External Security Considerations › Prepare to Use External Security › Remove SAF Authority Using DEFSAF

Remove SAF Authority Using DEFSAF

You can use the UNPERMIT action of the DEFSAF utility to remove users from the predefined SAF resource groups.

This procedure removes authority from the user ID SOFADMIN and removes access to SOF.

Follow these steps:

1. Log in to TSO with the user ID that you can use to run the CA OPS/MVS utility program DEFSAF from data set opshlq.OPS.REXX.
2. Execute DEFSAF from either the ISPF or TSO command line with ACT(UNPERMIT) to remove SAF authority.
   • To execute DEFSAF from an ISPF command line, enter the following commands:

     ISPF EDIT on member DEFSAF in opshlq.CCLXEXEC
     

     !OI OPSSOF ACT(UNPERMIT) SAFRO(SOFADMIN)
     

   • To execute DEFSAF from the TSO command line, enter the following command:

     TSO OX 'opshlq.CCLXEXEC(DEFSAF)' OPSSOF ACT(UNPERMIT) SAFRO(SOFADMIN)
     

Access to SOF has been removed from user ID SOFADMIN.