Creating and joining a new remote domain

When you use the EIM Configuration wizard to create and join a new domain, you can choose to configure a directory server on a remote system to act as the EIM domain controller as part of creating your EIM configuration.

You must specify the appropriate information for connecting to the remote directory server to allow you to configure EIM. If Kerberos is not currently configured on the IBM® i platform, the wizard prompts you to start the Network Authentication Service Configuration wizard.

Note: The directory server on the remote system must provide EIM support. EIM requires that the domain controller be hosted by a directory server that supports Lightweight Directory Access Protocol (LDAP) Version 3. Additionally, the directory server product must have the EIM schema configured. For example, the IBM Directory Server V5.1 provides this support. For more detailed information about EIM domain controller requirements, review Planning an Enterprise Identity Mapping domain controller.

When you complete the EIM Configuration wizard, you can accomplish these tasks:

Create a new EIM domain.
Configure a remote directory server to act as the EIM domain controller.
Configure network authentication service for the system.
Create EIM registry definitions for the local IBM i registry and the Kerberos registry.
Configure the system to participate in the new EIM domain.

To configure your system to create and join a new EIM domain, you must have all the following special authorities:

Security administrator (*SECADM).
All object (*ALLOBJ).
System configuration (*IOSYSCFG).

To use the EIM Configuration wizard to create and join a domain on a remote system, complete these steps:

Verify that the directory server on the remote system is active.
From IBM Navigator for i on the system for which you want to configure EIM, expand Security > All Tasks > Enterprise Identity Mapping > Configuration.
Click Configure to start the EIM Configuration wizard.
On the Welcome page of the wizard, select Create and join a new domain, and click Next.
On the Specify EIM Domain Location page, select On the local Directory server and click Next.
Note: This option configures the local directory server to act as the EIM domain controller. Because this directory server stores all EIM data for the domain, it must be active and remain active to support EIM mapping lookups and other operations.

