CA-Top Secret interface - Revision history

ELowell: /* Preparing a TOPSPARM parameter module with TOPSGEN */

2019-06-26T19:58:34Z

Preparing a TOPSPARM parameter module with TOPSGEN

← Older revision		Revision as of 19:58, 26 June 2019
Line 958:		Line 958:

	<tr><td>DEFACID</td>		<tr><td>DEFACID</td>
	<td>Defines the default ACID ~~if the user is~~ not ~~directly logged in through CA-Top Secret~~. ~~The additional line displayed indicates the current default ACID~~ in ~~use~~. For more information about this default, see [[#Defining the Model 204 default user ACID\|Defining the Model 204 default user ACID]]. </td></tr>		<td>Defines the default ACID to be used for users defined in CCASTAT but not defined to TopSecret. If this is a valid TopSecret ID then users defined in CCASTAT are allowed to log on. For more information about this default, see [[#Defining the Model 204 default user ACID\|Defining the Model 204 default user ACID]].
			<p>If DEFACID=JOBNAME, then the user ID associated with the submitted job is used as the DEFACID and CCASTAT logons are allowed.</p></td></tr>

	<tr><td>DEFPASS</td>		<tr><td>DEFPASS</td>

ELowell: /* Defining Model 204 to CA-Top Secret */

2019-06-26T19:36:21Z

Defining Model 204 to CA-Top Secret

← Older revision		Revision as of 19:36, 26 June 2019
Line 627:		Line 627:
	</li>		</li>

	<li>DEFACID(M204USR) defines the ACID to ~~be assigned to~~ users ~~that cannot be~~ defined~~. This entry is~~ not ~~normally used, but might be in the future, so this should correspond~~ to ~~the Model 204 default ACID that is defined in TOPSPARM~~.		<li>DEFACID(M204USR) defines the default userid or ACID used to log users on who are defined in CCASTAT but not defined to TopSecret.
	</li>		</li>
	</ul>		</ul>

JAL: /* AUTHCTL VIEW command */ add 7.7 info

2018-04-20T00:05:54Z

AUTHCTL VIEW command: add 7.7 info

Show changes

JAL: /* Preparing a TOPSPARM parameter module with TOPSGEN */ misc formatting

2018-04-19T21:32:26Z

Preparing a TOPSPARM parameter module with TOPSGEN: misc formatting

Show changes

JAL: misc formatting

2017-10-16T22:21:31Z

misc formatting

Show changes

JAL: misc formatting

2017-10-16T22:06:40Z

misc formatting

Show changes

JDamon: /* User 0 login */

2017-10-13T21:28:44Z

User 0 login

← Older revision		Revision as of 21:28, 13 October 2017
Line 478:		Line 478:
	<p>Model 204 always attempts to log in User 0 automatically and verifies that any user ID supplied matches the ACID of the owner of the address space. It is not necessary to supply a user ID on the LOGIN command for User 0, because Model 204 determines the owner ACID and supplies it automatically. </p>		<p>Model 204 always attempts to log in User 0 automatically and verifies that any user ID supplied matches the ACID of the owner of the address space. It is not necessary to supply a user ID on the LOGIN command for User 0, because Model 204 determines the owner ACID and supplies it automatically. </p>

	<p>If a user ID is supplied on the LOGIN command and the user ID does not exist on CCASTAT, it must match the ACID of the owner of the address space or the login fails. If the user ID is found on CCASTAT and CCASTAT users are allowed to log in, all further authorization checking is based on a default ACID specified by the installation ~~(must be APF-authorized)~~. </p>		<p>If a user ID is supplied on the LOGIN command and the user ID does not exist on CCASTAT, it must match the ACID of the owner of the address space or the login fails. If the user ID is found on CCASTAT and CCASTAT users are allowed to log in, all further authorization checking is based on a default ACID specified by the installation. </p>

	<p>Technical Support recommends that no user ID be specified in the login for User 0, so jobs can be easily migrated from test to production without having to change the login command. </p>		<p>Technical Support recommends that no user ID be specified in the login for User 0, so jobs can be easily migrated from test to production without having to change the login command. </p>

