CA-L-Serv Configuration Tasks › Update External Security for CA-L-Serv › How the Update Tasks are accomplished › Implement Security with CA Top Secret

Implement Security with CA Top Secret

The following sample definitions are for users running under CA Top Secret. The actual implementation in your environment may differ from these templates.

To implement security with CA Top Secret

1. Define the new resource class to the CA Top Secret Resource Descriptor Table (RDT). For example:

   TSS ADD(RDT) RESCLASS($LSRVDSN) RESCODE(02) ATTR(LONG,DEFPROT)
                ACLST(CONTROL) DEFACC(CONTROL)
   

   Note: For more information about the command syntax and features, see the CA Top Secret Reference Guide.

2. Protect your data sets using the $LSRVDSN resource class.

   One approach is to issue commands to define the data sets that are under the control of CA‑L‑Serv:

   TSS ADDTO(owner_acid) $LSRVDSN(prefix1)
   TSS ADDTO(owner_acid) $LSRVDSN(prefix2)
   

   An alternative approach is to define a pseudo data set named 'ALL' that stands for all the data sets under CA‑L‑Serv control:

   TSS ADDTO(owner_acid) $LSRVDSN(all)
   

3. Permit the users access to the CA‑L‑Serv data sets.

   Once the resources are protected, issue PERMIT commands to permit users access to these data sets using the $LSRVDSN resource class:

   TSS PERMIT(user_acid1) $LSRVDSN(dsname1) ACCESS(CONTROL)
   TSS PERMIT(user_acid1) $LSRVDSN(dsname2) ACCESS(CONTROL)
   TSS PERMIT(user_acid2) $LSRVDSN(dsname1) ACCESS(CONTROL)
   

   This can also be achieved using a generic prefix:

   TSS PERMIT(user_acid)  $LSRVDSN(prefix.) ACCESS(CONTROL)
   

   Optionally, users may be permitted access to the 'ALL' resource:

   TSS PERMIT(user_acid1) $LSRVDSN(all) ACCESS(CONTROL)
   TSS PERMIT(user_acid2) $LSRVDSN(all) ACCESS(CONTROL)
   

4. Define CA‑L‑Serv to CA Top Secret.

   A user ID must be created for CA‑L‑Serv so it has access to its data sets. To do this, specify:

   TSS CREATE(lserv_acid) TY(USER) DEPT(deptname) FAC(STC) ‑
       NAME('name') PASS(NOPW,0) NOSUBCHK
   

5. Permit CA‑L‑Serv access to data sets.

   CA‑L‑Serv must be given authority to access its data sets using the PERMIT command:

   TSS PERMIT(lserv_acid) DSN(dsname1) ACCESS(CONTROL)
   TSS PERMIT(lserv_acid) DSN(dsname2) ACCESS(CONTROL)
   

   This permission can also be achieved using a generic prefix:

   TSS PERMIT(lserv_acid) DSN(prefix.) ACCESS(CONTROL)