Command Functions › ADMIN Function—Grant Administrative Authority

ADMIN Function—Grant Administrative Authority

Valid on z/OS, z/VSE, and z/VM.

Use the ADMIN command function to assign administrative capabilities to subordinate CA Top Secret administrators.

Administrative authority:

• Cannot be assigned to zones, division, department, or profile ACIDs.
• Can only be assigned to subordinate administrators within the administrator's scope. For example, VCAs cannot assign administrative authorities to other VCAs, even if they are in the same division. They can assign administrative authorities to DCAs, User ACIDs, and auditors within the divisions they control.

Only the MSCA defined to CA Top Secret during the installation process can create and assign administrative authorities to SCAs.

This command function has the following format:

TSS ADMIN(acid) keyword(authority level)
                ACCESS(access level)

• acid

  Specifies the ACID of the administrator being granted ADMIN authority.

• keyword

  Specifies the authority type the administrator is authorized to manage:

  • ACID

    Specifies the authority levels, such as MAINTAIN, REPORT, AUDIT, and CREATE, at which administrators can manage ACIDs within their scope.

  • DATA

    Information that the administrator may display using the TSS LIST function: BASIC, RESOURCE, XAUTH, LCF, SOURCE, PROFILE, INSTDATA, CICS, ADMIN, NAMES, PASSWORD, WORKATTR, SESSKEY, and ALL.

    An administrator can display all of the above information, except SESSKEY, using the TSS LIST command function.

  • FACILITY

    Any active facility contained in the Facility Matrix, such as VM, TSO, IMS, CICSTEST, and CA Roscoe.

  • MISC1

    Low level administrative functions: LCF, INSTDATA, USER, LTIME, SUSPEND, NOATS, RDT, TSSSIM, and ALL.

  • MISC2

    DLF, TARGET, NDT, TSO, SMS, APPCLU, WORKATTR, and ALL.

  • MISC3

    PTOK and SDT

  • MISC4

    CERTSITE, CERTAUTH, CERTUSER, CERTLIST, CERTGEN, CERTEXPO, CERTCHEK, and KERBUSER

  • MISC5

    MLSADMIN

  • MISC7

    RSTDACC

  • MISC8

    LISTRDT, LISTSDT, LISTSTC, LISTAPLU,MCS, PWMAINT,REMASUSP, and ALL.

  • MISC9

    High level administrative functions: BYPASS, TRACE, CONSOLE, STC, MASTFAC, MODE, GLOBAL, GENERIC, and ALL.

  • RESOURCE

    Allows administrators to give authority to issue commands for all resource types owned within their administrative scope. An administrator can also give authority for a specific resource (like DSNAME). All specific resources have the same authority levels; OWN, XAUTH, AUDIT, REPORT, INFO and ALL.

    The access keyword, which is a subset of RESOURCE, is used with XAUTH to specify access levels. Access level operands depend on the type of resource to which access is being permitted. Examples include: NONE, READ, WRITE, UPDATE, SCRATCH, BROWSE, MULTI, MREAD, MWRITE.

  • resource

    Used as an archetype for any resource defined to the RDT.

  • SCOPE

    Used to define the scope for the LSCA

• authority level

  Specifies the authority level or levels at which the administrator will manage the authority type:

  • RESOURCE

    OWN, XAUTH, AUDIT, INFO, REPORT, and ALL

  • ACID

    XAUTH, AUDIT, CREATE, INFO, DEFNODES, REPORT, MAINTAIN, and ALL

  • DATA

    BASIC, RESOURCE, XAUTH, LCF, SOURCE, INSTDATA, CICS, PROFILE, ADMIN, NAMES, ACID, WORKATTR, SESSKEY, PASSWORD,

    and ALL

  • MISC1

    LCF, INSTDATA, USER, LTIME, RDT, SUSPEND, NOATS, TSSSIM, and ALL

  • MISC2

    SMS TSO, NDT, DLF, TARGET, WORKATTR, APPCLU, and ALL

  • MISC3

    SDT

  • MISC4

    CERTSITE, CERTAUTH, CERTUSER, CERTLIST, CERTGEN, CERTEXPO, CERTCHEK, and KERBUSER

  • MISC5

    MLSADMIN

  • MISC7

    RSTDACC

  • MISC8

    LISTRDT, LISTSTC, LISTAPLU, MCS, LISTSDT, PWMAINT, REMASUSP, and ALL

  • MISC9

    BYPASS, TRACE, CONSOLE, STC, MASTFAC, MODE,GLOBAL, GENERIC, and ALL

  • FACILITY

    Specific Facilities

  • SCOPE

    Define scope for LSCA

• access level

  Specifies the access levels (for example, FETCH and WRITE) for which the administrator is authorized to PERMIT RESOURCE(XAUTH) resource access. If no entry is made, CA Top Secret usually assigns a default level based on the resource type.

• Access Levels for RESOURCE(XAUTH) only

  ALL, BLP, BROWSE, CONTROL, CREATE, DELETE, FETCH, FEOV, FIND, LOAD, MULTI, MREAD, MWRITE, NONE, PURGE, READ, REPLACE, SCRATCH, UPDATE, and WRITE