IBM i Global

IBM i 

A space for professionals working with IBM’s integrated OS for Power systems to exchange ideas, ask questions, and share expertise on topics like RPG and COBOL development, application modernization, open source integration, system administration, and business continuity.


#Power


#IBMi
 View Only
Expand all | Collapse all

Using cached/scripted credentials to enter a 5250 emulator session

  • 1.  Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue November 15, 2022 09:33 AM
    Hello

    As part of a Privileged Access Management project, I would like to be able to run a 5250 emulator using a scripted set of credentials. I have tried using the following commands but still get a username/password dialogue.

    acslaunch_win-64.exe /plugin=logon /system=*** /userid=username /password=password
    acslaunch_win-64.exe /plugin=5250 /system=*** /sso /nosave /wide

    Any suggestions would be great

    Thanks

    ------------------------------
    Chris Jessup
    ------------------------------


  • 2.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue November 15, 2022 07:05 PM
    Edited by Satid Singkorapoom Tue November 15, 2022 07:35 PM
    Dear Chris

    Have you also taken the actions described in this Technote?  Bypass IBM i OS Sign-On Screen
    I think the proper value for the system value QRMTSIGN is mandatory but am not sure if this applied to ACS version of PC5250 or not.

    To enable bypass sign-on, the following is required:

    o On the operating system command line, type the following:

    WRKSYSVAL QRMTSIGN

    Press the Enter key. Change the value to *VERIFY.
    o In the IBM Access for Windows PC5250 Emulator, Select Communications, Configure, and check the Bypass Signon option.

    In the IBM i Access Client Solutions 5250 Emulator, Select Communications, Configure, and then the Advanced option on the left hand side, select the Bypass Signon option.

    The Bypass sign-on is now enabled. The change will take effect immediately.


    If setting the system value does not help, please read this Technote :  Three Methods by which to by-pass GUI sign on using IBM i Access Client Solutions.    Please note that it indicates that for your method,  "These examples would have to be ran from the directory where either the acslaunch_win-32.exe or the acslaunch_win-64.exe reside."    I think this means you should specify the full directory path for the EXE files.

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 3.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Fri November 18, 2022 03:10 AM
    Thanks for your help. It is most appreciated.

    I get a MSGGEN002 - The function completed successfully when I try acslaunch_win-64.exe /plugin=logon /system=systemname /userid=userid /password=password /GUI=1

    But I still get a username/password dialog when launching the emulator acslaunch_win-64.exe /plugin=5250 /system=systemname /nosave /wide
    Do you know why it is not using the cached credentials?

    ------------------------------
    Chris Jessup
    ------------------------------



  • 4.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Fri November 18, 2022 06:56 AM
    Edited by Satid Singkorapoom Fri November 18, 2022 06:42 PM
    Dear Chris

    >>>> Do you know why it is not using the cached credentials? <<<<

    Yes, I think I know why (although not fully 100% sure) and thus my original response above.  What you want is called Bypass Sign-on feature of 5250 emulator.  This feature requires the 2 actions I provided above to work.

    With the problem you encountered, have you already changed system value QRMTSIGN to *VERIFY yet?  This has been MANDATORY for a long time in the past for enabling Bypass Sign-on feature in 5250 emulator that came with the old IBM i Access. AND you also need to enable Bypass Sign-on in 5250 emulator as shown in the picture below.  



    I believe these 2 actions are still required for ACS's 5250 emulator regardless of how you invoke the emulator. Please take these 2 actions and see if it works the way you want or not.

    As a side note, I notice that options /nosave and /wide are not completed. For details, check section 9.1.13 in this ACS Getting Start URL :  https://www.ibm.com/support/pages/ibm-i-access-acs-getting-started

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 5.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Fri July 12, 2024 09:26 AM

    Hi Satid Singkorapoom,

    I was able to automate the login process with the following command line. 

    C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\acslaunch_win-64.exe /PLUGIN=logon /AUTH /SYSTEM=SYSTEM1 /USERID=USERXX /PASSWORD=XXXXXXXX /GUI=0  &  C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\acslaunch_win-64.exe C:\Users\Administrador\Documents\IBM\iAccessClient\Emulator\KYWICDS.hod

    I tried with following comand but it didn't work because i got a meesage saying that user and password are invalid parameter

    C:\Users\aPublic \IBM\ClientSolutions\Start_Programs\Windows_i386-64\acslaunch_win-64.exe /PLUGIN=logon /AUTH /SYSTEM=SYSTEM1 /USERID=USERXX /PASSWORD=xxxxxx /GUI=0 /PLUGIN=5250

    Is there a single command to automate the login process and launch the 5250 session?



