Implementing Security for IMS › Resource Security for the IMS /LOCK and /UNLOCK Commands (IMS r9.1 and above) › Transactions on the IMS /LOCK and /UNLOCK Commands

Transactions on the IMS /LOCK and /UNLOCK Commands

If LOCK resource security is enabled, when a transaction is specified on a LOCK or UNLOCK command, IMS performs a security validation to see if the user is allowed to LOCK or UNLOCK the transaction.

IMS uses a SAF call to invoke CA Top Secret transaction security. The resource class for these transaction security calls is formed from the prefix "T" and the value established for the RCLASS parameter (which defaults to "IMS").

Notes:

• This is the same resource class that IMS uses for normal transaction validation
• The OPTIONS(27) control option can be turned on in order for the IMS SAF based TIMS resource class checks to be translated to LCF and OTRAN as needed (rather than using TIMS)

CA Top Secret provides a system-supplied resource class TIMS.

Rather than use RCLASS to distinguish security permissions for different regions, CA Top Secret encourages the administrator to make use of separate facilities for distinguished regions and to distinguish region-specific permissions by FACILITY.

If the administrator chooses to use a non-default RCLASS value, the administrator will be responsible for the following:

• Creating an RDT entry for the resulting transaction resource class, concatenating "T" with the RCLASS value. Attributes of the new class should be identical with TIMS.
• Informing support of the non-standard usage if problems are encountered.

The following instructions assume the use of the TIMS facility for transaction security. The administrator should substitute their non‑standard transaction resource class, if one is in use.

TIMS is a general resource that can be added to establish ownership:

TSS ADDTO(acid) TIMS(transaction)

To allow the user to LOCK or UNLOCK the transaction, enter:

TSS PERMIT(acid) TIMS(transaction)
                 FACILITY(IMSPROD)

TSS PERMIT(acid) TIMS(transaction)

The first permission allows the user to LOCK and UNLOCK the transaction only in regions using the IMSPROD facility. The second permission allows the user to LOCK and UNLOCK the transaction unrestricted by facility.

GIMS Resource Class

The GIMS resource class documented in the IMS product documentation for transaction grouping has no meaning in CA Top Secret. You can use profiles for transaction grouping, or permit individual transactions in the TIMS resource class.