IBM i Global

 View Only
  • 1.  Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue November 15, 2022 09:33 AM
    Hello

    As part of a Privileged Access Management project, I would like to be able to run a 5250 emulator using a scripted set of credentials. I have tried using the following commands but still get a username/password dialogue.

    acslaunch_win-64.exe /plugin=logon /system=*** /userid=username /password=password
    acslaunch_win-64.exe /plugin=5250 /system=*** /sso /nosave /wide

    Any suggestions would be great

    Thanks

    ------------------------------
    Chris Jessup
    ------------------------------


  • 2.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue November 15, 2022 07:05 PM
    Edited by Satid Singkorapoom Tue November 15, 2022 07:35 PM
    Dear Chris

    Have you also taken the actions described in this Technote?  Bypass IBM i OS Sign-On Screen
    I think the proper value for the system value QRMTSIGN is mandatory but am not sure if this applied to ACS version of PC5250 or not.

    To enable bypass sign-on, the following is required:

    o On the operating system command line, type the following:

    WRKSYSVAL QRMTSIGN

    Press the Enter key. Change the value to *VERIFY.
    o In the IBM Access for Windows PC5250 Emulator, Select Communications, Configure, and check the Bypass Signon option.

    In the IBM i Access Client Solutions 5250 Emulator, Select Communications, Configure, and then the Advanced option on the left hand side, select the Bypass Signon option.

    The Bypass sign-on is now enabled. The change will take effect immediately.


    If setting the system value does not help, please read this Technote :  Three Methods by which to by-pass GUI sign on using IBM i Access Client Solutions.    Please note that it indicates that for your method,  "These examples would have to be ran from the directory where either the acslaunch_win-32.exe or the acslaunch_win-64.exe reside."    I think this means you should specify the full directory path for the EXE files.

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 3.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Fri November 18, 2022 03:10 AM
    Thanks for your help. It is most appreciated.

    I get a MSGGEN002 - The function completed successfully when I try acslaunch_win-64.exe /plugin=logon /system=systemname /userid=userid /password=password /GUI=1

    But I still get a username/password dialog when launching the emulator acslaunch_win-64.exe /plugin=5250 /system=systemname /nosave /wide
    Do you know why it is not using the cached credentials?

    ------------------------------
    Chris Jessup
    ------------------------------



  • 4.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Fri November 18, 2022 06:56 AM
    Edited by Satid Singkorapoom Fri November 18, 2022 06:42 PM
    Dear Chris

    >>>> Do you know why it is not using the cached credentials? <<<<

    Yes, I think I know why (although not fully 100% sure) and thus my original response above.  What you want is called Bypass Sign-on feature of 5250 emulator.  This feature requires the 2 actions I provided above to work.

    With the problem you encountered, have you already changed system value QRMTSIGN to *VERIFY yet?  This has been MANDATORY for a long time in the past for enabling Bypass Sign-on feature in 5250 emulator that came with the old IBM i Access. AND you also need to enable Bypass Sign-on in 5250 emulator as shown in the picture below.  



    I believe these 2 actions are still required for ACS's 5250 emulator regardless of how you invoke the emulator. Please take these 2 actions and see if it works the way you want or not.

    As a side note, I notice that options /nosave and /wide are not completed. For details, check section 9.1.13 in this ACS Getting Start URL :  https://www.ibm.com/support/pages/ibm-i-access-acs-getting-started

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 5.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Sun November 20, 2022 07:34 AM
    From ACS Getting Start information, I see that you should also include the option /AUTH in the first plugin=logon command.  /AUTH means "attempts connect to system with specified logon credentials and only caches them on success".

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 6.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Mon November 21, 2022 06:02 AM
    Wouldn't this suggest it should be cached "MSGGEN002 - The function completed successfully "

    ------------------------------
    Chris Jessup
    ------------------------------



  • 7.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Mon November 21, 2022 07:03 PM
    Edited by Satid Singkorapoom Mon November 21, 2022 07:39 PM
    Dear Chris

    I see that if the message should mean what you expect for your case, then it does not make sense that the option /AUTH exists for the logon operation.  To me, /AUTH exists to turn on caching of the credential which should logically mean that credential caching is not the default behavior of ACS's connection logon. I also see that the fact that you encounter the sign-on dialog box on the subsequent command should give you an evidence that the message does not mean that logon credential is cached as you may expect. 

    Please try /AUTH to see if it addresses your issue or not. If not and you already run the latest ACS codes, then your incident can be a bug in ACS and you should report this to IBM Support team. 

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------