Controlling Access to IBM Tivoli Monitoring Products
The IBM Tivoli Monitoring (ITM) platform offers a series of Simple Object Access Protocol (SOAP) requests that can be issued from z/OS.
SOAP is a communications XML-based protocol that lets applications exchange information through
the Internet. For further information about creating SOAP messages, see the appendix Tivoli® Enterprise Monitoring Web services
in IBM®
Tivoli Monitoring: Administrator’s Guide.
Authentication of users (autotasks or operators) is done based on <userid> and <password> tags that are specified in a SOAP request, if security is enabled. Note, however, that before a SOAP request can be issued the user must be logged on to NetView.
The SOAP request is sent to the hub Tivoli Enterprise Monitoring Server (monitoring server) that is supplied in the INGOMX command and processed there.
SOAP requests can be authorized in terms of both user and hub monitoring server via a user access list. They can be further restricted to groups of users and particular SOAP servers using command authorization table identifiers however final authorization is performed on the hub monitoring server based on the user access list and logon validation.
- SERVER allows access based on either the server object that is defined in the SOAP SERVER policy item of a NTW policy object, or a host name. Note that you can only specify the first 8 characters for long host names.
- IPADDR allows access based on IP addresses, however this must be for all IP addresses or none because an address cannot be specified in the command authorization table.
Table 1 shows the SA z/OS command names, keywords, and values that can be protected along with their associated SAF resource or command authorization table identifier.