2/11/2020

IBM z/OS Connect Enterprise Edition

Security

Mitch Johnson
mitchj@us.ibm.com
Washington System Center

© 2017, 2020 IBM Corporation

z/OS Connect EE
Contents
 Introduction

 Basic Liberty Security

 API provider security

–Authentication
–Authorization
–Encryption
–Flowing identities to back end systems

 API requester security

–What’s different?

 More information
© 2017, 2020 IBM Corporation

1
 2/11/2020

z/OS Connect EE
General considerations for securing REST APIs
 Know who is invoking the API (Authentication)

 Ensure that the data has not been altered in transit (Data Integrity) and ensure
confidentiality of data in transit (Encryption)

 Control access to APIs (Authorization)

– End user
– Application

 Know who invoked the APIs (Audit)

3
© 2017, 2020 IBM Corporation

z/OS Connect EE
Common challenges

• End-to-end security is hampered by the issue of how to provide

secure access between middleware components that use
disparate security technologies e.g. registries
› This is a driver for implementing open security models like OAuth and
OpenID Connect and standard tokens like JWT
• Security when using z/OS Connect is implemented in many
products including z/OS Connect, WebSphere Liberty Profile on
z/OS, SAF/RACF, CICS, IMS, Db2, MQ …
› And these are all documented in different places
• Often security is at odds with performance, because the most
secure techniques often involve the most processing overhead
especially if not configured optimally

4
© 2017, 2020 IBM Corporation

2
 2/11/2020

z/OS Connect EE

A review of Liberty security

© 2017, 2020
20 IBM Corporation

z/OS Connect EE

OMVS security - Unix file permissions

Owner Group Other
Read Write Execute Read Write Execute Read Write Execute

1 1 1 1 0 1
Bit
0 0 0
Base-2
Value [4] [2] [1] [4] [2] [1] [4] [2] [1]

4 + 2 + 1 = 4 + 0 + 1 = 0 + 0 + 0 =

7 The owner has READ,

WRITE and EXECUTE 5 The group has READ and
EXECUTE, but not
WRITE
0 Others have nothing

The owner of the IDs that are part of the IDs that are not the owner and
file or directory group for the file or not part of the group; that is,
directory other
chmod –R u+rwx zceesrv3 chmod –R g+rwx zceesrv3 chmod –R o+rx zceesrv3
6 chmod –R o-w zceesrv3
© 2017, 2020 IBM Corporation

3
 2/11/2020

z/OS Connect EE

Default server configuration – server create zceesrv1

ID=LIBSERV It will create the directories and files under the

Group=LIBGRP <WLP_USER_DIR> and assign ownership based on
export JAVA_HOME=<path_to_64_bit_Java>
the ID and Group that created the server
1
export WLP_USER_DIR=/var/zosconnect
There are a few potential issues with this in a
./server create zceesrv1
production setting:
/var/zosconnect 750 LIBSERV LIBGRP
/servers 750 LIBSERV LIBGRP • If you have multiple people with a need to change
/zceesrv1 750 LIBSERV LIBGRP configuration files, do you share the password of LIBSERV?
/logs 750 LIBSERV LIBGRP (answer: no)
messages.log 640 LIBSERV LIBGRP Sharing passwords is a bad practice. Better to take advantage SAF SURROGAT
/resources 755 LIBSERV LIBGRP so permitted users can switch to the owning ID so they can make changes
/zosconnect 755 LIBSERV LIBGRP
/apis 755 LIBSERV LIBGRP • If you have multiple people with a need to read output files,
/apiRequesters 755 LIBSERV LIBGRP do you simply connect them to LIBGRP? (answer: no)
/rules 755 LIBSERV LIBGRP The owner group may be granted access to other resources (on z/OS SAF
/services 755 LIBSERV LIBGRP profiles notably: SERVER) and you do not want others inheriting that. Better to
server.xml 640 LIBSERV LIBGRP make the configuration group be something different from the owner group and
server.env 640 LIBSERV LIBGRP grant READ through that group.
/workarea 750 LIBSERV LIBGRP

Access for Owner, Group, Other uses UID and GID in the SAF OMVS segment, not the actual SAF identity or group

CWWKB0121I: The server process UMASK value is set to 0000

- sets permission bit for new files deployed using the RESTful APIs to rw-rw-rw (666 XOR 000)
7 © 2017, 2020 IBM Corporation

z/OS Connect EE

Include file processing

Server ID has
This allows portions of the configuration to be held in
Liberty
Read access to files outside the main server.xml file
Server all files through
group Two primary uses:
server.xml 1. Hold sensitive configuration information in file that is
READ to select people, but not the read group
File 2. Allow a user to update their portion of the server
<include>
Owner: LIBSERV configuration, but not other parts of it
<include> Group: LIBGRP
For the second use-case it is important to insure the user
can not override configuration in the main XML. Use the
"onConflict" tag in the <include> element:
<include location="myIncludeFile.xml" onConflict="IGNORE"/>
File
XML Owner: LIBADM Read only by those This tells Liberty to ignore XML elements in include file
Group: LIBADMG permitted to SU to
the owning ID that are also found in the main server.xml
It does not prevent them from injecting configuration elements not found in the
main server.xml. If there is a concern about that, don't use include processing.
File
XML Owner: CICSADM Server can read,
Group: CICSADMG and user can
update this file
Yes, nesting of includes is possible
8

8
© 2017, 2020 IBM Corporation

4
 2/11/2020

z/OS Connect EE

Using Include – protecting the server.xml

• Setup a server.xml using ‘include’ statements and allow application admins to
write to those included files, but not the server.xml itself.
• Control what configuration can be overridden in included files using the ‘onConflict’ option
provided with the include element (see Ignore, Replace, Merge).
https://www.ibm.com/support/knowledgecenter/en/SSAW57_liberty/com.ibm.websphere.wlp.nd.multiplatform.doc/ae/cwlp_config_include.html

