![]() |
Chapter 21. Managing User Enrollment Enhanced Integration for NetWare includes support that allows AS/400 group and user profiles to be enrolled on one or more NDS trees and NetWare 3.12 servers. By enrolling AS/400 users and groups from AS/400, you can easily control their management from a centralized location by specifying where these user and group profiles are to be propagated to NetWare. The advantages of this support include:
You can also manually create authentication entries. See Chapter 16. "NetWare Authentication Entries and Connections" for more information. Using these integration functions is not intended to completely replace the requirement to use NetWare administration tools, such as SYSCON and NetWare Administrator (NWADMIN). This chapter describes how you can enroll AS/400 and PC users on NetWare
and centrally manage users' access to your NetWare network.
This section describes the process of user enrollment and discusses some considerations to keep in mind as you plan for user enrollment and management of NetWare users from AS/400. Figure 21-1 shows the steps that occur when you
enroll AS/400 users on NetWare:
|
Figure 21-1. Enrolling AS/400 users on NetWare
The QNETWARE user profile on AS/400 and NetWare enables AS/400 user enrollment. Therefore, a QNETWARE user object must be created in the Bindery for each NetWare 3.12 server and in each NDS tree that you want to manage from AS/400. QNETWARE must also have ADMIN authority or SUPERVISOR authority on NetWare 3.12 servers to be able to create objects and to manage passwords in the network. Although it is not prohibited, you should not use the QNETWARE user object to log in to NetWare from a client workstation. The QNETWARE user profile is created automatically on AS/400 when Enhanced Integration for NetWare is installed. The QNETWARE user profile is created in the disabled state because it is not allowed to run AS/400 jobs; QNETWARE's only purpose is to enroll AS/400 users and to propagate AS/400 profile information to NetWare. AS/400 logs into each NetWare server using the QNETWARE user profile and communicates with the Enhanced Integration for NetWare NLM, sending the commands necessary to enroll AS/400 users and to update the group and user profile information in the network. Figure 21-2. AS/400 logs in to NetWare
as QNETWARE to update profile information
Network Server User Attributes The AS/400 network server user attributes store network information for a group or user profile. Many of the administrative commands use some of this information, such as the default server type, default context, and default NDS tree. The network server user attributes also contain a list of NDS trees (and associated user information) and a NetWare 3.12 server list that are used by the user enrollment support to enroll the user or group on NetWare. Note:
You use the CHGNWSUSRA command to specify the network server user attributes and to start enrolling AS/400 users. It is with these attributes that you specify the NDS trees and NetWare 3.12 servers on which you want to enroll AS/400 users. On AS/400, a user profile can be used as either a user or a group profile. That means someone can sign on to AS/400 with a group ID and do work on the system as a user. However, in NetWare, only user objects can be used to log in and run applications. Groups are separate object types that are used only to combine and then manage individual user objects as one entity. For example, you can specify file access rights on a group object basis, and the users belonging to those groups inherit those file rights. When you enroll AS/400 users, consider using groups rather than individual user profiles. This can greatly reduce the number of profiles you must define to be propagated in your network. For example, if you specify that an AS/400 group profile and all its group members be propagated to a NetWare server, any user profiles belonging to the group are automatically enrolled on NetWare. The group members do not need to be enrolled individually. When you use groups, you can also reduce the number of profiles that need to have their NetWare security defined. You can set rights and attributes for a group object, and the group members inherit those rights and attributes. You can also use groups to better manage access to your network resources. For example, if you install financial applications and data on a NetWare server, you can grant access to that server only to the FINANCE group and its group members. NetWare Object Rights and Attributes If you plan to usually enroll AS/400 groups and all of their members, you can either:
You must set NetWare object security rights and attributes from NetWare by using the SYSCON, NETADMIN, or NWADMIN utilities. Whether you enroll AS/400 user profiles individually or as group members, the corresponding NetWare user objects might be added to the NetWare group EVERYONE when they are created. For NetWare 3.12, user objects are always added to the EVERYONE group. For NetWare 4.1, user objects are only added to the EVERYONE group if it already exists in the same container where the user object is being created. Note that all users added to EVERYONE inherit the security rights defined for that group. Use of Multiple AS/400 Systems AS/400 user enrollment from a single AS/400 works independently of any other AS/400 systems. Although you can enroll users on the same NDS tree or NetWare 3.12 server from multiple AS/400 systems, this is not recommended. If you want to use more than one AS/400 to enroll AS/400 users, consider having completely separate user profile sets. Otherwise, you could encounter undesirable enrollment situations. For example, MARLA is enrolled on NetWare SERVER1 from AS/400 A.
