SCS Address Space Administration › SCS Address Space Security Setup › Pass Tickets › CA Top Secret for z/OS PassTicket Examples › Example: Configure PassTickets for CA CSM Application Server

Example: Configure PassTickets for CA CSM Application Server

You can use CA Top Secret for z/OS to configure PassTickets on the system where the CA CSM application server is executing.

Follow these steps:

1. Update the resource descriptor table (RDT) to define the PTKTDATA class (which is not a predefined class):

   TSS ADDTO(RDT) RESCLASS(PTKTDATA) RESCODE(n) ACLIST(ALL,READ,UPDATE) MAXLEN(37)
   

   Note: Include RESCODE(n) in the range of 101 to 13F to make PTKTDATA a prefixed resource class.

2. Assign ownership to a department for the PassTicket session key (SESSKEY) resource:

   TSS ADDTO(department) PTKTDATA(IRRPTAUTH)
   

   department

   Specifies a preexisting department. The ownership of the application is defined to this department. This ownership lets the department administrator (or higher) define permissions for PassTicket generation and validation.

3. Define the CA CSM application server PassTicket session key:

   TSS ADDTO(NDT) PSTKAPPL(MSMCAPPL) SESSKEY(0123456789ABCDEF)
   

   MSMCAPPL

   Defines the session key for the SCS address space ID used during CA CSM Configuration processing. This name may have been overridden when you installed CA CSM, so it should reflect the real application name.

   Note: This example demonstrates a complete session key value of 16 hex digits (creating an 8-byte or 64-bit key). Change your key so that it consists of 16 random hex digits, and is different from the values in this example. Each application key must be the same on all systems in the configuration, and the values must be kept secret and secured.

4. Permit access to the CA CSM application server PassTicket session key value for the Started Task User for the CA CSM application server:

   TSS PERMIT(stc-userid) PTKTDATA(IRRPTAUTH.MSMCAPPL.) ACCESS(READ,UPDATE) 
   

   stc-userid

   Specifies the ACID that you defined the access requirements for user ID associated with the CA CSM application server.