Appendix H. Security
REXX/CICS can be viewed as a more sophisticated version of the CICS-supplied Command Level
Interpreter Transaction (CECI). The REXX transaction (used to issue REXX execs), much like the CECI
transaction, can be controlled using CICS transaction security. The REXX transaction might be made
widely available, or might be limited to a few individuals, depending upon the nature of the CICS region it
is running in.
Note:
The REXX transaction is not required to execute existing REXX execs, but is required if users or
programmers want the ability to create or modify REXX execs, and then test them.
REXX/CICS Supports Multiple Transaction Identifiers
REXX/CICS supports the ability to associate transaction identifiers (TRANIDs), other than REXX, with the
REXX/CICS support program. In this case, the name of the REXX exec that is issued is determined by a
previous DEFTRNID command. This gives you the ability to still use transaction security with REXX on an
exec by exec basis.
REXX/CICS File Security
Access at the RFS directory level is controlled with the RFS AUTH command and the RFS replaceable
security exit.
ESA/VSE Command Level Security
In some situations, current software practices limit the effectiveness of relying on CICS resource security
alone. For additional security control, REXX/CICS was designed with the concept of command level
security. Because most facilities under REXX/CICS are accessed as commands, command level security
can be used to control access to CICS (and other product or system) facilities. For example, VSAM file
access is accomplished through the READ, WRITE, and REWRITE commands.
REXX/command level security is controlled by the DEFSCMD and DEFCMD AUTH parameter and by the
provision of authorized REXX/CICS library support.
Command execution security controls the use of certain REXX/CICS commands, or command keywords.
In general, this is accomplished by the designation of certain commands (or command options) as
authorized. Such command designation is accomplished by the DEFCMD and DEFSCMD commands. For
authorized commands to execute properly, they must either be:
1. Executed from an exec loaded from a VSE Librarian sublibrary specified on a SETSYS AUTHCLIB or
SETSYS AUTHELIB command.
2. Executed by an authorized user. A user can be authorized by the AUTHUSER command.
REXX/CICS Authorized Command Support
Any REXX/CICS command can be identified as authorized by a REXX/CICS Systems Administrator.
Authorized commands can only be successfully executed in an exec that is issued by an authorized
REXX/CICS user or that was loaded from an authorized REXX/CICS sublibrary. Only authorized
REXX/CICS users have access to the commands and execs in the “authorized command” sublibraries
specified on the SETSYS AUTHCLIB command. All users have the ability to run execs in the “authorized
exec” sublibraries specified on the SETSYS AUTHELIB command. All users can run execs in sublibraries
specified in the LIBDEF PROC search chain for the CICS partition. Authorized users can be defined by
any existing authorized user or in an authorized exec. The REXX/CICS CICSTART exec that is called at
REXX/CICS initialization (at the first REXX/CICS transaction after a CICS restart) is automatically
© Copyright IBM Corp. 1992, 2009
421
Summary of Contents for SC34-5764-01
Page 1: ...CICS Transaction Server for VSE ESA REXX Guide SC34 5764 01...
Page 2: ......
Page 3: ...CICS Transaction Server for VSE ESA REXX Guide SC34 5764 01...
Page 22: ...xx CICS TS for VSE ESA REXX Guide...
Page 23: ...Part 1 User s Guide Copyright IBM Corp 1992 2009 1...
Page 24: ...2 CICS TS for VSE ESA REXX Guide...
Page 40: ...18 CICS TS for VSE ESA REXX Guide...
Page 54: ...Using Variables and Expressions 32 CICS TS for VSE ESA REXX Guide...
Page 106: ...84 CICS TS for VSE ESA REXX Guide...
Page 110: ...88 CICS TS for VSE ESA REXX Guide...
Page 122: ...100 CICS TS for VSE ESA REXX Guide...
Page 123: ...Part 2 Reference Copyright IBM Corp 1992 2009 101...
Page 124: ...102 CICS TS for VSE ESA REXX Guide...
Page 130: ...Introduction 108 CICS TS for VSE ESA REXX Guide...
Page 152: ...REXX General Concepts 130 CICS TS for VSE ESA REXX Guide...
Page 224: ...Functions 202 CICS TS for VSE ESA REXX Guide...
Page 252: ...230 CICS TS for VSE ESA REXX Guide...
Page 278: ...256 CICS TS for VSE ESA REXX Guide...
Page 312: ...DB2 Interface 290 CICS TS for VSE ESA REXX Guide...
Page 316: ...High level Client Server Support 294 CICS TS for VSE ESA REXX Guide...
Page 340: ...318 CICS TS for VSE ESA REXX Guide...
Page 344: ...for execs Commands 322 CICS TS for VSE ESA REXX Guide...
Page 399: ...Part 3 Appendixes Copyright IBM Corp 1992 2009 377...
Page 400: ...378 CICS TS for VSE ESA REXX Guide...
Page 438: ...416 CICS TS for VSE ESA REXX Guide...
Page 442: ...System Definition Customization Administration 420 CICS TS for VSE ESA REXX Guide...
Page 446: ...Security 424 CICS TS for VSE ESA REXX Guide...
Page 448: ...426 CICS TS for VSE ESA REXX Guide...
Page 464: ...442 CICS TS for VSE ESA REXX Guide...
Page 466: ...444 CICS TS for VSE ESA REXX Guide...
Page 468: ...446 CICS TS for VSE ESA REXX Guide...
Page 476: ...454 CICS TS for VSE ESA REXX Guide...
Page 478: ...456 CICS TS for VSE ESA REXX Guide...
Page 479: ......
Page 480: ...SC34 5764 01...
Page 481: ...Spine information CICS TS for VSE ESA REXX Guide...