Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE STRUCTURE, Руководство системного администратора

Страница: 272 / 374

272 ZENworks 10 Configuration Management System Administration Reference
n
ov
do
cx (e
n)
16
Ap
ril 20
10
3 Create a String called DefaultRealm and set the value to desired user source.
For example, if all the users should log in to a user source named POLICY-TREE, create a
String called DefaultRealm and set its value to POLICY-TREE.
If the login to the specified default user source fails, the other existing user sources are searched and
the user is logged in to the user source that matches the user account.
On a Windows XP, Windows 2000, or Windows 2003 device, the user can choose to view the status
of the login during the process of logging in to ZENworks.
To enable the status messages to be displayed on the screen:
1 Open the Registry Editor.
2
Go to
HKEY_LOCAL_MACHINE\Software\Novell\NWGINA
.
3 Create a DWORD called EnableStatusMessages and set the value to 1.
32.2 Authentication Mechanisms
The following mechanisms can be used to authenticate managed devices to the ZENworks
Management Zone:
Š
Section 32.2.1, “Kerberos (Active Directory only),” on page 272
Š
Section 32.2.2, “Shared Secret,” on page 274
Š
Section 32.2.3, “Username/Password (eDirectory and Active Directory),” on page 276
32.2.1 Kerberos (Active Directory only)
Kerberos*, an authentication protocol developed at MIT, requires entities (for example, a user and a
network service) that need to communicate over an insecure network to prove their identity to one
another so that secure authentication can take place.
Kerberos functionality is included natively in a Windows Active Directory environment.
Kerberos requires the use of a Key Distribution Center (KDC) to act as a trusted third party between
these entities. All Kerberos server machines need a keytab file to authenticate to the Key
Distribution Center (KDC). The keytab file is an encrypted, local, on-disk copy of the host's key.
When using Kerberos authentication, the Active Directory server generates a Kerberos ticket that
Novell Common Authentication Services Adapter (CASA) uses to authenticate the user, rather than
using a username and password for authentication.
Š
“Setting Up Kerberos in your ZENworks Environment” on page 272
Š
“Enabling Kerberos Authentication While Adding a User Source” on page 273
Š
“Enabling Kerberos Authentication on an Existing User Source” on page 273
Š
“Understanding How Kerberos Authentication and the ZENworks Login Dialog Box Interact”
on page 273
Setting Up Kerberos in your ZENworks Environment
1 Set up a Kerberos service principal account and generate a keytab file for that account.