z/OS Security › TCP/IP Security Features Used by CA Gen › IMS

IMS

For IMS the CA Gen IMS Connect message user exit CAGRITCP calls user exit CAGRITSC to obtain the SECOTMA flag that match the IMS/OTMA OTMASE parameter. This SECOTMA flag controls how the OTMA security prefix is populated as follows:

• If the OTMA security flag is N, we do not populate any of the fields in the OTMA security header prefix.
• If the OTMA Security Flag is F or C, we populate the user ID part of the OTMA security header prefix with the CFB security data from sent in the client request.
• The password is placed in the OTMA User Data Header.
• If a Group ID or a Token is supplied (using the CAGRITSC exit), we populate the relevant fields in the OTMA Security Header.

Since the CAGRITSC exit also gets visibility of the user ID and password that is sent by the client, a call to the ESM can be done in it and other security checks bypassed. Also, this exit is an ideal place to do lowercase to uppercase conversion of the security data that is required.