Configuring security for a Liberty JVM server

You can use the CICS® Liberty security feature to authenticate users and authorize access to web applications through Java™ Platform, Enterprise Edition roles, providing integration with CICS transaction and resource security. You can also use CICS resource security to authorize the appropriate users to manage the lifecycle of both the JVMSERVER resource and Java web applications that are deployed in a CICS BUNDLE resource.

Before you begin

Ensure that the CICS region is configured to use SAF security and is defined with SEC=YES as a system initialization parameter. Then authorize application developers and system administrators to create, view, update, and remove JVMSERVER and BUNDLE resources in order to deploy web applications into a Liberty JVM server. The JVMSERVER resource controls the availability of the JVM server, and the BUNDLE resource is a unit of deployment for the Java applications and controls the availability of the applications. The default behavior of the CICS TS security feature, cicsts:security-1.0, is to use the SAF registry. The basic user registry (which is also used by quickStartSecurity) is only suitable for simple security testing. Be aware that if you configure and run with basic user registry and you need to switch to cicsts:security-1.0, you will need to delete the session tokens.

About this task

This task explains how to configure security for a Liberty JVM server and integrate Liberty security with CICS security.

The default transaction ID for running any web request is CJSA. However, you can configure CICS to run web requests under a different transaction ID by using a URIMAP of type JVMSERVER. Typically, you might specify a URIMAP to match the generic context root (URI) of a web application to scope the transaction ID to the set of servlets that make up the application. Or you might choose to run each individual servlet under a different transaction with a more precise URI.

Procedure

  1. Configure the WebSphere® Liberty profile angel process to provide authentication and authorization services to the Liberty JVM server, see The Liberty server angel process.
  2. Add the cicsts:security-1.0 feature to the featuremanager list in the server.xml, 
    <featureManager>
   ...
   <feature>cicsts:security-1.0</feature>
</featureManager>
...
  3. Save the changes to server.xml.
    Note: Alternatively if you are autoconfiguring the Liberty JVM server and the SEC system initialization parameter is set to YES in the CICS region, the Liberty JVM server is dynamically configured to support Liberty JVM security when the JVM server is restarted. For more information, see Configuring a Liberty JVM server.
    If the SEC system initialization parameter is set to NO, you can still use Liberty security for authentication or SSL support. If CICS security is switched off, and you want to use a Liberty security, you must configure the server.xml file manually:
    1. Add the appSecurity feature to the featuremanager list.
    2. Add a user registry to authenticate users. Liberty security supports SAF and basic user registries. For more information, see Configuring a user registry for the Liberty profile.
    3. Add security-role definitions to authorize access to application resources, see Authorizing users to run applications in a Liberty JVM server.
Start of change

Results

When the cicsts:security-1.0 feature is used, the web container is automatically configured to use the z/OS® Security feature of Liberty. Additionally a SAF Registry is used for authentication, and Java Platform, Enterprise Edition roles in an <application-bnd> element are respected for authorization.End of change

What to do next

For more information about using Secure Sockets Layer (SSL), see Configuring SSL (TLS) for a Liberty JVM server.