Server.xml
db2.xml (owned by a DBA)
Server.xml
server.xml
<featureManager> (owned by ID ADMIN1) <featureManager>
<server description="Db2 REST">
<feature>ssl-1.0</feature>
<featureManager>
<featureManager>
<feature>ssl-1.0</feature>
<featureManager> <zosconnect_zosConnectServiceRestClientConnection
<ssl id=”mySSLConfig" keyStoreRef=”myKeys"
<ssl id=”mySSLConfig" keyStoreRef=”myKeys" trustStoreRef=”mytrustStore" trustStoreRef=”mytrustStore" clientAuthenticationSupported="true" />
<feature>appSecurity-1.0</feature>
clientAuthenticationSupported="true" /> id="Db2Conn" host="wg31.washington.ibm.com" port="2446"
<featureManager> basicAuthRef="dsn2Auth" />
<zosconnect_zosConnectServiceRestClientBasicAuth id="dsn2Auth"
<include location="${server.config.dir}/zc3lab/db2.xml applName=DSN2APPL”/>
onConflict=“IGNORE”/> </server>

<include location="${server.config.dir}/zc3lab/ipic.xml Server.xml

ipic.xml (owned by a CICS administarator)
<featureManager>
onConflict=“IGNORE”/> <featureManager>
<feature>ssl-1.0</feature>
<featureManager>
<feature>zosconnect:cicsService-1.0</feature>
<ssl id=”mySSLConfig" keyStoreRef=”myKeys" trustStoreRef=”mytrustStore"
clientAuthenticationSupported="true" />
</featureManager>
<zosconnect_cicsIpicConnection id="catalog"
host="wg31.washington.ibm.com" port="1491"/>
<zosconnect_cicsIpicConnection id=“cscvinc"
host="wg31.washington.ibm.com" port="1492“
zosConnectApplid= "ZOSCONN " zosConnectNetworkid= " ZOSCONN " />
</server>

9 © 2017, 2020 IBM Corporation

z/OS Connect EE
z/OS : Starting Liberty Servers

All three options result in a Liberty z/OS server, and functionally there’s very little
difference.
When started as a UNIX process, the MODIFY command interface is not present. For production use, the best
practice is to use a started task.

UNIX Process 1. UNIX Process

Start with shell script • Use the 'server' shell script in the installation /bin directory
• Syntax: server start zceesvr1
Liberty z/OS
1 Server
• ID of server will be based on ID that issued the command
Instance 2. Started Task using server shell script (server start zceesrv1)
• Set WLP_ZOS_PROCEDURE environment variable in server.env file
Started Task • Example: WLP_ZOS_PROCEDURE=ZCEEPROC,JOBNAME=ZCEESVR1,PARMS=‘ZCEESVR1'
Start with shell script • This is how z/OS servers are started by Collective Controller
Liberty z/OS
• ID of the server will be based on the SAF STARTED profile that takes effect
2 Server 3. Started Task using START command
Instance • Common procedure: START ZCEEPROC,JOBNAME=ZCEESVR1,PARMS=‘ZCEESVR1'
• Dedicated proc: START ZCEEPROC
• ID of the server will be based on the SAF STARTED profile that takes effect
Started Task
Use z/OS START

Liberty z/OS
3 Server Expectation is for production servers either #2 (via Collective
Instance
Controller) or #3 will be used

Liberty z/OS good practices: https://www-03.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/WP102687

10 © 2017, 2020 IBM Corporation

10

5
 2/11/2020

z/OS Connect EE

z/OS Security – Range of options – Started Task IDs

On z/OS, the best practice for Liberty servers in production is that they run as ‘Started Tasks’ (STCs).

= = =
ID
/<WLP_USER_DIR> ID
/<WLP_USER_DIR> ID
/<WLP_USER_DIR>

Liberty z/OS Liberty z/OS ID Liberty z/OS

ID ID
Server Server Server

=
Liberty z/OS ID Liberty z/OS ID Liberty z/OS ID
Server Server Server

Liberty z/OS Liberty z/OS ID Liberty z/OS

ID ID
Server Server Server

• Multiple servers • Multiple servers • Multiple servers

• All have same STC ID • All have same STC ID • Different STC IDs
• STC ID = File Owner ID • STC ID ǂ File Owner ID • STC IDs ǂ File Owner ID

Should all servers sharing WLP_USER_DIR share the same STC ID?
It is a matter of the degree of identity isolation that is required

11
© 2017, 2020 IBM Corporation

11

z/OS Connect EE

z/OS : Assigning ID to started tasks: SAF STARTED

The first question here is whether you wish to have a common started task ID that is shared among
servers, or if you wish each server to have a unique ID
Then the second question is whether servers under a WLP_USER_DIR will share a common JCL
start proc, or use unique start procs for each server

Common ID Unique IDs

Common START ZCEEPROC,JOBNAME=<server>,PARMS='<server>' START ZCEEPROC,JOBNAME=<server>,PARMS='<server>'

Proc STARTED ZCEEPROC.* STARTED ZCEEPROC.<jobname>

Unique START ZCEESRV1 START SRV01

Procs STARTED ZCEE*.* STARTED SRV01.*

It's possible to use a combination of the above, even under the same WLP_USER_DIR. So there's
no "one best answer" here. What's best is what's best for you.

12 © 2017, 2020 IBM Corporation

12

6
 2/11/2020

z/OS Connect EE

z/OS : The Angel process – what is this about?

The Angel Process is a started task that is used to
protect access to z/OS authorized services. This is
(unnamed) ABC XYZ done with SAF SERVER profiles.
Angel Angel Angel • Authorized services include: WOLA, SAF, WLM, RRS, DUMP
Process Process Process • The ability to start multiple Angel processes on an LPAR was
introduced in 16.0.0.4. This is called "Named Angels". It
provides a way to separate Angel usage between Liberty
SAF SERVER
z/OS servers:
Authorized • An Angel process can be started with a NAME='<name>' parameter (or it can be
READ?
Fail No Yes Services started as a "default" without a name). The name may be up to 54 characters.
• Liberty servers can be pointed at a specific Angel with a bootstrap property
Best practice:
• When an "embedder” or stack product of Liberty calls for its own named Angel,
follow those instructions and set up an Angel for that product.
Server ID • You may create separate named Angels for isolation of Test and Production, but do
not take this practice too far. A few Angels, yes; dozens, no.
• Establish automation routines to start the Angels at IPL
Liberty z/OS • Grant SAF GROUP access to the SERVER profiles, then connect server IDs as
Server needed

bootstrap.properties
com.ibm.ws.zos.core.angelRequired=true
com.ibm.ws.zos.core.angelName=<name>

