CA-ACF2 MVS interface - Revision history

JAL: misc formatting

2018-04-27T20:15:19Z

misc formatting

← Older revision		Revision as of 20:15, 27 April 2018
Line 670:		Line 670:
	</ul>		</ul>

	<p>For trusted logins, the statement format is the same but the login character string is a semicolon surrounded by single quotes (';'). </p> </li>		<p>For trusted logins, the statement format is the same but the login character string is a semicolon surrounded by single quotes (<code>';'</code>). </p> </li>
	</ul>		</ul>

	=====Trusted login errors=====		=====Trusted login errors=====
			<p>
	<p>When using trusted login, you might receive one of the following errors: </p>		When using trusted login, you might receive one of the following errors: </p>

	<ul>		<ul>
	<li>M204.2378: ~~SECURITY TRUSTED LOGIN FEATURE DISABLED~~		<li>M204.2378: Security trusted login feature disabled
	<p>This message is generated when either:</p>		<p>
			This message is generated when either of these occurs:</p>
	<ul>		<ul>
	<li>The Model 204 job requesting the trusted login feature is running without a Model 204 Security Interface.		<li>The Model 204 job requesting the trusted login feature is running without a Model 204 Security Interface. </li>
	</li>

	<li>		<li>The Model 204 address space does not have enough storage to allocate an internal work area for the trusted login feature.
	The Model 204 address space does not have enough storage to allocate an internal work area for the trusted login feature.		<p>
	In this situation, the ~~Model204~~ job does not initialize, because it still has to allocate storage for the Model 204 file buffers.		In this situation, the Model 204 job does not initialize, because it still has to allocate storage for the Model 204 file buffers. </p></li>
	</li>		</ul></li>
	</ul>
	<li>~~M204.2379: INVALID TRUSTED USERID LENGTH = <var class="term">length</var>.~~

	<p>This message is issued ~~when~~ the trusted user ID passed by CRAM is not between 1-8 bytes long. </p>		<li>M204.2379: Invalid trusted user-id length = <var class="term">length</var>
	</li>		<p>
			This message is issued if the trusted user ID passed by [[Cross-memory facilities CRAM and M204XSVC\|CRAM]] is not between 1-8 bytes long. </p> </li>
	</ul>		</ul>

	===Using Pass Tickets===		===Using Pass Tickets===
	<p>		<p>
	Model 204 supports the use of Pass Tickets instead of passwords during the logon process under ACF2. ~~There are no~~ new CCAIN parameters nor ~~are any~~ changes ~~required~~ to existing parameters. However, ACF2 expects Pass Tickets to be generated using the user's id and the characters "MVS" concatenated with the SMF system id of the ~~online~~. Changes similar to these are required in ACF2: </p>		Model 204 supports the use of Pass Tickets instead of passwords during the logon process under ACF2. This support does not require new CCAIN parameters nor changes to existing parameters. However, ACF2 expects Pass Tickets to be generated using the user's ID and the characters <code>MVS</code> concatenated with the SMF system ID of the Online. </p>
	<p class="~~syntax~~">TSO ACF		<p>
			Changes similar to these are required in ACF2: </p>
			<p class="code">TSO ACF
	SET PROFILE(PTKTDATA) DIVISION(SSIGNON)		SET PROFILE(PTKTDATA) DIVISION(SSIGNON)
	INSERT ~~MVSsysid~~ SSKEY(random hex string)		INSERT MVS<i>sysid</i> SSKEY(<i>random-hex-string</i>)
	~~end~~		END </p>
	Then refresh in SDSF		<p>
	F ACF2,REBUILD(PTK),CLASS(P)		Then, refresh in SDSF: </p>
			<p class="code">F ACF2,REBUILD(PTK),CLASS(P)
	</p>		</p>


