Bank of Z is a hybrid banking application that demonstrates modern IBM Z development practices. It routes transactions through CICS or IMS depending on customer ID, with z/OS Connect as the API gateway between the browser-based UI and the z/OS transactional applications.
Full documentation is available at https://ibm.github.io/Bank-of-Z/.
For a detailed walkthrough of components and request flows, see the Architecture docs.
New here? Start with the Installation Overview →
Or follow the full setup path step by step:
| Step | Link |
|---|---|
| 1. Review prerequisites | Prerequisites |
| 2. Configure your environment | Environment Configuration |
| 3. Set up local tools | Local Tools Setup |
| 4. Deploy Bank of Z | Deploying Bank of Z |
| 5. Follow a tutorial | Tutorials |
The setup scripts configure HTTPS on two Liberty instances:
BAQ<APP_SHORT_NAME>(z/OS Connect) on port 9444 — serves the API at/apiFE<APP_SHORT_NAME>(Frontend Liberty) on port 9445 — serves the frontend WAR at/
CORS is configured on the z/OS Connect server to allow requests from the frontend
origin. config.js constructs the API URL using the current page's protocol and
hostname pointing at port 9444.
The server certificate is generated by addcert.sh + gencert-eku.sh using a
re-sign approach so the private key stays in the RACF keyring at all times:
RACDCERT GENCERT SIGNWITH(CERTAUTH)— RACF generates the keypair and a CA-signed certificate; the private key never leaves RACF.- The certificate (public side only) is exported as PEM and passed to Bouncy Castle, which rebuilds it with EKU
TLS Web Server Authentication+ SANs, then re-signs it with the VSICA CA key. RACDCERT ADD FORMAT(CERTDER)— the re-signed cert is imported back; RACF matches it to the private key it already holds (same public key).- Liberty reads the cert+key directly from the keyring via
safkeyring://<ZOS_ADMIN_USER>/<ZOS_KEYRING>.
Validity is capped at the CA/Browser Forum maximum for the date the cert is generated (CAB Forum ballot SC-081):
- Until 2027-03-14: 200 days
- 2027-03-15 onward: 100 days
- 2029-03-15 onward: 47 days
Re-run addcert.sh when the certificate expires to generate a fresh one.
One manual step is needed once per workstation — import the image's CA certificate into your OS trust store so browsers recognise it as trusted.
Replace <zos-user> and <image-ip> with your z/OS username and image IP address.
First, copy the CA cert from the image (Change Python path if needed):
ssh <zos-user>@<image-ip> \
'/usr/lpp/IBM/cyp/v3r14/pyz/bin/python3 -c "
raw=open(\"/u/ibmuser/common_cacert\",\"rb\").read()
open(\"/tmp/vsica_ca.pem\",\"w\").write(raw.decode(\"cp1047\"))"'
scp <zos-user>@<image-ip>:/tmp/vsica_ca.pem "$HOME/Downloads/vsica_ca.pem"Then trust it in your OS:
macOS:
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "$HOME/Downloads/vsica_ca.pem"Windows (run as Administrator):
certutil -addstore Root %USERPROFILE%\Downloads\vsica_ca.pemThen open the Bank of Z frontend:
HTTP
http://<your-zos-host>:9081/admin.htmlHTTPS
https://<your-zos-host>:9445/admin.html| Topic | Description |
|---|---|
| About Bank of Z | Purpose, capabilities, and architecture overview |
| Architecture | Components, request flows, and external integrations |
| Installation Overview | Installation workflow and stages |
| Prerequisites | Local and z/OS software requirements |
| Environment Configuration | Zowe profile setup and connectivity |
| Local Tools Setup | IDE, Zowe CLI, and GRUB setup |
| Deploying Bank of Z | Build the application and deploy to z/OS |
| Development Workflows | Zowe CLI and GRUB workflow guides |
| Tutorials | Deploy Bank of Z, CICS enhancement scenario |
| Reference | Commands, configuration, repository structure, glossary |
| Troubleshooting | Common issues and solutions |
This is a sample application for demonstration purposes. Feel free to fork the repository, customise it for your environment, add new features or programs, and share improvements.
Licensed under the Apache License, Version 2.0. See LICENSE for details.