RE: Single Sign On - EIM configuration questions and troubleshooting

I resolved item 1 below.
The only thing I changed, when launching OpsNav, I opted to connect using the a.a.a.a IP instead of b.b.b.b IP.
a.a.a.a is the IP that resolves to pencor06.pencor.com.

Now when testing the NAS configuration, the fully qualified domain name is returned.
New different error message returned from kinit.

QSH
Keytab list

Principal: krbsvr400/pencor06.pencor.com@xxxxxxxxxx
Key version: 1
Key type: 56-bit DES
Entry timestamp: 2017/03/02-07:06:32

kinit -k krbsvr400/pencor06.pencor.com@xxxxxxxxxx
EUVF06014E Unable to obtain initial credentials.
Status 0x96c73a0e - Encryption type is not supported.

Working through this error.
http://www-01.ibm.com/support/docview.wss?uid=nas8N1010903

The response of "EUVF06014E - Unable to obtain initial credentials. Status 0x96c73a0e - Encryption type is not supported." to a kinit -k command is an indication that Network Authentication Services (NAS) on the IBM i and the AD user account on the Windows server are not supporting the same encryption types, making it impossible for the two to communicate.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Steinmetz, Paul
Sent: Wednesday, March 01, 2017 4:27 PM
To: 'Midrange Systems Technical Discussion'
Subject: RE: Single Sign On - EIM configuration questions and troubleshooting

I want to thank everyone for the tips, test drive etc.
We had this working years ago, just for a test, it wasn't used, got removed.

I'm seeing some areas of concern.
1) Regarding the ping and DNS, everything is working there.

However, our iSeries has 3 ips.1


The ping is returning a.a.a.a. , which equates to the iSeries domain names.
b.b.b.b and c.c.c.c are not equated to any DNS.
But in the keytab file, I saw b.b.b.b

This might be an issue.

2) In the EIM wizard, where it asks for user Distinguished name, etc.
The examples and worksheets state to use Cn=Administrator, with that password.

However, our domain admin set up an account, instructed me to use Cn=ldappsi06ssoact,ou=systemaccounts,ou=Systems,dc=pencor,dc=com
Followed by its password.

This might be an issue.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Justin Taylor
Sent: Wednesday, March 01, 2017 3:55 PM
To: Midrange Systems Technical Discussion
Subject: RE: Single Sign On - EIM configuration questions and troubleshooting

I had tons of trouble first setting up EIM since our network domain was not what the Windows team swore it was.


Even now, if a reboot doesn't fix an EIM problem, I test three PING commands:
ping hostname
ping hostname.domain
ping -a ipAddress

And all three have to come back with the exact same fully-qualified hostname.




-----Original Message-----
From: Evan Harris [mailto:auctionitis@xxxxxxxxx]
Sent: Wednesday, March 01, 2017 2:43 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Subject: Re: Single Sign On - EIM configuration questions and troubleshooting

one thing I remember from the docs and setting this up a couple of times:
the DNS lookup is pretty important.
It says to make sure that you have the name exactly correct, and that it is *case sensitive* If you are getting the IP address back instead of the fqdn maybe you want to check that part of the set up.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: http://amzn.to/2dEadiD