Distributed network security credential support and OTMA

OTMA supports security credentials that are entered by a user in a distributed environment. After distributed network security credentials are passed to OTMA, the credentials are included in IMS log records that contain information about the message prefix.

To enable network security credentials to be passed from user-written applications that use the HWSSMPL0 or the HWSSMPL1 user message exit, you must define IRM extensions, which are used to pass the network security credentials that are entered by a user to IMS Connect. An IRM extension with an ID of *NETUID* is used to pass a network user ID and an IRM extension with an ID of *NETSID* is used to pass a network session ID. After the network security credentials are passed to IMS Connect, the HWSSMPL0 and HWSSMPL1 user message exit routines use the network security credentials that are in the IRM extensions to build the OTMA message prefix. The security credentials are included in the security-data section of the OTMA message prefix.

When a user enters network security credentials to an application that uses the HWSJAVA0 user message exit, the credentials are passed from the application to IMS TM resource adapter, which then includes the credentials in the security-data section of the OTMA message prefix.

Because distributed network security credentials are passed to IMS in the security-data section of the OTMA message prefix, all IMS log records that contain information about the message prefix, such as log records X'01' and X'03', include the distributed security credentials.

If a Fast Path message contains network security credentials and is processed by the Fast Path expedited message handler (EMH) on the local IMS system, the credentials are logged in the X'5901' log record.

If a Fast Path message that contains network security credentials is processed by using the EMH queue (EMHQ) in a shared-queues environment, in the front-end IMS system, the credentials are included in the X'5911' log record. In the back-end IMS system, which is the processing IMS system, the credentials are included in the X'5901' log record.

You can enable IMS to log distributed network security credentials in RACF SMF records after the credentials are passed to OTMA. To enable distributed network security credentials to be logged in RACF SMF records, specify LOGSTR=YES in the OTMA client descriptor of the DFSYDTx member of the IMS PROCLIB data set. After LOGSTR=YES is specified, the first 255 bytes of the distributed network security credentials that are sent to OTMA are logged in RACF SMF records.

You can use the otma_send_receivey and otma_send_asyncx APIs of the IMS OTMA Callable Interface (OTMA C/I) to pass the network user ID and the network session ID to IMS. For each API, up to 100 bytes for the network user ID and up to 100 bytes for the network session ID can be passed to IMS.

You can also use the Transaction Authorization exit routine (DFSCTRN0) to pass the addresses of the network security credentials in the OTMA message prefix.