User ID substitutions for AO application programs

In certain circumstances, IMS substitutes other identifiers, such as an LTERM name or program name, as the user ID. Unless you have anticipated this and defined substitute user IDs to RACF®, RACF rejects the CMD or ICMD call.

The following examples show how IMS might use user IDs in different circumstances in the AO application program's execution environments. These examples are based on a specification of AOI=YES in the TRANSACT macro.

MPP or IFP

If a message GU call has completed, the user ID is used to determine if the user can issue commands using ICMD. The user ID is of a signed-on terminal or the LTERM name of the signed-off terminal where the transaction is issued. If GU is not issued, PSB name is used.

BMP

If a message GU call has completed, the user ID is used to determine if the user can issue commands using ICMD. The user ID is of a signed-on terminal or the LTERM name of the signed-off terminal where the transaction is issued. If GU is not issued or if the BMP is non-message driven, the value of the USER parameter specified on the JCL JOB statement is used. If the USER parameter is not specified, a user ID of 0000000 is used.

DRA THREAD

The security token that is passed in the PAPL for a schedule request is used to determine whether the user can issue commands using ICMD.

BMP regions are initiated by a /START command or by a JCL job. If you use a /START command, you should use RACF to protect the library that contains the cataloged procedures. If you use JCL, you can use RACF resource access security (RAS). You control access to the BMP region by defining a unique user ID to RACF on the JOB statement. If you are using RAS, enter the user ID in the RACF security class.

When AO application programs issue a command through the CMD or ICMD call, passwords are not used.