107 lines
7.2 KiB
HTML
107 lines
7.2 KiB
HTML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE html
|
|
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html lang="en-us" xml:lang="en-us">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|
<meta name="security" content="public" />
|
|
<meta name="Robots" content="index,follow" />
|
|
<meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' />
|
|
<meta name="DC.Type" content="concept" />
|
|
<meta name="DC.Title" content="Lookup operation examples: Example 2" />
|
|
<meta name="abstract" content="Use this example to learn how the search flow works for a lookup operation that returns a target user identity from specific identifier associations based on the known Kerberos principal." />
|
|
<meta name="description" content="Use this example to learn how the search flow works for a lookup operation that returns a target user identity from specific identifier associations based on the known Kerberos principal." />
|
|
<meta name="DC.Relation" scheme="URI" content="rzalveservereimmaplookup.htm" />
|
|
<meta name="copyright" content="(C) Copyright IBM Corporation 2002, 2006" />
|
|
<meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 2002, 2006" />
|
|
<meta name="DC.Format" content="XHTML" />
|
|
<meta name="DC.Identifier" content="rzalvlookupoperationexamplesexample2" />
|
|
<meta name="DC.Language" content="en-us" />
|
|
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
|
<!-- US Government Users Restricted Rights -->
|
|
<!-- Use, duplication or disclosure restricted by -->
|
|
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
|
<link rel="stylesheet" type="text/css" href="./ibmdita.css" />
|
|
<link rel="stylesheet" type="text/css" href="./ic.css" />
|
|
<title>Lookup operation examples: Example 2</title>
|
|
</head>
|
|
<body id="rzalvlookupoperationexamplesexample2"><a name="rzalvlookupoperationexamplesexample2"><!-- --></a>
|
|
<!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script>
|
|
<h1 class="topictitle1">Lookup operation examples: Example 2</h1>
|
|
<div><p>Use this example to learn how the search flow works for a lookup
|
|
operation that returns a target user identity from specific identifier associations
|
|
based on the known Kerberos principal.</p>
|
|
<p>In Figure 12, an administrator wants to map a Windows<sup>®</sup> user in a Windows Active
|
|
Directory registry to an i5/OS™ user profile. Kerberos is the authentication
|
|
method that Windows uses and the name of the Windows Active
|
|
Directory registry as the administrator defined it in EIM is <samp class="codeph">Desktops</samp>.
|
|
The user identity that the administrator wants to map from is a Kerberos principal
|
|
named <samp class="codeph">jsday</samp>. The name of the i5/OS registry as the administrator defined
|
|
it in EIM is <samp class="codeph">System_C</samp> and the user identity that the administrator
|
|
wants to map to is a user profile named <samp class="codeph">JOHND</samp>.</p>
|
|
<div class="p">The administrator creates an EIM identifier named <samp class="codeph">John Day</samp>.
|
|
He then adds two associations to this EIM identifier:<ul><li>A source association for the Kerberos principal named <samp class="codeph">jsday</samp> in
|
|
the <samp class="codeph">Desktops</samp> registry.</li>
|
|
<li>A target association for the i5/OS user profile named <samp class="codeph">JOHND</samp> in
|
|
the <samp class="codeph">System_C</samp> registry.</li>
|
|
</ul>
|
|
</div>
|
|
<p><strong>Figure 12:</strong> EIM lookup operation returns a target user identity from
|
|
specific identifier associations based on the known Kerberos principal <samp class="codeph">jsday</samp> </p>
|
|
<p><br /><img src="rzalv505.gif" alt="Example 2. A lookup operation returns a target user identity from specific identifier associations" /><br /></p>
|
|
<div class="p">This configuration allows a mapping lookup operation to map from the Kerberos
|
|
principal to the i5/OS user
|
|
profile as follows:
|
|
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" frame="border" border="1" rules="all"><thead align="left"><tr><th valign="top" id="d0e92">Source user identity and registry</th>
|
|
<th valign="top" id="d0e94">---></th>
|
|
<th valign="top" id="d0e96">EIM identifier</th>
|
|
<th valign="top" id="d0e98">---></th>
|
|
<th valign="top" id="d0e100">Target user identity</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody><tr><td valign="top" headers="d0e92 "><samp class="codeph">jsday</samp> in <samp class="codeph">Desktops</samp> registry</td>
|
|
<td valign="top" headers="d0e94 ">---></td>
|
|
<td valign="top" headers="d0e96 ">John Day</td>
|
|
<td valign="top" headers="d0e98 ">---></td>
|
|
<td valign="top" headers="d0e100 "><samp class="codeph">JOHND</samp> (in <samp class="codeph">System_C</samp> registry)</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
<p>The lookup operation search flows in this manner:</p>
|
|
<ol><li>The user <samp class="codeph">jsday</samp> logs on and authenticates to Windows by
|
|
means of his Kerberos principal in the Windows Active Directory registry <samp class="codeph">Desktops</samp>. </li>
|
|
<li>The user opens iSeries™ Navigator to access data on <samp class="codeph">System_C</samp>.</li>
|
|
<li>i5/OS uses
|
|
an EIM API to perform an EIM lookup operation with a source user identity
|
|
of <samp class="codeph">jsday</samp>, a source registry of <samp class="codeph">Desktops</samp>,
|
|
and a target registry of <samp class="codeph">System_C</samp>.</li>
|
|
<li>The EIM lookup operation checks whether mapping lookups are enabled for
|
|
the source registry <samp class="codeph">Desktops</samp> and target registry <samp class="codeph">System_C</samp>.
|
|
They are. </li>
|
|
<li>The lookup operation checks for a specific identifier source association
|
|
that matches the supplied source user identity of <samp class="codeph">jsday</samp> in
|
|
a source registry of <samp class="codeph">Desktops</samp>. </li>
|
|
<li>The lookup operation uses the matching identifier source association to
|
|
determine the appropriate EIM identifier name, which is <samp class="codeph">John Day</samp>.</li>
|
|
<li>The lookup operation uses this EIM identifier name to search for an identifier
|
|
target association for the EIM identifier that matches the specified target
|
|
EIM registry definition name of <samp class="codeph">System_C</samp>. </li>
|
|
<li>There is a such an identifier target association and the lookup operation
|
|
returns the target user identity of <samp class="codeph">JOHND</samp> as defined in the
|
|
target association. </li>
|
|
<li>With the mapping lookup operation complete, iSeries Navigator begins to run under
|
|
the <samp class="codeph">JOHND</samp> user profile. The user's authority to access resources
|
|
and perform actions within iSeries Navigator is determined by the authority
|
|
defined for the <samp class="codeph">JOHND</samp> user profile rather than the authority
|
|
defined for the <samp class="codeph">jsday</samp> user identity.</li>
|
|
</ol>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="rzalveservereimmaplookup.htm" title="This information explains the process for Enterprise Identity Mapping (EIM) mapping and view examples.">EIM lookup operations</a></div>
|
|
</div>
|
|
</div>
|
|
</body>
|
|
</html> |