Portal | Manuals | References | Downloads | Info | Programs | JCLs | Master the Mainframes
IBM Mainframe Computers Forums Index
 
Register
 
IBM Mainframe Computers Forums Index Mainframe: Search IBM Mainframe Forum: FAQ Memberlist Usergroups Profile Log in to check your private messages Log in
 

 

Altering RACF group in batch or thru EXEC

 
Post new topic   Reply to topic    IBMMAINFRAMES.com Support Forums -> TSO/ISPF
View previous topic :: :: View next topic  
Author Message
vasanthz

Global Moderator


Joined: 28 Aug 2007
Posts: 1445
Location: Azeroth

PostPosted: Thu Oct 30, 2008 4:52 pm    Post subject: Altering RACF group in batch or thru EXEC
Reply with quote

Hi,

Could you please let me know if is possible to change my RACF by executing a batch job or a REXX exec. icon_sad.gif

We have a requirement to change our RACF groups whenever we submit specific jobs. So wanted to know if this can be done by some utility or EXEC. icon_smile.gif
Back to top
View user's profile Send private message

expat

Global Moderator


Joined: 14 Mar 2007
Posts: 8593
Location: Back in jolly old England

PostPosted: Thu Oct 30, 2008 4:59 pm    Post subject:
Reply with quote

I think not, unless you have RACF SPECIAL privileges.

Your default group would be used as default.
Back to top
View user's profile Send private message
enrico-sorichetti

Global Moderator


Joined: 14 Mar 2007
Posts: 10202
Location: italy

PostPosted: Thu Oct 30, 2008 5:03 pm    Post subject: Reply to: Altering RACF group in batch or thru EXEC
Reply with quote

wht' s wrong with using the "GROUP" parameter in the JOB card
Back to top
View user's profile Send private message
expat

Global Moderator


Joined: 14 Mar 2007
Posts: 8593
Location: Back in jolly old England

PostPosted: Thu Oct 30, 2008 5:12 pm    Post subject:
Reply with quote

But if you are connected to the group anyway, any authority related to that group and not your default group should be picked up as a matter of course.
Back to top
View user's profile Send private message
vasanthz

Global Moderator


Joined: 28 Aug 2007
Posts: 1445
Location: Azeroth

PostPosted: Thu Oct 30, 2008 5:18 pm    Post subject:
Reply with quote

Thanks for the swift reply,

I have not come across GROUP parameter icon_eek.gif , I will read about it and try it out now.


We have many RACF groups like GCDCOM4,GCDSRSUP, and some other GCD thingies icon_smile.gif
We change the RACF groups through the option 6(command) from ISPF with the following command "ALU XK89 DFLTGRP(RACFNAME)"

I was about to explain my situation to "EXPAT", but in the process found a technique for doing this.
I have come across executing TSO commands through batch and I guess that could solve the problem.



//XK89CA7 JOB 1,'BATCH CA7',MSGCLASS=Y,CLASS=1,NOTIFY=&SYSUID
//PS010 EXEC PGM=IKJEFT01
//SYSTSIN DD *
ALU XK89 DFLTGRP(GCDCOM4)
/*
//SYSTSPRT DD SYSOUT=*


This worked fine. icon_biggrin.gif
Nice coming across GROUP parameter. icon_biggrin.gif

Apologies if I had wasted your time icon_sad.gif
Back to top
View user's profile Send private message
enrico-sorichetti

Global Moderator


Joined: 14 Mar 2007
Posts: 10202
Location: italy

PostPosted: Thu Oct 30, 2008 5:45 pm    Post subject: Reply to: Altering RACF group in batch or thru EXEC
Reply with quote

I wonder why You need to change the default group...
never had the need to do it ( if the racf setup has been done properly)

the security auditors will be certainly be happy for all the alter group commands being given without reason icon_biggrin.gif
Back to top
View user's profile Send private message
vasanthz

Global Moderator


Joined: 28 Aug 2007
Posts: 1445
Location: Azeroth

PostPosted: Thu Oct 30, 2008 5:55 pm    Post subject:
Reply with quote

Hi Enrico,

Its a little complex to explain my situation.
We have many interfacing systems at our shop and each system files have their own RACF group associated with them.
The access is not tailored for individual TSO user.

The system files are restricted only to specific RACF groups.

So when we want to access some other sytem files, we are forced to change the RACF.
Back to top
View user's profile Send private message
enrico-sorichetti

Global Moderator


Joined: 14 Mar 2007
Posts: 10202
Location: italy

PostPosted: Thu Oct 30, 2008 5:58 pm    Post subject: Reply to: Altering RACF group in batch or thru EXEC
Reply with quote

does You support know about the GRPACC option ????
Back to top
View user's profile Send private message
vasanthz

Global Moderator


Joined: 28 Aug 2007
Posts: 1445
Location: Azeroth

PostPosted: Thu Oct 30, 2008 6:01 pm    Post subject:
Reply with quote

GRPACC? icon_eek.gif
No.

