/SECURE
Format

>>-+-/SECURE-+----APPC--+-CHECK---+----------------------------->
'-/SEC----' +-FULL----+
+-NONE----+
'-PROFILE-'
>--+---------------------------------------------+-------------><
'-OTMA--+-CHECK-----------------------------+-'
+-FULL------------------------------+
+-NONE------------------------------+
+-PROFILE---------------------------+
'-REFRESH--+----------------------+-'
'-TMEMBER--tmembername-'
Environments and Keywords
Table 148 lists the environments
(DB/DC, DBCTL, and DCCTL) from which the command and keywords can
be issued.
Table 148. Valid Environments for the /SECURE Command and Keywords
Command
/ Keywords |
DB/DC |
DBCTL |
DCCTL |
/SECURE |
X |
|
X |
APPC |
X |
|
X |
OTMA |
X |
|
X |
Usage
The /SECURE command is used to control the RACF security level. It is
used for administrative control of the IMS environment and as an
emergency operations control command to throttle RACF activity without
requiring an IMS shutdown.
- APPC
-
When used with the CHECK, FULL, NONE, or PROFILE
parameters. APPC controls the RACF security level for input from
LU 6.2 devices. The /DISPLAY APPC command can be used to show the security level that is currently
in effect. At IMS startup, the security default is FULL.
- CHECK
- Causes existing RACF calls to be made. IMS commands are checked
using the RACF resource class of CIMS. IMS transactions are checked
using TIMS. Disables MVS System Authorization Facility security
for IMS allocate PSBs (APSBs).
- FULL
- Causes the same processing as the CHECK parameter but uses
additional RACF calls to create the security environment for dependent
regions and enables MVS System Authorization Facility security for
IMS APSBs for all CPI Communications driven application programs.
- NONE
- Does not call RACF within IMS for security verification. RACF
security verification in APPC/MVS is not affected. Disables MVS System
Authorization Facility security for IMS APSBs.
- PROFILE
- Causes the values in the TP profile for each transaction to
be used. If the TP profile is not defined for a transaction, or
if the TP profile does not specify a RACF security level, then the
default security is CHECK.
- OTMA
- |Is used with the CHECK, FULL, NONE, or PROFILE
|parameters to control the RACF security level for input from IMS
|Open Transaction Manager Access (OTMA) clients. The /DISPLAY OTMA command can be used to show the security level that is currently
|in effect. After an IMS cold start, the security default is FULL if
|the IMS start-up parameter OTMASE= is not used. If the IMS initialization parameter
|OTMASE is not specified, IMS retains OTMA security settings (established
|by a /SECURE OTMA command) after a warm start or emergency restart. If the
|OTMASE parameter is used, the security option for OTMA will be determined
|by the OTMASE= setting.
|
|
Related Reading: For more information
|about the OTMASE parameter, see the IMS Version 9: Installation Volume 2: System Definition and Tailoring.
|
|
|- CHECK
|- Causes existing RACF calls to be made. IMS commands are checked
|using the RACF resource class of CIMS. IMS transactions are checked
|using TIMS.
|
|- FULL
|- Causes the same processing as the CHECK parameter but uses
|additional RACF calls to create the security environment for dependent
|regions.
|
|- NONE
|- Does not call RACF within IMS for security verification.
|
|- PROFILE
|- Causes the values in the Security Data section of the OTMA
|message prefix for each transaction to be used.
|
|- REFRESH
|- OTMA caches the ACEE for a userid to reduce the amount of
|RACF I/O. As a result, a refresh for the cached ACEE is needed after
|the RACF database is updated. Issuing the /SEC OTMA REFRESH command without the TMEMBER option will perform the ACEE
|refresh for all userids for all the OTMA clients. However, the actual
|ACEE refresh occurs when the next OTMA message for the userid is
|received. This is designed to prevent all the RACF ACEE refreshes
|from happening at one time.
|
|
Examples
Example 1 for /SECURE Command
Entry ET:
/DIS APPC
Response ET:
IMSLU #APPC-CONV SECURITY STATUS DESIRED
IMSLUNME 0 PROFILE ENABLED ENABLED
*91242/163820*
Explanation: Enter /DISPLAY APPC to see which security checking option is in effect.
Entry ET:
/SECURE APPC FULL
Response ET:
DFS058I SECURE COMMAND COMPLETED
Example 2 for /SECURE Command
Entry ET:
/DIS OTMA
Response ET:
GROUP/MEMBER XCF-STATUS USER-STATUS SECURITY
HARRY
-APPL8 ACTIVE SERVER FULL
*95068/175730*
Explanation: Enter /DISPLAY OTMA to see which security checking option is in effect.
Entry ET:
/SECURE OTMA FULL
Response ET:
DFS058I SECURE COMMAND COMPLETED

IBM Confidential