RE: Single sign on

If Novell supports kerberos authentication, then a systems running Windows
2000/XP domain or Windows 2000/XP workstations configured to authenticate
to a Novell KDC should work fine in the Single Sign-on environment that is
available with V5R2 of OS/400.

We have tested in environements with Windows 2000/XP clients configured to
point at non-Windows Kerberos servers and it works just fine.  We have
never tested in an environment with using Novell as the non-Windows KDC.

The single sign-on enablement requires the configuration of Network
Authentication Service (i.e. Kerberos) on each OS/400 system you want to
participate in the single sign-on environment and to configure enterprise
identity mapping (EIM) for the network and have each OS/400 system point at
the EIM domain controller.

Once this is done, then you can have true single sign-on with iSeries
Access/Navigator, ODBC/JDBC/DRDA programs you write on windows, Netserver,
QFileSvr.400, PC5250 emulator, and several additional functions and
products coming in the not too distant future.

The iSeries information center contains information on how to configure
Kerberos. I would just use the configuration wizard which is launched from
iSeries Navigator by right-clicking on Network authentication service,
found under the security tab.

EIM is the only new piece of technology so we have lots of information
about that. The best place to learn about EIM is at
http://publib.boulder.ibm.com/eserver, select your language and then select
Enterprise identity mapping from the left-hand pane. I strongly encourage
you to read the concepts article first. There is other great information
there related to planning, etc. The way to configure an OS/400 system to
use EIM is to run the EIM configuration wizard which is launched by
right-clickicking on the Configuration folder under EIM, which is under the
Network folder.

Since we have never configured a single sign-on environment with Novell as
the KDC, I would greatly appreciate any feedback from anyone that does
this. I expect that it will not be any more or less work than it is to
configure single sign-on using a KDC running on a windows domain
controller.

Patrick Botz
Senior Technical Staff Member
eServer Security Architect
(507) 253-0917, T/L 553-0917
email: botz@xxxxxxxxxx