eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Certificate Name Filtering SupportDCDSN—Specifies the name of a data set that contains a digital certificate. TheSDNFILTR or IDNFILTR data must match a portion of the subject/issuer’sdistinguished name extracted from the certificate. The distinguished name fromthe point of the match to the end of the name is used as the filter data.TRUST/NOTRUST—When specified it indicates whether this mapping can beused to associate a userid to a certificate presented by a user accessing thesystem. If neither TRUST nor NOTRUST is specified, the default is NOTRUST.Managing Criteria MapsWhen the acid is MULTIID and the CRITERIA keyword was specified on the TSS ADDCERTMAP command, criteria data must be defined in CRITMAP records to identify theacid to be associated with a certificate. The acid name on the CRITMAP record identifiesthe user when the filter that matched the certificate was for acid MULTIID. The TSSADD|REM|REPL|LIST commands is used to manage criteria maps. The syntax of theADD command follows:TSS ADD(userid) CRITMAP(recid){SYSID(system identifier)}{CNFAPP(application name)}{CNFUVAR(site variable list)}Userid—Name of the acid to be associated with this filter.CRITMAP—Unique 8-byte record identifier.SYSID—The system identifier. A maximum of 4 characters can be specified andthe value can contain an asterisk (*) for masking.CNFAPP—The application variable. A maximum of 8 characters can be specifiedand the value can contain an asterisk (*) for masking.CNFUVAR—A list of application-defined variables that are defined asCRITERIA keyword data. This field can contain up to 255 uppercase characters.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–77