Network Authentication Service with a second Realm

I have an established and working configuration for single sign-on for my V7R3 environment. My company is migrating our Active Directory domain from "company.com" to "corp.company.com". We use a Microsoft Active Directory for Kerberos authentication.

In attempting to set up a second Realm of corp.company.com, I went into IBM Navigator for I and selected Security / Network Authentication Service / Configuration Wizard and configured the services necessary for single sign-on for the second realm. I produced a .bat file which was run on the new corp.company.com domain controller.

I have also attempted to update the Realm properties by going to Security / Network Authentication Service / Realms and added a second Realm with the appropriate KDC.

I can see the entries in the keytab list and have verified that the passwords match between NAS and AD. I have performed a
kinit -k krbsvr400/IBMiMachineName.company.com@xxxxxxxxxxx<mailto:krbsvr400/IBMiMachineName.company.com@xxxxxxxxxxx> and gotten a proper response. SSO is working with a 5250 session. I do not get a positive response when attempting the same kinit -k command with the CORP.COMPANY.COM command.

Does anyone have links to information or documentation that would address adding a second realm to an existing and working NAS/EIM SSO configuration?


Joe Sizer
IBM I Power9 Administrator
Pencor Digital Services

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
Office: 610.826.9080 Ext. 2117