JDamon: /* Running the CA-Top Secret Interface with Model 204 */

2017-10-13T21:28:14Z

Running the CA-Top Secret Interface with Model 204

← Older revision		Revision as of 21:28, 13 October 2017
Line 226:		Line 226:
	==Running the CA-Top Secret Interface with Model 204==		==Running the CA-Top Secret Interface with Model 204==

	<p>When running either as an Online or in batch mode, Model 204 checks CA-Top Secret for the system resources a user can access. Model 204 manages the authorization process, because, in multiuser mode, only Model 204 can identify the user requesting a resource. Model 204 asks CA-Top Secret to validate those requests and responds to a user who has been denied a request for a resource. </p>		<p>When running either as an Online or in batch mode, Model 204 checks CA-Top Secret for the system resources a user can access. Model 204 manages the authorization process, because, in multiuser mode, only Model 204 can identify the user requesting a resource. Model 204 asks CA-Top Secret to validate those requests and responds to a user who has been denied a request for a resource. Model 204 must run from an APF-authorized load library to use the Top Secret interface.</p>

	<p>Model 204 interfaces with CA-Top Secret in the following distinct areas: </p>		<p>Model 204 interfaces with CA-Top Secret in the following distinct areas: </p>

JDamon: /* Preparing a TOPSPARM parameter module with TOPSGEN */

2017-10-13T21:23:24Z

Preparing a TOPSPARM parameter module with TOPSGEN

← Older revision		Revision as of 21:23, 13 October 2017
Line 925:		Line 925:
	===Preparing a TOPSPARM parameter module with TOPSGEN===		===Preparing a TOPSPARM parameter module with TOPSGEN===

	<p>The TOPSGEN macro of the TOPSPARM module allows the system manager, TSS administrator, or system programmer to generate a set of arguments that govern login and other security processes. There can be multiple argument sets in a TOPSPARM module. The TOPSPARM parameter module can be linked with Model 204 or dynamically loaded when the CA-Top Secret Interface is initialized. Dynamic loading allows for more flexibility in making TOPSGEN changes, but ~~you~~ must ~~remember that it is~~ APF-authorized. </p>		<p>The TOPSGEN macro of the TOPSPARM module allows the system manager, TSS administrator, or system programmer to generate a set of arguments that govern login and other security processes. There can be multiple argument sets in a TOPSPARM module. The TOPSPARM parameter module can be linked with Model 204 or dynamically loaded when the CA-Top Secret Interface is initialized. Dynamic loading allows for more flexibility in making TOPSGEN changes, but TOPSPARM must always reside in APF-authorized load library. </p>

	<p>The following is a sample TOPSGEN macro: </p>		<p>The following is a sample TOPSGEN macro: </p>

JDamon: Clarification on APF.

2017-10-13T21:18:40Z

Clarification on APF.

← Older revision		Revision as of 21:18, 13 October 2017
Line 843:		Line 843:
	<p>For security purposes, the system manager cannot modify this ACID and password. If different data is required or if the installation would like to change defaults, the parameter module TOPSPARM must be modified by the TSS administrator or systems programmer or both. </p>		<p>For security purposes, the system manager cannot modify this ACID and password. If different data is required or if the installation would like to change defaults, the parameter module TOPSPARM must be modified by the TSS administrator or systems programmer or both. </p>

	<p>TOPSPARM allows you to override the default ACID and password. This module can be made available during the Model 204 link-edit. Otherwise, Model 204 loads it when the interface is initialized. If the module is loaded, it must be made available in the STEPLIB containing Model 204 or in a system load library. (Be sure ~~it is~~ APF-authorized so that it does not cause the Model 204 ~~LOAD~~ module to lose its APF authorization.) The TOPSPARM module is generated with the TOPSGEN macro. </p>		<p>TOPSPARM allows you to override the default ACID and password. This module can be made available during the Model 204 link-edit. Otherwise, Model 204 loads it when the interface is initialized. If the module is loaded, it must be made available in the STEPLIB containing Model 204 or in a system load library. Be sure TOPSPARM resides in an APF-authorized loadlib so that it does not cause the Model 204 load module to lose its APF authorization. The TOPSPARM module is generated with the TOPSGEN macro. </p>

	===Terminal security considerations===		===Terminal security considerations===