Hi Paul,
With EIM, you don't have to worry about IBM i passwords. That's the whole point.
Issue 1)
Telnet issues - Kerberos will authenticate if passwords are expired. The profile is still enabled and you're not using passwords to authenticate with your emulator. Set the password to *none for most users if you can. There's always exceptions.
Non-telnet issues...doesn't sound like you have Kerberos configured right for those services because they're still relying on password authentication. You need to ensure those services are Kerberos enabled and have service principals defined.
Issue 2)
Sounds exactly like what you want to happen: no prompting to change passwords. Just set the password to *NONE, rather than a default password. That should work for the standard telnet user.
Steve Pitcher
iTech Solutions
Office: (203) 744-7854 Ext. 176
Mobile: (902) 301-0810
http://www.itechsol.com
http://www.iInTheCloud.com
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Steinmetz, Paul
Sent: Wednesday, August 30, 2017 5:03 PM
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxx>
Subject: EIM SSO expired password issues
We implemented EIM SSO earlier this year.
Overall working well.
Outstanding issues below.
1) Telnet connection configured as - Use Kerberos principal; no prompting.
Telnet working fine, no password needed.
iSeries password expires.
Telnet connections continue to work even though password expired.
Non-Telnet connections (mapped drives, ODBC for mail merges, etc,) fail due to expired password.
User is NOT given a prompt to change their password.
iSeries userprofile/password is different from Windows user/password.
2) New iSeries userprofile is created and configured for EIM SSO.
Previous to EIM SSO, we set the password to match the profile, PWDEXP set *YES.
User would get a prompt to change their password on first use.
With EIM SSO, the prompt no longer occurs.
For both issues,
Any thoughts from the group for managing iSeries passwords when configured for EIM SSO.
Thank You
_____
Paul Steinmetz
IBM i Systems Administrator
Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home
psteinmetz@xxxxxxxxxx
http://www.pencor.com/
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
http://amzn.to/2dEadiD
midrange.com
