IMPORT RACF

CONFIG

Output CFG file path

Mandatory

USERS_DB

Output UDB file path

Mandatory

RES_DB

Output UDB file path

Mandatory

INPUT

Input RACF file path

Mandatory

SUPP_HR

Input Supplementary HR file path

Optional

RACF_SYS_NAME

RACF system name

Optional

UACC

'UACC' flag

Optional

GROUPS_AS_

ROLES

'Import all groups as roles' flag

Optional

ADD_ACL_

ENTITIES

'Add ACL entities' flag

Optional

IGNORE_

REVOKED_USERS

'Ignore revoked users' flag

Optional

IMPORT TSS

CONFIG

Output CFG file path

Mandatory

USERS_DB

Output UDB file path

Mandatory

RES_DB

Output UDB file path

Mandatory

TSSLISTFILE

Input TSS LIST file path

Mandatory

SUPP_HR

Input Supplementary HR file path

Optional

TSS_SYS_NAME

TSS system name

Optional

ADD_ACL_

ENTITIES

'Add ACL entities' flag

Optional

GROUPS_AS_

ROLES

'Import all groups as roles' flag

Optional

IMPORT CSV

CONFIG

Output CFG file path

Mandatory

USERS_DB

Output UDB file path

Mandatory

RES_DB

Output UDB file path

Mandatory

ROLE

Input Roles CSV file path

Optional

USER_RES

Input User-Resource links CSV file path

Optional

USER_ROLE

Input User-Role links CSV file path

Optional

ROLE_RES

Input Role-Resource links CSV file path

Optional

ROLE_ROLE

Input Role-Role links CSV file path

Optional

USER_RES_ATTR

Input User-Resource link attributes CSV file path

Optional

USER_ROLE_ATTR

Input User-Role link attributes CSV file path

Optional

ROLE_RES_ATTR

Input Role-Resource link attributes CSV file path

Optional

ROLE_ROLE_ATTR

Input Role-Role link attributes CSV file path

Optional

SEPARATOR

CSV separator character

Optional

ROLEID_AS_NUM

'Role ID as number' flag: Used for backward compatibility; Obsolete

Optional

INPUT_UNICODE

Treats all input files as unicode. If a file does not have a unicode signature in the beginning (BOM: 0xFEFF), it is added to the file, and the original file is saved with a .backup extension.

Optional

False

EXPORT CSV

CONFIG

Input CFG file path

Mandatory

ROLE

Output Roles CSV file path

Mandatory

USER_RES

Output User-Resource links CSV file path

Mandatory

USER_ROLE

Output User-Role links CSV file path

Mandatory

ROLE_RES

Output Role-Resource links CSV file path

Mandatory

ROLE_ROLE

Output Role-Role links CSV file path

Mandatory

USER_RES_ATTR

Output User-Resource link attributes CSV file path

Optional

USER_ROLE_ATTR

Output User-Role link attributes CSV file path

Optional

ROLE_RES_ATTR

Output Role-Resource link attributes CSV input file path

Optional

ROLE_ROLE_ATTR

Output Role-Role link attributes CSV file path

Optional

SEPARATOR

CSV separator character

Optional

ROLEID_AS_NUM

'Role ID as number' flag: Used for backward compatibility; Obsolete

Optional

UNICODE_OUTPUT

'Unicode output' flag

Optional

MERGE CFG

FIRST_CFG

Input CFG file path

Optional

SECOND_CFG

Input CFG file path

Optional

TARGET_CFG

Output CFG file path

Mandatory

TARGET_UDB

Output UDB file path

Mandatory

TARGET_RDB

Output RDB file path

Mandatory

CASE_SENSITIVE

'Case sensitive' flag

Optional

<SOURCE>

(CFG path)

</SOURCE>

Zero or more child tags. The tag's internal text contains an additional configuration path to merge.

If FIRST_CFG and SECOND_CFG are absent at least 2 <SOURCE> tags should be present.

