RE: iSeries Security Enterprise Identity Mapping. Vendor Y/N ? -- MIDRANGE-L

Scenario 1: Administrators are in complete control of what identity mapping
associations have been made. EIM only provides the information about which
identities are associated with each other. Knowing this information does
not give an application the privilege of acting on that information.  EIM
does not do authentication. Applications must continue to do
authentication. EIM allows those applications to perform authentication
using whatever user registry the application and the administrator want it
to use. The application then uses EIM, AFTER it authenticates the user, to
find the appropriate user ID in the user registry being used for
authorizaiton. What is "appropriate" is controlled by the adminstrator. So,
the short answer to your question is that the application (or OS interface)
is still responsible for choosing whether to trust the person that is
attempting to authenticate.

Scenario 2:
EIM is not involved in authentication in anyway. EIM is "user registry
agnostic". Each adminsitrator will have to determine if they trust the
desktop's (i.e. login platform's) authentication mechanisms. There are no
changes required in those mechanisms to allow EIM to map from an ID in that
user registry to another ID in another user registry.

The iSeries single sign-on strategy is based on Kerberos (not windows
Kerberos, just Kerberos) and EIM. We only talk about Win2K, because the
reality is: a) win2k uses Kerberos by default when logging into a domain;
b) rightly or wrongly, most adminstrators have already chosen to trust the
win2k login mechanism. EIM, however, does not force the administrator to
trust win2k authentication.

Patrick Botz
Senior Software Engineer
eServer Security Architect
(507) 253-0917, T/L 553-0917
email: botz@us.ibm.com




                      "Steve Richter"
                      <srichter@autocode        To:       
<midrange-l@midrange.com>
                      r.com>                    cc:
                      Sent by:                  Subject:  RE: iSeries Security  
Enterprise Identity Mapping. Vendor Y/N ?
                      midrange-l-admin@m
                      idrange.com


                      05/01/2002 11:16
                      AM
                      Please respond to
                      midrange-l





Pat,

How does EIM know that the W2K PC running CAE that is logged on to by user
STEVE is not in a cubicle down the hall but is actually in Minsk and should
be prevented from auto signing onto the iSeries and adding bogus data to
the
credit card settlement file ?

2nd scenario. The user name and password are entered on the pc at
startup/login time. There are probably device drivers running on the pc at
that time. Could these drivers be silently hacked to intercept the login
keystrokes ?

Also, when is V5R2 and EIM available to iSeries models other then the 890 ?

Thanks,

Steve Richter



_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.