eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Mapping of Foreign EnvironmentsMapping Foreign Principal NamesForeign principal names are defined on CA-Top Secret to indicate the realm fromwhich the foreign user will be mapped into a local ACID. The following format isused for this fully qualified reference./…/foreign_realm/foreign_principal_nameThe foreign_principal_name should be defined in the foreign_realm as a localprincipal in that system. The foreign_principal_name need not be identical withits associated ACID in the foreign system.The local ACID need not be defined as a Kerberos local principal. It serves as asurrogate for security activities by the foreign principal in the local environment.The KERBLINK label provides a convenient reference in the SDT to identify therelationship. The command to link these entities is given below:TSS ADD(SDT) KERBLINK(kerblink)LINKNAME(‘/…/foreign_realm/foreign_principal_name’) KERBUSER(surrogat)KERBLINK—1-8 character label for the SDT record identifying the foreignprincipal relationshipLINKNAME—a fully qualified foreign principal name. Theforeign_principal_name must be defined as a local_principal_name in the foreignsystem.KERBUSER—a local ACID defined to CA-Top Secret. This ACID need not existat the time that the SDT record is defined. When the foreign principal attempts toinitiate a session with the local realm, however, the ACID must be defined or anerror will result.Suppose that two foreign realms have been defined,MAJESTERIAL.CLIENT.COM and COLLOSSAL.SUCCESS.COM and we wish toestablish trust relationships locally for Kerberos principals king5 in the firstrealm, using the following command:TSS ADD(lscess1) KERBNAME(king5)major_major_majorIn the second realm, using the following command:TSS ADD(lclint1) KERBNAME(major_major_major).On the second realm, where king5 is foreign defines a foreign principal “king5”from the originating foreign realm MAJESTERIAL.CLIENT.COM and associatesthat principal locally with ACID “client1” in the local TSS.TSS ADD(SDT) KERBLINK(kclint1) LINKNAME(‘/…/majesterial.client.com/king5’)KERBUSER(client1)Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–89