Optional

MERGE UDB

FIRST_UDB

Input UDB file path

Mandatory

SECOND_UDB

Input UDB file path

Mandatory

TARGET_UDB

Output UDB file path

Mandatory

CASE_SENSITIVE

'Case sensitive' flag

Optional

MERGE RDB

FIRST_RDB

Input RDB file path

Mandatory

SECOND_RDB

Input RDB file path

Mandatory

TARGET_RDB

Output RDB file path

Mandatory

MERGE AUDIT

TARGET_AUD

Output Audit card file path

Mandatory

MASTER_AUD

Input Primary Audit card file path

Mandatory

ADDED_AUD

Input Secondary Audit card file path

Mandatory

TRIM CFGDB

INPUT_CFG

Input CFG file path

Mandatory

TARGET_CFG

Output CFG file path

Mandatory

TARGET_UDB

Output UDB file path

Mandatory

TARGET_RDB

Output RDB file path

Mandatory

FILTER CFG

SOURCE_CFG

Input CFG file path

Mandatory

TARGET_CFG

Output CFG file path

Mandatory

REMOVE_ONLY

'Remove Only' flag

Optional

<CONDITION>

1 or more child tags.

ENTITY

USER | ROLE | RESOURCE

Mandatory

FIELD

If 'ENTITY' is USER:

PERSON ID

USER NAME

ORGANIZATION

ORGANIZATION TYPE

(field name)

If 'ENTITY' is ROLE:

ROLE NAME

DESCRIPTION

ORGANIZATION

OWNER

TYPE

CREATE DATE

REVIEWER

APPROVAL STATUS

APPROVAL DATE

FILTER

ORGANIZATION 2 ORGANIZATION 3

If 'ENTITY' is RESOURCE:

RES NAME 1/2/3

(field name)

For all relevant entity types:

DIRECT RESOURCES

TOTAL RESOURCES

DIRECT USERS

TOTAL USERS

DIRECT ROLES

TOTAL ROLES

CHILD ROLES

PARENT ROLES

Mandatory

FROM

Minimum value

Optional

TOP

Maximum value

Optional

TYPE

REG_EXP | PATTERN | (none)

Optional

PATTERN

A text sample (exact string / pattern / regular expression)

Optional

</CONDITION>

Either FROM and TO or TYPE and PATTERN attributes may be present at the same time

EVAL HR

SOURCE_UDB

Input CFG file path

Mutually exclusive. One should be present.

SOURCE_UDB

Input UDB file path

REP_FILE

Output report file

Mandatory

ENRICH UDB

SOURCE_UDB

Input UDB file path

Mandatory

TARGET_UDB

Output UDB file path

Mandatory

SUPP_FILE

Input Supplementary (Enrichment) file path

Mandatory

CONCATENATION_

CHARACTER

Filed concatenation character

Optional

CASE_SENSITIVE

'Case Sensitive' flag

Optional

CLEAR_EMPTY_

FIELDS

'Clear empty fields' flag

Optional

CLEAR_UNKNOWN_USERS

'Clear unknown users' flag

Optional

<COLUMN>

0 or more child tags.

This is an experimental feature not included in the official product definition.

POS

Position of the Enrichment file column

Optional

NAME

Title of the Enrichment file column

Optional

FIELD

Target field name in UDB

Optional

</COLUMN>

IDENTIFICATION_

FIELD

Valid when at least 1 <COLUMN> tag is present

Optional

ENRICH RDB

SOURCE_RDB

Input RDB file path

Mandatory

TARGET_RDB

Output RDB file path

Mandatory

SUPP_FILE

Input Supplementary (Enrichment) file path

Mandatory

IMPORT LDIF

MAPPING_FILE

Input Mapping XML file path

Mandatory

SOURCE_FILE

Input LDIF text file path

Mandatory

TARGET_CFG

Output CFG file path

Mandatory

TARGET_UDB

Output UDB file path

Mandatory

TARGET_RDB

Output RDB file path

Mandatory

IMPORT AD

MAPPING_FILE

Input Mapping XML file path

Mandatory

TARGET_CFG

Output CFG file path

Mandatory

TARGET_UDB

Output UDB file path

Mandatory

TARGET_RDB

Output RDB file path

Mandatory

<SEARCH_ROOT>

(Container DN)

</SEARCH_ROOT>

0 or more child tags. If not present the default search root is used.

Optional

<DOMAIN>

1 or more child tags. If not present the <COMMAND> tag should include <DOMAIN>'s mandatory attributes

Optional

USER_NAME

AD User Name

Mandatory

PASSWORD

AD Password

Mandatory

SERVER

AD Server Name / IP

Mandatory

PORT

AD Server Port number

Optional

</DOMAIN>

EXPORT SQL

SQL_SERVER_

TYPE

MS SQL Server | ORACLE

Optional

SERVER

The SQL server network name/IP

Mandatory

DATABASE

The SQL database name

Mandatory

USER

The SQL user name. If not present default authentication is used (SSPI)

Optional

PASSWORD

The SQL password. Mandatory when USER is specified.

