(ZOS) SSL considerations for WAS administrators

The Resource Access Control Facility (RACF ) customization jobs create an SSL keyring owned by the WebSphere Application Server for z/OS administrator. This SSL keyring contains the digital certificate needed to communicate with WAS. Other MVS™ user IDs, which require WAS for z/OS administration require additional customization.

The Resource Access Control Facility (RACF) customization jobs create an SSL keyring owned by the WAS for z/OS administrator containing the digital certificate needed to communicate with WAS. However, additional customization is required for administration by other MVS user IDs.

that the MVS user ID in the following description is the MVS user ID under which the wsadmin process is running, not the user ID specified in the wsadmin request.

In the following example:

• yyyyy is the user ID of the new WAS for z/OS administrator
• xxxxx is the name of the keyring specified in soap.client.props in the profile_root/properties directory.
• zzzzz is the label name used in the BBOSBRAK jobs to specify which certificate authority certificate was used to generate server keys

Tasks

1. If the new administrator is not a member of the WAS for z/OS administrative group, make sure that the new user ID has access to the appropriate RACF keyrings and digital certificates. For example:

   PERMIT IRR.DIGTCERT.LIST CLASS(FACILITY) ID(yyyyy) ACC(READ)
   PERMIT IRR.DIGTCERT.LISTRING CLASS(FACILITY) ID(yyyyy) ACC(READ)
   

2. Use the setup completed by the customization jobs as a model for the additional steps. This information is in the BBOCBRAK member of the <HLQ>.DATA data set generated during the customization process. The BBOCBRAK job contains the set of RACF commands that were used:

   /* Generating SSL keyrings for WebSphere administrator                       */ 
   RACDCERT ADDRING(xxxxx) ID( yyyyyy )                                           
   
    /* Connect WAS CA Certificates to Servers keyring    */ 
   "RACDCERT ID(yyyyy) CONNECT (RING(xxxxx) LABEL('zzzzz')   CERTAUTH"         
   
   SETROPTS RACLIST(FACILITY) REFRESH" 
   

Related:

(ZOS) Secure Sockets Layer security for WAS for z/OS