Previous Topic: Extending Security Using the Application InterfaceNext Topic: Application Interface Checks


Application Interface Components

To use the Application Interface, the following components are required:

TSSAI

An application interface program distributed and residing in the CA Top Secret load library. TSSAI does NOT check the CICS facility bypass lists.

Request Parameter List

CA provides mapping through the Request Parameter List. In AAKOSRC0, support for each of the languages are in the following members:

The application program passes a parameter list to the program TSSAI through an appropriate Dynamic Call Mechanism in the language being used.

To use the CA Top Secret Application Interface, define a parameter list declaring all of the Request Record fields. The Request Record contains:

The application program defines a parameter list declaring all the Request fields. Depending on the type of checking that is to be performed, all or some of the fields are required.

Application Program Code Logic

To invoke the Application Interface, the program code (written in COBOL, PL/1, or Assembler) must follow the logic outlined below.

Request Record Field Characteristics

This table shows the Request Record fields and their characteristics:

Field

Dec Offset

Hex Offset

Length

Content

TSSHEAD

+0

+0

8

Specifies the release level format for a TSSAI request. Acceptable values for this field are:

TCPLV5L1—Uses the parameter format for TSS 5.1 and above

TCPLV4L4—Uses the parameter format for TSS 4.4

TCPLV4L3—Uses the parameter format for TSS 4.3

TCPLV4L2—Uses the parameter format for TSS 4.2

Please consult documentation for earlier formats of CA Top Secret. If the value of TSSHEAD does not match any supported format, TSSAI assumes the parameter format for r4.1.

TSSCLASS

+8

+8

8

For a standard resource check, specifies the resource class

(RDT RESCLASS). Special values which can be used in this field are:

DUFXTR—Extract INSTDATA

DUFUPD—Update INSTDATA

FLDXTR—Extract user-defined FDT field

FLDUPD—Update user-defined FDT field

FACLIST—Extract all facilities

RESLIST—Extract all permissions for a resource class

ACIDNAME—Details of current signon

ACIDFULL—NAME attribute of current signon

DEPTNAME—DEPT ACID (if any) associated with current signon

DEPTFULL—NAME attribute for associated DEPT ACID

DIVNAME—DIV ACID (if any) associated with current signon

DIVFULL—NAME attribute for associated DIV ACID

ZONENAME—ZONE ACID (if any) associated with current signon

ZONEFULL—NAME attribute for associated ZONE ACID

TSSRNAME

+16

+10

44

For a standard resource check, specifies the name of the resource within TSSCLASS. For special values of TSSCLASS TSSRNAME will represent:

DUFXTR/DUFUPD—an ACID other than the current signed on acid to be extracted or updated

FLDUPD | FLDXTR—the FDT FDTNAME of the field to be extracted or updated

FACLIST—(unused)

RESLIST—the RDT RESCLASS for which permissions are to be listed

TSSPPGM

+60

+3C

8

For a standard resource check, specifies a program name through which the resource is being accessed. Of the special values of TSSCLASS, only FLDXTR and FLDUPD make use of this field:

FLDUPD|FLDXTR—the FDT SEGMENT associated with this FDTNAME

TSSACC

+68

+44

8

For a standard resource class whose RDT definition includes explicit access levels, this field must correspond to one of the defined access levels (left justified and space filled); however, if specified with hex-zeroes, the RDT DEFACC value will be substituted.

This field is ignored for resources whose associated RDT entry has no defined access levels. It is ignored by all special values of TSSCLASS.

TSSCACEE

+84

+54

4

For all values of TSSCLASS except DUFXTR and DUFUPD, this field represents the address of an ACEE for whom the resource or special check is being performed. (This address would have to be supplied programmatically using an appropriate RACROUTE REQUEST=VERIFY macro.) In order for such requests to be valid, the current signed on user would have to be cross-authorized to the requested ACID.

By convention, if TSSCACEE is all blank (x'40'), the check to be requested will be presumed for the current signed on ACID.

In CICS, TSSCAI will only honor TSSCACEE when OPTIONS(64) has been selected at TSS initialization. In IDMS, TSSMAI will never honor TSSCACEE.

TSSVOL

+88

+58

6

VOLSER used for data set requests only

TSSLOG

+94

+5E

1

Y logs the event and does violation logging

N, no logging is done; use when violation VTHRESH processing is not required

TSSLRTN

+98

+62

4

Binary length of TSSRTN area. This field must be set and requires a minimum of 1024 for FLDUPD, FLDXTR, FACLIST and RESLIST, and 256 for all other calls.

TSSRTN

+114

+72

256-32K

Normally unused. For DUFUPD and FLDUPD, please consult later sections.

CA Top Secret Return Data Fields

After the application program's request is processed, CA Top Secret returns information to the program in specific fields. The return fields for installation data are:

Field

Dec Offset

Hex Offset

Length

Returned Information

TSSRC

+76

+4C

2

Return code

TSSSTAT

+78

+4E

2

Status code

TSSCRC

+80

+50

2

Character return code.

TSSCSTAT

+82

+52

2

Character status code

TSSDRC

+97

+61

1

Hex DRC returned from DUFXTR/DUFUPD

TSSRTN

+114

+72

256‑32K

This field is used for multiple purposes with special values of TSSCLASS

ACID Hierarchy Return Fields

The return fields for ACID hierarchy data are:

Field

Dec Offset

Hex Offset

Length

Returned Information

TSSACIDA

+114

+72

8

ACID name

TSSFAC

+122

+7A

8

Facility name

TSSMODE

+130

+82

8

Current MODE of user

TSSTYPE

+138

+8A

8

ACID type

TSSTERM

+146

+92

8

Terminal name

TSSSYS

+154

+9A

8

System name (SMF ID)

TSSACIDF

+162

+A2

32

Full 32‑character ACID name

TSSDEPTA

+194

+C2

8

Department ACID name

TSSDEPTF

+202

+CA

32

Full 32-character name

TSSDIVA

+234

+EA

8

Division ACID name

TSSDIVF

+242

+F2

32

Full 32‑character name of Division ACID

TSSZONEA

+274

+112

8

Zone ACID name

TSSZONEF

+282

+11A

32

Full 32‑character name of ZONE ACID

Return Codes

The return codes are:

Return Code

Field

TSSCRC

Meaning

00

TSSROK

OK

Resource is defined/access is granted.

04

TSSRND

ND

Resource is not defined to CA Top Secret. If performing a facility check, a return code of 4 means that the facility to be checked is not defined to CA Top Secret.

08

TSSRNA

NA

Resource is defined/access is not authorized.

12

TSSRIPL

IP

Parameter list is invalid.

16

TSSRENV

EN

Environment error; CA Top Secret is not properly installed within the environment.

20

TSSRINAC

IA

CA Top Secret is not active.

24

TSSRSX

XS

Return data exceeded size of TSSRTN field.

28

TSSRSEGT

SG

Incorrect FDT segment name.

32

TSSRFDTE

FD

Incorrect FDT field name.

36

TSSRUSRF

US

Field specified is not a user field.

40

TSSRRGF

GF

Storage is not available to complete request.

Status Return Codes

The status return codes are:

Return Code

Field

TSSCSTAT

Meaning

00

TSSSDEF

DE

User is defined

04

TSSSUND

UN

User is undefined

08

TSSSNSO

NS

User is not signed on

12

TSSSIDT

ID

Invalid device type; not a standard IBM 3270 device type