Original Client Certificate Userid in CICS Monitoring Record

When a HTTP request, running in CICS Liberty, is authenticated by a client certificate the CICS monitoring record does not contain the correct userid. That does not affect runtime operation of the user task, but the task will be associated with the CICS Default User instead of the original certificate userid.

When an HTTP request arrives in Liberty it drives some CICS code which will cause a new task to get attached. At that point in time Liberty has not yet associated a userid with the thread. This means that CICS does not know the userid, but still needs one to start the user task. In a basic authentication scenario CICS does its own processing of the HTTP Authorization header and extracts the original userid. This is why the user task is able to start with the correct userid when basic authentication is used. With basic authentication the correct userid is also available from CICS Monitoring Records (SMF110). That capability is not available when using a client certificate.

In the client certificate scenario the task starts and the monitoring data is created using the information at that point in time. This will only include the current userid, which is the cics default user. Once the task has been created, but before any user code runs, CICS gets notified by Liberty that the identity for the thread has now been set. CICS now switches the userid of the task to the one that Liberty has determined and performs the standard task attach security checking. The switching of the userid is not reflected in cics monitoring records, only the cics default user is logged. This RFE proposes to either directly attach tasks authenticated by client certificates with the original userid or to introduce a new monitoring field, which identifies the userid associated with the client certificate.