PassTicket
A one-time password substitute that a trusted program creates, so a user can be signed on without sending their real password.
Also written RACF PassTicket, PTKTDATA, single sign-on
A PassTicket is a short-lived replacement for a password. A trusted server, such as a web portal, creates one for a user and an application, and uses it to sign the user on to that application, for example CICS or TSO. The user never has to type their mainframe password into the portal.
It works through a secret key shared between the program that makes the PassTicket and RACF. The key is stored in a RACF profile in the PTKTDATA class, one for each application. RACF checks that the PassTicket was made with the right key, for the right user and application, and within a short time window, by default about ten minutes.
This is the basis of many single sign-on setups. A user logs on once to a front-end system, and that system uses PassTickets to reach mainframe applications on their behalf.
The secret keys are very sensitive: anyone with a key could create PassTickets for any user of that application. Security teams protect the PTKTDATA profiles closely and keep the list of programs allowed to create PassTickets short.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- LogonSigning on to a mainframe system with a user ID and password to start an interactive session.
- MFAMulti-factor authentication: requiring something more than a password, such as a code from a phone or token, before a user can log on.
- General resource profileA RACF profile that protects something other than a dataset, such as a CICS transaction, a program or an operator command.
- SAFThe interface z/OS and its subsystems use to ask the security manager whether something is allowed.