Download - IBM CICS - IBM Z Customer Council

©2020 IBM Corporation

IBM CICSTransaction Server for z/OS

What’s New in CICS

[email protected]

Steve Fowlkes


• Java and Node.js in CICS

• Asynchronous API

• Policies in CICS

• Other CICS Enhancements

Session Agenda

2



CICS and Java


• IBM CICS Transaction Server has evolved to become the world's most powerful mixed language application server

• Applications can share core programming contexts such as transactionality, security, monitoring and management, regardless of the language its components are written in, and take full advantage of IBM Z

• Developers can create incredible mixed language applications, that include Java Enterprise Edition 8, Spring Boot, Eclipse MicroProfile and Node.js capabilities, with first-class interoperability

Unparalleled mixed-language application server

4


Java EE 8 Full Platform application support

5

• CICS TS supports Java applications that are written to the Java Enterprise Edition 8 (Java EE 8) Full Platform specification

• Using the embedded version of IBM WebSphere Liberty

• Java applications that are hosted in CICS TS are integrated with CICS tasks by default

• Can use the JCICS API to call other CICS programs and services

• Provide a simple and powerful mechanism of modernizing CICS applications

• by using Java EE 8 features and capabilities


• The CICS Liberty JVM server now supports the Jakarta Enterprise Edition (EE) 8• Use the latest Enterprise Edition APIs to integrate with CICS• The Jakarta EE 8 full platform technologies and specifications are an evolution of Java EE 8

• allowing developers and applications to easily transition from Java EE to Jakarta EE• The promise of Jakarta EE is a community-driven open source model

• enjoying more frequent releases than Java EE• evolving more quickly to address the needs of modern applications

• Liberty product extensions and Admin Center• Easily add user product extensions to take advantage of Liberty's powerful SPI

• allowing you to extend behaviour• Liberty Admin Center provides developers with a web interface

• to deploy, monitor, and manage Liberty servers and applications

Support for Jakarta EE 8 Platform

6


• The CICS Liberty JVM server supports Spring Boot applications• Using the Spring application programming model• Develop code without any web application server configuration and reduce build time

• Support is added for the Liberty features springBoot-1.5 and springBoot-2.0• Allowing Spring Boot JARs to be deployed directly to a Liberty JVM server• It also is possible to configure Spring Boot applications

• for integration with CICS transactions and security• to call the CICS Java API

• if applications are packaged and deployed as Spring Boot web application archives (WARs)• When built as a WAR

• a Spring Boot application can be deployed and managed using CICS bundles in the same way as can other CICS Liberty applications

• A Spring Boot application can use the annotation @CICSProgram to define a method as the target of a CICS program• This can be linked to from COBOL or any other language using the CICS channel and container interface

Spring Boot

7


• As an alternative to the IBM CICS SDK for Java• You can define your projects as Maven or Gradle modules• Express dependencies by referencing the Maven Central artifacts• Then package and deploy your application in a CICS bundle using the CICS-provided Maven or Gradle plug-in

• Simplified dependency management• Java developers can easily add dependencies on the Java CICS APIs and the CICS annotation processor with a few lines of configuration

• More flexibility when choosing the development environment• Java developers can write application code in a familiar IDE• Maven and Gradle support is available in most Java IDEs

• Eclipse, IntelliJ IDEA, and Visual Studio Code

• Bundle deployment with ease and confidence at development time (Requires the CICS bundle deployment API)• Java developers can redeploy a bundle using the CICS-provided Maven or Gradle plug-in• No need for them to have a zFS connection or disable, discard, and reinstall the bundle manually• Java developers can use the CICS-provided Maven or Gradle plug-in

• to integrate CICS bundle build and deployment into their toolchain• the API ensures controlled access to the CSD and to the bundle directory on the zFS

Maven Central libraries for CICS Java application development

8

https://www.ibm.com/links?url=https%3A%2F%2Fsearch.maven.org%2Fsearch%3Fq%3Dg%3Acom.ibm.cics


• Artifacts for CICS are provided on Maven Central to help developers resolve Java dependencies• Use with Maven or Gradle build tools

• The Java CICS class library (JCICS)• Provides EXEC CICS API support for Java applications in CICS TS