13 © 2017, 2020 IBM Corporation

13

z/OS Connect EE
z/OS : SAF SERVER profiles related to the Angel

BBG.ANGEL.<angel_name> enables access to a specific

You can grant server named Angel
IDs direct READ to
each profile, but that
BBG.ANGEL enables
access to the unnamed Angel process
may get labor
intensive BBG.AUTHMOD.BBGZSAFM enables access to authorized
services
Server ID
BBG.AUTHMOD.BBGZSCFM enables loading of
authorized client services
BBG.AUTHMOD.BBGZSAFM.SAFCRED enables use of SAF authorized services
BBG.AUTHMOD.BBGZSAFM.ZOSWLM enables use of WLM authorized services
WOLA BBG.AUTHMOD.BBGZSAFM.TXRRS enables use of RRS services (transaction)
Server ID Access BBG.AUTHMOD.BBGZSAFM.ZOSDUMP enables use of SVCDUMP services
Group BBG.AUTHMOD.BBGZSAFM.LOCALCOM
BBG.AUTHMOD.BBGZSAFM.WOLA enables use of WOLA
Or you could establish BBG.AUTHMOD.BBGZSCFM.WOLA
functional group IDs that have BBG.AUTHMOD.BBGZSAFM.PRODMGR enables use of IFAUSAGE services
specific access, then connect
server ID to the group or groups BBG.AUTHMOD.BBGZSAFM.ZOSAIO enables use TCP asynchronous I/O services
to get the access.

Best practice:
• Establish all the SERVER profiles ahead of time. Existence of profile does not grant access; READ to it does.
• Determine what access a server needs and grant only that; check "is available" messages in messages.log to
verify

14 © 2017, 2020 IBM Corporation

14

7
 2/11/2020

z/OS Connect EE

z/OS Connect Security

Overview

© 2017, 2020
20 IBM Corporation

15

z/OS Connect EE
z/OS Connect EE API provider security overview
Authorization Audit

Liberty z/OS
Authentication
z/OS Connect EE Back end system
API Layer Security
Encryption Encryption
Identity
Service Layer Security Resource
Propagation

Role Group
Trusted
Access Access
Server

SAF Security in support of server

runtime

1. Authentication (basic, client 4. Audit

certificates, 3rd party authentication) 5. Configuring security with SAF
2. Encryption (aka "SSL" or "TLS") 6. Back end identity propagation (CICS,
3. Authorization (role and group access) IMS, Db2, MQ)

See Dev Center article "Securing APIs with z/OS

© 2017, 2020 IBM Corporation
Connect EE" overview of z/OS Connect EE security

16

8
 2/11/2020

z/OS Connect EE

z/OS Connect EE security options

http://ibm.biz/zosconnect-security

The actions which can be controlled by authorization (see Note 1 in the diagram above) are: deploying, querying, updating,
starting, stopping and deleting of APIs, services and API requesters.
© 2017, 2020 IBM Corporation
17

17

Typical z/OS Connect EE security flow z/OS Connect EE

1. The credentials provided by the client

2. Secure the connection to the z/OS Connect EE server
3. Authenticate the client. This can be within the z/OS Connect EE server or by requesting verification
from a third party server
4. Map the authenticated identity to a user ID in the user registry
5. Authorize the mapped user ID to connect to z/OS Connect EE and optionally authorize user to invoke
actions on APIs
6. Audit the API request
7. Secure the connection to the System of Record (SoR) and provide security credentials to be used to
invoke the program or to access the data resource
8. The program or database request may run in the SoR under the mapped ID
18 © 2017, 2020 IBM Corporation

18

9
 2/11/2020

z/OS Connect EE

Authentication

Obtaining an identity

© 2017, 2020
20 IBM Corporation

19

z/OS Connect EE
Authentication
Several different ways this can be accomplished:
Basic Authentication Client Certificate Third Party Authentication

Identity Mapping
z/OS Connect EE z/OS Connect EE z/OS Connect EE = 'FRED'

Token (JWT, LTPA, other)

TLS
ID/PW Okay! Client Okay!
3rd Party
Cert
Cert Auth
Okay
REST REST Could be a Trusted REST
trusted
Client Client server Server Client
ID/PW

Server prompts for ID/PW Server prompts for cert. Client authenticates to 3rd party sever
Client supplies ID/PW Client supplies certificate Client receives a trusted 3rd party token
Server checks registry: Server validates cert and Token flows to Liberty z/OS across
 Basic (server.xml) maps to an identity trusted connection and is mapped to
 LDAP an identity
 SAF

20
© 2017, 2020 IBM Corporation

20

10
 2/11/2020

z/OS Connect EE
Security token types by z/OS Connect EE
Token type How used Pros Cons

LTPA Authentication technology used in • Easy to use with • IBM Proprietary

IBM WebSphere WebSphere and DataPower token

SAML XML-based security token and set • Token includes user id and • Tokens can be
of profiles claims heavy to process
• Used widely with SoR • No refresh token
applications

OAuth 2.0 Facilitates the authorization of • Used widely for SoE • Needs
access one site to access and use applications e.g with introspection
token information related to the user's Google, Facebook, endpoint to
account on another site Microsoft, Twitter … validate token

JWT JSON security token format • More compact than SAML

• Ease of client-side
processing especially
mobile

21
© 2017, 2020 IBM Corporation

21

z/OS Connect EE
Open security standards

• OAuth is an open standard for secure delegated access to server resources

designed to work with HTTP
• OpenID Connect is an authentication layer on top of Oauth
• JWT (JSON Web token) defines a compact and self-contained way for securely
transmitting information between parties as a JSON object
See the YouTube video OAuth 2.0 and OpenID Connect (in plain English)
https://www.youtube.com/watch?v=996OiexHze0
© 2017, 2020 IBM Corporation
22

