Writing Resource Rules › LOGON-BY

LOGON-BY

In earlier releases of CA ACF2 for z/VM, you could access a user ID in two ways:

1. Enter the LOGON command and your password
2. Use the group logon facility.

With group logon, a logonid is designated as a group ID if the GRPLOGON attribute is present in a logonid record. A logonid record is designated as a mandatory group ID by the GRPLOGON attribute. Access to the ID requires a user to enter his own CA ACF2 for z/VM logonid and password and eliminates the need to share passwords. CA ACF2 for z/VM verifies the logonid and password against the group logon resource rules to determine if access is allowed. LOGON‑BY lets you log onto another VM user ID and lets you optionally share IDs when a group logon resource rule exists that allows access. LOGON‑BY:

• Allows authorized users access to user IDs without password sharing
• Improves logon sequence for group logon
• Allows user IDs to designate other users to access their IDs
• Identifies user IDs and accessing logonids in all CA ACF2 for z/VM reports.

Optional group IDs allow users to share user IDs. A logonid record is designated as an optional group ID when the GRP‑OPT attribute is present in the logonid record. GRP‑OPT designates an ID as an optional group ID. A logonid with this attribute can be logged onto as the primary ID, or a group ID. To access a virtual machine with this attribute as a group ID, this privilege must be present and a group logon resource rule must exist. If GRP‑OPT and the GRPLOGON field are both present, then GRPLOGON takes precedence. To access an optional group ID, the group user enters the LOGON‑BY syntax. When you use LOGON‑BY to access another user ID, that ID becomes a group ID for the duration of the session.