Command Propagation Facility

Command Propagation Facility

This section contains the following topics:

About CPF

CPF-Related Control Options

CPF related MODIFY commands

CA Top Secret Command Keywords Used With CPF

CPF Recovery File

CPF Journal Files

Recovery and Accountability

About CPF

The Command Propagation Facility (CPF) lets sites administer multiple Security Files across VTAM‑networked systems by propagating TSS commands, as well as user‑initiated changes (such as updated passwords, permissions, maintenance, and suspensions) to all or selected nodes within that network. This process is referred to as distributed security processing because it allows the security administrator to distribute any change in a user’s authorization rights and restrictions to any node to which that user is defined.

The Command Propagation Facility provides the security environment with:

• Routing of security administration to all or selected nodes within the z/VM, VSE, and z/OS security network.
• Optional synchronous or asynchronous remote command execution.
• TSS command execution with most CA Top Secret commands— except MODIFY, LOCK, UNLOCK, HELP, and WHOAMI.
• Automatic update of passwords on all connected systems if changed by the user during logon.
• Propagation of user‑initiated suspensions for exceeding password and violation limits.
• Optional Journal Files to log commands transmitted to, and responses received from, remote nodes.
• Collecting asynchronous commands in an optional Recovery File so that they can be retransmitted in case of network outage.

Communication Components

To perform distributed security processing, CA Top Secret relies on CAICCI (Common Communication Interface), a component of CA-CIS. These components are CAIENF (Event Notification Facility) and CAICCI (Common Communication Interface).

CAICCI is a common communications facility that enables CA Top Secret secured nodes to communicate with one another. It provides the VTAM facilities needed to transmit and receive TSS commands.

Note: The word node, when used in this chapter, refers to the unique identifier (SYSID) that is assigned to that node when it is defined using CAICCI. A node is not the same as the VTAM APPLID, although you can use the same names. See the CA Common Services for VM documentation set for more information about defining nodes.