Security Server (formerly RACF) interface - Revision history

JDamon: Gave an example of multiple VALIDAT options.

2019-08-21T01:37:02Z

Gave an example of multiple VALIDAT options.

← Older revision		Revision as of 01:37, 21 August 2019
Line 913:		Line 913:

	<tr><td>VALIDAT</td>		<tr><td>VALIDAT</td>
	<td>Specifies the type of validation to be performed. Multiple validation types can be specified for the interface.		<td>Specifies the type of validation to be performed. Multiple validation types can be specified for the interface;
			e.g. VALIDAT=(ACCOUNT,LOGIN,PRIORITY,SUBMIT)
	<p>		<p>
	Options are: </p>		Options are: </p>

ELowell: /* Preparing a RACFPARM parameter module with RACFGEN */

2019-06-26T19:44:19Z

Preparing a RACFPARM parameter module with RACFGEN

← Older revision		Revision as of 19:44, 26 June 2019
Line 945:		Line 945:
	<li>If DEFUSER=, that is, this field is left blank, then CCASTAT-defined users are not allowed to log into Model 204. Only valid Security Server users can utilize the running system. </li>		<li>If DEFUSER=, that is, this field is left blank, then CCASTAT-defined users are not allowed to log into Model 204. Only valid Security Server users can utilize the running system. </li>

	<li>If DEFUSER=<var class="term">JOBNAME</var>, then the following occurs. The ASID ACEE is moved to DEFUSER, the GROUP ACEE is moved to		<li>If DEFUSER=<var class="term">JOBNAME</var>, then the following occurs. The ASID ACEE is moved to DEFUSER, the GROUP ACEE is moved to DEFGROUP, and the default user’s ACEE pointer is set to AUCKDPTR. In other words, the user ID associated with the submitted job is used as DEFUSER and users defined in CCASTAT are allowed to log on.</li>
	DEFGROUP, and the default user’s ACEE pointer is set to AUCKDPTR. </li>
	</ul></td></tr>		</ul></td></tr>

JAL: add link

2018-04-30T17:02:58Z

add link

← Older revision		Revision as of 17:02, 30 April 2018
Line 372:		Line 372:
	===Using Pass Tickets===		===Using Pass Tickets===
	<p>		<p>
	Model 204 supports the use of Pass Tickets instead of passwords during the logon process under RACF. This support does not require new CCAIN parameters nor changes to existing parameters. However, RACF expects Pass Tickets to be generated using the user's ID concatenated with the APPLID (VTAMNAME) of the target ~~online~~.</p>		Model 204 supports the use of Pass Tickets instead of passwords during the logon process under RACF. This support does not require new CCAIN parameters nor changes to existing parameters. However, RACF expects Pass Tickets to be generated using the user's ID concatenated with the APPLID (<var>[[VTAMNAME parameter\|VTAMNAME]]</var>) of the target Online.</p>

	===User ID information===		===User ID information===

JDamon: Added info on Pass Tickets

2018-04-28T00:01:23Z

Added info on Pass Tickets

← Older revision		Revision as of 00:01, 28 April 2018
Line 369:		Line 369:
	<td>Is an optional character string that identifies the account under which you log in.</td> </tr>		<td>Is an optional character string that identifies the account under which you log in.</td> </tr>
	</table>		</table>

			===Using Pass Tickets===
			<p>
			Model 204 supports the use of Pass Tickets instead of passwords during the logon process under RACF. This support does not require new CCAIN parameters nor changes to existing parameters. However, RACF expects Pass Tickets to be generated using the user's ID concatenated with the APPLID (VTAMNAME) of the target online.</p>

	===User ID information===		===User ID information===

JAL: /* Trusted login errors */ misc formatting

2018-04-27T21:48:14Z

Trusted login errors: misc formatting

← Older revision		Revision as of 21:48, 27 April 2018
Line 664:		Line 664:
	<p>When using trusted login, you might receive one of the errors described in this section. </p>		<p>When using trusted login, you might receive one of the errors described in this section. </p>
	<ul>		<ul>
	<li~~><p~~>The following message: ~~</p>~~		<li>The following message:
	<p class="code">M204.2378: ~~SECURITY TRUSTED LOGIN FEATURE DISABLED~~ </p>		<p class="code">M204.2378: Security trusted login feature disabled </p>
	<p>is generated in either of the following situations: </p>		<p>
			is generated in either of the following situations: </p>
	<ul>		<ul>
	<li>The Model 204 job requesting the trusted login feature is running without a Model 204 Security Interface (CA-ACF2, Security Server, or CA-Top Secret).</li>		<li>The Model 204 job requesting the trusted login feature is running without a Model 204 Security Interface (CA-ACF2, Security Server, or CA-Top Secret). </li>
	<li>
	Model 204 address space does not have enough storage to allocate an internal work area for the trusted login feature. In this		<li>Model 204 address space does not have enough storage to allocate an internal work area for the trusted login feature.
	situation, the ~~Model204~~ job does not initialize because it still has to allocate storage for the Model 204 file buffers.		<p>
	</li>		In this
			situation, the Model 204 job does not initialize because it still has to allocate storage for the Model 204 file buffers. </p></li>
	</ul>		</ul>
	</li>		</li>