Never heard of it. Is it some RACF control command? icon_question.gif
Back to top
View user's profile Send private message
enrico-sorichetti

Global Moderator


Joined: 14 Mar 2007
Posts: 10202
Location: italy

PostPosted: Thu Oct 30, 2008 6:10 pm    Post subject: Reply to: Altering RACF group in batch or thru EXEC
Reply with quote

it' s an attribute of a racf user by which a user can access all the resources
for all groups to which is connected...

without grpacc at logon or job initiation
the user MUST choose using the GROUP keyword the group to work with
and access will be granted only to the resources of that group

with grpacc the user will access with the proper privileges all the resources
for all groups to which the user is connected
Back to top
View user's profile Send private message
vasanthz

Global Moderator


Joined: 28 Aug 2007
Posts: 1445
Location: Azeroth

PostPosted: Thu Oct 30, 2008 6:21 pm    Post subject:
Reply with quote

Hi Enrico,
Thanks for sharing the GRPACC,

I gave "lu" command on ISPF option 6. It displays the below information. I belive there are no attributes set for my ID icon_sad.gif .

Code:
 USER=XK89  NAME=VASANTH.SHANMUGAM     OWNER=GINDIA    CREATED=03.261           
  DEFAULT-GROUP=GCDDLTST PASSDATE=08.282 PASS-INTERVAL= 30 PHRASEDATE=N/A       
  ATTRIBUTES=NONE                                                               
  REVOKE DATE=NONE   RESUME DATE=NONE                                           
  LAST-ACCESS=08.304/12:46:36                                                   
  CLASS AUTHORIZATIONS=NONE                                                     
  INSTALLATION-DATA=HID=VASANTH SHANMUGAM,IT PERM C/O SUNDARA VINAYAGA         
                    M,CONNECT GROUP GCDRET3A REMOVED SEE EMAIL IN NOV0         
                    6                                                           
  NO-MODEL-NAME                                                                 
  LOGON ALLOWED   (DAYS)          (TIME)   


Please let me know how to set this attribute.
Back to top
View user's profile Send private message
enrico-sorichetti

Global Moderator


Joined: 14 Mar 2007
Posts: 10202
Location: italy

PostPosted: Thu Oct 30, 2008 8:00 pm    Post subject: Reply to: Altering RACF group in batch or thru EXEC
Reply with quote

Hi Vasanthz
I had another issue going on where GRPACC was involved
and I mixed up things a bit
GRPACC might be involved, but usually at the very end of the chain
( rough explanation... it concerns the permission for others members of the group to access resources created by a user when connected to that group)

I have been running some test with two users and two groups to find
out if there was any reason to change the default group

as far as datasets are concerned by having the two users connected to the
two groups with the proper permissions

the test for both users were ...
create, read, delete dataset for the primary/default group
the same for the other connect group
without even changing the group with the job card

I have been researching but was not able to find any reason
for dataset access , at least , to change the default connect group
Back to top
View user's profile Send private message
Pedro

Senior Member


Joined: 01 Sep 2006
Posts: 2019
Location: Silicon Valley

PostPosted: Thu Oct 30, 2008 9:17 pm    Post subject: Reply to: Altering RACF group in batch or thru EXEC
Reply with quote

The system RACF options have to allow list-of-groups access checking. Then the permissions will work for any group you are connected to, regardless of your current group. I think that is preferred rather than having each person do meticulous things to get their job done.

The system programmer has to issue this command:
Code:
  SETROPTS GRPLIST
Back to top
View user's profile Send private message
enrico-sorichetti

Global Moderator


Joined: 14 Mar 2007
Posts: 10202
Location: italy

PostPosted: Thu Oct 30, 2008 10:24 pm    Post subject: Reply to: Altering RACF group in batch or thru EXEC
Reply with quote

well said Pedro !!
Back to top
View user's profile Send private message
vasanthz

Global Moderator


Joined: 28 Aug 2007
Posts: 1445
Location: Azeroth

PostPosted: Thu Oct 30, 2008 10:42 pm    Post subject:
Reply with quote

Hi Enrico,

Actuallty I am a software programmer and am not aware of the security RACF very much.
I have had the perception that the only way to access multiple sytem files is to change the RACF, I will check with my info security buddies and try to get SETROPTS GRPLIST option ON.

I hope they don't kick me out since this being Christmas critical period. icon_eek.gif

Quote:
the test for both users were ...
create, read, delete dataset for the primary/default group
the same for the other connect group
without even changing the group with the job card

I have been researching but was not able to find any reason
for dataset access , at least , to change the default connect group


Thanks for testing this scenario icon_biggrin.gif
Back to top
View user's profile Send private message
View previous topic :: :: View next topic  
Post new topic   Reply to topic    IBMMAINFRAMES.com Support Forums -> TSO/ISPF All times are GMT + 6 Hours
Page 1 of 1

 

Search our Forum:

Similar Topics
Topic Author Forum Replies Posted
No new posts How does a called pgm know if its cal... Graeme Westerman COBOL Programming 4 Tue Nov 29, 2016 9:25 pm
This topic is locked: you cannot edit posts or make replies. MIPS reduction for Batch job Virendra Shambharkar All Other Mainframe Topics 8 Mon Nov 07, 2016 4:02 pm
No new posts abend sort based on count records in ... anatol DFSORT/ICETOOL 5 Mon Oct 17, 2016 10:10 pm
No new posts Strange EXEC function call in z/VM Willy Jensen CLIST & REXX 3 Wed Oct 05, 2016 2:07 pm
No new posts DB2 Streaming Batch Processing Problem Manshadi DB2 4 Sat Sep 24, 2016 12:14 pm


Facebook
Back to Top
 
Mainframe Wiki | Forum Rules | Bookmarks | Subscriptions | FAQ | Tutorials | Contact Us