eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

WebSphere Application Server for z/OS AND OS/390These are the pieces in the distributed network that you must consider:■■■■You must authorize servers to the base operating system services in z/OS orOS/390. These services include eTrust CA-Top Secret security, databasemanagement, and transaction management.For the servers, you must distinguish between control regions and serverregions. Control regions run authorized system code, so they are trusted.Server regions run application code and are given access to resources, so youshould carefully consider the authorizations you give server regions.You must also distinguish between the level of authority given to run-timeservers compared to your own application servers. For example, the SystemManagement server needs the authority to start other servers, while yourown application servers do not need this authority.You must authorize clients (users) to servers and objects within servers. Thecharacteristics of each client requires special consideration:- Is the client on the local system or is it remote? The security of thenetwork becomes a consideration for remote clients.- Will you allow unidentified (unauthenticated) clients to access thesystem? Some resources on your system can be intended for publicaccess, while others must be protected. In order to access protectedresources, clients must establish their identities and have authorizationto use those resources.- What kind of objects will the client access? Enterprise beans and CORBAobjects have differing authorization mechanisms.If you must protect resources, identifying who accesses those resources is critical.Thus, any security system requires client (user) identification, also known asauthentication. In a distributed network supported by WebSphere for z/OS,clients can be accessing resources from:■■■■Within the same system as a serverWithin the same sysplex as the serverRemote z/OS or OS/390 systemsHeterogeneous systems, such as WebSphere on distributed platforms, CICS,or other CORBA-compliant systems.Additionally, clients can request a service that requires a server to forward therequest to another server. In such cases the system must handle delegation, theavailability of the client identity for use by intermediate servers and targetservers.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–37