CICS Transaction Gateway V5 The WebSphere ... - IBM Redbooks

144 CICS Transaction Gateway V5
specified in the CICS TG started task and in the CICS region was an alias.
Security failed when the CICS TG accessed the actual data set name. Defining
the actual data set name solved our problem.
We also had a problem when running with security enabled on the CICS TG. The
EciI1 example would give us dirty address space errors when attempting to
access module DFHXCSVC in the SDHFLINK library. Marking
CICSTS22.CICS.SDFHLINK as program controlled solved this problem.
Allow read access to program controlled libraries
If your z/OS system has defined the BPX.SERVER FACILITY class profile within
RACF, then the user ID under which the Gateway daemon runs must be
permitted to this profile. The following example shows the PERMIT command
assuming the user ID of the server is CTGUSER:
PERMIT BPX.SERVER CLASS(FACILITY) ID(CTGUSER) ACCESS(READ)
PERMIT BPX.FILEATTR.PROGCTL CLASS(FACILITY) ID(CTGUSER) ACCESS(READ)
If the BPX.SERVER FACILITY class is not defined, the CICS TG user ID must be
defined with a UID of 0 (that is, be a root user).
Remove address space sharing from ctgstart
We specified that the ctgstart script should not share its address space with any
other processes. This is to ensure that the calling address space is not
contaminated by a non-program-controlled load module. To force the JVM to use
its own non-shareable address, we used the following UNIX System Services
command:
extattr -s /usr/lpp/ctg500/bin/ctgstart
This command should be performed from the owner ID or superuser.
Example 7-4 on page 145 shows the result of this command. The ctgstart
module does not have an “s” in the second column, which is the desired effect of
the above command.
CICS TG started task user ID
We ran our CICS TG as a started task, using the user ID CTGUSER. The user ID
under which the CICS TG started task runs should:
► Have an OMVS segment defined
► Be in a group that has an OMVS segment
► Be defined without a password
► Have READ access to the RACF profile that protects the
TCPIP.STANDARD.TCPXLBIN data set. This data set contains translate
tables for translating from ASCII to EBCDIC and from EBCDIC to ASCII.