IMS Control Region Initialization Requirements

Implementing Security for IMS › Define CA Top Secret to IMS › IMS Control Region Initialization Requirements

IMS Control Region Initialization Requirements

IMS Control Region Initialization Requirements The following IMS initialization parameters are used to control CA Top Secret in the IMS control region. These initialization parameters can be specified in the IMS procedure JCL or in the DFSPBxxx parameter block member in the IMS PROCLIB:

RCF=A|B|C|N|R|S|T|Y (IMS r9.1 and below)

RCF=A|C|N|S|T|Y (IMS r10 and above)

Controls whether CA Top Secret will be used for signon, transaction, and command authorization.

A: Enables CA Top Secret for signon, transactions, and commands. Combines options S, T, and C.
B: (IMS r9.1 and below) Enables CA Top Secret for signon, transactions, and commands (combines options S, T, and C), but the IMS signon verification security table (DFSISSOx) will not be loaded from the IMS MATRIX data set.
C: Enables CA Top Secret for commands from ETO terminals.
N: Specifies that CA Top Secret will not be used for signon, transaction, and command authorization.
R: (IMS r9.1 and below) Enables CA Top Secret for commands from static and dynamic (ETO) terminals (option S), but the IMS signon verification security table (DFSISSOx) will not be loaded from the IMS MATRIX data set.
S: Enables CA Top Secret for signon and for commands from static and dynamic (ETO) terminals.
T: Enables CA Top Secret for signon and transaction authorization.
Y: Enables CA Top Secret for signon and transaction authorization, and for commands from ETO terminals, but not for commands from static terminals. (Combines options T and C)

SGN=D|E|F|G|M|N|W|X|Y|Z (IMS r9.1 and below)

SGN=F|G|M|N|Y|Z (IMS r10 and above)

Controls whether signon verification is active and whether the IMS signon verification security table is loaded from IMS MATRIX data set.

D: (IMS r9.1 and below) Enables signon verification and the IMS signon verification security table (DFSISSOx) will not be loaded from the IMS MATRIX data set. The operator cannot override this option on the restart command during IMS initialization.
E: (IMS r9.1 and below) Enables signon verification, but the IMS signon verification security table (DFSISSOx) will not be loaded from the IMS MATRIX data set. A single user is allowed to sign on to multiple IMS terminals. The operator cannot override this option on the restart command during IMS initialization. (Combines options D and M)
F: Enables signon verification. The operator cannot override this option on the restart command during IMS initialization.
G: Enables signon verification and allows a single user to sign on to multiple IMS terminals This option cannot be overridden by the operator on the restart command during IMS initialization. (Combines options F and M).
M: Enables signon verification and allows a single user to sign on to multiple IMS terminals.
N: Signon verification is not enabled. For r9.1 and below the IMS signon verification security table (DFSISSOx) is not loaded from the IMS MATRIX data set. The operator can override this option on the restart command during IMS initialization.
W: (IMS r9.1 and below) Enables signon verification, but the IMS signon verification security table (DFSISSOx) will not be loaded from the IMS MATRIX data set. The operator can override this option on the restart command during IMS initialization.
X: (IMS r9.1 and below) Enables signon verification, but the IMS signon verification security table (DFSISSOx) will not be loaded from the IMS MATRIX data set. A single user can sign on to multiple IMS terminals. The operator can override this option on the restart command during IMS initialization. (Combines options W and M)
Y: Enables signon verification. For IMS r9.1 and below the IMS signon verification security table (DFSISSOx) is loaded from the IMS MATRIX data set. The operator can override this option on the restart command during IMS initialization.
Z: Enables signon verification and allows a single user to sign on to multiple IMS terminals. For r9.1 and below the IMS signon verification security table (DFSISSOx) is loaded from the IMS MATRIX data set. The operator can override this option on the restart command during IMS initialization. (Combines options Y and M).

Notes:
IMS multiple signon support (SGN=E|G|M|X|Z) applies only to static IMS terminals and is not supported for ETO terminals.
When IMS multiple signon is enabled (SGN=E|G|M|X|Z), single signon can be enforced through the CA Top Secret FACILITY option SIGN(S). When specified in this way, multiple attempts to sign on are audited by CA Top Secret and error messages are generated if a user tries to sign on multiple times.

