RACF ADMINISTRATIVE AUTHORITIES
KOIRUG - October 2005
Robert S. Hansel
RACF Specialist - RSH Consulting, Inc.
[Link]@[Link] - 617-969-9050 - [Link]
RSH CONSULTING
RACF ADMIN AUTHORITIES
ADMINISTRATION
Administrative Capabilities
System and Group Attributes
Profile Ownership
Group Connect Authorities
Class Authorization
FACILITY Class IRR Profiles
FIELD Class Profiles
Access Enabled Authority
Miscellaneous Authorities
Implementation Suggestions
RSH CONSULTING
RACF ADMIN AUTHORITIES
ADMINISTRATIVE CAPABILITIES
SETROPTS
USER
GROUP
DATASET
GENRES
OTHER
LIST
LISTUSER
LISTGRP
LISTDSD
RLIST
DSMON
Set Options
ADDUSER
ADDGROUP
ADDSD
RDEFINE
IRRUT100
GLOBAL
REFRESH
ALTUSER
ALTGROUP
ALTDSD
RALTER
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
RACLIST
REFRESH
PASSWORD
CONNECT
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS
GENRES
ACCESS
TEMPDSN
ACCESS
Highlights:
- Green - yes
- Yellow - yes but with footnote caveats listed beneath each chart
RSH CONSULTING
RACF ADMIN AUTHORITIES
SYSTEM AND GROUP ATTRIBUTES
AUDITOR
View RACF profiles & set audit options
SPECIAL
Administer RACF profiles & set control options
OPERATIONS
Access resources & define group dataset profiles
RSH CONSULTING
RACF ADMIN AUTHORITIES
SYSTEM AND GROUP ATTRIBUTES
SYSTEM / USER-Attribute
ALU userid attribute
USER=JSMITH1
NAME=JOHN SMITH
DEFAULT-GROUP=USRGRPA
OWNER=SECGRP1
PASSDATE=00.351
CREATED=01.067
PASS-INTERVAL= 30
ATTRIBUTES=OPERATIONS
Authority applies across entire RACF system
GROUP / CONNECT-Attribute
CO userid GROUP(groupid) attribute
GROUP=DASDMGT
CONNECTS=
AUTH=USE
00
CONNECT-OWNER=RJONES2
UACC=NONE
CONNECT-DATE=92.181
LAST-CONNECT=UNKNOWN
CONNECT ATTRIBUTES=SPECIAL
Authority limited by Scope-of-Groups
RSH CONSULTING
RACF ADMIN AUTHORITIES
SCOPE-OF-GROUPS
Determines scope of authority for:
y Group-AUDITOR
y Group-SPECIAL
y Group-OPERATIONS
Based on Profile Ownership, not Group Structure
Cache group tree in Virtual Lookaside Facility (VLF) to avoid
repetitive retrieval of group profiles to determine scope-ofgroups tree structure for Group-level authorities
y Implement only if group authority is used extensively
y [Link](COFVLFxx) entry
CLASS NAME(IRRGTS)
EMAJ(GTS)
RSH CONSULTING
RACF ADMIN AUTHORITIES
SCOPE-OF-GROUPS
Included:
Excluded:
y User and Group Profiles owned by
Users within the Scope-of-Groups
y Profiles owned by the Group
y Profiles owned by Subgroups
owned by the Group
y Profiles owned by Subgroups
owned by Subgroups (etc.) owned
by the Group
y Resource Profiles owned by Users
owned by the Group or its
Subgroups
y Profiles owned by either Users or
Groups owned by Users within the
Scope-of-Groups (dataset
exception)
y Profiles owned by either Users or
Groups outside the Scope-ofGroups (dataset exception)
y Dataset Profiles with HLQ is same
as a User or Group owned by the
Group or its Subgroups
RSH CONSULTING
RACF ADMIN AUTHORITIES
SCOPE-OF-GROUPS
#GRP0
#GRP1
#GRP2
#GRP3
#GRP4
#GRP5
#GRP6
@dataset
$USERA
#GRP7
#GRP8
$USERB
$USERC
@dataset
$USERD
@genres
#GRP9
$USERE
@genres
@dataset
@genres
@dataset
#GRP2
RSH CONSULTING
@dataset
$USERA
RACF ADMIN AUTHORITIES
AUDITOR - System
SETROPTS
LIST
USER
LISTUSER
