Re: System i security management questions

Brad,

We use Tivoli Identity Manager to keep our userid's in sync between IBM i
and Windows. It can do more (mainframes, etc). We used a consultant from
our BP (Sirius) to help set this up for us. Not everyone who has a
Windows account necessarily has an i account. Tivoli still manages this
well. If we suspend a user in Tivoli it suspends them in Windows and
changes their i account to disabled. Deletes, well, delete. Yes, you can
alter the parameters like object ownership, etc. We even have Tivoli
enroll them into Lotus Notes (if we specify that user has Notes).

To get someone enrolled into anything on any system requires someone to
fill out a Notes workflow request. After it goes through the appropriate
approval process our BOFH goes into Tivoli and enrolls them. The workflow
may continue on (prepare them a new laptop, etc). I cover for the BOFH
when she's out of the office.

We have some tie ins between lotus and ADP to notify us when someone is
flagged for termination. Just in case they didn't let systems know and we
can now process them alternatively. Normally we suspend people for a set
number of days before we delete them.

For awhile we were using SSO and EIM to assure single sign on. You would
enter Windows and certain users, even if they had an i account could only
use 5250 if they used 'bypass signon' If they tried to sign on it
wouldn't let them. See CHGUSRPRF LCLPWDMGT(*NO). This was to ensure that
the users used biometrics to sign on. We had this customer...

HTH


Rob Berendt