z/os Connect to pass the terminal id or original ip address for securitu

This requirement is addressed by z/OS Connect V3.0.55 / APAR PH43628: https://www.ibm.com/support/pages/apar/PH43628
The underlying problem is now solved since you can containerise your API as a micro service and restrict access to it, to only be from certain endpoints via and ingress router or TLS config
For further details refer to the “ Securing z/OS Connect resourses ”topic in the z/OS Connect OpenAPI 3 Documentation: https://www.ibm.com/docs/en/zosconn/zos-connect/3.0?topic=securing-zos-connect-resources

Whilst this requirement (restrict certain users to certain IP addresses) is valid, based on our current plans and priorities for IBM z/OS Connect Enterprise Edition, it is not likely that this will be implemented in the next 12 months. Correspondingly this requirement is being declined at this point. The requirement will be kept in the RFE system and might be reassessed in the future. You also have an opportunity to resubmit in twelve months time if you wish it to be reconsidered then.

It is currently possible to restrict requests from only certain IP addresses as per the previous comments.

I think I may not have explained this issue as well as I could. I have asked our security person to give me a batter explanation.

=====================================================================
"It is good to know that APIs can be restricted to certain IP addresses. However, this is to do at the application level only and not a solution to the issue we currently face. The terminal restriction in our organisation is at the system level and applicable to all mainframe applications.
Certain system logonids can only sign on to the mainframe from certain terminal-ids or IP addresses which are defined in the ACF2 database. As z/OS Connect cannot pass on the terminal-id (or IP address) to ACF2 via SAF, the existing terminal restriction at the system level would have to be downgraded in order to enable the system user to sign on to the z/OS Connect application. To fix this security issue, I strongly believe zOS Connect should pass on TERMID to ACF2 via SAF.
====================================================================
I have tried to attach a word document but it keeps failing with 'unknown error while scanning'. Are you able to provide me with an email or ftp address where I can send the file?

Thank you for this RFE.

During our assessment of this RFE our technical team have suggested that existing function in the product today can be used to restrict API calls to only a trusted set of IP addresses.

It is possible to restrict access to a z/OS Connect EE server to known IP addresses, by adding some tcpOptions entries to server.xml, for example:
enabled="true"
host="*"
httpPort="1234"
httpsPort="1235">
addressIncludeList="9.1.2.3"
/>
enabled="true"
/>


- the accesslogging is optional and creates a file to log successful requests (not failed ones).

The RFE mentioned restricting access to specific APIs. This needs to be done through API security as there is no relationship between httpEndpoints and APIs. So a complete solution would be a combination of using tcpOptions (as documented in the Liberty Knowledge Center https://www.ibm.com/support/knowledgecenter/en/SS7K4U_liberty/com.ibm.websphere.liberty.autogen.zos.doc/ae/rwlp_config_httpEndpoint.html#tcpOptions), and API security (as documented in the "Securing z/OS Connect EE Resources" section of the z/OS Connect EE Knowledge Center here: https://www.ibm.com/support/knowledgecenter/en/SS4SVW_3.0.0/securing/security_overview.html).

If the above solution does not meet your need of "Restricting API access to known, trusted, IP addresses" we would like to know specifically what ability you would require over and above the existing technology in order to achieve your goals?