22

11
 2/11/2020

z/OS Connect EE
OpenID Connect Overview

• OpenID Connect (OIDC) is

built on top of OAuth 2.0

• Flexible user authentication

for Single Sign-On (SSO) to
Web, mobile and API
workloads

• Addresses European PSD2

and UK OpenBanking
requirements for authorization
and authentication

23
© 2017, 2020 IBM Corporation

23

z/OS Connect EE
Why JWT with z/OS Connect EE?
• Token validation does not require an additional trip and can be
validated locally by z/OS Connect server

• Parties can easily agree on a specific set of custom claims in order to

exchange both authentication and authorization information

• Widely adopted by different Single Sign-On solutions and well

known standards such as OpenID Connect

• Message-level security using signature standard

• JWT tokens are lighter weight than other XML based tokens e.g
SAML
24
© 2017, 2020 IBM Corporation

24

12
 2/11/2020

z/OS Connect EE
JWT (JSON Web Token)
• JWT is a
compact way of
representing
claims that are
to be
transferred
between two
parties

• Normally
transmitted via
HTTP header

• Consists of
three parts
• Header
• Payload
• Signature
25 © 2017, 2020 IBM Corporation

25

z/OS Connect EE
Example scenario – security flow
Propagate distributed identity
HTTPS/JSON
userID/pwd Identity in JWT
HTTPS/JSON
z/OS CICS task
4 runs with
1 3 6
REST API z/OS RACF ID
{JWT} CICS USER1
client Gateway Connect EE

5 7

RACF
2 Registry
Edward Johnson

RACMAP ID(USER1) MAP USERDIDFILTER(NAME(‘distuser‘)) REGISTRY(NAME('*'))

1. User authenticates with the managed API using a "distributed" identity and a password
2. An external registry is used as the user registry for distributed users and groups
3. API Gateway generates a JWT and forwards the token with the request to z/OS Connect EE
4. z/OS Connect EE validates JWT
5. z/OS Connect EE calls RACF to map distributed ID to RACF user ID and authorizes access to API
6. z/OS Connect EE CICS service provider propagates distributed ID to CICS
7. CICS calls RACF to map distributed ID to RACF user ID and performs resource authorization checks
26
© 2017, 2020 IBM Corporation

26

13
 2/11/2020

z/OS Connect EE
JWT used in scenario
{
"alg": "RS256"
}
{
"sub": "distuser",
"token_type": "Bearer",
"azp": "rpSsl",
"iss": "https://wg31.washington.ibm.com:26213/oidc/endpoint/OPssl",
"aud": "myZcee",,
"realmName": "zCEERealm",
"uniqueSecurityName": "distuser"
}

• The header contains an alg (algorithm) element value RS256

₋ RS256 (RSA Signature with SHA-256) is an asymmetric algorithm which uses a public/private
key pair
₋ ES512 (Elliptic Curve Digital Signature Algorithm with SHA-512) link for more info
₋ HS256 (HMAC with SHA-256) is a symmetric algorithm with only one (secret) key
• The iss (issuer) claim identifies the principal that issued the JWT
• The sub (subject) claim distuser identifies the principal that is the subject of the JWT
• The aud (audience) claim myZcee identifies the recipients for which the JWT is intended
27
© 2017, 2020 IBM Corporation

27

z/OS Connect EE
Configuring authentication with JWT
z/OS Connect EE can perform user authentication with JWT using the support that is
provided by the openidConnectClient-1.0 feature. The <openidConnectClient>
element is used to accept a JWT token as an authentication token
<openidConnectClient id="RPssl" inboundPropagation="required"
signatureAlgorithm="RS256" trustAliasName="JWT-Signer"
trustStoreRef="jwtTrustStore"
userIdentityToCreateSubject="sub" mapIdentityToRegistryUser=“true"
issuerIdentifier=“https://wg31.washington.ibm.com:26213/oidc/endpoint/OPssl"
authnSessionDisabled="true" audiences="myZcee"/>

• inboundPropagation is set to required to allow z/OS Connect EE to use the received JWT as an
authentication token
• signatureAlgorithm specifies the algorithm to be used to verify the JWT signature
• trustStoreRef specifies the name of the keystore element that defines the location of the
validating certificate
• trustAliasName gives the alias or label of the certificate to be used for signature validation
• userIdentityToCreateSubject indicates the claim to use to create the user subject
• mapIdentityToRegistryUser indicates whether to map the retrieved identity to the registry user
• issuerIdentifier defines the expected issuer
• authnSessionDisabled indicates whether a WebSphere custom cookie should be generated for the
session
• audiences defines a list of target audiences
See Dev Center article "Using a JWT with z/OS Connect EE" for full description of scenario
© 2017, 2020 IBM Corporation
28

28

14
 2/11/2020

z/OS Connect EE
Using authorization filters with z/OS Connect EE
Authentication filter can be used to filter criteria that are specified in the authFilter
element to determine whether certain requests are processed by certain providers,
such as OpenID Connect, for authentication.
<openidConnectClient id="RPssl" inboundPropagation="required"
signatureAlgorithm="RS256" trustAliasName="JWT-Signer"
trustStoreRef="jwtTrustStore"
userIdentityToCreateSubject="sub" mapIdentityToRegistryUser=“true"
issuerIdentifier=“https://wg31.washington.ibm.com:26213/oidc/endpoint/OPssl"
authnSessionDisabled="true" audiences="myZcee"
authFilterRef=“JwtAuthFilter”/>
<authFilter id=“API Gateway">
<remoteAddress id=“ApiAddress" ip="10.7.1.*" matchType="equals"/>
</authFilter>
<authFilter id=“PhoneBook">
<requestUrl id=“URL" urlPattern=“/phoneBook/*" matchType="equals"/> </authFilter>
<authFilter id="JwtAuthFilter" >
<requestHeader id="authHeader" name="Authorization" value="Bearer" matchType="contains"/>
</authFilter>

Some alternative filter types

• A remoteAddress element is compared against the TCP/IP address of the client that
sent the request.
• The host element is compared against the "Host" HTTP request header, which
identifies the target host name of the request.
• The requestUrl element is compared against the URL that is used by the client
application to make the request. © 2017, 2020 IBM Corporation
29

29

z/OS Connect EE

Authorization

Once we have an identity

© 2017, 2020
20 IBM Corporation

30

15
 2/11/2020

Security flow with z/OS Connect EE z/OS Connect EE

Client ID receives
REST authority to invoke
Clients or operate against
the API/service
requested
Identity Admin
No

Operator
Yes Yes Yes Yes
requireAuth Role Access? Group ID in
True? Access On? Group?
Invoke
No No No
Reader
Client is free to Client is rejected
Client is rejected
access z/OS and can not access
and has no
Connect EE and the z/OS Connect EE or
authority to
API it requested the API it requested
proceed
ID used is
unauthenticated
userid.

