Jim,
With EIM/SSO, you associate a userID on another platform, e.g. Windows, or AIX, etc., with an OS/400 user profile, and then, when the user signs-on and authenticates to that "owning" network, they are issued a Kerberos token, and that token is passed "under the covers" and so you normally set those OS/400 user profiles that are using EIM/SSO to PSWD(*NONE), as you don't want them to sign-on any other way, or to be able to change their password via OS/400 or IBMi, but only through the central EIM/SSO mechanism.
That's the whole "big idea" behind "Single-Sign-On."
At least, as far as I understand it.
HTH,
Mark S. Waterbury
On Wednesday, October 9, 2019, 11:09:57 PM EDT, midrange <franz9000@xxxxxxxxx> wrote:
Why do I remember having problems whenever QUSER would get disabled. It's been a long long time ago, .. perhaps it was a SNA issue?
And why would EIM/SSO allow password *none profiles to sign on?
Jim Franz
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Waterbury
Sent: Wednesday, October 09, 2019 9:01 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: disable all Q* ibm supplied profiles and chaning default passwords
Hi, Jim,
One interesting wrinkle ... you can sign-on to a user profile that has a password set to *NONE, if you are on a system that is using EIM/SSO.
Only if you *DISABLE the profile, can you totally prevent it from being used to sign-on interactively.
This does not prevent those profile(s) from being used to run batch jobs or "services."
Just saying ...
Mark S. Waterbury
On Wednesday, October 9, 2019, 8:19:09 PM EDT, midrange <franz9000@xxxxxxxxx> wrote:
I think this thread has pointed out some of the misconceptions that surround ibm i security.
One point that I've not seen yet - there is a difference between a. disabling a profile or b. changing a default password to *NONE (to never be used to sign on) Carol Woodbury's books recommended QPGMR, QSRV, QSRVBAS, QSYSOPR, QUSER all to set to *NONE The profile can be used by parts of the OS, but not to log in.
New releases come this way, but if you are carrying 30 years of baggage, restoring to new hardware, it takes some cleanup.
Jim Franz
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
midrange.com
