System methods for sending information about a user

APPC architecture provides three methods for sending security information about a user from the source system to the target system.

These methods are referred to as the architected security values. The APPC Programming book provides more information about the architected security values.

The following table shows the security values in the APPC architecture:

Table 1. Security values in the APPC architecture
Architected security value User ID set to target system Password sent to target system
None No No
Same Yes1 See note 2.
Program Yes Yes3
Note:
  1. The source system sends the user ID if the target system specifies SECURELOC(*YES) or SECURELOC(*VFYENCPWD).
  2. The user does not enter a password on the request because the password is already verified by the source system. For SECURELOC(*YES) and SECURELOC(*NO), the source system does not send the password. For SECURELOC(*VFYENCPWD), the source system retrieves the stored, encrypted password and sends it, in encrypted form.
  3. The system sends the password in encrypted form if both the source and target systems support password encryption. Otherwise, the password is not encrypted.

The application that you request determines the architected security value. For example, SNADS always uses SECURITY(NONE). DDM uses SECURITY(SAME). With display station passthrough, you specify the security value by using parameters on the STRPASTHR command.

In all cases, the target system chooses whether to accept a request with the security value that is specified on the source system. In some situations, the target system might reject the request completely. In other situations, the target system might force a different security value. For example, when you specify both a user ID and a password on the STRPASTHR command, the request uses SECURITY(PGM). However, if the QRMTSIGN system value is *FRCSIGNON on the target system, you still see a Sign On display. With the *FRCSIGNON setting, the systems always use SECURITY(NONE), which is the equivalent of the user entering no user ID and password on the STRPASTHR command.

The source and target systems negotiate the security value before data is sent. In the situation where the target system specifies SECURELOC(*NO) and the request is SECURITY(SAME), for example, the target system tells the source system to use SECURITY(NONE). The source system does not send the user ID.

The target system rejects a session request when the user’s password on the target system has expired. This applies only to connection requests that send a password, including the following:
  • Session requests of type SECURITY(PROGRAM).
  • Session requests of type SECURITY(SAME) when the SECURELOC value is *VFYENCPWD.
Parent topic: APPC user access to the target system