Managing CA VM:Secure › Assigning Account Numbers to User IDs

Assigning Account Numbers to User IDs

CA VM:Secure enables you to control access to system resources by verifying account numbers when you assign them to a user ID.

Use the *AC= special comment to list account numbers that a user ID is allowed to use. You must have previously defined the account numbers using the ACCOUNT directory statement.

When you create a user ID or change a user ID account number (using the MAINT command), the change can apply immediately or at next logon or can be a temporary change. CA VM:Secure follows the procedure below to verify whether the new account number is valid for that user ID.

First, it scans the user ID directory entry file for any *AC= special comments for account numbers the user can use:

• If CA VM:Secure finds the new account number listed on a *AC= special comment in the user ID directory entry, CA VM:Secure verifies the new account number and updates the new account number as you request, either at the next logon, temporarily, or immediately.
• If CA VM:Secure does not find the new account number listed on a *AC= special comment in the user ID directory entry, CA VM:Secure calls the ACCOUNT user exit to verify the change. If you have not installed the ACCOUNT user exit or if the ACCOUNT user exit rejects the change, CA VM:Secure does not verify the new account number and generates an error.

If the account number is valid, CA VM:Secure next determines how to change the account number based on whether you use the CA VM:Account interface:

• If you use the CA VM:Account interface, all account number changes take effect immediately and are permanent. CA VM:Account issues DIAGNOSE X’84’ to update the VMDBK, and CA VM:Secure updates the CP directory for the next logon.
• If you do not use the CA VM:Account interface, and you have selected either an immediate change or one at the next logon, CA VM:Secure updates the new account number in the CP directory. If you have selected either an immediate or temporary change, CA VM:Secure also updates the VMDBK using DIAGNOSE X’84’.

Note: For information about using the ACCOUNT user exit, see the chapter "User Exit Reference" in the Reference Guide. For more information about the CA VM:Account interface, see the CA Mainframe VM Product Manager Product Interface Guide.