Re: EIM / LDAP

You shouldn't have to configure LDAP before using the Wizard to create

an

EIM domain.

If you don't know the administrator ID and/or password, use iSeries
Navigator, Network, Servers, TCP/IP. Scroll to the bottom of the list

and

you'll find IBM Directory Server. Double-click it. (Make sure you
connect to the system as QSECOFR).

You'll see a multi-panel window. On the General panel in the middle of

the

page is "Administrator information". You can change the administrator

ID

(make sure whatever you change it to starts with "cn=" followed by
whatever name you want). Press the "Password..." button and you can set

the password to whatever you want.

Thanks for those tips, I'll file those away. I was able to get the wizard
to work by using "Unconfigure" on IBM Directory Server, then relaunching
the wizard to create an EIM domain.

Everything looks good when using the QSH commands to verify setup. When
trying to enable 5250 Kerberos authentication I get CWBSY1017 - rc=612
errors. The redbook indicates that this means "the password for the
secret key entered on the KDC did not match the password provided when
running the Network Authentication Service wizard that created the key." I
don't see how this could be, as we used the batch file created by wizard
to update the KDC.

I'm currently waiting for our business partner/Arrow/IBM to resolve our
software support. The business partner and Arrow say that we have
support. IBM says that the contract is "not signed", meaning that the
entitlement team says something is missing, but of course can't tell me
what is missing.

In the meantime we look like jackasses: we tell management we can enable
SSO once we have a Windows 2000 domain. We get approval, we implement the
new domain, and now we can't tell them why SSO isn't working, when it will
be working or even when we will be able to work on the issue.

I'd find another line of work, but I'm addicted to the glamour, prestige
and acclaim that come from working in I/S..... :)