If network authentication service is not currently configured on the IBM i platform, or additional network authentication configuration information is needed to configure a single sign-on environment, the Network Authentication Services Configuration page displays. This page allows you start the Network Authentication Service Configuration wizard so that you can configure network authentication service. Or, you can configure Network Authentication Service at a later time by using the configuration wizard for this service through IBM Navigator for i. When you complete network authentication service configuration, the EIM Configuration wizard continues.
To configure network authentication service, complete these steps:
1. On the Configure Network Authentication Service page, select Yes to start the Network Authentication Service Configuration wizard. With this wizard, you can configure several IBM i interfaces and services to participate in a Kerberos realm as well as configure a single signon environment that uses both EIM and network authentication service.
2. On the Specify Realm Information page, specify the name of the default realm in the Default realm field. If you are using Microsoft Active Directory for Kerberos authentication, select Microsoft Active Directory is used for Kerberos authentication, and click Next.
3. On the Specify KDC Information page, specify the fully qualified name of the Kerberos server for this realm in the KDC field, specify 88 in the Port field, and click Next.
4. On the Specify Password Server Information page, select either Yes or No for setting up a password server. The password server allows principals to change passwords on the Kerberos server. If you select Yes, enter the password server name in the Password server field. In the Port field, accept the default value of 464, and click Next.
5. On the Select Keytab Entries page, select IBM i Kerberos Authentication, and click Next.
  Note: In addition you can also create keytab entries for the IBM Tivoli® Directory Server for IBM i, IBM i NetServer, and IBM HTTP Server for i server if you want these services to use Kerberos authentication. You may need to perform additional configuration for these services before they can use Kerberos authentication.
6. On the Create IBM i Keytab Entry page, enter and confirm a password, and click Next. This is the same password you will use when you add theIBM i principals to the Kerberos server.
7. Optional: On the Create Batch File page, select Yes, specify the following information, and click Next:
  - In the Batch file field, update the directory path. Click Browse to locate the appropriate directory path, or edit the path in the Batch file field.
  - Select Include password in the batch file. This ensures that all passwords associated with the IBM i service principal are included in the batch file. It is important to note that passwords are displayed in clear text and can be read by anyone with read access to the batch file. Therefore, it is essential that you delete the batch file from the Kerberos server and the IBM i platform immediately after you use it. If you do not include the password, you will be prompted for the password when you run the batch file.
    Note: You can also manually add the service principals that are generated by the wizard to Microsoft Active Directory. To learn how to do this, review Add IBM i principals to the Kerberos server.
  - On the Summary page, review the network authentication service configuration details, and click Finish to return to the EIM Configuration wizard.
Use the Specify EIM Domain Controller page to specify connection information as follows for the remote EIM domain controller that you want to configure:
1. In the Domain controller name field, specify the name of the remote directory server that you want to configure as the EIM domain controller for the domain that you are creating. The EIM domain controller name can be the directory server TCP/IP host and domain name or the directory server address.
2. Specify connection information for the connection to the domain controller as follows:
  - Select the Use secure connection (SSL or TLS) to use a secure connection to the EIM domain controller. When this is selected, the connection uses either Secure Sockets Layer (SSL) or Transport Layer Security (TLS) to establish a secure connection to protect EIM data transmission over an untrusted network, such as the Internet.
    Note: You must verify whether the EIM domain controller is configured to use a secure connection. Otherwise, the connection to the domain controller may fail.
  - In the Port field, specify the TCP/IP port on which the directory server listens. If Use secure connection is selected, the default port is 636; otherwise, the default port is 389.
3. Click Verify Connection to test that the wizard can use the specified information to successfully establish a connection to the remote EIM domain controller.
4. Click Next.
On the Specify User For Connection page, select a User type for the connection.
You can select one of the following types of users: Distinguished name and password, Kerberos keytab file and principal, Kerberos principal and password, or User profile and password. The two Kerberos user types are available only if network authentication service is configured for the local IBM i platform. The user type that you select determines the other information that you must provide to complete the dialog as follows:
Note: To ensure that the wizard has enough authority to create the necessary EIM objects in the directory, select Distinguished name and password as the user type and specify the LDAP administrator DN and password as the user.
You can specify a different user for the connection; however, the user you specify must have the equivalent of LDAP administrator authority for the remote directory server.
1. If you select Distinguished name and password, provide the following information:
  - In the Distinguished name field, specify the LDAP administrator's distinguished name (DN) and password to ensure the wizard has enough authority to administer the EIM domain and the objects in it.
  - In the Password field, specify the password for the distinguished name.
  - In the Confirm password field, specify the password a second time for validation purposes.
2. If you select Kerberos keytab file and principal, provide the following information:
  - In the Keytab file field, specify the fully qualified path and keytab file name that contains the Kerberos principal for the wizard to use when connecting to the EIM domain. Or, click Browse to browse through directories in the IBM i integrated file system to select a keytab file.
  - In the Principal field, specify the name of the Kerberos principal to be used to identify the user.
  - In the Realm field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal jsmith in the realm ordept.myco.com, is represented in the keytab file as jsmith@ordept.myco.com.
3. If you select Kerberos principal and password, provide the following information:
  - In the Principal field, specify the name of the Kerberos principal for the wizard to use when connecting to the EIM domain.
  - In the Realm field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal jsmith in the realm ordept.myco.com is represented in the keytab file as jsmith@ordept.myco.com.
  - In the Password field, specify the password for the Kerberos principal.
  - In the Confirm password field, specify the password a second time for validation purposes.
4. If you select User profile and password, provide the following information:
  - In the User profile field, specify the user profile name for the wizard to use when connecting to the EIM domain.
  - In the Password field, specify the password for the user profile.
  - In the Confirm password field, specify the password a second time for validation purposes.
5. Click Verify Connection to test that the wizard can use the specified user information to successfully establish a connection to the EIM domain controller.
6. Click Next.
On the Specify Domain page, provide the following information:
1. In the Domain field, specify the name of the EIM domain that you want to create. Accept the default name of EIM, or use any string of characters that makes sense to you. However, you cannot use special characters such as = + < > , # ; \ and *.
2. In the Description field, enter text to describe the domain.
3. Click Next.
On the Specify Parent DN for Domain dialog, select Yes to specify the parent DN the wizard should use for the location of the EIM domain that you are creating.
This is the DN that represents the entry immediately above your domain name entry in the directory information tree hierarchy. Or specify No to have EIM data stored in a directory location with a suffix whose name is derived from the EIM domain name.
Note: When you use the wizard to configure a domain on a remote domain controller you should specify an appropriate parent DN for the domain. Because all necessary configuration objects for the parent DN must already exist or the EIM configuration may fail, you should browse for the appropriate parent DN rather than manually enter the DN information. Click ? for further information about using a parent DN.
On the Registry Information page, specify whether to add local user registries to the EIM domain as registry definitions. Select one or both of these user registry types:
Note: You do not have to create the registry definitions at this time. If you choose to create the registry definitions later, view adding a system registry definition and EIM configuration properties.
1. Select Local IBM i to add a registry definition for the local registry. In the field provide, accept the default value for the registry definition name or specify a different value for the registry definition name. The EIM registry name is an arbitrary string that represents the registry type and specific instance of that registry.
2. Select Kerberos to add a registry definition for a Kerberos registry. In the field provided, accept the default value for the registry definition name or specify a different value for the registry definition name. The default registry definition name is the same as the realm name. By accepting the default name and using the same Kerberos registry name as the realm name, you can increase performance in retrieving information from the registry. Select Kerberos user identities are case sensitive, if necessary.
3. Click Next.
On the Specify EIM System User page, select a User type that you want the system to use when performing EIM operations on behalf of operating system functions.
These operations include mapping lookup operations and deletion of associations when deleting a local IBM i user profile. You can select one of the following types of users: Distinguished name and password, Kerberos keytab file and principal, or Kerberos principal and password. Which user types you can select vary based on the current system configuration. For example, if Network Authentication Service is not configured for the system, then Kerberos user types may not be available for selection. The user type that you select determines the other information that you must provide to complete the page as follows:
Note: You must specify a user that is currently defined in the directory server which is hosting the EIM domain controller. The user that you specify must have privileges to perform mapping lookup and registry administration for the local user registry at a minimum. If the user that you specify does not have these privileges, then certain operating system functions related to the use of single sign-on and the deletion of user profiles may fail.
If you have not configured the directory server prior to running this wizard, the only user type you can select is Distinguished name and password and the only distinguished name you can specify is the LDAP administrator's DN.
1. If you select Distinguished name and password, provide the following information:
  - In the Distinguished name field, specify the LDAP distinguished name that identifies the user for the system to use when performing EIM operations.
  - In the Password field, specify the password for the distinguished name.
  - In the Confirm password field, specify the password a second time for verification purposes.
2. If you select Kerberos principal and password, provide the following information:
  - In the Principal field, specify the Kerberos principal name for the system to use when performing EIM operations
  - In the Realm field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal jsmith in the realm ordept.myco.com is represented in the keytab file as jsmith@ordept.myco.com.
  - In the Password field, enter the password for the user.
  - In the Confirm password field, specify the password a second time for verification purposes.
3. If you select Kerberos keytab file and principal, provide the following information:
  - In the Keytab file field, specify the fully qualified path and keytab file name that contains the Kerberos principal for the system to use when performing EIM operations. Or, click Browse to browse through directories in the IBM iintegrated file system to select a keytab file.
  - In the Principal field, specify the Kerberos principal name for the system to use when performing EIM operations.
  - In the Realm field, specify the fully qualified Kerberos realm name for which the principal is a member. The name of the principal and realm uniquely identify the Kerberos users in the keytab file. For example, the principal jsmith in the realm ordept.myco.com is represented in the keytab file as jsmith@ordept.myco.com.
4. Click Verify Connection to ensure that the wizard can use the specified user information to successfully establish a connection to the EIM domain controller.
5. Click Next.
In the Summary panel, review the configuration information that you have provided. If all information is correct, click Finish.

