Customization › Implementing Security with SAF › ESFNETC Interface

ESFNETC Interface

The ESFNETC interface lets a program issue commands on behalf of a display terminal. When SECUEXT=SAF is specified in the parameters for CA Spool, a user must have update access to the display terminal to get a command queued for processing.

This is a RACF example of how to define users to CA Spool:

RDEFINE APPL ESF                                              
ADDSD 'ESFSECU.**'			GENERIC                        
ADDSD 'ESFSECU.NONO.DISP1A'		GENERIC                        
PERMIT 'ESF' CLASS(APPL)		ID(SUPER)        ACCESS(READ)  
PERMIT 'ESFSECU.**'			ID(SUPER)        ACCESS(UPDATE)
PERMIT 'ESFSECU.NONO.DISP1A'		ID(SUPER)        ACCESS(NONE)  
PERMIT 'ESF' CLASS(APPL)		ID(OPER)         ACCESS(READ)  
PERMIT 'ESFSECU.**'			ID(OPER)         ACCESS(UPDATE)
PERMIT 'ESFSECU.NONO.DISP1A'		ID(OPER)         ACCESS(UPDATE)

An internal SAF interface example of how to define users to CA Spool:

SAFUID SUPER,LABEL=SUPER                          
SAFUID OPER,LABEL=OPER                            
SAFAT OPER,DATASET=ESFSECU.**,ACCESS=UPDT         
SAFAT SUPER,DATASET=ESFSECU.**,ACCESS=UPDT        
SAFAT SUPER,DATASET=ESFSECU.NONO.DISP1A,ACCESS=NONE

Authorizations Established

In the above example:

• The user named SUPER has access to do everything possible in CA Spool, except issuing commands through the ESFNETC interface.
• The user named OPER has no restrictions.