However, depending on your site, this might be easier said than done – not because installing Explorer is hard, but because people will probably start worrying about security now that this easy to use CICS tool is available.

The point of this post is to try explain a little about CICS Explorer and security, so that you can be primed to answer any questions that may arise.

Passwords

A user can opt to save their password for a connection in Explorer. If this option is used, the password is stored, encrypted, in the workplace used by Explorer.

The default workplace is c:\Documents and Settings\username\.cicsexplorer (Windows) or ~/.cicsexplorer (Linux). The default location can be changed with the -data option when starting Explorer. See here for details. Despite the password being encrypted, this location needs to be protected – especially if it is on a network drive.

Depending on the type of connecton in use, SSL may be used on the conversation, this may stop passwords being transferred in clear text over the network.

For CMCI or Data Interface connections to CICSPlex SM, the PTFs for CICSPlex SM APARs PK87387 (4.1) and PK87334 (3.2) allow you to specify the acceptable cipher suites used for the conversation. For CMCI connections to an SMSS, or CICS CM, you can specify the cipher suites on the CICS TCPIPSERVICE manually.

Note: At present, the server certificates on an SSL connection are not validated, you won’t be prompted to accept an expired certificate etc.

Access

The access you have with CICS Explorer depends on the type of connection and plugins you are using. The basic answer to the question is, if you have access to the equivalent function using a ‘traditional’ interface, then you will have the same access under CICS Explorer.

CMCI Connections…

CMCI requests will run under the transaction CWWU by default. So use transaction security on CWWU to control who is allowed to use the CMCI.

.. to CICSPlex SM

As the requests will be processed by CICSPlex SM, the normal CICSPlex SM security controls are in place. e.g. CICSPlex SM Object security (CPSMOBJ) and Simulated CICS Command and Resource security.

.. to a Single System(SMSS)

Normal CICS Command and Resource Security is used. The IBM supplied CWWU transaction has CMDSEC=YES and RESSEC=YES.

Data Interface Connection to CICSPlex SM

This connection is read only. The transaction invoked on the CICSPlex SM Web User Interface (WUI) server will be COVA, so you can protect this transaction to control access to the WUI. Note that the user could also access the WUI via a browser using the normal WUI interface, where actions / updates are permitted. So you should implement CICSPlex SM Object security (CPSMOBJ) and possibly simulated Command and Resource security.

CICS Configuration Manager

The CICS CM ‘user’ Transactions, typically CCVA,CCVC,CCVR and CCVT are used. Again CICS Transaction Security may be used to control who can run these. The CICS Configuration Manager security settings are the same as used by other CICS CM interfaces, e.g. you can activate CICS CM security checking on the CICS CM commands and resource definitions.

CICS Interdependancy Analyser

CICS IA uses DB2 for its data. So the user needs to be granted access to the appropriate DB2 tables.

CICS Performance Analyser

CICS PA information is based on SMF data or a CICS PA Historical Database (HDB). Normal z/OS data set security can be used to control access to the SMF or HDB data. Once the information is in an HDB, users can export from the HDB to to two different places for use by CICS Explorer:

1. DB2 – so the user needs to be granted access to the appropriate DB2 tables.
2. CSV file – the user would need access to the generated CSV file to download to the workstation, so access can be controlled witn normal z/OS dataset protection.

New and Exciting Commands

When you are installing CICS TS 4.1 make sure you understand that there are potentially new exciting CICS SPI commands that can give you access to things which may have been protected by other means in previous releases.

What I am trying to refer to is the EXEC CICS CSD commands added by CICS TS 4.1. Normally you would use transaction security to control access to the CEDA, CEDB or CEDC transactions. Now that the CSD can also be accessed via EXEC CICS CSD, you may need to make sure that CICS Command security for the ‘CSD’ resource is defined appropriately and that command security is active for transactions that may issue this command. For example, CECI, or CWWU.

Summary

So to summarise, CICS Explorer isn’t about to let users alter their salaries on the Payroll CICS, nor order a new Hi-Def TV from the Web Ordering system, – Well not unless the user had access to do these sorts of things already!

In general if you are protecting your CICS resources today, they will be protected under CICS Explorer, using the same controls you always used.

If you have any questions about Security and CICS Explorer, please comment in this post, or ask away over on Developerworks.

CICSPlex SM WUI Data interface

This connection is available with all currently supported CICS TS releases. It requires that the customer has setup CICSPlex SM and a CICSPlex SM WUI (Web User Interface). CICS Explorer users configure a connection to the usual WUI hostname and port (that you would use in a web browser).

This interface is ‘read only’. You can retrieve data, but not ‘alter’ it, for example, while you can see CICS tasks, you cannot purge them.

As this is a CICSPlex SM interface, you can work with the context and scopes that are normally available, exploiting the CICSPlex SM ‘Single System Image’ (SSI) capabilities.

CICS Management Client Interface (CMCI)

This is the connection that has been keeping my fellow blogger, Chris, busy. It is new with CICS TS V4. It provides full ‘CRUD’ (Create / Remove / Update / Delete) capabilities, so unlike the Data Interface option previously described, you can purge tasks, discard files etc.

