Hi, 
First thanks for reaching out our team. Now for the questions: 

1. You have to logon with this DWC_ADMIN_USER, meaning you have to enter a password. But this user x is set as protected.    --> that's not entirely true, you do not have to logon with that user, you need only to launch the scripts (configureDb.sh and dwcinst.sh) with that user, surrogate users can run those, with the limitations that they need ownership of the package files and installation paths (workdir, datadir). You can launch the JCL with the user you prefer and then switch user only to launch the scripts. That is a supported way of installing the DWC. 
2. It seems that you have to write the DWC_ADMIN_USER's PASSWORD hardcoded in the scripts (or maybe on the command line) which I do not like at all.  -->  Again not entirely true, while it's true that the scripts expect users and passwords as parameters you do not need to insert the passwords as clear text, inside the package we include one tool to crypt all the needed passwords before the installation process and you can use those crypted passwords in the properties files or command line. The script accept only this encryption method. If you want I can point you to the right documentation for that specific tool and how to set it up. 

Generally speaking the DWC on USS is not an SMPE installation, it has its own internal standards and security checks during the installation process and also during the configuration. After the installation you can use all the liberty supported authentication methods, even SAF if you so desire, but to install it you need to provide the user who will be the first administrator of the interface. Also both in all the logs and in all the files generated by the installation passwords are never visualized in clear text to ensure the security of those data, also the properties files can be deleted as soon as the installation is completed, to ensure that all sensible data are not present after the software has been installed.

If you have other doubts or concerns, please feel free to reach out to me, and I will do my best to answer them.  All contacts are in the signature of this reply. 

------------------------------
Valerio Cascioli
------------------------------

Workload Automation Verification Team

Senior Software Engineer I

 Email: valerio.cascioli@hcl-software.com

Hi Valerio,

Thank you for you reply. I'm not sure if I grasped the details completely, though.

E.g. how do I reconcile this with what I found in:

ZWSTECHNOTE : DWCZOS : Install DWC z/OS with DB2 database using a non-SUPERUSER Release 10.1 Fix pack 1 (or higher)             

(17) Logon to the DWC from a browser using the DWC_ADMIN_USER id.  The URL to use is given in message WAINST006I when dwcinst.sh is run     

In the meantime, I have done some experiments to wrap the script(s) in another script that extracts the password from a protected z/OS PDSE member.

My tests are not finished yet, but I hope something like this would be usable for the installation (using BPXBATCH):

#!/bin/sh   

DWC_PW=$(cat "//'personal.dataset(PWRD)'")                           
 # Fail if password not retrieved                                       
 if [ -z "$DWC_PW" ]; then                                              
   echo "ERROR: Cannot retrieve password from secure dataset."          
   exit 8                                                               
 fi                                                                     
 DWC_ADMIN_USER="DWCADM"                                                
 #                                                                      
 #                                                                      
 # Execute installation command                             
 # DWC installer references credentials through parameters. 
 # (Example uses dwcinst syntax from IBM docs)              
 ./dwcinst.sh \                                             
   -adminuser "$DWC_ADMIN_USER" \                           
   -adminpassword "$DWC_PW" \                               
   -propertiesfile /u/dwca/install/dwcinst.properties       
 # Immediately clean the variable from memory               
 unset DWC_PW                                              

------------------------------
Peter V
------------------------------


Original Message:
Sent: Fri March 27, 2026 12:25 PM
From: Valerio Cascioli
Subject: DWC on ZOS security set-up

Hi, 
First thanks for reaching out our team. Now for the questions: 

1. You have to logon with this DWC_ADMIN_USER, meaning you have to enter a password. But this user x is set as protected.    --> that's not entirely true, you do not have to logon with that user, you need only to launch the scripts (configureDb.sh and dwcinst.sh) with that user, surrogate users can run those, with the limitations that they need ownership of the package files and installation paths (workdir, datadir). You can launch the JCL with the user you prefer and then switch user only to launch the scripts. That is a supported way of installing the DWC. 
2. It seems that you have to write the DWC_ADMIN_USER's PASSWORD hardcoded in the scripts (or maybe on the command line) which I do not like at all.  -->  Again not entirely true, while it's true that the scripts expect users and passwords as parameters you do not need to insert the passwords as clear text, inside the package we include one tool to crypt all the needed passwords before the installation process and you can use those crypted passwords in the properties files or command line. The script accept only this encryption method. If you want I can point you to the right documentation for that specific tool and how to set it up. 

Generally speaking the DWC on USS is not an SMPE installation, it has its own internal standards and security checks during the installation process and also during the configuration. After the installation you can use all the liberty supported authentication methods, even SAF if you so desire, but to install it you need to provide the user who will be the first administrator of the interface. Also both in all the logs and in all the files generated by the installation passwords are never visualized in clear text to ensure the security of those data, also the properties files can be deleted as soon as the installation is completed, to ensure that all sensible data are not present after the software has been installed.

If you have other doubts or concerns, please feel free to reach out to me, and I will do my best to answer them.  All contacts are in the signature of this reply. 