BULK_INSERT

'Bulk Insert' flag

Optional

SHARE_DIR

The shared directory path for the bulk files. Meaningless when BULK_INSERT is FALSE. Mandatory when TRUE.

SOURCE_CFG

Input CFG file path (on disk)

SOURCE_ file path is mandatory. 2 or more SOURCE_ are not allowed.

TARGET_ is optional.

TARGET_CFG

Output CFG SQL file name

SOURCE_AUD

Input AUD file path (on disk)

TARGET_AUD

Output AUD SQL file name

SOURCE_UDB

Input UDB file path (on disk)

TARGET_UDB

Output UDB SQL file name

SOURCE_RDB

Input RDB file path (on disk)

TARGET_RDB

Output RDB SQL file name

SOURCE_BPR

Input BPR file path (on disk)

TARGET_BPR

Output BPR SQL file name

OVERWRITE_

USERS_DB

'Overwrite UDB' flag. Valid when SOURCE_CFG is present

Optional

OVERWRITE_

RES_DB

'Overwrite RDB' flag. Valid when SOURCE_CFG is present

Optional

IMPORT SQL

SQL_SERVER_

TYPE

MS SQL Server | ORACLE

Optional

SERVER

The SQL server network name/IP

Mandatory

DATABASE

The SQL database name

Mandatory

USER

The SQL user name. If not present default authentication is used (SSPI)

Optional

PASSWORD

The SQL password. Mandatory when USER is specified.

SRC_FILE

Input SQL file name.

The command is intended to work with any types of files but currently implemented for the CFG files only.

Mandatory

DEST_FILE

Output file path.

Mandatory

RUN AUDIT

SOURCE_CFG

Input CFG file path

Mandatory

TARGET_AUD

Output Audit card file path

Mandatory

OVERWRITE_

TARGET_AUD

'Overwrite Audit card' flag

(if FALSE new alert entities are added to the existing file)

Optional

IGNORE_INVALID_

ENTITIES

'Ignore invalid entities' flag.

Optional

MAX_TOTAL_

ALERTS

Maximum total number of generated alerts

MAX_ENTITY_

ALERTS

Maximum number of generated alerts per an entity

MAX_CATEGORY_

ALERTS

Maximum number of generated alerts per a category (audit type)

MAX_TOTAL_

ENTITY_ALERTS

Maximum number of generated alerts per entity and category

<SETTINGS>

Used for the Pattern Audit

Optional

FLAGS

The settings bitmask

Optional

TESTS

Comma separated list of pattern-based tests

Optional

<EVAL_WEIGHTS >

Optional

ORG

ORG TYPE

FIELD_N

User field evaluation weight

</EVAL_WEIGHTS >

Audit Parameters

According to the parameter

Optional

</SETTINGS>

FIX AUDIT

TARGET_CFG

Output CFG file path

Mandatory

TARGET_UDB

Output UDB file path

Mandatory

TARGET_RDB

Output RDB file path

Mandatory

TARGET_AUD

Output Audit card file path

Mandatory

ALERT_TYPES

See the alert types in the

RUN AUDIT specification

Optional

FIX_TO_APPLY

1 | 2 (1 for primary, 2 for secondary fixes)

