SAF Interface

Select the CA XCOM Data Transport SAF Interface by specifying SECURITY=SAF in the CA XCOM Data Transport Default Options Table, or specify SAF by overriding the SECURITY parameter on the CA XCOM Data Transport EXEC statement on the CA XCOM Data Transport server (XCOMXFER) JCL.

When using SECURITY=ACF2|TOPS|RACF, the CA XCOM Data Transport server runs under its own ACEE and the security checks are done using the specified external security package.

With the CA XCOM Data Transport SAF Interface , the transfer runs under one of the following ACEEs:

For an incoming (remotely initiated) transfer, the ACEE of the user ID provided in the transfer header
For an outgoing (locally initiated) transfer, the ACEE of the user ID that initiated the transfer

The ACEE is built using the IBM BPX1SEC callable service which invokes whichever external security package is in control of the CA XCOM Data Transport Server address space. This eliminates the need to give the CA XCOM Data Transport server READ/WRITE/UPDATE access to all data sets that are to be transferred using this server, as long as the user whose ACEE is used for a particular transfer has the proper accesses to the resources.

Because SECURITY=SAF is used only for the actual transfer process, it should not be used with the CA XCOM Data Transport XCOMPLEX Admin Server (XCOMXADM).

BPX1SEC Security Requirements

The use of the IBM BPX1SEC callable service has the following requirements:

The ACEE of the CA XCOM Data Transport Server must be defined to OMVS with superuser status (UID=0)
If the BPX.DAEMON resource in the FACILITY class is defined, then the ACEE of the CA XCOM Data Transport Server must have READ authority to BPX.DAEMON.

The following example show the CA Top Secret commands necessary to grant proper access.

Note: If you have SECURITY=ACF2 or SECURITY=RACF, see your CA ACF2 or IBM RACF documentation as required.

Access to BPX.DAEMON

To grant access to the BPX.SERVER

Issue the following CA Top Secret command:

TSS PER(xxxxxxxx) IBMFAC(BPX.DAEMON) ACC(READ)

xxxxxx: The ACEE of the CA XCOM Data Transport Server.