The RACF® secured signon function provides an alternative to the RACF password, called a PassTicket. The RACF PassTicket is a one-time-only password that is generated by a requesting product or function. It is an alternative to the RACF password that removes the need to send RACF passwords across the network in clear text. It makes it possible to move the authentication of a mainframe application user ID from RACF to another authorized function executing on the host system or to the work station local area network (LAN) environment.

Beginning with z/OS® V1 R7, RACF audits PassTicket generation and evaluation. For more information, see z/OS Security Server RACF Auditor's Guide.