Kerberos on iSeries-P6

One customer needed to have single sign on between iSeries session and Active Directory. So I decided to use kerberos. During the setup I had trouble getting a ticket for the iSeries using the kinit command. The error message was EUVF06007E Unable to obtain name of default credentials cache. After hours I found that the home directory for the user didn't exist on the iSeries. After having this one created with crtdir in /home everything ran fine.

Don't forget to check in the properties of Network Authentication Service that Use TCP is checked.

If you are using Windows 2008 you also need to change two parameters.

Add the following registry key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters\allowTGTSessionKey needs to be dword and value equals 1

Computer policy\Windows Settings\Securyt settings\Local policies\Security Options\Network security: Configure encryption type : DES_CBC_MD5, DES_CBC_CRC

Important: the DNS resolution. Both workstations and server need to get the same result when using reverse lookup !

In case you are using Windows 7 as client you have to check the following points.

1. In Administrative Tools select
   
   
2. Local Security policy
   
   
3. Security settings
   
   
4. Local policies
   
   
5. Security options Select Network Security
   
   
6. LAN Manager Authentication level and change it to "Send LM & NTLM responses"
   
   
7. In Internet Explorer
   
   
8. Internet Options
   
   
9. Advanced
   
   
10. Enable Integrated authentication
    
    
    
11. The Network security: Configure encryption types allowed for Kerberos under Security Options likely is set to "No minimum". This needs to have DES_CBC_CRC turned on at minimum for Kerberos authentication to work properly.  Once this is turned on the above authentication test should work as well as FIMO SSO.