IBM Server GC28-1920-01 Manual de usuario descargar pdf (Pagina 61)

Chapter 7. Administration Considerations

This chapter summarizes the changes to administration procedures that the security

administrator should be aware of. For more information, see

OS/390 Security

Server (RACF) Security Administrator's Guide

OS/390 OpenEdition DCE

The interoperation of RACF with OS/390 OpenEdition DCE enables DCE

application servers on MVS to map a DCE user identity

(principal)

to a RACF user

ID. The mapping of a DCE principal to a RACF user ID is known as

cross-linking

The cross-linking information contained in the RACF database can be used by:

 OS/390 OpenEdition DCE, for determining which MVS users are eligible for

OS/390 OpenEdition DCE single signon to DCE

 Application servers residing on OS/390, to determine the RACF user ID of

clients. For more information on application servers and their use of identity

cross-linking contained in RACF, see “OS/390 OpenEdition DCE Application

Considerations” on page 39.

To support the

cross-linking

and

single signon to DCE

features, RACF provides:

 The DCE segment for the RACF user profile

 The DCEUUIDS general resource class

The DCE segment, defined to the RACF user profile, associates a DCE principal

with the RACF user profile. See Figure 17 on page 20 for the contents of the DCE

segment.

The DCEUUIDS general resource class contains the cross-linking information for

each RACF/DCE user. Profiles defined to the RACF DCEUUIDS class associate a

DCE principal with a RACF user ID on a particular system that is part of a DCE

cell.

The security administrator must work with the DCE administrator to define RACF

profiles to support the

cross-linking

and

single signon to DCE

features.

Cross-Linking Between RACF Users and DCE Principals

Profiles in the DCEUUIDS class establish a cross-link between a DCE principal

UUID and a RACF user ID. Two OpenEdition DCE utilities administer DCE

information in the RACF database and create the initial cross-link information

between the RACF user profile and the DCE principal registry:

mvsimpt is a two-pass utility that creates DCE principal entries in the DCE

registry for the set of RACF users chosen to be cross-linked, based on

the output from the RACF database unload utility. The unloaded RACF

database is sorted by the administrator according to RACF user IDs with

a RACF DCE segment and filtered by the utility according to processed

entries from previous mvsimpt and mvsexpt processing.

mvsexpt is a two-pass utility that populates a RACF database with information for

a set of DCE principals. It creates and updates the RACF DCE

segment for each DCE principal being cross-linked with the RACF

1 2 ... 56 57 58 59 60 61 62 63 64 65 66 ... 109 110

Comentarios a estos manuales

Sin comentarios

IBM Server GC28-1920-01 Manual de usuario Pagina 61

Comentarios a estos manuales

Relacionado con productos y manuales para Servidores IBM Server GC28-1920-01