Administering the RPC Server for CICS Socket Listener

The EntireX RPC Server for CICS Socket Listener allows standard RPC clients to communicate with CICS programs running on IBM CICS®. All CICS interface types are supported: (DFHCOMMAREA, Channel Container and Large Buffer).

Customizing the RPC Server

The following are used to set up the RPC Server for CICS Socket Listener:

Configuration File

The default name of the configuration file is cicssocketlistener.properties. The RPC Server for CICS Socket Listener searches for this file in the current working directory.

You can set the name of the configuration file with -Dentirex.server.properties=<your file name> with "/" as file separator.

The configuration file contains the configuration for both parts of the RPC Server for CICS Socket Listener.

graphics/cicsSocket_config.png

Configuring more than one RPC Server

If you configure more than one RPC Server for CICS Socket Listener that connect to the same broker, the following items must be distinct:

  • the trace output file (property entirex.server.logfile)

  • the log for the Windows Service (property entirex.server.serverlog)

Start Script

The start script for the RPC Server for CICS Socket Listener is called cicssocketlistenerserver.bsh (UNIX) or cicssocketlistenerserver.bat (Windows) and is provided in the bin folder of the installation directory. You may customize this file.

Configuring the RPC Server Side

The RPC Server for CICS Socket Listener uses the properties that start with "entirex.server" for configuring the RPC server side.

Alternatively to the properties, you can use the command-line options. These have a higher priority than the properties set as Java system properties, and these have higher priority than the properties in the configuration file.

Property Name Command-line Option Default Explanation
entirex.server.brokerid -broker localhost Broker ID. See URL-style Broker ID.
entirex.server.serveraddress -server RPC/SRV1/CALLNAT Server address.
entirex.server.userid -user CICSSLRPCServer The user ID for access to the broker.
entirex.server.fixedservers   no
NO The number of worker threads balances between what is specified in entirex.server.minservers and what is specified in entirex.server.maxservers. This is done by a so-called attach thread. At startup, the number of worker threads is the number specified in entirex.server.minservers. A new worker thread starts if the broker has more requests than there are worker threads waiting. If more than the number specified in entirex.server.minservers are waiting for requests, a worker thread stops if its receive call times out. The timeout period is configured with entirex.server.waitserver. See worker model DYNAMIC.
YES The number of worker threads specified in entirex.server.minservers is started and the server can process this number of parallel requests. See worker model FIXED.
entirex.server.minservers   1 Minimum number of server threads.
entirex.server.maxservers   32 Maximum number of server threads.
entirex.server.restartcycles -restartcycles 15 Number of restart attempts if the Broker is not available. This can be used to keep the RPC Server for CICS Socket Listener running while the Broker is down for a short time.
entirex.server.password -password   The password for secured access to the broker. The password is encrypted and written to the property entirex.server.password.e.
To change the password, set the new password in the properties file.
To disable password encryption, set entirex.server.passwordencrypt=no.
Default: yes.
entirex.server.security -security no no|yes|auto|name of BrokerSecurity object
entirex.server.compresslevel -compresslevel 0 Permitted values (you can enter the text or the numeric value)
BEST_COMPRESSION 9
BEST_SPEED 1
DEFAULT_COMPRESSION -1, mapped to 6
DEFLATED 8
NO_COMPRESSION 0
N 0
Y 8
entirex.server.waitattach   600S Wait timeout for the attach server thread.
entirex.server.waitserver   300S Wait timeout for the worker threads.
entirex.timeout   20 TCP/IP transport timeout. See Setting the Transport Timeout under Writing Advanced Applications - EntireX Java ACI.
  -help   Display usage of the command-line parameters.
entirex.server.logfile -logfile   Name of the log file, default is standard output.
entirex.trace -trace 0 Trace level (1,2,3).

Configuring the CICS Socket Listener Side

These properties are used to configure the connection to CICS. As a prerequisite, the CICS Socket Listener must be installed. See Preparing for CICS Socket Listener.

Alternatively, you can use the command-line options. These have a higher priority than the properties set as Java system properties, and these have higher priority than the properties in the configuration file.

Name Default Value Explanation
cics.sl.host   Required. Host name or IP address where the CICS Socket Listener is running.
cics.sl.port   Required. TCP or SSL port number (1-65535) of the CICS Socket Listener.
cics.sl.transaction XRFE Required. Transaction ID (1-4 characters) defined for the RPC CICS RFE. Default is XRFE.
entirex.bridge.targetencoding cp037 Required. Specify the appropriate EBCDIC encoding used by your CICS installation. Default is codepage cp037 with full Latin-1 character set.
cics.sl.sockettimeout 20 Optional. Timeout (in seconds) for the CICS Socket Listener as SSL server. Default is 20 seconds.
cics.sl.userid   Optional. The user ID (max. 8 characters) for access to CICS as defined in your underlying mainframe security system (e.g. RACF).
cics.sl.password   Optional. Password (max. 8 characters) as defined in your underlying mainframe security system (e.g. RACF).
cics.sl.sslparams   SSL parameters (optional). Same syntax as Broker ID.
cics.sl.application.name   Optional. Required if pass ticket is to be used instead of a password. Application name (1-8 characters) as defined in your underlying mainframe security system (e.g. RACF). See note.

