Secondary Resource Checks

Implementing Security › Administering CICS Command Security › Secondary Resource Checks

Secondary Resource Checks

The following table indicates that certain CEMT keywords require secondary resource checks. When secondary checks are used:

SPI resource access ensures that the user is permitted to display or alter a particular type of CICS resource.
Individual resource access allows display or alteration of the individual resources displayed at the user's terminal.

Like CEMT INQUIRE, the CEMT SET action is also used to provide a display of affected resources (after the SET operands are implemented). For this reason, individual resources described in the table, CEMT Secondary Resource Checks, will often need both INQUIRE and SET access to invoke alteration through CEMT. You should also note that:

SET access does not imply INQUIRE access.
When the CEMT SET action is applied to these resources, both SET and INQUIRE access is required through CA Top Secret.
Whether the CEMT SET or INQUIRE action is used to initiate a resource display for the keywords in this table, both SET and INQUIRE access through CA Top Secret is required to alter the individual CICS resource.
When an individual resource is permitted only INQUIRE access, the resource can be displayed but not altered, whether SPI access to INQUIRE or SET the CICS resource class has been granted.

The following table shows the relationship between a CEMT keywrod and a secondary resource type:

CEMT Keyword	Secondary Resource Type

DB2ENTRY*	DB2ENTRY
DB2TRAN*	DB2TRAN
DSNAME	DATASET
FILE	FCT
JOURNAL	JCT
PROGRAM	PPT
QUEUE	DCT
TRANSACTIONS	OTRAN or LCF
VOLUMES	VOLUMES
Note: * CTS 1.2 and above only

Notes

DSNAME access checking by CA Top Secret requires the FACILITY control option DSNCHECK=YES. This is set via the command:
```
TSS MODIFY FACILITY(facility=DSNCHECK=YES)
```
When this control option is in effect, CA Top Secret checks DATASET, but not FCT resources for FILE or DATASET keywords in INQUIRE or SET actions through CEMT.
FCT access checking by CA Top Secret requires the FACILITY control option DSNCHECK=NO (the default). This is set via the command:
```
TSS MODIFY FACILITY(facility=DSNCHECK=NO)
```
When this control option is in effect, CA Top Secret checks the FCT but not DATASET resources when FILE or DATASET keywords with INQUIRE or SET actions through CEMT.