------------------------------
Valerio Cascioli
------------------------------

Workload Automation Verification Team

Senior Software Engineer I

 Email: valerio.cascioli@hcl-software.com

Hi, 
point 17 of that technote refers to the logon procedure after the installation is completed successfully. The user you set to be DWC_ADMIN_USER in the installation process is, de-facto, the first administrator of the dwc interface. This means that it will be the first user enabled to logon to the DWC. In order to logon you need to navigate to the designated url (as the technote explains) included in WAINST006I message, and provide to the prompt user id and password to the web interface. 
After you are able to logon with this admin user, you can set all the other users and groups with different roles and privileges on the web interface.  All authentication methods supported by liberty (which is the foundation of this software) are automatically supported by DWC. So for example you could use RACF as the user registry. But you are not limited to this, you can use many more user registries, this is left to your choice. 

As for the script-wrap, no objection here, you can do that, but pay attention that you have only two methods to pass the password to the installation scripts (in your case via the properties file). Either in clear text, or encrypted by our tool, as I mentioned in my last comment. All other entries will not be allowed by the installation. But how you populate the properties files, it's totally to your choice. Just to make and example: 
let's say you want to set the DWC_ADMIN_USER to    userDWC   with password stored in a protected dataset  for the sake of this example let me assume the pwd is userDWCpassword   (those are fictional values, no real data, only for the sake of this example) 
in the properties files you need to fill the fields: 
#--user|-u              
DWC_ADMIN_USER=
#--password             
DWC_ADMIN_PW= 
you can use whichever method you prefer to fill those fields. But for the DWC_ADMIN_PW field, the only accepted values are clear text (just make the value as "userDWCpassword") or the version of the same password encrypted by our tool (the name of the tool is "secure") that is something like "{aes}......." 
All other entries will result in the failure of the installation. 
As I said in my last reply, once the installation is complete (it takes something like 5 minutes in total) you can delete the properties files or delete only the sensible information in the files (i.e. the admin password). I can assure you that in all files generated by the installation (logs and configuration files) there won't be any clear text password. 
I hope this can help you, if not and you have more doubts/questions please feel free to reach out to me, all contacts are in the signature. 

    

Hi Valerio,

Thank you for you reply. I'm not sure if I grasped the details completely, though.

E.g. how do I reconcile this with what I found in:

ZWSTECHNOTE : DWCZOS : Install DWC z/OS with DB2 database using a non-SUPERUSER Release 10.1 Fix pack 1 (or higher)             

(17) Logon to the DWC from a browser using the DWC_ADMIN_USER id.  The URL to use is given in message WAINST006I when dwcinst.sh is run     

In the meantime, I have done some experiments to wrap the script(s) in another script that extracts the password from a protected z/OS PDSE member.

My tests are not finished yet, but I hope something like this would be usable for the installation (using BPXBATCH):

#!/bin/sh   

DWC_PW=$(cat "//'personal.dataset(PWRD)'")                           
 # Fail if password not retrieved                                       
 if [ -z "$DWC_PW" ]; then                                              
   echo "ERROR: Cannot retrieve password from secure dataset."          
   exit 8                                                               
 fi                                                                     
 DWC_ADMIN_USER="DWCADM"                                                
 #                                                                      
 #                                                                      
 # Execute installation command                             
 # DWC installer references credentials through parameters. 
 # (Example uses dwcinst syntax from IBM docs)              
 ./dwcinst.sh \                                             
   -adminuser "$DWC_ADMIN_USER" \                           
   -adminpassword "$DWC_PW" \                               
   -propertiesfile /u/dwca/install/dwcinst.properties       
 # Immediately clean the variable from memory               
 unset DWC_PW                                              

------------------------------
Peter V


Original Message:
Sent: Fri March 27, 2026 12:25 PM
From: Valerio Cascioli
Subject: DWC on ZOS security set-up

Hi, 
First thanks for reaching out our team. Now for the questions: 

1. You have to logon with this DWC_ADMIN_USER, meaning you have to enter a password. But this user x is set as protected.    --> that's not entirely true, you do not have to logon with that user, you need only to launch the scripts (configureDb.sh and dwcinst.sh) with that user, surrogate users can run those, with the limitations that they need ownership of the package files and installation paths (workdir, datadir). You can launch the JCL with the user you prefer and then switch user only to launch the scripts. That is a supported way of installing the DWC. 
2. It seems that you have to write the DWC_ADMIN_USER's PASSWORD hardcoded in the scripts (or maybe on the command line) which I do not like at all.  -->  Again not entirely true, while it's true that the scripts expect users and passwords as parameters you do not need to insert the passwords as clear text, inside the package we include one tool to crypt all the needed passwords before the installation process and you can use those crypted passwords in the properties files or command line. The script accept only this encryption method. If you want I can point you to the right documentation for that specific tool and how to set it up. 

Generally speaking the DWC on USS is not an SMPE installation, it has its own internal standards and security checks during the installation process and also during the configuration. After the installation you can use all the liberty supported authentication methods, even SAF if you so desire, but to install it you need to provide the user who will be the first administrator of the interface. Also both in all the logs and in all the files generated by the installation passwords are never visualized in clear text to ensure the security of those data, also the properties files can be deleted as soon as the installation is completed, to ensure that all sensible data are not present after the software has been installed.

If you have other doubts or concerns, please feel free to reach out to me, and I will do my best to answer them.  All contacts are in the signature of this reply. 

------------------------------
Valerio Cascioli
------------------------------

Workload Automation Verification Team

Senior Software Engineer I

 Email: valerio.cascioli@hcl-software.com