Linux, UNIX, z/OS, and IBM i client configuration for Kerberos/SPNEGO SSO in ELM
ELM client software that is running on an operating system other than Microsoft Windows can use Kerberos authentication to connect to a Microsoft Active Directory.
UNIX kinit utility
- Point the client system to the Domain Name System (DNS) in Active Directory. Typically, this setting is configured in the /etc/resolve.conf file.
- Configure the krb5.ini or krb5.conf file. For more information, see Configuring the krb5 file for encryption in Kerberos/SPNEGO SSO in ELM.
- While UNIX users might run the IBM JRE kinit utility to authenticate ELM clients, doing so is unnecessary and would require a second login. The UNIX kinit utility is still needed to authenticate applications that are not based on Java technology.
- Because the kinit utility on z/OS uses EBCDIC character encoding instead of ASCII, z/OS users must run the IBM JRE kinit utility to authenticate ELM Eclipse clients.
UNIX kinit cache file
On UNIX systems, the default location and name for the kinit cache file is /tmp/krb5cc_uid, where uid is the numeric user ID. To use a different cache file, the KRB5CCNAME environment variable can be set to a different location.
Specify the encryption algorithms that the server requires
Users must specify the encryption algorithms that the server requires. For example, if the server requires Advanced Encryption Standard 256-bit (AES-256) encryption, the client krb5.conf or krb5.ini file must include this encryption algorithm.