topic Single sign-on in Operating System - OpenVMS

Single sign-on

Wim Van den Wyngaert — Wed, 24 Nov 2004 08:53:53 GMT

Hi,

I have about 140 AXP nodes with about 10 different sysuaf files. There is a system of distribution for feeding 60 stations with a copy of the sysuaf. VMS 6.2 - 7.3.

I was thinking of arming myself against management questions concerning single sign-on.

1) What software can I use to implement single sign-on and what does it cost ?
2) Who implemented it in a critical environment (e.g. multi-site cluster) and what problems did you have ?

Wim

Re: Single sign-on

John Gillings — Wed, 24 Nov 2004 16:43:58 GMT

Wim,

Pathworks can do single signon into an NT domain on V7.1 and higher. It's been around for a long time. It's secure as a Windows only domain and any issues with stability are external to VMS. You'll have to ask your account manager for local pricing for Pathworks. If you don't want/need PC clients for Pathworks (ie: sharing VMS disks and printers), it might even be "free" - please check before basing decisions on that assessment!

V7.3 has support for generic authentication "ACME". There are EAKs for LDAP and hooks to support arbitrary authentication modules (Kerberos is under development, and possibly Radius). You won't see any backports, so it won't help with anything V7.2 or below.

There are also various implementations of UAF synchronization floating around with varying degrees of robustness and security. Generally speaking, I don't believe that is a good solution.

Check out the VMS Management Station - it might help. There are also lots of VMS management products from various sources that may have workable solutions. Just make sure anything that communicates passwords across a network implements some kind of encryption!

Re: Single sign-on

Shael Richmond — Wed, 24 Nov 2004 17:56:40 GMT

If all you are using Pathworks for is to provide authentication then there is no cost. We use it across 26 sites to have the VMS systems use the same username/password and their Windows domain username/password.

Re: Single sign-on

John Gillings — Wed, 24 Nov 2004 20:40:21 GMT

Wim,

I've confirmed that you can install Pathworks Server, join an NT domain and use single signon for zero cost. You will need TCPIP (licensed) and configured to start the PWIP driver.

You will need to define the system exec logical name SYS$SINGLE_SIGNON somewhere in your startup. Make sure it's not done until AFTER pathworks is running.

Re: Single sign-on

Art Wiens — Thu, 25 Nov 2004 09:16:50 GMT

John, when you say Pathworks Server...are you talking about the same product as Advanced Server, or an older version of Pathworks? It's free?!

Art

Re: Single sign-on

Antoniov. — Thu, 25 Nov 2004 13:25:09 GMT

John,
are you sure pathwork is free?
May you tell me more about pathwork and VMS sign-on?
It's possible set pathwork and vms with same user & password but AFAIK the user have to change the network password not vms password.
It's true?
I'm interesting in this feature!

Antonio Vigliotti

Re: Single sign-on

Uwe Zessin — Thu, 25 Nov 2004 14:15:37 GMT

Antonio,
it means that LOGINOUT verifies the username/password you enter against a Windows domain controller, not the SYSUAF. You can still do a login against the SYSUAF if you specify a qualifier (/LOCAL ?) after the username.

Re: Single sign-on

Brad McCusker — Thu, 25 Nov 2004 19:44:08 GMT

A few comments I hope are helpful...

John wrote:

"Pathworks can do single signon into an NT domain"

It can also do single signon into a Windows 2000 domain using LanManager security.

Art wrote:

"John, when you say Pathworks Server...are you talking about the same product as Advanced Server, or an older version of Pathworks?"

Yes, Advanced Server and PATHWORKS are essentially the same product. "Advanced Server for OpenVMS" is the follow-on product to "PATHWORKS for OpenVMS (Advanced Server)".

Art also asked:

"It's free?!"

Well, that depends on what you want to do. You can install, configure, start, and even run Advanced Server for OpenVMS with no licnese, so, it is free to do all of that. Once it is running, it can be a part of a domain, or, you can make it a PDC in its own domain, and add users and add shares and things like that. Also, External Authentication will just work.

Now, if you want to actually connect to a resource (file or printer), then, you will need a license. It is at the point of SessionSetup in the protocol that licenses are actually checked and enforced.

Antoniov asked:

"May you tell me more about pathwork and VMS sign-on?
It's possible set pathwork and vms with same user & password but AFAIK the user have to change the network password not vms password."

Yes, PATHWORKS and VMS would have the same password. But, what really happens is that VMS authentication is performed by PATHWORKS via the NT domain. There is a mechanism to keep the VMS password in synch with the domain password, but, generally speaking, it is the domain authentication that is used. See the Adminstrators guide for more information: http://h71000.www7.hp.com/doc/73final/documentation/pdf/ADSRV_ADMIN_GD.PDF

Re: Single sign-on

Wim Van den Wyngaert — Fri, 26 Nov 2004 06:00:47 GMT

All,

Is VMS able to continue without the NT nodes being operational ?

I also ment : sign on once, and work everywhere (where you are allowed). Is that also possible ?

Also nice would be that FTP, copy, etc could work without specifying username + password (I know use proxies for this but ftp doesn't handle that).

And is anyone using something in a critical environment ?

Wim@home

Re: Single sign-on

Paul Nunez — Fri, 26 Nov 2004 06:09:28 GMT

Hi,

I just wanted to clarify one point made earlier:

> You will need to define the system exec >logical name SYS$SINGLE_SIGNON somewhere in >your startup. Make sure it's not done until >AFTER pathworks is running.

