z/OS Security › TCP/IP Security › CICS › Surrogate User Checking › PLT Post-Initialization Processing

PLT Post-Initialization Processing

When a program list table is specified on a PLTPI system initialization parameter, CICS checks that the region user ID is authorized as a surrogate user of the user ID specified in the PLTPIUSR system initialization parameter. The PLTPIUSR parameter specifies the user ID that CICS is to use for PLT programs that run during the CICS initialization. All PLT programs that are run under the authority of the specified user ID, which must be authorized to all the resources referenced by the programs.

The PLTPISEC parameter defines the scope of PLT security checking. This specifies whether command security checks and resource security checks are to apply to PLTPI programs.

If you do not specify the PLTPIUSR parameter, CICS runs PLTPI programs under the authority of the CICS region user ID, the DFLTUSER, in which case CICS does not perform a surrogate user check. However, the CICS region user ID must then be authorized to all the resources referenced by the PLT programs. Furthermore, the CICS region user ID is associated with any transactions started by PLT programs, and therefore must be authorized to run such transactions.