CICS Nov title - CBT Tape

Prior to APAR PQ36169, the security implementation for direct Web/
CICS transactions was dependent on the systems programmer
implementing some flavour of the user-replaceable analyser program.
For non-SSL connections, two sample sets of analysers were made
available with CICS, one using an HTML sign-on dialog, the other
using Basic Authentication headers. (Further sample security analysers
are available on the CICS Supportpac Web site.)
If you’re using SSL connections, client authentication was made
almost impossible because of the lack of support for automatic
registration of client certificates.
With this APAR we now have a much simpler way to manage SSL and
non-SSL connections using the new TCPIPSERVICE parameter
AUTHENTICATE:
AUTHENTICATE(NO|BASIC|CERTIFICATE|AUTOREGISTER|AUTOMATIC)
where:
• NO – no authentication of the client is required. However, if a
registered certificate is provided by the client, it is used. This is
the default.
• BASIC – HTTP Basic Authentication of the client is attempted.
You do not need to use the sample analysers to implement HTTP
basic authentication.
• CERTIFICATE with SSL(CLIENTAUTH ) – a valid X.509
client certificate is required from the client, and it must map to a
valid trusted user-id in the external security manager’s database.
If such a certificate is not received, the connection is rejected with
an HTTP 403 response.
• AUTOREGISTER with SSL(CLIENTAUTH ) – this allows the
client to register a certificate automatically. If the client presents
a certificate that is not registered, an HTTP Basic Authentication
dialogue is entered in which the client must enter the user-id for
which the certificate is to be registered.
• AUTOMATIC – this combines the AUTOREGISTER and BASIC
functions.
44 © 2000. Xephon UK telephone 01635 33848, fax 01635 38345. USA telephone (303) 410 9344, fax (303) 438 0290.