How the RACF Security Interface Works

When a file transfer request is received, the system performs the following actions:

CA XCOM Data Transport first ensures that the user ID and password are valid. This is done through the RACINIT macro. The password sent across the line is encrypted. In addition to the user ID, the VTAM APPLID and the VTAM LU name fields are passed to the RACINIT macro via the APPL and TERMID operands. A new password can be specified by the user. CA XCOM Data Transport also passes the VOLSER of the volume on which requested data sets reside.
The CA XCOM Data Transport IBM RACF Interface requests that an ACEE be created by the RACINIT macro and saved for use by the authorization routine.
Note: User ID/password validation is done for data files and job type transfer requests, but not for report type transfer requests.
The CA XCOM Data Transport IBM RACF Interface then passes the ACEE to the RACHECK macro that determines whether the user ID has access privileges. For data set access requests, three types of allocation checking are done, depending on the level of access requested:
- READ authority
- WRITE authority
- ALLOCATION authority
After access checking is done, the ACEE is purged from the system with the following command:
```
RACINITENVIR=DELETE
```

Note: Access events are logged by SMF under both the CA XCOM Data Transport and the user's UID.