Identity & Access Management on OS/400.....How Much LDAP can be useful
Joy Dubey
I am looking into the Identity & access Management on OS/400 and for proper clarification, I prepared a questionnaire.
So kindly go through it and help me in answering them.
Thanks & regards
Joy
//////////////////////////////////////////////////////
Queries on OS/400
- Basic Access Questions:
- What are Access profiles?
- How access Profiles are associated with the User and Group Profiles?
- What all information is stored in the profiles?
- What is the Profile format/schema?
- Where the Profiles are stored physically in the System?
- User Authentication Questions:
- How the User Authentication is taken care?
- Which component (Kernel or anything) handles the Authentication?
- What is the Architecture of the Authentication Manager?
- User Authorization Questions:
- Is there any Access manager/Identity Manager/Security Manager, who works as a component or as a service exists in the System? If Y then how it is handled (architecture) and If N then how these profiles are handled?
- What is authorization Lists (access Lists related with the OS/400 Objects better known as Specific Authorization)?
- How authorization lists are associated with the Access profiles?
- Whenever User performs any action (say types a command and fires it)
- Which component intercepts the event and performs an action based on the Type of event and parameters to the events?
- How it verifies the access rights of the individual.
- Other Questions:
- What are other services/carriers keeps the User information?
- How is LDAP associated with the System?
- Is LDAP, the optional service, which can be enabled/disabled?
- Does it contain the User Provisioning/Access/Group Information implicitly?
- If y then what is Schema?
- What is System Distribution Directory?
- Is SDD, the optional service, which can be enabled/disabled?
- If SDD is itself a directory, can it be accessible through JNDI or simply is it LDAP compatible?
- Is the User Provisioning/Access/Group Information can be published in LDAP?
- Is User Provisioning/Access/Group Information If can be published with the help of Directory Services enables System Distribution Directory (SDD)?
- If yes then
- Is there any CL command/External API/External tool required to do the same?
- Is publishing data, from SDD to LDAP, would be a one-time service or periodic service?
- What is the Schema?
- Is there any service, which keeps the synchronization between SDD & LDAP?
- If Y then
- Does it behave like a switch means is it possible to make/unmake the synchronization as an optional behavior? If yes then what are commands to that?
- What set of user access rights (on OS/400) to perform enabling/disabling these actions?
- Do you need some extra set of rights to manipulate data on LDAP?
jmc...@us.ibm.com
mailing list question.
I suggest you start with iSeries Information Center:
http://publib.boulder.ibm.com/infocenter/iseries/v5r3/ic2924/html_nav/info/rzahgicsecurity.htm
John
Joy Dubey
Shalomc
You ask excellent questions, but their scope is vast, and cannot be
contained in a single post.
Answering your questionnaire also requires a considerable amount of
time.
I suggest that you break up your question into manageable chunks and
repost them.
I also suggest that you cross post in comp.sys.ibm.as400.misc, which is
where many of the experts hang around.
Shalom Carmel
-----------------------
www.venera.com - Exposing iSeries insecurity
Joy Dubey
- I am looking to Add/Modify/Delete users and their access rights, present in the AS/400 System, programmatically.
- The preferred language is Java and Java Technology.
- Is there any Interface/service/component available which can help me communicating with AS/400 System programmtaically(ion any language).
- What kind of access rights need to be associated with the User/session with which I am connecting with the System, for performing the above said actions?
- if there is any interface/service/component available, then do they deal with the Primary repository with the System, if not then how much that is synchonized with the actual System?
Thanks
& Regards
Joy
Christian Chateauvieux
- LDAP access to user profiles is supported by recent releases of
OS/400 (V5R2 and above). ITDI's LDAP connector would then allow you to
add/delete/modify accounts, as well as setting passwords. If you want to
write your own Java application to do this, then use JNDI and the LDAP
provider.
- For older releases (at least V4R4), you should be able to do one way
synch to an AS/400 using the "IBM Toolbox for Java". That allows a Java
application running remotely to issue command calls or call APIs. It
includes a RUser class that can be used to change or delete users --
apparently not create them. It also has a CommandCall class that could
be used to issue the Create/Change/Delete User Profile commands. In
either case, your connector would need to be able to connect to the
remote iSeries system using the AS400 class - needs a system name, user
name and password.
Here's a link to the V5R2 documentation:
http://publib.boulder.ibm.com/iseries/v5r2/ic2924/info/rzahh/page1.htm
For other releases goto
http://publib.boulder.ibm.com/html/as400/infocenter.html. Once you have
selected the area/language/release, drill down to: Programming -> Java
-> IBM Toolbox for Java.
Hope this helps,
Christian
Joy Dubey wrote:
> hey all,
>
> The link you sent to me was a bit useful. Thanks for it!
>
> I just couldn't be able to find out certain thing.
>
> So plz let me explain what and what for I m information looking for:[My
> Requirement]
>
> * I am looking to Add/Modify/Delete users and their access rights,
> present in the AS/400 System, programmatically.
> * The preferred language is Java and Java Technology.
