How to setup TPX for Password Phrase in a Top Secret Environment ?

Products

• TPX - Session Management
• Vman Session Management for z/OS

Issue/Introduction

Question:

How to setup TPX for Password Phrase in a Top Secret Environment ?

 

Answer:

NOTE: Turning on Password Phrase support in Top Secret (TSS) or MVS is beyond the scope of this document and is not covered.

TPX Setup of Password Phrase in a TOP SECRET Environment

This document outlines what needs to be done to configure TPX to allow a site to process Password Phrase signons when running with Top Secret security. Turning on Password Phrase support inside Top Secret or MVS is beyond the scope of this document and is not covered.

After applying PTFs and APARs for TPX Password Phrase implementation in a Top Secret environment a site will need to:

• SMRT related parameters for allow Password Phrase signons.
• Use panel TEN1003 for Password Phrase signons.

NOTE: Before making the SMRT changes to implement Password Phrase, we recommend backing up the production ADMIN1 and ADMIN2 files and/or the SMRT configuration within TPXADMIN.

Password Phrase Related TPX 5.4 PTFs

Sites should consider installing all the following Password Phrase maintenance under TPX 5.4:

• PTF RO84473 - ACF2PWPH OUT OF SEQUENCE ERROR MSGS
• PTF RO66029 - PASSWORD PHRASE S0C1 FREESLOT+1B0
• PTF RO71425 - ONLY USERID AND PASSWORD SENT TO AFFINITY TPX
• PTF RO72179 - VARIABLE SNVPSWDV NOT WORKING ON TEN0003 PANEL
• PTF RO72995 - PREVENT S0C4 IN SECVNPW+6E6 R3=0 FROM UIDXPWPH
• PTFs RO73376, RO73377 and RO73378 - UPPER CASE PSWD IN PWSD PHRASE ENVIRONMENT

Sites using German Panels should also apply:

• PTF RO88547 - PASSWORD PHRASE LOGON PANEL TGE1003 - GERMAN

SMRT Related configuration changes for Password Phrase signons

1. Ensure that the size for Slot Pool 5 for above the line storage is set to 208 bytes
   
   This required change was identified in the TPX 5.4 Release Notes.
   
   Once the Password Phrase APARs and or PTFs has been installed at a site then the default size for slot 5 above the 16M line has been raised from 200 to 208. This needs to be done regardless whether a site utilizes Password Phrases or not. This change accommodates the user control block (UID) increase for maintaining password phrases.
   
   

   <Please see attached file for image>

   
2. Managing the case of Passwords and Password Phrases
   
   When there is a need to address a mixed environment of upper case passwords and mixed case password phrases (where passwords are automatically set to upper case while password phrases are left in mixed case), then PTFs RO73376, RO73377 and RO73378 UPPER CASE PSWD IN PWSD PHRASE ENVIRONMENT are required.
   
   These PTFs affect the available fields within the SMRT and will modify how passwords and password phrases are handled by TPX:
   
   
   1. Without PTFs RO73376, RO73377 and RO73378 applied:
      
      Set "Y" in field "Allow Lower Case Pswds:" on the TEN0090 panel.
      
      Most Password Phrase sites use mixed case passwords. If your site plans to use mixed case passwords then set "Y" in field "Allow Lower Case Pswds:" on the SMRT TEN0090 panel:
      
      

      <Please see attached file for image>

      
   2. With PTFs RO73376, RO73377 and RO73378 applied:
      
      After these PTFs have been applied, field "Allow Lower Case Pswds:" will just be for passwords and not password phrases. The default is still "N".
      
      New Field "Upper Case Pswd Phrases" will be for password phrases only and defaults to "N".
      
      

      <Please see attached file for image>

      
3. Set "Default LOGO" field to TEN1003
   
   The Default LOGO field on the SMRT TEN0108 panel is where a site configures the default signon panel to be used by TPX.
   
   The English TEN0003 signon panel allows a site to verify that a valid userid and password (of up to 8 characters) combination has been entered. TPX also supplies an English TEN1003 signon panel. The TEN1003 panel allows users to sign on with either passwords or password phrases which can be between 9 and 100 characters long.
   
   Either Password Phrases or Passwords can be entered on the TEN1003 panel. Only Passwords are entered on the TEN0003 panel.
   
   The TEN1003 panel allows users at a site to verify:
   
   
   • A valid userid and password phrase combination has been entered.
   • A valid userid, password phrase and optionally a new password phrase has been entered.
   • A valid userid and password combination has been entered.
   • A valid userid, password and optionally a new password has been entered.

A TPX site administrator should set the Default LOGO parameter to TEN1003 when they need to allow password phrase signon attempts:

<Please see attached file for image>

A TPX site administrator may customize their local TEN1003 Signon Panel. Sites should customize the TEN1003 panel in another local library (non-SMPE TPX library) so that TPX maintenance doesn't accidently overwrite changes made by the local site. (For example, a site wants to put their company name on their version of the TPX TEN1003 panel.)

Many variables on the TEN1003 panel affect how the panel functions and what is displayed. Password Phrase/New Password Phrase variables allow 100 byte character fields. Each Phrase field is broken into two 50 byte fields.

The TEN1003 sign-on panel contains five specific signon related variables:

• SNUSERV - Characters 1 through eight is for the userid
• SNPSWDV - When 8 characters or less it is for a password. When there are 9 through 50 characters then it is for the first half of the Password Phrase
• SNPSWDV2 - An optional 0 through 50 characters for the second half of the Password Phrase
• SNNPSWDV - When 8 characters or less it is for a new password. When there are 9 through 50 characters then it is for the first half of the new Password Phrase
• SNNPSWD2 - An optional 0 through 50 characters for the second half of the new Password Phrase

The sites must be careful when modifying fields on the TEN1003 panel. Variables having to do with password phrase fields can contain up to 50 characters. Any time either the SNPSWDV or SNNPSWDV fields are entered with less than nine characters causes the user to have a traditional password signon attempt. A Password Phrases signon attempt occurs when the password phrase is entered with a length between 9 and 100 characters in length.

A sample TEN1003 signon panel:

<Please see attached file for image>

 

Additional Information:

For more information on the TEN0003 and TEN1003 signon Panels, see the Password Verification section in Programming Guide: TPX Programming/Modifying panels/Password Verification.

Environment

Release: NVINAM00200-5.4-TPX-Session Management-Access Management package
Component: