This document describes how to configure a Natural Development Server for z/OS (Batch).

The following topics are covered:

• Configuration Requirements

• NDV Configuration File

• NDV Configuration Parameters

• NDV Configuration File Example

• NDV Server Datasets

• NDV User Exits (Coded in Natural)

• Other NDV User Exits

• Encrypted Communication

Configuration Requirements

A Natural Development Server for z/OS (Batch) requires the following z/OS language environment parameter configuration:

ENVAR(TZ=CET-1DST) CET

You can set the z/OS language environment parameters:

• With the PARM parameter specified in the EXEC card of the Natural Development Server startup job. The length of the options is limited by the maximum length of the PARM parameter.

• Assemble an LE/370 runtime option module CEEUOPT and link it to the Natural Development Server load module.

External Security Configuration

If you configure the NDV server to impersonate the NDV clients in the NDV server (NDV configuration parameter SECURITY_MODE set to IMPERSONATE or IMPERSONATE_LOCAL), the NDV server must run "program-controlled". Under RACF, the following definitions are required for the NDV server:

• The resource BPX.SERVER must be defined and the NDV server account must have READ access to this resource.

• The LOAD datasets defined in the NDV startup job definition must be defined to the program class "**".

  ralt program ** addmem('natural load library') uacc(read)
  ralt program ** addmem('NDV load library'//NOPADCHK) uacc(read)
  ralt program ** addmem('user load library'//NOPADCHK) uacc(read)

• SETR WHEN(PROGRAM) REFRESH

Additionally, each client connecting to the server must be defined in RACF and must be granted to use the z/OS Linux System Services.

NDV Configuration File

A configuration file is allocated to the name <serverid>C (for example, NDVS1C) or STGCONFG alternatively.

The configuration file is a text file located on a dataset or on an HFS file under z/OS.

The configuration file contains the server configuration parameters in the form of a keyword=value syntax. In addition, it may contain comments whose beginning is marked with a hash symbol (#).

See also the NDV Configuration File Example shown below.

NDV Configuration Parameters

The following NDV configuration parameters are available:

• DBG_CODEPAGE

• DEFAULT_PROFILE

• FORCE_IPV4

• FRONTEND_NAME

• FRONTEND_OPTIONS

• FRONTEND_PARAMETER

• HANDLE_ABEND

• HOST_NAME

• HTPMON_ADMIN_PSW

• HTPMON_PORT

• IGNORE_PRESENT_SERVER

• INITIAL_USERID

• KEEP_TCB

• MINIMUM_STUDIO_VERSION

• O4I

• PARMCHECK

• PASSWORD_MIXEDCASE

• PORT_NUMBER

• SECURITY_MODE

• SECURITY_CACHING

• SECURITY_SYSLOG

• SECURITY_TIMEOUT

• SESSION_PARAMETER

• SESSION_PARAMETER_MIXED_CASE

• SESSION_TIMEOUT

• TERMINAL_EMULATION

• THREAD_NUMBER

• THREAD_SIZE

• TRACE_FILTER

• TRACE_LEVEL

• UNICODE_SOURCE

• UPPERCASE_SYSTEMMESSAGES

DBG_CODEPAGE

This optional configuration parameter specifies the translation table to be used by the remote debugger. By default, the remote debugger uses the code page IBM-1047, whereas the Natural Development Server uses TABA1/2.

No default value is provided.

Example:

DBG_CODEPAGE=USER

DEFAULT_PROFILE

This optional configuration parameter defines a default profile.

profile-name,dbid,fnr,password,cipher-code

No default value is provided.

Example:

DEFAULT_PROFILE=RDEVS,10,930

The setting in the example defines that, if no parameters are defined in the Map Environment dialog box of Natural Studio, the session is started with the Natural profile parameter PROFILE=(RDEVS,10,930).

Related parameter: SESSION_PARAMETER.

FORCE_IPV4

This configuration parameter applies to z/OS.

This parameter allows you to enforce the use of communication method IPV4.

FRONTEND_NAME

This configuration parameter specifies the name of the Natural front-end to be used to start a Natural session. The front-end resides on a PDS member.

No default value is provided.

Example:

FRONTEND_NAME=NATvrsSV

- where vrs stands for the version, release, system maintenance number.

FRONTEND_OPTIONS

The values of this configuration parameter may be used to specify additional options for the Natural front-end.

You may combine the above options as desired in that you add their values and set the result as shown in the example below.

Example:

FRONTEND_OPTIONS=07

The setting in this example enables the Options 01, 02 and 04.

FRONTEND_PARAMETER

This optional configuration parameter contains additional Natural front-end parameters as specified in the Startup Parameter Area.