>
> So for the same, I have questions which are:[My Research points]
>
> * Is there any Interface/service/component available which can help
> me communicating with AS/400 System programmtaically(ion any
> language).
> * What kind of access rights need to be associated with the
> User/session with which I am connecting with the System, for
> performing the above said actions?
> * if there is any interface/service/component available, then do
> they deal with the Primary repository with the System, if not then
> how much that is synchonized with the actual System?
>
> If any worries, plz revert.
>
> P.S.: If u could plz route me to someone else, if these queries
> is distinctive from your Domain. Thanks again!
>
>
>
> Thanks & Regards
> Joy
>
> /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
> <jmc...@us.ibm.com <mailto:jmc...@us.ibm.com>> wrote in message
Joy Dubey
Christian Chateauvieux
I am not certain what you mean by 'User Provisioning information'.
Perhaps you are looking for an Identity Management solution where you
define business roles and policies allowing people with certain roles to
be entitled to have accounts given systems. AS/400 would be one of the
endpoints you would be able to provision accounts into.
If this is what you are looking for, take a look at Tivoli Identy Manager:
http://www-306.ibm.com/software/tivoli/products/identity-mgr/
Now, back to the LDAP discussion: as I explained earlier AS/400 allows
you to manage accounts and profiles via command line tools or via LDAP
(just like MS Active Directory or RACF do). You can use identity
management solutions to interact with the AS/400 interfaces (ITIM has
got a provisioning agent for AS/400) but you can also use Data
Integration solutions such as IBM Tivoli Directory Integrator
(http://www-306.ibm.com/software/tivoli/products/directory-integrator/)
to provision or synchronize AS/400 data (exposed by LDAP) with other
systems. Directory Integrator allows you to create dataflows in whatever
manner you like (in opposition with Identity Manager which is a
centralized IdM solution) so with Directory integrator you could
perform, for example, point to point sync of the LDAP data exposed by
AS/400 with other platforms (other LDAP servers, Lotus Notes, databases,
files, message queues, etc).
Does this help?
Christian
Joy Dubey wrote:
> <mailto:christian.c...@fr.ibm.com>> wrote in message
Joy Dubey
Christian Chateauvieux
The answer is 'yes' for all questions.
- You can use ITIM to read/write accounts to AS/400. ITIM would use an
agent that would need to be installed on AS/400 to do so. Alternatively
ITIM could also use ITDI as an agent; in that case ITDI could connect to
AS/400 via LDAP (provided the LDAP backend is configured) or Java calls
(the classes mentioned earlier in the thread).
- You can use ITDI to read/write accounts via LDAP or via Java calls
to the JT400 APIs.
- You can use an LDAP client (e.g a Java client) to read/write AS/400
accounts via LDAP, provided the LDAP backend is configured.
ITIM and ITDI can be driven from outside, too: ITIM exposes a Java API,
so does ITDI. ITDI could also accept any transport (HTTP based, MQ
based, email based, etc) to perform actions, provided you configure it
to do so.
> does as/400 keeps the user information...does it keep the
> information in files, in some external persistent store(like DB or
> directory server)
I have no idea. I'd check the LDAP projection backend documentation in
the iSeries book. I don't know wether this backend is active by default
on recent AS/400 or not.
Maybe someone else is listening?
Christian
Joy Dubey wrote:
Joy Dubey
Joy Dubey
jmc...@us.ibm.com
around user profiles:
- an LDAP add request is converted to a "create user profile" command
invocation,
- an LDAP search request calls system APIs to list user profiles and
returns the information in LDAP format,
and so on.
User profiles are not stored in LDAP, nor are they synchronized to the
LDAP server. User profiles are stored as operating system managed
objects. Further explanation of that is beyond the scope of a note.
The system project backend currently allows access only to user profiles.
In i5/OS, group profiles are implemented a special case of user profiles.
You can manage group members, but in i5/OS this is done by modifying the
user profile to indicate which groups it belongs to.
Schema - you really need access to an iSeries system. There is an
os400-usrprf objectclass with attributes that directly map to parameters
of the CRT/CHGUSRPRF commands. If you had the output from a search and
were familiar with the CRTUSRPRF command and the DSPUSRPRF output, you
would find the schema pretty much self-explanatory. We chose not to try
to document it in detail because of this relationship and an assumption
that users would have access to a system to try it out.
For example, you could create a user using an LDIF file like:
dn: os400-profile=TESTUSER,cn=accounts,os400-sys=mysys.ibm.com
objectclass: os400-usrprf
os400-profile=TESTUSER
os400-password=changeme
os400-pwdexp=*YES
os400-usrcls=*SECOFR
os400-text=John Doe,555-5555
which corresponds to the command:
CRTUSRPRF PROFILE(TESTUSER) PASSWORD('changeme') PWDEXP(*YES)
USRCLS(*SECOFR) TEXT('John Doe,555-5555')
The system projection backend is always present if the server is running.
To access it, you must authenticate as an i5/OS user. Access to user
profiles is governed by the the identity of the user and his authority on
the system. He can exactly what he can running commands directly on the
system.
John