Previous Topic: Delegating Change AuthorityNext Topic: Using NEXTKEYs With $ROLESET Rules


NEXTKEY and $PREFIX

When you use NEXTKEY in resource rules with extended resource keys, the $PREFIX control statement in the target resource rule specifies the portion of the resource name matched during NEXTKEY processing; the remainder is matched against the extended keys on the resource rule lines.

Resource name: TEST.TESTNAME2.TESTNAME3

Resource rule:

$KEY(TEST) TYPE(TBL) SYSID(PROD)              first validation
TESTNAME2.‑ UID(‑) PREVENT NEXTKEY(TESTNAME2) SERVICE(SELECT)
 ...

$KEY(TESTNAME2) TYPE(TBL) SYSID(PROD)           NEXTKEY validation
$PREFIX(TEST.TESTNAME2)                         matched two levels
TESTNAME3   UID(‑) SERVICE(SELECT) ALLOW        third level validation

When you use NEXTKEY to select another resource rule for validation, and you do not specify a $PREFIX control statement in the alternative resource rule, CA ACF2 processes the alternative rule as if it had been selected using a full resource key match with no portion of the resource name remaining to be matched against any rule line extended keys.

Resource name: TEST.TESTNAME2

Resource rule:

$KEY(TEST) TYPE(TBL) SYSID(PROD)                 first validation
TESTNAME2 UID(‑) PREVENT NEXTKEY(TESTNAME3) SERVICE(SELECT)

$KEY(TESTNAME3) TYPE(TBL) SYSID(PROD)            NEXTKEY validation
UID(‑) SERVICE(SELECT) ALLOW                     no extended key