An alternative approach to Basic Authentication for CICS TS Web Services Security

Resolving The Problem

Add a handler to the pipeline to provide basic authentication support.

If all that is required is basic authentication, then an alternative to using the full WS-Security functionality exists that will offer better performance.

Basic authentication, as the name implies, is the simplest form of security authentication. What is usually meant by this term is that an end user is required to present proof of identity by providing a userid and password that can then be verified with an external security manager, such as RACF. It is possible to implement this support by writing a header handler for a CICS pipeline.

A pipeline is implemented as a series of programs, known as handlers, that are invoked in a predefined sequence. If basic authentication is required, then it is possible to add a handler to the pipeline to provide this support. For information on how to configure a pipeline to have extra handlers, refer to the Supplying your own message handlers section in the CICS TS information center.

Such a handler needs to perform the following:

1. Retrieve the DFHFUNCTION container, return if function is not ‘RECEIVE-REQUEST’.
   
   
2. Retrieve the DFHHEADER container with an EXEC CICS GET CONTAINER command.
   
   
3. Extract the values for Username and Password from the XML.
   
   
4. Issue an EXEC CICS VERIFY PASSWORD command.
   
   
5. If successful, update the DFHWS-USERID container with an EXEC CICS PUT CONTAINER command.
   
   
6. Otherwise issue an EXEC CICS SOAPFAULT CREATE command.
   
   
7. Return