The CMCI can operate with two different types of host:

CICSPlex SM WUI

This option requires CICSPlex SM. Using a CICS TS V4 WUI, there is a new WUI System parameter (CMCIPORT) to allow you to configure an additional port number that is used for the CMCI interface. A WUI can now have two TCPIPSERVICEs and ports, one for HTML based WUI web browser users, and another for the XML based CMCI users – which includes CICS Explorer.

As this is a CICSPlex SM interface, you can work with the context and scopes that are normally available with the CICSPlex SM ‘Single System Image’ (SSI) capabilities.

System Managed Single Server (SMSS)

SMSS allows the CMCI with a standalone CICS region. You don’t need to configure any CICSPlex SM components, or set up any CICSPlex SM infrastructure like CMASes and WUI Servers.

Using this variation of the interface, you can only work with the single CICS region that you are connected to. Each CICS, that you manage, needs to run the SMSS code, and you have to have a TCPIPSERVICE and unique port number configured for each region.

Examples

The following graphic attempts to show some different CMCI topologies. With CICS Explorer, the SM perspective is connected via one connection at a time. So to work with any of the green CICS in the CICSplex, the Explorer user connects to the CMCIPORT on the WUI server on the left and CICSPlex SM handles the requests to all of the CICS that are part of the CICSplex, e.g. CICSPlex SM communications will be used to manage the green CICS on the right.

The brown CICS in the graphic above, attempt to show that the CICS Explorer user must connect to each of these CICS in turn to manage the ‘single system’.

With the CMCI, a CICS can either be CICSPlex SM managed, or an SMSS. You can’t use both interfaces at the same time. Only one of the ‘pink arrows’ can be active at a time.

Getting to CICS TS V4

If you are a CICSPlex SM user today with CICS TS V3, you can get up and running to look (and not touch) with the SM perspective very quickly – using your existing WUI.

Depending on your configuration, as soon as you get a CICS TS V4 CMAS (MP) and WUI server running, you may be able to start performing actions on your CICS TS V3 CICS while you complete your migration to CICS TS V4. However There are some rules you need to follow:

1. The CICSPlex SM Maintenance point CMAS must be the highest level, so CICS TS V4.
2. The CICSPlex SM WUI Server must be the highest level and connect to a CICS TS V4 CMAS.
3. The CICSPlex SM code in a CMAS and WUI Server must run on a CICS 660 region.
4. The CICSPlex SM agent code running in a user CICS (MAS) needs to be the same as CMAS release.

The CICSPlex SM V4 code can run in older releases of CICS, so you can manage a CICS 640 region with CICSPlex SM V4, and use the CMCI to gain CRUD access (for supported resources) to this ‘CICS TS V3 CICS’.

CMASes can be different releases, so for example, you can have a CICSPlex SM V4 CMAS communicating to a CICSPlex SM V3 CMAS, but see rule 1 above, the V4 CMAS must be the MP CMAS for all the CICSplexes that are to be accessed. Using this setup, you will have CRUD access to the CICS TS V3 CICS managed by the CICSPlex SM V3 CMAS.

The following graphic attempts to illustrate:

Depending on the other CICS tools installed, you may have support for additional types of connection, but this post is just attempting to describe the capabilities of the SM perspective.

Questions or problems with the Beta may be raised on developerWorks.

A couple of videos are available:

Technical Overview:

Business Value:

If you have any questions, go over to the I ♥ CICS facebook group, or collar one of the CICS team attending Share, or add a comment to this post.

For more information regarding System z software, the IBM site has plenty to read at:

http://www-01.ibm.com/software/os/systemz/en_US/

Four new supportPacs were announced today:

• CICS Explorer for Windows (CS1J)
• CICS tools plugins (CS1N)
• CICS Explorer SDK (CA1R)
• CICS Explorer for Linux (CS1O)

For details of these supportPacs check out this announcement.

A developerWorks CICS Explorer forum is available if you have any questions about these supportPacs.

Read more about it and see how you can get involved in the Beta program for CICS Explorer by checking out the latest issue of the CICS Portfolio e-Newsletter

If you have questions, add a comment to this post, but please remember we can’t go into details for non GA products.

Full CICS responsibility didn’t come to Hursley until 1st January 1975, when Hursley traded PL/I with the Palo Alto Lab for CICS, making CICS a significant part of IBM Hursley History.

Although I am a relative ‘new boy’, first visiting Hursley in 1989, I have had a dig through my cupboards for some nostalgia, I came across a couple of old CICS ‘cherry picker’ photos.

These photos were taken by the Hursley photographic department perched perilously (though I am sure in full compliance with health and safety standards of the time) on a cherry picker, while all the teams involved in producing the new release were invited out onto the lawn in the front of Hursley house.

First up is circa 1989, CICS 3.1.1 photo:

Circa 1990, CICS 3.2.1:

Circa 1991, CICS 3.3:

Just look how may ties were worn in these photos, it isn’t like that around Hursley today!

While the celebration on Saturday is for IBM employees and their families, if you are in the area you might catch the Spitfire fly-past and aerobatic display at 16:00.

Got any CICS nostalgia or IBM Hursley history? Add a comment with a link, or use the ‘Share with us’ link above.

Note: All photos copyright IBM Hursley.