Resources › PDSMEMn Resource Class—Secure Partitioned Data Set Members

PDSMEMn Resource Class—Secure Partitioned Data Set Members

Valid on z/OS.

Use PDSMEMn to secure an individual or group of Partitioned Data Set members. (where n is 1 to 8)

When used with TSS ADDTO/REMOVE, this resource class has the following format:

TSS ADDTO(acid) PDSMEMn(member|<DIR>|<BYPASS>)

Prefix length

One to eight characters

Capacity of list

One to five PDS members per TSS command

When used with TSS PERMIT/REVOKE, this resource class has the following format:

TSS PERMIT(acid) PDSMEMn(prefixes)
                  ACCESS(access‑level(s))

Prefix length

One to eight characters

Capacity of list

One to five PDS members per TSS command

This keyword is used with:

• The commands CREATE, ADDTO, REMOVE, PERMIT, and REVOKE
• The PDSMEMn ACID types User, Profile, Department, Division, Zone, DCA, VCA, ZCA, LSCA, SCA, and MSCA when used with TSS ADD/REMOVE
• The PDSMEMn ACID types User, Profile, DCA, VCA, ZCA, LSCA, SCA, and MSCA when used with TSS PERMIT/REVOKE
• PDSMEMn(OWN) authority to ADD or REMOVE PDS members from ACIDs
• PDSMEMn(XAUTH) authority to permit or revoke PDS members

The administrator can:

• Specify the access levels: NONE, ALTER, READ, UPDATE, and ALL.
• The administrator can use any of the following methods to control access to PDS members: Expiration, Facility, Time/Day, and Privpgm.

Masking

Masking is not allowed; however, ownership ior permission is granted by generic prefixing within resource class.

Example: PDSMEMn resource class

This example assigns ownership of a PDS member‑name family, prefixed by IEA:

TSS ADDTO(SYSPROG) PDSMEM(IEA)

This example removes ownership:

TSS REMOVE(SYSPROG) PDSMEM(IEA)

This example permits access for READ and UPDATE to member IEASYS00:

TSS PERMIT(SYSPROG) PDSMEM(IEASY00)
                    ACCESS(UPDATE)

READ is implied by UPDATE.

This example revokes access:

TSS REVOKE(SYSPROG) PDSMEM(IEASY00)

PKISERV Resource Class—Control Access to R_Pkiserv Administrative Functions

Valid on z/OS.

Use PKISERV to control access to R_PKIServ administrative functions on a more granular level than with IRR.RPKISERV.PKIADMIN resources in the IBMFAC resource class.

Note: For information on setting the permissions, see IBM documentation z/OS Cryptographic Services PKI Services Service Guide and Reference.

When used with TSS ADDTO/REMOVE, this resource class has the following format:

TSS ADDTO(acid) PKISERV(MYDOMAIN)

Prefix length

2 - 26 characters.

Capacity of list

1 - 5 prefixes per TSS command.

When used with TSS PERMIT/REVOKE, this resource class has the following format:

TSS PERMIT(acid) PKISERV(MYDOMAIN)

Resource length

1 - 246 characters.

This resource class is used with:

• The commands CREATE, ADDTO, REMOVE, PERMIT, REVOKE, ADMIN, DEADMIN, WHOOWNS, and WHOHAS.
• The ACID types User, Department, Division, Zone, DCA, VCA, ZCA, LSCA, SCA, and MSCA when used with TSS ADD/REMOVE.
• The ACID types User, Profile, DCA, VCA, ZCA, LSCA, SCA, and MSCA when used with TSS PERMIT/REVOKE.
• PKISERV(OWN) authority to ADD or REMOVE ownership of PKISERV resources from ACIDs.
• PKISERV(XAUTH) authority to PERMIT or REVOKE access to PKISERV resources.

The administrator can use any of the following methods to control access to PKISERV resources: Expiration, Facility, Program Pathing, Time/Day, and Actions.

Examples: PKISERV resource class

• This example protects the resource by assigning ownership to the Corporate Department ACID:

  TSS ADDTO(CORPORAT) PKISERV(MYDOMAIN)
  

  The administrator can now PERMIT access to users or profiles that require access.

• This example removes ownership:

  TSS REMOVE(CORPORAT) PKISERV(MYDOMAIN)
  

• This example permits users to access PKISERV(MYDOMAIN.QUERYREQS.1BYSSL):

  TSS PERMIT(TECHUSER) PKISERV(MYDOMAIN.QUERYREQS.1BYSSL)