FRONTEND_PARAMETER = 'MSGCLASSX       '

No default value is provided.

For further information, refer to the section Natural in Batch Mode in the Natural Operations for Mainframe documentation.

Example:

FRONTEND_PARAMETER='MSGCLASSX       '

The setting in this example specifies that the default output class for CMPRINT is X.

HANDLE_ABEND

If an abend occurs in the server processing outside the Natural processing the abend is not trapped by the Natural abend handling. For this reason the NDV server has its own abend recovery.

It is recommended that you leave this parameter on its default value in order to limit the impact of an abend to a single user. If you set the value of this parameter to NO, any abend in the server processing terminates the complete server processing. That is, it affects all users running on that server.

Example:

HANDLE_ABEND=NO

HOST_NAME

This optional configuration parameter is necessary only if the server host supports multiple TCP/IP stacks.

No default value is provided.

Example:

HOST_NAME=node1

or

HOST_NAME=157.189.160.55

HTPMON_ADMIN_PSW

This configuration parameter defines the password required for some monitor activities (for example, Terminate Server) performed by the HTML Monitor Client.

No default value is provided.

Example:

HTPMON_ADMIN_PSW=GHAU129B

HTPMON_PORT

An NDV server can be configured to host an HTTP monitor task which serves the HTML Monitor Client running in a web browser. It is not required to run this monitor task on each server. A single task allows you to monitor all servers running at one node.

This configuration parameter defines the TCP/IP port number under which the server monitor task can be connected from a web browser.

No default value is provided.

Example:

HTPMON_PORT=3141

IGNORE_PRESENT_SERVER

An NDV server allocates a so-called "server environment" which contains the server dependent common resources. This environment is unique for each server and relates to the NDV server name.

If an NDV server with NDV CICS Adapter ends abnormally, it might leave a stuck NDV server environment within the CICS region. This causes that a restart of the server fails with error message NAT9913.

If you start an NDV server with IGNORE_PRESENT_SERVER=YES, it might damage an already running server which is using the same server name and the same CICS region.

Example:

IGNORE_PRESENT_SERVER=YES

INITIAL_USERID

At server initialization, the Natural Development Server creates a temporary Natural session to obtain the properties of the installed Natural environment.

This configuration parameter specifies the user ID to be used for this Natural session.

Example:

INITIAL_USERID=NDVINITU

See also NDV Clients must be defined to Natural Security (in the Natural Development Server Installation documentation).

KEEP_TCB

By default, the remote Natural session of a mapped environment terminates its TCB whenever you switch the focus within Natural Studio to a different mapped environment. If you toggle the focus back, the remote session is dispatched using a different TCB.

The maximum number of active TCBs is equal to the number of connected clients.

The configuration parameter KEEP_TCB specifies whether the remote Natural session should use the same TCB during its entire lifetime. This is required if you use Adabas and the Adabas parameter ADANAME is set to ADAUSER or if you want to access DB2. It could also be required if you access 3GL programs which need to be executed under the same TCB for successive calls.

Example:

KEEP_TCB=YES

MINIMUM_STUDIO_VERSION

This parameter defines a minimum version of Natural Studio which is required to operate with the NDV server. This parameter assists in performing a preliminary validation if all clients use a minimum Natural Studio version. This can be useful to smoothly upgrade to a NDV version that does not support clients whose version is below the minimum Natural Studio version.

Example:

MINIMUM_STUDIO_VERSION=62100

O4I

This parameter allows you to collect server data for Optimize for Infrastructure.

Example:

O4I=YES

PARMCHECK

This parameter allows you to perform a parameter check of Natural session parameters after the server is up. The check is done by mapping to Natural. If a problem occurs, a message is written to the NDV server trace, and the server is terminated immediately. In such cases, session parameters (SESSION_PARAMETER) can be corrected. To avoid termination of the server in case of invalid Natural parameters, the parameter check can be switched off.

This parameter does not apply with SECURITY_MODE=IMPERSONATE, IMPERSONATE_LOCAL, or IMPERSONATE_REMOTE.

Example:

PARMCHECK=NO

PASSWORD_MIXEDCASE

This parameter allows you to define whether passwords specified in the Map Environment dialog are translated into upper case or not.

This parameter does only apply with SECURITY_MODE=IMPERSONATE, IMPERSONATE_LOCAL or IMPERSONATE_REMOTE.

Example:

PASSWORD_MIXEDCASE=YES

PORT_NUMBER

This configuration parameter defines the TCP/IP port number under which the server can be connected.

No default value is provided.

