Specific Control Options › AUTH—Merge Records for Search

AUTH—Merge Records for Search

Valid on z/OS and z/VM.

Use the AUTH control option to indicate whether CA Top Secret:

• Merges the User, Profile, and ALL records for its access authorization search
• Searches each record separately

All entry methods are accepted.

This control option has the following format:

AUTH(OVERRIDE[,ALLOVER])

AUTH(MERGE,[ALLOVER|ALLMERGE])

OVERRIDE

(Default) Indicates that the User, Profile, and All records are searched separately in the following manner:

• User Record—CA Top Secret searches an ACID's user record for the authorization to access a resource. If CA Top Secret locates this authorization, it continues its search of the entire user record, and grants access to the resource. If the system finds another authorization for the same resource, it will grant or deny access based on the PERMIT containing the resource prefix that most explicitly matches the resource being requested. Once this authorization is found in a user record, CA Top Secret will not check profile records
• Profile Record—If the system cannot locate the authorization in the user record, it searches each profile in sequence. CA Top Secret searches the entire profile record. Once an authorization record is found in a profile, subsequent profiles are not searched. If more than one authorization is found for the same resource, it will grant or deny access using the PERMIT containing the resource prefix that most explicitly matches the resource being requested

  Note: OVERRIDE is mutually exclusive with MERGE and ALLMERGE. OVERRIDE implies ALLOVER.

MERGE

CA Top Secret merges user and profile records, and searches this merged record for the requested authorization. The system will not make an access decision until it has searched the entire merged record.

ALLOVER

(Default) Indicates that the ALL record should be searched if no authorization is found in the user or profile records.

Note: ALLOVER is mutually exclusive with ALLMERGE.

ALLMERGE

Indicates that the ALL record is merged with user and profile records. ALLMERGE implies MERGE.