Re: SSO/Choosing EIM Domain Controller

[ALopez@xxxxxxxxxx]

> I'm having a problem understanding the question.
>
> A common approach is to let the Windows Active Directory be the 
> Kerberos server.  That supports SSO within the Windows domain.
>
> EIM maps the Windows network name of a user to his or her i5/OS 
> profile name.  Why would you need EIM to be running if the i5/OS 
> system is down?  If you can't access EIM, you wouldn't access 
> anything else on that box either.

Our Lotus Notes is on a PC server.  Web Access supports SSO, though I 
don't know if that's true when the server isn't iSeries hosted. 

In more general terms, isn't the point of EIM that an application wouldn't 
have to be iSeries based?  Anything that can access an LDAP server could 
have an EIM identifier.  It doesn't apply to my shop right now, but if EIM 
can be used by zSeries, pSeries and Linux, why would I want a situation 
where the authentication mechanism is working (via Kerberos in Windows) 
and the identification mechanism is down for saves (via EIM on OS/400)?

I'll admit that I am a lot more comfortable with security on an iSeries 
LDAP, especially since Windows 2003 server DNS has an unpatched exploit 
actively being used, but it still seems that both authentication and 
identification would be better served from being on the same platform. 

In any case, we'll just run with EIM on the iSeries and deal with any 
further issues when we have to.....