Enabling or disabling the Storage Authentication Service

Complete this task to enable or disable the Storage Authentication Service using the Tape Library Specialist Web interface.

1. From the Work Items navigation pane, select Access —> Web Security.
   The Web Security screen displays.
2. Select the Storage Authentication Service tab.
3. Select the Enable Storage Authentication Service check box to enable SAS. Deselect the Enable Storage Authentication Service check box to disable SAS.
   Notes:

   • It is also possible to disable SAS by resetting the security/admin password on the operator panel. Refer to Using the operator panel to change the administrator's Web password in order to use this method.
   • When SAS is disabled, all users with active sessions continue with the same permissions that were obtained when SAS was enabled.
   • You cannot change the SAS configuration while SAS is enabled.
4. If you are enabling SAS, insert values for the following fields. If you are disabling SAS, proceed to step 5.
   • Primary Server URL: This should be set to the HTTPS URL using the IP address of the host running the TIP server and the communication port used by SAS. An example of the Primary Server URL is: https://192.168.0.10:16311 where 192.168.0.10 is the TIP host server and 16311 is the authentication service port.

     The TS3500 tape library does not support Domain Name Service (DNS) host names. Only IP addresses can be used in the URL. The URL can have a maximum of 254 characters. For the TIP Authentication Service, the default HTTP port is 16310 and the default HTTPS port is 16311. Contact your TPC administrator if the TIP server is configured differently and you need to verify the host IP and port number for the TIP server.

   • Secondary Server URL: Optionally, a Secondary Server URL can be given for making SAS highly available in case the TIP server using the Primary Server URL is not reachable. The TIP server URL given here must adhere to the following rules:
     • Both the Primary Server URL and the Secondary Server URL must be either HTTP or HTTPS.
     • Both of the TIP servers must have the same common set of user credentials.
     When the Secondary Server URL is given, SAS uses this secondary URL as follows.

     • When enabling SAS, authentication and authorization for the given Admin User ID and password must succeed using both URLs.
     • When logging in or disabling SAS, the Primary Server URL is tried first and if there is no communication failure, the results are returned back to the user. Other potential failures, such as failure to authenticate (an unknown user or a wrong password) or failed authorization (not an Admin) do not cause SAS to use the secondary server URL. The Secondary Server URL is only used if there is a communication failure with the Primary Server URL.
   • Service Connection User ID and Password: The TS3500 tape library uses this User ID and Password for connecting to the TIP Authentication Service using HTTP basic authentication. The User ID can be configured in TIP to be any User ID in LDAP or a User ID that is also used by TPC. Contact your IBM® Tivoli Storage Productivity Center administrator to obtain the authentication service User ID and Password.
     Note: The User ID and Password cannot exceed 14 characters each.
5. Enter the User ID and Password of a user in an Admin LDAP group and select Apply.
   If you are using only HTTP URLs, you have completed this procedure. If you are also using HTTPS URLs, proceed according to the following scenarios:

   Note: It can take up to two minutes to enable SAS when using HTTPS URLs.

   • If an acceptable SSL certificate exists, no error message displays and you are finished with this procedure.
   • If there are no SSL certificates, the following error message displays: Request Failed - New Certificate Required. Proceed to step 6.
   • If there is a mismatch with an existing certificate (for example an expired certificate or the subject does not match) the following error message displays: Certificate Error Has Occurred. Proceed to step 7.

   Notes:

   • When submitting any changes to the settings on this tab, you must also provide the User ID and Password to be confirmed using the Storage Authentication Service.
   • Should the login with the SAS User ID and Password fail for any reason, refer to Using the operator panel to change the administrator's Web password in order to disable SAS using the operator panel. You can then log in using your local user account.
6. If the Request Failed - New Certificate Required error message displays, verify and accept an SSL certificate by completing the following substeps:
   1. From the Web Security screen, select the SSL Certificates tab.
   2. Verify the hostname in the Issued To field to ensure that it corresponds to the IP in the URL.
   3. Verify that the expiration date is still valid in the Expiration field.
      Note: The date and time are in Universal Time Coordinated (UTC) format. Since the tape library does not maintain local time zone information, there is a minor discrepancy in verifying the validity dates of a certificate. SAS may declare a certificate invalid a few hours early or a few hours too late depending on the difference between local time and UTC.
   4. Verify the value in the Fingerprint field by using a browser connected to the TIP Server console and looking at the certificate details used in the browser connection.
   5. Take one of the following actions:
      • To accept the certificate, return to the Storage Authentication Service tab. Enter the User ID and Password and select Apply. Once accepted, certificates are stored in compact flash in the TS3500 tape library.
      • To reject one or more certificates because the hostname, expiration date, or fingerprint values do not match, select the certificate(s). Then select Delete from the Select Action drop-down menu and click Go.
        Note: Certificates can only be deleted when SAS is disabled.
7. If the Certificate Error Has Occurred error message displays, delete the existing certificate by completing the following substeps:
   1. From the Web Security screen, select the SSL Certificates tab.
   2. Select the certificate(s) to be deleted. Then select Delete from the Select Action drop-down menu and click Go.
   3. Go back and complete step 6.