RE: IFS mapped drive issues

["Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>]

Had issue today again, user had to change their AS/400 password, mapped drives failed, user was disabled, fixed using go nets.
I think this all boils down to authentication issues.
It appears the IFS mapped drives may be caching the password, when password changes,  the mapped drive is trying to authenticate with the old password, account is then disabled with netserver.
Sometimes, it is as simple as reenabling the usrprofile.
Other times, resolutions are varied.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Wednesday, June 05, 2013 11:57 AM
To: Midrange Systems Technical Discussion
Subject: RE: IFS mapped drive issues

Yes, third party packages make it harder to implement things like program only access in which the only way to access data is by programs which adopt authority.  Thus handling the security of multiple databases.  When we had the BBU's the people handling customer X's data could not see customer Y's data.  We had plants dedicated to particular large customers. 
 Or, even of more concern, they buy from each other.  You sure didn't want
01 being able to see the cost of an item produced by 02 and sold to 01 at the profit margin.
I feel your pain.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail to:  2505 Dekko Drive
          Garrett, IN 46738
Ship to:  Dock 108
          6928N 400E
          Kendallville, IN 46755
http://www.dekko.com





From:   "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To:     "'Midrange Systems Technical Discussion'" 
<midrange-l@xxxxxxxxxxxx>, 
Date:   06/05/2013 11:48 AM
Subject:        RE: IFS mapped drive issues
Sent by:        midrange-l-bounces@xxxxxxxxxxxx



I wish that was an option.
Each DB is for a different subsidiary, security, tax, audit other factors.
Also, they are all 3rd party packages, need to abide by those 
requirements.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [
mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Wednesday, June 05, 2013 11:43 AM
To: Midrange Systems Technical Discussion
Subject: RE: IFS mapped drive issues

If the databases are owned by different group profiles, and you're 
concerned about new objects each user may create getting the right group 
profile assigned, this can be an issue.
We ended up consolidating databases.  The business was ripe for it. 
Instead of Dilbert's BBU's (battling business units) they were all 
consolidated into one happy company.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail 
to:  2505 Dekko Drive
          Garrett, IN 46738
Ship to:  Dock 108
          6928N 400E
          Kendallville, IN 46755
http://www.dekko.com





From:   "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To:     "'Midrange Systems Technical Discussion'" 
<midrange-l@xxxxxxxxxxxx>, 
Date:   06/05/2013 10:35 AM
Subject:        RE: IFS mapped drive issues
Sent by:        midrange-l-bounces@xxxxxxxxxxxx



Multiple signons for multiple dbs.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [
mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Wednesday, June 05, 2013 10:33 AM
To: Midrange Systems Technical Discussion
Subject: RE: IFS mapped drive issues

Is this because one PC may be shared between several users?
Or, is this because one PC user may have mutiple IBM i signon's?  For 
example SUSAN may have SUSAN01 for database 01 and SUSAN02 for database 
02.  We used to have this crud.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail 
to:  2505 Dekko Drive
          Garrett, IN 46738
Ship to:  Dock 108
          6928N 400E
          Kendallville, IN 46755
http://www.dekko.com





From:   "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To:     "'Midrange Systems Technical Discussion'" 
<midrange-l@xxxxxxxxxxxx>, 
Date:   06/05/2013 12:28 AM
Subject:        RE: IFS mapped drive issues
Sent by:        midrange-l-bounces@xxxxxxxxxxxx



One Windows  user may have 3,4,5,6 iSeries accounts, they cannot match. We 


run many different apps, each requiring separate accounts for login.
If we had only one iSeries app, I agree, they could then match.
I setup and tested Enterprise Identity Mapping (EIM) along with Kerberos, 
again, if we only had one app, this could work.

I am going to revisit Net Use, see if I can it to work for IFS 

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [
mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Tuesday, June 04, 2013 11:34 PM
To: Midrange Systems Technical Discussion
Subject: RE: IFS mapped drive issues

<snip>
None of our Windows accounts equal our iSeries accounts.
</snip>
I disagree with this philosophy.  Both Windows, and IBM i, should have 
their security taken seriously.  Critical data is stored on both.  Done 
right, then it's no great risk to have them be the same.  Done REALLY 
right and it could actually be MORE secure to have them the same.  Like 
SSO with biometrics.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail 
to:  2505 Dekko Drive
          Garrett, IN 46738
Ship to:  Dock 108
          6928N 400E
          Kendallville, IN 46755
http://www.dekko.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, 
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a 
moment to review the archives at http://archive.midrange.com/midrange-l.