IBM i Global

 View Only
Expand all | Collapse all

Using cached/scripted credentials to enter a 5250 emulator session

  • 1.  Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue November 15, 2022 09:33 AM
    Hello

    As part of a Privileged Access Management project, I would like to be able to run a 5250 emulator using a scripted set of credentials. I have tried using the following commands but still get a username/password dialogue.

    acslaunch_win-64.exe /plugin=logon /system=*** /userid=username /password=password
    acslaunch_win-64.exe /plugin=5250 /system=*** /sso /nosave /wide

    Any suggestions would be great

    Thanks

    ------------------------------
    Chris Jessup
    ------------------------------


  • 2.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue November 15, 2022 07:05 PM
    Edited by Satid Singkorapoom Tue November 15, 2022 07:35 PM
    Dear Chris

    Have you also taken the actions described in this Technote?  Bypass IBM i OS Sign-On Screen
    I think the proper value for the system value QRMTSIGN is mandatory but am not sure if this applied to ACS version of PC5250 or not.

    To enable bypass sign-on, the following is required:

    o On the operating system command line, type the following:

    WRKSYSVAL QRMTSIGN

    Press the Enter key. Change the value to *VERIFY.
    o In the IBM Access for Windows PC5250 Emulator, Select Communications, Configure, and check the Bypass Signon option.

    In the IBM i Access Client Solutions 5250 Emulator, Select Communications, Configure, and then the Advanced option on the left hand side, select the Bypass Signon option.

    The Bypass sign-on is now enabled. The change will take effect immediately.


    If setting the system value does not help, please read this Technote :  Three Methods by which to by-pass GUI sign on using IBM i Access Client Solutions.    Please note that it indicates that for your method,  "These examples would have to be ran from the directory where either the acslaunch_win-32.exe or the acslaunch_win-64.exe reside."    I think this means you should specify the full directory path for the EXE files.

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 3.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Fri November 18, 2022 03:10 AM
    Thanks for your help. It is most appreciated.

    I get a MSGGEN002 - The function completed successfully when I try acslaunch_win-64.exe /plugin=logon /system=systemname /userid=userid /password=password /GUI=1

    But I still get a username/password dialog when launching the emulator acslaunch_win-64.exe /plugin=5250 /system=systemname /nosave /wide
    Do you know why it is not using the cached credentials?

    ------------------------------
    Chris Jessup
    ------------------------------



  • 4.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Fri November 18, 2022 06:56 AM
    Edited by Satid Singkorapoom Fri November 18, 2022 06:42 PM
    Dear Chris

    >>>> Do you know why it is not using the cached credentials? <<<<

    Yes, I think I know why (although not fully 100% sure) and thus my original response above.  What you want is called Bypass Sign-on feature of 5250 emulator.  This feature requires the 2 actions I provided above to work.

    With the problem you encountered, have you already changed system value QRMTSIGN to *VERIFY yet?  This has been MANDATORY for a long time in the past for enabling Bypass Sign-on feature in 5250 emulator that came with the old IBM i Access. AND you also need to enable Bypass Sign-on in 5250 emulator as shown in the picture below.  



    I believe these 2 actions are still required for ACS's 5250 emulator regardless of how you invoke the emulator. Please take these 2 actions and see if it works the way you want or not.

    As a side note, I notice that options /nosave and /wide are not completed. For details, check section 9.1.13 in this ACS Getting Start URL :  https://www.ibm.com/support/pages/ibm-i-access-acs-getting-started

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 5.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Fri July 12, 2024 09:26 AM

    Hi Satid Singkorapoom,

    I was able to automate the login process with the following command line. 

    C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\acslaunch_win-64.exe /PLUGIN=logon /AUTH /SYSTEM=SYSTEM1 /USERID=USERXX /PASSWORD=XXXXXXXX /GUI=0  &  C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\acslaunch_win-64.exe C:\Users\Administrador\Documents\IBM\iAccessClient\Emulator\KYWICDS.hod

    I tried with following comand but it didn't work because i got a meesage saying that user and password are invalid parameter

    C:\Users\aPublic \IBM\ClientSolutions\Start_Programs\Windows_i386-64\acslaunch_win-64.exe /PLUGIN=logon /AUTH /SYSTEM=SYSTEM1 /USERID=USERXX /PASSWORD=xxxxxx /GUI=0 /PLUGIN=5250

    Is there a single command to automate the login process and launch the 5250 session?