Example:

PORT_NUMBER=3140

SECURITY_MODE

The Natural Development Server offers a security concept that also covers the operating system resources. The client credentials are validated at the operating-system-depending security system and the client request is executed under the client's account data.

Using the SECURITY_MODE parameter, you can specify at which rank (Batch or CICS) you want to impersonate the activities of an NDV client.

Note concerning Natural for DB2 (Batch Server only): In order to be able to run the Natural Development Server with impersonation enabled, you must have linked the DB2 interface module DSNRLI (instead of DSNALI) to the Natural nucleus.

No default value is provided.

Example:

SECURITY_MODE=IMPERSONATE

SECURITY_CACHING

SECURITY_CACHING applies only to a Natural Development Server for z/OS (Batch), and pertains to SECURITY_MODE being set to IMPERSONATE_LOCAL.

SECURITY_CACHING is intended for server environments where password changes occur frequently. Commonly, each client action in NaturalONE starts a new server session and the password is checked each time. At worst, this requires the client to enter a new password for each client action.

In order to allow for the client to experience a smooth workflow, information about the client is stored in a client list. Based on the stored information, access is therefore possible without having to repeat entering new passwords. The duration of validity of a client entry can be set using the parameter SECURITY_TIMEOUT.

The client list stores the user Id and Host (IP Address), the time of login and the time of last access, together with a hash value of the password. The hash value of the password is generated by the sha1 algorithm. During the first login, the user is authorized and an ACEE is generated, which is also saved in the client list. For each subsequent accesses of the same user, only the hash value of the saved password is compared to the hash value of the sent password. If both passwords match, the session is started with the saved ACEE. If the hash values of the passwords are not the same, the user is prompted to enter a password.

To create an ACEE, SECURITY_CACHING requires the Natural Authorized Services Manager for the execution of authorized services of the z/OS Security Server RACF.

Example:

SECURITY_CACHING=YES

SECURITY_SYSLOG

Write a console message in case of security problems with external security. One line is written to the console, for example 'Aug-23 16:22:46.77 S0305217 BPXM023I (INITUSER) SERVERID - Invalid userid specified.' More information about the reason can be found in the appropriate trace or error log of the server.

The parameter applies to z/OS Batch servers only.

SECURITY_SYSLOG=YES

SECURITY_TIMEOUT

SECURITY_TIMEOUT only applies, if SECURITY_CACHING is set.

Cancels active client when the SECURITY_TIMEOUT parameter is met. Checks for clients active longer than n minutes once a day at HH:MM (24 hours) or every n minutes.

The server will not start if an invalid SECURITY_TIMEOUT parameter is given.

Examples:

SECURITY_TIMEOUT=19:30,480

Every day at 19:30 cancel clients logged on for more than 480 minutes.

SECURITY_TIMEOUT=19:30,0

Every day at 19:30 cancel all clients.

SECURITY_TIMEOUT=360,480

Every 360 minutes cancel clients logged on for more than 480 minutes.

SESSION_PARAMETER

This optional configuration parameter defines session parameters that precede the parameter string either specified in the Map Environment dialog of Natural Studio or defined by default by the configuration parameter DEFAULT_PROFILE.

No default value is provided.

Example 1:

SESSION_PARAMETER='NUCNAME=NATNUCvr' +
  'PROFILE=(NDVPARM,18006,48),ADAMODE=0,' +
  'BPI=(TYPE=NAT,SIZE=6044),BPI=(TYPE=EDIT,SIZE=2048)', + 
  'BPI=(TYPE=SORT,SIZE=1024)'

- where vr stands for the version and release number.

Example 2:

SESSION_PARAMETER=FNAT=(10,930)

The setting in the second example defines that every session on this Natural Development Server is started with the session parameter FNAT=(10,930) appended to the user-specified parameters or the definitions in the configuration parameter DEFAULT_PROFILE.

SESSION_PARAMETER_MIXED_CASE

This optional configuration parameter can be used to allow session parameters and URL specifications in mixed case.

SESSION_TIMEOUT

Cancel inactive sessions when the SESSION_TIMEOUT parameter is met. Check for sessions inactive longer then n minutes once a day at HH:MM (24 hours) or every n minutes.

The server will not start if an invalid SESSION_TIMEOUT parameter is given.

Examples:

SESSION_TIMEOUT=19:30,480

Every day at 19:30 cancel sessions more than 480 minutes inactive.

SESSION_TIMEOUT=360,480

Every 360 minutes cancel sessions more than 480 minutes inactive.

TERMINAL_EMULATION

This configuration parameter defines the terminal emulation to be used for processing the Natural I/O. This definition applies to all clients using that server.

