CICS Explorer: What's new, and what's even newerPhil Wakelin

CICS TS Strategy & Design, IBM Hursley

November 2019

Session GL

Place your

custom session

QR code here.

Please remove

the border and

text beforehand.

Session Objectives

CICS Explorer is a desktop application for interacting with CICS TS. Come and hear about the latest features being delivered via our continuous delivery, such as Multi-Factor Authentication security support, improved systems management and cool new UI capabilities for searching and sorting.

Agenda

• Installation options & compatibility

• MFA & CMCI JVM server

• Aggregate

• Map

• GraphQL

2

Installation

• New installation matrix on Mainframe Developer Centerhttps://developer.ibm.com/mainframe/products/downloads/

3

Install method Aqua Eclipse IBM CICS Explorer

IBM Explorer for z/OS

IDz

Eclipse p2 orInstallation Manager

3.0 4.4 (Luna) 5.3 3.0.1 14.0

Eclipse p2 orInstallation Manager

3.1 4.6 (Neon) 5.4 3.1 14.1, 14.2

Eclipse p2 only 3.2 4.8 (Photon) 5.5 3.2 n/a

Eclipse p2 only n/a 2019-nn n/a n/a n/a

CICS Explorer and CICS TS compatibility

• Backwards compatibility• Full support for all older CICS TS releases

➢i.e. CICS Explorer V5.5 supports CICS TS V5.5, V5.4, V5.3, V5.2…..

• Forwards compatibility• CICS Explorer V5.n supports CICS TS V5.n+1 *

➢i.e. CICS Explorer V5.4 supports CICS TS V5.4 and V5.5

* CICS TS generally provides forwards compatibility PTF to Explorer after release of CICS TS V5.n+1 where possible

4

5

Multi – Factor Authentication

What is Multi-Factor Authentication (MFA)?

6

System requires that multiple authentication factors be presented during logon

• Something you know: A password or security question• Something you have: An ID badge or cryptographic token device• Something you are: Fingerprint or other biometric data

Example• You log into your email account -> a token gets sent to you by text

• Note the tokens are generally only valid for one use, with a limited lifetime

How is it implemented in CICS Explorer?

7

• Enable MFA in RACF (or your security manager)• Install IBM Multi-Factor Authentication for z/OS• Setup MFADEF class profile in RACF

• At logon:1. User obtains MFA token 2. User enters concatenated RACF authenticator + token code in passphrase field

i.e. password135789

• Note token is valid one-time use only• MFA is not practical on stateless connections like HTTP basic authentication (i.e CMCI)• Requires a persistent secure connection, or a signed token for retransmission

https://www.ibm.com/support/knowledgecenter/en/SSGMCP_5.5.0/security/cics-mfa.html

How can I use MFA with CICS Explorer?

8

• Enable the CMCI JVM server• Supported from CICS TS 5.4 with APAR PI87691 • Replaces CMCI port provides by CICSPlex SM WUI server• Introduces a Liberty server which supplies Explorer with an signed LTPA session cookie, valid for

multiple CMCI API requests

• Enabled with feature toggle: • com.ibm.cics.cmci.jvmserver=true

• Create credential within Explorer as “Username with Multi-Factor Authentication”

• Explorer will prompt for credentials when the user connects and again when the session expires

https://www.ibm.com/support/knowledgecenter/en/SSGMCP_5.5.0/configuring/cmci/config-cmci-region.htmlhttps://www.ibm.com/support/knowledgecenter/en/SSSQ3W_5.5.0/com.ibm.cics.core.help/topics/concepts/MFA_intro.html

MFA – CICS TS V5.4 Continuous Delivery

• PI87691: MULTI-FACTOR AUTHENTICATION SUPPORT FOR CMCI AND CICS EXPLORER

9

CICS TS V5.5 – Explorer Hill

“A system programmer no longer needs to configure and deploy the WUI because the

capabilities they need are better in Explorer”

10

CICS EXPLORER - MAP

11

Map

• What is Map - Shows the relationship between specific resources• Eligible resources get an extra right click menu option

• CICS TS V5.5 has support for Map operations on • Workload management ‘definition’ resources• WLMSPEC (Workload Specification)• WLMDEF (Workload Definition)• WLMGROUP (Workload Group)• TRANGRP (Transaction Group)• DTRINGRP (Transaction Group Entry)

• CICSplex topology resources• CSYSDEF (CICS Region Definition)• CSYSGRP (CICS Region Group Definition)

12

Where can I map from?

• Table views

• Workload Specification Editor

• CICSplex Explorer

• Map View

13

Inferred relationships

14

CICS Explorer - Aggregation

15

Aggregation

• What is Aggregation?