	==Maintaining the CA-ACF2 MVS Interface==		==Maintaining the CA-ACF2 MVS Interface==
			<p>
	<p>At each CA-ACF2 MVS site, the installation security officer (ISO) performs systemwide maintenance functions within CA-ACF2 MVS. This section describes the role of the security officer in maintaining the Model 204 CA-ACF2 MVS Interface. </p>		At each CA-ACF2 MVS site, the installation security officer (ISO) performs systemwide maintenance functions within CA-ACF2 MVS. This section describes the role of the security officer in maintaining the Model 204 CA-ACF2 MVS Interface. </p>

	===Defining user privileges===		===Defining user privileges===

JDamon: Added info on Pass Tickets

2018-04-26T05:15:34Z

Added info on Pass Tickets

@@ Line 695: / Line 695: @@
 </li>
 </ul>
 ==Maintaining the CA-ACF2 MVS Interface==

JAL: /* AUTHCTL VIEW command */ use mixed case

2018-04-25T16:14:16Z

AUTHCTL VIEW command: use mixed case

← Older revision		Revision as of 16:14, 25 April 2018
Line 595:		Line 595:

	<p class="code">ACF2 INTERFACE OPTIONS		<p class="code">ACF2 INTERFACE OPTIONS
	RESOURCE JST ACF2 ~~RESOURCE TYPE~~		RESOURCE JST ACF2 resource type
	LOGIN X'0172' ~~AUTHORITY BYTE OFFSET IN~~ LIDREC		LOGIN X'0172' authority byte offset in LIDREC
	X'80' ~~BIT DEFINING MODEL204 AUTHORITY~~		X'80' bit defining Model 204 authority
	ACCOUNT X'0176' ~~ACCOUNT OFFSET IN~~ LIDREC		ACCOUNT X'0176' account offset in LIDREC
	X'04' ~~ACCOUNT LENGTH~~		X'04' account length
	RECSCTY X'0000' ~~RECORD SECURITY KEY OFFSET IN~~ LIDREC		PRIORITY LOW priority default or offset in LIDREC
	X'00' ~~RECORD SECURITY KEY LENGTH~~		RECSCTY X'0000' record security key offset in LIDREC
	~~PRIORITY LOW PRIORITY DEFAULT OR OFFSET IN LIDREC~~		X'00' record security key length
	VALIDATE ~~ACCOUNT VALIDATION OPTION IN EFFECT~~		VALIDATE account validation option in effect
	DLMCHECK ~~USE~~ $JOB ~~DLM CHECKING OPTION~~		DLMCHECK use $JOB dlm checking option
	M204USER ~~DEFAULT LOGONID IN USE~~		M204USER default Logon ID in use
	</p>		</p>
			<p>
	<p>The last line displayed indicates the current default ~~Logonid~~ in use. For more information, refer to [[#Inserting a CA-ACF2 default Logonid\|Inserting a CA-ACF2 default Logonid]]. </p>		The last line displayed indicates the current default Logon ID in use. For more information, refer to [[#Inserting a CA-ACF2 default Logonid\|Inserting a CA-ACF2 default Logonid]]. </p>
			<p>
	For information about setting control information, see [[#Preparing the ACF2PARM parameter module with ACF2GEN\|Preparing the ACF2PARM parameter module with ACF2GEN]].		For information about setting control information, see [[#Preparing the ACF2PARM parameter module with ACF2GEN\|Preparing the ACF2PARM parameter module with ACF2GEN]]. </p>

	===Using trusted login for CRAM users===		===Using trusted login for CRAM users===

JAL: misc formatting

2018-04-16T20:03:37Z

misc formatting

JAL: /* ACF2GEN macro */ add "E" to RESOURC

2018-04-16T18:58:58Z

ACF2GEN macro: add "E" to RESOURC

← Older revision		Revision as of 18:58, 16 April 2018
Line 823:		Line 823:
	<p class="code"> TITLE 'GENERATE AN ACF2 PARAMETER MODULE'		<p class="code"> TITLE 'GENERATE AN ACF2 PARAMETER MODULE'

