IBM Mainframe Forum Index
 
Log In
 
IBM Mainframe Forum Index Mainframe: Search IBM Mainframe Forum: FAQ Register
 

Possible to EXEC REXX as another user without batch job?


IBM Mainframe Forums -> CLIST & REXX
Post new topic   Reply to topic
View previous topic :: View next topic  
Author Message
Chris Amidon

New User


Joined: 21 Apr 2015
Posts: 5
Location: United States

PostPosted: Tue May 05, 2015 9:07 pm
Reply with quote

Hi, I have a feeling I already know the answer to this question, as I've done some pretty intense Googling on this, but I'm hoping one of you guys are smarter than I am or at least have better Google-fu than I, and have done this before.

I have a need (desire?) to EXEC a REXX from within another REXX as another user. Ideally, I can do this without having to submit a batch job (this is how I'm doing it now, but it is a bit messy for my taste). I'd love to be able to execute a compiled REXX as another user and get back a result without having to do it through a batch job.

I'm currently accomplishing this task by building commands that I'm feeding in to a dataset which is then being used in the SYSIN dataset for a job that I'm submitting with a USER= and PASSWORD= statement on the jobcard. If I could just execute a REXX function as another user, that would be a bit easier to work with.
Back to top
View user's profile Send private message
Mickeydusaor

Active User


Joined: 24 May 2006
Posts: 258
Location: Salem, Oregon

PostPosted: Tue May 05, 2015 9:39 pm
Reply with quote

Why not build all the required DD and DSN in the Your REXX and the just invoke the program from your REXX instead of build and submitting a batch
job. you then can plug anything you want into the job card, the userid and so on before invoking the program.
Back to top
View user's profile Send private message
Chris Amidon

New User


Joined: 21 Apr 2015
Posts: 5
Location: United States

PostPosted: Tue May 05, 2015 11:41 pm
Reply with quote

I guess that is very valuable information! I have another process running that resets the password periodically and stores it in an encrypted file. When I build my JCL, I'm actually running another process to fetch the encrypted password and plugging it into the JCL.

I know someone could get the password if they were smart enough to run the REXX through a debugger, but we are calling it "good enough" for this particular process as long as we have another process that automatically resets the password every so often (think like 5 minutes).
Back to top
View user's profile Send private message
enrico-sorichetti

Senior Moderator


Joined: 14 Mar 2007
Posts: 10714
Location: italy

PostPosted: Wed May 06, 2015 12:21 am
Reply with quote

why not use the surrogate id ???
i.e the authority to submit a job on behalf of another user.
Back to top
View user's profile Send private message
Chris Amidon

New User


Joined: 21 Apr 2015
Posts: 5
Location: United States

PostPosted: Wed May 06, 2015 12:35 am
Reply with quote

Granting surrogate authority would give these users more access than I actually want them to have. I'm hiding the process to build the jobcard in a compiled REXX and then using RACF to protect execution of the exec.

I realize this is suboptimal, and I seriously wouldn't do it if there were a better way.
Back to top
View user's profile Send private message
Pedro

Global Moderator


Joined: 01 Sep 2006
Posts: 2214
Location: Silicon Valley

PostPosted: Wed May 06, 2015 2:15 am
Reply with quote

Quote:
If I could just execute a REXX function as another user

It is not clear what you cannot do from your own userid that the other userid will be able to do. You should be able to grant the same permissions as the other user so that either user can invoke the rexx program.

Your process is not entirely clear to me... perhaps what you want is for the program to be the one that is authorized, rather than granting permission to numerous users. You would want a compiled program rather than a rexx program.
Back to top
View user's profile Send private message
Chris Amidon

New User


Joined: 21 Apr 2015
Posts: 5
Location: United States

PostPosted: Wed May 06, 2015 2:22 am
Reply with quote

Well, the program is going to be removing a users access to a specific RACF profile. I need the helpdesk to be able to execute this function. I don't know of a way to allow this user to perform this action without granting helpdesk users RACF SPECIAL authority. The catch is that I don't want to do anything that would de-facto make these users RACF SPECIAL like granting surrogate authority would. I ONLY want them to be able to remove a users authority to this one specific profile.

Perhaps what you are saying is what I actually need. Presumably I could compile a REXX program and give it access to remove access to the profile in question.
Back to top
View user's profile Send private message
Pedro

Global Moderator


Joined: 01 Sep 2006
Posts: 2214
Location: Silicon Valley

PostPosted: Wed May 06, 2015 6:33 am
Reply with quote

Consider granting the help desk personnel CONTROL authority to only that data set profile:
Code:
ADDGROUP HELPDESK
CONNECT HELP01 GROUP(HELPDESK) AUTHORITY(USE)
CONNECT HELP02 GROUP(HELPDESK) AUTHORITY(USE)

PERMIT my.restrict.dsn ID(HELPDESK) ACCESS(CONTROL)

I think the help desk personnel will be able to issue PERMIT commands for your data set. They will be able to grant or delete authority.

Another approach is to use the ICHCCX00 command exit. Your exit can determine the userid and the parameters specified on the command, then it can allow the command to proceed or not. This is not for the faint of heart.
Back to top
View user's profile Send private message
View previous topic :: :: View next topic  
Post new topic   Reply to topic View Bookmarks
All times are GMT + 6 Hours
Forum Index -> CLIST & REXX

 


Similar Topics
Topic Forum Replies
No new posts Revoke on DB2 to remove an user DB2 4
This topic is locked: you cannot edit posts or make replies. Is there a way to restrict user login... All Other Mainframe Topics 11
No new posts Any examples of calling FTP from REXX? CLIST & REXX 1
No new posts SummeRx: a new framework for REXX z/OS CLIST & REXX 6
No new posts File-aid batch how to repeat a line... Compuware & Other Tools 2
Search our Forums:

Back to Top