The system logical name sys$single_signon is defined to 1 (enabled) by default; the sysmgr doesn't need to be concerned with the logical UNLESS external authentication is causing problems. In that case, you should set sys$single_signon to 80000001 and enable OPCOM security messages:

$ define/system/exec sys$single_signon - 80000001
$ reply/enable=security

Then repeat the failing operation to get debug messages.

The only action the system manager needs to take to enable single signon for a user is to enable the EXTAUTH flag on the user's SYSUAF account:

UAF> MOD AUSERNAME /FLAG=EXTAUTH

Also, the feature is extremely capable - it works egardless of the domain role of the Advanced Server (PDC, BDC, or Member server), regardless of what O/S the PDC (emulator) runs (PATHWORKS, Advanced Server, Windows NT/200x), and across trusts (NT-style trusts).

Good stuff :o)

Paul

Re: Single sign-on

Wim Van den Wyngaert — Fri, 26 Nov 2004 06:19:29 GMT

Also :

We now have usage of set password. What happend with that ?

We have a sysuaf that is also distributed. The base is an unused sysuaf. Can that be synchronized with pathworks too ?

Wim

Re: Single sign-on

Paul Nunez — Fri, 26 Nov 2004 06:39:20 GMT

Hi,

>We now have usage of set password. What >happend with that ?

For extauth users, $ SET PASSWORD will modify the user's _domain_ (i.e., Windows) password AND then immediately sync's the user's sysuaf password.

Not that it's a big deal, but $ SET PASSWORD is the only method of changing the password that sync's the two passwords immediately. It's not a big deal because once a user starts using extauth, it's likely they'll never attempt to access their sysuaf password again, UNLESS, (1) the extauth flag was removed from their sysuaf account or (2) some client/server app is in use in which the server end is running on the OVMS system and it accesses the SYSUAF directly, bypassing LOGINOUT.EXE.

If the user changes their domain password using the Advanced Server command $ ADMINISTER SET PASSWORD or they change it from their Windows workstation, only the domain account password is modified. When the user next utilizes external authentication to access the OVMS system, OVMS (LOGINOUT?) will sync the user's sysuaf account password at that time.

One other piece of this puzzle - if the user's domain account name and SYSUAF account name do not match, you must "map" the two together using the Advanced Server command:

$ admin add hostmap domainuname sysuafuname

>We have a sysuaf that is also distributed. >The base is an unused sysuaf. Can that be >synchronized with pathworks too ?

I don't understand enough of what you're doing to answer :<( Can you elaborate?

HTH,

Paul

Re: Single sign-on

Jan van den Ende — Fri, 26 Nov 2004 07:58:29 GMT

Wim,

Also nice would be that FTP, copy, etc could work without specifying username + password (I know use proxies for this but ftp doesn't handle that).

I am surprised!
We use IP proxies since many years!

Try
$ TCPIP help add proxy

Normally:
TCPIP ADD PROXY /host= /remote=

Of course your remotehost_name must be known, bij TCPIP$HOSTS or DNS

If you defined them on one node of the cluster, with TCPIP SHO PROX you will note a TYPE value CD, all other nodes see only C
On the other nodes
$ TCPIP SET TCPIP /SIGNAL
will synchronise them.

Success.

Cheers.

Have a Duvel on me.

jpe

Re: Single sign-on

Wim Van den Wyngaert — Sun, 28 Nov 2004 07:08:19 GMT

Jan,

Of course I use the proxies too. For rlogin for example. But, to my knowledge, FTP requires a username plus password. This causes hardcoded usernames and passwords. I know rcp can handle it but then I have to re-implement stuff that I don't own. (btw today no Duvel but Roodenberg, a very good red wine of South Africa).

Paul,

We have a lot of stations that have the same sysuaf. But sometimes they are power off and thus we have a reference sysuaf that is copied at boot time and synced after modification (or password change that is done with task-to-task).

Are there any non-HP people that have implemented pathworks and had problems ?

Wim

Re: Single sign-on

Ian Miller. — Sun, 28 Nov 2004 11:54:05 GMT

What would worry me is that the access to my VMS system was controlled by a windows system with its well known security and stability problems. I may be a bit biased :-) but Id prefer users to be authenticated against a secure system - parhaps kerberos or pki certificates in a corporate directory server on a secure platform.

(are we all mad posting replies on here during a weekend ? or parhaps just fanatics :-)
Newcastle Star Ale today :-)

Re: Single sign-on

Uwe Zessin — Sun, 28 Nov 2004 12:27:51 GMT

But according to John's message it sounds to me like non-Windows authentication is all beta-quality (EAK / under development) at best.

Re: Single sign-on

DICTU OpenVMS — Mon, 29 Nov 2004 04:02:21 GMT

If sys$single_signon is given the value of 3, then the windows passwd gets set in the uaf after a succesfull login. So even if the not so reliable system isn't available (again), the user is able to login...

Re: Single sign-on

Ian Miller. — Mon, 29 Nov 2004 04:40:16 GMT

Uwe - yes that unfortunate - the one one that works today is kerberos I think.

Menco - good point.

Re: Single sign-on

Wim Van den Wyngaert — Mon, 29 Nov 2004 05:00:54 GMT

I tend to agree with Ian.

Because it is Windows based, I have to do 3 months of admin before I can test this. And in case of a disaster, I don't want to depend on windows stuff (or in general, other platforms). For all stuff I depend for on windows, I have a backup system on VMS (allthough not is not always working as it should, e.g. mozilla).

Wim

Re: Single sign-on

Uwe Zessin — Mon, 29 Nov 2004 05:33:08 GMT

Eeek. I can certainly understand that you don't want to use a Windows solution if:

- it is not under your control
- you have a high administrative overhead dealing with them

It is too bad that VMS is a little behind in single sign-on technology.