Portal | Manuals | References | Downloads | Info | Programs | JCLs | Master the Mainframes
IBM Mainframe Computers Forums Index
 
Register
 
IBM Mainframe Computers Forums Index Mainframe: Search IBM Mainframe Forum: FAQ Memberlist Usergroups Profile Log in to check your private messages Log in
 

 

Possible to EXEC REXX as another user without batch job?

 
Post new topic   Reply to topic    IBMMAINFRAMES.com Support Forums -> CLIST & REXX
View previous topic :: :: View next topic  
Author Message
Chris Amidon

New User


Joined: 21 Apr 2015
Posts: 5
Location: United States

PostPosted: Tue May 05, 2015 9:07 pm    Post subject: Possible to EXEC REXX as another user without batch job?
Reply with quote

Hi, I have a feeling I already know the answer to this question, as I've done some pretty intense Googling on this, but I'm hoping one of you guys are smarter than I am or at least have better Google-fu than I, and have done this before.

I have a need (desire?) to EXEC a REXX from within another REXX as another user. Ideally, I can do this without having to submit a batch job (this is how I'm doing it now, but it is a bit messy for my taste). I'd love to be able to execute a compiled REXX as another user and get back a result without having to do it through a batch job.

I'm currently accomplishing this task by building commands that I'm feeding in to a dataset which is then being used in the SYSIN dataset for a job that I'm submitting with a USER= and PASSWORD= statement on the jobcard. If I could just execute a REXX function as another user, that would be a bit easier to work with.
Back to top
View user's profile Send private message

Mickeydusaor

Active User


Joined: 24 May 2006
Posts: 258
Location: Salem, Oregon

PostPosted: Tue May 05, 2015 9:39 pm    Post subject:
Reply with quote

Why not build all the required DD and DSN in the Your REXX and the just invoke the program from your REXX instead of build and submitting a batch
job. you then can plug anything you want into the job card, the userid and so on before invoking the program.
Back to top
View user's profile Send private message
Chris Amidon

New User


Joined: 21 Apr 2015
Posts: 5
Location: United States

PostPosted: Tue May 05, 2015 11:41 pm    Post subject:
Reply with quote

I guess that is very valuable information! I have another process running that resets the password periodically and stores it in an encrypted file. When I build my JCL, I'm actually running another process to fetch the encrypted password and plugging it into the JCL.

I know someone could get the password if they were smart enough to run the REXX through a debugger, but we are calling it "good enough" for this particular process as long as we have another process that automatically resets the password every so often (think like 5 minutes).
Back to top
View user's profile Send private message
enrico-sorichetti

Global Moderator


Joined: 14 Mar 2007
Posts: 10202
Location: italy

PostPosted: Wed May 06, 2015 12:21 am    Post subject: Reply to: Possible to EXEC REXX as another user without batch job?
Reply with quote

why not use the surrogate id ???
i.e the authority to submit a job on behalf of another user.
Back to top
View user's profile Send private message
Chris Amidon

New User


Joined: 21 Apr 2015
Posts: 5
Location: United States

PostPosted: Wed May 06, 2015 12:35 am    Post subject:
Reply with quote

Granting surrogate authority would give these users more access than I actually want them to have. I'm hiding the process to build the jobcard in a compiled REXX and then using RACF to protect execution of the exec.

I realize this is suboptimal, and I seriously wouldn't do it if there were a better way.
Back to top
View user's profile Send private message
Pedro

Senior Member


Joined: 01 Sep 2006
Posts: 2019
Location: Silicon Valley

PostPosted: Wed May 06, 2015 2:15 am    Post subject: Reply to: Possible to EXEC REXX as another user without batch job?
Reply with quote

Quote:
If I could just execute a REXX function as another user

It is not clear what you cannot do from your own userid that the other userid will be able to do. You should be able to grant the same permissions as the other user so that either user can invoke the rexx program.

Your process is not entirely clear to me... perhaps what you want is for the program to be the one that is authorized, rather than granting permission to numerous users. You would want a compiled program rather than a rexx program.
Back to top
View user's profile Send private message
Chris Amidon

New User


Joined: 21 Apr 2015
Posts: 5
Location: United States

PostPosted: Wed May 06, 2015 2:22 am    Post subject:
Reply with quote

Well, the program is going to be removing a users access to a specific RACF profile. I need the helpdesk to be able to execute this function. I don't know of a way to allow this user to perform this action without granting helpdesk users RACF SPECIAL authority. The catch is that I don't want to do anything that would de-facto make these users RACF SPECIAL like granting surrogate authority would. I ONLY want them to be able to remove a users authority to this one specific profile.

Perhaps what you are saying is what I actually need. Presumably I could compile a REXX program and give it access to remove access to the profile in question.
Back to top
View user's profile Send private message
Pedro

Senior Member


Joined: 01 Sep 2006
Posts: 2019
Location: Silicon Valley

PostPosted: Wed May 06, 2015 6:33 am    Post subject: Reply to: Possible to EXEC REXX as another user without batch job?
Reply with quote

Consider granting the help desk personnel CONTROL authority to only that data set profile:
Code:
ADDGROUP HELPDESK
CONNECT HELP01 GROUP(HELPDESK) AUTHORITY(USE)
CONNECT HELP02 GROUP(HELPDESK) AUTHORITY(USE)

PERMIT my.restrict.dsn ID(HELPDESK) ACCESS(CONTROL)

I think the help desk personnel will be able to issue PERMIT commands for your data set. They will be able to grant or delete authority.

Another approach is to use the ICHCCX00 command exit. Your exit can determine the userid and the parameters specified on the command, then it can allow the command to proceed or not. This is not for the faint of heart.
Back to top
View user's profile Send private message
View previous topic :: :: View next topic  
Post new topic   Reply to topic    IBMMAINFRAMES.com Support Forums -> CLIST & REXX All times are GMT + 6 Hours
Page 1 of 1

 

Search our Forum:

Similar Topics
Topic Author Forum Replies Posted
No new posts How does a called pgm know if its cal... Graeme Westerman COBOL Programming 4 Tue Nov 29, 2016 9:25 pm
No new posts What is the command to check MODE of ... rohanthengal CLIST & REXX 6 Fri Nov 18, 2016 1:48 pm
This topic is locked: you cannot edit posts or make replies. MIPS reduction for Batch job Virendra Shambharkar All Other Mainframe Topics 8 Mon Nov 07, 2016 4:02 pm
This topic is locked: you cannot edit posts or make replies. Rexx to create GDG by scanning JJ result krish.deepu CLIST & REXX 5 Tue Oct 25, 2016 5:32 pm
No new posts Replace repeated JCL with looping REXX prino CLIST & REXX 3 Thu Oct 13, 2016 5:30 am


Facebook
Back to Top
 
Mainframe Wiki | Forum Rules | Bookmarks | Subscriptions | FAQ | Tutorials | Contact Us