Optional

COMPARE CFG

CURRENT_CFG

Updated CFG file path

Mandatory

PRIOR_CFG

Original CFG file path

Mandatory

TARGET_AUD

Output Audit card file path

Optional

DIFF_PATH

Output Diff Report file path

Mandatory

LOG_PATH

Output Diff Log file path

Mandatory

DIFF_NEW_USERS

'Report New Users' flag

Optional

DIFF_REMOVED_

USERS

'Report Removed Users' flag

Optional

DIFF_SAME_USERS

'Report Updated Users' flag

Optional

DIFF_NEW_RES

'Report New Resources' flag

Optional

DIFF_REMOVED_RES

'Report Removed Resources ' flag

Optional

DIFF_SAME_RES

'Report Updated Resources ' flag

Optional

DIFF_NEW_ROLES

'Report New Roles' flag

Optional

DIFF_REMOVED_

ROLES

'Report Removed Roles' flag

Optional

DIFF_SAME_ROLES

'Report Updated Roles' flag

Optional

DIFF_BY_ROLES

'Link Diff by Roles' flag

Optional

DIFF_BY_USERS

'Link Diff by Users' flag

Optional

UNICODE_OUTPUT

'Unicode Output' flag

Optional

IMPORT REQUEST

TARGET_CFG

Target CFG to apply the requests

Mandatory

TARGET_AUD

Target Audit file to put the requests

Mandatory

SQL_SERVER_

TYPE

MS SQL Server | ORACLE

Optional

SERVER

The SQL server network name/IP

Mandatory

DATABASE

The SQL database name

Mandatory

USER

The SQL username. If not present, default authentication is used (SSPI)

Optional

PASSWORD

The SQL password. Mandatory when USER is specified.

REQUESTED_BY

Name of requester

Optional

REQUEST_CFG

Source CFG name in the database

Optional

TRANSACTION

Transaction name

Optional

CAMPAIGN

Campaign name

Optional

CATEGORY

Category name

Optional

VALUE

Value

Optional

TYPE

Request Type

Optional

CSV MAPPER

SOURCE_CSV

Input CSV file path

Mandatory

TARGET_CFG

Output CFG file path

Mandatory

TARGET_UDB

Output UDB file path

Mandatory

TARGET_RDB

Output RDB file path

Mandatory

PERSON_ID_

CASE_SENSITIVE

'Person ID case-sensitive' flag

Optional

IN_SEPARATOR

Input separator

Optional

OUT_SEPARATOR

Output separator

Optional

PERSON_ID

Person ID column index (1-based)

Mandatory

RES_NAME_X

Resource Name column index, where X may be 1, 2, or 3

For each X, either first or second is Mandatory

RES_NAME_X_

TEXT

Resource Name constant text

BASIC ROLES SEARCH

ROLE_NAME_

PREFIX

Role name prefix

Optional

SOURCE_CFG

Input CFG path name

Mandatory

TARGET_CFG

Output CFG path name

Mandatory

MIN_NEWLY_

COVERED_

CONNECTIONS_NUM

Minimum number of newly covered connections

Optional

MIN_NEWLY_

COVERED_

CONNECTIONS_PCT

Minimum percent of newly covered connections

Optional

MIN_RESOURCES_

NOT_COVERED_NUM

Minimum number of resources not covered by new roles

Optional

MIN_RESOURCES_

NOT_COVERED_PCT

Minimum percent of resources not covered by new roles

Optional

MIN_USERS_NOT_

COVERED_NUM

Minimum number of users not covered by new roles

Optional

MIN_USERS_NOT_

COVERED_PCT

Minimum percent of users not covered by new roles

Optional

MAX_ROLES

Maximum number of new roles

Optional

MIN_RESOURCES

Minimum number of resources in a new role

Optional

MIN_USERS

Minimum number of users in a new role

Optional

ITERATED SEARCH

ROLE_NAME_

PREFIX

Role name prefix

Optional

SOURCE_CFG

Input CFG path name

Mandatory

TARGET_CFG

Output CFG path name

Mandatory

DEFAULT_

DESCRIPTION

Default role description

Optional

MIN_NEWLY_

COVERED_

CONNECTIONS_NUM

Minimum number of newly covered connections

Optional

MIN_NEWLY_

COVERED_

CONNECTIONS_PCT

Minimum percent of newly covered connections

Optional

MIN_RESOURCES_

NOT_COVERED_NUM

Minimum number of resources not covered by new roles

Optional

MIN_RESOURCES_

NOT_COVERED_PCT

Minimum percent of resources not covered by new roles

Optional

MIN_USERS_NOT_

COVERED_NUM

Minimum number of users not covered by new roles

Optional

MIN_USERS_NOT_

COVERED_PCT

Minimum percent of users not covered by new roles

Optional

MAX_ROLES

Maximum number of new roles

Optional

MIN_RESOURCES

Minimum number of resources in a new role

Optional

MIN_USERS

Minimum number of users in a new role

Optional

SEARCH_MODE

USERS | RESOURCES | CONNECTIONS

Mandatory

RULE-BASED SEARCH

ROLE_NAME_

PREFIX

Role name prefix

Optional

SOURCE_CFG

Input CFG path name

Mandatory

TARGET_CFG

Output CFG path name

Mandatory

SEARCH_MODE

USERS | RESOURCES | CONNECTIONS

Mandatory

IGNORE_NULL_

VALUES

'Ignore null values' flag

Optional

MIN_PERCENT_

WITHIN_GROUP

Minimum percent of role coverage within a group

Optional

MAX_RULES_

PER_GROUP

Maximum number of rules per a group

Optional

<ATTRIBUTE>

(attribute name)

