One other thing: RACF also supports Passtickets. You can define a 64-bit key in RACF that you provide out-of-band to the client. With that key and the published Passticket algorithm (RACF Macros and Interfaces), you can generate a one-time-only password that must be used within at most 20 minutes. That is, both systems use GMT in computation and the algorithm allows for plus or minus 10 minute differents in TOD clocks.
Alan Altmark z/VM Development IBM Endicott
