Addressing Security Requirements › Configure CA LDAP Server Resource Authorizations for CA Compliance Manager Policies and Reports

Configure CA LDAP Server Resource Authorizations for CA Compliance Manager Policies and Reports

When a user tries to access information through the Compliance Policy Administration interface, a resource authorization check occurs against the logged in user ID. The RACROUTE AUTH call submitted from the interface uses one of two entities. Additionally, the interface uses one of two possible access levels depending on the type of data the user is trying to access.

Because all CA Compliance Manager interface requests are processed through the CA LDAP Server, the following parts of the resource authorization check parameters are configurable:

• The high-level qualifier that is used when the entity is constructed
• The resource class

Follow these steps:

1. Customize control access by modifying the values in the CA LDAP Server slapd.conf file using the following parameters:

   Important!: Skip this step if you accept the default values for these parameters.

   CMGRPolicyEntity

   Indicates the high-level qualifier to use when constructing the entity name.

   Default: CMGR

   CMGRPolicyClass

   Indicates the resource class that RACROUTE AUTH call uses.

   Default: CACMGR

   The full entity name is a concatenated value consisting of the high-level qualifier value specified in the CMGRPolicyEntity parameter and REPORTS or POLICY. The latter depends on the area of the CA Compliance Manager interface the user is accessing. The following table includes examples:

For detailed control access and option information, see the CA LDAP Server for z/OS Product Guide.

1. Modify the following CA Compliance Manager jobs in CAI.CEIQJCL0 to match the CMGRPolicyEntity and CMGRPolicyClass values in defining these resource authorizations for CA Compliance Manager:
   • CA ACF2 - CMGRIACF
   • CA Top Secret - CMGRITSS
   • IBM RACF CMGRIRAC

   Important! Skip this step if you accept the default values for the CMGRPolicyEntity and CMGRPolicyClass parameters in the previous step.

   The high-level qualifier value that is used for the entity is the value specified in the slapd.conf file CMGRPolicyEntity parameter.