RACF Groups. John Hilman BAS02. Vanguard Professional Services

Transcription

1 RACF Groups John Hilman Vanguard Professional Services BAS02 1

2 2 Legal Notice Copyright 2017 Copyright by Vanguard Integrity Professionals, Inc. All rights reserved. Unauthorized reproduction, modification, publication, display, or distribution of this work in any form is not permitted. Criminal copyright infringement may be punishable by fines and/or incarceration. Recording of live or online presentations is not permitted. The use of session, event, staff, or presenter images is not authorized including but not limited to posting images on social media. With respect to presentation materials such as hand-outs or slide decks, registered participants are permitted to reproduce, distribute, and display such materials internally within their organizations for non-commercial educational purposes only. All other uses must be expressly granted in writing by Vanguard Integrity Professionals, Inc.. Trademarks The following are trademarks of Vanguard Integrity Professionals Nevada: Vanguard Administrator Vanguard Advisor Vanguard Analyzer Vanguard SecurityCenter Vanguard Offline Vanguard Cleanup Vanguard PasswordReset Vanguard Authenticator Vanguard incompliance Vanguard IAM Vanguard GRC Vanguard QuickGen Vanguard Active Alerts Vanguard Configuration Manager Vanguard Configuration Manager Enterprise Edition Vanguard Policy Manager Vanguard Enforcer Vanguard ez/token Vanguard Tokenless Authenticator Vanguard ez/piv Card Authenticator Vanguard ez/integrator Vanguard ez/signon Vanguard ez/password Synchronization Vanguard Security Solutions Vanguard Security & Compliance Vanguard zsecurity University

3 3 Trademarks The following are trademarks or registered trademarks of the International Business Machines Corporation: CICS CICSPlex DB2 eserver IBM IBM z IBM z Systems IBM z13 IMS MQSeries MVS NetView OS/390 Parallel Sysplex RACF RMF S/390 System z System z9 System z10 System/390 VTAM WebSphere z Systems z9 z10 z13 z/architecture z/os z/vm zenterprise Java and all Java-based trademarks are trademarks of Oracle and/or its affiliates. UNIX is a registered trademark of The Open Group in the United States and other countries. Microsoft, Windows and Windows NT are registered trademarks of Microsoft Corporation in the United States, other countries, or both. Other company, product, and service names may be trademarks or service marks of others.

4 4 Session Topics RACF Group Tree Structure Group Profile Naming Conventions RACF Commands for Group Administration Using Vanguard Administrator for Group Administration Group Related User Attributes Group Authorities RACF Group Scoping

5 5 Group Structure OWNER=IBMUSER SYS1 OWNER GROUP NAME OWNER=SYS1 SECADM SUPERIOR GROUP OWNER=SECADM DOMESTIC OWNER=SECADM LVPAYCLK OWNER=SECADM INTERNTL OWNER=DOMESTIC OWNER=DOMESTIC OWNER=DOMESTIC OWNER=INTERNTL MANUFACT OVERHEAD SALES INTERHQ OWNER=MANUFACT OWNER=SALES OWNER=SALES OWNER=INTERHQ PROD WESTREG EASTREG REGIONS OWNER=PROD OWNER=EASTREG MAINT NYC

6 6 RACF Groups COMBINES LIKE ELEMENTS LVPAYCLK KAREN RUSS MARK PATTY Grouping of users makes administration of users easier and more manageable

7 7 Group Profile Naming Conventions A RACF GROUP NAME MUST BE One to eight characters in length Any combination of alphabetic, numeric, #, $, EXCEPT it may NOT start with a numeric Unique from other group names or user IDs SYS1, SECADM, #STCGRP are all valid Group names 1STGRP, IBMUSER are not valid Group names LOCAL NAMING STANDARDS SHOULD BE CREATED TO AVOID ATTEMPTED USE OF THE SAME GROUP NAME

8 8 Group Profile Segments BASE (or RACF) SEGMENT Required segment Contains basic group information Group Name Owner Superior Group Installation Data Connected Users Subgroups Important keywords to explicitly specify: OWNER SUPGROUP

9 9 Group Profile Segments OPTIONAL SEGMENTS DFP SEGMENT Contains default Data Class, Storage Class, and Management Class values for the Automatic Class Selection routines in DFSMS Referred to by RESOWNER field in dataset profiles OMVS SEGMENT Specifies the z/os UNIX System Services Group Identifier (GID) CSDATA SEGMENT Specifies information to add a custom field for this group

