DB2

The following modifications must be made if you are using CA Top Secret to secure DB2 resources (DB2 is a product of the IBM Corporation).

Define DB2 started tasks ssssMSTR, ssssDIST and ssssDBM1 (where ssss is the four‑character subsystem ID) to CA Top Secret through a TSS ADDTO(STC).
Also add the IMS Resource Lock Manager (IRLM) as a started task. DB2 uses the IRLM to manage the locking of DB2 resources. The name for the IRLM started task was specified during the DB2 install process.
Use the DB2 resource keyword for connection authorization in the format (where ssss is the subsystem name your site is using for DB2):
```
DB2 \{(DSNR.ssss.BAT)\} for BATCH and TSO connections
DB2 \{(DSNR.ssss.DIS)\} for Distributed Data Facility (DDF)
DB2 \{(DSNR.ssss.MAS)\} for connection from IMS
DB2 \{(DSNR.ssss..SAS)\} for connection from CICS
DB2 \{(DSNR.ssss.RRSAF)\} for connection from RSS Attachment Facility
```
Note: CA Top Secret r4.4 and above supports DB2 resources previously defined as ABSTRACTs. However, it is recommended that the DB2 resource class be used for newly defined DB2 resources.

For connection authorization, individual user checking is not performed for CICS and IMS; the ACID associated with the CICS and IMS started tasks or the associated region ACID is checked instead. The ACID associated with a job is used to validate the connection for TSO and BATCH.
To protect archive log tape data sets, specify YES on the IBM DB2 installation CLIST panel entry for ARCHIVE LOG RACF.

PERMIT users with appropriate access levels to required DB2 (O/S) data sets.