IMS Version 9

/SECURE

Format

Read syntax diagramSkip visual syntax diagram>>-+-/SECURE-+----APPC--+-CHECK---+----------------------------->
   '-/SEC----'          +-FULL----+
                        +-NONE----+
                        '-PROFILE-'

>--+---------------------------------------------+-------------><
   '-OTMA--+-CHECK-----------------------------+-'
           +-FULL------------------------------+
           +-NONE------------------------------+
           +-PROFILE---------------------------+
           '-REFRESH--+----------------------+-'
                      '-TMEMBER--tmembername-'

Environments and Keywords

Table 148 lists the environments (DB/DC, DBCTL, and DCCTL) from which the command and keywords can be issued.

Table 148. Valid Environments for the /SECURE Command and Keywords
Command / Keywords DB/DC DBCTL DCCTL
/SECURE X X
APPC X X
OTMA X X

Usage

The /SECURE command is used to control the RACF security level. It is used for administrative control of the IMS environment and as an emergency operations control command to throttle RACF activity without requiring an IMS shutdown.

APPC
When used with the CHECK, FULL, NONE, or PROFILE parameters. APPC controls the RACF security level for input from LU 6.2 devices. The /DISPLAY APPC command can be used to show the security level that is currently in effect. At IMS startup, the security default is FULL.
CHECK
Causes existing RACF calls to be made. IMS commands are checked using the RACF resource class of CIMS. IMS transactions are checked using TIMS. Disables MVS System Authorization Facility security for IMS allocate PSBs (APSBs).
FULL
Causes the same processing as the CHECK parameter but uses additional RACF calls to create the security environment for dependent regions and enables MVS System Authorization Facility security for IMS APSBs for all CPI Communications driven application programs.
NONE
Does not call RACF within IMS for security verification. RACF security verification in APPC/MVS is not affected. Disables MVS System Authorization Facility security for IMS APSBs.
PROFILE
Causes the values in the TP profile for each transaction to be used. If the TP profile is not defined for a transaction, or if the TP profile does not specify a RACF security level, then the default security is CHECK.
OTMA
|Is used with the CHECK, FULL, NONE, or PROFILE |parameters to control the RACF security level for input from IMS |Open Transaction Manager Access (OTMA) clients. The /DISPLAY OTMA command can be used to show the security level that is currently |in effect. After an IMS cold start, the security default is FULL if |the IMS start-up parameter OTMASE= is not used. If the IMS initialization parameter |OTMASE is not specified, IMS retains OTMA security settings (established |by a /SECURE OTMA command) after a warm start or emergency restart. If the |OTMASE parameter is used, the security option for OTMA will be determined |by the OTMASE= setting. | |

Related Reading: For more information |about the OTMASE parameter, see the IMS Version 9: Installation Volume 2: System Definition and Tailoring.

| |
|
CHECK
|
Causes existing RACF calls to be made. IMS commands are checked |using the RACF resource class of CIMS. IMS transactions are checked |using TIMS. |
|
FULL
|
Causes the same processing as the CHECK parameter but uses |additional RACF calls to create the security environment for dependent |regions. |
|
NONE
|
Does not call RACF within IMS for security verification. |
|
PROFILE
|
Causes the values in the Security Data section of the OTMA |message prefix for each transaction to be used. |
|
REFRESH
|
OTMA caches the ACEE for a userid to reduce the amount of |RACF I/O. As a result, a refresh for the cached ACEE is needed after |the RACF database is updated. Issuing the /SEC OTMA REFRESH command without the TMEMBER option will perform the ACEE |refresh for all userids for all the OTMA clients. However, the actual |ACEE refresh occurs when the next OTMA message for the userid is |received. This is designed to prevent all the RACF ACEE refreshes |from happening at one time. |
|

Examples

Example 1 for /SECURE Command

Entry ET:

  /DIS APPC

Response ET:

IMSLU     #APPC-CONV SECURITY STATUS   DESIRED
IMSLUNME           0 PROFILE  ENABLED  ENABLED
*91242/163820*

Explanation: Enter /DISPLAY APPC to see which security checking option is in effect.

Entry ET:

  /SECURE APPC FULL

Response ET:

DFS058I SECURE COMMAND COMPLETED

Example 2 for /SECURE Command

Entry ET:

  /DIS OTMA

Response ET:

  GROUP/MEMBER      XCF-STATUS   USER-STATUS    SECURITY
  HARRY
  -APPL8            ACTIVE       SERVER         FULL
  *95068/175730*

Explanation: Enter /DISPLAY OTMA to see which security checking option is in effect.

Entry ET:

  /SECURE OTMA FULL

Response ET:

  DFS058I SECURE COMMAND COMPLETED

Go to the previous page Go to the next page

IBM Confidential

Downloads | Library | Support | Support Policy | Terms of use | Feedback
Copyright: IBM Corporation 1974, 2004 Copyright IBM Corporation 1974, 2004  timestamp Last updated: March, 2004