10 10 Commands For Group Administration ADDGROUP (AG) ALTGROUP (ALG) LISTGRP (LG) CONNECT (CO) REMOVE (RE) DELGROUP (DG) ADD A GROUP PROFILE MODIFY A GROUP PROFILE LIST A GROUP PROFILE CONNECT A USER TO A RACF GROUP REMOVE A USER FROM A RACF GROUP DELETE A GROUP PROFILE

11 11 ADDGROUP Command Syntax ADDGROUP (AG) group-name or (group-names...) ADDGROUP [ OWNER(user-id or group-name) ] [ SUPGROUP(group-name) ] [ DATA('installation data') ] [ CSDATA(custom-field-name (custom-field-value)) ] [ DFP(class-names) ] [ OMVS(GID(group-identifier)) ] [ UNIVERSAL ] ADDGROUP (MVS, CICS) OWNER(TECHSUPP) SUPGROUP(TECHSUPP) AG MVSGRP OW(MVS) SUP(MVS) DATA( FUNCTIONAL GROUP FOR SYS PROGS )

12 12 Syntax Rules and Defaults If OWNER is group name, must be its superior group If no owner specified, you are the owner OWNER determines administration SUPGROUP determines structure If SUPGROUP omitted, your current connect group becomes superior group

13 13 UNIX Group Identifiers Each UNIX group must have a group identification number (GID). GID - how the UNIX system internally identifies each group. AG OMVSGRP OW(MVS) SUP(MVS) OMVS(GID(200))

14 14 Universal Groups UNIVERSAL Group AG UNIGRP OW(MVS) SUP(MVS) UNIVERSAL

15 Adding A Group RACF Panels 15

16 Specify the Group Name 16

17 Specify Owner and Superior Group 17

18 Specify the GID 18

19 Profile Added 19

20 Adding a GROUP with Vanguard Administrator 20

21 Select Group Option 2 21

22 Enter the Group Name 22

23 23 Enter Owner and Superior Group Enter Owner and Superior Group Enter E for Installation Data

24 24 Enter Installation Data Press End (F3)

25 Enter GO to Generate Commands 25

26 VRAEXEC to Execute Now 26

27 27 Auditing Groups AT THE GROUP PROFILE LEVEL No auditing available AT THE SYSTEMWIDE LEVEL All additions, changes to, or deletions of group profiles SETR AUDIT(GROUP)

28 28 ALTGROUP Command Syntax ALTGROUP (ALG) group-name or (group-names...) ALTGROUP [ OWNER(user-id or group-name) ] [ SUPGROUP(group-name) ] [ DATA('installation data') ] [CSDATA(custom-field-name (custom-field-value)) ] [ DFP(class-names) ] [ OMVS(GID(group-identifier)) ] [ NOOMVS ] ALG UNIXGRP OMVS(GID(2015))

29 29 LISTGRP Command Syntax LISTGRP LISTGRP (LG) group-name or (group-names ) or * [ CSDATA ] [ DFP ] [ OMVS ] LISTGRP TSADMIN LG UNIXGRP OMVS LG (TECHSUPP MVS CICS)

30 Group Profile Contents 30

31 Display a Group Profile RACF Panels 31

32 Select Optional Segment Information 32

33 Group Profile Display 33

34 Display a GROUP with Administrator 34

35 Select Group Profiles Option 2 35

36 Select Masking Criteria for Group Report 36

37 Three Ways to List a Group 37

38 Using the LR Command 38

39 Output of the LR Command 39

40 Using the LV Command 40

41 Output of the LV Command 41

42 Output of the LV Command 2 42

43 Output of the LV Command 3 43

44 Using the VRC Command 44

45 Listing or Changing a Group 45

46 46 Connecting Users to Groups CONNECT (CO) user-id or (user-ids...) [ GROUP(group-id) ] [ OWNER(user-id or group-id ] [ AUTHORITY( use, create, connect, join) ] [ SPECIAL NOSPECIAL ] [ OPERATIONS NOOPERATIONS ] [ AUDITOR NOAUDITOR ] [ RESUME [ (date)] NORESUME ] [ REVOKE [ (date)] NOREVOKE ] CONNECT CONNECT U25RTH GROUP(CICSGRP) OWNER(CICSGRP) CO (U25JED, U17JED) GROUP(TECHSUPP) CO U25JPM GROUP(MVSGRP) REVOKE(mm/dd/yy)

