Security › Security Overview › Server Security Processing

Server Security Processing

Regardless of how the client-side security data is provided and later associated with a cooperative flow, security data serves two primary objectives, as follows:

• Security data is used to authorize the execution of a DPS application. Server-side security processing uses the associated security data to grant execution access to those users it deems authorized.
• In certain execution environments, the security data is used to establish a user context under which the target DPS execute. In these execution environments, the CA Gen USER_ID system attribute is populated with the value of the user ID under which the server execute.

In other execution environments accessing the USER_ID is not allowed by the environment and would therefore use the USER_ID system attribute unavailable (EJBs and .NET Servers). More specifically, accessing the USER ID is not feasible; therefore, the TIRUSRID user exit does not exist in these server execution environments.

In those environments where the user ID context is accessible, the TIRUSRID user exit is invoked to obtain the user ID from the execution environment. This user exit is called soon after the Server Manager begins executing and before control is passed to the target DPS. The value of the USER_ID system attribute is populated as a result of executing TIRUSRID user exit.

Granting the execution access is security processing that can occur in more than one location along the execution path to a DPS. There can be up to as many as five layers of security processing that is incorporated when executing a DPS. These layers include the following security:

• Layer 1: Transaction Security
• Layer 2: Server Manager Security
• Layer 3: Application Security
• Layer 4: Procedure Step Security
• Layer 5: Function Security

Each layer refines the granularity of what is being protected. The user that is associated with a cooperative request must be granted access at each layer that is implemented for processing to proceed. Depending on the execution environment, not all layers of security within a DPS is implemented.