eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

WebSphere Application Server for z/OS AND OS/390■The application assembler must assign method permissions to the bean ormethod using the Application Assembly Tool.– Define the roles relevant to the application. These role names mustmatch the resource names defined to Top Secret.– Once defined, the role can be assigned to access an application (as amethod permission).– After the application assembly is complete, the application must bereinstalled using the Administration application.Use the SOMDOBJS class in eTrust CA-Top Secret to control a client’s accessto CORBA objects. Resource names in SOMDOBJS have the form:■server_name.home.methodWhere server_name is the server name. It must be 8 characters or less. homeis the home name. It must be 192 characters or less. method is the methodname. It can be up to the length of the remainder of 244 minus the sum of theserver and home name lengths.Example:If the server name is 8 characters, and the home name is:128 characters, the method name can be 108 (244 - (8 + 128)). If a method isprotected by SOMDOBJS and:– A client program is using the method to update an attribute of an object,give the client UPDATE authorization for the method.– A client program is using the method to read an attribute of an object,give the client READ authorization for the method.All names are folded into uppercase characters, regardless of how youenter them. Thus, there is no difference betweenMY_server.MY_home.MY_method andMY_SERVER.MY_HOME.MY_METHOD.In addition to the SOMDOBJS definitions, you must specifymethod-level access checking through the WebSphere for z/OSAdministration application. Check the box for method-level accesschecking when you define your application’s container.Resource managers such as DB2, IMS, and CICS have implemented theirown resource controls, which control the ability of clients to access resources.When resource controls are used by DB2, use the DSNR Top Secret class orissue the relevant DB2 GRANT statements.Access to OTMA for IMS access is through the IBMFAC Class(IMSXCF.OTMACI). Access to EXCI for CICS is through the SURROGATclass (*.DFHEXCI). You can control access to data sets through the DATASETclass and HFS files through file permissions or the HFSSEC class.1–42 Cookbook