    ------------------------------
    Santiago Avila
    ------------------------------



  • 6.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue July 16, 2024 09:23 AM

    Dear Sanbtiago

    Would Roberto Colonnese's post below work for you?  He uses    C:\Users\amministrativo4\IBM\ClientSolutions\Start_Programs\Windows_i386-32\acslaunch_win-32.exe /PLUGIN=logon /AUTH /SYSTEM=xxx.xxx.xxx.xxx /USERID=xxxxx /PASSWORD=xxxxxx /GUI=2



    ------------------------------
    Satid S
    ------------------------------



  • 7.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue July 16, 2024 11:07 AM

    When I use this command I get this error  "a meesage saying that user and password are invalid parameter". So I don't know if the syntax it is incorrect or It does not support those options of User and password



    ------------------------------
    Santiago Avila
    ------------------------------



  • 8.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue July 16, 2024 09:23 AM

    Dear Santiago

    Would Roberto Colonnese's post below work for you?   He uses  C:\Users\amministrativo4\IBM\ClientSolutions\Start_Programs\Windows_i386-32\acslaunch_win-32.exe /PLUGIN=logon /AUTH /SYSTEM=xxx.xxx.xxx.xxx /USERID=xxxxx /PASSWORD=xxxxxx /GUI=2



    ------------------------------
    Satid S
    ------------------------------



  • 9.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue August 27, 2024 01:58 PM

    Hi Satid S,

    Yes, when you use the /PLUGIN=logon the authentication process works, but I does not open the terminal emulation by itself. You have to do another job to open it. What i mean is that it does not authenticate with the /PLUGIN=5250 which is what I want to do it.

    Regards,

    Santiago



    ------------------------------
    Santiago Avila
    ------------------------------



  • 10.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Wed August 28, 2024 04:57 AM
    Edited by Satid S Wed August 28, 2024 05:00 AM

    Dear Santiago

    >>>> Yes, when you use the /PLUGIN=logon the authentication process works, but I does not open the terminal emulation by itself. You have to do another job to open it. What i mean is that it does not authenticate with the /PLUGIN=5250 which is what I want to do it. <<<<

    I did a test from my Windows PC as follows:

    • open Windows command line session
    • change current directory to \<ACS folder>\Start_Programs\Windows_x86-64\ 
    • run this:  acslaunch_win-64.exe /plugin=logon /system=*** /userid=username /password=password
    • I am notified that the function completed successfully.
    • run this:  acslaunch_win-64.exe /plugin=5250 /system=***  /nosave /wide
    • I get a 5250 session without being asked to provide any user+password

     

    I ask you to do this test and see if you have a problem or not.  If you encounter the problem, then something in your Windows environment may be the cause.  

    Do you use a company-supplied Windows PC that is more likely managed by your company-deployed Group Policy?   In the past when I used my company-supplied Windows PC, I could not do some professional operations that I needed to do and I was told I had to seek approval for exemption from standard Group Policy. I did and then was able to do what I needed to do in my company-supplied PC.   Are you in this same situation?



    ------------------------------
    Satid S
    ------------------------------



  • 11.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Wed August 28, 2024 03:37 PM

    Thank you Satid, 

    It does work as you tell to run it, only that I wanted to do it only in one line, both process, but I will do it as you showed to me.

    Regards,

    Santiago



    ------------------------------
    Santiago Avila
    ------------------------------



  • 12.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Sun November 20, 2022 07:34 AM
    From ACS Getting Start information, I see that you should also include the option /AUTH in the first plugin=logon command.  /AUTH means "attempts connect to system with specified logon credentials and only caches them on success".

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 13.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Mon November 21, 2022 06:02 AM
    Wouldn't this suggest it should be cached "MSGGEN002 - The function completed successfully "

    ------------------------------
    Chris Jessup
    ------------------------------



  • 14.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Mon November 21, 2022 07:03 PM
    Edited by Satid Singkorapoom Mon November 21, 2022 07:39 PM
    Dear Chris

    I see that if the message should mean what you expect for your case, then it does not make sense that the option /AUTH exists for the logon operation.  To me, /AUTH exists to turn on caching of the credential which should logically mean that credential caching is not the default behavior of ACS's connection logon. I also see that the fact that you encounter the sign-on dialog box on the subsequent command should give you an evidence that the message does not mean that logon credential is cached as you may expect. 

    Please try /AUTH to see if it addresses your issue or not. If not and you already run the latest ACS codes, then your incident can be a bug in ACS and you should report this to IBM Support team. 

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 15.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Mon October 30, 2023 03:57 PM

    Hi, I also have a similar problem, I can't automate the logon in programs like Access or Excel, I can do it in the terminal.

    C:\Users\amministrativo4\IBM\ClientSolutions\Start_Programs\Windows_i386-32\acslaunch_win-32.exe /PLUGIN=logon /AUTH /SYSTEM=xxx.xxx.xxx.xxx /USERID=xxxxx /PASSWORD=xxxxxx /GUI=2


    here is the string I use in the .bat file that is executed every time Windows starts.

    thanks.



    ------------------------------
    Roberto Colonnese
    ------------------------------