MARLA is then enrolled on the same server from AS/400 B with a different
password than the one used on AS/400 A. Now MARLA's password on
AS/400 A no longer matches the password on SERVER1 and she cannot
start connections to SERVER1 automatically from AS/400 A.
Step 1--Set Up Your NetWare Servers for User Enrollment You need to set up your NetWare servers for user enrollment by creating QNETWARE user objects on each NDS tree and NetWare 3.12 server on which you want to enroll AS/400 users. Generally, the same password is used for QNETWARE on each server. If the password is not the same, you must create QNETWARE authentication entries, as described in "Step 2--Set Up AS/400 for User Enrollment". To set up your NetWare servers for user enrollment:
Tip:
Step 2--Set Up AS/400 for User Enrollment When Enhanced Integration for NetWare is installed on AS/400, a default QNETWARE user profile is created with *NONE for a password. You need to change the QNETWARE profile so it can log in to the NDS trees or NetWare 3.12 servers on which AS/400 users are to be enrolled. to NetWare. To set up your AS/400 system for user enrollment:
+--------------------------------------------------------------------------------+ | Change System Value | | | | System value . . . . . : QRETSVRSEC | | Description . . . . . : Retain server security data | | | | | | Type choice, press Enter. | | | | Retain server security | | data . . . . . . . . 1 0=Do not retain data | | 1=Retain data | +--------------------------------------------------------------------------------+
Even if you set QRETSVRSEC to 0 and passwords cannot be stored, you can still enroll AS/400 users on NetWare. Refer to "Enrolling AS/400 Users when QRETSVRSEC=0" for more information.
To set the password for the QNETWARE profile, enter:
To create an authentication entry for the QNETWARE user object, which
has a password of BOSS in NDS tree TREE1 in NDS context MAIN, enter:
Step 3--Create AS/400 Group and User Profiles If you do not have AS/400 profiles, or if they do not represent the structure you want in your NetWare network, you need to create AS/400 group and user profiles. Note:
To create user or group profiles for users on AS/400 that need to access NetWare servers, use the Create User Profile (CRTUSRPRF) command. For example, to create a group profile named FINANCE for a group of
users that needs to access a NetWare server for a specific financial application,
enter:
To create a user profile named TOM and add it to the FINANCE group profile,
enter:
After you create the AS/400 profiles, they are ready to be enrolled
on NDS trees and NetWare 3.12 servers.
Step 4--Enroll AS/400 Users on NetWare You can automatically create NetWare objects by enrolling AS/400 users on one or more NDS trees and NetWare 3.12 servers. This means that certain AS/400 profile information is automatically propagated to NetWare. For example, the profile name and password is automatically propagated to all the NDS trees and NetWare 3.12 servers you specify. If you plan for most of your AS/400 users to be enrolled on the same set of NDS trees and NetWare 3.12 servers, you can define those servers and trees by using the Change Network Server Attributes (CHGNWSA) command. To ensure that AS/400 group and user profiles map correctly to NetWare, you must define an AS/400 profile as either a group or a user on a NetWare server or NDS tree. You cannot define an AS/400 profile as both a group and a user in an NDS tree or a NetWare 3.12 server. But you can define an AS/400 profile as a user object in one NDS tree or NetWare 3.12 server and as a group object in a different NDS tree or NetWare 3.12 server. You can define any AS/400 profile as either a group or a user object in an NDS tree or NetWare 3.12 server. For example, an AS/400 user profile that has no other profiles referencing it as a group can be defined as a group profile to NetWare. You can also define AS/400 group profiles as user objects to NetWare. However, group members in these profiles are not automatically enrolled on NetWare. For a description of all the AS/400 profile attributes that are mapped to NetWare group and user objects, refer to "Mapping AS/400 Profiles to NetWare". To enroll AS/400 users on NetWare, use the Change Network Server User Attributes (CHGNWSUSRA) command. Use this command to enroll AS/400 users on NetWare by specifying the NDS trees and NetWare 3.12 servers on which the AS/400 users are to be enrolled. You can specify the NDS trees and NetWare 3.12 servers on the CHGNWSUSRA command as:
+--------------------------------------------------------------------------------+ | Change NWS User Attributes (CHGNWSUSRA) | | | | Type choices, press Enter. | | | | User profile . . . . . . . . . . PUBS Name, *CURRENT | | Profile type . . . . . . . . . . > *GROUP *USER, *GROUP | | Prompt control . . . . . . . . . > *NETWARE *ALL, *BASE, *LANSERVER... | | Propagate group members . . . . *ALL *SAME, *NONE, *ALL | | Default server type . . . . . . *NETWARE *SAME, *NWSA, *BASE... | | NDS tree . . . . . . . . . . . . *NWSA | | NDS context . . . . . . . . . . *NWSA | | | | | | | | | | | | | | | | | | | | More... | | F3=Exit F4=Prompt F5=Refresh F12=Cancel F13=How to use this display | | F24=More keys | | | +--------------------------------------------------------------------------------+