TRN=E|F|N|X|Y (IMS r9.1 and below)

TRN=F|N||Y (IMS r10 and above)

Controls whether transaction security authorization is active and whether the IMS signon verification security table is loaded from IMS MATRIX data set.

E: (IMS r9.1 and below) Transaction authorization checking is enabled, but the IMS signon verification security table (DFSISSOx) will not be loaded from the IMS MATRIX data set. The operator cannot override this option on the restart command during IMS initialization.
F: Transaction authorization checking is enabled. The operator cannot override this option on the restart command during IMS initialization.
N: Transaction authorization checking is not enabled. The operator can override this option on the restart command during IMS initialization.
X: (IMS r9.1 and below) Transaction authorization checking is enabled, but the IMS signon verification security table (DFSISSOx) will not be loaded from the IMS MATRIX data set The operator can override this option on the restart command during IMS initialization.
Y: Transaction authorization checking is enabled. The operator can override this option on the restart command during IMS initialization.

AOIS=A|C|N|R|S

Controls security for type 2 AOI commands, that is, commands issued by applications programs using the ICMD DLI communications call.

A: Enables CA Top Secret security for type 2 AOI commands, and indicates that the optional IMS DFSCCMD0 command security user exit should also be called. (Combines options C and R)
C: Specifies that the optional IMS DFSCCMD0 command security user exit should be called for command authorization.
N: Specifies that no ICMD communications call can be issued by applications programs.
R: Specifies that CA Top Secret security will be used for type 2 AOI commands.
S: Specifies that no security will be used for type 2 AOI commands.

AOI1=A|C|N|R|S (IMS r9.1)

AOI1=A|C|N|R (IMS r10 and above)

Controls security for type 1 AOI commands (commands issued using the CMD DLI communications call).

A: Enables CA Top Secret for type 1 AOI commands, and indicates that the optional IMS DFSCCMD0 command security user exit should also be called. (Combines options C and R)
C: Specifies that the optional IMS DFSCCMD0 command security user exit should be called for command authorization.
N: Specifies that no CMD communications call can be issued by applications programs.
R: Specifies that CA Top Secret will be used for type 1 AOI commands.
S: (IMS r9.1 only) Specifies that IMS internal security is used for type 1 AOI commands.

Note: If AOI1=A, C, or R is specified, the AOI parameter must be specified in the TRANSACT macro in the IMS system definition for any transactions that issue the CMD DLI communications call. For information, the IBM manual IMS Installation Volume 2: System Definition and Tailoring.

ISIS=0|1|2 (IMS r8.1 and below)

ISIS=0|1|2|A|C|N|R (IMS r9.1)

ISIS=A|C|N|R (IMS r10 and above)

Controls AGN (application group name) security for IMS r9.1 and below, and controls RAS (resource access security) for IMS r9.1 and above. AGN and RAS security are mutually exclusive and cannot both be specified in IMS r9.1.

0: (IMS r9.1 and below)) No AGN security is performed. If this option is specified, CA Top Secret for PSBs and DBDs and the use of the TSS command and the Application Interface under IMS are disabled
1: (IMS r9.1 and below) Enables CA Top Secret for AGNs
2: (IMS r9.1 and below) CA Top Secret for AGNs is disabled, but the optional IMS DFSISIS0 user exit is called for AGN security.
A: (IMS r9.1 and above) Enables CA Top Secret RAS (resource access security) for transaction, PSB, and LTERM access by IMS dependent regions. The optional IMS DFSRAS00 resource access security user exit is also called. (combines options C and R)
C: Specifies that the optional IMS DFSRAS00 resource access security user exit should be called for authorization for transaction, PSB, and LTERM access by IMS dependent regions.
N: No RAS security is performed. If this option is specified, CA Top Secret for PSBs and DBDs and the use of the TSS command and the Application Interface under IMS are disabled
R: Enables CA Top Secret RAS (resource access security) for transaction, PSB, and LTERM access by IMS dependent regions.

