1. © Logicalis Group Single signon possibilities for iSeries Mandy Shaw, Logicalis (with many thanks to Pat Botz of IBM Rochester)

2. Simplify your infrastructure: single level signon What Every Enterprise Wants Protect access to enterprise resources at lowest possible cost What Every User Wants Highest possible convenience and productivity Not to have to remember or change passwords

3. SSO Definition What we mean by SSO The ability of an end user to sign in to the enterprise network and run multi- tier applications without being prompted again for authentication data, and without requiring the end user to have the same user ID and/or password on every system. What we don’t mean by SSO Same user id everywhere Same password everywhere Centralized storing/caching of passwords LDAP Authentication

4. Kerberos and Enterprise Identity Mapping Kerberos involves the acceptance of a single authentication by ‘Kerberised’ applications, avoiding the need for passwords EIM links user ids for different servers, at individual or group level EIM can be used without Kerberos; Kerberos can be used without EIM

5. John Smith's user ID: u:JSimth p:myonepwd z/OS RACF iSeries WebSphere NetServer intranet User AIX Windows 2000/NT Linux NDS Nirvana Extranet / Internet

6. John Smith's user IDs: z/OS RACF iSeries WebSphere NetServer intranet User AIX Windows 2000/2003 Server Linux NDS Windows NT/98/95 u:JohnSmith p:myonepwd u:simthj p:*NONE u:John p:*NONE u:Smith1 p:*NONE u:JoSm05 p:*NONE etc.. John Smith's user IDs: u:John Smith u:JSimth u:John u:Smith1 u:JoSm05 etc.. OS/400 approach gets you here

7. OS/400 implementation elements LDAP directory used purely to store EIM data EIM Identifiers for individuals Maps identifiers to user ids in registries Kerberos OS/400 can store KDC and do Kerberos authentication Typically, it won’t Network Authentication Service Identifies where the Kerberos authentication is done, and for which apps Applications NetServer, iSeries Navigator, Management Central, PC5250, QFileSvr.400, …

8. Benefits Whatever the user profile password is set to, it is not used for authentication, therefore can be set to *NONE No need to store/cache passwords Exploits signon technology that the significant majority of end users use when they sign on Comparatively small overhead to implement and manage over time Use within application development

9. Things to consider EIM doesn’t create or delete users: it just maps them and saves management time Use with V5R2 requires appropriate PTFs Kerberos authentication doesn’t yet cover all possible OS/400 applications (e.g. FTP) Domino and WebSphere currently require special treatment Domino: consider Active Directory integration WebSphere: consider identity tokens or Domino integration