Novell Modular Authentication Service (NMAS)


NICI Client

You must have the NICI Client installed on each client that will run ConsoleOneTM and NMAS. See Novell International Cryptographic Infrastructure (NICI) for more information.


Update NetWare 5 Servers Running NMAS before Installing Novell Native File Access Protocols

Before installing Novell Native File Access Protocols (as part of the NetWare 6 installation or otherwise), all NetWare 5 servers (in the tree) running NMAS must be updated to NMAS 2.0.1, NICI 2.0.1, and ConsoleOne 1.3.

NMAS 2.0.1, NICI 2.0.1, and ConsoleOne 1.3.2 updates and instructions are available at www.novell.com/downloads.


NMAS and BorderManager Interoperability

In order for BorderManagerTM Enterprise Edition 3.5 (BMEE35) and NMAS to coexist, the Login Policy Object must be created using the BMEE35 NetWare Administrator snap-ins.

In order to install BMEE35 in a tree with NMAS, complete the following steps:

  1. If a Login Policy Object already exists, delete it from the Security Container.

    2.

  2. Install BMEE35.

    3.

  3. Create a new Login Policy Object using NetWare Administrator with the BMEE35 snap-ins.

  4. Configure the BorderManager services to use the Login Policy Object.

    Refer to the Border Manager documentation for details.

    5.

  5. Run the NMAS installation from the server-side GUI.

    6.

  6. Reinstall any NMAS Methods and re-create any NMAS login sequences.

    7.

Simple Password and Force Password Change

The Simple Password method is used for various authentication services in NetWare 6. These include the Native File Access Pack that provides authentication support for CIFS and AFP.

A problem might arise if you set or change a user's simple password from the ConsoleOne administrative snap-ins using Force Password Change. If you experience problems setting an initial password, you might need to check the Force Password Change check box. If the user already has a password set, Force Password Change might not work unless you remove the current password and enter a new one.


Explicit Rights and Graded Authentication

You must give explicit rights to users with graded authentication. Inherited rights do not work. For example, an administrator's Supervisor right is defined at the [Root] container. Rights for the administrator are not defined in the Volume object. So if the administrator changes the volume's security label from Logged In to any other security label, the administrator cannot get the appropriate rights. The administrator must assign explicit rights to the volume, directories, or files in the volume.



Previous | Next