eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

z/OS and OS/390 Security Server SupportDCE Security ServerThe DCE Security Server is a separate security product that providesauthentication services for users and servers running DCE applications.In a DCE environment, one DCE Security Server must exist. A DCE securityserver provides a central hub for system entry validation and single-sign onauthentication for all DCE platforms within a connected DCE environment. Akey concept of a DCE security server is that it provides an independent orso-called third-party platform in which to validate and authenticate securityrequests. This concept provides obvious security advantages.For example, when a user passes from one DCE platform to another, the targetplatform passes information about the user (so-called user credentials) alongwith other information to the DCE security server for authentication andauthorization. The DCE security server authenticates such requests by checkingthe supplied user credentials against those stored in the DCE security server'ssecurity repository and/or security registry. In performing this authentication,the DCE security server follows an authentication algorithm, which involves notonly the user credentials but also involves encryption keys known for eachplatform. The algorithm is standards-based and is platform independent. As aresult, multiple vendors and platforms offer a DCE security server.IBM's z/OS and OS/390 OE/DCE Security Server product allows an IBMmainframe to perform these functions.With z/OS and OS/390 O/E DCE security server, eTrust CA-Top Secret isutilized mainly to act as a repository for information needed to support the DCEauthentication process. In particular, the eTrust CA-Top Secret is used to holdDCE-specific userid information and encryption keys. Most notably, a 'DCEsegment' can now be defined for any userid. The DCE userid segment allows sixDCE-specific fields to be maintained for any userid. For example, one fieldnamed DCEKEY identifies each user's DCE password. During authentication, theDCE security server retrieves this and other information from eTrust CA-TopSecret following formal SAF interfaces. This information is then used separatelyto authenticate and authorize the DCE security server request. As stated, eTrustCA-Top Secret acts mainly as a repository for DCE information.eTrust CA-Top Secret provides for the following functions:■■■■support for the DCE segment for any userid;support for the KEYSMSTR resource class used to hold keys for DCEpassword encryption;support for the DCEUUIDS resclass used to track the correspondencebetween z/OS or OS/390 userids and DCE UIDs;support for four new callable services used to exchange information betweenthe ESM and the DCE security server.1–96 Cookbook