	<i>NAME</i> ACF2GEN ~~RESOURC~~=204, ACF2 resource type X		<i>NAME</i> ACF2GEN RESOURCE=204, ACF2 resource type X
	LOGIN=(0,0), Login ensure position and bit X		LOGIN=(0,0), Login ensure position and bit X
	ACCOUNT=(0,0), Account position and length X		ACCOUNT=(0,0), Account position and length X
Line 847:		Line 847:

	<tr>		<tr>
	<td nowrap>~~RESOURC~~</td>		<td nowrap>RESOURCE</td>
	<td>Specifies the 3-character CA-ACF2 Generalized Resource Type code for this argument set. The Generalized Resource Rules for Model 204 privileges are defined and grouped by this code and stored in CA-ACF2. The code must match the Generalized Resource Type code described to CA-ACF2 in the ACFFDR statements for your site. The default is <code>204</code>. </td>		<td>Specifies the 3-character CA-ACF2 Generalized Resource Type code for this argument set. The Generalized Resource Rules for Model 204 privileges are defined and grouped by this code and stored in CA-ACF2. The code must match the Generalized Resource Type code described to CA-ACF2 in the ACFFDR statements for your site. The default is <code>204</code>. </td>
	</tr>		</tr>

JAL: /* ACF2GEN macro */ add table borders

2018-04-16T18:56:42Z

ACF2GEN macro: add table borders

← Older revision		Revision as of 18:56, 16 April 2018
Line 839:		Line 839:
	Where: </p>		Where: </p>

	<table ~~class="noBorder"~~>		<table>
	<tr>		<tr>
	<td><var class="term">NAME</var> </td>		<td><var class="term">NAME</var> </td>

JAL: /* Preparing the ACF2PARM parameter module with ACF2GEN */ misc formatting

2018-04-16T18:47:14Z

Preparing the ACF2PARM parameter module with ACF2GEN: misc formatting

Show changes

Goff: /* ACF2GEN macro */

2018-02-28T20:25:56Z

ACF2GEN macro

← Older revision		Revision as of 20:25, 28 February 2018
Line 831:		Line 831:
	LOGONID=M204USER, Default Logonid X		LOGONID=M204USER, Default Logonid X
	NODLMCHECK/DLMCHECK Perform DLM check		NODLMCHECK/DLMCHECK Perform DLM check
	*
	ACF2GEN TYPE=END End of macro definitions		ACF2GEN TYPE=END End of macro definitions
	END
			END
	</nowiki></p>		</nowiki></p>

Goff: /* Sample ACF2PARM module */

2018-02-28T20:25:06Z

Sample ACF2PARM module

← Older revision		Revision as of 20:25, 28 February 2018
Line 977:		Line 977:
	LOGONID=JOBLID, X		LOGONID=JOBLID, X
	DLMCHECK		DLMCHECK
	ACF2GEN TYPE=END
			ACF2GEN TYPE=END

	END		END
	</p>		</p>

Goff: /* ACF2GEN macro */

2018-02-28T20:23:20Z

ACF2GEN macro

← Older revision		Revision as of 20:23, 28 February 2018
Line 831:		Line 831:
	LOGONID=M204USER, Default Logonid X		LOGONID=M204USER, Default Logonid X
	NODLMCHECK/DLMCHECK Perform DLM check		NODLMCHECK/DLMCHECK Perform DLM check
	ACF2GEN TYPE=END End of macro definitions		*
			ACF2GEN TYPE=END End of macro definitions
	END		END
	</nowiki></p>		</nowiki></p>

← Older revision		Revision as of 20:03, 16 April 2018
Line 583:		Line 583:

	===AUTHCTL VIEW command===		===AUTHCTL VIEW command===
			<p>
	<p>The AUTHCTL VIEW command displays the interface control options currently in effect for the active interface (CCASTAT and ACF2GEN). </p>		The <var>[[AUTHCTL command\|AUTHCTL VIEW]]</var> command displays the interface control options currently in effect for the active interface (CCASTAT and ACF2GEN). </p>

