A year or so ago I had come across the term realms in relation to security, but could not find what they are or how they are used.
I’ve been working with JSON Web Tokens, (to identify a Linux user to the MQWEB server on z/OS) and have found out what realms are.
The short answer is a realm is a zone of definitions it could be a machine, or a company. OK – this is not very clear.
The high level view
Take the scenario, I have a z/OS and a Linux environments. On both systems I have a userid COLIN.
When I create a JWT
- on Linux I give it parameters subject:COLIN, issuer:LINUX
- on z/OS I give it parameters subject:COLIN, issuer:zPROD
By some magic the JWT arrive at my web server, and I have configured the server to lookup the information in RACF.
In this scenario the realm is either LINUX or ZPROD.
I define mapping on z/OS (RACMAP) which say
- For (subject: COLIN, Realm: LINUX) set the userid=NOONE
- For (subject: COLIN, Realm: zPROD) set the userid=IBMUSER
So depending what is in the payload I can get a different userid on z/OS to issue my MQ commands.
A more complex example
In my MQWEB server I have definitions like
openidConnectClient: when issuerIdentifier=”zOSMF” and the signing certificate matches the keyring label “COLINPAICE” in keyring …. then use realm=”zPROD”
For user COLIN, this would match a RACMAP with
For (subject: COLIN, Realm: zPROD) set the userid=IBMUSER.
Whoops
With the configuration
<openidConnectClient
mapIdentityToRegistryUser="true"
...
/>
it ignored the realms, and used the sysplex name.
I got a RACF message
ICH408I USER(START1 ) GROUP(SYS1 ) NAME(####################)
DISTRIBUTED IDENTITY IS NOT DEFINED:
ADCDC ADCDPL
My z/OS has sysplex name of ADCDPL.
Which says there was no mapping for the userid ADCDC, and the realm name ADCDPL. This took me half a day to resolve!
With this if I had configured RACMAP to have subject ADCDC and realm ADCDPL mapping to SYS1U – if a request came in from z/OS or Linux both would get userid SYS1U – which I am sure you do not want to happen.
The short answer is a realm is a zone of definitions it could be a machine, or a company. OK should now be perfectly obvious.
ColinPaice 