Implementing Security for Batch › Authorization to Submit Batch Jobs

Authorization to Submit Batch Jobs

By default, a defined user is only allowed to submit those batch jobs for which the ACID is specifically authorized (jobs identified by his/her ACID). Explicit authority is required to PERMIT a user to submit jobs identified by other ACIDs. Job submission authority is granted via the ACID parameter of the TSS PERMIT command function. For example, to authorize USER01 to submit jobs that run under the direct access authorities of the ACIDs PAYPROD and USER02, enter:

TSS PERMIT(USER01) ACID(PAYPROD,USER02)

Explicitly permitting a user's job submission authorizations rather than the user's job access authorizations has many useful applications. In the previous entry, PAYPROD is the ACID associated with the batch job that updates the Payroll Master File. The PAYPROD ACID is given all the direct access authorizations required to perform this function. The USER01 ACID, however, is only permitted to run the batch job without being given the authorizations necessary to update the Payroll Master File. Thus, one user is allowed to submit a job for another without sharing access authorizations.