Security in OMEGAMON enhanced 3270 user interface

The existence of the SAF user ID and its validity are always checked. The enhanced 3270 user interface also runs a number of SAF authorization checks to check whether the user has authority to do the following activities:

• Log on to this instance of the enhanced 3270 user interface
• End-user activities
  • View data for a specific attribute group (table) on a specific managed system
  • Transmit a Take Action request to a specific managed system
  • Change auto-update preferences
  • Enter a command on the command line
  • Create and modify a profile member name with the same name as the user ID of the user
  • Use a specific hub monitoring server from within the enhanced 3270 user interface
  • Use the Situation Editor, Object Editor, and ISPF Editor functions
• Administrative activities
  • List enhanced 3270 user interface users, and optionally end a user's session
  • Start or stop user interface tracing
  • Start or stop internal tracing
  • Modify (Save As) any PDS member that is named with a different user ID to that of the current user
  • Configure near-term history
  • Stop a user session
  • Send commands and queries to a given hub monitoring server via the enhanced 3270 user interface for IBM Tivoli Management (ITM) CMS (TEMS), Service Index or SOAP consoles.
  • Retrieve user session initialization hub monitoring server information
  • Configure multi-tenancy

User permissions and the amount of security that is imposed are assigned by site administrators. Authorization works as follows:

• If no SAF security class is supplied (value for RTE_SECURITY_CLASS is missing or blank), users can log on to the OMEGAMON enhanced 3270 user interface, can access data through queries, but cannot issue Take Action commands.
• If a SAF security class is supplied, but the class is not defined and active in SAF, no one can log on to the OMEGAMON enhanced 3270 user interface.
• If a SAF security class is supplied, and is defined and active in SAF, but no logon profile is defined, no one can log on to the OMEGAMON enhanced 3270 user interface.
• If a user is able to log on, and a different security class than the one used for logon is used for queries or for Take Action commands (but is not activated or resources are not defined in that security class), everyone can view data for any managed system and perform other commands and activities, but all Take Action commands are denied.
• If a security class name is configured, resource profiles must be defined to control log on, data access, and Take Actions, and users must be given access to those profiles.

In order for a PassTicket to be generated, the PTKTDATA security class must be activated. To activate the PTKTDATA class and the SETROPTS RACLIST processing, run the following command.

SETROPTS CLASSACT(PTKTDATA) RACLIST(PTKTDATA) GENERIC(PTKTDATA) 

By using the PassTicket key class the security administrator can associate a RACF secured sign-on secret key with a particular mainframe application that uses RACF for user authentication. All profiles that contain PassTicket information are defined to the PTKTDATA class.