New parameter for IMS APPL class validation for OTMA messages

Using the IMS APPL class in RACF it is possible to control the authority of users who attempt to logon to IMS. In my customer’s shop the IMS APPL class is active and all personal userids are authorized to the IMS APPL class.

But there are other types of users. They are the users used in WAS-IMS Connect-OTMA applications that, in some way, represent an application and are not personal userids.

In our shop, these userids were restricted from accessing the IMS application by the IMS APPL class. The reason is that no one who can know the password of one of these userids can use it from a terminal connected to IMS.

During the migration from IMS V13 to IMS V15 we found that since IMS V14 the IMS APPL class also protects the logon of OTMA “sessions”. To do this, RACF is called to see if the userids of the OTMA messages are authorized to the IMS APPL class.

This change in behavior in IMS has meant that we have had to authorize the OTMA applications userids to the IMS APPL class as well. So, my customer has lost some security.

It would be very good if there were a new differentiated parameter for IMS APPL class validation (analogous to the DFSDCxxx SAPPLID parameter) to be able to validate the userids of the messages that arrive through OTMA differently from those who logon from a terminal connected to IMS.