Run batch jobs under user credentials

We can allow batch jobs to run under credentials of the user when WebSphere security is enabled.

The RUN_JOBS_UNDER_USER_CREDENTIAL variable allows users to enable or disable batch jobs to run under credentials of the user. When the job is dispatched to the endpoint, the batch container switches the credentials of the server to the credentials of the user. The credentials of the server are in the job step thread.

RUN_JOBS_UNDER_USER_CREDENTIAL can be created at any scope level and accepts values true or false. The default is false, which means that batch jobs run under server credentials.

When Java 2 Security is enabled, your batch applications must grant the following two permissions in the was.policy file of the application:

• permission com.ibm.websphere.security.WebSphereRuntimePermission "SecOwnCredentials"
• permission com.ibm.websphere.security.WebSphereRuntimePermission "ContextManager.getServerCredential"

The following steps describe how to create the custom property to enable or disable batch jobs to run under the credentials of a user after logging on to the administrative console:

Tasks

1. Click Environment > WebSphere variables.

2. Select a configuration scope, then click New. The general properties page opens.

3. For Name, type RUN_JOBS_UNDER_USER_CREDENTIAL.

4. For Value, type True or False to enable or disable jobs to run under user credential.

5. Click OK, then click Save. (ZOS)

   To enable jobs to run under user credentials on z/OS, also complete step 6.

6. Save the configuration and restart the server. To run jobs under credentials of the user on the z/OS platform, follow these steps:
   1. Go to the security administration pane and click z/OS security options.
   2. Enable application server and z/OS thread identity synchronization. This option specifies that application servers can process the syncToOSThread option for application components that specify it. Local JCA connectors might honor the MVS™ identity for authentication and authorization when an application requests a connection.
   3. Enable the connection manager RunAs thread identity. This option sets the MVS identity associated with the Java EE identity on the execution thread.

   4. Click OK.

   5. Save the configuration and restart the server.

What to do next

Stop and start the server where the batch execution environment is installed.

Related:

Command-line interface for batch jobs

Roles and privileges for securing the job scheduler

(ZOS) Application Synch to OS Thread Allowed

(ZOS) Java thread identity and an operating system thread identity

Secure the job scheduler using roles