Specific Control Options › AUTH—Merge Records for Search

AUTH—Merge Records for Search

Valid on z/OS and z/VM.

The AUTH control option indicates whether CA Top Secret:

• Merges the User, Profile, and ALL records for its access authorization search.
• Searches each record separately.

All entry methods are accepted.

This control option has the following format:

AUTH(OVERRIDE[,ALLOVER])

AUTH(MERGE,[ALLOVER|ALLMERGE])

OVERRIDE

(Default) Indicates that the User, Profile, and All records are searched separately in the following manner:

• User Record—CA Top Secret searches an ACID's user record for the authorization to access a resource. If CA Top Secret locates this authorization, it continues its search of the entire user record, and grants access to the resource. If the system finds another authorization for the same resource, it grants or denies access based on the PERMIT containing the resource prefix that most explicitly matches the resource being requested. Once this authorization is found in a user record, CA Top Secret does not verify profile records.
• Profile Record—If the system cannot locate the authorization in the user record, it searches each profile in sequence. CA Top Secret searches the entire profile record. Once an authorization record is found in a profile, subsequent profiles are not searched. If more than one authorization is found for the same resource, it grants or denies access using the PERMIT containing the resource prefix that most explicitly matches the resource being requested.

  Note: OVERRIDE is mutually exclusive with MERGE and ALLMERGE. OVERRIDE implies ALLOVER.

MERGE

CA Top Secret merges user and profile records, and searches this merged record for the requested authorization. The system does not make an access decision until it has searched the entire merged record.

ALLOVER

(Default) Indicates that if no authorization is found in the user or profile records ALL record are searched.

Note: ALLOVER is mutually exclusive with ALLMERGE.

ALLMERGE

Indicates that the ALL record is merged with user and profile records. ALLMERGE implies MERGE.