Security configuration for the z/OS Connect Server

You must configure the z/OS Connect Server and the back-end IMS to ensure secure communications.

zosConnect-2.0 Applies to zosConnect-2.0.

Examine the IMS service security process flow topic to gain an understanding of how user authentication and authorization are handled, and how the user ID and password for each service request are determined.

Table 1. Required security configurations
Area Configuration task
z/OS Connect Server See Overview of IBM z/OS Connect security and related security configuration topics for details.

To configure for secure connections between z/OS Connect and IMS, see Configuring secure connections between IBM z/OS Connect and IMS Connect.
IMS services For service-level security, you can set the authority level of a user in the zosconnect_zosConnectService element. The following example sets, for the phonebook service, the administrator authority for users in ADMINGRP1 and the Invoke authority for users in USERGRP1.
<zosconnect_zosConnectService id="phonebook" 
 invokeURI="/imsmobile/services/phonebook"
 runGlobalInterceptors="true"
 adminGroup="ADMINGRP1"
 invokeGroup="USERGRP1"
 serviceDescription="" serviceName="phonebook" 
 serviceRef="phonebook"/>
For more information, see Overview of IBM z/OS Connect security.
IMS service provider See IMS service security process flow for general security process flow and user ID propagation.

The IMS service provider also provides an optional attribute imsTechnicalID. If z/OS Connect authentication is turned off, or the request subject from which the user ID is extracted is more than 8 bytes, the IMS service provider retrieves the user from the technical ID that you specify in server.xml. Specify also the technical group and technical password in an <imsmobile_imsServiceManager> element in the server.xml file:

<imsmobile_imsServiceManager
   imsTechnicalGroup="IMSGROUP" 
   imsTechnicalID="IMSUSER"
   imsTechnicalPassword="encoded_password"/>

The IMS technical ID and IMS technical group name must be properly configured in SAF (for example, RACF) on the IMS host system.

You can use the securityUtility encode command to encode the password for the imsTechnicalID. The securityUtility command can be found in the <installation_path>/wlp/bin directory. For more information, see securityUtility command.

Copy the encoded password into the server.xml file for the imsTechnicalPassword attribute. The following is a sample of an updated <imsmobile_imsServiceManager> element in the server.xml file:
<imsmobile_imsServiceManager 
   imsTechnicalGroup="SYS1" imsTechnicalID="IMSGUEST" 
   imsTechnicalPassword="mypassword" >
IMS Connect IMS Connect handles authentication for IMS. The IMS Connect HWSJAVA0 exit routine manages the messages for the IMS service provider.

For more information, see User authentication in IMS Connect.

To configure for secure connections between IBM® z/OS Connect and IMS, see Configuring secure connections between IBM z/OS Connect and IMS Connect.
Client applications All client requests must provide basic authentication credentials in the header. The user ID and password in the credential must be registered in the basic registry or SAF registry on the server.
Important:
  • Use of z/OS Communications Server Application Transparent Transport Layer Security (AT-TLS) SSL protection to secure the communication between the z/OS Connect Server and IMS Connect is recommended.
  • Optionally, you can turn on IMS security (/SECURE OTMA) for authorization that is based on RACF user ID in the request subject and the associated group name.
Enhancing security through these options are recommended. However, if you turn on IMS security, and you are using the basic user registry for user authentication in z/OS Connect Server, you must use RACF ID as the user ID in your basic user registry in order for IMS OTMA to authorize the user.