IDOPTSCB Macro for Authorization

Customizing the CA Ideal Environment › Maintaining Authorizations › IDOPTSCB Macro for Authorization

IDOPTSCB Macro for Authorization

To change the @IIDOPTS load module, which contains the current command authorizations, modify the IDOPTSCB macro. (This macro is also used for other functions and contains parameters not described here. A full description is contained in the z/OS Installation and Maintenance Guide.)

The following syntax is used for authorization changes in the IDOPTSCB macro.

IDOPTSCB FUNC=START,TYPE=DC[,ATZEXIT=exit-pgm] 
                    place other site options here

FUNC=START

Required preceding any command authorization macros.

TYPE=DC

Required.

ATZEXIT=exit-pgm(Optional)

Specifies a user-written global exit program to receive control each time a command is invoked. You can use this exit to override the action determined by CA Ideal. It does not override any local exits specified in the ATZEXIT parameters.

IDOPTSCB FUNC=END

FUNC=END

Required following all authorization macros.

IDOPTSCB FUNC=HELP

FUNC=HELP

Generates a printout of parameter documentation.

IDOPTSCB FUNC=ATZ,
COMMAND=function-keyword,
LEVEL=  {level                       }
        {(subject-level,object-level)}
[,ATZEXIT=exit-pgm]

FUNC=ATZ

ATZ is required for each command authorization.

COMMAND=function-keyword

Specifies a functional command. This description is limited to word identifying the command that the parameters of this macro apply to. "Authorization Table" appendix relates all commands and their functional keywords.

LEVEL=  {level                     }
        {subject-level,object-level}

The minimum level of authorization that is required to execute the command identified in COMMAND=. If a command refers to a system other than the current system, you must specify a subject level (for the current system) and an object level (for the system the command refers to). "Authorization Table" appendix indicates the functional keywords that have subject and object levels with asterisks. You can specify the following values:

ADMIN: Requires a CA Ideal Administrator privilege.
BYPASS: Prevents CA Ideal from checking the level, giving authorization to all users. If a user-written exit is provided, it gets control after BYPASS and can override it.
CONTROL: Requires Control authorization in the current system.
DATAVIEW-ADMIN: Requires a Dataview Administrator privilege.
DISABLE: Disables a function. However, even with DISABLE specified, a user-written exit gets control after the DISABLE and can override it.
PRINT-ADMIN: Requires a Print Administrator privilege.
READ: Requires Read authorization in the current system.
RUN-PROD: Requires Run Prod authorization in the current system.
UPDATE: Requires Update authorization in the current system.
UPDATE-PANEL: Requires Update Panel authorization in the current system.
UPDATE-REPORT: Requires Update Report authorization in the current system.

Some levels automatically include others. The levels implied by each privilege and authorization are described in "Defining and Maintaining CA Ideal."

ATZEXIT=exit-pgm(Optional)

The name of a user-written program to receive control each time this command is invoked. You can use this exit to override the action determined by CA Ideal. It is called instead of the global exit, if any, specified in the FUNC=START parameter. The next section describes requirements for exit programs.

Note: If you use a separate @IIDOPTS load module for each environment, you can put all of your authorization exit programs in one library, provided that each exit program has a different name. If you use one @IIDOPTS load module for both online and batch processing, two copies of the authorization exit program are needed in separate libraries, one for batch and one for CICS.

Example

The following example:

Defines the storage type as DC (required to generate the options block), enforces the user ID integrity check, and specifies a global exit program USERPGM1.
Disables online compiles for all authorization levels and specifies an exit program USERPGM2 (for example, to enforce a more precise level of authorization).
For a COPY of a program across systems, requires CONTROL authorization in the current system, but only READ authorization in the system containing the program.
Requires Administrator privilege for all DUPLICATE PROGRAM commands across systems.

Requires CONTROL authorization for all batch compiles.

IDOPTS CSECT

          IDOPTSCB FUNC=START,                                                 X
              TYPE=DC,                                                         X
              UIDCHK=YES,                                                      X
              ATZEXIT=USERPGM1
          IDOPTSCB FUNC=ATZ,                                                   X
              COMMAND=COMPILE-ONLINE,                                          X
              ATZEXIT=USERPGM2,                                                X
              LEVEL=DISABLE
          IDOPTSCB FUNC=ATZ,                                                   X
              COMMAND=COPY-PROGRAM-ACROSS-SYSTEM,                              X
              LEVEL=(CONTROL,READ)
          IDOPTSCB FUNC=ATZ,                                                   X
              COMMAND=DUPLICATE-PROGRAM-ACROSS-SYSTEM,                         X
              LEVEL=ADMIN
          IDOPTSCB FUNC=ATZ,                                                   X
              COMMAND=COMPILE-BATCH,                                           X
              LEVEL=CONTROL
          IDOPTSCB FUNC=END

Note: Follow correct assembler syntax. (For example, a non-blank column 72 indicates that the statement is continued on the next line starting in column 16.) If conventions are not followed, other macros might not generate what was requested, even though they do not produce error messages.