</ATTRIBUTE>

1 or more attributes for the rule-based search

Mandatory

MIN_NEWLY_

COVERED_

CONNECTIONS_NUM

Minimum number of newly covered connections

Optional

MIN_NEWLY_

COVERED_

CONNECTIONS_PCT

Minimum percent of newly covered connections

Optional

MIN_RESOURCES_

NOT_COVERED_NUM

Minimum number of resources not covered by new roles

Optional

MIN_RESOURCES_

NOT_COVERED_PCT

Minimum percent of resources not covered by new roles

Optional

MIN_USERS_NOT_

COVERED_NUM

Minimum number of users not covered by new roles

Optional

MIN_USERS_NOT_

COVERED_PCT

Minimum percent of users not covered by new roles

Optional

MAX_ROLES

Maximum number of new roles

Optional

MIN_RESOURCES

Minimum number of resources in a new role

Optional

MIN_USERS

Minimum number of users in a new role

Optional

COPY ROLE

SOURCE_CFG

Input CFG path name

Mandatory

TARGET_CFG

Output CFG path name

Mandatory

<ROLE>

1 or more child tags.

Mandatory

NAME

Source role name

Mandatory

REPLACE

Replace role flag

Optional

TRUE

COPY_LINKS

Copy links flag

Optional

TRUE

TARGET_NAME

Target role name

Optional

(same as NAME)

</ROLE>

IMPORT UNIX PASSWORD

SOURCE_

PASSWORD

Input Unix Password file path

Mandatory

SOURCE_GROUPS

Input Groups file path

Mandatory

TARGET_CFG

Output CFG file path

Mandatory

TARGET_UDB

Output UDB file path

Mandatory

TARGET_RDB

Output RDB file path

Mandatory

RES_NAME_2

Default Res Name 2

Optional

(empty)

RES_NAME_3

Default Res Name 3

Optional

(empty)

IMPORT ITIM 4.5

LOGIN_CONFIG

Login configuration parameter

Mandatory

APP_SRV_HOME

Application server

Mandatory

IMPORT ITIM 4.6

DETAILS_XML

Details XML file path

Mandatory

MAPPING_XML

Mapping XML file path

Mandatory

EXPORT ITIM 4.5

JAR_DIRECTORY

Java modules directory

Mandatory

ITIM_HOME

ITIM home directory

Mandatory

EXPORT ITIM 4.6

DIFF_FILE

Export differences file path (export commands only)

Mandatory

IMPORT CA

VERSION

IM Version

Optional

0.0

CFG_FOLDER

Configuration file folder

(from 12.5)

Mandatory

EXPORT CA

PASSWORD

Password

Mandatory

DIFF_FILE

Export differences file path (export only)

Mandatory

OUT_FOLDER

Output file folder

(import only, from 12.5)

Mandatory

REPORT_ID

Report ID string

(import only, from 12.5)

Optional

(empty)

SETTINGS

Settings XML file path

(before 12.5)

Mandatory

MAPPING

Mapping XML file path

(before 12.5)

Mandatory

RES_DB

Input RDB file path (before 12.5)

Mandatory

USERS_DB

Input UDB file path (before 12.5)

Mandatory

ROLE

Input Roles CSV file path

(before 12.5)

Mandatory

USER_RES

Input User-Resources CSV file path (before 12.5)

Mandatory

ROLE_RES

Input Role-Resources CSV file path (before 12.5)

Mandatory

USER_ROLE

Input User-Roles CSV file path (before 12.5)

Mandatory

ROLE_ROLE

Input Role-Roles CSV file path (before 12.5)

Mandatory

REMOVE REDUNDANT LINKS

SOURCE_CFG

Input configuration file path

Mandatory

TARGET_CFG

Output configuration file path

Mandatory

BPR SOD REPORT

CFG

Input configuration file path

Mandatory

BPR

Input rules file path

Mandatory

OUTPUT

Output report file path

Mandatory

IMPORT SAP

PASSWORD

SAP Password

Mandatory

SETTINGS

Settings XML file path

Mandatory