There are a multitude of vendor products that provide SOX compliant security without using RACF, ACF2, TopSecret or other product. In those instances, transaction security has been disabled because the product uses its own internal security features and double authenticating serves no purpose. The better products use your existing security system buthandle the signon process themselves. If your application is not handling signon properly than it is time to get on the CICS-L list and get more help on how to set up CICS. If you are using a session manager and sharing a userid then the session is stolen and you can not fix the problem without revoking the userid and handing out unique userids. If your region prohibits a userid from being signed on more than once, get over to the CICS-L list. My favorite answer to unrealistic requests is to give them a url where they can purchase a magic wand and make it happen.
>We have an issue in one our project. The project is deveopled to see who >are using the system using the shared mainframe id. > >The problem here is that say suppose the user 1 using the shared id and >common passord login from terminal 1 and after some time while this user >is logged in , say a user 2 is logging in teminal 2 using the shared id >and common password , the other user will be automatically kicked out, >but still the online cics region will be active & for the 2'nd user the >cics region will not ask their individual password and the new screen >will not be thrown. > >Here there is a security issue/flaw involved. we need to control this >and this loophole in the design has to be tackled. could some one give >us suggestion how to take this? ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