• The CICS annotations library and the CICS annotation processor• Enables CICS programs to invoke Java applications in a Liberty JVM server

• A bill of materials (BOM)• For each version of CICS, a BOM is provided

• to reference the correct version numbers for all compilation dependencies• defines versions of all the artifacts to ensure they are at the same release level of CICS TS

Maven Central libraries for CICS Java application development

9


• Enables developers to deploy and lifecycle CICS bundles as part of their build process• The CICS bundle deployment API

• Significantly reduces the time to rebuild and deploy the application• Provided by the CICS management client interface (CMCI) JVM server• Use in conjunction with the CICS plug-ins for Maven and Gradle• Deployment API receives metadata and the compressed CICS bundle

• including details of the CICSplex, the CICS region, and a CICS bundle definition• CICS bundle is installed and enabled into the specified CICS region

• with any existing CICS bundle disabled and discarded where required

• The CICS bundle deployment API enables Java developers to deploy bundles• while the system programmer retains control

Deployment API to simplify CICS bundle deployment

10


11


Liberty JWT feature

• Programmatically parse, build and verify JWT tokens in Java applications

• Provides for authentication using digitally signed web tokens

OpenID Connect Client feature

• Configure Liberty server to authenticate a request using a JWT token without writing any code

• Supports identity mapping• Map Subject in JWT to local registry user• Map distributed identity to SAF registry user via RACMAP

Both also available on CICS TS V5.3 and 5.4 with APAR PI91554

JSON Web Token

13


Java and Liberty in CICS

CICS TS V5

Java EE

Web

Apps

JDBC

JCA COBOL Applications

DB2

SQL

JCICS

VSAM

JMS

Liberty JVM server

IBM MQ

JZOS

z/OSservices

The full Java EE 8 Platform now supported in integrated mode

JMS support for MQ in client mode

JDBC and SQLJ for Db2 data sources and other relational databases

JCICS provides access to CICS API including linking to other CICS programs

JCA adapter supports porting of CICS TG ECI applications into CICS

JZOS provides access to z/OS services such as console, files


• Exploit zIIP capability for reduced MLC charges• Best suited to rich Java applications• Good for pure Java workloads

• JDBC Type 4 drivers• MQ/JMS client mode

• Exploit unique Java APIs• XML parsing & data marshalling• Java web services (JAX-RS, JAX-WS, JAXB, Jackson)• PDF generation• Java frameworks/function (e.g. Spring, JavaMail)• Type 4 JDBC driver for remote d/b or MQ/JMS client mode

Move Java app closer to system of record • Reduce network latency• Improve reliability

What types of CICS applications benefit from Java?



CICS and Node.js


• JavaScript – Scripting programming language for dynamic content• Interact with backend servers• Typically used with HTML and CSS• User interactions, asynchronous API calls, etc.• Language that is used within web browsers

• Node.js – Server-side JavaScript runtime platform• Designed to build scalable network applications

• best suited for data and I/O intensive applications• focused on high network bandwidth applications

• Lightweight and efficient• event-driven• single-threaded• non-blocking I/O model• leverages the underlying asynchronous I/O support in z/OS

• Module-driven approach to application design and development• scalable and encourages agile practices• becoming a favored choice for digital transformation

• has the ability to provide and aggregate REST services

Terminology

17


• Node Package Manager (NPM) – resolves, downloads, and builds dependencies• Large ecosystem of frameworks and tools for application development• 950K+ modules available via the NPM ecosystem• Modules are already available for most tasks

• saving considerable time for Node.js application developers

• IBM SDK for Node.js – z/OS – provides the Node.js runtime• Inherit the acclaimed capabilities of IBM Z• With full connection to the IBM Z critical assets• Leverage the trusted environment of IBM Z

• maximize the security and uptime of critical Node.js applications

Terminology

18


• A Node.js application in CICS might aggregate calls to existing business logic functions• To provide a single service interface for a front-end application• Avoiding the need for the front-end application to make several network calls• A Node.js application can also add functionality to existing business logic

• by calling external services or by using NPM modules

• Node.js applications can call services hosted in CICS in order to invoke existing business logic• These could be JSON or SOAP web services• Exposed by using CICS web services technology or z/OS Connect

• Node.js applications can call CICS services by using NPM modules• Used for making HTTP requests and for consuming JSON and SOAP web services

• When a Node.js application is hosted in the same CICS region as a JSON web service• A locally optimized transport can be used• Uses a cross-memory approach to call the service• Must use the ibm-cics-api module• Service must be exposed using CICS JSON web services technology

• suitable PIPELINE and URIMAP resources must exist

Why use Node.js in CICS ?

20


• The ibm-cics-api doesn’t just work inside CICS• You can use it to call remotely into CICS too

• Develop the Node.js app on your own machine• Then test that same app without having to deploy it anywhere

• Enable in CICS by adding a TCPIPSERVICE in front of the URIMAP and PIPELINE that will be handling the request from Node.js

• The transport will now use HTTP rather than a cross-memory call

The ibm-cics-api library

21


Add Node.js application to a CICS bundle1. NODEJSAPP bundle part2. Profile3. Nodejs. application• Start script• Other application assets

Build CICS bundle from source and deploy to zFS• CICS build toolkit• CICS Explorer• Zowe CLI• Tag text files, otherwise EBCDIC assumed• Run npm to resolve dependencies• DFHDPLOY, CICS TS plug-in for UCD, …

Lifecycle Management via CICS bundle as usual• CEDA, CEMT, SPI, CICS Explorer, CMCI, …• Node.js app is running when bundle part enabled• IBM SDK used by CICS to run the application• Unix signals used by CICS to end application

Node.js application in CICS

22



CICS Asynchronous API


• Executing work independently following an asynchronous request

• Tracking the completion status of work running asynchronously

• Exchanging data between asynchronous processes

Three key challenges involved in asynchronous processing

24


New Asynchronous API

25

• An Application Developer can write a CICS application that issues requests in parallel

• Minimising the application idle time waiting for responses

• Using a supported API that manages success and failure conditions


• EXEC CICS RUN TRANSID(tran) CHILD(token) CHANNEL(chan) • Run a new child task tran passing optional channel chan• If command is successful, CICS returns a child token

• EXEC CICS FETCH CHILD(token) COMPSTATUS(stat) CHANNEL(fetchchan) ABCODE(abcode)• Blocking command which fetches the completion status of a specific child

• NORMAL or ABEND• Optionally fetches a response channel from the child

• This will be a modified version of the channel passed by the earlier RUN TRANSID command

Asynchronous API commands

26


• EXEC CICS FETCH ANY(token) COMPSTATUS(stat) CHANNEL(fetchchan) ABCODE(abcode)• Blocking command which fetches the completion status of ANY child of the parent

• which has not been fetched• CICS will wait for the next unfetched child to complete• This command is used by the parent to iterate through responses from its children

• as each child completes• Optionally fetches a response channel from the fetched child

• This will be a modified version of the channel passed by RUN TRANSID

• EXEC CICS FREE CHILD(token)• Free child token created by previous RUN TRANSID command• Needed to support long-running parent

Asynchronous API commands (continued)

27


• EXEC CICS FETCH CHILD TIMEOUT(2000)

(or ANY)• Value in milliseconds

• If zero or omitted, the command will not time out• Nothing happens to the child task

• EXEC CICS FETCH CHILD NOSUSPEND

(or ANY)• The command does not block

• Useful to check combinations of children

Timeouts

28


A Parent Task

29

EXEC CICS PUT CONTAINER(container) CHANNEL(channel)

FROM(struct) FLENGTH(len_struct) BIT

RESP(reason) RESP2(response)

EXEC CICS RUN TRANSID(transid) CHILD(child)

CHANNEL(channel) RESP(reason) RESP2(response)

… Continue with other business logic …

EXEC CICS FETCH CHILD(child)

ABCODE(abcode)

COMPSTATUS(child_status)

CHANNEL(fetch_channel)


EXEC CICS GET CONTAINER(container) CHANNEL(fetch_channel)

INTO(struct) FLENGTH(len_struct)



A Child Program

30

EXEC CICS GET CONTAINER(container) CHANNEL(channel)



... Do some other business logic to modify container / data





A Parent Task

31




EXEC CICS RUN TRANSID(transid) CHILD(child)

CHANNEL(channel) RESP(reason) RESP2(response)

… Continue with other business logic …

EXEC CICS FETCH CHILD(child)

ABCODE(abcode)

COMPSTATUS(child_status)

CHANNEL(fetch_channel)


EXEC CICS GET CONTAINER(container) CHANNEL(fetch_channel)




• MAXACTIVE in TRANCLASS can be used to limit the number of tasks for a particular transaction class

• Can also use CICS policies to manage asynchronous workload, using the Async requests rule type

• When there are many parent tasks in the system, each of them starting child tasks• The system can then be flooded with asynchronous child tasks

• causing system reach MXT• side effects: SOS, long response time, task abend, hold up other tasks etc.

• We need a mechanism to control the number of asynchronous child tasks, so that:• System is not be flooded with asynchronous child tasks• System has capacity to serve other types of tasks

CICS automated control of asynchronous tasks

32

https://www.ibm.com/support/knowledgecenter/SSSQ3W_5.5.0/com.ibm.cics.core.help/topics/tasks/task_policies.html?view=kc


• If a region becomes overloaded• CICS will automatically start regulating workflow to prevent too many child tasks being created

• Parent tasks issuing a RUN TRANSID command• will be suspended and using the ASPARENT wait type put in a queue

• Parent tasks will be resumed when workload levels in the region drop

Automatic regulation by CICS

33



CICS Policies


• Control the run time behaviour of CICS based on a policyDeclarative mechanism to ensure CICS workload and systemscontinue to run effectively

• A policy defines the conditions and actions to take

CICS user task makes excessive use of system resourcese.g. a user task consumes too much storage

CICS system or user task changes the state of a system resourcee.g. a FILE resource is closed

CICS overall system health changese.g. number of active task exceeds the maximum user tasks in the CICS system (the MXT value)

• Several policies can be installede.g. one for each application, and one for the CICS region

CICS policy-based management

35


• CICS bundle contains one or more policies and other CICS resources

• Policy is an XML definition in a CICS bundle that contains one or more policy rules• Policy rule defines the rule type + condition + action• Rule types are grouped into system rules and task rules

• Condition is the criteria that has to be true before taking the action

• Action is the logic to perform• Issue a message (default)• Abend the task (task rules)• Emit an event• Reject EXEC CICS request (system rules)• Set z/OS WLM health open status (system rules)

Terminology

36


• Use task rules to • monitor the resource utilization of individual user tasks• automatically respond when a tasks resource usage exceeds a pre-defined threshold

• Excessive resource usage and looping transactions can be detected and dealt with appropriately

• Actions supported• Issue a message• Emit an event• Abend the task

• Details in topic Policy task rules

Rule types

37

https://www.ibm.com/support/knowledgecenter/SSGMCP_5.5.0/fundamentals/policies/policy-task-rules.html


• Support for seven types of system rules to help monitor overall system health• the status of a DB2 connection changes from or to a specific state

• DB2 connection status rule• the open status of a CICS FILE changes from or to a specific open state

• File open status rule• the enable status of a CICS FILE changes from or to a specific enablement state

• File enable status rule• CICS issues a DFHxxnnnn message or CICSPlex SM issues an EYUxxnnnn message

• Message rule• the number of active tasks in a CICS transaction class goes above or below a percentage of a transaction class MAXACTIVE value

• Transaction class tasks rule• a transaction encounters an unhandled abend

• Transaction abend rule• the number of active tasks in a CICS system goes above or below a percentage of the MXT value

• User tasks rule

New in CICS TS 5.4 - Policy system rules

38


• The following system rules are also available in CICS TS V5.4 with APAR PI92806• Enable status and available status of a BUNDLE resource

• Bundle enable status• Status of MRO and IPIC CONNECTION resources

• IPIC connection status• Enable status of a PROGRAM resource

• Program enable status

• Total number of AIDs in the local CICS system (CICS TS V5.5+ only)• AID threshold

New in CICS TS 5.4 - Policy system rules

39


New policy system rules• Status of DBCTL connections• DBCTL connection status

• Status of IBM MQ connections• IBM MQ connection status

• Enable status of a CICS PIPELINE resource• Pipeline enable status

• Update to CICS Explorer 5.5.0.3 for editor support• Delivered by CICS TS V5.5 APAR PH07632

New policy system rules to monitor (V5.5 CD)

40


• Use system rules to• monitor the state of critical system resources• monitor the overall health of a CICS system• respond automatically when any changes occur

• Actions supported• Issue a message• Emit an event• Reject EXEC CICS request• Set z/OS WLM health open status

• Details in topic Policy system rules

Rule types

41

https://www.ibm.com/support/knowledgecenter/SSGMCP_5.5.0/fundamentals/policies/policy-system-rules.html



What Else is New


• Extended INQUIRE JVMSERVER• Includes PROFILE, JAVAHOME, STDOUT, STDERR, TRACE, LOG, and WORKDIR• CICS Explorer views include new attributes and hyperlinks to files and directories

• New PERFORM JVMSERVER• JVM DUMP / LIBERTY SERVERDUMP to take javacore, heap and snap dumps, and Liberty dumps• GATHER DIAGNOSTICS to capture JVM configuration and output into a single tar file• LIBERTY REFRESH to update Liberty configuration and applications with minimal disruption• OSGI REFRESHPKGS to force OSGi bundle dependencies to refresh to the latest versions

• New INQUIRE/SET JVMENDPOINT• Inquire on endpoints used in Liberty JVM• Enable/disable endpoints results in start/stop of listening for requests• New CICS Explorer view

Enhanced administration commands for JVM server

43


• Enhanced support for CICS TS as an HTTP client when using TLS• CICS TS supports the use of Server Name Indication (SNI)

• as defined in Internet Engineering Task Force RFC 6066• No configuration change is required

• Enhanced VERIFY TOKEN command to process JSON Web Tokens• VERIFY TOKEN command has been enhanced to support JWTs provided by RACF only• User's basic authentication credentials can be converted to a time-limited secure token• Useful where applications currently using passwords are converted to use multi-factor authentication (MFA) tokens

Security Enhancements

44


• Monitoring helps diagnose user authentication problems, sometimes involving delays and external security managers• Performance data in group DFHTASK provides two new fields

• indicate the total elapsed time that a user task spent verifying authentication credentials

• User domain statistics provide new global statistics• giving a more comprehensive view of user instances

• CICS now collects global statistics on the security domain• providing a comprehensive view of authentication requests

CICS monitoring for the security domain

45


• CICS now monitors and guards against a shortage of MVS 24-bit and 31-bit storage• Short-on-storage (SOS) messages will be issued to indicate when CICS is short of MVS storage

• SOS can trigger new policy option• to set WLM health in order to direct workloads away from the CICS region until the

SOS is resolved

• During SOS CICS can wait to create open task control blocks (TCBs)

• TSICDATA subpool has been moved above the bar• Provides greater resilience when large number of tasks are started with data and queue on TCLASS limits• Avoids short on storage conditions in the 31bit ECDSA in this situation

Enhanced protection and monitoring of MVS SOS

46


Enhanced CICS translator checks for restricted commands or keywords• Define a restricted commands parmlib member DFHAPIR• impose rules on the use of specific CICS API and SPI commands• prevent the use of specific commands and keywords in application programs

• Warning or error messages issued

Translation time only• Runtime unaffected

Does not apply to GDS, DLI, FEPI, or CPSM commands

Restricting CICS API and SPI commands and keywords

47


• Extension of GMTRAN option DISCONNECT to CESF• forces the terminal session to be disconnected upon sign-off

• Resource definition online (RDO) enhancements to support definition of DUMPCODEs• allows DUMPCODEs for a CICS region to be installed at startup, removing the need to write a PLT

program• Capability to format recent trace entries for tasks

• stores data about the most recent trace entries for each task in a separate table• New replication log record

• enhanced to log a REDO record when an application issues an UNLOCK command following a read-update command, etc.

• New feature toggle to support RLS migration• you can issue a DELETE command with the RIDFLD option for a single record without causing AFCG

abends• Changes to feature toggle configuration

• can now implement region ID-specific feature toggle configuration• Ability of CICS-MQ bridge to write SMF type 110 records

• new parameter SMFMQGET• instructs the bridge to write SMF type 110 records for the number of MQGET requests

• Enhancements to CONFDATA to redact passwords in traces and dumps

Other key enhancements

48

©2020 IBM Corporation 49