Welcome
Customizing the ADFzCC server
Using JWT authentication
The ADFzCC server supports authentication using a JSON Web Token (JWT) supplied by a compatible client. The JWT is validated by z/OS SAF using the application ID specified by the SAFJWT_APPLID configuration keyword.

PDF documentation
Preface
This document provides information about IBM® Application Delivery Foundation for z/OS® Common Components.
Summary of changes
This edition of the document provides information applicable to IBM Application Delivery Foundation for z/OS® Common Components Version 1 Release 11. Changes to the latest release are indicated by a | change bar in the left margin of the page in the PDF format of the documentation.
Introduction to IBM ADFz Common Components
ADFzCC server overview
Customizing the ADFzCC server
- Required authorizations
- Multi-Factor Authentication (MFA)
  When clients initially connect to the ADFzCC server they are prompted for a user ID and a password or passphrase. If the credentials are valid, the client can start sessions on the relevant z/OS system as the nominated user.
- Using JWT authentication
  The ADFzCC server supports authentication using a JSON Web Token (JWT) supplied by a compatible client. The JWT is validated by z/OS SAF using the application ID specified by the SAFJWT_APPLID configuration keyword.
- Using PassTickets
  The ADFzCC server can be configured to use PassTickets for authenticated clients.
- Setting SSL/TLS encrypted communications
- Using AT-TLS for encrypted communications
- Update sample IPVCONFG
- Create matching WORKDIR by running job IPVMKDIR
  The IPVMKDIR job creates a work directory to be used with the server. It is supplied in the sample library hlq.SIPVSAM1.
- Check address space timeout
- Add ports to TCPIP reservation list
- Configuration considerations for IBM® Explorer for z/OS® (z/OS® Explorer)
- Configuring TCP/IP stack affinity
Options
Quick start guide for compiling and assembling programs for use with IBM ADFz products
IPVLANGX compiler listing to side file conversion utility
IPVLANGP side file formatting utility
IPVLANGO Automatic Binary Optimizer LANGX file update utility
Maintaining ADFz Common Components
ADFzCC event processing
Messages
Troubleshooting
Support resources
Notices

Using JWT authentication

The ADFzCC server supports authentication using a JSON Web Token (JWT) supplied by a compatible client. The JWT is validated by z/OS SAF using the application ID specified by the SAFJWT_APPLID configuration keyword.

The default value of SAFJWT_APPLID is FEKAPPL. Specify a different application ID if the SAF JWT configuration for your environment uses another application ID.

The user ID supplied by the client must match the user ID returned by SAF for the JWT. JWT authentication cannot be combined in the same authentication request with a password, password change, or client PassTicket.

After successful JWT validation, the ADFzCC server generates a PassTicket and uses it to establish the user security environment. The application ID used for this PassTicket is the application ID supplied by the client, if present, otherwise the APPLID configuration value, if specified, or IPVAPPL by default.

Sample IPVCONFG - CONFIG=DEFAULT

JWT authentication application ID. FEKAPPL is the default.
Change this value only if the SAF JWT configuration uses a different application ID.
SAFJWT_APPLID=FEKAPPL