Sign-on

CA Endevor/DB Sign-on is a two phase process. Phase one establishes the userid, while phase two establishes the CCID(s) and Security Class options under which the user will be operating.

Phase 1

CA Endevor/DB performs two types of Phase 1 Sign-on:

Sign-on Type	Description
Explicit	Performed as a result of an CA Endevor/DB Sign-on screen or a SIGNON command. An CA Endevor/DB Sign-on element is built with the userid keyed into the screen (if any) or the CA IDMS/DC userid (if any). If Auto-User is in effect, the userid will be added to the CCDB automatically. If the global options require a password or a userid, it will be requested by the system if omitted.
Implicit	Performed internally by the Change Monitor when it first encounters an attempt to update an entity in a Dictionary or CCDB. If no prior CA Endevor/DB Sign-on element exists for the user, the system will attempt an Implicit Sign-on. The userid in the CA IDMS/DC sign-on element will be used to obtain the CA Endevor/DB user definition. If the global options require a userid, and none can be obtained from a sign-on element, the attempted Dictionary update will be disallowed, and the user will be requested to perform an Explicit Sign-on. If Auto-User is in effect, the userid will be automatically added to the CCDB. When running CA IDMS compilers in CA Endevor/DB Batch mode, an Implicit Signon occurs if the Batch compiler is not run under NDVRBOOK, or if no userid was used in the SIGNON statement. The Implicit Signon will attempt to acquire a userid associated with the batch job. If no userid is available, the Implicit Signon will be for an unspecified userid. If the global options require a userid, the attempted dictionary update will be disallowed.

Sign-on Type

Description

Explicit

Performed as a result of an CA Endevor/DB Sign-on screen or a SIGNON command. An CA Endevor/DB Sign-on element is built with the userid keyed into the screen (if any) or the

CA IDMS/DC userid (if any). If Auto-User is in effect, the userid will be added to the CCDB automatically. If the global options require a password or a userid, it will be requested by the system if omitted.

Implicit

Performed internally by the Change Monitor when it first encounters an attempt to update an entity in a Dictionary or CCDB. If no prior CA Endevor/DB Sign-on element exists for the user, the system will attempt an Implicit Sign-on. The userid in the CA IDMS/DC sign-on element will be used to obtain the CA Endevor/DB user definition. If the global options require a userid, and none can be obtained from a sign-on element, the attempted Dictionary update will be disallowed, and the user will be requested to perform an Explicit Sign-on. If Auto-User is in effect, the userid will be automatically added to the CCDB.

When running CA IDMS compilers in CA Endevor/DB Batch mode, an Implicit Signon occurs if the Batch compiler is not run under NDVRBOOK, or if no userid was used in the SIGNON statement. The Implicit Signon will attempt to acquire a userid associated with the batch job. If no userid is available, the Implicit Signon will be for an unspecified userid. If the global options require a userid, the attempted dictionary update will be disallowed.

Phase 2: Once phase one of SIGNON is complete, phase two processing begins. The USER descriptor for the userid determined in phase one is fetched from the CCDB and the security class named therein is fetched. If no userid was determined, the DEFAULT SECURITY CLASS named in the DICTIONARY descriptor is fetched. In either case, the dictionary security class is also fetched, and the two sets of security flags are merged. At this point, CA Endevor/DB SIGNON processing checks the merged DE-CCID flag to determine if DERIVED CCID mode is in effect.

If DERIVED CCID mode is in effect (DE-CCID = Y), processing is as follows:

The CA Endevor/DB and CA IDMS/DC userids are compared. If SYNCH = N and the userids are different, the session is terminated.
The USER descriptor is checked. If it is LOCKED, the session is terminated.
The DICTIONARY descriptor is checked. If it is LOCKED, the session is terminated.
If there is not an existing USER descriptor for the user in the CCDB and AUTO-US = Y, CA Endevor/DB creates a USER descriptor with the security class set to the default security class and the password set to blanks.
If the userid is not specified and NO-USER = N, the session is terminated.
If the password is not specified and NO-PASS = N, the session is terminated.
If all the above checks are passed, the session is started in "DERIVED CCID" mode.

If DERIVED CCID mode is not in effect (DE-CCID = N), processing is as follows:

The CA Endevor/DB and CA IDMS/DC userids are compared. If SYNCH = N and the userids are different, the session is terminated.
The USER descriptor is checked. If it is LOCKED, the session is terminated.
The DICTIONARY descriptor is checked. If it is LOCKED, the session is terminated.
If a userid is specified and a USER descriptor exists in the CCDB, and if CCIDs were specified in the SIGNON, the CCID list in the USER descriptor is replaced. If no CCIDs were specified in the signon, the CCID list in the USER descriptor is picked up and processing proceeds as if those CCIDs had been specified.
For each CCID specified in the signon, the CCID descriptor is fetched. If the CCID is locked, the session is terminated. If the CCID is PRIVATE and the user is not preauthorized, the session is terminated. The security class named in the CCID descriptor is merged with the dictionary and user security classes.
If there is not an existing USER descriptor for the user in the CCDB and AUTO-US = Y, CA Endevor/DB creates a USER descriptor with the security class set to the default security class and the password set to blanks.
If the userid is not specified and NO-USER = N, the session is terminated.
If the password is not specified and NO-PASS = N, the session is terminated.
If no CCIDs were specified in the signon or existing USER descriptor and NO-CCID = N, the session is terminated.
If all above checks are passed, the session is started in "Normal" mode.

Once the user session is started, each change made to a dictionary or CCDB entity is subject to security checking and logging.

The options in the Dictionary level Security Class apply to all users, including the security administrator. Be very careful when modifying the Security Class associated with the Dictionary. The options in the CCID Security Class apply to all users who are working with that CCID. The User Security Class options apply to the individual user. Security Class restrictions at the Dictionary level cannot be overridden. When no userid or CCID is required, or when a user is initially added with Auto-User, a default Security Class is assigned by CA Endevor/DB to cover the session. The CCDB administrator specifies the default mask in the CCDB Dictionary definition.