eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret and the SYSPLEX XES FunctionHow does this all work? You must first define the list structure to the CouplingFacility. Then for each system enter a TSS MODIFY (SYSPLEX) command todefine the connect-name, structure-names, and group-name, and toautomatically connect each system to the Coupling Facility.The Security File ENQ record, the first physical record in the Security File, isused to keep control information about the Security file, including file lockingstatus. The ENQ record includes the Coupling Facility structure name, and theCoupling Facility validity record includes the volume serial number (VOLSER)of the Security File. This information is stored by the first system that connects tothe Coupling Facility structure, and is used by systems that connect subsequentlyto ensure that a unique Security File data set and structure name combination isused among all connected systems. When a local system attempts to lock theSecurity File, the structure name in the Security File ENQ record is compared tothe local system's currently defined structure.Whenever the Security File is locked by a non-Coupling Facility connectedsystem, the structure name found within the ENQ record is validated to beactive, and the local system connects to the same structure, before proceedingwith any update activity against the file.While the current system is active in the Coupling Facility, if the Security FileENQ record is altered by another system and it no longer contains the structurename, all systems are forced to disconnect from the Coupling Facility.When a Coupling Facility connected system manually disconnects from thestructure, all other connected systems are forced to disconnect as well, to ensurethat no residual data is left in the Coupling Facility while one of the systems isrunning without an XES connection. An XES sysplex connection without an XCFconnection is allowed.After a system is forced to disconnect from a structure, as a result of a manualdisconnect command, all other connected systems are forced to disconnect. Nore-connect is attempted until a new structure is allocated in the Coupling Facilityby a manual connect command, or by a new system starting up. To determine ifa structure was reallocated, use the TSS MODIFY(STATUS(SYSPLEX))command, or the D XCF,STR OS/390 operator command. Compare the currentversion number to the version number of the previous connection.3–4 Cookbook