We are planning to set up SSO for this customer and I have a doubt regarding one the steps detailed here. Especifically, the 'Create Identifiers and Associations in EIM'.

I don't quite understand if that step is needed for every single user profile that requires SSO (and if it is has to be done one by one? If there are, say, 300 users, does that step need to be repeated 300 times?)... OR... is that step only needed if a person has different user profiles across different IBM i systems?

Hello Alejandro ..

Yes, one by one ... I don't know other way except IBM Lab Services tool ..

https://semiug.org/2021/docs/Single%20Sign%20On%20Overview%20for%20IBM%20i.pdf

As others have mentioned, IBM Lab Services has a tool which can effectively "script" this initial setup/mapping.  Doing it one-by-one is very time consuming.  In addition, the tool allows you to automate the mapping of new user profiles as they get created.  If your users' IBM i user profiles match with their AD accounts, you won't have to do anything extra when setting up new users.  We used it when setting up SSO/Kerberos here, and continue to use it as users are created.  It's seamless as long as the user profiles match with AD.

Alejandro;

We have this SSO Service.  https://www.fortra.com/resources/datasheets/powertech-services

And/Or we also sell RPA product that has a BOT for synching AD with IBM i profiles.  https://connectors.fortra.com/bots/ibm-i/solution-template-active-directory-ibm-i-extend-sso

Good luck 

Tom

Hello Alejandro,

Hi Alejandro, 

If you have access to a Java developer then you might be able to "roll your own" based on this example program (EIMTool.zip) in the Redbook.

Under the Additional Materials, you will find some ancient Java that isn't too difficult to understand with the guidance of the Redbook.

Windows-based Single Signon and the EIM Framework on the IBM eServer iSeries Server

Ibm		remove preview
Windows-based Single Signon and the EIM Framework on the IBM eServer iSeries Server Support for a Kerberos based Network Authentication Service and the introduction of Enterprise Identity Mapping (EIM) were exciting OS/400® V5R2 announcements during 2002. A Kerberos based Network Authentication Service enables the iSeries (and any ... View this on Ibm >

& here : 
Using Enterprise Identity Mapping Java classes

Your other option is to go the RPA Route yourself, record it with software that you are comfortable with (such as Power Automate), then let the RPA do the dirty work ?

If you do want to execute though on an enterprise level with reports and comfort for all the C-Levels and auditors, then best to get experts such as Fortra/i.gayte.it/ LAB Services involved.

------------------------------
Marius le Roux
Owner
MLR Consulting
------------------------------

A little off-topic, but to complete the thinking around SSO on IBM i - IBM PowerSC supports MFA and SSO on i, and comes with scriptable CLI utilities that can be used for bulk user provisioning and set up. Probably not applicable in this case Alejandro because PowerSC supports OIDC and not Kerberos.

Thanks everyone, every single reply helped. 

I think for a moment we overlooked the fact that we needed a solution to address future maintenance of the associations of IBM i user profiles and AD accounts, and we have already presented to the customer all your proposed solutions. Thanks a lot again!