If LOCK resource security is enabled, when a program is specified on a LOCK or UNLOCK command, IMS performs a security validation to see if the user is allowed to LOCK or UNLOCK the program.
IMS uses a SAF call to invoke CA Top Secret program security. The resource class for these program security calls is formed from the prefix "I" and the value established for the RCLASS parameter (which defaults to "IMS").
Note: This is the same resource class that IMS uses for RAS PSB validation.
Rather than use RCLASS to distinguish security permissions for different regions, CA Top Secret encourages the administrator to make use of separate facilities for distinguished regions and to distinguish region-specific permissions by FACILITY.
If LOCK resource security is enabled, the security administrator must create an RDT entry for the program resource class.
This example assumes the use of the IIMS resource class for program security.
TSS ADD(RDT) RESCLASS(IIMS)
RESCODE(xx)
MAXLEN(8)
The following instructions assume the use of the IIMS facility for program security. The administrator should substitute their non‑standard program resource class, if one is in use.
IIMS is a general resource that can be ADDed to establish ownership:
TSS ADDTO(acid) IIMS(program)
To allow the user to LOCK or UNLOCK the program, enter:
TSS PERMIT(acid) IIMS(program)
FACILITY(IMSPROD)
TSS PERMIT(acid) IIMS(program)
The first permission allows the user to LOCK and UNLOCK the program only in regions using the IMSPROD facility. The second permission allows the user to LOCK and UNLOCK the program unrestricted by facility.
The JIMS resource class documented in the IMS product documentation for program grouping has no meaning in CA Top Secret. You can use profiles for program grouping, or permit individual programs in the IIMS resource class.
|
Copyright © 2013 CA Technologies.
All rights reserved.
|
|