determination as to whether a given operator is authorized to do a given transaction.
MAGEC will first do all of its own security checking. If the transaction is rejected by the intrinsic checks, it will (cont.)
issue the standard "unauthorized..." message without ever calling the external security module; however, if MAGEC (cont.)
security parameters show the operator to be authorized, it will then call your module for further checking. If your (cont.)
module passes back an unauthorized status, a message is issued to the operator. If your module returns an authorized (cont.)
status, the transaction will be allowed to process.
The external security program you write is an ordinary, usually Command-Level Cobol, program which may issue calls to (cont.)
an interface provided with your external security system. You specify to MAGEC the name of that program in the MAGEC (cont.)
System Parameters table, Table #243. The parameter is named SECURITY-EXIT. Thus, you could enter the command (cont.)
online:
TBLCHG 243/SECURITY-EXIT
and then set or alter the name of your security checking program. If you specify a name of all spaces, MAGEC will (cont.)
bypass attempting to call your program and only the intrinsic MAGEC security parameters will be (cont.)
used.
In order to write a security checking program you must follow a few simple conventions. Those conventions are discussed in this chapter under the heading Security Exit.
##
Bypassing MAGEC Security
Some MAGEC users may wish to bypass MAGEC's security checking altogether. Normally this would be because they have (cont.)
written a security exit program which will accomplish the necessary authorization checking instead.
To bypass MAGEC's security the MAGEC-SECURITY System Parameter should be set to NO. This can be done using the online command:
TBLCHG 243/MAGEC-SECURITY
A setting of YES (the default) will allow normal MAGEC security checking, a setting of NO will bypass MAGEC's security checking altogether.
If you choose to bypass MAGEC's security you should be careful to consider that the activity logging and automatic menu (cont.)
systems are based upon the security parameters and ID's. Also,the employee ID in any audit stamp (maintained by the (cont.)
MAGEC I/O module) is taken from the employee number given when the operator logs on. With MAGEC's security bypassed, it (cont.)
is not necessary for an operator to log on to MAGEC in order to do any function; therefore, the empoloyee number would (cont.)
be zero.
One suggestion which might help minimize difficulties associated with bypassing MAGEC security is to have a (cont.)
SECURITY-EXIT program set a meaningful value into the employee number in the TWA security area. It could also set (cont.)
authorization levels to help the dynamic menu system in MAGEC to produce more concise menus.
#
Online Maintenance
##
LAP Definitions
Maintenance to the MAGEC LAP file is done online using the LAP File Maintenance Screen (see opposite page) and the (cont.)
LAPADD, LAPCHG, etc. Function Codes. The standard set of nine Functions is provided. The key value (nn) must be numeric (cont.)
and not less than 01 nor greater than 50. The LAP must be defined here before it can be specified as the Logical (cont.)
Application for any Function Code (FCD). The Main Menu screen (**MENU Function Code) is produced from the LAP file, it (cont.)
shows all the Logical Applications for which the Operator (who invoked the Menu) is authorized (has an Authorization (cont.)
Level greater than 0).
The SHORT NAME** is a four-character (or less) abbreviation for the Logical Application, such as: G/L, or A/P, for (cont.)
General Ledger or Accounts Payable, etc. It is used where there is insufficient space to show the LONG NAME, such as on (cont.)
the SIF and DVC Maintenance screens.
The** LONG NAME** is a 35-character (or less) name for the LAP which will be used where space permits, such as on the Main Menu.
Logical Applications are an important part of MAGEC security. However, since there is a limit of 50 LAP's it is wise to (cont.)
avoid indiscriminately using up all available numbers. The User View and Location Code security provide added (cont.)
dimensions which can logically subdivide the Logical Applications. For instance: an Operator at Headquarters, having (cont.)
the same Authorization Level for General Ledger as another Operator at a Remote Site, might actually possess vastly (cont.)
greater authorization access since many General Ledger Functions might be available only via a User View which the (cont.)
other Operator is not allowed to log onto.
