Securing the observed systems

When a system is observed, the Provisioning Manager connects to the CIM server on that system and retrieves configuration and performance information about the workload. For the logon to the observed system a separate System Observation userid (default CPOCIM) is defined on the runtime system and all observed systems. To enable this communication, establish a connection for the System Observation user that is authorized for PassTickets. The steps to take are:

• Define the System Observation user on the observed systems with the same password as on the runtime system
• Enable the secured sign-on function
• Authorize the System Observation user to access the CIM server

The following definitions assume that the System Observation user is already defined and OMVS segment is assigned. These definitions must be effective on all observed systems.

The RACF security definitions listed here and contained in member CPOSEC2 assume a prior CIM setup. Detailed information about CIM setup can be found in z/OS Common Information Model User’s Guide. The CPOSEC2 sample is adapted for the CIM security setup job CFZSEC.

Defining the secured sign-on function on the observed systems

This feature must be set up on the observed systems in the same way it was set up on the runtime system, which is described in Defining the secured sign-on function on the runtime system. Note that the KEYMASKED value must match the runtime system, and PassTicket generation is only performed on the runtime systems.

Defining access to the CIM server

The System Observation user must be authorized to access the CIM server on all observed systems. This configuration assumes that the System Observation user is already defined and the CIM setup is complete.

• Give the System Observation user access to the CIMSERV profile in the WBEM class by connecting it to the default CIM users group CFZUSRGP, which was defined in the CIM setup:

   CONNECT (CPOCIM) GROUP(CFZUSRGP) AUTH(USE)

For more information, see z/OS Common Information Model User’s Guide.