VERIFYAPPL and VTAM generic resources for TSO

Customers should be able to exploit both VTAM generic resources as well as the TSO VERIFYAPPL function to limit access by system/APPLID.

Currently, if one wishes to control exactly which systems a TSO user has access to using the VERIFYAPPL keyword in the TSOKEYxx member, the systems programmer works with the external security manager to protect certain specific APPLIDs and prevent the TSO LOGON when the user attempts to LOGON to a specific system. When VTAM generic resources are used for TSO, WLM decides which single system is used for the LOGON and the user has no way to know which system is selected. The problem is that there may be systems where these "generic" LOGONs are not welcome and when TSO does the APPLID security check, it uses the VTAM generic resource name as defined by the GNAME parameter in the TSOKEYxx member. And presumably, the GNAME is the generic name for the entire collection of systems in the SYSPLEX, so when the security check is made for that APPLID using the generic name, there is no way to prevent a LOGON from happening on any single system or subset of the systems in a SYSPLEX. The only way to accomplish that is to remove the GNAME parameter from certain specific TSOKEYxx members in PARMLIB and have TSO fall back to the pre-VTAM generic resource method of LOGON restriction using the SMFID of the individual systems. But this creates a complication in PARMLIB trying to ensure that the security rules are in-sync with the TSOKEYxx PARMLIB definitions--that is... any systems that are eligible for a generic TSO LOGON can have the GNAME parameter defined in TSOKEYxx and any systems that are restricted can only use the TSOKEYxx members that have the individual SMFID defined.

Users should be able to set up PARMLIB with a single member that contains the GNAME parameter and permit VTAM/WLM to route the TSO LOGON to the best candidate system in the SYSPLEX, but also use the VERIFYAPPL function to check to see if the user is permitted to LOGON to that system. If not, VTAM/WLM should select the next best system and so on, until either there is a system available for the LOGON or there are no systems available at which time the LOGON just fails for lack of an available system.