Establishing Signon Processing › Enabling External Security › CA Ideal Specifications

CA Ideal Specifications

You need to:

• Establish a link between the security ID and a CA Ideal user definition using one of the following methods.
• CA Ideal user name can match security-id. If this is not already true, you can modify existing user definitions by changing long names to match security-id names using DDUPDATE. However, it does require that you delete all test and history PERSON (USERS) occurrences first.

  To change the actual person names, you can simply run the following transactions in a single DDUPDATE batch job. Use a set of these transactions for each person name you want to change. Given a table of existing and new names, you can easily write a program to generate the transactions.

  	-UPD PERSON,old-name(PROD,,ovrd)
  	1000 NEWNAME,new-name
  	-END
  

  This method also modifies the DD user signon definition, but not the DQ user in entirety.

• If CA Ideal users are already defined and the security-id does not match the current user-id, add a dictionary alias to the person equal to the security-id. You can easily add aliases in a single batch job executing DDUPDATE. You can update the prod version occurrences.
• Use the DFLTUSR option in SC00TRAN on a transaction basis or in IDOPTS as an environment option. If you specify a default user for the transaction, it takes precedence over a default user specified in IDOPTS. This is only a viable alternative if the CA Ideal user definition used to signon does not need to be distinguishable in CA Ideal.
• Reassemble a separate copy of IDOPTS for each region where you want a different SECPRFX or DFLTUSR. Set UIDCHK=NO.
• The CA Ideal SIGNON statement no longer determines the identity of a batch user since the user ID is passed to the external security package in the JCL. Each security product can function differently, depending on the security inheritance mechanisms in place. Security inheritance becomes an issue when batch jobs are submitted from online.
• Reassemble SC00OPTS with parameter SECRTY=YES. For details on maintaining SC00OPTS, see the CA IPC Implementation Guide.
• If you want unique signons, implement using the security product where possible. It is also possible to establish this functionality in CA Ideal by issuing the CA IPC SCF command SET COMMAND SITE OPTIONS and specifying “Check duplicate user:” as Y. This allows each security user a single session in the CA Ideal region.
• To suppress compile messages, issue the CA IPC SCF command SET COMMAND SITE OPTIONS and specify “Asynchronous messages:” as N (None).
• To suppress network print messages, issue the CA IPC PSS command SET OUTPUT SITE OPTIONS and specify “Post successful message:” as N (No).