Conversion Utilities › ACFLIDGN - Generating Logonids

ACFLIDGN - Generating Logonids

The ACFLIDGN utility is a conversion aid that generates a logonid record for each user in the VM directory. New installations should use this procedure since users without logonid records cannot log onto a system with CA ACF2 for z/VM installed.

Prerequisites

• You must predefine the CA ACF2 for z/VM databases.
• You must access the ACFFDR TEXT file in read only mode.
• Input to ACFLIDGN consists of the VM directory, CA ACF2 for z/VM Logonid database, and a user‑selected model logonid.
  • Access the minidisk containing the CA ACF2 for z/VM Logonid database as read and write
  • Access the minidisk containing the VM directory read only
  • Determine the name of the model logonid you want to use

Running ACFLIDGN

Be sure you defined the filename for the Logonid database in the @DDSN macro of the ACFFDR.

Execute ACFLIDGN before you IPL the CA ACF2 for z/VM CP nucleus; that is, the CA ACF2 for z/VM databases must be ready before you IPL with CA ACF2 for z/VM active. ACFLIDGN scans the VM directory for user statements that define the individual users (virtual machines). ACFDCVT then merges the user ID and an encrypted form of the password into a copy of the model (prototype) record to generate a LIDREC. It issues messages for each user ID processed.

You cannot run ACFLIDGN while CA ACF2 for z/VM is active and using the database. To execute this utility

1. If necessary, IPL the system with CA ACF2 for z/VM not active (NOAUTO).
2. Enter the following command:

   ACFLIDGN
   

   ACFLIDGN displays a series of questions while it is executing. Answer each question appropriately.

3. Set the AUTOALL bit for AUTOLOG1 and the DIALBYP bit for VTAM and VTERM. If you need detailed information about setting these logonid bits, see the Administrator Guide.
4. IPL the system normally.

One of the questions you must answer is:

Should user IDs already present in the Logonid database be replaced?
The model logonid is also replaced if present in the directory
allowing for convenient password update.  Reply 'no' or 'yes'.
No is the default.

This option facilitates EXEC reruns after you make a large number of directory additions.

After directory processing completes, ACFLIDGN prompts you to supply additional logonids and passwords for the LIDRECs to generate. You can specify the model. This feature creates limited numbers of security administrators, auditors, and account managers after processing the bulk of general users.

The prompt for additional logonids is:

Specify the logonid name that is to be used as a model.  The default is
genuser, which is supplied as a non-CA ACF2 for z/VM authorized ID.

ACFLIDGN does not generate a CA ACF2 for z/VM logonid for user IDs that have a password of NOLOG.

Check the logonids you just created to personalize each one. Some users might need special privileges or limited access. You need to address each logonid on a case‑by‑case basis to be sure the user has the necessary authorization to perform his job.

Messages

ACFDCVT issues the following messages to track all Logonid database processing performed during the VM directory conversion. The prompts that ACFLIDGN issues are not described since they are self‑explanatory.

ACFpgm886E <lid> LIDREC created

ACFLIDGN created a new logonid record for the indicated user.

ACFpgm887E <lid> LIDREC replaced

ACFLIDGN replaced a previous logonid record for the indicated user.

ACFpgm888E <lid> LIDREC already exists ‑ bypassed

The logonid record created for this user duplicates a previous logonid record. ACFLIDGN ignored the logonid record. Execution continues.

ACFpgm88AE <lid> error encrypting password ‑ bypassed

ACFLIDGN could not encrypt the password contained in the directory for this user. It did not create a logonid. Execution continues.

ACFpgm88BE <lid> I/O error processing LIDREC, RC=<rc>

An I/O processing error occurred during an attempt to write the LIDREC for the indicated user. One possible cause is a full minidisk. Execution continues.

ACFpgm889E <lid> model logonid not found

ACFLIDGN could not find the model logonid in the Logonid database. Execution stops.

For additional information about these and other messages, see the Message Guide.