z/OS Security Server Support › Using CA Top Secret as a Repository

Using CA Top Secret as a Repository

With z/OS O/E DCE security server, CA Top Secret acts as a repository for information needed to support the DCE authentication process. CA Top Secret holds DCE‑specific userid information and encryption keys. A ‘DCE segment’ can be defined for any userid. The DCE userid segment allows six DCE‑specific fields to be maintained for any userid. For example, one field named DCEKEY identifies each user’s DCE password. During authentication, the DCE security server retrieves this and other information from CA Top Secret following formal SAF interfaces. This information is then used separately to authenticate and authorize the DCE security server request.

CA Top Secret provides support for:

• The DCE segment for any userid
• The KEYSMSTR resource class used to hold keys for DCE password encryption
• The DCEUUIDS resclass used to track the correspondence between z/OS userids and DCE UIDs
• Four new callable services used to exchange information between the ESM and the DCE security server