31
© 2017, 2020
20 IBM Corporation

31

Overview of z/OS Connect interceptors z/OS Connect EE

The interceptor framework provides a way to call code to do pre-invoke work and
then again to do post-invoke work:

Interceptor A In server.xml you can:

Interceptor B
• Define ‘global interceptors,’ which apply
Request
Backend to all configured APIs and services
Program • Define interceptors specific to a given
Response
configured API or service
Interceptor A
Interceptor B

z/OS Connect comes with an authorization interceptor (which user can

access which API or service) and an audit interceptor (for SMF recording)
It is also possible to write your own interceptor and have it called as part of
request/response processing

32
© 2017, 2020
20 IBM Corporation

32

16
 2/11/2020

Authorization interceptor z/OS Connect EE

The “authorization interceptor” is a supplied piece of interceptor code that will check to see if the
user has the authority to perform the action requested:

What the interceptor

Controlled by provides
a defined
“role” Administrator
Full authority
“Fred” Allowed to Yes
Enter?
Operator
No Start, Stop, Deploy ….

Go Away

Invoke
Invoke service only

Reader
33 Discover and read
© 2017, 2020 IBM Corporation

33

z/OS Connect EE
Configuring the authorization interceptor
REST Definition of groups at the global
Clients level. Can also be defined at API
and service level.
<zosconnect_zosConnectManager
Pointer to interceptor list
Identity globalAdminGroup="GMADMIN"
globalInvokeGroup="GMINVOKE"
globalInterceptorsRef="interceptorList_g" />

Auth <zosconnect_zosConnectInterceptors An interceptor "list"

No
interceptor in id="interceptorList_g" that defines just the
effect? interceptorRef="auth"/> "auth" interceptor.
Admin
Yes Authority <zosconnect_authorizationInterceptor id="auth"/>

Element that defines authorization

ID in a
No interceptor to z/OS Connect EE.
defined auth
group?
Reject
Yes
Define at global (shown here), API or service layer
Auth to
Override, opt-out … many ways to configure this
perform
action? See Techdoc WP102439 "Interceptor Scenarios" PDF for examples of variations
on configuring interceptors at different levels in z/OS Connect.
Allow
Yes © 2017, 2020 IBM Corporation

34

17
 2/11/2020

z/OS Connect EE

Audit

© 2017, 2020
20 IBM Corporation

35

Audit (SMF) Interceptor z/OS Connect EE

The audit interceptor writes SMF 123.1 records. Below is an example of some of
the information captured:

• System Name
• Sysplex Name Server Identification
• Job Name Section
• Job Prefix
• Address Space Stoken

• Arrival Time
• Completion Time
• Target URI
• Input JSON Length User Data Section
• Response JSON Length
• Method Name
• API or Service Name
• Userid
• Mapped user name
36
© 2017, 2020
20 IBM Corporation

36

18
 2/11/2020

z/OS Connect EE
Configuring interceptors - Example
Interceptors defined as global apply to all the APIs defined to the instance of z/OS
Connect (unless the global definition is overridden). Interceptors defined as API-
level apply only to that API. The authorization interceptor works on the principle of
user membership in a group.

<zosconnect_zosConnectManager globalInterceptorsRef="interceptorList_g"
globalAdminGroup="GMADMIN" globalInvokeGroup="GMINVOKE"/>

<zosconnect_authorizationInterceptor id="auth"/>
<zosconnect_auditInterceptor id="audit"/>

<zosconnect_zosConnectInterceptors id="interceptorList_g" interceptorRef="auth"/>

<zosconnect_zosConnectInterceptors id="interceptorList_s" interceptorRef="audit"/>

<zosconnect_zosConnectAPIs location="">
<zosConnectAPI name="catalog" invokeGroup =“CATINVOK“
interceptorsRef="interceptorList_s" />
</zosconnect_zosConnectAPIs>

37
© 2017, 2020 IBM Corporation

37

z/OS Connect EE

Encryption

© 2017, 2020
20 IBM Corporation

38

19
 2/11/2020

z/OS Connect EE
SSL/TLS connections

I wish to establish a connection to you Java-based key/trust files

Easy to set up, but less control by
Here is my server cert signed by a CA
REST security administrators
Client I trust you based on CA, please agree to TLS
z/OS Connect EE
SAF
SAF keyrings
Acknowledgement and TLS establishment This is under the control of
security administrators
… Optional challenge for client certificate

Important to understand where the TLS sessions start and end:

Trusted
REST Server
Clients Start Terminate
z/OS Connect EE
REST SAF
Clients Start Terminate

The client TLS sessions may come and go This session can be much longer-lived and thus
frequently. If that's the responsibility of less setup/teardown overhead
a mid-tier trusted server, then the
overhead of setup/teardown is there, You can manage SAF-based certificates more
not on the z/OS system easily here because potential clients are limited
39 and known
© 2017, 2020 IBM Corporation

39

z/OS Connect EE
Using JSSE with z/OS Connect EE
z/OS Connect EE
CPUs
Liberty server

JVM CPACF

IBMJCE
https JSSE JCE
IBMJCECCA ICSF CEX6C Crypto
CEX6C
Express
Cards
server.xml RACF

• z/OS Connect EE support for SSL/TLS is based on Liberty server support

• Java Secure Socket Extension (JSSE) API provides framework and Java
implementation of SSL and TLS protocols used by Liberty HTTPS support
• Java Cryptography Extension (JCE) is standard extension to the Java Platform
that provides implementation for cryptographic services
• IBM Java SDK for z/OS provides two different JCE providers, IBMJCE and
IBMJCECCA
40
© 2017, 2020 IBM Corporation