+--------------------------------------------------------------------------------+ | Change NWS User Attributes (CHGNWSUSRA) | | | | Type choices, press Enter. | | | | NDS tree list: | | NDS tree . . . . . . . . . . . TREE1 | | User object context . . . . . MAIN | | | | Default server . . . . . . . . IBMSRV1 | | | | Profile object . . . . . . . . NWLOGIN | | | | + for more values | | NetWare 3.12 server list . . . . NTW3SRV1 | | | | + for more values | | | | | | | | | | Bottom | | F3=Exit F4=Prompt F5=Refresh F12=Cancel F13=How to use this display | | F24=More keys | | | +--------------------------------------------------------------------------------+
|
If you defined your NetWare servers and NDS trees in the network server attributes, as described in "Step 9--Define Network Server Attributes (Optional)", you can define defaults for the NetWare server and NDS tree with the CHGNWSUSRA command. When you specify the NDS tree list (NDSTREELST) parameter as *NWSA, you avoid having to change AS/400 group or user profiles when NetWare servers are added to or removed from your network. Changes to any user or group profiles defined to use the *NWSA value are propagated automatically to new servers whenever new servers are added to the NWSA. To see what your NWSA values are, use the Display NWS Attributes (DSPNWSA) command with OPTION(*NETWARE). The following examples show how to enroll either a group profile or a user profile to the system default list of NetWare servers and NDS trees. To enroll the group profile FINANCE and all its group members on the
NDS trees and NetWare 3.12 servers defined in the network server attributes
(NWSA), enter:
To enroll user profile JOHN on the NDS trees and NetWare 3.12 servers
defined in the network server attributes (NWSA), enter:
Figure 21-5. Specifying an NDS Tree List
+--------------------------------------------------------------------------------+ | Specify More Values for Parameter NDSTREELST | | | | Type choices, press Enter. | | | | NDS tree list: | | NDS tree . . . . . . . . . . . > TREE1 | | User object context . . . . . MAIN | | | | Default server . . . . . . . . IBMSRV1 | | | | Profile object . . . . . . . . NWLOGIN | | | | | | NDS tree . . . . . . . . . . . > TREE2 | | User object context . . . . . PUBS.ROCH.IBM | | | | Default server . . . . . . . . PUBSRV1 | | | | Profile object . . . . . . . . NWLOGIN | | | | More... | | F3=Exit F4=Prompt F5=Refresh F12=Cancel F13=How to use this display | | F24=More keys | | | +--------------------------------------------------------------------------------+Specifying an NDS Tree List--Examples The following examples show how to enroll either a group profile or a user profile in context O=MAIN in NDS tree XYZ: To enroll group profile FINANCE and all of its group members in context
O=MAIN in NDS tree XYZ, enter:
To enroll user profile MIKE in context O=MAIN in NDS tree XYZ, enter:
Specifying a NetWare 3.12 Server List Figure 21-6. Specifying a NetWare 3.12 Server
List
+--------------------------------------------------------------------------------+ | Change NWS User Attributes (CHGNWSUSRA) | | | | Type choices, press Enter. | | | | NDS tree list: | | NDS tree . . . . . . . . . . . *NWSA | | User object context . . . . . | | | | Default server . . . . . . . . | | | | Profile object . . . . . . . . | | | | + for more values | | NetWare 3.12 server list . . . . > NTW3SRV1 | | | | > NTW3SRV2 | | | | + for more values > NTW3SRV3 | | | | | | Bottom | | F3=Exit F4=Prompt F5=Refresh F12=Cancel F13=How to use this display | | F24=More keys | | | +--------------------------------------------------------------------------------+Specifying a NetWare 3.12 Server List--Examples The following examples show how to enroll either a group profile or a user profile on NetWare 3.12 servers. To enroll group profile FINANCE and all its group members on a NetWare
3.12 server named NTW3SRV1, enter:
To enroll user profile JOHN on servers NTW3SRV1 and NTW3SRV2, enter:
Propagating Profile Changes to NetWare After you use the CHGNWSUSRA command to enroll AS/400 users on NetWare, AS/400 profile changes are automatically propagated to NetWare. Only those AS/400 profiles that you defined to be enrolled, by using the CHGNWSUSRA command, are affected when you:
If a user profile was enrolled only as a group member with the PRPGRPMBR(*ALL) parameter and does not belong to any other groups that were enrolled, and you remove that user profile from the group, the NetWare user object with the same name is deleted on all NDS trees and NetWare 3.12 servers specified with the CHGNWSUSRA command. You can stop propagating group and user profile changes by using the CHGNWSUSRA command and specifying *NONE for the NDSTREELST and NTW3SRVLST parameters. You cannot enroll the following AS/400 profiles on NetWare and, thus,
you also cannot propagate changes for these profiles to NetWare.
