Single sign-on planning worksheets
Complete these worksheets to ensure that you have met all of the prerequisites for single sign-on and that you have considered all of the aspects of your particular system and its security requirements.
Before you use these configuration planning worksheets, you need to plan your overall single sign-on implementation. Use these configuration planning worksheets to ensure that you have met all of the prerequisites, and that you have taken into consideration all of the aspects of your particular IBM® i environment.
Single sign-on prerequisite worksheet
This detailed work sheet is provided to help you ensure that you meet all hardware and software prerequisites for implementing single sign-on. To ensure a successful implementation, you must be able to answer Yes to all prerequisite items in the work sheet and you should gather all the information necessary to complete the work sheets before you perform any configuration tasks.
| Prerequisite work sheet | Answers |
|---|---|
| Is your system running IBM i 5.4, or later? | |
Are the following options and licensed programs
installed on your server?
|
|
| Have you installed an application
that is enabled for single sign-on on each of the PCs that will participate
in the single sign-on environment? Note: For the scenarios in this
information, all of the PCs have IBM i
Access Client Solutions (5733-XJ1) installed. See IBM i
Access Client Solutions: Getting Started
|
|
If you intend to use the Synchronize
Functions wizard in System
i Navigator to
propagate an existing single sign-on configuration across multiple
systems or if you intend to configure Management Central servers for
single sign-on using System
i Navigator :
|
|
| Do you, the administrator, have *SECADM, *ALLOBJ, and *IOSYSCFG special authorities? | |
Do you have one of the following
systems acting as the Kerberos server (also known as the KDC)? If
yes, specify which system.
|
|
| Are all your PCs in your network configured in a Windows domain? | |
| Have you applied the latest program temporary fixes (PTFs)? | |
| Is the IBM i model time within 5 minutes of the system time on the Kerberos server? If not, see Synchronize system times. |
.Single sign-on configuration planning worksheet
This is a configuration planning worksheets, designed to ensure that you have met all of the hardware and software prerequisites for single sign-on. Additionally, this worksheet ensures that you have completed those Enterprise Identity Mapping (EIM) and network authentication service configuration tasks that are required for a successful single sign-on environment.
Note: The single sign-on configuration
planning worksheet is designed to assist you with the implementation
of a single sign-on environment based on Enterprise Identity Mapping
(EIM) and network authentication services. If you intend to use a
different authentication mechanism, such as IBM Tivoli® Directory
Server for IBM i or
digital certificates, you might need to adapt portions of this work
sheet to better suit your needs.
| Configuration planning work sheet | Answers |
|---|---|
| Use the following information to complete the EIM Configuration wizard: | |
How do you want to configure EIM for your system?
|
|
| Where do you want to configure your EIM domain? | |
| Do you want to configure network authentication service? | |
| The Network Authentication
Service wizard launches from the EIM Configuration wizard. Use the
following information to complete the Network Authentication Service
wizard: Note: The Network Authentication Service wizard
can also be launched independently of the EIM Configuration wizard.
|
|
| What is the name of the Kerberos default realm
to which your system will belong? Note: A Windows domain is similar to a Kerberos realm.
|
|
| Are you using Microsoft Active Directory? | |
| What is the Kerberos server, also known as a key distribution center (KDC), for this Kerberos default realm? What is the port on which the Kerberos server listens? | |
| Do you want to configure a password server for
this default realm? If yes, answer the following questions: What is name of the password server for this Kerberos server?
What is the port on which the password server listens? |
|
For which services do you want to create keytab
entries?
|
|
| What is the password for your service principal or principals? | |
| Do you want to create a batch file to automate adding the service principals for System A to the Kerberos registry? | |
| Do you want to include passwords with the IBM i service principals in the batch file? | |
| As you exit the Network Authentication Service wizard, you will return to the EIM Configuration wizard. Use the following information to complete the EIM Configuration wizard: | |
| Specify user information that the wizard should use when configuring the directory server. This is the connection user. You must specify the port number, administrator distinguished name, and a password for the administrator. | |
| What is the name of the EIM domain that you want to create? | |
| Do you want to specify a parent DN for the EIM domain? | |
| Which user registries do you want to add to the EIM domain? | |
| Which EIM user do you want System A to use when performing EIM operations? This is the system user. | |
| After you complete the EIM Configuration wizard, use the following information to complete the remaining steps required for configuring single sign-on: | |
| What is the IBM i user profile name for the user? | |
| What is the name of the EIM identifier that you want to create? | |
| What kinds of associations do you want to create? | |
| What is the name of the user registry that contains the Kerberos principal for which you are creating the source association? | |
| What is the name of the user registry that contains the IBM i user profile for which you are creating the target association? | |
| What information do you need to supply to test EIM identity mapping? | |