Re: TEPS 10 Character UserID Limitation Security Validation at Hub

Julius,

Good points! The TEPS vs TEMS LDAP authentication is always tricky and
there is no right answer IMHO.  TEPS LDAP integration is much more
versatile in that if the customer has multiple LDAP repositories or
multiple user filters, it can be done in TEPS but not at HTEMS.  Also, if a
customer site has plans to setup SSO or if their active directory setup
requires to follow referrals  , it would be better for them to use the
TEPS.  On the other hand, TEMS authentication will make it easier to manage
the LDAP users from single point, but the downside is that authenticated
LDAP users are given access not only to portal but tacmd and SOAP server as
well.

A slightly better idea is to enable at both places but then there are still
some disadvantages like the one you mentioned.



with warm regards,
Venkat Saranathan
Gulf Breeze Software

*Gulf Breeze Calculus: We differentiate our work in Tivoli Integration!*


On Wed, May 15, 2013 at 1:24 PM, Julius Loman <[email protected]> wrote:

> For example you can do SSO for TEP clients (browser based).
> If I remember the things correctly - The user ID you enter in TEP login
> window
> is the one from the User DN field and it does not matter what is in the
> User ID
> field.
>
> One of the bad things about the possibility of authenticating users at
> TEPS is
> the fact that it allows anybody with IP connectivity to HUB and access to
> ITM
> media to gain sysadmin permissions in TEP on any ITM environment. (even if
> HUB
> authentication is used).
>
> On Wed, May 15, 2013 at 12:25:00PM -0500, Gregory Mendes <
> [email protected]> wrote:
> > Thanks for that information.
> >
> > Then what is the reason for authenticating from the Hub_TEMS vs. TEPS?
>  I thought that got you past the 10 character limitation in TEPS.
> >
> > Regards,
> >
> >
> >
> > Gregory R. Mendes
> > Tivoli Architect/Tools Specialist
> > Mendes, Inc.
> > Tivoli Monitoring 6.2.3 Certified
> > 770-317-8593
> >
> >
> > Date: Wed, 15 May 2013 10:44:46 -0500
> > Subject: Re: [TME10] TEPS 10 Character UserID Limitation Security
> Validation  at Hub
> > From: [email protected]
> > To: [email protected]
> >
> > No, you weren't able to log in with the value of the "User Name" column.
>  That maps to the "Name" column from KFWUSER and is just a way to identify
> the real name of the person logging in.  The ID column in KFWUSER maps to
> the "User ID" field in the user admin create user UI, and all CTAUTH calls
> do a match on the value form ID, so that's always the key.
> >
> >
> >
> > On Wed, May 15, 2013 at 8:38 AM, Gregory Mendes <
> [email protected]> wrote:
> >
> >
> >
> >
> > Hello All,
> >
> > I asked this question before and received several responses and I thank
> you all for them.  I took advice from Julius about UserID vs. User Name
> configuration.
> >
> > The reason I implemented security validation at the Hub was because of
> the 10 character UserID limitation at the TEP.
> >
> >
> > So, what I did was call the UserID "testuser1" and the User Name
> "ssd01_DBADM" which is over 10 characters.
> >
> > I was under the impression and from the information I received that the
> Hub would validate the User Name that's over 10 characters and not the User
> ID.  My log files have rolled off but I swear I logged in with the "User
> Name" instead of the "User ID" and it worked.
> >
> >
> > I'm I wrong?  I have been before but your advice is greatly appreciated.
> >
> > Regards,
> >
> >
> >
> > Gregory R. Mendes
> > 770-317-8593
> >
> >
> >
> > _______________________________________________
> >
> > TME10 mailing list
> >
> > [email protected]
> >
> > Unsubscribe:[email protected]
> >
> >
> >
> >
> > --
> > "Sometimes I think that's the only right thing to do:
> > To dream. to live in the world of dreams.
> > But it doesn't last forever--wakefulness always comes to take me back..."
> >
> >
> > _______________________________________________
> > TME10 mailing list
> > [email protected]
> > Unsubscribe:[email protected]
>
> > _______________________________________________
> > TME10 mailing list
> > [email protected]
> > Unsubscribe:[email protected]
>
>
> --
>
> [ Julius Loman ][ [email protected] ][ http://lomo.kyberia.net ][
> icq:35732873 ]
>
>
> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected]
>
>

_______________________________________________
TME10 mailing list
[email protected]
Unsubscribe:[email protected]