	<li>The following message is issued when the trusted user ID passed by CRAM is not between 1-8 bytes long:		<li>The following message is issued when the trusted user ID passed by [[Cross-memory facilities CRAM and M204XSVC\|CRAM]] is not between 1-8 bytes long:
	<p class="code">M204.2379: ~~INVALID TRUSTED USERID LENGTH~~ = <span class="term">length</span></p>		<p class="code">M204.2379: Invalid trusted user-id length=<span class="term">length</span> </p>
	</li>		</li>
	</ul>		</ul>

JAL: misc formatting

2018-04-20T00:48:33Z

misc formatting

Show changes

JAL: /* New and changed commands */ add the change to the AUTHCTL VIEW cmd

2018-04-20T00:18:07Z

New and changed commands: add the change to the AUTHCTL VIEW cmd

← Older revision		Revision as of 00:18, 20 April 2018
Line 579:		Line 579:
	===AUTHCTL VIEW command===		===AUTHCTL VIEW command===
	<p>		<p>
	The <var>[[AUTHCTL command\|AUTHCTL VIEW]]</var> command displays the interface control options currently in effect for the active interface.		The <var>[[AUTHCTL command\|AUTHCTL VIEW]]</var> command displays the interface control options currently in effect for the active interface. As of version 7.7 of Model 204, the command also displays a list of all the <em>sets</em> of control options that are available to the interface (and potential values of the <var>[[#SECPLIST parameter\|SECPLIST]]</var> parameter).
	</p>		</p>
	<p>		<p>
Line 588:		Line 588:
	AUTHCTL VIEW RACF</p>		AUTHCTL VIEW RACF</p>
	<p>		<p>
	A list of interface options something like the following ~~is displayed (assuming this information was used during initialization)~~, ~~and the~~ Security Server ID and group name of the job owner might also be included: </p>		You see a list of interface options something like the following, which might be preceded by a list of available option sets, as described above. The Security Server ID and group name of the job owner might also be included: </p>

	<p class="code">GROUP M204TEST <var class="term">Security Server control group name</var>		<p class="code">GROUP M204TEST <var class="term">Security Server control group name</var>
Line 599:		Line 599:
	DLMCHECK <var class="term">Use $JOB DLM checking option</var> </p>		DLMCHECK <var class="term">Use $JOB DLM checking option</var> </p>
	<p>		<p>
	For more information about defaults, refer to [[#Security Server default user ID\|Security Server default user ID]]. For information about setting control information, see [[#Preparing a RACFPARM parameter module with RACFGEN\|Preparing a RACFPARM parameter module with RACFGEN]]. </p>		For more information about user defaults, refer to [[#Security Server default user ID\|Security Server default user ID]]. For information about setting control information, see [[#Preparing a RACFPARM parameter module with RACFGEN\|Preparing a RACFPARM parameter module with RACFGEN]]. </p>

	===Using trusted login for CRAM users===		===Using trusted login for CRAM users===

JAL: /* Defining user privileges */ add `s`

2018-04-20T00:00:23Z

Defining user privileges: add <var>s

← Older revision		Revision as of 00:00, 20 April 2018
Line 694:		Line 694:

	===Defining user privileges===		===Defining user privileges===
			<p>
	<p>You must identify user privilege names as Security Server generic data set profiles. The standard Model 204 user privileges		You must identify user privilege names as Security Server generic data set profiles. The standard Model 204 user privileges
	described earlier have been assigned fixed names. The following set of user privilege names defines the possible privilege types for a user. These names are further qualified by the control group name entered in the RACFPARM module. </p>		described earlier have been assigned fixed names. The following set of user privilege names defines the possible privilege types for a user. These names are further qualified by the control group name entered in the RACFPARM module. </p>

	<p>		<p>
	These user privilege profile names are described in the following table. See the [[LOGCTL command: Modifying user ID entries in the password table\|LOGCTL]] command page for more information ~~on the~~ LOGCTL settings.		These user privilege profile names are described in the following table. See the [[LOGCTL command: Modifying user ID entries in the password table\|LOGCTL]] command page for more information about <var>LOGCTL</var> settings. </p>
	</p>

	<table>		<table>
Line 708:		Line 706:
	<th>User privilege name... </th>		<th>User privilege name... </th>
	<th>Defines a user who can... </th>		<th>Defines a user who can... </th>
	<th>~~Corresponding~~ LOGCTL setting </th>		<th>LOGCTL setting </th>
	</tr>		</tr>