	<p>For example, if you enter the following command: </p>		<p>For example, if you enter the following command: </p>
Line 595:		Line 595:

	<p class="code">ACF2 INTERFACE OPTIONS		<p class="code">ACF2 INTERFACE OPTIONS
	RESOURCE JST ACF2 RESOURCE TYPE		RESOURCE JST ACF2 RESOURCE TYPE
	LOGIN X'0172' AUTHORITY BYTE OFFSET IN LIDREC		LOGIN X'0172' AUTHORITY BYTE OFFSET IN LIDREC
	X'80' BIT DEFINING MODEL204 AUTHORITY		X'80' BIT DEFINING MODEL204 AUTHORITY
	ACCOUNT X'0176' ACCOUNT OFFSET IN LIDREC		ACCOUNT X'0176' ACCOUNT OFFSET IN LIDREC
	X'04' ACCOUNT LENGTH		X'04' ACCOUNT LENGTH
	RECSCTY X'0000' RECORD SECURITY KEY OFFSET IN LIDREC		RECSCTY X'0000' RECORD SECURITY KEY OFFSET IN LIDREC
	X'00' RECORD SECURITY KEY LENGTH		X'00' RECORD SECURITY KEY LENGTH
	PRIORITY LOW PRIORITY DEFAULT OR OFFSET IN LIDREC		PRIORITY LOW PRIORITY DEFAULT OR OFFSET IN LIDREC
	VALIDATE ACCOUNT VALIDATION OPTION IN EFFECT		VALIDATE ACCOUNT VALIDATION OPTION IN EFFECT
	DLMCHECK USE $JOB DLM CHECKING OPTION		DLMCHECK USE $JOB DLM CHECKING OPTION
	M204USER DEFAULT LOGONID IN USE		M204USER DEFAULT LOGONID IN USE
	</p>		</p>

Line 613:		Line 613:

	===Using trusted login for CRAM users===		===Using trusted login for CRAM users===
			<p>
	<p>If your site uses CRAM, you can use the trusted login feature, which allows users to issue login commands or calls that do not include a user ID and password. For a user to log in as trusted, the user ID must be defined to CAACF2 MVS. User IDs defined to CCASTAT are not allowed to log in as trusted users. CICS users must be using the CA-ACF2 MVS interface for CICS. Only CICS user IDs that log in through CA-ACF2 can log in as trusted users. </p>		If your site uses CRAM, you can use the trusted login feature, which allows users to issue login commands or calls that do not include a user ID and password. For a user to log in as trusted, the user ID must be defined to CAACF2 MVS. User IDs defined to CCASTAT are not allowed to log in as trusted users. CICS users must be using the CA-ACF2 MVS interface for CICS. Only CICS user IDs that log in through CA-ACF2 can log in as trusted users. </p>

	<p>Trusted login can be used with the following CRAM thread IODEV types: </p>		<p>Trusted login can be used with the following CRAM thread IODEV types: </p>
Line 823:		Line 823:
	<p class="code"> TITLE 'GENERATE AN ACF2 PARAMETER MODULE'		<p class="code"> TITLE 'GENERATE AN ACF2 PARAMETER MODULE'

	<i>NAME</i> ACF2GEN ~~RESOURCE~~=204, ACF2 resource type X		<i>NAME</i> ACF2GEN RESOURC=204, ACF2 resource type X
	LOGIN=(0,0), Login ensure position and bit X		LOGIN=(0,0), Login ensure position and bit X
	ACCOUNT=(0,0), Account position and length X		ACCOUNT=(0,0), Account position and length X
Line 847:		Line 847:

