Re: EIM SSO expired password issues

[Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>]

Hi Paul

This is valid behavior.

Basic concept - SSO means that a password is not used or needed. It is 
not even considered when authenticating, since SSO assumes that 
authenticating is done by the 3rd-party trusted Kerberos ticket manager, 
which is Windows in your case.

So since this is valid behavior, I would say that your regular user 
profiles should all be set to PASSWORD(*NONE) - this prevents the use of 
this profile for things like ODBC, say, as I understand it.

There are other considerations I won't speak of, such as profiles you 
need for access to the machine when Kerberos is broken.

HTH
Vern

On 8/30/2017 3:03 PM, Steinmetz, Paul wrote:
> We implemented EIM SSO earlier this year.
> Overall working well.
>
> Outstanding issues below.
>
> 1) Telnet connection configured as - Use Kerberos principal; no prompting.
> Telnet working fine, no password needed.
> iSeries password expires.
> Telnet connections continue to work even though password expired.
>
> Non-Telnet connections (mapped drives, ODBC for mail merges, etc,) fail due to expired password.
> User is NOT given a prompt to change their password.
> iSeries userprofile/password is different from Windows user/password.
>
> 2) New iSeries userprofile is created and configured for EIM SSO.
> Previous to EIM SSO, we set the password to match the profile, PWDEXP set *YES.
> User would get a prompt to change their password on first use.
> With EIM SSO, the prompt no longer occurs.
>
> For both issues,
> Any thoughts from the group for managing iSeries passwords when configured for EIM SSO.
>
> Thank You
> _____
> Paul Steinmetz
> IBM i Systems Administrator
>
> Pencor Services, Inc.
> 462 Delaware Ave
> Palmerton Pa 18071
>
> 610-826-9117 work
> 610-826-9188 fax
> 610-349-0913 cell
> 610-377-6012 home
>
> psteinmetz@xxxxxxxxxx
> http://www.pencor.com/