Set Options(1) ADDUSER
GROUP
DATASET
GENRES
OTHER
LISTGRP
LISTDSD
RLIST
DSMON
ADDGROUP
ADDSD
RDEFINE
IRRUT100
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
GLOBAL
REFRESH
ALTUSER(2)
ALTGROUP
ALTDSD(3)
RALTER(3)
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RACLIST
REFRESH
PASSWORD
CONNECT
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS
GENRES
ACCESS
TEMPDSN
ACCESS
(1) Audit Options only:
SAUDIT
OPERAUDIT
CMDVIOL
AUDIT
LOGOPTIONS SECLEVELAUDIT SECLABELAUDIT APPLAUDIT
(2) UAUDIT only
(3) GLOBALAUDIT only
RSH CONSULTING
RACF ADMIN AUTHORITIES
AUDITOR - Group
SETROPTS
USER
GROUP
DATASET
GENRES
OTHER
LIST
LISTUSER(1)
LISTGRP(1)
LISTDSD(1)
RLIST(1)
DSMON
Set Options
ADDUSER
ADDGROUP
ADDSD
RDEFINE
IRRUT100
GLOBAL
REFRESH
ALTUSER(2)
ALTGROUP
ALTDSD(3)
RALTER(3)
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
RACLIST
REFRESH
PASSWORD
CONNECT
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS
GENRES
ACCESS
TEMPDSN
ACCESS
(1) Excluding profile segments
(2) UAUDIT only
(3) GLOBALAUDIT only
RSH CONSULTING
10
RACF ADMIN AUTHORITIES
SPECIAL - System
SETROPTS
LIST(1)
USER
LISTUSER
Set Options(1) ADDUSER
GROUP
DATASET
GENRES
OTHER
LISTGRP
LISTDSD
RLIST
DSMON
ADDGROUP
ADDSD
RDEFINE
IRRUT100
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
GLOBAL
REFRESH
ALTUSER(2)
ALTGROUP
ALTDSD(3)
RALTER(3)
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RACLIST
REFRESH
PASSWORD
CONNECT
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS
GENRES
ACCESS
TEMPDSN
ACCESS
(1) Excluding Audit Options
(2) Excluding UAUDIT
(3) Excluding GLOBALAUDIT
RSH CONSULTING
11
RACF ADMIN AUTHORITIES
SPECIAL - Group
SETROPTS
USER
GROUP
DATASET
LIST(1)
LISTUSER(2)
LISTGRP(2)
LISTDSD(2,3)
Set Options
ADDUSER(2,4,
ADDGROUP(2 ADDSD(12)
GENRES
OTHER
RLIST(2,3)
DSMON
RDEFINE(9,12)
IRRUT100
RALTER(3,10)
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
5,6)
GLOBAL
REFRESH
ALTUSER(2,5,6, ALTGROUP(8) ALTDSD(3)
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RACLIST
REFRESH
PASSWORD
CONNECT(6)
PERMIT(12)
PERMIT(12)
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS
GENRES
ACCESS
TEMPDSN
ACCESS
7,11)
(1) Excluding Audit Options
(5) Excludes System-level attributes
(9) Create profiles from group profile members
(2) Excluding Profile Segments
(6) Only assign held attributes
(10) ADDMEM resources from member profiles
(3) Excluding GLOBALAUDIT
(7) Excluding UAUDIT
(11) Excludes NOEXPIRE on password change
(4) Require CLAUTH(USER)
(8) To change SUPGROUP, requires admin authority new group
(12) If specify FROM, must have admin authority to FROM profile
RSH CONSULTING
12
RACF ADMIN AUTHORITIES
OPERATIONS - System
SETROPTS
USER
GROUP
DATASET
GENRES
OTHER
LIST
LISTUSER
LISTGRP
LISTDSD(1)
RLIST(1)
DSMON
Set Options
ADDUSER
ADDGROUP
ADDSD(2)
RDEFINE
IRRUT100
GLOBAL
REFRESH
ALTUSER
ALTGROUP
ALTDSD
RALTER
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
RACLIST
REFRESH
PASSWORD
CONNECT
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS(3,4)
GENRES
ACCESS(3,5)
TEMPDSN
ACCESS
(1) Excluding segments & GLOBALAUDIT
(2) Group datasets only
(3) If permitted accesses, access capped at the permitted level
