How to Configure CA CSM PassTickets for CA Chorus

How to Configure CA CSM PassTickets for CA Chorus

CA Chorus uses PassTicket security to let users launch CA CSM from the Quick Links module without requiring an additional user login. All systems using PassTickets must have identical application names and session keys for all nodes on the network.

This scenario shows how a security administrator and system administrator configure PassTickets to let users use CA CSM without requiring an additional user login.

Important! The procedures in this scenario assume that you have run the ETJI095x security job. If you have not done so, complete that step first.

A PassTicket is a temporary encoded and encrypted substitute for the user password that can be used to access a specific application. The PassTicket must be used within a few minutes of the time it is generated. Using PassTickets enables the z/OS components and products to authenticate a user ID without sending z/OS passwords through the network. Instead, the user is authenticated after they first log in with a valid z/OS user ID and password. The following process occurs when the user selects a function that accesses a z/OS component:

• The CA Chorus web service calls the z/OS security product to generate a PassTicket for access authorization.
• The PassTicket is sent with the user request to the component, possibly on a different z/OS system.
• The component calls the z/OS security product to authenticate the user using the PassTicket as a password substitute before processing the request.

Note: Examples are provided for using CA ACF2, CA Top Secret, and IBM RACF to configure PassTickets to connect to CA CSM. These examples are provided as a guideline. For detailed information about using CA ACF2 commands, see the CA ACF2 Administration Guide. For detailed information about using CA Top Secret, see the CA Top Secret Command Functions Guide. For detailed information about using IBM RACF, see the IBM documentation.

To launch and use CA CSM from CA Chorus, complete the following tasks:

1. Configure your security system to use PassTickets. Choose one of the following options:
   • Use CA ACF2 to Configure PassTickets for Connecting to CA CSM from CA Chorus
   • Use CA Top Secret to Configure PassTickets for Connecting to CA CSM from CA Chorus
   • Use IBM RACF to Configure PassTickets for Connecting to CA CSM from CA Chorus
2. Update the CA CSM startup parameters.

Important! Verify that you use the same CA CSM applid that is used in CA Chorus.