Enabling caching of MFA-based authentication credentials for clients with sysplex workload balancing

Sysplex group authentication enables the use of multi-factor authentication (MFA) and RACF® PassTickets in Db2 data sharing environments.

Before you begin

For clients that do not have sysplex workload balancing or seamless failover enabled, see the alternate approach described in Enabling caching of MFA and RACF PassTickets credentials for clients without sysplex workload balancing.
The MFA support that is provided by Db2 is based on the IBM Z® Multi-Factor Authentication product, which provides enhanced logon security, addresses regulatory and industry requirements, and provides centralized and simplified management. If you are using IBM Z Multi-Factor Authentication, it must already be configured on MVS or across the z/OS® sysplex and must be configured in accordance with how clients will provide user authentication credentials from remote applications.
If you are using RACF PassTickets:
- The security product that you are using must be online.
- Complete the steps in Enabling Db2 to receive RACF PassTickets.

About this task

MFA and RACF PassTickets are two distinct methods of providing additional authentication credentials at logon to verify a user's identity. Requiring an additional authentication credential ensures that a user's account cannot be compromised if one of their credentials is discovered.

sysplex group authentication eliminates connection authentication failures that occur when a Db2 client has sysplex workload balancing or seamless failover enabled by using either of the following methods:

The enableWLB keyword in the <wlb> section of the IBM® data server driver configuration file (db2dsdriver.cfg) for the non-java client
The enablesysplexWLB JDBC database property

Without sysplex group authentication, connection authentication requests will fail because the drivers that perform sysplex workload balancing and seamless failover attempt to connect with multiple members of a data sharing group on behalf of the original client application connection. These extra connection attempts fail because the additional authentication credential expires or becomes void because it's valid only for the initial connection request and cannot be reused for subsequent connection requests.

Procedure

Ensure that the ICSF load library, SCSFMOD0, is in the LINKLIST of the LPAR where Db2 is running.
For every member of a data sharing group for which you want to enable sysplex group authentication, ensure that Db2 is running with a Db2 subsystem parameters (ZPARM) module in which AUTHEXIT_CACHEREFRESH (DSN6SPRM) is set to ALL.

To use RACF PassTickets for passwords without using IBM Multi-Factor Authentication for z/OS, complete the following additional steps on RACF:

Enable Db2 as a serving data sharing group that can receive PassTickets with connection authentication tokens by defining a PTKTDATA profile that permits a member of a Db2 data sharing group to evaluate whether a password is a PassTicket when being accessed by a distributed client. If this permission profile does not exist, an authorization failure will occur when the PassTicket use has exceeded 10 minutes.
```
RDEFINE PTKTDATA IRRPTAUTH.applname.* 
```
```
RDEFINE PTKTDATA IRRPTAUTH.applname.userid
```
Where:
- applname is either the generic LU or the IPNAME defined to each member of the data sharing group. All members of a data sharing group must be defined with the same generic LU or IPNAME.
- userid is an asterisk (*) or a specific client user ID that you want to allow into the serving data sharing group and be authenticated with a PassTicket as a password.
This profile must be available to all the systems of a sysplex where a member of the serving Db2 data sharing group is started.
Issue one of the following commands to permit the user ID that is assigned in the STARTED profile in the DDF address space (ssnmDIST) to read the profile that you created in step 3:
```
PERMIT IRRPTAUTH.applname.* CLASS(PTKTDATA) -
     ID(dist_userid) ACCESS(READ)
```
```
PERMIT IRRPTAUTH.applname.userid CLASS(PTKTDATA) -
     ID(dist_userid) ACCESS(READ)
```
Where dist_userid is the user ID that is assigned in the STARTED profile in the DDF address space (ssnmDIST). If you use different STARTED user IDs for the ssnmDIST address spaces of members of the same Db2 data sharing group, you must give READ permission to this PTKTDATA profile to each of these user IDs
Issue the SETROPTS command to enable the PTKTDATA profile that you created in the previous steps:
```
SETROPTS RACLIST(PTKTDATA) REFRESH
```
Notes:
- When a particular PassTicket-based authentication token hasn't been used by a client in an authentication request for more than two hours, the token expires and is removed from the cache.
- If Db2 receives a RACF ALTUSER REVOKE or a DELUSER command for an authorization ID that matches an entry for an authorization ID in the cache, that entry expires across the entire data sharing group.

Example

The following example shows the RACF commands that: define a PTKTDATA profile for SYEC1GLU for any user ID; grant the DDF address space (ssnmDIST) STARTED profile user ID (SYSDSP) READ access to that PTKTDATA profile; and enable the new PTKTDATA profiles:

RDEFINE PTKTDATA IRRPTAUTH.SYEC1GLU.*
PERMIT IRRPTAUTH.SYEC1GLU.* CLASS(PTKTDATA) -
     ID(SYSDSP) ACCESS(READ)
SETROPTS RACLIST(PTKTDATA) REFRESH