eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

WebSphere Application Server for z/OS AND OS/390Finally, in a distributed network, how do you ensure that messages being passedare confidential and have not been tampered? How do you ensure that clients arewho they claim to be? How do you map network identities to z/OS or OS/390identities? These issues are addressed by the following support in WebSphere forz/OS:■■■The use of SSL and digital certificatesKerberosDistributed Computing Environment (DCE)Network security is not required for your initial installation and customization ofWebSphere for z/OS. This information is provided to introduce you toWebSphere for z/OS security and allow you to make early planning decisionsabout system security. The following topics describe how WebSphere for z/OSsupports security. The descriptions are organized under the following subtopics:■■Authorization CheckingUser Identification, Authentication and Network SecurityAuthorization CheckingEach control region, server region, and client must have its own MVS user ID(more about user identification and authentication later). When a request flowsfrom a client to the server or from a server to a server, WebSphere for z/OSpasses the user identity (client or server) with the request. Thus each request isperformed on behalf of the user identity and the system checks to see if the useridentity has the authority to make such a request.ControlAccess control lists in LDAPCBIND classDATASET classDCEUUIDS and IBMFACclassesDSNR classEJBROLE classIBMFACAuthorizationControlled access to WebSphere for z/OSnaming and interface repository dataAccess to a serverAccess to data setsMapping DCE credentials to Top Secret userIdsAccess to DB2Access to methods in enterprise beansSSL key rings, certificates and mappings(IRR.DIGTCERT.GENCERT) &(IRR.DIGTCERT.LIST) &(IRR.DIGTCERT.LISTRING)1–38 Cookbook