Removing sensitive data from CICS trace using CONFDATA

CICS® trace data can contain sensitive data such as passwords and similar tokens. This occurs in various places in CICS such as transport data and containers. You can use the CONFDATA system initialization parameter in conjunction with the CONFDATA transaction attribute to prevent confidential data from appearing in external and internal trace records in a transaction or system dump.

The CONFDATA mechanism

Data is redacted based on the settings of the CONFDATA system initialization parameter and the CONFDATA transaction attribute as shown in the following table.

Table 1. Interaction between the CONFDATA system initialization parameter and the CONFDATA transaction attribute
	System initialization parameter CONFDATA=HIDE	System initialization parameter CONFDATA=SHOW
Transaction attribute CONFDATA(NO)	Not redacted	Not redacted
Transaction attribute CONFDATA(YES)	Redacted	Not redacted
CICS transactions (see CICS transactions that specify CONFDATA(YES))	Redacted	Not redacted

The trace points affected by the CONFDATA mechanism are listed in Trace points that might contain redacted data.

Where CICS has identified data as a password or similar security token, such as in the security domain trace points, the data is never traced.

While CICS attempts to mask sensitive data, sensitive data might still appear in dumps; therefore, do keep dumps data sets secured.

Usage notes for CONFDATA transaction attribute

The default transaction attribute of CONFDATA(NO) assumes that most user applications do not handle passwords. You should set CONFDATA(YES) to any transaction that might contain passwords in its transport data.

Usage notes for CONFDATA system initialization parameter

The CONFDATA system initialization parameter should usually be set to the default value of HIDE to prevent sensitive data from being exposed in trace entries or dumps. Most problems can be diagnosed without this data. If it is necessary to reproduce problems with CONFDATA set to SHOW, be aware that password data could be exposed.

Changing the CONFDATA setting in a running system

You can use CSFE DEBUG to change the value of the CONFDATA system initialization parameter in a running system. Optionally, you can also use it to change the CONFDATA option of a transaction. Make sure that you are authorized to use the CSFE transaction. For more information, see Using CSFE to change the CONFDATA setting.

CICS transactions that specify CONFDATA(YES)

All CICS system transactions are treated as CONFDATA(YES).

The following CICS transactions are treated as CONFDATA(YES) regardless of any change to their definitions:

CE, CR, CV, CW	CS	CP
CESL CESN CRTE CVMI CWXN	CSM2 CSM3 CSM5 CSMI CSM1	CPIA CPIH CPIL CPIQ CPMI

Note: The CEDF and CEDX transactions will redact data if it is known to be a password or similar token. It is not possible to redact user data that might contain sensitive data. For this reason, you must protect these transactions on systems that contain sensitive data.

Trace points that might contain redacted data

Component	Trace points	Data that might contain sensitive data
z/OS® Communications Server	AP FC90-91	The z/OS Communications Server receive-any input area (RAIA) storage containing initial input that is created when the RECEIVE ANY operation has been processed, and before the target transaction has been identified. Only the first 4 bytes of normal data, or the first 8 bytes of function management headers (FMHs) are traced.
MRO	AP DD16 AP DD23 AP DD25 AP FC9B	Initial input received on an MRO link.
EXCI	AP 4E25-26	If CONFDATA=HIDETC in the DFHXCOPT.
IPIC	SO 0201-02 SO 029D
HTTP (web)	WB 0700-01 WB 0410
HTTP (IP)	IS 0602-03 IS 0702-03 IS 0906
FEPI	AP 1243-44 AP 145E-61 AP 1595-99	FEPI screens and RPL data areas (RPLAREAs) areas and user data.
CICS client	AP 3057-5A
Containers (Web Services)	PG 1910-12 PG 1921	Data in the DFHREQUEST container.

Redacted trace data is replaced by the string SUPPRESSED BY CONFDATA=HIDE or similar.