RE: Tying in biometric scanning to 5250 sign on

A possible solution, if you require biometrics, would be to require it for
authentication to the user's workstation (ultimately the Windows domain).
Once authenticated to the Windows domain, you can then use Kerberos to
authenticate to the iSeries.  

Additional comments below...

Kurt

> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
> bounces@xxxxxxxxxxxx] On Behalf Of Chris Bipes
> Sent: Wednesday, March 01, 2006 10:16 AM
> To: Midrange Systems Technical Discussion
> Subject: RE: Tying in biometric scanning to 5250 sign on
> 
> See in line comments: **
> 
> 
> Christopher Bipes
> Information Services Director
> 
> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx
> [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Wilt, Charles
> Sent: Tuesday, February 28, 2006 5:20 PM
> To: Midrange Systems Technical Discussion
> Subject: RE: Tying in biometric scanning to 5250 sign on
> 
> I don't know about 3rd party emulators, but I assume their vendors could
> add bypass sign on support if the wanted assuming they don't already
> have it.
> 
> As far as not allowing bypass sign on, why not?  By-pass sign on passes
> the user ID & sign on encrypted, whereas the 5250 sign on screen passes
> it unencrypted.  Unless you are using SSL tn5250, by pass sign on is
> more secure.
> ** They do, not that we have more secure desktops, this needs to be
> re-visited.  We did not like a PC being left signed on and any one being
> able to walk up and open the emulator and be signed on at the PC user.
> With XP and AD we have prevented the PC from being access with policies
> about secured screen saver.
[Kurt] Your users probably use their pc's for more than just terminal
emulation so this should be addressed through 
a) security policy - make sure your users read, understand and follow your
companies security policy.  
b) operating system controls - Group policy in a Windows environment allows
you to control the screen saver settings.  On OS400 there are several
companies that have inactive session monitors.
> 
> As far as your external customers, it would seem to me that you could
> make use of SSO.  After all, SSO uses Kerberos and active director isn't
> the only Kerberos server out there.  I'm no expert, but I'd be willing
> to bet a six pack that you could get SSO to work for your external
> users.
> ** This will take some more research and knowledge.  Would I have to
> open our AD to the Internet?  If so, what security implementations would
> that cause?
[Kurt] Your Kerberos server would have to be opened to the internet and your
external users computers would have to be added to your Windows domain.
This isn't likely to happen so take the bet.
> 
> I don't see much of a solution with you 3rd party apps except to ask the
> vendor to support the iSeries user profiles directly instead of a custom
> authentication.
> ** We have.  Gone no where.  Wish I was more involved in the decision
> process.  I can't even get these vendors to use the Group Profile
> capacity of user profiles.  I hate putting USERS into aux sec files.
> 
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.