CICS Transaction Gateway V5 The WebSphere ... - IBM Redbooks

6.1 Introduction to CICS security
100 CICS Transaction Gateway V5
CICS uses the z/OS System Authorization Facility (SAF) to route authorization
requests to an external security manager (ESM) to perform all its security
checks. Any suitable ESM could be used, but as IBM’s RACF product is the most
commonly used, the remainder of this book will refer to RACF. For complete
information about CICS security, refer to the CICS RACF Security Guide,
SC33-1701.
Every CICS region requires certain special user IDs to be established, and also
uses certain user ID when receiving inbound requests from other systems.
These user IDs are as follows:
Region user ID This is the user ID under which the CICS job itself runs, and
is a powerful user ID.
Default user ID This is used when users do not explicitly sign on, and should
be given very low authorization. It is specified in the SIT
parameter DFLTUSER.
Flowed user ID This is any user ID that is flowed in an ISC or MRO request,
and includes user IDs flowed in ECI and EPI requests from
Java applications.
Link user ID This is a user ID defined on CONNECTION or SESSIONS
definition. It is used in link security and to determine if
connected systems are equivalent.
Authentication of CICS users is the responsibility of RACF. Once authenticated,
the user can pass through transaction security, resource security, command
security, surrogate security, and, if the request is forwarded to another CICS
region, intercommunication security. These are briefly explained in the following
text.
Transaction security
CICS uses transaction security to control a user’s permission to start a
transaction. CICS performs a transaction security check even if no user has
signed on. Users who do not sign on can use only those transactions that are
authorized to the CICS default user ID. Usually this ID is very limited in what it
has access to.
Resource security
CICS provides a further (optional) level of security by controlling access to
individual resources, which include programs, files, and started transactions.
There are no special implications for resource security with the CICS TG and so
this subject is not addressed any further in this chapter.