Re: EIM SSO expired password issues

Hi Paul

This is valid behavior.

Basic concept - SSO means that a password is not used or needed. It is not even considered when authenticating, since SSO assumes that authenticating is done by the 3rd-party trusted Kerberos ticket manager, which is Windows in your case.

So since this is valid behavior, I would say that your regular user profiles should all be set to PASSWORD(*NONE) - this prevents the use of this profile for things like ODBC, say, as I understand it.

There are other considerations I won't speak of, such as profiles you need for access to the machine when Kerberos is broken.

HTH
Vern

On 8/30/2017 3:03 PM, Steinmetz, Paul wrote:

We implemented EIM SSO earlier this year.
Overall working well.

Outstanding issues below.

1) Telnet connection configured as - Use Kerberos principal; no prompting.
Telnet working fine, no password needed.
iSeries password expires.
Telnet connections continue to work even though password expired.

Non-Telnet connections (mapped drives, ODBC for mail merges, etc,) fail due to expired password.
User is NOT given a prompt to change their password.
iSeries userprofile/password is different from Windows user/password.

2) New iSeries userprofile is created and configured for EIM SSO.
Previous to EIM SSO, we set the password to match the profile, PWDEXP set *YES.
User would get a prompt to change their password on first use.
With EIM SSO, the prompt no longer occurs.

For both issues,
Any thoughts from the group for managing iSeries passwords when configured for EIM SSO.

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx
http://www.pencor.com/