RE: Single Sign On - EIM configuration questions and troubleshooting -- MIDRANGE-L

Both Jwalk and Legasute configured and working for SSO - Single signon !!!

1) Below was needed for both Jwalk and Legasuite

Configuring the Registry and Group Policy for Kerberos
Additional steps are required to configure LegaSuite with Kerberos on Windows 8 and Windows 7 as the security policies have changed and partially block access to the necessary Kerberos levels. Modifications are required in the Windows registry and group policy to allow access. If these steps are not followed, a Kerberos connection cannot be made unless logging on to the host. Consult the Microsoft Technet website (opens new window) for the article about Changes in Kerberos and configuring the registry.

Complete the task below to configure the registry and group policy to allow access to the Kerberos levels and to enable Single Sign on Windows.

Modifying the Registry

Run regedit32.exe (administration rights are required to run this command)

Locate and expand the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters.

If the parameter "allowTGTSessionKey" does not exist,right-click on the key "Parameters", and select New > DWORD (32-bit) Value. Assign the value '1' (the default value is 0).

If the parameter already exists, and its value is '0', right-click on the parameter and click "Modify".

Set the value to "1" and exit.

Modifying the Group Policy

Run gpedit.msc (administration rights are required to run this command).

Expand the Group Policy window.

Expand Local Computer Policy and drill down to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.

Go to Network security - Configure encryption types allowed for Kerberos.

Double-click on Network security - Configure encryption types allowed for Kerberos.

Select "AES256_HMAC_SHA1"

Press OK to exit the dialog.

Return to the Group Policy window and exit.

2) Below additions needed to legasuite.ini file for Legasuite

AutomaticSignOn=3
KerberosPrincipal=Pencor06.pencor.com

3) Below addition needed to jwalk.ini file for Jwalk

AutomaticSignOn=3

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Steinmetz, Paul
Sent: Friday, March 03, 2017 2:19 PM
To: 'Midrange Systems Technical Discussion'
Subject: RE: Single Sign On - EIM configuration questions and troubleshooting

On our R&D LPAR, Single Signon configured and working, for one user, for iSeries Access for Windows.
Working on SSO config for Rocket Jwalk GUI and Legasuite GUI at this time.

Anyone running SSO for either of these products.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Steinmetz, Paul
Sent: Thursday, March 02, 2017 3:08 PM
To: 'Midrange Systems Technical Discussion'
Subject: RE: Single Sign On - EIM configuration questions and troubleshooting

Regarding item 1 below,
I found the wizard options in IBM Navigator for I Network, All Tasks, EIM Security, All Tasks, NAI

They were sort of hidden.
There are other EIM and NAI options above all tasks, not where the wizards are located.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Steinmetz, Paul
Sent: Wednesday, March 01, 2017 2:19 PM
To: 'Midrange Systems Technical Discussion'
Subject: Single Sign On - EIM configuration questions and troubleshooting

I'm working on Single Sign On - EIM configuration
I'm creating a basic single sign-on configuration for Pencor06 with a single user.

For references, using
IBM I Version 7.2 Security Single sign-on - rzamzpdf.pdf https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_72/rzamz/rzamzpdf.pdf

IBM Software Technical Document 558590066 - Single Sign-On Configuration
http://www-01.ibm.com/support/docview.wss?uid=nas8N1012326

Historical document 319249546 - Troubleshooting Single Sign-on
http://www-01.ibm.com/support/docview.wss?uid=nas8N1016361

Work sheets completed.

1) I'm using the OpsNav EIM and Network Authentication Service Configuration wizards.
Are these the best and current wizards to use?
I didn't a wizard option under IBM Navigator for I.

2) When testing the NAS configuration
QSH
keytab list

Principal: krbsvr400/10.X.XX.X@xxxxxxxxxx
Key version: 1
Key type: 56-bit DES
Entry timestamp: 2017/03/01-08:49:16

I did notice that the keytab list returned my iSeries IP instead of the iSeries fully qualified domain name.
The example shows fully qualified domain name.
I'm not sure if this is an issue, as of yet.

kinit -k krbsvr400/10.x.xx.x@xxxxxxxxxx

Further states - If everything is set up correctly, the only thing returned after the kinit -k command should be a $ prompt as seen in the screenshot above.

EUVF06014E Unable to obtain initial credentials.
Status 0x96c73a06 - Client principal is not found in security registry.

I'm not sure what the issue is at this point.

3) When exiting the wizard, EIM configuration in process.
Creating domain P06EIM

EIM configuration warning
Error occurred while creating domain P06EIM. Authentication error occurred. Verify the the logon DN and password are correct.

The problem here is you can't continue without cancelling the wizard, which turn loses the confug.
Must start from scratch.

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx
http://www.pencor.com/

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: http://amzn.to/2dEadiD