The daily edition.

1. Capability Overview

In a mainframe z/OS environment, applications and subsystems query security products (such as RACF, ACF2, or Top Secret) through the System Authorization Facility (SAF) interface. Rocket Enterprise Server replicates this mainframe security model via the External Security Facility (ESF).

ESF serves as the security intermediary across all Enterprise Server execution environments (CICS, IMS, JCL/JES) and administrative layers (ESCWA and Directory Server). Instead of relying on isolated or legacy security stores (such as CASESM), ESF delegates authentication and authorization decisions to enterprise directory services and security providers through pluggable External Security Managers (ESMs) like LDAP, Active Directory, PAM, or vault systems (External Security - Enterprise Server).

2. Architecture & How It Works

• Unified Security Across Three Domains: Rocket Enterprise Server architecture defines three distinct security domains: ESCWA (management console), Directory Servers (MFDS), and individual Server Regions. ESF allows administrators to configure a Security Manager Stack—an ordered chain of ESM modules evaluated sequentially (Default ESF Configuration). Rocket documentation strongly recommends establishing a shared Default ES Configuration across all three domains so that user identities, group memberships, and access rules remain synchronized throughout the estate.
• Mainframe SAF Class Emulation: ESF intercepts transaction execution, dataset access, and batch job submissions, mapping traditional mainframe resource classes (such as FACILITY, DATASET, JESSPOOL, SURROGAT, and TCICSTRN) directly into corresponding LDAP attributes or ESM rule hierarchies (Default ESF Configuration). Administrative operations performed via command-line utilities are similarly governed by SAF access rules evaluated under the AdminAPI resource class (Configuring External Security Facility (ESF) from the Command Line).
• In-Memory Caching & Dynamic Invalidation (esfupdate): To maintain high transaction throughput without generating excessive network traffic to external LDAP servers, ESF aggressively caches Accessor Environment Elements (ACEEs), user credentials, and group memberships. When an administrator updates security definitions in an external directory, the changes do not require a region restart; executing the esfupdate command-line utility signals active worker processes to flush their local security caches and re-evaluate authorizations on subsequent requests (Additional ESF notes, To Update Security Manager Changes Using esfupdate).

3. Practical Configuration & Operational Tidbits

1. Stack Chaining with PAM and MLDAP: You can combine disparate authentication and authorization sources within a single security manager stack. A common configuration pairs the PAM ESM Module (which authenticates user passwords against host OS/Kerberos mechanisms) with the MLDAP ESM Module (which resolves granular CICS transaction and JCL dataset authorization rules stored in OpenLDAP or Active Directory) (Using the PAM ESM Module and MLDAP ESM Module together).
2. Mainframe-Style Administration with esfadmin: Administrators transitioning from z/OS can manage directory-backed security entities using familiar command verbs. The esfadmin utility provides sub-commands such as ADDUSER, ALTUSER, ADDGROUP, ADDRESOURCE, and ADDACE to script and manipulate access control entries without manual LDAP directory edits (LISTUSER).
3. Disabling Legacy CASESM: In ESCWA, navigate to Operation > Directory Server > [Region] > General > Security, attach your configured ESM to the Security Managers list, and restart the region to ensure authentication is handled strictly by external enterprise security rather than internal default fallbacks (External Security - Enterprise Server).
4. SAF Diagnostic Tracing: When troubleshooting permission issues, enable the region-specific auxiliary trace flag saf. Because security tracing captures detailed entry/exit logs for every authorization check, Rocket recommends toggling it off once diagnostics are complete to prevent performance degradation in production (Security Tracing).

4. Reference Citations (Rocket Enterprise Server 12.0 Manuals)

• Default ESF Configuration — Enterprise Server 12.0 for UNIX
• External Security - Enterprise Server — Enterprise Server 12.0 for UNIX
• Configuring External Security Facility (ESF) from the Command Line — Enterprise Server 12.0 for UNIX
• Additional ESF notes — Enterprise Server 12.0 for UNIX
• To Update Security Manager Changes Using esfupdate — Enterprise Server 12.0 for UNIX
• Using the PAM ESM Module and MLDAP ESM Module together — Enterprise Server 12.0 for UNIX
• Security Tracing — Enterprise Server 12.0 for UNIX
• Security Managers and security configurations — Enterprise Server 12.0 for UNIX