(4) Create Group datasets unless connected to the Group with USE authority
(5) Classes defined with OPER=YES
RSH CONSULTING
13
RACF ADMIN AUTHORITIES
OPERATIONS - Group
SETROPTS
USER
GROUP
DATASET
GENRES
OTHER
LIST
LISTUSER
LISTGRP
LISTDSD(1)
RLIST(1)
DSMON
Set Options
ADDUSER
ADDGROUP
ADDSD(2)
RDEFINE
IRRUT100
GLOBAL
REFRESH
ALTUSER
ALTGROUP
ALTDSD
RALTER
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
RACLIST
REFRESH
PASSWORD
CONNECT
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS(3,4)
GENRES
ACCESS(3,5)
TEMPDSN
ACCESS
(1) Excluding segments & GLOBALAUDIT
(2) Group datasets only
(3) If permitted accesses, access capped at the permitted level
(4) Create Group datasets unless connected to the Group with USE authority
(5) Classes defined with OPER=YES
RSH CONSULTING
14
RACF ADMIN AUTHORITIES
GROUP AUTHORITY EXAMPLE
SYS1
$$dept
$$dept
$$dept
Group
AUDITOR
@deptusr
Group
SPECIAL
RSH CONSULTING
#deptrole
$deptres
dsn-hlq
$$deptmisc
CONNECT
15
RACF ADMIN AUTHORITIES
PROFILE OWNERSHIP
Authority depends on type of profile owned
y User
y Group
y Dataset
y General Resource
When owned by a Group, Group-level authority rules
When owned by a User, the User can administer the profile
The Profile Creator is made the Owner by default
Authority not extended by Scope-of-Groups
RSH CONSULTING
16
RACF ADMIN AUTHORITIES
PROFILE OWNER - User Profile
SETROPTS
USER
GROUP
DATASET
GENRES
OTHER
LIST
LISTUSER(1)
LISTGRP
LISTDSD
RLIST
DSMON
Set Options
ADDUSER
ADDGROUP
ADDSD
RDEFINE
IRRUT100(2)
GLOBAL
REFRESH
ALTUSER(1)
ALTGROUP
ALTDSD
RALTER
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
RACLIST
REFRESH
PASSWORD
CONNECT
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS
GENRES
ACCESS
TEMPDSN
ACCESS
(1) Excluding segments, UAUDIT, & system-level attributes
(2) Only for User Profile owned
RSH CONSULTING
17
RACF ADMIN AUTHORITIES
PROFILE OWNER - Group Profile
SETROPTS
USER
GROUP
LIST
LISTUSER
LISTGRP(1)
Set Options
ADDUSER(2,3)
GLOBAL
REFRESH
DATASET
LISTDSD
GENRES
OTHER
RLIST
DSMON
ADDGROUP(1 ADDSD
RDEFINE
IRRUT100
ALTUSER
ALTGROUP(1) ALTDSD
RALTER
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
RACLIST
REFRESH
PASSWORD
CONNECT(4)
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS
GENRES
ACCESS
TEMPDSN
ACCESS
(1) Excluding segments
(2) Requires CLAUTH(USER)
(3) Excluding segments, UAUDIT, & system-level attributes
(4) Only assign held attributes
RSH CONSULTING
18
RACF ADMIN AUTHORITIES
PROFILE OWNER - Dataset Profile
SETROPTS
USER
GROUP
DATASET
GENRES
OTHER
LIST
LISTUSER
LISTGRP
LISTDSD(1)
RLIST
DSMON
Set Options
ADDUSER
ADDGROUP
ADDSD
RDEFINE
IRRUT100
GLOBAL
REFRESH
ALTUSER
ALTGROUP
ALTDSD(1)
RALTER
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
RACLIST
REFRESH
PASSWORD
CONNECT
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS
GENRES
ACCESS
TEMPDSN
ACCESS
(1) Excluding segments & GLOBALAUDIT
RSH CONSULTING
19
RACF ADMIN AUTHORITIES
PROFILE OWNER - Gen. Resource Profile
SETROPTS
USER
GROUP
DATASET
GENRES
OTHER
LIST
LISTUSER
LISTGRP
LISTDSD
RLIST(1)
DSMON
Set Options
ADDUSER
ADDGROUP
ADDSD
RDEFINE
IRRUT100
GLOBAL
REFRESH
ALTUSER
ALTGROUP
ALTDSD
RALTER(1,2)
GENERIC
REFRESH
DELUSER
