eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

WebSphere Application Server for z/OS AND OS/390You can use the CBIND class to restrict a client’s ability to access servers. Thereare two types of resources, WebSphere for z/OS uses in the CBIND class:■One that controls whether a local or remote client can access servers.The name of the resource has this form:CB.BIND.server_namewhere server_name is the name of the server.■One that controls whether a client can use objects in a server. The name ofthe resource has this form:CB.server_namewhere server_name is the name of the server.Note: When you add a new server, you must authorize all systemsmanagement user IDs (for example, CBADMIN) to have read access to theCB.server_name and CB.BIND.server_name resources.Example:CBADMIN needs read authority to the CB.BBOASR1 andCB.BIND.BBOASR1 servers:TSS ADD(deptacid) CBIND(CB.)TSS PERMIT(CBADMIN) CBIND(CB.BBOASR1) ACCESS(READ)TSS PERMIT(CBADMIN) CBIND(CB.BIND.BBOASR1) ACCESS(READ)Use the EJBROLE (or GEJBROLE) class in eTrust CA-Top Secret to control aclient’s access to enterprise beans. There are two distinct sets of tasks that arerequired to protect an application using EJB roles.■The security administrator must define the roles and set up access rights ineTrust CA-Top Secret.– Define a profile name using the EJBROLE (or GEJBROLE) class.Example:TSS ADD(dept) EJBROLE(ROLE_NAME)Where department is a department already defined in the Top Secretdatabase and role_name matches the security role attribute specified inthe jar file or for the application. A role name cannot contain blanks, andcannot exceed 245 characters. Role names, however, can be in mixedcase.Create membership in the role by permitting Top Secret userID’s orprofiles permission to the defined EJBROLE resource.Example:TSS PERMIT(acid) EJBROLE(role_name)Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–41