Emulating single signon with newlook

Emulating single signon with newlook

contents Emulating Single Sign On (SSO)... 3 IBM i Requirements... 3 Screen Flow... 3 newlook Solution... 3 Other Considerations... 3 IBM i Requirements... 4 A Super User profile... 4 Several designated user profiles... 4 Capability to call a program from the sign on screen... 4 A CL program to switch users... 4 Screen Flow... 5 newlook Solution Requirements... 6 Retrieve Super User Profile and Password... 6 Retrieve Designated User Profile... 6 Connect to the IBM i system... 6 Sign On to the IBM i system... 6 Identify the designated user... 6 Start the designated user initial program/menu... 6 Other Considerations... 7 What the user will see.... 7 Changing the super user password.... 7 looksoftware Last updated 13-Apr-12 Page 2 of 7

Emulating Single SignOn (SSO) This document includes an overview of a design that can be used to build a solution with newlook to emulate SSO. The sections in this document are: IBM i Requirements What is needed on the IBM i to build this solution. Screen Flow How the green screens will work to access the user s initial program/menu. newlook Solution Requirements The design of the solution required to be built with newlook. Other Considerations Additional topics of interest. looksoftware Last updated 13-Apr-12 Page 3 of 7

IBM i Requirements These are the minimum objects required on the IBM i side to support this solution. A Super User profile This user profile does not need to be able to sign on to an interactive session, and does not require to be authorized to applications or data. It must have *USE and *READ authority to all the designated user profiles that will be used in this solution. Several designated user profiles These user profiles are the normal users who currently sign on to the IBM i. The Super User must have *USE and *READ authority to all these designated user profiles. Capability to call a program from the sign on screen The program name on the Sign On screen will be used to start an interactive session. This functionality must be available for the super user profile. A CL program to switch users This program will be called from the sign on screen when newlook uses the Super User to sign on. Its purpose is to collect the user name from a green screen prompt, and switch the job to use that designated user name as the current user. The core of that CL program will be contain functionality similar to this: /*********************************/ PGM PARM(&USERNAME) DCL VAR(&USERNAME) TYPE(*CHAR) LEN(10) DCL VAR(&PASSWORD) TYPE(*CHAR) LEN(50) VALUE('*NOPWD') DCL VAR(&HANDLE) TYPE(*CHAR) LEN(12) DCL VAR(&ERRCODE) TYPE(*CHAR) LEN(8) VALUE(X'0000000000000000') CALL PGM(QSYGETPH) PARM(&USERNAME &PASSWORD &HANDLE &ERRCODE) CALL PGM(QWTSETP) PARM(&HANDLE) ENDPGM /*********************************/ Modifications to this base code will include: error handling a green screen display to collect a user profile name. calling/transferring to the user profile s initial program The two key programs are the APIs named QSYGETPH and QWTSETP - More details for the two APIs can be found here: http://publib.boulder.ibm.com/iseries/v5r2/ic2924/index.htm?info/apis/qsygetph.htm http://publib.boulder.ibm.com/iseries/v5r2/ic2924/index.htm?info/apis/qwtsetp.htm looksoftware Last updated 13-Apr-12 Page 4 of 7

Screen Flow This is the process that will be used by newlook to sign on to the user s first program/menu. newlook will be following this screen flow in order to emulate SSO. After the initial connection, the Sign On screen will be displayed. The Super User and password will be entered, along with the name of the program to perform the user switch. That program will ask for the designated user name, it will be entered, and the CL program will perform the user switch and call the initial program for the designated user. looksoftware Last updated 13-Apr-12 Page 5 of 7

newlook Solution Requirements These steps need to be coded inside the newlook Solution to emulate SSO. Retrieve Super User Profile and Password The Super User profile and password need to be determined. These could be retrieved from a locally cached encrypted file, or hard- coded into a newlook macro or script. Retrieve Designated User Profile It must be determined where the user profile name is to be retrieved from. If the user profile is the Windows user name then this can be retrieved programmatically and is the easiest to implement. If the designated user profile is not the same as the Windows user name then a translation table may be required to look up the IBM i user profile name to be used. If the smartclient is being launched from within another existing application then it may be possible for that application to provide the user profile as an input variable to the smartclient. Connect to the IBM i system A 5250 telnet connection will be made to the IBM i partition. Sign On to the IBM i system At the Sign on screen, the Super User and Password will be filled in with the retrieved values (or from internal hard coded values), and the name of the Switch User program will be filled into the Program name field. Enter will then be pressed to continue. Identify the designated user The Switch User program will now ask for the designated User Profile, and it will be filled in from the retrieved values. Enter will then be pressed to continue. The designated user profile will be stored into newlook memory for later use. Start the designated user initial program/menu The Switch User program can retrieve the initial program and library, or initial menu, from the designated user profile and will transfer control to that program or menu. looksoftware Last updated 13-Apr-12 Page 6 of 7

Other Considerations What the user will see. Once the user has clicked on the icon on their desktop, the newlook solution should open using the smartframe, if possible. The first screen that appears will be their initial program or menu, as defined in their IBM i user profile definition. All screen navigation will be invisible to the user. Changing the super user password. The Super User profile name and password must be stored somewhere so the newlook solution can retrieve it. It is possible to store it inside a newlook macro or script, or another solution might be to store it in a locally cached encrypted file. In any case, changing the Super User profile will require a change to the newlook solution. suite 9 / 622 ferntree gully rd wheelers hill vic 3150 australia acn : 071 351 776 tel: +61 (0)3 9535 4444 fax: +61 (0)3 9535 4455 email: info@looksoftware.com web: www.looksoftware.com looksoftware Last updated 13-Apr-12 Page 7 of 7