14 Managing Security for Oracle Connect for IMS, VSAM, and Adabas Gateways

14.1.1 Setting Up the Password Caching Policy in Oracle Studio for IMS, VSAM, and Adabas Gateways

Oracle Studio for IMS, VSAM, and Adabas Gateways can cache passwords that are used for accessing servers and databases. The following security levels are supported:

• Oracle Studio for IMS, VSAM, and Adabas Gateways does not cache passwords. When Oracle Studio for IMS, VSAM, and Adabas Gateways needs a password to access a server or database, it prompts the user to enter the password. This is the safest level, but it is less convenient.

• Oracle Studio for IMS, VSAM, and Adabas Gateways caches passwords persistently but protects them through a master password. At this security level, Oracle Studio for IMS, VSAM, and Adabas Gateways prompts for the master password at startup.

• Oracle Studio for IMS, VSAM, and Adabas Gateways caches passwords persistently but hides them through a fixed internal master password. This security level is convenient but not safe because the cached password can be retrieved any time. This level is not recommended.

To set the password caching policy of Oracle Studio for IMS, VSAM, and Adabas Gateways

1. In Oracle Studio for IMS, VSAM, and Adabas Gateways, point to Windows, then select Preferences.

2. Select the Studio node.

3. On the Security tab, do the following:

   • For the highest security level, clear the Remember passwords check box.

   • For a lower security level, do the following:

     Click Change master password. The Change master password dialog box opens.

     Enter a master password and confirm it. Then click OK.

     Select the Remember passwords check box.

   Note:

   If you set a master password, Oracle Studio for IMS, VSAM, and Adabas Gateways will prompt you for the password the next time you open the application. If you set the master password to an empty password, Oracle Studio for IMS, VSAM, and Adabas Gateways will use the internal default password.

4. Click OK to save your settings.

14.1.2 Setting Up Administration Access to a Machine

To administrate an Oracle Connect for IMS, VSAM, and Adabas Gateways machine, you must add it to Oracle Studio for IMS, VSAM, and Adabas Gateways. Administrative access requires that you provide Oracle Studio for IMS, VSAM, and Adabas Gateways with an Oracle Connect for IMS, VSAM, and Adabas Gateways administrator account and password.

The Oracle Connect for IMS, VSAM, and Adabas Gateways administrator account is the account that you specified during the installation of Oracle Connect for IMS, VSAM, and Adabas Gateways on this machine or when running NAV_UTIL ADD_ADMIN.

You specify the administrator account and password in the Add machine screen, in the Connection area, as shown in Figure 14-1.

Figure 14-1 Password Entry in Add Machine Screen

Description of "Figure 14-1 Password Entry in Add Machine Screen"

14.1.3 Assigning Design Roles

After you defined a machine in Oracle Studio for IMS, VSAM, and Adabas Gateways, you can grant viewing and editing rights to users and groups according to their roles in the design process.

The following roles are available:

• Administrator: Allowed to edit all of the definitions in Oracle Studio for IMS, VSAM, and Adabas Gateways.

• Designer: Allowed to edit binding definitions and view daemon definitions in Oracle Studio for IMS, VSAM, and Adabas Gateways.

• User: Allowed to view the definitions in Oracle Studio for IMS, VSAM, and Adabas Gateways.

Perform the following steps to assign design roles to users and groups.

1. In the Configuration view, right-click the machine and select Administration Authorization.

2. In the Administration Authorization screen, click Add User or Add Group to assign authorization to specific users or a specific group of users. The name cannot contain blanks.

14.1.4 Assigning Authorization Rights to a Workspace

After you defined a machine in Oracle Studio for IMS, VSAM, and Adabas Gateways, you can authorize the viewing and editing rights for specific workspaces.

Perform the following steps to assign authorization rights to a workspace.

1. In the Design perspective, in the Configuration view, right-click the machine and select Set Authorization.

2. Specify the user name and password for the user with authorization rights for this workspace.

14.1.5 Setting Up a Master Password for a User Profile

The definition of a user profile stores the user names and passwords that are required to access databases and remote machines. To protect this information, you can assign a master password to a user profile. If you do not assign a password, anyone can use the information stored in the definition.

Perform the following steps to set a master password for a user profile.

1. In the Design perspective, in the Configuration view, expand the machine that contains the user profile definition.

2. Expand the Users node.

3. Right-click the relevant user and select Change User Password.

4. Enter the relevant information and click OK.

14.2.1 Granting Daemon Administration Rights to Users

You can grant a user run-time administration rights to the daemon. An administrator has the right to perform actions such as starting and shutting down a daemon, recycling servers of all workspaces, and updating the configuration of an active daemon.

Perform the following steps to grant daemon administration rights to a user.

1. In the Design perspective, in the Configuration view, expand the relevant machine.

2. Expand the Daemons node.

3. Right-click the daemon and select Edit Daemon.

4. In the daemon editor, on the Daemon Security tab, in the Administrator privileges area, click Selected user only, as shown in Figure 14-2.

   Figure 14-2 Administrator Privileges in the Daemon Security Tab

   
   Description of "Figure 14-2 Administrator Privileges in the Daemon Security Tab"
   
   

5. Click Add Group or Add User to grant administration rights to a group or user.

   Note:

   On z/OS platforms, to define a group of users, preface the name of the group in the configuration with '@'. The group name is validated by a security system such as RACF.