	<tr>		<tr>
	<td nowrap>~~RESOURCE~~</td>		<td nowrap>RESOURC</td>
	<td>Specifies the 3-character CA-ACF2 Generalized Resource Type code for this argument set. The Generalized Resource Rules for Model 204 privileges are defined and grouped by this code and stored in CA-ACF2. The code must match the Generalized Resource Type code described to CA-ACF2 in the ACFFDR statements for your site. The default is <code>204</code>. </td>		<td>Specifies the 3-character CA-ACF2 Generalized Resource Type code for this argument set. The Generalized Resource Rules for Model 204 privileges are defined and grouped by this code and stored in CA-ACF2. The code must match the Generalized Resource Type code described to CA-ACF2 in the ACFFDR statements for your site. The default is <code>204</code>. </td>
	</tr>		</tr>
Line 897:		Line 897:
	<td>This argument has only one valid value, <code>ACCOUNT</code>, which specifies that any account entered by the user during the login process that does not match the LIDREC default account value is validated by CAACF2.		<td>This argument has only one valid value, <code>ACCOUNT</code>, which specifies that any account entered by the user during the login process that does not match the LIDREC default account value is validated by CAACF2.
	<p>		<p>
	<code>~~VALIDAT~~=ACCOUNT</code> compares the account value entered by the user to the value in the user's Logonid.		<code>VALIDATE=ACCOUNT</code> compares the account value entered by the user to the value in the user's Logonid.
	If the values match, the user is allowed in to Model 204. If the values do not match, the account entered by the user is validated against the standard CA-ACF2 Resource type TAC (refer to the <var class="book">CA-ACF2 System Programmer’s Guide</var> for more information). </p>		If the values match, the user is allowed in to Model 204. If the values do not match, the account entered by the user is validated against the standard CA-ACF2 Resource type TAC (refer to the <var class="book">CA-ACF2 System Programmer’s Guide</var> for more information). </p>
	<p>		<p>
Line 1,029:		Line 1,029:

	===Assembling ACF2PARM===		===Assembling ACF2PARM===
			<p>
	<p>The JCL needed to assemble ACF2PARM is in the installation JCL library (as member ACF2GEN). Refer to [[#Preparing the ACF2PARM parameter module with ACF2GEN\|Preparing the ACF2PARM parameter module with ACF2GEN]] for more information on ACF2GEN.		The JCL needed to assemble ACF2PARM is in the installation JCL library (as member ACF2GEN). Refer to [[#Preparing the ACF2PARM parameter module with ACF2GEN\|Preparing the ACF2PARM parameter module with ACF2GEN]] for more information on ACF2GEN.
	</p>		</p>

Line 1,036:		Line 1,036:

	====Optionally linking ACF2PARM as a separate load module ====		====Optionally linking ACF2PARM as a separate load module ====
			<p>
	<p>If you link ACF2PARM as a separate load module, use the SECRLINK job in the JCL library. Modify the job according to the comments. </p>		If you link ACF2PARM as a separate load module, use the SECRLINK job in the JCL library. Modify the job according to the comments. </p>

	<p>If you link ACF2PARM with the Model 204 configuration, add the following line in SYSLIN for the link-edit steps for Online, BATCH204, IFAM1, and IFAM4: </p>		<p>If you link ACF2PARM with the Model 204 configuration, add the following line in SYSLIN for the link-edit steps for Online, BATCH204, IFAM1, and IFAM4: </p>
Line 1,044:		Line 1,044:

	===Link-editing Model 204===		===Link-editing Model 204===
			<p>
	<p>To link Model 204, make the following changes to Model 204 link-edit JCL and control statements (for the link-edit of the Online, BATCH204, IFAM1, and IFAM4 load modules) in order to include the interface modules supplied by Computer Associates, Inc. (CA) and used by the CA-ACF2 Interface. The actual data set names used for the CA-ACF2 modules depend on your site.		To link Model 204, make the following changes to Model 204 link-edit JCL and control statements (for the link-edit of the Online, BATCH204, IFAM1, and IFAM4 load modules) in order to include the interface modules supplied by Computer Associates, Inc. (CA) and used by the CA-ACF2 Interface. The actual data set names used for the CA-ACF2 modules depend on your site.
	An example of the JCL statement is:</p>		An example of the JCL statement is:</p>