Running providers in separate address spaces

In a conventional CIM server setup, all providers are processed in the CIM server’s address space. Only when the CIM server is running in a multi level secured (MLS) z/OS system, providers are executed in several provider agent processes depending on the user's security classification and port of entry, independent of the CIM server configuration.

If the CIM server is not running in an MLS system, you may want to run CIM providers in separate processes to protect the CIM server from failing CIM providers or to protect the CIM providers from each other. Rather than loading and calling CIM provider libraries directly within the CIM server process one or more provider agent processes are then started that will run the CIM provider code. In this case you can enable the out-of-process support (OOP) for providers. This is an enhanced version of the OpenPegasus out-of-process provider feature

To turn on out-of-process support, 

• _ Set the configuration property forceProviderProcesses to true.

  (See Changing planned configuration properties)

If the Enhanced Security model is enabled (that is, the CIM server is not privileged),  

• _ Grant the CIM server user ID READ access to the profile BPX.JOBNAME defined in the FACILITY class.

  This allows the CIM server to set the job name of the out-of-process agent to CFZOOPA.

  Example for the security product RACF®:

  RDEFINE FACILITY BPX.JOBNAME UACC(NONE)
  PERMIT BPX.JOBNAME CL(FACILITY) ACCESS(READ) ID(CFZSRV)
  SETROPTS CLASSACT(FACILITY) RACLIST(FACILITY) REFRESH

  where CFZSRV is the CIM server user ID.

When the out-of-process support is enabled, the z/OS-specific provider property ShareAS and the property ModuleGroupName for class PG_ProviderModule are used. These properties specify whether a provider should run in its own address space, optionally grouped with other providers, or should be processed in the CIM server address space. They are set during provider registration via the registration MOF file. ModuleGroupName can also be set dynamically at runtime using the -g option of the cimprovider command.