40

20
 2/11/2020

Using AT-TLS with z/OS Connect EE z/OS Connect EE

CPUs
CPACF

CEX6C
CEX6A
ICSF z/OS Connect EE
Liberty server
System JVM
https
SSL http
AT-TLS
AT-TLS
policy
RACF RACF
server.xml

• Application Transparent TLS (AT-TLS) creates a secure session on behalf of z/OS

Connect

• Only define http ports in server.xml (z/OS Connect does not know that TLS session exists)

• Define TLS protection for all applications (including z/OS Connect) in AT-TLS policy

• AT-TLS uses System SSL which exploits the CPACF and Crypto Express cards via ICSF
41
© 2017, 2020 IBM Corporation

41

JSSE and AT-TLS comparison z/OS Connect EE

Capability Description JSSE AT-TLS

1-way SSL Verification of z/OS Connect certificate by client Yes Yes

2-way SSL Verification of client certificate by z/OS Connect Yes Yes

SSL client authentication Use of client certificate for authentication Yes No

Support for requireSecure Requires that API requests are sent over HTTPS Yes No
option on APIs
Persistent connections To reduce number of handshakes Yes Yes

Re-use of SSL session To reduce number of full handshakes Yes Yes

Shared SSL sessions To share SSL sessions across cluster of z/OS Connect No Yes
instances
zIIP processing Offload TLS processing to zIIP Yes No

CPACF Offload symmetric encryption to CPACF Yes Yes

CEX6 Offload asymmetric operations to Crypto Express cards Yes Yes

© 2017, 2020 IBM Corporation

42

42

21
 2/11/2020

AT-TLS Inbound to zCEE Scenarios z/OS Connect EE

A Inbound Policy allows HTTPS z/OS Connect EE server

connections to HTTP port
JSSE
HTTP port
HTTPS port
server.xml
server.xml
9443 9080
9080
AT-TLS
inbound BAQURIMP
HTTP

CICS
HTTPS

cURL HTTPS CICS

AT-TLS
REST Client HTTPS
HTTPS
outbound HTTP Batch
HTTPS IMS
BAQURI / BAQPORT

A Outbound Policy allows non-SSL

clients to connection to HTTPS ports
43
© 2017, 2020 IBM Corporation

43

z/OS Connect EE
AT-TLS Outbound from zCEE Scenarios (HTTP/OTMA)

Db2/IMS/other Db2/IMS/other other

HTTP HTTP

AT-TLS AT-TLS HTTPS

inbound inbound

Inbound Policy allows HTTPS HTTPS

connections to HTTP port

AT-TLS AT-TLS
outbound outbound
HTTPS

HTTP HTTP

JSSE
z/OS Connect EE server

A Outbound Policy allows SSL protection

44
between two non-SSL endpoints © 2017, 2020 IBM Corporation

44

22
 2/11/2020

TLS Handshake Flow z/OS Connect EE

CICS API zCEE Server (API API

Requester Requester) Provider

Liberty CA Chain
CICS Program CICS CA Chain
API
Liberty Client Cert
API
Requester Liberty.KeyRing
Non SSL outbound
SSL API
CICS.KeyRing inbound SSL outbound

CICS Client Cert TrustStore

zCEE.KeyRing
CICS CA Chain
Provider Client Cert
zCEE Client Cert
Liberty CA Chain zCEE CA Chain
zCEE CA Chain
Provider CA Chain Provider CA Chain

45
© 2017, 2020 IBM Corporation

45

z/OS Connect EE

Configuring TLS Encryption with JSSE

© 2017, 2020
20 IBM Corporation

46

23
 2/11/2020

z/OS Connect EE
Cyphers

 During the TLS handshake, the TLS protocol and data exchange cipher
are negotiated
 Choice of cipher and key length has an impact on performance
 You can restrict the protocol (SSL or TLS) and ciphers to be used
 Example setting server.xml file
<ssl id="DefaultSSLSettings"
keyStoreRef="defaultKeyStore" sslProtocol="TLSv1.2"
enabledCiphers="TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384"/>
 This configures use of TLS 1.2 and two supported ciphers
 It is recommended to control what ciphers can be used in the server
rather than the client

47
© 2017, 2020 IBM Corporation

47

z/OS Connect EE
Persistent connections

 Persistent connections can be used to avoid too many handshakes

 Configured by setting the keepAliveEnabled attribute on the
httpOptions element to true
 Example setting server.xml file
<httpEndpoint host="*" httpPort="80" httpsPort="443"
id="defaultHttpEndpoint" httpOptionsRef="httpOpts"/>
<httpOptions id="httpOpts" keepAliveEnabled="true"
maxKeepAliveRequests=“500" persistTimeout="1m"/>
 This sets the connection timeout to 1 minute (default is 30 seconds) and
sets the maximum number of persistent requests that are allowed on a
single HTTP connection to 500
 It is recommended to set a maximum number of persistent requests when
connection workload balancing is configured
 It is also necessary to configure the client to support persistent
connections
48 © 2017, 2020 IBM Corporation

48

24
 2/11/2020

z/OS Connect EE
SSL sessions
 When connections timeout, it is still possible to avoid the impact of full
handshakes by reusing the SSL session id
 Configured by setting the sslSessionTimeout attribute on the sslOptions
element to an amount of time
 Example setting server.xml file
<httpEndpoint host="*" httpPort="80" httpsPort="443"
id="defaultHttpEndpoint" httpOptionsRef="httpOpts“
sslOptionsRef="mySSLOptions"/>
<httpOptions id="httpOpts" keepAliveEnabled="true"
maxKeepAliveRequests=“100" persistTimeout="1m"/>
<sslOptions id="mySSLOptions" sslRef="DefaultSSLSettings"
sslSessionTimeout=“10m”/>
 This sets the timeout limit of an SSL session to 10 minutes (default is 8640ms)
 SSL session ids are not shared across z/OS Connect servers

49
© 2017, 2020 IBM Corporation

49

z/OS Connect EE

Flowing identities to back end systems

© 2017, 2020
20 IBM Corporation

50

25
 2/11/2020

z/OS Connect EE
Flowing an identity to the back end
CICS Region

TCP The CICS SP propagates the distributed

Program id to CICS (or sends the SAF id if it has
been used for authentication)
z/OS Connect EE
IMS Region