**
NOTE:
**
When a new LAP is added it will be necessary to define Authorization Levels for it on the SIF and DVC profiles for those Operators and Devices which are to have access to it.
| ```
**
LAPxxx nn
M A G E C
LOGICAL APPLICATION DEFINITION
LOGICAL APPLICATION NUMBER= nn
SHORT NAME: ____
LONG NAME: ___________________________________
Press PF4 for browse (LOC) screen Press PF13 for Hardcopy
Press PF16 to Copy field to buffer Press PF17 to Paste data from buffer
Press PF2 for field-level HELP
```**
Figure 02 -- LAP File Maintenance Screen
##
FCD Definitions
Online maintenance to the FCD file is done using the FCD File Maintenance Screen shown on the facing page. The standard (cont.)
set of Function Codes is provided: FCDADD, FCDCHG, etc. The key value (ffffff) is a six-character Function (cont.)
Code.
The **DESCRIPTION** is a 30-character literal which will appear, among other places, on the third-level Menu screen.
The **LOGICAL APPLICATION NUMBER** is the number of the LAP to which this Function Code belongs, it must be defined on the LAP file to be valid.
The **LAP description** will be displayed beside the LAP number.
The parameters which appear under **TEST** and **PRODUCTION** headings apply to this Function depending whether in a TSnn or PRnn User View.
The **USER VIEWS** fields are to contain "masks" of Yes/No indicators (Y and N) to specify in which User Views this Function Code is to be allowed. A blank in any position is equivalent to an N.
The **MMP NUMBER** fields specify which program (MMP) is to be invoked by MAGEC to handle this Function Code.
The **AUTH LEVEL** specifies the Authorization Level (0 - 9) which the Operator/Device must possess in the LAP specified above in order to do this Function.
The **HOLD** flag may be set to Y (*Yes*, on hold) or N (*No*, not on hold) by the Security Officers.
The **AUTO EDIT** parameter specifies that the MAGEC Automatic Editing is to be done for this Function. Functions (cont.)
ending in ADD, CHG, and DUP must be specified Y (*Yes*). Other Functions may be Y or N. This allows non-standard (cont.)
Functions to take advantage of the Auto-Editing.
Central Security Officers may add or change any FCD record. Local Security Officers may only change those which their own Authorization Levels permit them to do.
| ```
**
FCDxxx ffffff
M A G E C
FUNCTION CODE DEFINITION
FUNCTION CODE= ffffff DESC: ___________________________
LOGICAL APPLICATION NUMBER: __ _______________________________
TEST PRODUCTION
87654321 87654321
USER VIEWS: ________ USER VIEWS: ________
MMP NUMBER: ___ MMP NUMBER: ___
AUTH LEVEL: _ AUTH LEVEL: _
HOLD: _ HOLD: _
THIS FUNCTION WILL INVOKE AUTO EDIT (Y OR N): _
Press PF4 for browse (LOC) screen Press PF13 for Hardcopy
Press PF16 to Copy field to buffer Press PF17 to Paste data from buffer
Press PF2 for field-level HELP
```**
Figure 03 -- FCD File Maintenance Screen
##
**LOAD Function
Security data is maintained on online Dictionary files but is transferred into main memory tables for run-time (cont.)
efficiency. Data from the FCD-File, DCL-File, ELT-File, and KYF-File are handled this way for use by the Security (cont.)
system and other MAGEC Features.
When the Security Officer does an update to the FCD-File, for example, the file record is changed, but not the (cont.)
in-memory image. At system start-up time (when the TP Monitor is "brought-up") these in-memory images are loaded from (cont.)
the files. In order to permit dynamically changing Security parameters without stopping and starting the TP Monitor; a (cont.)
special Function is provided for Security Officers (and others who need it). The Function is:
**LOAD xxxxxxxx
where:
xxxxxxxx
= "ONLY FCD" or "ONLY DB " or "ALL "
Any other value defaults to "ALL ". This permits reloading only the Function Code Table from the FCD-File or only the (cont.)
database definitions from the DB definition files or all of them. The loading of these in-memory tables will take (cont.)
(usually) 30 to 60 seconds during which MAGEC must quiesce online processing. Any operator who enters a transaction (cont.)
while the tables are being loaded will receive the message:
SYSTEM LOADING - ONE MOMENT
The operator's screen will not be destroyed. Pressing ENTER (or any other transmit key) again will retransmit the same transaction.
##
Auto-Generated FCD's
When a new application is generated containing the standard set of nine Function Codes, MAGEC automatically generates (cont.)
the nine FCD entries in order to reduce the work of the Security Officers. It generates them with the LAP code set to (cont.)
50 (Testing) and all Production User-Views set to N and all Test User-Views to Y. The Security Officers may alter them (cont.)
at will, usually after Testing is complete and they are ready to "put into Production".
