RE: more on Kerberos

Hi Rich

I don't see this as the solution (although possibly I'm wrong).

To my knowledge the password validation isn't done on the i5, it's done on
the Kerberos server. The Kerberos server issues the user a ticket once the
account has validated and the iSeries uses the ticket rather than a password
to control access. Therefore, changing the iSeries password level would
merely affect all the users that sign on to the iSeries, not those going
through Kerberos.

More likely there's something else at work.

I think I'd work through the steps for setting up the server again. Is this
an EIM setup ?

Regards
Evan Harris



-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rich Loeber
Sent: Tuesday, 18 March 2008 9:54 a.m.
To: Midrange Systems Technical Discussion
Subject: Re: more on Kerberos

Maybe the solution, then, is to bump it up to 2 or 3, but that is a change
that is not taken lightly and requires planning before implementation.

Rich
------------------------------------------------------------------------

Mike Cunningham wrote:

Still at 0

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rich Loeber
Sent: Monday, March 17, 2008 4:12 PM
To: Midrange Systems Technical Discussion
Subject: Re: more on Kerberos

Mike,

What password type do you have specified in the system values on i5/OS.
Types 2 and 3, I believe, will support mixed case passwords.

Rich Loeber
Kisco Information Systems
http://www.kisco.com


----------------------------------------------------------------------
----

Mike Cunningham wrote:

I am getting closer to getting this to work between our Windows
Kerberos server and i5OS. I think my current problem is related to
mixed case passwords. Our Windows domain is setup to require the use
of mixed case passwords so when I did the iSeries Navigator Wizard to
setup Kerberos I used a mixed case password (e.g. not the real one but
something like Kt639hJ). When I issue the command kinit -k
krbsvr400/system.pct.edu@xxxxxxx<mailto:krbsvr400/system.pct.edu@xxxxx
du> I get an EUVF06016E Password not correct error If I leave the -k
off and issue the command
Kinit

krbsvr400/as400adm.pct.edu@xxxxxxx<mailto:krbsvr400/as400adm.pct.edu@xxxxxxx

And then enter the mixed case password I get a valid ticket issued

Does anyone know for sure if the i5OS half of this process can't deal
with mixed case passwords? We do not have long passwords enabled for
normal signon and there is nothing in the Kerberos manual that I can
find that says mixed case passwords are not allowed