Enhance the support of MFA in DB2

Due to regulatory requirements many customers are being required to implement MFA on the mainframe. Specially the requirements for NYDFS which sets cybersecurity standards for financial services firms in New York.  DB2 seems to have some limitations that have been in place for many years that manage authentication and enhancements are needed to fully exploit the different methods/processes for implementing MFA.

At our company we enabled a method of MFA to match the user experience that was already in place in the distributed environment and used to access many secure internal corporate websites.  The solution chosen was a two-factor authentication where after sending in credentials to be authenticated on the mainframe, this resulted in a "push" to the users personal phone/device to acknowledge and approve the logon. 

This implementation has run into a few limitations that were unknown until they were encountered and have resulted in some business impacts during the rollout. Specifically what we are requesting as part of this enhancement idea are:

1) Increase the number of TCBs that can do RACF authorization calls, currently at 8 to higher limits. Current limit has introduced significant queuing on these auth TCBs and connection timeouts for both MFA and non-MFA connections.

2) Investigate redesigning the algorithm for Auth TBC selection to provide better optimization and throughput. 

3) Add necessary fields, perhaps in the SMF Stats record, that will help monitor the usage and efficiency of these auth TCBs.

Thank you for considering this enhancement request.