    ------------------------------
    Santiago Avila
    ------------------------------



  • 6.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue July 16, 2024 09:23 AM

    Dear Sanbtiago

    Would Roberto Colonnese's post below work for you?  He uses    C:\Users\amministrativo4\IBM\ClientSolutions\Start_Programs\Windows_i386-32\acslaunch_win-32.exe /PLUGIN=logon /AUTH /SYSTEM=xxx.xxx.xxx.xxx /USERID=xxxxx /PASSWORD=xxxxxx /GUI=2



    ------------------------------
    Satid S
    ------------------------------



  • 7.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue July 16, 2024 11:07 AM

    When I use this command I get this error  "a meesage saying that user and password are invalid parameter". So I don't know if the syntax it is incorrect or It does not support those options of User and password



    ------------------------------
    Santiago Avila
    ------------------------------



  • 8.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue July 16, 2024 09:23 AM

    Dear Santiago

    Would Roberto Colonnese's post below work for you?   He uses  C:\Users\amministrativo4\IBM\ClientSolutions\Start_Programs\Windows_i386-32\acslaunch_win-32.exe /PLUGIN=logon /AUTH /SYSTEM=xxx.xxx.xxx.xxx /USERID=xxxxx /PASSWORD=xxxxxx /GUI=2



    ------------------------------
    Satid S
    ------------------------------



  • 9.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Tue August 27, 2024 01:58 PM

    Hi Satid S,

    Yes, when you use the /PLUGIN=logon the authentication process works, but I does not open the terminal emulation by itself. You have to do another job to open it. What i mean is that it does not authenticate with the /PLUGIN=5250 which is what I want to do it.

    Regards,

    Santiago



    ------------------------------
    Santiago Avila
    ------------------------------



  • 10.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Wed August 28, 2024 04:57 AM
    Edited by Satid S Wed August 28, 2024 05:00 AM

    Dear Santiago

    >>>> Yes, when you use the /PLUGIN=logon the authentication process works, but I does not open the terminal emulation by itself. You have to do another job to open it. What i mean is that it does not authenticate with the /PLUGIN=5250 which is what I want to do it. <<<<

    I did a test from my Windows PC as follows:

    • open Windows command line session
    • change current directory to \<ACS folder>\Start_Programs\Windows_x86-64\ 
    • run this:  acslaunch_win-64.exe /plugin=logon /system=*** /userid=username /password=password
    • I am notified that the function completed successfully.
    • run this:  acslaunch_win-64.exe /plugin=5250 /system=***  /nosave /wide
    • I get a 5250 session without being asked to provide any user+password

     

    I ask you to do this test and see if you have a problem or not.  If you encounter the problem, then something in your Windows environment may be the cause.  

    Do you use a company-supplied Windows PC that is more likely managed by your company-deployed Group Policy?   In the past when I used my company-supplied Windows PC, I could not do some professional operations that I needed to do and I was told I had to seek approval for exemption from standard Group Policy. I did and then was able to do what I needed to do in my company-supplied PC.   Are you in this same situation?



    ------------------------------
    Satid S
    ------------------------------



  • 11.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Wed August 28, 2024 03:37 PM

    Thank you Satid, 

    It does work as you tell to run it, only that I wanted to do it only in one line, both process, but I will do it as you showed to me.

    Regards,

    Santiago



    ------------------------------
    Santiago Avila
    ------------------------------



  • 12.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Sun November 20, 2022 07:34 AM
    From ACS Getting Start information, I see that you should also include the option /AUTH in the first plugin=logon command.  /AUTH means "attempts connect to system with specified logon credentials and only caches them on success".

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 13.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Mon November 21, 2022 06:02 AM
    Wouldn't this suggest it should be cached "MSGGEN002 - The function completed successfully "

    ------------------------------
    Chris Jessup
    ------------------------------



  • 14.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Mon November 21, 2022 07:03 PM
    Edited by Satid Singkorapoom Mon November 21, 2022 07:39 PM
    Dear Chris

    I see that if the message should mean what you expect for your case, then it does not make sense that the option /AUTH exists for the logon operation.  To me, /AUTH exists to turn on caching of the credential which should logically mean that credential caching is not the default behavior of ACS's connection logon. I also see that the fact that you encounter the sign-on dialog box on the subsequent command should give you an evidence that the message does not mean that logon credential is cached as you may expect. 

    Please try /AUTH to see if it addresses your issue or not. If not and you already run the latest ACS codes, then your incident can be a bug in ACS and you should report this to IBM Support team. 

    ------------------------------
    Right action is better than knowledge; but in order to do what is right, we must know what is right.
    -- Charlemagne

    Satid Singkorapoom
    ------------------------------



  • 15.  RE: Using cached/scripted credentials to enter a 5250 emulator session

    Posted Mon October 30, 2023 03:57 PM

    Hi, I also have a similar problem, I can't automate the logon in programs like Access or Excel, I can do it in the terminal.

    C:\Users\amministrativo4\IBM\ClientSolutions\Start_Programs\Windows_i386-32\acslaunch_win-32.exe /PLUGIN=logon /AUTH /SYSTEM=xxx.xxx.xxx.xxx /USERID=xxxxx /PASSWORD=xxxxxx /GUI=2


    here is the string I use in the .bat file that is executed every time Windows starts.

    thanks.



    ------------------------------
    Roberto Colonnese
    ------------------------------