Surrogate user checking for EXCI calls

A surrogate user check is performed to verify that the batch region's userid is authorized to issue DPL calls for another user (that is, it is authorized as a surrogate of the userid specified on the DPL_request call).

External CICS® interface (EXCI) client jobs are subject to surrogate user checking. So you must authorize the batch region's userid as a surrogate of the userid specified on all DPL_request calls. This means the batch region's userid must have READ access to a profile named execution_userid.DFHEXCI in the SURROGAT general resource class (where execution_userid is the userid specified on the DPL call). For example, the following commands define a surrogate profile for a DPL userid, and grant READ access to the EXCI batch region:

RDEFINE  SURROGAT execution_userid.DFHEXCI UACC(NONE)
PERMIT   execution_userid.DFHEXCI CLASS(SURROGAT) ID(batch_region_userid)
                    ACCESS(READ) 

If no userid is specified on the DPL call, no surrogate user check is performed, because the userid on the DPL call defaults to the batch region's userid.

If the batch region's userid and the CICS region userid are different, link security checking is enforced. With link security, an unauthenticated userid passed on a DPL call cannot acquire more authority than that allowed by the link security check. It can acquire only the same, or less, authority than allowed by the link security check.