Distributed Identity IMS The IMS SP asserts the mapped

TCP Program
Connect id to IMS but also sends the
Mapped Identity
local distributed id for audit purposes

MQ CICS Region
The MQ SP asserts the mapped
Q1
Program id to CICS
TCP
Q2

Db2 The REST client SP can request

a Passticket and send with
REST mapped ID to Db2 (available
Tables
services today in V3.0.15)
51
© 2017, 2020
20 IBM Corporation

51

Flowing a RACF ID to IMS z/OS Connect EE

IMS Service Provider

Liberty Server

z/OS Connect
Authentication IMS Service
Provider

Do not specify a User name and

password in the IMS Connection profile
IP

Flowed RACF ID IMS Connect OTMA

IMS14HWS
IMS TM
RACF=Y Flowed RACF ID IVP1
Either: Modify exit HWSJAVA0 IVTNOM
to check if incoming request is
IMS Connect will from zCEE and set the
not authenticate TrustedUser flag to True to
bypass authentication.
the User ID Or: Use IMS Connect Extensions
mapped in the to check access to a RACF
request resource whose name is based IMS TM will authorize the
of the IMS Connect name and
optionally on IP address of client
request using the flowed RACF ID
and IMS Connect PORT
52 © 2017, 2020 IBM Corporation

52

26
 2/11/2020

Flowing a RACF ID to IMS z/OS Connect EE

IMS Service Provider

Liberty Server

z/OS Connect
Authentication IMS Service
Provider
Do not specify a User name and
password in the IMS Connection profile

IP

Flowed RACF ID IMS Connect IMS TM

OTMA IVP1
IMS14HWS

RACF=N Flowed RACF ID

IVTNOM

IMS Connect will not

authenticate the User ID
mapped in the request IMS TM will authorize the
request using the flowed RACF ID
53
© 2017, 2020 IBM Corporation

53

Flowing a user ID with CICS service provider z/OS Connect EE

Liberty Server CICS

HTTP or
HTTPS
z/OS Connect TCPIPSERVICE
Program
Authentication CICS Service Flowed IPCONN
Provider Distributed ID or
SAF ID

IPIC connections enforce bind security to prevent an unauthorized client system from
connecting to CICS, link security to restrict the resources that can be accessed over a
connection to a CICS system, and user security to restrict the CICS resources that can be
accessed by a user

Distributed identities can be propagated to CICS and then mapped to a RACF user ID by CICS.
You can then view the distinguished name and realm for a distributed identity in the
association data of the CICS task. Important: If the z/OS Connect EE server is not in the same
sysplex as the CICS system, you must use an IPIC SSL connection that is configured with client
authentication.

If a SAF ID is used for authentication (e.g basicauth with a SAF registry) then the SAF ID is
passed to CICS.
54
© 2017, 2020 IBM Corporation

54

27
 2/11/2020

z/OS Connect EE
CICS IPCONN
Must match zosConnectApplid set in
DEFINE IPCONN(ZOSCONN) zosconnect_cicsIpicConnection
GROUP(SYSPGRP)
APPLID(ZOSCONN) Must match zosConnectNetworkid set in
NETWORKID(ZOSCONN) zosconnect_cicsIpicConnection
TCPIPSERVICE(ZOSCONN)
LINKAUTH(SECUSER) Specify name of
USERAUTH(IDENTIFY) TCPIPSERVICE
IDPROP(REQUIRED)
Requests run under
the flowed user ID

<zosconnect_cicsIpicConnection id="cscvinc"
host="wg31.washington.ibm.com"
zosConnectNetworkid="ZOSCONN"
zosConnectApplid="ZOSCONN"
port="1491"/>

55
© 2017, 2020 IBM Corporation

55

Flowing a user ID with MQ service provider z/OS Connect EE

Liberty Server MQ CICS

z/OS Connect Q1
Program
Flowed
Authentication MQ Service RACF ID Q2
Provider

Set useCallerPrincipal=true to flow the authenticated RACF user ID

<zosconnect_services>
<service name="mqPut">
<property name="destination" value="jms/default"/>
<property name="useCallerPrincipal" value=“true"/>
</service>
</zosconnect_services>

56
© 2017, 2020 IBM Corporation

56

28
 2/11/2020

Setting the user ID for the REST client service z/OS Connect EE

provider
Liberty Server DB2
HTTP or
z/OS Connect HTTPS (AT-TLS)
DB2 REST DB2
Authentication REST Client Services Tables
Service Provider

Authentication options:
<zosconnect_zosConnectServiceRestClientConnection 1. User ID / password
basicAuthRef=????
2. TLS Client Certificate
…
sslCertsRef="sslCertificates"/> 3. Passticket support

JSSE TLS client authentication (optional)

<zosconnect_zosConnectServiceRestClientBasicAuth
…
userName="EMPLOY1"
password="{xor}GhIPExAGDwg="/>
Specify a user name and password to be used
in the HTTP header with the DB2 REST Service

<zosconnect_zosConnectServiceRestClientBasicAuth
…
applName="applName"/> z/OS Connect requests a PassTicket from RACF
57 © 2017, 2020 IBM Corporation

57

z/OS Connect EE

What’s different for API Requester?

© 2017, 2020
20 IBM Corporation

58

29
 2/11/2020

z/OS Connect EE
API requester security – overview
Authentication Authorization Audit

Liberty z/OS Authentication Authorization

Back end system z/OS Connect EE

API provider
Encryption Encryption
z/OS
API Layer Security RESTful
Application
endpoint

Role Group
Access Access

SAF Security in support of server

runtime

1. Authentication (basic, client 4. Audit

certificate) 5. Configuring security with SAF
2. Encryption (aka "SSL" or "TLS")
3. Authorization (OAuth)
59
© 2017, 2020 IBM Corporation

59

z/OS Connect EE
Typical z/OS Connect EE security flow

1. A user ID and password can be used for basic authentication by the z/OS Connect EE server
2. Connection between the CICS, IMS, or z/OS application and the z/OS Connect EE server can use TLS
3. Authenticate the CICS, IMS, or z/OS application.
4. Authorize the authenticated user ID to connect to z/OS Connect EE and to perform specific actions
on z/OS Connect EE API requesters
5. Audit the API requester request
6. Pass the user ID and password credentials to an authorization server to obtain a security token.
7. Secure the connection to the external API provider, and provide security credentials such as a
security token to be used to invoke the RESTful API
8. The RESTful API runs in the external API provider
60 © 2017, 2020 IBM Corporation

