The Password Problem and SSO Benefits
This webinar addresses the operational burden and security risks inherent in password-based authentication for IBM i environments. Steve Sisk, Principal Security Services Consultant at Fortra, explains how users typically manage 50+ accounts and passwords, leading to weak password practices, credential reuse across systems, and significant help desk overhead for password resets. Single sign-on (SSO) using Kerberos authentication eliminates these challenges by removing passwords entirely from IBM i user profiles, reducing operational costs, streamlining authentication, and improving security posture. The session demonstrates how SSO leverages existing Windows Active Directory infrastructure to provide seamless access to IBM i systems without requiring users to enter credentials repeatedly.
Kerberos and Enterprise Identity Mapping Architecture
The technical foundation of IBM i SSO relies on Kerberos authentication protocol and Enterprise Identity Mapping (EIM). When a user opens a 5250 session configured for SSO, Access Client Solutions (ACS) requests a Kerberos service ticket from the Windows domain controller. The domain controller validates the user's authorization and issues an encrypted ticket that is forwarded to the IBM i system. Kerberos on IBM i decrypts the ticket to authenticate the user, then EIM maps the Windows user ID to the corresponding IBM i user profile (which has its password set to *NONE). This architecture works across on-premise, cloud, and hybrid Azure environments, supporting ACS functions including ODBC/JDBC, HTTP services, and IFS share mounting.
Implementation Approach and Professional Services
Fortra's SSO implementation services include configuring Kerberos on IBM i systems (joining them to the Windows domain), setting up Enterprise Identity Mapping, and mass-loading user mappings through automated tools. The implementation covers configuration of additional services like IFS shares and HTTP, strategies for ACS deployment, and disaster recovery procedures including HA/DR environment failover. Fortra offers managed services with 12 hours of annual consulting for SSO and general IBM i security topics, an automated EIM management bot using Robotic Process Automation, and high availability options for the EIM domain. The company also provides comprehensive security services including risk assessments, penetration testing, remediation services, and the Powertech security product suite.
