Protecting Special Resources › The GRPLOGON Privilege: Logging onto Group Machines › Important Group Logon Information

Important Group Logon Information

Important details apply to the system entry process for logging onto group virtual machines.

• You must assign a group virtual machine the GRPLOGON privilege.
• You cannot log onto a machine with the AUTOONLY privilege, regardless if that machine is a group machine. CA ACF2 for VM issues the following message when you try to log onto a machine with the AUTOONLY privilege:

  ACFpgm279E Logon not allowed ‑ Logonid has AUTOONLY attribute
  

  CA ACF2 for VM records all unsuccessful system access attempts in the Invalid Password/Authority Log (ACFRPTPW).

  The GRPLOGON field of the RESCLASS VMO record defines the typecode required for resource rule validation for group machines. The default specification is GRPLOGON=(GRP), implementing type code GRP.

• You can specify the resource rule type code in the RESTYPE VMO record to implement $KEY resource name masking for group logon resource rules. This type code must be the same value specified in the GRPLOGON field of the RESCLASS VMO record. You can use standard UID masking in individual rule entries.
• CA ACF2 for VM ignores the SERVICE and VERIFY keywords for group logon resource rules.
• Normal source and shift controls apply to the validation process for resource rule sets for group virtual machines.
• Password suppression is an IBM security feature implemented in the PSUPRS operand of the SYSJRL macro. It forces you to enter your password on a separate line from your logonid when you log on. CA ACF2 for VM does not display your password when you enter it. If you attempt to enter a password for a logonid with the group logon attribute, you receive error messages, but can proceed.

  LOGON MAINT MAINTPW
  ACFpgm278E Logon for groupid ‑ password entered will be ignored
  ACFpgm263R Enter your CA‑ACF2 logonid
  

• When you are logging onto a group machine as a group user, you do not need to be defined as a user ID in the VM directory. The only prerequisite for a group user is that the user is defined with a logonid record in the Logonid database. You must always define the group machine with a logonid record in the Logonid database and a user ID in the VM directory. This applies not only when you are logging on as a group user, but also when you are logging on as the group machine itself.