Finalize your EIM configuration for the domain

When the wizard finishes, it adds the new domain to the Domain Management folder and you have created a basic EIM configuration for this server. However, you must complete these tasks to finalize your EIM configuration for the domain:

Use the EIM Configuration wizard on each additional server that you want to have join an existing domain. Review the Joining an existing domain topic for more information.
Add EIM registry definitions to the EIM domain, if necessary, for other non-IBM i platforms and applications that you want to participate in the EIM domain. These registry definitions refer to the actual user registries that must participate in the domain.
Depending on your EIM implementation needs you should view eitherAdding a system registry definition or Adding an application registry definition .
Based on your EIM implementation needs, determine whether to:
1. Creating an EIM identifier for each unique user or entity in the domain and Creating EIM identifier association for them.
2. Creating a policy association to map a group of users to a single target user identity.
3. Create a combination of these.
Use the EIM Testing EIM mappings function to test the identity mappings for your EIM configuration.
If the only EIM user you have defined is the DN for the LDAP administrator, then your EIM user has a high level of authority to all data on the directory server.
Therefore, you might consider creating one or more DNs as additional users that have more appropriate and limited access control for EIM data. To learn more about creating DNs for the directory server, review Distinguished names in the IBM i Information Center. The number of additional EIM users that you define depends on your security policy's emphasis on the separation of security duties and responsibilities. Typically, you might create at least the two following types of DNs:
- A user that has EIM administrator access control
  This EIM administrator DN provides the appropriate level of authority for an administrator who is responsible for managing the EIM domain. This EIM administrator DN could be used to connect to the domain controller when managing all aspects of the EIM domain by means of IBM Navigator for i.
- At least one user that has all of the following access controls:
  - Identifier administrator
  - Registry administrator
  - EIM mapping operations
  This user provides the appropriate level of access control required for the system user that performs EIM operations on behalf of the operating system.
Note: To use this new DN for the system user instead of the LDAP administrator DN, you must change the EIM configuration properties for the IBM i platform. Review Managing EIM configuration properties to learn how to change the system user DN.

You might need to perform additional tasks if you created a basic network authentication service configuration, especially if you are implementing a single sign-on environment. You can find information about these additional steps by reviewing the complete configuration steps demonstrated by the scenario, Enable single sign-on for IBM i .