Hello,

To generate an enhanced passticket an HMAC key must preexist within ICSF.  It appears that UKO does not support an HMAC template for creating HMAC keys.  If this is the case for the foreseeable future i would like to avoid using the ICSF panels within ISPF.

Is there any sample REXX code that a customer can use to build/customize within their own process to generate HMAC keys for an application?

Thanks in advance!

------------------------------
Phillip Allison
Enterprise Architect
ICE, Inc
Jacksonville FL
------------------------------

I'm 99.9% sure there is a sample out there - I just have to find it. It might be w/ RACF. Let me ask around and get back to you. 

------------------------------
Bob Petti
------------------------------

I just posted a couple samples to the library of the education community (I hope - fingers crossed). If they don't show up soon - let me know and I can try to email them to you directly. 

------------------------------
Bob Petti
------------------------------

I can see both samples were posted, thanks a bunch for chasing this down Bob!

------------------------------
Phillip Allison
Enterprise Architect
ICE, Inc
Jacksonville FL
------------------------------

Original Message:
Sent: Wed March 12, 2025 10:45 AM
From: Bob Petti
Subject: Generating HMAC Keys for Enhanced Passtickets

I just posted a couple samples to the library of the education community (I hope - fingers crossed). If they don't show up soon - let me know and I can try to email them to you directly. 

------------------------------
Bob Petti
------------------------------

Hi Bob,

Ok. I got your samples. Thank you very much.

We are looking creating HMAC keys for RACF Passtickets. Now the thing is that we have separate ICSF environments (eg. separate CKDS for each environment).
Since the same HMAC key is used for Passticket generation and validation, but that generation/validation might not be happening in the same SYSPLEX, the corresponding HMAC key must exist in each environment. Of course the appropriate PTKTDATA and PTKTVAL RACF resources must exist in the SYPLEXEs.

Now, I was thinking of creating a HMAC key in one environment and use EXPORT/IMPORT to transfer that key to the other environments. Now, this requires the creation of KEK key pairs, which is quite cumbersome.

One alternative that comes to mind is to use your HMACKEY REXX with the same clear key material on each SYSPLEX. Would that be a viable approach to have the same HMAC key in each SYSPLEX?

Thanks a lot for your answer

Cheers

Charles

------------------------------
Charles Lehmann
------------------------------

Original Message:
Sent: 03/12/25 10:45 AM
From: Bob Petti
Subject: Generating HMAC Keys for Enhanced Passtickets

I just posted a couple samples to the library of the education community (I hope - fingers crossed). If they don't show up soon - let me know and I can try to email them to you directly. 

------------------------------
Bob Petti
------------------------------

Hello Charles - 

Since you have the clear key material, you can certainly use it to create the same HMAC key on each SYSPLEX.  

------------------------------
Eleanor Chan
------------------------------

Original Message:
Sent: 07/17/26 07:30 AM
From: Charles Lehmann
Subject: Generating HMAC Keys for Enhanced Passtickets

Hi Bob,

Ok. I got your samples. Thank you very much.

We are looking creating HMAC keys for RACF Passtickets. Now the thing is that we have separate ICSF environments (eg. separate CKDS for each environment).
Since the same HMAC key is used for Passticket generation and validation, but that generation/validation might not be happening in the same SYSPLEX, the corresponding HMAC key must exist in each environment. Of course the appropriate PTKTDATA and PTKTVAL RACF resources must exist in the SYPLEXEs.

Now, I was thinking of creating a HMAC key in one environment and use EXPORT/IMPORT to transfer that key to the other environments. Now, this requires the creation of KEK key pairs, which is quite cumbersome.

One alternative that comes to mind is to use your HMACKEY REXX with the same clear key material on each SYSPLEX. Would that be a viable approach to have the same HMAC key in each SYSPLEX?

Thanks a lot for your answer

Cheers

Charles

------------------------------
Charles Lehmann
------------------------------


Original Message:
Sent: 03/12/25 10:45 AM
From: Bob Petti
Subject: Generating HMAC Keys for Enhanced Passtickets

I just posted a couple samples to the library of the education community (I hope - fingers crossed). If they don't show up soon - let me know and I can try to email them to you directly. 

------------------------------
Bob Petti
------------------------------