DELGROUP
DELDSD
RDELETE
RALTER
GLOBAL
ADDMEM
CATDSNS
ACCESS
RACLIST
REFRESH
PASSWORD
CONNECT
PERMIT
PERMIT
PROTECTALL ACCESS
REMOVE
DATASET
ACCESS
GENRES
ACCESS
TEMPDSN
ACCESS
(1) Excluding segments & GLOBALAUDIT
(2) ADDMEM resources owner has admin authority over
RSH CONSULTING
20
RACF ADMIN AUTHORITIES
GROUP AUTHORITIES
USE
Use access granted to Group
CREATE
Create Group dataset profiles
Create Group datasets
CONNECT
Connect & Remove users for Group
Assign users up to same authority
JOIN
Create users (with CLAUTH(USER))
Assign users up to same authority
Create Subgroups
Delete Subgroups
Authorities are cumulative
Scope-of-Groups does not extend authority
RSH CONSULTING
21
RACF ADMIN AUTHORITIES
CLASS AUTHORIZATION
Class Authorization - CLAUTH
y Allows creation of profiles and protection of undefined resources
without System-SPECIAL
y User profile attribute - ALU userid CLAUTH(class)
y Can be used for all classes except GROUP and DATASET
User Profiles - CLAUTH(USER)
y Requires Group-SPECIAL, JOIN authority, or group owner
General Resource Profiles - CLAUTH(class)
y SETROPTS
Refresh GENERIC, GLOBAL, RACLIST for CLAUTH class
Refresh WHEN(PROGRAM) with PROGRAM class
y ADDMEM undefined resources to grouped profiles or Global
Access Table
RSH CONSULTING
22
RACF ADMIN AUTHORITIES
CLASS AUTHORIZATION
GENERICOWNER SETROPTS Option
y Owner of General Resource generic profile retains control over
profile protected resources
y Restricts ability of other users with CLAUTH to create undercutting
profiles (e.g., cannot create AB* undercutting A*)
y Only owner and users who also have Group-SPECIAL where profile
is within Scope-of-Groups can create undercutting profiles
y Does not apply to PROGRAM class
CLAUTH authority extends to all resources classes with the
same POSIT value even though they may not appear in the
LISTUSER display
Once a profile has been created, creators ability to administer
the profile is determined by normal administrative authorities
RSH CONSULTING
23
RACF ADMIN AUTHORITIES
FACILITY CLASS IRR PROFILES
User password reset authorization
y Intended for Help Desk functions
y Reset any USERIDs password, except those with System-level
SPECIAL, OPERATIONS, or AUDITOR, or PROTECTED IDs
y General Resource
Class & Profile - FACILITY [Link]
Access Levels
READ
- Resume user, reset password to expired value
UPDATE
- Resume user, reset password to non-expired value
CONTROL - Change password prior to MINCHANGE interval (z1.7)
y Tip - to block reset, either:
Revoke user's default group connect (retains password)
Make PROTECTED (erases password)
RSH CONSULTING
24
RACF ADMIN AUTHORITIES
FACILITY CLASS IRR PROFILES
User profile list authorization
y List any user profile, except those with System-level authorities
y General Resource
Class & Profile - FACILITY [Link]
Access Level - READ - list any user profile
y Can only list base profile, not segments
RSH CONSULTING
25
RACF ADMIN AUTHORITIES
FIELD CLASS PROFILES
Delegate maintenance of profile segments (e.g., TSO, OMVS)
General Resource
y Class - FIELD
y Profile - [Link] (e.g., [Link] )
y Access Levels
READ
UPDATE
- examine
- change
