Security › External Security › Implementing External Security for CA ACF2

Implementing External Security for CA ACF2

Note: For more information about the commands listed in this section, see the CA ACF2 Administration Guide. The sample jobs can be found in CVDEOPTN member SARACF2.

For CA ACF2, a unique resource type is assigned for the CA View resource. The mapping of these resource types is identified in the following table:

Follow these steps:

1. Map the CA View resource types to CA ACF2 resource types, for example:

   //EXAMPLE JOB ACCOUNT,PROGRAMMER
   //CLAS EXEC PGM=IKJEFT01
   //SYSPRINT DD SYSOUT=*
   //SYSTSPRT DD SYSOUT=*
   //SYSTSIN DD *
   ACF
   SET CONTROL(GSO)
   INS CLASMAP.CHA1VIEW RESOURCE(CHA1VIEW) RSRCTYPE(VCL) ENTITYLN(246)
   /*
   

2. Tell CA ACF2 about the SAF calls that CA View is making, for example:

   //EXAMPLE JOB ACCOUNT,PROGRAMMER
   //SAFD EXEC PGM=IKJEFT01
   //SYSPRINT DD SYSOUT=*
   //SYSTSPRT DD SYSOUT=*
   //SYSTSIN DD *
   ACF
   SET CONTROL(GSO)
   INS SAFDEF.CHA1VIEW ID(CHA1VIEW) PROGRAM(SAR-) RB(SAR-) -
          NOAPFCHK RACROUTE(REQUEST=AUTH,CLASS=CHA1VIEW,STATUS=ACCESS)
   /*
   

3. Make the resource types resident, for example:

   //EXAMPLE JOB ACCOUNT,PROGRAMMER
   //ACF2 EXEC PGM=IKJEFT01
   //SYSPRINT DD SYSOUT=*
   //SYSTSPRT DD SYSOUT=*
   //SYSTSIN DD *
   ACF
   SET CONTROL(GSO)
   CHANGE INFODIR TYPES(R-RVCL)
   /*
   

4. Enter the modify console commands to cause a refresh, for example:

   F ACF2,REFRESH(CLASMAP)
   F ACF2,REFRESH(SAFDEF)
   F ACF2,REFRESH(INFODIR)
   

5. Define CA ACF2 rules, for example:

   Note: The rule definitions used in the following example are contained in a separate member of a PDS, called RULES.PDS. For more information, see the topic PDS Members later in this chapter.

   //EXAMPLE JOB ACCOUNT,PROGRAMMER
   //RULE EXEC PGM=IKJEFT01
   //SYSPRINT DD SYSOUT=*
   //SYSTSPRT DD SYSOUT=*
   //SYSTSIN DD *
   ACF
   SET RESOURCE(VCL)
   COMPILE 'RULES.PDS(VCL)'
   STORE
   /*
   

6. Tell CA ACF2 to rebuild the resident rules, for example:

   F ACF2,REBUILD(VCL)
   

Note: ACF2 cannot be configured to operate in a hierarchical mode. If a non‑privileged userid requires UPDATE and READ access to a resource, the ACF2 rule must include UPDATE and READ - UPDATE does not imply READ.