This property is ignored if cics.sl.password is set.

cics.sl.secured.signonkey   Optional. Required if pass ticket is to be used instead of a password. Secured signon key as defined in your underlying mainframe security system. Must be exactly 16 characters long. See note.

This property is ignored if cics.sl.password is set.

Note:
PassTicket is supported only when the CICS Socket Listener (remote connector) on z/OS is used. See Preparing for CICS Socket Listener and Installing CICS Socket Listener in the z/OS Installation documentation.

Using SSL/TLS with the RPC Server

To use SSL with the RPC Server for CICS Socket Listener, you need to configure two sides:

  • CICS Side
    See parameter cics.sl.sslparams.

  • RPC Server Side
    RPC servers can use Secure Sockets Layer/Transport Layer Security (SSL/TLS) as the transport medium. The term "SSL" in this section refers to both SSL and TLS. RPC-based servers are always SSL clients. The SSL server can be either the EntireX Broker or Broker SSL Agent. For an introduction see SSL/TLS and Certificates with EntireX in the Platform-independent Administration documentation.

    Start of instruction setTo use SSL

    1. To operate with SSL, certificates need to be provided and maintained. Depending on the platform, Software AG provides default certificates, but we strongly recommend that you create your own. See SSL/TLS Sample Certificates Delivered with EntireX in the EntireX Security documentation.

    2. Set up the RPC Server for CICS Socket Listener for an SSL connection.

      Use the URL-style Broker ID with protocol ssl:// for the Broker ID. If no port number is specified, port 1958 is used as default. Example: 

      ssl://localhost:22101?trust_store=C:\SoftwareAG\EntireX\etc\ExxCACert.jks&verify_server=no

      If the SSL client checks the validity of the SSL server only, this is known as one-way SSL. The mandatory trust_store parameter specifies the file name of a keystore that must contain the list of trusted certificate authorities for the certificate of the SSL server. By default a check is made that the certificate of the SSL server is issued for the hostname specified in the Broker ID. The common name of the subject entry in the server's certificate is checked against the hostname. If they do not match, the connection will be refused. You can disable this check with SSL parameter verify_server=no.

      If the SSL server additionally checks the identity of the SSL client, this is known as two-way SSL. In this case the SSL server requests a client certificate (the parameter verify_client=yes is defined in the configuration of the SSL server). Two additional SSL parameters must be specified on the SSL client side: key_store and key_passwd. This keystore must contain the private key of the SSL client. The password that protects the private key is specified with key_passwd.

      The ampersand (&) character cannot appear in the password.

      SSL parameters are separated by ampersand (&). See also SSL/TLS Parameters for SSL Clients.

    3. Make sure the SSL server to which the RPC side connects is prepared for SSL connections as well. The SSL server can be EntireX Broker or Broker SSL Agent. See:

      • Running Broker with SSL/TLS Transport under z/OS | UNIX | Windows | z/VSE

      • Settting up and Administering the EntireX Broker SSL Agent under UNIX | Windows

Starting the RPC Server

Start of instruction setTo start the RPC Server for CICS Socket Listener

Stopping the RPC Server

Start of instruction setTo stop the RPC Server for CICS Socket Listener

Running an EntireX RPC Server as a Windows Service

For general information see Running an EntireX RPC Server as a Windows Service.

Start of instruction setTo run the RPC Server for CICS Socket Listener as a Windows Service

  1. Customize the Start Script according to your system installation.

    See also Starting the RPC Server.

  2. Test your RPC server to see whether it will start if you run your script file.

  3. Use the EntireX RPC Service Tool and install the RPCService with some meaningful extension, for example MyServer. If your Start Script is cicssocketlistenerserver.bat, the command will be 

    RPCService -install -ext MyServer -script install_path\EntireX\bin\cicssocketlistenerserver.bat

    The log file will be called RPCservice_MyServer.log.

  4. In Windows Services menu (Control Panel > Administrative Tools > Services) select the service: Software AG EntireX RPC Service [MyServer] and change the property Startup Type from "Manual" to "Automatic".

Application Identification

The application identification is sent from the RPC Server for CICS Socket Listener to the Broker. It is visible with Broker Command and Information Services.

The identification consists of four parts: name, node, type, and version. These four parts are sent with each Broker call and are visible in the trace information.

For the RPC Server for CICS Socket Listener, these values are:

Identification Part Value
Application name ANAME=RPC Server for CICS Socket Listener
Node name ANODE=<host name>
Application type ATYPE=Java
Version AVERS=10.3.0.0