Re: EIM/Single Signon ?

[John McKee <jmmckee@xxxxxxxxxxxxxx>]

Just curious.  What happens if the 5250 session is disconnected?  User
just enters their user profile to reconnect?

John McKee

On Tue, Apr 3, 2012 at 8:22 AM, Vern Hamberg <vhamberg@xxxxxxxxxxx> wrote:
> Charles is spot on - multiple users on a single desktop - each Windows
> user is mapped to one user profile - if you don't force logging out of
> Windows somehow, then it's the same as someone just leaving their
> windows box running unlocked with a 5250 session open - security
> breakdown - using SSO can't solve this human engineering issue.
>
> A similar issue is, if a person needs to be an admin sometimes and a
> regular user otherwise - those would need multiple windows logins - each
> mapped to a different user profile - in the simplest scenario. There are
> some additional EIM config things that might help here - haven't studied
> that far yet.
>
> I suppose, theoretically, that you COULD map many-one or one-many or
> many-many in EIM - again, I've not tried much of that. I know that in
> our app I could handle multiple mappings to our app users, maybe
> displaying the choices. But this still depends on a single windows
> domain user having been authenticated, not several.
>
> The KISS principle applies strongly here.
>
> HTH
> Vern
>
> On 4/3/2012 7:57 AM, Charles Wilt wrote:
> > You need to be clear about what you what to know about...
> >
> > In a SSO w/EIM environment, the participating user profiles on the i
> > are configured with PASSWORD(*NONE)
> >
> > So QPWDLVL doesn't really matter.
> >
> > As far as multiple users using a 5250 session from a single
> > desktop...not going to work...
> > You'd either need to leave those users out of SSO or force them to
> > sign out of windows and back in under the next users AD credentials.
> >
> > If you simply want to replicate passwords, that's not SSO nor EIM.
> >
> > Charles
> >
> > On Tue, Apr 3, 2012 at 8:22 AM, Jack Kingsley<iseriesflorida@xxxxxxxxx>  wrote:
> > > Can anyone elaborate on how they might have moved forward with such a
> > > project, also, how did you handle the AD side of things with those
> > > credentials and then having them match on the "I" side of things.  Were you
> > > forced to change your QPWDLVL at all, was/is there a way around only 10
> > > characaters for the as400 profile, was this an issue.  How were you able to
> > > get around mutliple users using a computer for 5250 access once the AD
> > > credentials were verified granting access to the desktop.
> > > --
> > > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > To subscribe, unsubscribe, or change list options,
> > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > Before posting, please take a moment to review the archives
> > > at http://archive.midrange.com/midrange-l.
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.