The Source tab shows the result in XML. For example:

• To prevent anonymous access and limit administration rights to a user called sysadmin:

  <security anonymousClientAllowed="false" administrator="sysadmin" />
  

• To allow anonymous access to a server and to grant all users administration right:

  <security anonymousClientAllowed="true" administrator="*" />
  

<security anonymousClientAllowed="false"          administrator="sysadmin,@sys" />

14.2.2 Granting Workspace Administration Rights to Users

You can grant a user runtime workspace administrative rights for a specific workspace. These rights allow a user to enable, disable, and recycle workspace server.

Perform the following steps to grant administrative rights to a workspace.

1. In the Design perspective, in the Configuration view, expand the relevant machine.

2. Expand the Daemons node.

3. Expand the node of the relevant daemon.

4. Right-click the workspace and select Edit Workspace.

5. In the workspace editor, on the WS Security tab, in the Administration area, click Selected user only, as shown in Figure 14-3.

   Figure 14-3 Administrator Privileges in the WS Security Tab

   
   Description of "Figure 14-3 Administrator Privileges in the WS Security Tab"
   
   

6. Click Add Group or Add User to grant administration rights to a group or user.

   Note:

   To define a group of users on z/OS platforms, preface the name of the group in the configuration with '@'. The group name is validated by a security system such as RACF.

The Source tab shows the result in XML. For example:

• Users must enter the correct user name and password to use a workspace. All authenticated users have workspace administration rights. This is defined as follows:

  <workspace name="Navigator"
     description="An Oracle Server"
     startupScript="ATSRVR50.XY"
     serverMode="reusable" reuseLimit="0"
     anonymousClientAllowed="false"
     administrator="*" />
  </workspace>
  

• Users must enter the correct user name and password to use a workspace. Only the user SYSADMIN has administrator rights. This is defined as follows:

  <workspace name="Navigator"   
     description="An Oracle Server"
     startupScript="ATSRVR50.XY"
     serverMode="reusable" reuseLimit="0"  
     anonymousClientAllowed="false"
     administrator="SYSADMIN" />
  </workspace>
  

14.2.3 Granting Workspace Access Rights to a User

Clients log in to the daemon and request that a server be allocated to a particular workspace. When the client logs in, it provides its login credentials, that is the user name and password. The request for a specific workspace server is granted only if the logged-on user was granted access to the workspace.

By adding a user to the list of workspace users, you grant them access to the workspace servers only. If a database on the server requires additional authentication, you need to create a user profile definition with the name of this user.

Perform the following steps to grant workspace access to a user.

1. In the Design perspective, in the Configuration view, expand the relevant machine.

2. Expand the Daemons node.

3. Right-click the daemon and select Edit Daemon.

4. In the daemon editor, on the WS Security tab, in the Workspace Access area, click Selected user only, as shown in Figure 14-4.

   Figure 14-4 Workspace Users in the WS Security Tab

   
   Description of "Figure 14-4 Workspace Users in the WS Security Tab"
   
   

5. Click Add User to grant a user access to the workspace.

   Note:

   On z/OS platforms, to define a group of users instead of a single user (so that the group name is validated by a security system), preface the name of the group in the configuration with '@'.

6. Save your settings.

14.2.4 Accessing a Server through a Firewall

Oracle Connect for IMS, VSAM, and Adabas Gateways lets you access a server through a firewall. Table 14-1describes the available options.

HS_FDS_CONNECT_INFO="address='mvs.acme.com' port='2551' firewallProtocol='fixednat'

14.2.5 Encrypting Network Communications

Because Oracle Database Gateway for IMS, VSAM, and Adabas runs on UNIX or Windows and the networking layer that connects to the data sources runs on IBM z/OS, network communications should be encrypted. The networking layer of Oracle Database Gateway for IMS, VSAM, and Adabas uses an RPC-like protocol with message primitives that are similar in concept to the Microsoft OLEDB API.

CREATE DATABASE LINK [link_name]
CONNECT TO "[user_name]#[key_name]"
IDENTIFIED BY "[password]#[key_value]"

CREATE DATABASE LINK sales
CONNECT TO "sales1#saleskey"
IDENTIFIED BY "Sales1#123456"

14.2.6 Setting Up Impersonation

Impersonation is the ability of a server to execute in a security context that is different from the context of the process that owns the server.

The primary reason for impersonation is to cause access checks to be performed against the client's identity. Using the client's identity for access checks can cause access to be either restricted or expanded, depending on what the client has permission to do.

For example, suppose a file server has files containing confidential information and that each of these files is protected by a security system. To prevent a client from obtaining unauthorized access to information in these files, the server can impersonate the client before accessing the files.

To set up impersonation

1. On z/OS platforms, APF-authorize all the steplibs in the server script. For example:

   setprog... ada622-volume adavol
          CICS.CICS.SDFHEXCI - p390dx
          navroot.load - 111111
          navroot.loadaut - 111111
   

   where navroot is the high-level qualifier where Oracle Connect for IMS, VSAM, and Adabas Gateways is installed.

2. On all platforms, on the WS Security tab of the daemon editor, leave the Workspace account field empty, as shown in Figure 14-8.

   Figure 14-8 Workspace Account Setting on the WS Security Tab

   
   

3. On the Client platform, define a user profile for the server machine with the required username and password for the remote machine in the user profile.

4. Add a new user authenticator with the resource type defined as remote machine, as follows:

   Open Oracle Studio for IMS, VSAM, and Adabas Gateways.

   In the Configuration view, right-click the user profile and select Edit User.

   In the User editor, select the client machine and click Add.

   In the Add Authenticator screen, set the Resource type to Remote machine.

   Specify the resource name and, if required, authentication information; then click OK.