Applies to all profiles, no Scope-of-Groups limitation
&RACUID can be used to permit users access to just their own
USER segment(s) - usually to allow viewing (READ)
RSH CONSULTING
26
RACF ADMIN AUTHORITIES
ACCESS ENABLED AUTHORITY
READ or Greater
y List basic RACF segment information
Does not include access list or GLOBALAUDIT settings
y Prohibited if user connected to any Group with access of NONE
ALTER in Discrete profile
y Change, delete, and list access list of profile
y Permit access
y If permitted to a member-class profile (e.g., TCICSTRN), can ADDMEM
the resource to any grouping-class profile (e.g., GCICSTRN)
y If permitted to a grouping-class profile (e.g., GCICSTRN), can create a
member-class resource profile for grouping-class members
USERID, Group, ID(*), and UACC granted access all apply
RSH CONSULTING
27
RACF ADMIN AUTHORITIES
UNIVERSAL USER AUTHORITY
Any User
y Change own User profile Name, Default Group, Model Dataset (if
active)
y Change own User profile Password, Password-interval
y Change own User profile TSO logon defaults (e.g. Logon Proc)
y List own User profile
y Execute Cross-Reference Utility on own USERID
y Create, change, delete own user dataset profiles
y Add own user datasets to GLOBAL Access Table
y Issue RVARY command
RSH CONSULTING
28
RACF ADMIN AUTHORITIES
GRPACC AUTHORITY
GRPACC - Group Access
y When a User creates a Group dataset profile, the Group itself is
automatically granted UPDATE access
User creates profile [Link]
Group PAY is automatically added to access list with UPDATE access
y System-level Attribute
Applies to all Group dataset profiles created by the user
Supercedes Group-GRPACC
y GROUP-level Attribute
To enable its use, user must specifically log on to the Group where the
user's group connect has this authority
Applies to any Group in the user's administrative scope, even those
outside of the normal GRPACC Scope-of-Groups
RSH CONSULTING
29
RACF ADMIN AUTHORITIES
MISCELLANEOUS AUTHORITY
Prevent automatic grant of ALTER access to creators USERID
during profile creation
y RACF SETROPTS option
y ADDCREATOR
- add to access list (default)
y NOADDCREATOR
- do not add to access list
UACC on Group Connect
y Default UACC assigned upon profile creation
y Depends on Connect Group at time of profile creation
y Used when Default UACC in Class Descriptor Table specifies ACEE
y Defaults to NONE
Automatic Dataset Protection (ADSP)
y Activated in SETROPTS & assigned to user profile or group
connect
y Automatically generates discrete profiles when creating datasets
RSH CONSULTING
30
RACF ADMIN AUTHORITIES
IMPLEMENTATION SUGGESTIONS
Ownership by Group only (except TSO users & their datasets)
Group Ownership follow Group Hierarchy
Avoid mixing Group Usage; Segregate Resource Owning
Groups from Access Granting Groups
Limit assignment of SPECIAL, OPERATIONS, and CLAUTH
Restrict OPERATIONS access with Exclusion Group
Limit use of Discrete Dataset Profiles
Limit use of Discrete General Resource Profiles with ALTER
access
Activate GENERICOWNER and NOADDCREATOR
Avoid ADSP, GRPACC, and Group UACC
Monitor all use of authorities - OPERAUDIT, SAUDIT, AUDIT(*)
RSH CONSULTING
31
RACF ADMIN AUTHORITIES