CICS Transaction Gateway V5 The WebSphere ... - IBM Redbooks

Surrogate user security
CICS performs surrogate user security checking in a number of instances to
ensure that the authenticated user is authorized to act for another user. It can
also be used by the CICS TG itself to ensure that the started task user ID is
authorized to initiate work on behalf of the user ID flowed in an ECI request.
Intercommunication security
Intercommunication security in CICS is concerned with incoming requests for
access to CICS resources. Requests from the CICS TG can arrive via APPC
(ISC) or EXCI (MRO) connections and the two are treated somewhat differently.
There are three fundamentally different intercommunication security checks that
can be performed as follows:
► Bind security
This verifies the system wishing to connect (bind) to CICS is authorized to do
so.
► User security (or in LU 6.2 terms, conversation level security)
This causes a check to be made against the flowed user ID when an inbound
requests attaches the requested transaction in CICS. This behavior is defined
in the ATTACHSEC parameter on the CONNECTION definition. For MRO or
EXCI requests from the CICS TG, this should always be IDENTIFY, meaning
that only the user ID is checked. For APPC (or TCP62) connections from the
CICS TG, this should be set to VERIFY, meaning both the user ID and
password are checked. For ECI over TCP/IP connection from the CICS TG,
this should be set in the TCPIPSERVICE to VERIFY.
► Link security
This is an additional level of authorization checking that can apply to the
attached transaction. A specific user ID (the link user) is defined on the
connection with the remote system. This user ID must be authorized to have
access to all transactions and resources invoked through this connection.
This concept applies equally to MRO and ISC.
We discuss how each of these apply to security with CICS TG in this chapter.
6.2 CICS TG security scenarios
In the following sections, we present three security scenarios, as follows:
► An ECI call to a CICS program using the CICS TG for z/OS and an EXCI
connection to CICS (see 6.2.1, “ECI to CICS TG for z/OS (EXCI)” on
page 102)
Chapter 6. CICS TG security scenarios 101