OMEGAMON user authentication (passwords, password phrases, and MFA)

Edit online

You can use a password, a password phrase (passphrase), and multi-factor authentication (MFA) to log on securely to an OMEGAMON product or component.

A password is a traditional one to eight character alphanumeric value. A password phrase is a character string that consists of mixed-case letters, numbers, and special characters including blanks. MFA is an authentication method that typically requires a six-digit volatile numeric token that is paired with a password or passphrase value.

Depending on the OMEGAMON component and the authentication method you choose to use, some additional configuration might be necessary, especially if you are moving from traditional passwords to more secure methods. This topic provides general information about some of the considerations and configuration steps that might be required.

Note: Support for mixed-case passwords on your system requires activation of the SETROPTS PASSWORD(MIXEDCASE) option in RACF®.

Allowing mixed-case values in Tivoli Management Services

By default, the TMS:Engine folds password and passphrase values to uppercase. To use mixed-case password or passphrase values with certain OMEGAMON products and components, you must allow mixed-case values by disabling the folding of these values to uppercase. This behavior is controlled using the RTE_SECURITY_FOLD_PASSWORD_FLAG parameter. The default setting for this parameter is Y, which folds the password and passphrase values to uppercase. To use mixed-case password or passphrase values, you must change this setting to N, which disables the folding of the value to uppercase, allowing mixed-case values to persist.

Use of the RTE_SECURITY_FOLD_PASSWORD_FLAG parameter affects the following components:
  • Tivoli Enterprise Monitoring Server
  • Tivoli Enterprise Portal
  • Tivoli Enterprise Monitoring Server (TEMS) REST services
  • OMEGAMON enhanced 3270 user interface (passwords only)
    Note: See the following section, OMEGAMON enhanced 3270 user interface, for details about using passphrase with this interface.
  • OMEGAMON Classic 3270 interface (passwords only)
    Note: See the later section, OMEGAMON Classic 3270 interface, for details about using passphrase with this interface.

OMEGAMON enhanced 3270 user interface

By default, the OMEGAMON enhanced 3270 user interface (enhanced 3270UI) is configured to use traditional passwords in uppercase, and mixed-case passphrase and multi-factor authentication values. To use mixed-case passwords (eight characters or less), parameter RTE_SECURITY_FOLD_PASSWORD_FLAG must be set to N.

For more information, see the Passphrase and MFA (KOBHLPPM) topic in the online help in the product.

Note: Parameter RTE_SECURITY_FOLD_PASSWORD_FLAG does not impact passphrase values for the OMEGAMON enhanced 3270UI.

OMEGAMON Classic 3270 interface

By default, the OMEGAMON 3270 Classic interface is configured to use traditional passwords in uppercase. To use mixed-case passwords (eight characters or less), parameter RTE_SECURITY_FOLD_PASSWORD_FLAG must be set to N.

To use passphrase values and multi-factor authentication for the OMEGAMON 3270 Classic interface, you must configure your product to enable support. Multiple passphrase configuration options are available that affect the length of the passphrase that is supported on a single line and the layout of the logon screen. For more information, see OMEGAMON 3270 Classic interface security and How to: Configure passphrase and MFA support in the OMEGAMON 3270 Classic interface.

Note: Parameter RTE_SECURITY_FOLD_PASSWORD_FLAG does not impact passphrase values for the OMEGAMON 3270 Classic interface.
Note: If you will be using passphrase values and MFA with the OMEGAMON 3270 Classic interface, OMEGAMON uses the System Authorization Facility (SAF) interface (which is used to implement external security) without the use of external security exits.

Related links