Prerequisites for IBM zSecure Secret Manager
This topic describes the system, software, and security prerequisites required before installing, setting up, or configuring IBM® zSecure Secret Manager. These prerequisites apply to all installation and configuration scenarios unless stated otherwise.
Administrative responsibilities for installation and configuration can vary across environments and can be performed by one or more system administrators, depending on organizational practices.
Product installation prerequisite
Install IBM zSecure Secret Manager by using SMP/E, as described in the Program Directory: IBM zSecure Secret Manager. Complete all required Program Directory steps successfully before proceeding with configuration.
PKI engine requirements
- Certificate authority requirement: IBM zSecure Secret Manager requires IBM Vault Self-Managed for Z and LinuxONE, which serves as the certificate authority (CA). This is a mandatory prerequisite for certificate issuance and renewal operations.
- Certificate renewal support: IBM zSecure Secret Manager requires the Vault Public Key Infrastructure (PKI) secrets engine to automate certificate renewals.
- Supported Vault versions: IBM zSecure Secret Manager supports IBM Vault Self-Managed for Z and LinuxONE. Enterprise Vault deployments running version 1.11.0 or later are also supported.
z/OS system environment prerequisites
- VSAM Record-Level Sharing (RLS) requirements:
IBM zSecure Secret Manager uses EzNoSQL for z/OS.
EzNoSQL uses VSAM Record-Level Sharing (RLS) and requires a configured Coupling Facility (CF) for Cross-System Serialization (record-level locking). The required CF structures for VSAM RLS must be configured and operational. The minimum supported configuration consists of a single z/OS LPAR with the required CF configuration.
- EzNoSQL for z/OS: Version 3.2.0 must be installed and available on the system. For information about installing and configuring EzNoSQL for z/OS, see the IBM EzNoSQL for z/OS documentation.
- Unix System Services (USS):
- Unix System Services (OMVS) must be active on the system. zFS must be active, and required file systems must be mounted and accessible.
- The IBM zSecure Secret Manager user ID associated with the started task must have access to the required USS paths.
- Java Version 25 (see Java runtime prerequisites)
Sysplex support
When deploying IBM zSecure Secret Manager in a sysplex environment, configure one instance per RACF database. Each instance runs on the LPAR that uses the associated RACF database.
If multiple RACF databases exist across the sysplex, deploy a corresponding instance of IBM zSecure Secret Manager for each database on the appropriate LPAR.
IBM zSecure Secret Manager uses PC routine calls to process requests. Secret request commands must be issued from the same LPAR where the instance is running.
Java runtime prerequisites
- IBM Semeru Runtime Certified Edition Version 25 must be installed and available to the z/OS environment. For installation and configuration details, see the Program Directory: IBM zSecure Secret Manager.
- Ensure that the APF bit is enabled for the Java USS libraries. This can be verified by confirming that Java was installed while preserving permissions, timestamps, and z/OS extended attributes. IBM zSecure Secret Manager runs the JVM in authorized mode, which requires the JVM system libraries to have the APF bit enabled. If the APF bit is not enabled, JVM initialization in the started task will fail.
Security administration prerequisites
The installer must have authority to perform the following actions:
- Update PARMLIB members for APF authorization and zFS mounts
- Define or modify RACF user IDs
- Define STARTED class profiles
- Define baseline authorizations in the SECRET class
These authorities enable completion of post‑installation setup and activation of the service.
After verifying these prerequisites, proceed with installation and setup. See Install IBM zSecure Secret Manager for information.