Using External Security for CA Datacom › Security Interfaces, RACF

Security Interfaces, RACF

Limited Documentation

The following information is not intended to replace nor supersede any information in the RACF documentation for the version being executed. Any samples are not intended to display all features of RACF.

The IBM RACF facility for a z/OS environment supports user-defined resources which can be used by CA Datacom. Changes are required to the CAISSF component of CA Common Services for z/OS. See the CA Common Services for z/OS Installation Guide.

Note: To help ensure proper CICS interface with the IBM RACF product, verify that the DFHSIT macro parameter EXTSEC is coded YES. We also recommend coding the IBM DFHSNT macro parameter EXTSEC=YES. For more information, see IBM documentation.

User resource names in RACF are required to have a special character in the name. The CA Datacom resource names are altered for RACF as follows. The pattern is that the third character in the resource name is replaced with an @ sign.

Add the resource name definitions (from the previous table) to the RACF Class Descriptor table (ICHERCDE) and to the RACF SAF Router Table (ICHRFRTB). See your RACF documentation for the syntax for these commands.

The RACF resource rights (arranged in hierarchical sequence) for the DTTABLE resource class equate to those for CA Datacom/DB as follows:

RACF authorizations are hierarchical, that is:

• READ authority allows only read access.
• UPDATE authority allows read and update access.
• CONTROL authority allows read, update, and delete access.
• ALTER authority allows read, update, delete, and add access.

Add the specific security rules to secure the CA Datacom resources as defined in the general documentation section earlier in this chapter.

For more information, see Enabling Online Signons.