Using the Config Member/Default Table Parameter USERPRO with XCOM for z/OS

Products

• XCOM Data Transport
• XCOM Data Transport - Windows
• XCOM Data Transport - Linux PC
• XCOM Data Transport - z/OS

Issue/Introduction

USERPRO is an Config Member/XCOM default table parameter that allows you to enable or disable USERID Propagation.

Environment

• XCOM™ Data Transport® for z/OS
• XCOM™ Data Transport® for Windows
• XCOM™ Data Transport® for UNIX/Linux PC
  
  

Resolution

HOW USERPRO WORKS

• The USERPRO setting is used whenever security checks are done.
  
  
• Setting it to YES omits userid verification (that is, password checking) for the userid and only the userid's permission for the intended operation is verified with the security system.
  
  
• This happens on the system which performs the verification and is driven by the USERPRO setting in its Config Member/XCOMDFLT table.

Does XCOM propagate the password to the remote system?

No - the password is not used. Setting USERPRO to yes on the local system omits password checking for the userid and only the userid's permission for the intended operation is checked with the security system.

How is the receiving system getting the password in order to catalog a dataset, for example?

• If it's a TYPE=SCHEDULE, then the access to the local dataset will be done by the local XCOM Started Task (XCOM server, program XCOMXFER), i.e. the user who is assigned to this STC. But this will be done only after the STC has verified that the user has enough access rights to this file.
• The local XCOM partner, whether it is program XCOMJOB (EXECUTE) or XCOMXFER (SCHEDULE) also propagates this userid to the remote XCOM. This will be, in both cases, another XCOM Started Task (XCOM server, program XCOMXFER). For the access to the remote dataset, the same rules apply as above.
• So in reality, the actual dataset access is done by the XCOM STC as long as the user has the correct permissions.

Additional Information

When installing XCOM, you need to give it a security profile that allows it to do this.