	<tr>		<tr>
	<td><i>group</i>.PRIV.SUPER.USER </td>		<td><i>group</i>.PRIV.SUPER.USER </td>
	<td>Exercise superuser privileges: a user with READ access to this profile can execute a CREATE command. </td>		<td>Exercise superuser privileges: a user with READ access to this profile can execute a <var>CREATE</var> command. </td>
	<td>X'80' </td>		<td>X'80' </td>
	</tr>		</tr>
Line 719:		Line 717:
	<tr>		<tr>
	<td><i>group</i>.PRIV.SYSTEM.ADMIN</td>		<td><i>group</i>.PRIV.SYSTEM.ADMIN</td>
	<td>Exercise system administrator privileges: a user with read access to this profile can issue system administrator commands such as LOGWHO, MONITOR, PRIORITY, and WARN. </td>		<td>Exercise system administrator privileges: a user with read access to this profile can issue system administrator commands such as <var>LOGWHO</var>, <var>MONITOR</var>, <var>PRIORITY</var>, and <var>WARN</var>. </td>
	<td>X’40’ </td>		<td>X’40’ </td>
	</tr>		</tr>
Line 731:		Line 729:
	<tr>		<tr>
	<td><i>group</i>.PRIV.SYSTEM.MANAGER </td>		<td><i>group</i>.PRIV.SYSTEM.MANAGER </td>
	<td>With system manager privileges: a user with read access to this profile can issue all system administrator commands along with certain other privileged commands such as LOGCTL, AUTHCTL VIEW, and DUMPG. </td>		<td>With system manager privileges: a user with read access to this profile can issue all system administrator commands along with certain other privileged commands such as <var>LOGCTL</var>, <var>AUTHCTL VIEW</var>, and <var>DUMPG</var>. </td>
	<td>X'08' </td>		<td>X'08' </td>
	</tr>		</tr>

	<tr>		<tr>
	<td><i>group</i>.PRIV.OVERRIDE.RECORD.SECURITY </td>		<td nowrap><i>group</i>.PRIV.OVERRIDE.RECORD.SECURITY </td>
	<td>Override record security. </td>		<td>Override record security. </td>
	<td>X'04' </td>		<td>X'04' </td>

JAL: /* AUTHCTL VIEW command */ misc formatting

2018-04-18T21:24:09Z

AUTHCTL VIEW command: misc formatting

← Older revision		Revision as of 21:24, 18 April 2018
Line 588:		Line 588:
	AUTHCTL VIEW RACF</p>		AUTHCTL VIEW RACF</p>
	<p>		<p>
	~~The~~ following ~~list~~ is displayed (assuming this information was used during initialization): </p>		A list of interface options something like the following is displayed (assuming this information was used during initialization), and the Security Server ID and group name of the job owner might also be included: </p>

	<p class="code">~~Security Server INTERFACE OPTIONS~~		<p class="code">GROUP M204TEST <var class="term">Security Server control group name</var>
	GROUP M204TEST <var class="term">Security Server control group name</var>
	COMGROUP M204COM <var class="term">Security Server common control group name</var>		COMGROUP M204COM <var class="term">Security Server common control group name</var>
	VALIDATE LOGIN <var class="term">Validation option in effect</var>		VALIDATE LOGIN <var class="term">Validation option in effect</var>
	VALIDATE ACCOUNT <var class="term">Validation option in effect</var>		VALIDATE ACCOUNT <var class="term">Validation option in effect</var>
	PRIORITY LOW <var class="term">Priority default</var>		PRIORITY LOW <var class="term">Priority default</var>
	~~DLMCHECK~~ <var class="term">~~Use $JOB DLM checking option~~</var>		DEFUSR M204USR <var class="term">Default user ID</var>
	M204GRP <var class="term">Default user group</var>		DEFGRP M204GRP <var class="term">Default user group</var>
	~~M204USR~~ <var class="term">~~Default user ID~~</var>		DLMCHECK <var class="term">Use $JOB DLM checking option</var> </p>
	</p>		<p>
			For more information about defaults, refer to [[#Security Server default user ID\|Security Server default user ID]]. For information about setting control information, see [[#Preparing a RACFPARM parameter module with RACFGEN\|Preparing a RACFPARM parameter module with RACFGEN]]. </p>
	<p>~~The additional lines displayed indicate the current default user ID and group in use.~~ For more information about defaults, refer to [[#Security Server default user ID\|Security Server default user ID]].
	~~</p>~~

	~~<p>~~For information about setting control information, see [[#Preparing a RACFPARM parameter module with RACFGEN\|Preparing a RACFPARM parameter module with RACFGEN]]. </p>

	===Using trusted login for CRAM users===		===Using trusted login for CRAM users===

Mlarocca: /* SECPLIST parameter */

2017-07-19T22:19:35Z

SECPLIST parameter

← Older revision		Revision as of 22:19, 19 July 2017
Line 843:		Line 843:
	VALIDAT=ACCOUNT, X		VALIDAT=ACCOUNT, X
	DEFUSER=M204USR, X		DEFUSER=M204USR, X
	~~DEFGRP~~=, X		DEFUGRP=, X
	DEFPASS=, X		DEFPASS=, X
	DMLCHECK		DMLCHECK
Line 851:		Line 851:
	VALIDAT=(ACCOUNT,LOGIN), X		VALIDAT=(ACCOUNT,LOGIN), X
	DEFUSER=JOBNAME, X		DEFUSER=JOBNAME, X
	~~DEFGRP~~=M204GRP, X		DEFUGRP=M204GRP, X
	DEFPASS=DEFPASS, X		DEFPASS=DEFPASS, X
	DMLCHECK		DMLCHECK