Variables for Configuring MTO Security Behaviour

The variables below are used to control CICS security processing. They correspond to CICS intialization parameters for the mainframe, with a prefix of ES_ESM.

ES_ESM_CMDSEC

Use this variable to determine whether CICS processing should honor the CMDSEC option specified on a transaction's PLT definition.

Setting Result
ASIS The CMDSEC option of a transaction's resource definition will be honored. That is, command security checking is performed only when CMDSEC is set to YES on the transaction resource definition.
ALWAYS CICS processing always performs command security checking irrespective of the CMDSEC setting on the transaction definition.

ES_ESM_PLTPISEC

Use this variable to choose the desired level of security checking for PLTPI processing.

Setting Result

NONE

No security will be performed for PLTPI processing

ALL

Resource security check and Command security check will be performed

RESSEC

Only Resource security check will be performed

CMDSEC

Only Command security check will be performed

ES_CESN_NO_OS390

Use this variable to override the default behaviour CESN transaction response for invalid user credentials. Default behaviour reports "Your userid is invalid" or "Your password is invalid". Setting this variable to any value will cause CESN to produce an invalid credential message instead.

e.g. ES_CESN_NO_OS390=secured

ES_ESM_PLTPIUSR

Use this to specify the userid under the authority of which PLT programs will run during CICS initialization. The userid must have appropriate authorization (as determined by the PLTPISEC parameter) to access all the resources used by the programs. Enterprise Server will check that the CICS region has authority to act as a surrogate for the userid specified.

If you do not specify PLTPIUSR, the user specified when starting the enterprise server/CICS region is used. Where this is the case, this user must have appropriate authorization on the resources used by the PLT programs.

ES_ESM_SECPRFX

Use this to determine whether or not CICS processing should prefix the resource names when making security queries.

Setting Result
NO No prefixes are used
YES Resource names are prefixed with the CICS region user ID.
prefix This string will be used as the prefix for resource names. It can be 1 to 8 upper case alphanumeric characters and it must start with an alphabetic character.

ES_ESM_RESSEC

Use this parameter to determine whether CICS processing should honor the RESSEC option specified on a transaction's PLT definition.

Setting Result
ASIS The RESSEC option of a transaction's resource definition will be honored. That is, resource security checking is performed only when RESSEC is set to yes on the PLT definition. .
ALWAYS CICS processing always performs resource security checking irrespective of the RLS security setting on the transaction definition.

ES_ESM_XUSER

Use this to determine whether or not CICS processing will perform surrogate user checks.

Setting Result
NO No surrogate user checking is performed.
YES Perform surrogate user checking wherever such checks are permitted.

ES_OLD_SEC_TSTD

Use this to prevent security being enforced for TS or TD queues that are not defined in your security repository.

Setting Result
Any value Security will not be enforced for TS and TD queues that are not defined as entities within the security repository.

Note: If you do not set this variable, and you enable security for your enterprise server, you must declare each TS or TD that your transactions will access in your security repository.

Related topics: