This portal is to open public enhancement requests for IBM Sterling products and services. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).
Shape the future of IBM!
We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:
Search existing ideas
Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updateson them if they matter to you. If you can't find what you are looking for,
Post your ideas
Post an idea.
Get feedback from the IBM team and other customers to refine your idea.
Follow the idea through the IBM Ideas process.
Specific links you will want to bookmark for future use
Provide control over who can use the SNODEID parameter
This idea was previously raised for CDz CONDIRECTZ-I-8, however, it was informed by CDz L3 that the enhancement in CDz will not be able to work on remote Distributed CD nodes. Therefore, this request is raised for similar function on distributed platforms. Details of the requirement is a below:
With SPOE, the SNODEID presents a security vulnerability. The SNODEID is hard-coded in the process in clear text. Anyone authorized to use CDZ and able to read the file where the SNODEID is coded, typically in the process library, can create and submit their own process and have access on the remote node granted to the SNODEID under SPOE. Knowing the SNODEID a malicious actor could:
Retrieve the same production data that was sent by the local node to the remote node.
Retrieve the same production data that was or will be sent by the remote node to the local node.
Send bogus data from the local node to a production file on the remote node.
To mitigate this risk, we would like to have the capability to limit the use of the SNODEID by the user ID (ACID) submitting the process. A given ACID would need to be permissioned to use a particular SNODEID for a particular remote node. If the ACID were not correctly permissioned, then the process submit should fail. Ideally, the management of ACID permissions to use SNODEID's would be handled through the ESM (enterprise security manager) allowing proper separation of responsibilities between CD administrators and engineers and security administrators.
What is your industry?
How will this idea be used?
If this idea is implemented we will restrict the use of most SNODEIDs to the ACIDs used by the production job scheduler. This will prevent unauthorized use of SNODEIDs as explained in the idea description.
Do not place IBM confidential, company confidential, or personal information into any field.