Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

document missing commands #3985

Merged
merged 27 commits into from
Nov 14, 2024
Merged
Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
527763d
fix commands and add note
taban03 Nov 6, 2024
5130f51
add missing commands for ACF2 and TSS
taban03 Nov 7, 2024
2c29194
add missing commands for ACF2 and TSS for passticket verification
taban03 Nov 7, 2024
76d99f8
address pr review pt.1
taban03 Nov 7, 2024
71e2ffe
address pr review pt.2
taban03 Nov 8, 2024
64d1c66
fix indentation
taban03 Nov 8, 2024
2bc69af
language refactor configuration-extender-passtickets
janan07 Nov 8, 2024
dce055c
fix ESM formatting
janan07 Nov 8, 2024
8c41e98
add collapsible content for ESMs
janan07 Nov 8, 2024
cebbd79
Update docs/user-guide/api-mediation/configuration-extender-passticke…
janan07 Nov 11, 2024
3c5de6f
Update versioned_docs/version-v2.18.x/user-guide/api-mediation/config…
janan07 Nov 11, 2024
9705454
add collapsible content
janan07 Nov 11, 2024
293a85a
Merge branch 'master' into fix_passticket_commands
janan07 Nov 11, 2024
5ed0fa9
formatting
janan07 Nov 11, 2024
58019d0
Merge branch 'master' into fix_passticket_commands
janan07 Nov 11, 2024
432180b
address PR comments
taban03 Nov 12, 2024
bf71420
address PR comments
taban03 Nov 12, 2024
8018d21
Merge branch 'master' into fix_passticket_commands
taban03 Nov 13, 2024
d4c91a4
Update configuration-extender-passtickets.md
janan07 Nov 13, 2024
459bfa2
text commit
janan07 Nov 13, 2024
588b0ab
fix formatting
janan07 Nov 13, 2024
97c8aed
Merge branch 'master' into fix_passticket_commands
taban03 Nov 14, 2024
8332be3
Merge branch 'master' into fix_passticket_commands
taban03 Nov 14, 2024
a6af5cd
fix formatting
janan07 Nov 14, 2024
0629b28
fix formatting
janan07 Nov 14, 2024
a008030
fix order of ESMs in verifying section
janan07 Nov 14, 2024
6890cac
minor numeration fix
janan07 Nov 14, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 71 additions & 25 deletions docs/user-guide/api-mediation/configuration-extender-passtickets.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,29 +29,36 @@ Since the Zowe 2.17 release, it is no longer necessary to disable replay protect
This section applies to users who do not already have PassTickets enabled in the system, or users who need to define a PassTicket for a new APPLID. If you already have an APPLID that you intend to use to define your API service, skip to the section [Configuring security to allow the Zowe API Gateway to generate PassTickets for an API service](#configuring-security-to-allow-zowe-api-gateway-to-generate-passtickets-for-an-api-service).

:::tip
To validate if a PassTicket is already defined, list the APPL and PKTDATA with a command corresponding to your ESM. Output indicates if a PassTicket is already defined. No results after issuing an ESM command indicates that a PassTicket is not defined. If a PassTicket is defined, the access of the zoweuser can be determined.
To validate if a PassTicket is already defined, list the APPL and PTKTDATA with a command corresponding to your ESM. Output indicates if a PassTicket is already defined. No results after issuing an ESM command indicates that a PassTicket is not defined. If a PassTicket is defined, the access of the ZWESVUSR can be determined.

- **Validating an existing PassTicket for ACF2**

<details>

<summary>Click here for command details about validating an existing PassTicket for ACF2.</summary>
<summary>Click here for procedure details about validating an existing PassTicket for ACF2.</summary>

In your ESM command line interface or other security environment, execute the following commands:
In your ESM command line interface or other security environment, perform the following steps:

```acf2
SET RESOURCE(SAF)
LIST LIKE(-)
1. Issue a `SHOW CLASMAP` command in TSO ACF to verify if the APPL resource is defined in the GSO. Note the 3 character type code associated with APPL. If APPL does not appear in the SHOW CLASMAP listing, run the following commands:

SET RESOURCE(SAF)
LIST LIKE(<applid>-)
```acf2
SET CONTROL(GSO)
INSERT CLASMAP.appl RESOURCE(APPL) RSRCTYPE(APL)
F ACF2,REFRESH(CLASMAP)
```

2. Replace 'APL' with the type code listed in the SHOW CLASMAP output:
```
SET RESOURCE(APL)
LIST LIKE(<applid>-)
```
3. Verify if PTKTDATA is defined, by executing the following commands:
```
SET PROFILE(PTKTDATA) DIVISION(SSIGNON)
LIST LIKE(<applid>-)

SET RESOURCE(PTK)
LIST LIKE(IRRPTAUTH-)
```
```

- **`-`**
A wildcard symbol that lists all resources
Expand All @@ -67,13 +74,14 @@ To validate if a PassTicket is already defined, list the APPL and PKTDATA with a

<summary>Click here for command details about validating an existing PassTicket for Top Secret.</summary>

In your ESM command line interface or other security environment, execute the following commands:
1. In your ESM command line interface or other security environment, execute the following commands:

```tss
TSS WHOHAS APPL(<applid>)
TSS WHOHAS PTKTDATA(<applid>)
TSS WHOHAS PTKTDATA(IRRPTAUTH.<applid>.)
```
2. If APPL and PTKTDATA are not yet defined, follow the steps to create them as described in the [Enabling PassTickets with Top Secret](#enabling-passtickets-with-top-secret) section.

