Configuring authentication for ADDI

Edit online

Configure authentication for communicating with the IBM Application Discovery and Delivery Intelligence (ADDI) project.

About this task

It is common for data centers to assign different user IDs for access to z/OS and for access to SQL Server. By default, the server will attempt to log on to SQL Server with the same user ID that was presented for logon to z/OS. A facility is provided in the server to optionally change the logon credentials for a user when accessing SQL Server.

When communicating between the Data Virtualization Manager server and the ADDI project, you must define what credentials to use in MSSQL connections if z/OS users are not defined as users to SQL Server. To accomplish this, the following tools are provided:
AVZDRATH
A utility that sets encrypted passwords in GLOBALU variables. Use this utility to define alternate logon information for the Data Virtualization Manager server started task and z/OS users. This utility places SQL Server authentication information in GLOBALU system variables for connecting to ADDI projects. You can also use this utility to list existing credential information.
AVZEMSSG
An ATH rule that swaps z/OS user information with SQL Server authentication information defined using the AVZDRATH utility. This rule uses AES encrypted passwords stored as GLOBALU system variables.
You can use any of the following options for authentication:
  • Use z/OS IDs for authentication
  • Add a global default user definition using sample job AVZDRATH and enable ATH rule AVZEMSSG
  • Add authentication information for specific mainframe users using sample job AVZDRATH and enable ATH rule AVZEMSSG

Network administrators may need to open ports for DRDA communication between the z/OS host and the Microsoft SQL Server machine(s) hosting ADDI projects. The default port for Microsoft SQL Server access is 446.

If z/OS user IDs are not defined to Microsoft SQL Server, use the following procedure to define alternate authentication information for the started task and z/OS users requiring access to this feature:

Procedure

  1. Use the sample job AVZDRATH to add a global default user definition or authentication information for specific mainframe users as follows:
    1. Locate the AVZDRATH member in the hlq.SAVZCNTL data set.
    2. Modify the JCL according to the instructions provided in the AVZDRATH member.

      When adding the SYSIN statements that define the alternate credentials for logging in to your ADDI project, as instructed in the JCL, make sure to specify the correct DBTYPE. For ADDI projects, specify DBTYPE=MSSQL.

    3. Submit the job.
    4. Optional: To verify the information stored in the GLOBALU variables and list existing authentication, use the REPORT=SUMMARY statement in the AVZDRATH member and submit the job.
  2. Auto-enable the SEF ATH rule SAVZXATH(AVZEMSSG) to switch credentials when connecting to ADDI using DRDA. Global variables are used to define alternate authentication credential mapping for the SEF ATH rule.
    1. On the Data Virtualization Manager server - Primary Option Menu, select option E for Rules Mgmt.
    2. Select option 2 for SEF Rule Management.
    3. Enter * to display all rules, or ATH to display only authentication rules.
    4. Set Auto-Enable for the AVZEMSSG rule member by entering A and pressing Enter.