Hi Philippe,

1. Besides MFA, are there other methods to set up single sign-on between AD and RACF?
2. If the AD password (without a compound in-band) exceeds 8 characters, is out-of-band MFA the only way to accommodate RACF without the password phrase option?  What are the pros and cons of in-band vs. out-of-band?

Thanks,
Dave

Hi David,

I'm not aware of another method to use external LDAP server password with RACF, besides IBM MFA. 
Most z/OS applications can accept credentials longer than 8 characters, but each application has it's own configuration settings to enable password phrase sized credentials. For instance, in TSO the IKJTSOxx PARMLIB member statement PASSPHRASE(ON) causes TSO to display a longer password field on the TSO logon screen.
If an installation does not wish to configure applications to support phrase-sized credentials, it can use the IBM MFA out-of-band support to provide a web-based logon page for users to translate their longer credentials to 8-byte credentials. In-band provides a more direct way for users to logon to their z/OS applications with MFA/LDAP, but may require application configuration changes, or maybe even application changes to display a longer password fields.
If you would like us to take you through some of these scenarios in more detail, please just let me know.

Best regards,
Ross

Hi Philippe,

1. Besides MFA, are there other methods to set up single sign-on between AD and RACF?
2. If the AD password (without a compound in-band) exceeds 8 characters, is out-of-band MFA the only way to accommodate RACF without the password phrase option?  What are the pros and cons of in-band vs. out-of-band?

Thanks,
Dave

Hi Ross,

Thank you for your answers.  For either in-band or out-of-band, can we add another TOTP factor (w/Microsoft Authenticator), so the user will enter both the AD password and the passcode for authentication? If you could provide some details, that would be great.

Thanks,
Dave

------------------------------
David Cheng
------------------------------


Original Message:
Sent: Tue February 06, 2024 04:32 PM
From: Ross Cooper
Subject: Connecting RACF to Cloud based Active Directory

Hi David,

I'm not aware of another method to use external LDAP server password with RACF, besides IBM MFA. 
Most z/OS applications can accept credentials longer than 8 characters, but each application has it's own configuration settings to enable password phrase sized credentials. For instance, in TSO the IKJTSOxx PARMLIB member statement PASSPHRASE(ON) causes TSO to display a longer password field on the TSO logon screen.
If an installation does not wish to configure applications to support phrase-sized credentials, it can use the IBM MFA out-of-band support to provide a web-based logon page for users to translate their longer credentials to 8-byte credentials. In-band provides a more direct way for users to logon to their z/OS applications with MFA/LDAP, but may require application configuration changes, or maybe even application changes to display a longer password fields.
If you would like us to take you through some of these scenarios in more detail, please just let me know.

Best regards,
Ross

Hi Philippe,

1. Besides MFA, are there other methods to set up single sign-on between AD and RACF?
2. If the AD password (without a compound in-band) exceeds 8 characters, is out-of-band MFA the only way to accommodate RACF without the password phrase option?  What are the pros and cons of in-band vs. out-of-band?

Thanks,
Dave

Hi Ross,

Thank you for your answers.  For either in-band or out-of-band, can we add another TOTP factor (w/Microsoft Authenticator), so the user will enter both the AD password and the passcode for authentication? If you could provide some details, that would be great.

Thanks,
Dave

------------------------------
David Cheng
------------------------------


Original Message:
Sent: Tue February 06, 2024 04:32 PM
From: Ross Cooper
Subject: Connecting RACF to Cloud based Active Directory

Hi David,

I'm not aware of another method to use external LDAP server password with RACF, besides IBM MFA. 
Most z/OS applications can accept credentials longer than 8 characters, but each application has it's own configuration settings to enable password phrase sized credentials. For instance, in TSO the IKJTSOxx PARMLIB member statement PASSPHRASE(ON) causes TSO to display a longer password field on the TSO logon screen.
If an installation does not wish to configure applications to support phrase-sized credentials, it can use the IBM MFA out-of-band support to provide a web-based logon page for users to translate their longer credentials to 8-byte credentials. In-band provides a more direct way for users to logon to their z/OS applications with MFA/LDAP, but may require application configuration changes, or maybe even application changes to display a longer password fields.
If you would like us to take you through some of these scenarios in more detail, please just let me know.

Best regards,
Ross

Hi Philippe,

1. Besides MFA, are there other methods to set up single sign-on between AD and RACF?
2. If the AD password (without a compound in-band) exceeds 8 characters, is out-of-band MFA the only way to accommodate RACF without the password phrase option?  What are the pros and cons of in-band vs. out-of-band?

Thanks,
Dave