Sign-on without a password

None of these needs software on the host. Each uses what IBM already provides, set up by your mainframe or IBM i team.

IBM i sign-on with Kerberos

With Kerberos, people are signed on to IBM i with the account they used to sign in to their computer. They type no user ID and no password, and they don’t see the Sign On screen. IBM i Access Client Solutions offers the same thing.

When IBM i asks, WND Terminal gets a service ticket for IBM i’s sign-on service, krbsvr400/<host name>, from the computer’s own Kerberos. It sends the ticket in place of a user ID and password, as RFC 4777 describes. IBM i checks the ticket and signs on the user profile that Enterprise Identity Mapping (EIM) maps the person to.

• Windows uses its own Kerberos, with the person’s domain sign-in.
• A Mac uses its own Kerberos. That can be a Mac bound to Active Directory, a ticket from Ticket Viewer or kinit, or a platform single sign-on extension.

Each connection gets a new ticket, so a dropped connection signs on again when it comes back. If there’s no ticket, or IBM i doesn’t accept it, the Sign On screen appears with a note saying why.

Set it up

1. On IBM i, configure Network Authentication Service with the krbsvr400 principal for the system’s host name, and add that principal to your directory.
2. Map Kerberos principals to user profiles with EIM.
3. Set the system value QRMTSIGN to *VERIFY or *SAMEPRF.
4. In WND Terminal, choose Sign on with: My computer sign-in (Kerberos) on the connect page. For IT’s connections, set "SignOn": "kerberos", or add |kerberos to the connection’s Group Policy line.

If the connection uses an address or an alias, the principal made from the host name may be wrong. Set KerberosPrincipal on the connection, such as krbsvr400/[email protected]. IBM i Access sessions that sign on with Kerberos import this way too. Kerberos sign-on is part of automatic sign-on, so AllowAutoSignOn = false turns it off as well.

z/OS Express Logon

Express Logon logs people on to a z/OS application with their certificate instead of a user ID and password. It is IBM’s Express Logon Feature, which IBM PCOMM and Host On-Demand also use. The connection must be encrypted, on a secure port or with TLS negotiated on the telnet port.

WND Terminal connects and signs in with the person’s certificate. It gives the z/OS TN3270E server the application ID, then plays a logon macro. The macro types IBM’s placeholders, )USR.ID( and )PSS.WD(, where the user ID and password go. The TN3270E server puts the certificate’s user ID and a one-time RACF PassTicket in their place. Nobody types a password, and none is sent or stored. If the macro can’t finish, the status line says which step stopped and why.

The logon macro

Record your logon once as a macro. Recording writes type {password} for the password. For Express Logon, that line becomes )PSS.WD(, and the user ID typed just before it becomes )USR.ID(. A macro can also say type {user}, or type the placeholders itself. Use plain recorded steps, without variables, decisions or repeats.

Set it up

1. On z/OS, set up the TN3270E server as IBM documents. That means EXPRESSLOGON in the TELNETPARMS of a secure port with client authentication, certificates mapped to user IDs in RACF, and a PassTicket profile for each application.
2. On the connect page, turn on Log on with Express Logon. Give the Application ID your mainframe team set up, such as TSOSYS1, and choose your logon macro.
3. For IT’s connections, set ExpressLogon to the application ID and ExpressLogonMacro to the macro’s text or a macro file on a share only IT can change. In Group Policy, add |elf=TSOSYS1|elfmacro=\\fileserver\WNDTerminal$\tso-logon.txt to the connection’s line.

IBM documents that the client sends the application ID but doesn’t name the variable. WND Terminal sends it as APPLID. WND Software tests Express Logon against a test host that does what the TN3270E server does, so try it once on your own TN3270E server before you rely on it.

To turn Express Logon off everywhere, set AllowExpressLogon to false, or enable Turn off z/OS Express Logon in Group Policy. The audit log records each Express Logon (session.express_logon) with the application ID and the certificate.

PassTickets from the browser gateway

In a browser, Express Logon and Kerberos would use the server’s certificate or ticket, not the person’s. The gateway never signs anyone on that way. Instead it can sign people on to z/OS and IBM i with RACF PassTickets after they sign in to the gateway. That covers TSO, CICS, IMS and anything else RACF, ACF2 or Top Secret protects.

1. The gateway finds the person’s host user ID, from a claim in their ID token or from a file IT keeps.
2. It waits for the logon screen and plays the connection’s steps.
3. Right before the password is typed, it makes a PassTicket for that user ID and application, and types it into the password field.

A PassTicket works once, for a short time. If the person has no host user ID, or the logon screen isn’t what the steps expect, the session stays on the logon screen and says why.

[sign_on]
user_id_claim = "mainframe_user_id"
user_id_file = "/etc/wnd-gateway/user-ids.toml"

[[sign_on.passticket]]
connection = "Production (TSO)"
application = "TSOPROD"
key_file = "/etc/wnd-gateway/tsoprod.key"
steps = """
wait "Logon ===>"
type {user}
press Enter
wait "ENTER PASSWORD"
type {passticket}
press Enter
"""

The gateway makes both kinds of PassTicket, legacy (DES) and enhanced (HMAC-SHA-512). Set algorithm to match the RACF profile. User IDs and application names are 1 to 8 characters, so IBM i user profiles longer than 8 characters can’t be signed on this way.

The key stays on the gateway

The secured sign-on key is read when the gateway starts and kept only in memory. It never goes into a log, a message or a browser. Keep key_file readable by the gateway’s account only, or use key_env with your service manager’s secret store. The PassTicket is typed into the host’s hidden password field and then wiped. wnd-gateway check-config checks the keys and the user ID file without showing the key.

The audit log records every automatic sign-on as session.auto_sign_on, with the person, their host user ID, the application and whether it worked. It never records the key or the ticket.

WND Software wrote both algorithms from IBM’s description and tests them against a second, separately written version. IBM publishes no complete worked example. Sign on once to a test RACF or IBM i, with a key you define there, for each algorithm you use.