Implementing Security for Non-CA Products › Omegamon › Defining Product-level Security Using CA Top Secret

Defining Product-level Security Using CA Top Secret

To implement product‑level security using CA Top Secret, you must perform the following steps:

• Define task as a facility to CA Top Secret in the Facilities Matrix, where task is the name of the started task (for example, OMIIMVS, OMIICSA, OMIIRCOL, and so on). All examples use OMIIMVS as the started task.

  To define the OMIIMVS task, add the following commands to the CA Top Secret Parameter File:

  FACILITY (USER3=NAME=OMIIMVS)
  FACILITY (OMIIMVS=MODE=FAIL,ACTIVE,SHRPRF)
  FACILITY (OMIIMVS=PGM=KLV,NOASUBM,NOABEND,NOXDEF)
  FACILITY (OMIIMVS=ID=3,MULTIUSER,RES)
  FACILITY (OMIIMVS=LUMSG,STMSG,WARNPW)
  FACILITY (OMIIMVS=NOINSTDATA,SIGN (M))
  FACILITY (OMIIMVS=NORNDPW,AUTHINIT)
  FACILITY (OMIIMVS=NOPROMPT,NOAUDIT,NOTSOC)
  FACILITY (OMIIMVS=LOG (INIT,SMF,MSG,SEC9))
  

  Note: If a MASTFAC is defined for the Omegamon region ACID, it is not necessary to define PGM= on the FACILITY definition.

• Create the master facility ACID for Omegamon. An example appears below.

  TSS CREATE(OMEGAMON) NAME('acid')
                       DEPARTMENT(OMEGDEPT)
                       MASTFAC(OMIIMVS)
                       TYPE(USER)
                       PASS(NOPW,0)
  

  acid is the Omegamon master facility ACID.

• Define the Omegamon address space as a started task in the STC Record using the master facility ACID you created in Step 2. A sample definition appears below.

  TSS ADDTO(STC) PROCNAME(OMIIMVS)
                 ACID(OMEGAMON)
  

• Modify the security definition in the hlq.RM2PARM member KLVINNAM as shown below.

  DEFAULT DSNAME(hlq.NAM) EXIT=KLVTSNEV RACF NODB
  

• Install the exit for security validation. Omegamon provides a sample interface in member hlq.TLVSPENU(KLVTSNEV).

  Assemble and link KLVTSNEV with AC=1 into the hlq.TLVLOAD library; sample JCL is provided by Omegamon.

• Define the Omegamon data sets to be protected by CA Top Secret ; this step is optional.