|
Enrolling AS/400 Users when QRETSVRSEC=0 When the Retain Server Security (QRETSVRSEC) system value is set to 0, AS/400 cannot store passwords with authentication entries. Therefore, enrollment for group and user profiles is delayed until AS/400 can access the profile's password. This occurs when one of the following happens:
Mapping AS/400 Profiles to NetWare When AS/400 group and user profiles are enrolled on NetWare servers, only information in the AS/400 profiles that is applicable to NetWare is sent to the servers. Note:
You can add additional NetWare group and user attributes, such as user properties for a telephone number, fax number, and last name, from the NetWare NWADMIN utility. When an AS/400 group profile is enrolled as a group object in NetWare,
the following AS/400 attributes are propagated:
|
Checking AS/400 User Enrollment Status After you enroll AS/400 group and user profiles on NetWare, you can use the Work with NWS User Enrollment (WRKNWSENR) command to determine their status. You can obtain enrollment status by user profile, profile type, and server type. Enter WRKNWSENR PRFTYPE(*GROUP) to display the objects by GROUP instead of the default, which is by USER. This is the only way to display enrollment status for groups that have no users. +--------------------------------------------------------------------------------+ | Work with NWS User Enrollment (WRKNWSENR) | | | | Type choices, press Enter. | | | | User profile . . . . . . . . . . *ALL Name, generic*, *ALL | | Profile type . . . . . . . . . . *GROUP *USER, *GROUP | | Server type . . . . . . . . . . *NETWARE *NWSUSRA, *NWSA, *NETWARE | | NDS tree . . . . . . . . . . . . *ALL | | Server . . . . . . . . . . . . . *ALL | | | | | +--------------------------------------------------------------------------------+
If you specify *NWSA for the NDS tree and Server parameters, AS/400 displays those groups and users that are being enrolled into the NDS trees and NetWare 3.12 servers defined in the network server attributes.
+--------------------------------------------------------------------------------+ | Work with NWS User Enrollment | | System: SYSAS400 | | Type options, press Enter. | | 2=Change user profile 5=Display user profile 6=Retry entry | | 14=Change network user attributes 15=Display network user attributes | | 16=Display error details | | | | Tree/Server Enrollment Error | | Opt Profile Type status code Text | | IBM_TREE1 *NDSTREE | | GROUP1 *GROUP *CURRENT Scott and Marla | | PUBS *GROUP *CURRENT Edith and Merry | | RCHHJA50 *NTW3SVR | | FELLOWSHIP *GROUP *CURRENT Dennis and Lee | | | | | | | | | | Bottom | | Parameters or command | | ===> | | F3=Exit F4=Prompt F5=Refresh F6=Print list F9=Retrieve | | F10=Display users F12=Cancel F17=Position to | | | +--------------------------------------------------------------------------------+
The following list describes the various status values that might appear
on the Work with NWS User Enrollment display:
|
You can end user enrollment on one or more NDS trees or NetWare servers for an AS/400 profile that was enrolled on NetWare whenever you:
If you use one of the preceding commands to remove an AS/400 profile from a NetWare server that AS/400 can no longer access, AS/400 cannot complete the request. In this case, the Work with NWS User Enrollment display will show the status of the AS/400 profile as either *DLTPND, *DLTRCYPND, or *DLTFAIL. These status codes are described in "User Enrollment Status Values". If one of these status values appears, you can remove the entry from the display by using Option 4. The entry is then processed as though the delete request had completed successfully on the NetWare server once the remove entry request completes and the CPCA40F message "Remove request submitted successfully" appears. If you use option 4 to remove the entry, you must delete the NetWare
object from the NDS tree or NetWare 3.12 Bindery by using the NetWare NETADMIN,
NWADMIN, or SYSCON utility.
User Enrollment and Authentication Commands Table 21-1. User Enrollment Commands
|
[ Top of Page | Previous Page | Next Page | Table of Contents | Index ] |