Command Functions › ADMIN Function—Grant Administrative Authority

ADMIN Function—Grant Administrative Authority

Valid on z/OS, z/VSE, and z/VM.

Use the ADMIN command function to assign administrative capabilities to subordinate CA Top Secret administrators.

Administrative authority:

• Cannot be assigned to zones, division, department, or profile ACIDs.
• Can only be assigned to subordinate administrators within the administrator's scope. For example, VCAs cannot assign administrative authorities to other VCAs, even if they are in the same division. They can assign administrative authorities to DCAs, User ACIDs, and auditors within the divisions they control.

Only the MSCA defined to CA Top Secret during the installation process can create and assign administrative authorities to SCAs.

This command function has the following format:

TSS ADMIN(acid) keyword(authority level)
                ACCESS(access level)

acid

Specifies the ACID of the administrator being granted ADMIN authority.

keyword

Specifies the authority type the administrator is authorized to manage:

ACID

Specifies the authority levels, such as MAINTAIN, REPORT, AUDIT, and CREATE, at which administrators can manage ACIDs within their scope.

DATA

Information that the administrator may display using the TSS LIST function: BASIC, RESOURCE, XAUTH, LCF, SOURCE, PROFILE, INSTDATA, CICS, ADMIN, NAMES, PASSWORD, WORKATTR, SESSKEY, and ALL.

An administrator can display all of the above information, except SESSKEY, using the TSS LIST command function.

FACILITY

Any active facility contained in the Facility Matrix, such as VM, TSO, IMS, CICSTEST, and CA Roscoe.

MISC1

Low level administrative functions: LCF, INSTDATA, USER, LTIME, SUSPEND, NOATS, RDT, TSSSIM, and ALL.

MISC2

DLF, TARGET, NDT, TSO, SMS, APPCLU, WORKATTR, and ALL.

MISC3

PTOK and SDT

MISC4

CERTSITE, CERTAUTH, CERTUSER, CERTLIST, CERTGEN, CERTEXPO, CERTCHEK, and KERBUSER

MISC5

MLSADMIN

MISC7

RSTDACC

MISC8

LISTRDT, LISTSDT, LISTSTC, LISTAPLU,MCS, PWMAINT,REMASUSP, and ALL.

MISC9

High level administrative functions: BYPASS, TRACE, CONSOLE, STC, MASTFAC, MODE, GLOBAL, GENERIC, and ALL.

RESOURCE

Allows administrators to give authority to issue commands for all resource types owned within their administrative scope. An administrator can also give authority for a specific resource (like DSNAME). All specific resources have the same authority levels; OWN, XAUTH, AUDIT, REPORT, INFO and ALL.

The access keyword, which is a subset of RESOURCE, is used with XAUTH to specify access levels. Access level operands depend on the type of resource to which access is being permitted. Examples include: NONE, READ, WRITE, UPDATE, SCRATCH, BROWSE, MULTI, MREAD, MWRITE.

resource

Used as an archetype for any resource defined to the RDT.

SCOPE

Used to define the scope for the LSCA

authority level

Specifies the authority level or levels at which the administrator will manage the authority type:

RESOURCE

OWN, XAUTH, AUDIT, INFO, REPORT, and ALL

ACID

XAUTH, AUDIT, CREATE, INFO, DEFNODES, REPORT, MAINTAIN, and ALL

DATA

BASIC, RESOURCE, XAUTH, LCF, SOURCE, INSTDATA, CICS, PROFILE, ADMIN, NAMES, ACID, WORKATTR, SESSKEY, PASSWORD,

and ALL

MISC1

LCF, INSTDATA, USER, LTIME, RDT, SUSPEND, NOATS, TSSSIM, and ALL

MISC2

SMS TSO, NDT, DLF, TARGET, WORKATTR, APPCLU, and ALL

MISC3

SDT

MISC4

CERTSITE, CERTAUTH, CERTUSER, CERTLIST, CERTGEN, CERTEXPO, CERTCHEK, and KERBUSER

MISC5

MLSADMIN

MISC7

RSTDACC

MISC8

LISTRDT, LISTSTC, LISTAPLU, MCS, LISTSDT, PWMAINT, REMASUSP, and ALL

MISC9

BYPASS, TRACE, CONSOLE, STC, MASTFAC, MODE,GLOBAL, GENERIC, and ALL

FACILITY

Specific Facilities

SCOPE

Define scope for LSCA

access level

Specifies the access levels (for example, FETCH and WRITE) for which the administrator is authorized to PERMIT RESOURCE(XAUTH) resource access. If no entry is made, CA Top Secret usually assigns a default level based on the resource type.

Access Levels for RESOURCE(XAUTH) only

ALL, BLP, BROWSE, CONTROL, CREATE, DELETE, FETCH, FEOV, FIND, LOAD, MULTI, MREAD, MWRITE, NONE, PURGE, READ, REPLACE, SCRATCH, UPDATE, and WRITE

Examples: ADMIN function

In this example the security administrator VCA1 assigns ownership of data sets by adding them to the Audit Record:

TSS ADDTO(VCA1) DSNAME(OWN,AUDIT)

TSS ADDTO(DEPT1) DSNAME(XYZ.DATA.CRASH)

This example audits the specified data set:

TSS ADDTO(AUDIT) DSNAME(XYZ)

This example gives all users the ability to LIST their BASIC data, resource permissions, LCF transactions and password data, without allowing them to manipulate their data:

TSS ADMIN(ALL) DATA(BASIC,XAUTH,LCF,PASSWORD)