
|
|
<li><a href="rzalvcrtpolassoc.htm#create_pol_assoc">Create policy associations</a> to
|
|
map a group of users to a single target user identity.</li>
|
|
<li>Create a combination of these. </li>
|
|
</ul>
|
|
</li>
|
|
<li class="stepexpand"><span>Use the EIM <a href="rzalvtestmappings.htm#testmapping">test
|
|
a mapping</a> function to test the identity mappings for your EIM configuration. </span></li>
|
|
<li class="stepexpand"><span>If the only EIM user you have defined is the DN for the LDAP administrator,
|
|
then your EIM user has a high level of authority to all data on the directory
|
|
server.</span> Therefore, you might consider creating one or more DNs
|
|
as additional users that have more appropriate and limited <a href="../rzalv/rzalveservereimauths.htm">access control</a> for
|
|
EIM data. To learn more about creating DNs for the directory server, see <a href="../rzahy/rzahyunderdn.htm">Distinguished
|
|
names</a> in the IBM Directory Server for iSeries (LDAP) topic. The number of additional
|
|
EIM users that you define depends on your security policy's emphasis on the
|
|
separation of security duties and responsibilities. Typically, you might create
|
|
at least the two following types of DNs:<ul><li><strong>A user that has EIM administrator access control</strong><p>This EIM administrator
|
|
DN provides the appropriate level of authority for an administrator who is
|
|
responsible for managing the EIM domain. This EIM administrator DN could
|
|
be used to connect to the domain controller when managing all aspects of the
|
|
EIM domain by means of iSeries Navigator.</p>
|
|
</li>
|
|
<li><strong>At least one user that has all of the following access controls</strong>:<ul><li>Identifier administrator</li>
|
|
<li>Registry administrator</li>
|
|
<li>EIM mapping operations</li>
|
|
</ul>
|
|
This user provides the appropriate level of access control required for
|
|
the system user that performs EIM operations on behalf of the operating system.</li>
|
|
</ul>
|
|
<div class="note"><span class="notetitle">Note:</span> To use this new DN for the system user instead of the LDAP administrator
|
|
DN, you must change the EIM configuration properties for the iSeries server.
|
|
See <a href="../rzalv/rzalvmanageconfigprops.htm">Manage
|
|
EIM configuration properties</a> to learn how to change the system user
|
|
DN.</div>
|
|
</li>
|
|
</ol>
|
|
<div class="section"><p>You might need to perform additional tasks if you created a basic
|
|
network authentication service configuration, especially if you are implementing
|
|
a single signon environment. You can find information on these additional
|
|
steps by reviewing the complete configuration steps demonstrated by the scenario, <a href="../rzamz/rzamzenablessoos400.htm">Enable
|
|
single signon for i5/OS</a>.</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
</body>
|
|
</html> |