External Security Considerations › Prepare to Use External Security › Set Parameters that Allow External Security

Set Parameters that Allow External Security

Before you can use external security, set values for the following parameters:

EXTSECURITY

Turns on or off external security. Specify ON to turn on external security.

EXTSECCLASS

Specifies the resource class name for your site. The value you specify depends on the external security manager running on your host system. Set this parameter to one of the following values:

• IBMFAC (if your external security manager is CA Top Secret)
• FAC (if your external security manager is CA ACF2)
• FACILITY (if your external security manager is IBM RACF)

You can create and use another resource class name that is based on the security package you have installed on the target z/OS system. See the chapter specific to your security package for information about selecting a resource class name.

EXTSECPREFIX

Specifies the prefix for all security resource names that CA OPS/MVS defined. Use this value as the first or highest level qualifier for all resource names that your external security uses. The examples showing resource names in this guide use the default OP$MVS.

EXTSECSHOW

Sends trace messages to the OPSLOG. Specify ON to turn on trace messages. The trace messages show event checking information from SAF.

The message has the following format:

OPS2109T *CKSAF: <userid> <class> <prefix>.<rname>[.<ext>] <access> RC=<SAF rc> REASON:<reason>

userid

Specifies the user ID the SAF resource check uses.

class

Specifies the SAF resource class.

prefix

Specifies the SAF resource prefix or first-level qualifier of the resource name.

rname

Specifies the internally defined name to represent the security event.

ext

(Optional) Specifies an additional qualifier for the resource class. The presence and content depend on the resource name.

access

Requests resource access. Valid values are either READ or UPDATE.

rc

Specifies the return code from the SAF call.

reason

Converts into text the reason code from the SAF call.

More information:

SAF Resource Names Table