Provide the capability for user to supply a SECLABEL during CICS sign-on

With DB2 V8, MLS (Multi Level Security) it is possible to provide ROW level security to data in DB2 tables via SECLABELs ( RACF Security Lables) .
Although CICS does not fully support multilevel security, you can use
it in a multilevel-secure environment if you take care in the configuration.



By activating the RACF SECLABEL class and defining a set of security labels for users and DB2 table rows, it is possible to then access the secured DB2 rows via CICS. It is not required to have MLACTIVE or MLS set/activated. (MLSACTIVE or MLS(FAILURES) are not turned ON) You can use DB2 row-level security without impact on the rest of the MVS system.

When a CICS User does a CICS sign-on, the DEFAULT SECLABEL will be associated by RACF with the ACEE for this USER.

For non terminal programs , such as PLT programs
if the PLTPIUSR parameter is not specified, the PLT programs are run
under the CICS region userid when the PLTPISEC=NONE option is defined.

In this case you need to define the CICS region userid with a DEFAULT SECLABEL as described above.

LIMITATION: In the current CICS design, a CICS user is not able to supply a SECLABEL value during sign-on to CICS. TSO sign-on does provide this ability. So a CICS user is limited to only one SECLABEL value which is coded in the DEFAULT SECLABEL of the RACF User profile. This FITs is opened to ask that CICS provides the user with the ability to supply a SECLABEL during sign-on to CICS.