Note: CA Top Secret IMS interface already provides security for PSB usage using the IMSPSBVL setting for the CA Top Secret IMS control option. For IMS r9.1 and above, if RAS PSB security has been enabled, you should specify NOIMSPSBVL for the IMS control option. Failure to do so will cause two validations to be done for each PSB, one for the RAS PSB control and one for the IMSPSBVL control.

APPCSE=C|F|N

Controls security for commands and transactions entering IMS from an APPC conversation.

C: Enables CA Top Secret for IMS commands and transactions from APPC.
F: Enables CA Top Secret for IMS commands and transactions from APPC. The security environment (ACEE) for the APPC user will be created in the dependent region when an APPC transaction is executed.
N: Disables CA Top Secret for IMS commands and transactions from APPC.

OTMASE=C|F|N

Controls security for commands and transactions entering IMS from an OTMA clients.

C: Enables CA Top Secret for IMS commands and transactions from OTMA.
F: Enables CA Top Secret for IMS commands and transactions from OTMA. The security environment (ACEE) for the OTMA user will be created in the dependent region when an OTMA transaction is executed.
N: Disables CA Top Secret for IMS commands and transactions from OTMA.

CMDMCS=B|C|N|R|Y

Controls security for IMS commands entered from an MCS or EMCS console using the command recognition character defined in the IMS system definition.

B: Enables CA Top Secret for IMS commands entered from the MCS or EMCS console using the command recognition character, and IMS will call the optional IMS DSFCCMD0 command security user exit. (Combines options C and R)
C: CA Top Secret is not called for IMS commands entered from the MCS or EMCS console using the command recognition character, but IMS will call the optional IMS DSFCCMD0 command security user exit.
N: IMS commands cannot be entered from the MCS or EMCS console using the command recognition character.
R: Enables CA Top Secret for IMS commands entered from the MCS or EMCS console using the command recognition character.
Y: IMS commands can be entered from an MCS or EMCS console using the command recognition character. No security authorization will be performed.

LOCKSEC=Y|N (IMS r9.1 and above)

Controls CA Top Secret for transactions, programs, LTERMs, and databases specified on the IMS LOCK and UNLOCK commands.

Y: Enables CA Top Secret for transactions, programs, LTERMs, and databases specified on the IMS LOCK and UNLOCK commands.
N: CA Top Secret will not be called for transactions, programs, LTERMs, and databases specified on the IMS LOCK and UNLOCK commands.

Note: The IMS LOCKSEC initialization parameter controls resource security for the IMS LOCK and UNLOCK commands. It has no effect on CA Top Secret locking with ACID LTIME, FACILITY LOCKTIME, or explicit user of the TSS LOCK command.

TCORACF=Y|N (IMS r9.1 and above)

Controls security processing for commands in TCO (time controlled operations) scripts.

Y: Enables CA Top Secret for IMS commands entered from a TCO script. IMS will also call the optional IMS DSFCCMD0 command security user exit.
N: CA Top Secret will not be called for IMS commands entered from a TCO script. IMS will call the optional IMS DSFCCMD0 command security user exit.

MSCSEC= (IMS r9.1 and above )

Controls security processing for transactions entering IMS from MSC network links

LRDIRECT: Enables CA Top Secret for MSC directed routing transactions.
LRNONDR: Enables CA Top Secret for MSC non‑directed routing transactions.
LRALL: Enables CA Top Secret for all MSC transactions, both directed routing transactions and non‑directed routing transactions.
LRNONE: Disables CA Top Secret for all MSC transactions.

Note: CA Top Secret IMS interface already provides security for MSC non‑directed routing transactions using the IMSMSC field in the IMS control region ACID. If the IMSMSC field is being used to control security for MSC non‑directed routing transactions, do not specify LRNONDR or LRALL for the MSCSEC parameter. Doing so will cause two validations to be done for each transaction, one for the IMSMSC control and one for the MSCSEC control.

RCFTCB=nn

This is a performance option. It specifies a number between 1 and 20 indicating how many tasks will be created in IMS to process CA Top Secret signons and signoffs.

RCVY=Y|N

This security option enables RACF password reverification during transaction and command security validation. It has no effect on CA Top Secret password reverification, which is supported as part of the normal CA Top Secret transaction and command security process.