Example:

TERMINAL_EMULATION=WEBIO

THREAD_NUMBER

This configuration parameter specifies the number of physical storage threads to be allocated by the Natural front-end, that is, the number of sessions that can be executed in parallel.

Example:

THREAD_NUMBER=5

THREAD_SIZE

This configuration parameter specifies the size of each physical storage thread which contains the Natural session data at execution time.

Example:

THREAD_SIZE=800

TRACE_FILTER

This optional configuration parameter enables you to restrict the trace by a logical filter in order to reduce the volume of the server trace output, for example:

TRACE_FILTER="Client=(KSP P*)"

Each request of the user ID KSP and each request of the user IDs starting with a P are traced.

See Trace Filter in the section Operating the Natural Development Server.

TRACE_LEVEL

Example:

TRACE_LEVEL=0x00000011

or alternatively

TRACE_LEVEL=31+27

The setting in the example switches on Bits 31 and 27.

UNICODE_SOURCE

This configuration parameter is used to define whether the NDV server accepts source files in Unicode or not.

Sources transmitted in unicode are not converted using the Natural ASCII-to-EBCDIC translation tables TABA1/TABA2. All characters in the source file are supported without maintaining the Natural translation tables.

A transmission in Unicode, however, increases the CPU consumption of the server significantly.

Example:

UNICODE_SOURCE=YES

UPPERCASE_SYSTEMMESSAGES

This configuration parameter is used to enable or disable the translation of all NDV error messages and trace outputs to uppercase. This feature is for customers who are using character sets with no lowercase characters defined.

NDV Configuration File Example

 # This is a comment
SESSION_PARAMETER=profile=(stgqa,10,930) fuser=(10,32)
DEFAULT_PROFILE=DEFPROF
THREAD_NUMBER=2
THREAD_SIZE=700
FRONTEND_NAME=NATOS31L       # and another comment
PORT_NUMBER=4711

NDV Server Datasets

The Natural Development Server requires the following datasets:

Alternatively, you can qualify each dataset name by the server ID.

NDV User Exits (Coded in Natural)

Natural Single Point of Development provides the following user exits for mainframes:

^*) The sources of these user exit routines are named NDV-SXnn, where nn denotes the number of the user exit routine.

To make a user exit routine available

1. Copy the source code from SYSLIB into a user library.

2. Catalog it under the name NDV-UXnn.

3. Copy it back into the Natural system library SYSLIB.

The name of each user exit source is different from the name of the corresponding cataloged object. This guarantees that the object is not affected if the user exit source is overwritten by an installation update.

For further details, see the source code of the user exit routines NDV-SXnn in the Natural system library SYSLIB.

Other NDV User Exits

Apart from the NDV user exits that are coded in Natural, the following user exit exists:

User Exit NSECUX01

This user exit is applicable only when the parameter SECURITY_MODE is set to IMPERSONATE_LOCAL or IMPERSONATE.

This user exit allows you to adapt the user ID used for the RACF login. It is useful if the RACF user IDs and the user IDs used in Natural differ according to a standardized rule. For example, each RACF user ID is the corresponding Natural user ID preceded by two dollar signs ($$).

If the exit (the loadmodule NSECUX01) is found in the NDV load library concatenation, it is called using standard linkage conventions (direct branch using BASR instructions) before the user is validated against RACF.

The following parameters are passed to the exit:

The exit is called using standard linkage conventions.

Sample user exit implemented in C:

#include <string.h>
#include <stdio.h>
#  pragma linkage (NSECUX01, FETCHABLE)
void NSECUX01(char sUid[64])
{
char sUidTemp[64];
  printf("Uex got usid:%s\n", sUid);
  strcpy(sUidTemp, sUid);
  sprintf(sUid, "$$%s", sUidTemp);
  printf("Uex ret usid:%s\n", sUid);
  return;
}

The exit above extends each user ID by two preceding dollar signs ($$) when it is used for RACF login.

Encrypted Communication

Communication between NaturalONE and NDV servers can be encrypted by using an SSL or (preferably) a TLS protocol.

On the server side, encryption is enabled by using the AT-TLS component of the z/OS Communications Server. AT-TLS allows you to encrypt and secure the TCP/IP communication between client and server without any changes on the server side. If you want to use encrypted communication mode, you must define a set of rules concerning the NDV server job for the policy agent (PAGENT) configuration file of AT-TLS. Encrypted communication requires a certificate associated with encryption on the server side. This encryption certificate must either be included in a RACF keyring or stored in a key database located on the z/OS USS POSIX file system.

Use the ZOSMF utility for maintaining the PAGENT.

For detailed information on AT-TLS, refer to the z/OS Communications Server documentation from IBM.