This document describes the security environment of a Natural Subprogram Server under z/OS (Batch).
This document covers the following topics:
Each request contains the user identification and the user password. The Natural Subprogram Server performs a LOGON with these credentials. Natural security validates the user-ID and the password. All restrictions set for this user in Natural Security take effect.
From the operating system's perspective, the user operates anonymously under the account of the Natural Subprogram Server.
The Natural Subprogram Server can be configured to run with impersonation. For more information, see Natural API Server > Natural Subprogram Server on z/OS > Configuration > Configuration Parameters > SECURITY-MODE.
If the server is configured to run with impersonation, every client will be validated by the z/OS security system. The z/OS subtask of the client runs under the account of the client. All restrictions set for this user in RACF will take effect. Every client must be defined in the z/OS security system. For more information, see Natural API Server > Natural Subprogram Server on z/OS > Configuration > External Security Configuration.
To use impersonation, Natural Security (NSC) is a prerequisite. If a user is validated by the z/OS security system, the user is accepted as a “trusted” user by NSC. That is, the user must be defined in NSC but no password is validated during logon. So even with impersonation, all restrictions set for this user in Natural Security will take effect.