It is important to note that the way that MAGEC knows whether an application is using the standard set of nine (cont.)
functions, as opposed to custom functions, is by checking whether the developer has done any customization in the (cont.)
Insertion Point named %FUNCT. If there is no customization for %FUNCT then the MMPCRE program will automatically (cont.)
generate definitions for the nine standard fucntions. If there is custom code for %FUNCT, then it will not generate any (cont.)
such definitions, the developer will have to add the definitions using the online FCDxxx functions. If a developer (cont.)
wishes to create an application which supports a set of functions which is similar to the standard functions (possibly (cont.)
with some added functions or a few of the standard ones removed), then it is usually easier to first generate the (cont.)
application once with no %FUNCT customization, then to add the customization for %FUNCT and re-generate. That way (cont.)
MMPCRE will save the developer work by generating the standard definitions, which can be easily altered or added to (cont.)
online.
| ```
**
***LOAD xxxxxxxx nnnn Functions Loaded
```**
Figure 04 -- Security Table Reload Screen
##
Global FCD Changes
You will often want to be able to make changes to a group of function code definitions, therefore MAGEC provides a global change facility to help you to aviod having to do many individual updates.
The global change facility uses the function code: FCDGBL. There are two formats for the command.
FCDGBL
FCDGBL xxxxxx
In the first format (with a blank "key" value), you will be presented a screen into which you are to enter change parameters. The screen will have all its enterable fields filled with underscores.
In the second format (with xxxxxx = a valid function code), you will be presented a screen with the enterable fields (cont.)
filled in using values copied from the function code specified (xxxxxx). This enables you to use "model" function codes (cont.)
you have set up to reduce your keystrokes and opportunity for errors.
On this first screen you are to specify which fields you wish to update. Any fields which are set to blanks (cont.)
(underscores are equivalent to blanks) will not be updated at all. You must specify a non-blank value in at least one (cont.)
field in order to continue.
This screen **does not update** any records, nor does it specify which records are to be updated. It merely captures (cont.)
the values to be used for the fields to be updated *when* you select which records are to be updated (that will happen (cont.)
later).
Pressing PF10 indicates that you have entered the values and wish to proceed to the next step. Pressing PF3 will back (cont.)
you up in the sequence, or back you out of the FCDGBL function altogether. PF key instructions are displayed on every (cont.)
screen throughout the sequence.
When you proceed forward, the next screen will simply give you some instructions and tell you to press ENTER to (cont.)
continue. It will display the field value(s) you have entered, but the screen fields will be protected so that you (cont.)
cannot alter them from here. After reading the instructions you should press ENTER to proceed forward. The next step (cont.)
will be a scan-like function very similar to MAGEC's standard xxxSCN functions.
You can enter a selection mask to produce a list (one screenful at a time) of functions which are candidates to be (cont.)
updated. **No updating will take place yet**. You will merely create a list of items from which you can then make your (cont.)
selections.
The items which match your selection mask will be listed on the screen with an ACTION code of "Change" initially shown. (cont.)
You can use the cursor and PF keys to toggle each item's action code from Change to Skip and vice-versa. When you have (cont.)
set all of the action codes as you wish, you just press PF10 to initiate the updating. **Now, it will update records**. (cont.)
All items which have their action codes set to Change will be updated. Only the fields specified with non-blank values (cont.)
in the first screen will be altered. You will receive a display showing OK in the action codes for the items (cont.)
updated.
If there are more items which match your selection mask (for the scan operation), you can press ENTER to page forward for more candidate functions.
| ```
**
FCDGBL xxxxxx Enter values in fields to be changed
M A G E C GLOBAL FUNCTION CODE MAINTENANCE
FUNCTION CODE DESCRIPTION: ___________________________
LOGICAL APPLICATION NUMBER: __ _______________________________
TEST PRODUCTION
87654321 87654321
USER VIEWS: ________ USER VIEWS: ________
MMP NUMBER: ___ MMP NUMBER: ___
AUTH LEVEL: _ AUTH LEVEL: _
HOLD: _ HOLD: _
THIS FUNCTION WILL INVOKE AUTO EDIT (Y OR N): _
Enter new values into those fields which you wish to change, blanks into those
you do not wish to change. No updating occurs now, you will select records you
wish to have updated later. PF3 = ABORT PF10 = CONTINUE
next: sec04.md.txt