RE: Network Authentication Service with a second Realm

Hello Vern,

Thanks for the suggestion. I have a statement of work for IBM Systems Lab Services. I may go that route.

Joe


-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Vern Hamberg via MIDRANGE-L
Sent: Thursday, June 23, 2022 6:50 AM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Cc: Vern Hamberg <vhamberg@xxxxxxxxxxxxxxx>
Subject: Re: Network Authentication Service with a second Realm

________________________________
CAUTION: This email originated from outside of the PENCOR network. Do not click on any links or open attachments unless the sender is known, and the content is verified as safe.
________________________________

Hi Joe

I strongly recommend you contact IBM i support for help with this. Now I used to work for an ISV and had support from a special ISV support team.
Still, regular support will have someone who can help, I'm pretty sure.

I do hope someone here can help, of course.

Regards
Vern

On 6/22/2022 8:23 AM, Sizer, Joseph via MIDRANGE-L wrote:

I have an established and working configuration for single sign-on for my V7R3 environment. My company is migrating our Active Directory domain from "company.com" to "corp.company.com". We use a Microsoft Active Directory for Kerberos authentication.

In attempting to set up a second Realm of corp.company.com, I went into IBM Navigator for I and selected Security / Network Authentication Service / Configuration Wizard and configured the services necessary for single sign-on for the second realm. I produced a .bat file which was run on the new corp.company.com domain controller.

I have also attempted to update the Realm properties by going to Security / Network Authentication Service / Realms and added a second Realm with the appropriate KDC.

I can see the entries in the keytab list and have verified that the
passwords match between NAS and AD. I have performed a kinit -k krbsvr400/IBMiMachineName.company.com@xxxxxxxxxxx<mailto:krbsvr400/IBMiMachineName.company.com@xxxxxxxxxxx> and gotten a proper response. SSO is working with a 5250 session. I do not get a positive response when attempting the same kinit -k command with the CORP.COMPANY.COM command.

Does anyone have links to information or documentation that would address adding a second realm to an existing and working NAS/EIM SSO configuration?


Joe Sizer
IBM I Power9 Administrator
Pencor Digital Services

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
Office: 610.826.9080 Ext. 2117

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com