- **`.`**
A wildcard symbol that lists all resources
Expand All @@ -98,7 +106,7 @@ To validate if a PassTicket is already defined, list the APPL and PKTDATA with a
RLIST PTKTDATA IRRPTAUTH.<applid>.* ALL
```

Ensure that you validate PKTDATA access for APPL.
Ensure that you validate PTKTDATA access for APPL.

- **`*`**
A wildcard symbol that resturns all resources
Expand All @@ -121,12 +129,19 @@ Follow these steps to enable PassTicket Support specific to your ESM.

<summary> Click here for command details about configuring Zowe to use PassTickets using ACF2. </summary>

1. In your ESM command line interface or other security environment, define the application session key by entering the following commands, if the session key is not already defined.
1. Issue the `SHOW CLASMAP` command in TSO ACF to identity the 3 character type code associated with APPL. Replace 'APL' with the type code listed in the SHOW CLASMAP output:

```acf2
taban03 marked this conversation as resolved.
Show resolved Hide resolved
SET RESOURCE(APL)
RECKEY <applid> ADD(UID(<user>) ALLOW)
F ACF2,REBUILD(APL)
```
2. In your ESM command line interface or other security environment, define the application session key by entering the following commands if the session key is not already defined.

```acf2
SET PROFILE(PTKTDATA) DIV(SSIGNON)
INSERT <applid> SSKEY(<key-description>)
F ACF2,REBUILD(PTK),CLASS(P)
SET PROFILE(PTKTDATA) DIV(SSIGNON)
INSERT <applid> SSKEY(<key-description>)
F ACF2,REBUILD(PTK),CLASS(P)
```

* **`applid`**
Expand All @@ -135,15 +150,15 @@ Specifies the application ID used for PassTicket validation to authenticate conn
* **`key-description`**
Specifies the secured sign-on hexadecimal application key of 16 hexadecimal digits (8-byte or 64-bit key). Each application key must be the same on all systems in the configuration and the values must be kept secret and secured.

2. Complete the PassTicket setup by entering the following commands:
3. Complete the PassTicket setup by entering the following commands:

```acf2
F ACF2,REBUILD(PTK),CLASS(P)
```

The PassTicket record is now active in the system.

3. Enable the started task user ID to generate PassTickets for the application by entering commands similar to the following:
4. Enable the started task user ID to generate PassTickets for the application by entering commands similar to the following:

```
SET RESOURCE(PTK)
Expand All @@ -164,7 +179,7 @@ You configured Zowe to use PassTickets for single sign on using ACF2.
<summary> Click here for command details about configuring Zowe to use PassTickets using Top Secret.</summary>


Before you begin this procedure, verify that the `PTKTDATA` class and ownership for the PassTicket resource (`IRRPTAUT`) have not already been defined as described in the previous tip.
Before you begin this procedure, verify that the `PTKTDATA` class and ownership for the PassTicket resource (`IRRPTAUTH`) have not already been defined as described in the previous tip.

1. Update the resource descriptor table (RDT) to define the `PTKTDATA` class by entering the following commands:

Expand All @@ -181,11 +196,13 @@ Before you begin this procedure, verify that the `PTKTDATA` class and ownership
Include `RESCODE(n)` in the range of 101 to 13F to make `PTKTDATA` a prefixed resource class.
:::

2. Assign ownership for the PassTicket resource (`IRRPTAUT`). Execute the following commands:
2. Assign ownership for the PassTicket resource (`IRRPTAUTH`). Execute the following commands:
```
TSS ADDTO(department) PTKTDATA(IRRPTAUT)
TSS ADDTO(<department>) PTKTDATA(IRRPTAUTH)
```

- **`department`**
Specifies the department for `PTKTDATA(IRRPTAUTH`. The default department is `TSODEPT1`.
janan07 marked this conversation as resolved.
Show resolved Hide resolved

3. Define PassTicket for application ID _applid_:

```tss
Expand Down Expand Up @@ -350,13 +367,42 @@ Grant the Zowe started task user ID permission to generate PassTickets for users

### Verifying your PassTicket Application

In your ESM command line interface or other security environment, execute the following commands:
In your ESM command line interface or other security environment, execute the commands that correspond to your ESM:

<details>
<summary>Click here for command details for RACF</summary>

**RACF:**
```racf
RLIST APPL <applid> ALL
RLIST PTKTDATA IRRPTAUTH.<applid>.* ALL
RLIST APPL <applid> ALL
RLIST PTKTDATA IRRPTAUTH.<applid>.* ALL
```

</details>

<details>
<summary>Click here for command details for Top Secret.</summary>

**TSS:**
```tss
TSS WHOHAS APPL(<applid>)
TSS WHOHAS PTKTDATA(IRRPTAUTH.<applid>)
```

</details>

<details>
<summary>Click here for command details for ACF2.</summary>

**ACF2:**
```acf2
SET RESOURCE(SAF)
taban03 marked this conversation as resolved.
Show resolved Hide resolved
LIST LIKE(<applid>-)
SET RESOURCE(PTK)
LIST LIKE(IRRPTAUTH-)
```
</details>

* **`applid`**
Specifies the application ID used for PassTicket validation to authenticate connections to the server

Expand Down
Loading
Loading