The Single Sign On (SSO) in the EIM mode is the implementation of the IBM Single sign-on system.
The main idea is that there is one unique credential management server, Kerberos. When the user is connecting to its station the Kerberos server gives him a ticket. When EIM is used during connection that ticket is used in place of user/password. This ticket is validated by the Kerberos server (from the iSeries job), and a corresponding OS/400 user is given from the ticket username (the windows login).
So, the user password is not used anymore, and best security is to put "*NONE" to the password. This way the user must use a Kerberos authentication to connect to the system.