60

30
 2/11/2020

z/OS Connect EE
Authentication
zconbt API requester
archive

Copybooks

z/OS LPAR

z/OS Address Space z/OS Connect EE API provider

z/OS Communication HTTP(s) API requester RESTful

HTTP(s) endpoint
application stub (. ara) endpoint

server.xml

1. Basic Authentication
Options: 1. Basic Authentication 2. TLS Client / Server
2. TLS Client / Server 3. Custom by coding
61
© 2017, 2020 IBM Corporation

61

z/OS Connect EE
Encryption

z/OS LPAR

z/OS Address Space z/OS Connect EE API provider

z/OS Communication HTTP(s) API requester RESTful

HTTP(s) endpoint
application stub (. ara) endpoint

server.xml

Options: 1. AT-TLS 1. JSSE

2. CICS TLS (System SSL) 2. AT-TLS

62
© 2017, 2020 IBM Corporation

62

31
 2/11/2020

z/OS Connect EE
Authorization

z/OS LPAR

z/OS Address Space z/OS Connect EE API provider

z/OS Communication HTTP(s) API requester RESTful

HTTP(s) endpoint
application stub (. ara) endpoint

server.xml

Authorization interceptor options: OAuth or JWT

• Global level access token
• API requester level

63
© 2017, 2020 IBM Corporation

63

z/OS Connect EE
Calling an API with OAuth 2.0 support
OAuth provider

token
endpoint

HTTPS

z/OS LPAR

z/OS Address Space z/OS Connect EE API provider

AuthServer endpoint
z/OS Communication HTTP(S) API requester RESTful
application stub (. ara) endpoint
API endpoint

HTTP(S) request
with access token

server.xml

MOVE user TO BAQ-OAUTH-USERNAME

MOVE password TO BAQ-OAUTH-PASSWORD

64
© 2017, 2020 IBM Corporation

64

32
 2/11/2020

z/OS Connect EE
Configuring OAuth support
For OAuth, two grant types are supported:
• Resource Owner Password Credential [a.k.a. password]
• Client Credentials [a.k.a. client credentials]

The access token is a way for the API provider to validate the client application rights to invoke its APIs.

<zosconnect_endpointConnection id="orderDispatchAPI"
host="https://154.2.45.123" port="443"
authenticationConfigRef="myOAuthConfig"/>

<zosconnect_oAuthConfig id="myOAuthConfig"
grantType="client_credentials"
authServerRef="myOAuthProvider" />

<zosconnect_authorizationServer id="myOAuthProvider"
tokenEndpoint="https://154.2.45.123/oauth2/token"
basicAuthRef="myAppID"/> optional

<zosconnect_authData id="myAppID" user="myClientID"

password="myClientSecret" />

65
© 2017, 2020 IBM Corporation

65

z/OS Connect EE
Calling an API with JWT support

MOVE user TO BAQ-TOKEN-USERNAME

MOVE password TO BAQ-TOKEN-PASSWORD

66
© 2017, 2020 IBM Corporation

66

33
 2/11/2020

z/OS Connect EE
Configuring JWT support
A JWT token is a way for the API provider to validate the client application rights to invoke its APIs.
<zosconnect_endpoint id="conn"
host="https://api.server.com"
authenticationConfigRef="myJWTConfig"/>
<zosconnect_authToken id="myJWTConfig"
authServerRef="myJWTserver"
header="myJWT-header-name" >
<tokenRequest credentialLocation="header"
header="Authorization" requestMethod="GET"/>
<tokenRequest />
<tokenResponse tokenLocation="header"
header="JWTAuthorization"/>
<tokenResponse />
</zosconnect_authToken>
<zosconnect_authorizationServer id="myJWTserver“
tokenEndpoint=
"https://jwt.server.com:9443/JWTTokenGenerator/getJwtToken"
basicAuthRef="tokenCredential" optional
sslCertsRef="defaultSSLConfig" />
<zosconnect_authData id="tokenCredential"
user="jwtuser" password="jwtpassword"/>

67
© 2017, 2020 IBM Corporation

67

Securing connection from z/OS Connect to API provider z/OS Connect EE

Request endpoint:
<zosconnect_endpointConnection id="orderDispatchAPI"
host="http://154.2.45.123" port="80"
domainBasePath="/mpl-icc/z-api-mpl/"
connectionTimeout="10s" receiveTimeout="20s" />
element also support HTTPS, BasicAuth and OAuth access token

For SSL client authentication:

<zosconnect_endpointConnection id="orderDispatchAPI"
host="https://154.2.45.123" port="443" sslCertsRef="myCerts"/>
<ssl id="myCerts" keyStoreRef="ks1" clientKeyAlias="john.cert"
sslProtocol="TLS" />

For Basic Authentication:

<zosconnect_endpointConnection id="orderDispatchAPI"
host="http://154.2.45.123" port="80"
authenticationConfigRef="myBasicAuth"/>
<zosconnect_authData id="myBasicAuth" user="John" password="{xor}pwd"/>

68
© 2017, 2020 IBM Corporation

68

34
 2/11/2020

z/OS Connect EE

Summary

© 2017, 2020
20 IBM Corporation

69

z/OS Connect EE
Summary
• Understand your enterprise’s security requirements

• Security design needs to consider

• Authentication
• Encryption
• Authorization
• Audit
• Protection against attack

• Because z/OS Connect EE is based on Liberty it benefits from a wide range of

Liberty security capabilities

• z/OS Connect EE has it’s own security capabilities in the form of the
authorization and audit interceptors

• Look at the security solution end to end, including the security capabilities of
an API Gateway

© 2017, 2020 IBM Corporation

70

35
 2/11/2020

More information z/OS Connect EE

© 2017, 2020 IBM Corporation

71

/questions?thanks=true
Thank you for listening.

© 2018, 2019 IBM Corporation

© 2017, 2020 IBM Corporation

72

36