Verifying CICS users

To protect resources from unauthorized access, CICS® must be able to identify users of the system when they invoke transactions.

Identifying CICS terminal users
If you are running CICS with RACF® security checking, you control users' access to CICS resources through levels of authorization you define in RACF-managed resource profiles.
The sign-on process
When users log-on to CICS through the z/OS® Communications Server, but do not sign on, they can use only those transactions that the CICS default user is permitted to use.
The sign-off process
The sign-off process dissociates a user from a terminal where the user had been previously signed on. The user can explicitly sign off using the CESF transaction or an installation-provided transaction that uses the SIGNOFF API command. If the attributes of the signed-on user include a non-zero value for TIMEOUT, an implicit sign-off occurs if this interval expires after a transaction terminates at this terminal.
Controlling access to CICS from specific ports of entry
During sign-on processing, CICS issues a request to RACF to verify the user's password, and to check whether the user is allowed to access that terminal.
Defining port of entry profiles
Port of entry is the generic term for the device at which the user signs on. For CICS, the port of entry can be either a terminal or a console. You can use associated port of entry profiles to control whether a user can sign on at a particular device.
Auditing sign-on and sign-off activity
RACF can log all sign-on and sign-off activity to SMF, including any invalid or unsuccessful sign-on attempts. You can use this information in several ways: for example, as an audit trail, to identify possible attempts to breach security, and to help with capacity planning.
Preset terminal security
For some terminals, and MVS™ consoles when used as CICS terminals, it is appropriate to use preset terminal security as an alternative to terminal user security.
Using an MVS system console as a CICS terminal
If you intend to use an MVS system console as a CICS terminal, you might need authorization to use the MVS MODIFY command by using the OPERCMDS resource class.
Obtaining CICS-related data for a user
CICS obtains CICS-related data from one of the following sources: the CICS and LANGUAGE segments of the RACF profile, or built-in CICS system default values. This section explains how the data is obtained, for the default user and terminal users signing on.
Support for mixed-case passwords
Support for mixed-case passwords depends on your external security manager. All security managers that support password phrases, that is passwords between 9 and 100 characters in length, support mixed case. However, not all security managers that support standard passwords, that is passwords up to 8 characters in length support mixed case.
National language and non-terminal transactions
When a user specifies a national language during sign-on, the sign-on option overrides the language specified in the user's RACF CICS segment.

Parent topic: Implementing RACF protection in a single CICS region