z/OS Integration
Hitachi ID Password Manager (formerly P-Synch), a component of the Hitachi ID Management Suite, actually supports more than just passwords -- it is, in reality, a platform for managing authentication factors and encryption keys. Password Manager is used by many organizations to reduce the volume of IT support calls relating to passwords and PINs, to improve user productivity by eliminating login problems and to strengthen the security of passwords and of user support processes. Password Manager includes built-in connectors to manage passwords on over 113 kinds of systems and applications.
z/OS Security Product Integration
Password Manager can manage passwords on RACF, ACF2 and TopSecret.
There are three options for managing mainframe users and passwords, on any currently available version of z/OS:
- Install the Hitachi ID Mainframe Connector component as a started task on the
LPAR with the mainframe security database. The _shortMFCONNECTOR started task
acts as a TCP/IP listener and accepts inbound connections on a
designated TCP port. The Password Manager server negotiates a cryptographic
handshake with the started task (128-bit AES, shared secret
key, mutual authentication, random session keys) and asks the started
task to issue RACROUTE commands to enumerate users, verify current
passwords and reset passwords.
Advantages: Fast, secure, reliable, easy to configure.
Disadvantages: Change control to install a local, privileged agent on the mainframe. - Manage passwords using a Telnet or TN3270 script, assuming
that a Telnet or TN3270 service is enabled and available. This
option is less secure and robust than the _shortMFCONNECTOR started task,
but requires no change control on the mainframe.
Advantages: No change control, no local agent on the mainframe.
Disadvantages: Slower connections, no cryptographic protection, fragile if the terminal user interface is substantially changed. - Install an LDAP directory server on the mainframe, which uses
the mainframe security database as its back-end, at least for user
and password data. IBM and CA both provide such directory products.
With the LDAP service installed,
Password Manager can integrate with the mainframe as through it were
a normal LDAP directory.
Advantages: Fast and potentially secure -- if LDAP+SSL is used.
Disadvantages: Mainframe LDAP directory products are relatively new and quite fragile. Change control and a local software footprint on the mainframe are still required.
Triggering Password Synchronization
Native password changes made on zOS, OS390 or MVS mainframes, with any security product, can trigger transparent password synchronization, through insertion of a suitable exit program (provided with _shortMFCONNECTOR) in the LPAR with the security program.