• Takes a set of data and performs analysis on it to make it easier to spot discrepancies

➢Merges resource records together to display a summarize view for one or more attributes

➢Within a group, perform analysis on the values of attributes that don’t match

16

Example - LOCFILE

17

Name Status Dataset Name Read Count

FILEA ENABLED HLQ.FILE.Y 100

FILEB ENABLED HLQ.FILE.Z 150

FILEC ENABLED HLQ.FILE.Y 200

FILED DISABLED HLQ.FILE.Z 250

1| FILEA2| FILEB3| FILEC4| FILED

1| FILEA, FILEB, FILEC2| FILED

1| FILEA, FILEC2| FILEB, FILED

1| FILEA2| FILEB3| FILEC4| FILED

Example - LOCFILE

18

Name Status Dataset Name Read Count

FILEA ENABLED HLQ.FILE.Y 100

FILEB ENABLED HLQ.FILE.Z 150

FILEC ENABLED HLQ.FILE.Y 200

FILED DISABLED HLQ.FILE.Z 250

Count Name Status Dataset Name Read Count

3 FILE* ENABLED HLQ.FILE.* 150

1 FILED DISABLED HLQ.FILE.Z 250

Example - LOCFILE

19

Name Status Dataset Name Read Count

FILEA ENABLED HLQ.FILE.Y 100

FILEB ENABLED HLQ.FILE.Z 150

FILEC ENABLED HLQ.FILE.Y 200

FILED DISABLED HLQ.FILE.Z 250

Count Name Status Dataset Name Read Count

2 FILE* ENABLED HLQ.FILE.Y 125

2 FILE* ******** HLQ.FILE.Z 225

Aggregate functions

• Strings• DIFFERENCE: Show analysis of common characters

• Enumerations (CVDA / EYUDA values)• LIKE: Show whether all of the enumeration values match

• Numbers or Dates• MINIMUM: Show the minimum value• MAXIMUM: Show the maximum value• AVERAGE: Show the mean average• SUM: Show the total of all values• DIFFERENCE

20

Aggregation in Explorer

21

Aggregation in Explorer

22

Aggregation vs WUI

• More flexibility around configuring

• Saveable as part of view configuration

• Group by multiple columns

23

24

GRAPHQL

Introducing: CMCI-GraphQL

• A new HTTP API for CICS system management information

• Read Stew’s blog introducing the API here• https://developer.ibm.com/cics/2018/02/06/cics-ts-5-5-open-beta-graphql-api/

Sample endpoints

• https://example.com/CICSSystemManagement - CMCI-REST

• https://example.com/graphql - CMCI-graphql

25

CMCI-GraphQL

26

CMCI-GraphQL

27

28

CICS TS V5.6 Beta

CICS TS V5.6 Open Beta

• CICS TS V5.6 Open Beta• https://www.ibm.com/it-infrastructure/z/cics/trials

• IBM/cics-bundle-maven - https://github.com/IBM/cics-bundle-maven• A Maven plugin that authors CICS bundles for deploying resources into CICS TS.

• CICS Bundle deployment API• RESTful API endpoint in CMCI JVM server• Simplifies bundles deployment during development• Integrates with Maven plugin

29

The CICS bundle deployment API

30

• The CICS bundle deployment API is a new part of the CICS runtime that allows CICS bundles to be deployed straight to CICS, in development regions.

• This removes the slow FTP, and multi-step install required through CICS Explorer.

• It also allows more specific access by developers to deploy to CICS.

• The cics-bundle-maven-plugin builds on it to perform rapid deployment to CICS.

Before the CICS bundle deployment API After the CICS bundle deployment API

Developer requires CICS ExplorerDeveloper can use CICS Explorer, Eclipse, IntelliJ IDEA, VS Code, …, or just a shell!

Bundle upload to zFS is a separate step Upload is integrated into a single deployment step

Bundle upload is slow, file-by-file, and requires FTP setup Upload is faster, as single file, and is over HTTP

Previous bundle must be disabled and discarded to deploy new bundle

Previous bundle is disabled and discarded automatically

Developer needs permission to write the bundle to zFS and permission to install, disable, and discard the bundle

Developer only needs a specific permission for deploying bundles

Comparing the developer experience

31

Enabling the CICS bundle deployment API

32

To set up the CICS bundle deployment API, you need to:

• Ensure you’re running the CMCI JVM server with CICS TS V5.6 beta

• Enable the deployment API with a system property:-Dcom.ibm.cics.cmci.bundles-dir=…

• Set up security profiles to define the set of developers who can use it

Please submit your session feedback!

• Do it online at http://conferences.gse.org.uk/2019/feedback/GL

• This session is GL