Server USER_ID attribute availability after Gen COBOL to .NET C# migration

Products

• Gen
• Gen - Run Time Distributed

Issue/Introduction

Migrating an existing Gen 8.6 Mainframe/COBOL server application to .NET/C#.
The client remains a Gen Windows GUI C client.
The system attribute USER_ID is used extensively in server action blocks and under the Mainframe COBOL servers is passed from the client.
However the USER_ID is not available on .NET servers.

Environment

• Product: Gen 8.6
  
  
• Client: Windows GUI C Client
  
  
• Server: .NET / C#
  
  
• Migration Path: Mainframe COBOL to .NET

Cause

As stated in the Gen 8.6 documentation section "Distributed Processing > Working With Distributed Processing > Anatomy of a DP Application > Server Execution Environments". Under "Behavior Differences", the USER_ID is not available for a .NET C# Server:
"Obtaining a user ID context for a DPS that populates the USER_ID system attribute is not available when the DPS operates as a Java EJB or .NET Server."

Resolution

If the system attribute CLIENT_USER_ID is not already in use for application security, it can be set as required on the client and then passed to the server.

• By default on the client in WREXITN.C function WRUSRID the USER_ID is set to the value of Windows Environment variable USERNAME.
  
  
• Therefore the CLIENT_USER_ID could either just be set to USER_ID in the appropriate action diagram or WREXITN.C function WRSECTOKEN could be updated to set CLIENT_USER_ID to the same Windows Environment variable USERNAME.
  
  
• Enabling Standard Security passes the CLIENT_USER_ID to the server in the Common Format Buffer (CFB) header.

 

Implementation Steps

1. Edit the C client application to set CLIENT_USER_ID to USER_ID and rebuild it.
   
   
2. Edit the C user exit WREXITN.C function WRSECTOKEN to enable Standard Security by commenting the default return line and adding the required return line:
   /* return SecurityNotUsed;     */
return SecurityUsedStandard;
   
   
3. Per Gen 8.6 documentation section "Reference > User Exits > Windows C User Exits > Windows GUI Client User Exits > WRSECTOKEN - Client Security Token User Exit (Windows)". Under "Building on Windows" rebuild the user exit dll wren.dll using MKEXITSN.C.
   
   
4. When execute the C client application the new version of wren.dll will then pass the CLIENT_USER_ID value in the CFB header to the server.
   NOTE: If "CMIDEBUG ON" is enabled in the client commcg.ini file a comparison of the trace files created before & after the change also shows the difference in the RetCode from WRSECTOKEN (-1 versus -2), with the userId parameter being populated for the latter and then passed on the flow.
   
   
   1. EITHER: Update server action blocks that reference USER_ID to instead reference CLIENT_USER_ID.
      
      
5. OR:  Gen Engineering provided new version of .NET server exit SecurityValidationExit.cs that adds function SetUSERID() to populate the USER_ID system attribute in server views. Therefore the USER_ID can be set to the CLIENT_USER_ID received from the client whose value is already available in that exit. Relevant uncommented lines shown below:

   *****
           // Populate USER_ID system attribute in server views.
        // The default behavior is to return null.
        // if you want set USER_ID, return the user id you want to set, or set the user id from the client user id as illustrated in the comments below.
        // If the returned string length is greater than 8, it will be truncated within the Runtime to keep the first 8 characters.
        public string SetUSERID()
        {
            if (!string.IsNullOrEmpty(_clientUserId))
            {
                return _clientUserId;
            }
            // return null;
        }
   *****

   NOTE: If it is required to remove the trailing spaces from the USER_ID value this line can be used instead:
                                   return _clientUserId.TrimEnd();
   
   Per Gen 8.6 documentation section "Reference > User Exits > .NET User Exits" rebuild the the user exit file CA.Gen.exits.dll using script makeexits.bat.
   
   An official PTF for the new .NET server exit SecurityValidationExit.cs will be released in due course.

Additional Information

Other Gen 8.6 documentation references:

• "Distributed Processing > Working With Distributed Processing > Security in Distributed Processing > Client Security Processing"
  For the DPC applications that flow to a non-EJB and a non- .NET Server, the supporting runtime invokes a client security user exit (such as WRSECTOKEN). This client security user exit indicates whether the CLIENT_USER_ID and CLIENT_PASSWORD variables are used as security data associated with a cooperative flow request. That same user exit also influences how the runtime incorporates the security data into the cooperative flow request.
  For the flows between a DPC and DPS that operate in the same execution environment and have processing that does not use a CFB or a Tuxedo View32 buffer (Java clients flowing to EJBs and .NET clients flowing to .NET Server), the CLIENT_USER_ID and CLIENT_PASSWORD system attributes are always transmitted (serialized) as part of the Import data that are exchanged between the DPC and the DPS.
  
  
• "Distributed Processing > Working With Distributed Processing > Security in Distributed Processing > Security Data" - see Standard Security