RE: Centrify single sign on

Cook booking Pam? Never a good idea. Lets hold off on the "management wants SQLserver so I need a solution" crap for a second. The problem is this... AIX has their new Centrify solution to allow single sign on. Ok. What exactly is Centrify? You've identified that you need to configure IDS to work with PAM so you can use centrify. Fair enough. Its pretty much the same process as if you wanted to use LDAP. Modifying the $INFORMIXDIR/etc/sqlhosts is the way to go... So now you have an issue where you're required to provide a user name and password to authenticate. Ok so then you have a couple of possible issues. 1) You don't have your configuration set up correctly in PAM. 2) I don't have time... day job cutting in. To keep this short. 1) Log a support call with IBM on Centrify, Log a second support call on IDS. Both severity 2. Maybe the IDS a sev 1. 2) Log a call to your local IT Specialist and your Sales team. Talk to your client rep and let them know that if you can't make this work, AIX as well as IDS are in possible jeopardy. (A little exaggeration never hurt. Especially when its illegal to use a cattle prod on Sales critters) They are paid to help you. Here? We're just a couple of guys who's played with the product and a couple of the engineering team tossed in for laughs. PAM is one of those things that is on the fringe of being important, but not really well know within the community. HTH -Mike ________________________________ > Subject: RE: Centrify single sign on > Date: Fri, 4 Apr 2008 10:10:58 +1100 > From: AClarke@civica.com.au > To: prichard@blm.gov; informix-list@iiug.org > > > > Do you have pam_unix or some other 'sufficient' module in the list of modules? This should allow multiple sources of authentication. If pam_unix is not the one, there should be a module to somehow automagically recognise a logged-in user on the box. > > Perhaps a condition on the pam_permit module will detect a local user. > > Either way, I can't believe that PAM can't provide a solution to this problem. > > -----Original Message----- > From: informix-list-bounces@iiug.org on behalf of prichard@blm.gov > Sent: Fri 4/4/2008 9:26 AM > To: informix-list@iiug.org > Subject: Centrify single sign on > > I've been piloting Centrify single sign on software on AIX 5.3 TL7. > The problem I'm having is that Informix 9.4 uc3 doesn't recognize the > users that Centrify is getting from Active Directory unless I use > pam. When I configure IDS for pam then on the client running dbaccess > I'm prompted for the user's login name and password, something that > does not happen when I use NIS. > > I read the articles at http://informix-technology.blogspot.com/2007/11/informix-user-authentication-pam-for.html > and the ibm developer works articles. It appears that there is no > solution for this unless I modify the many applications we have > written for IDS. Is this true or am I misinterpreting? > > Management is already pushing hard to go to MS SQL Server. So if I > can't solve this quickly I will have to transition to SQL Server. > _______________________________________________ > Informix-list mailing list > Informix-list@iiug.org > http://www.iiug.org/mailman/listinfo/informix-list _________________________________________________________________ More immediate than e-mail? Get instant access with Windows Live Messenger. http://www.windowslive.com/messenger/overview.html?ocid=TXT_TAGLM_WL_Refresh_instantaccess_042008