Re: EIM / LDAP

All from QSH
kinit <your windows userID>
at the prompt type your windows password.
If that works it means communication between i5/OS and the domain
controller is working normally.

Interesting, the Redbook (on pages 109 - 110) doesn't mention this step. I
fail right here with a EUVF06014E Unable to obtain initial credentials.
Status 0x96c73a0e - Encryption type is not supported.

Unfortunately, while I can Google the error message, nothing shows up for
this status message.

NAS properties shows that I have the following checksum types:
Application: rsa-md5
KDC: rsa-md5
Safe: rsa-md5-des

"Use new algorithm for rsa-md5-des" is checked.

Under tickets, I show the same selected encryption types for Initial
Ticket and Ticket Granting Service:
des-cbc-crc
des-cbc-md5

All those are the defaults shown in the Redbook.

keytab list
This will give you a dump of the entries in your keytab file.
Copy the krbsvr/<your i5/OS FQDN>@<YOUR FULLY QUALIFIED WINDOWS DOMAIN
NAME> into the paste buffer

This works, and returns principals for krbsvr400, ldap, etc.

kinit -k <paste the contents of the paste buffer here>
This uses the password from the keytab file
This will probably fail based on your comments below

This completes successfully.

kinit <paste the contents of the paste buffer here>
Note: same command as above but remove the "-k" parameter
This will prompt you for the password. Type the password exactly as you
entered it.

This also completes without an error.

If this works, the keytab file on i5/OS must have been changed by

someone

after you ran the wizard.
If this doesn't work because the password is incorrect, then you have a
password mismatch. If you didn't run the ".bat" file yourself on the
Windows domain controller, what may have happened is that you chose a
password (when running the NAS config wizard) that did not meet the
windows password rules. The Windows Admin probably changed the password

in

the bat file to meet those naming conventions.

The admin ran the batch file under my supervision. We ran two batch
files, as the first one did not include a principal for ldap. The second
one used the same password as the first [with all passwords for all
principals being the same...].