RE: TEPS 10 Character UserID Limitation Security Validation at Hub
Gregory Mendes <[email protected]>
| Newsgroups | gmane.comp.sysutils.tivoli.general |
|---|---|
| Message-ID | <BAY172-W23B5DFF794783F93E1E029F7A20__18363.9821051203$1368654653$gmane$org@phx.gbl> |
Hey Venkat, Very interesting comparison. Here at my customer I don' have multiple LDAP repositories or multiple filters. They are not interested in SSO or setups that follow referrals. That's why I chose the Hub_TEMS security validation from the advise of you all and your experiences with it. Regards, Gregory R. Mendes Tivoli Architect/Tools Specialist Mendes, Inc. Tivoli Monitoring 6.2.3 Certified 770-317-8593 Date: Wed, 15 May 2013 16:19:43 -0500 Subject: Re: [TME10] TEPS 10 Character UserID Limitation Security Validation at Hub From: venkat.saranathan-9LkaxTQlAnxWk0Htik3J/[email protected] To: [email protected] Julius, Good points! The TEPS vs TEMS LDAP authentication is always tricky and there is no right answer IMHO. TEPS LDAP integration is much more versatile in that if the customer has multiple LDAP repositories or multiple user filters, it can be done in TEPS but not at HTEMS. Also, if a customer site has plans to setup SSO or if their active directory setup requires to follow referrals , it would be better for them to use the TEPS. On the other hand, TEMS authentication will make it easier to manage the LDAP users from single point, but the downside is that authenticated LDAP users are given access not only to portal but tacmd and SOAP server as well. A slightly better idea is to enable at both places but then there are still some disadvantages like the one you mentioned. with warm regards, Venkat Saranathan Gulf Breeze Software Gulf Breeze Calculus: We differentiate our work in Tivoli Integration! On Wed, May 15, 2013 at 1:24 PM, Julius Loman <[email protected]> wrote: For example you can do SSO for TEP clients (browser based). If I remember the things correctly - The user ID you enter in TEP login window is the one from the User DN field and it does not matter what is in the User ID field. One of the bad things about the possibility of authenticating users at TEPS is the fact that it allows anybody with IP connectivity to HUB and access to ITM media to gain sysadmin permissions in TEP on any ITM environment. (even if HUB authentication is used). On Wed, May 15, 2013 at 12:25:00PM -0500, Gregory Mendes <[email protected]> wrote: > Thanks for that information. > > Then what is the reason for authenticating from the Hub_TEMS vs. TEPS? I thought that got you past the 10 character limitation in TEPS. > > Regards, > > > > Gregory R. Mendes > Tivoli Architect/Tools Specialist > Mendes, Inc. > Tivoli Monitoring 6.2.3 Certified > 770-317-8593 > > > Date: Wed, 15 May 2013 10:44:46 -0500 > Subject: Re: [TME10] TEPS 10 Character UserID Limitation Security Validation at Hub > From: [email protected] > To: [email protected] > > No, you weren't able to log in with the value of the "User Name" column. That maps to the "Name" column from KFWUSER and is just a way to identify the real name of the person logging in. The ID column in KFWUSER maps to the "User ID" field in the user admin create user UI, and all CTAUTH calls do a match on the value form ID, so that's always the key. > > > > On Wed, May 15, 2013 at 8:38 AM, Gregory Mendes <[email protected]> wrote: > > > > > Hello All, > > I asked this question before and received several responses and I thank you all for them. I took advice from Julius about UserID vs. User Name configuration. > > The reason I implemented security validation at the Hub was because of the 10 character UserID limitation at the TEP. > > > So, what I did was call the UserID "testuser1" and the User Name "ssd01_DBADM" which is over 10 characters. > > I was under the impression and from the information I received that the Hub would validate the User Name that's over 10 characters and not the User ID. My log files have rolled off but I swear I logged in with the "User Name" instead of the "User ID" and it worked. > > > I'm I wrong? I have been before but your advice is greatly appreciated. > > Regards, > > > > Gregory R. Mendes > 770-317-8593 > > > > _______________________________________________ > > TME10 mailing list > > [email protected] > > Unsubscribe:[email protected] > > > > > -- > "Sometimes I think that's the only right thing to do: > To dream. to live in the world of dreams. > But it doesn't last forever--wakefulness always comes to take me back..." > > > _______________________________________________ > TME10 mailing list > [email protected] > Unsubscribe:[email protected] > _______________________________________________ > TME10 mailing list > [email protected] > Unsubscribe:[email protected] -- [ Julius Loman ][ [email protected] ][ http://lomo.kyberia.net ][ icq:35732873 ] _______________________________________________ TME10 mailing list [email protected] Unsubscribe:[email protected] _______________________________________________ TME10 mailing list [email protected] Unsubscribe:[email protected] _______________________________________________ TME10 mailing list [email protected] Unsubscribe:[email protected]