Re: Single SignOn (SSO)

[Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>]

Hi Jerry

If I understand the question, by "db2 side", you mean on the IBM i, 
right? I assume you are using NAS (Kerberos) and EIM (Enterprise 
Identity Management).

There are no commands for enrolling people in EIM - I suggest someone 
like Pat Botz be brought in to do it - he has the tools - so does IBM 
Labs, of course.

There are APIs one can call to do the enrollment. You'd have to 
roll-your-own if you don't get someone like Pat to help.

To make their sessions work, it's not done on the IBM i - it's done, so 
far as I know, in the ACS config file, each system definition can be set 
to use Kerberos.

Now the session files can inherit the setting from the main config. This 
is, again, at the PC, with some of it maybe at some central network 
site, if you're doing it that way.

HTH and isn't too confusing!

Vern

On 6/20/2018 11:41 AM, Jerry Draper wrote:
> We have SSO set up on our system and now will be "enrolling" hundreds 
> of users.
>
> We want to do it in batch on the db2 side and not in ACS.
>
> What are the IBM I cmds?
>
> Thanks,
>
> Jerry