47 47 Connect Attributes / Group Authorities LVPAYCLK Connect Attributes SPECIAL OPERATIONS AUDITOR REVOKE PATTY Group Authorities JOIN CONNECT CREATE USE

48 48 Connect Attributes GROUP RELATED USER ATTRIBUTES APPLY TO USERS, GROUPS, AND RESOURCES WITHIN THE SCOPE OF THE GROUP GROUP-SPECIAL GROUP-AUDITOR GROUP-OPERATIONS Gives the user the authority to issue all RACF commands within the scope of a group Gives the user the authority for auditing resources and users within the scope of a group Gives the user the authority to access RACF protected resources within the scope of a group co patty group(lvpayclk) special auditor operations

49 49 Group Authorities JOIN CONNECT Add Sub-Group USE CREATE Add DS Profile Allocate New DS CONNECT Users to Group REMOVE Users from Group Add New User ID If CLAUTH(USER) Each level is inclusive of lower level authorities

50 50 Removing Users From Groups REMOVE (RE) user-id or (user-ids...) REMOVE [ GROUP(group-id) ] [ OWNER(user-id or group-id ] REMOVE U25RTH GROUP(CICSGRP) RE (U25JED, U17JED) GROUP(TECHSUPP) RE U25JPM GROUP(MVSGRP) OWNER(MVSGRP)

51 Group Connections RACF Panels 51

52 Specify User and Connect Owner 52

53 Specify Group Attributes 53

54 Administrator Connect Manager 54

55 55 Add a Group Connection Enter the Group ID and Connect Owner

56 56 Remove a Group Connection Enter R next to the group to remove press enter

57 57 DELGROUP Command Syntax DELGROUP (DG) group-name or (group-names...) RACF Restrictions: No Subgroups, No Connected Users, No Group Data Set Profiles RACF Considerations: Access Lists, Profile Ownership DG MVSRS

58 58 Steps to Deleting Groups 1. Remove all users from group 2. Identify all data sets associated with group and take appropriate action 3. Any subgroups of group must be changed to another group 4. If group is owner of profiles, change ownership to another group 5. Remove group name from any resource access lists

59 Administrator - Deleting a Group 59

60 Administrator - Deleting a Group 60

61 Delete Group Command 61

62 Generated Commands 62

63 63 Centralized Administration SPECIAL SECADM Jim LVPAYCLK LVCSTSRV Owner=Jim Russ Owner=Jim Mark Owner=Jim Mary Owner=Jim Tom Owner=Jim Patty Owner=Jim Sue

64 64 Delegate Profile Ownership SPECIAL SECADM Jim Bob LVPAYCLK LVCSTSRV Owner=Bob Russ Owner=Bob Mark Owner=Bob Mary Owner=Bob Tom Owner=Bob Patty Owner=Bob Sue

65 65 Using Group-Special SPECIAL SECADM Jim RACFADM Group Special Bob LVPAYCLK LVCSTSRV Owner=RACFADM Russ Owner=RACFADM Owner=RACFADM Owner=RACFADM Mark Mary Tom Owner=RACFADM Patty Owner=RACFADM Sue

66 66 Delegating Group-Special SPECIAL SECADM Jim RACFADM Group Special Patty Group Special RACFADM LVPAYCLK LVPAYCLK Mark LVCSTSRV Mary RACFADM LVCSTSRV Group Special Bob LVPAYCLK Russ LVCSTSRV Sue Tom

67 67 Scope of the Group Rules THE "SCOPE OF THE GROUP " IS DETERMINED BY THE GROUP OWNERSHIP STRUCTURE GROUP OWNERSHIP CAN ONLY OCCUR BETWEEN A SUPERIOR GROUP AND ITS SUBGROUPS

68 68 Scope of the Group Rules BILL Group-Special OWNER=SYS1 SECADM THE SCOPE WILL CONTINUE AS LONG AS "GROUPS OWN GROUPS" OWNER=SECADM RACFADM OWNER=RACFADM OWNER=RACFADM LVPAYCLK LVCSTSRV OWNER=PDUKE INTERNTL OWNER=INTERNTL INTERHQ THE SCOPE ENDS WHEN A GROUP IS OWNED BY A USER ID OWNER=INTERHQ REGIONS

69 69 Within the Scope of the Group USERS AND RESOURCES ARE WITHIN THE SCOPE OF A GROUP WHEN THEY ARE: Where did I lose that SCOPE? OWNED BY A GROUP DIRECTLY OWNED BY SUBGROUPS THAT ARE OWNED BY A GROUP OWNED BY SUBGROUPS THAT ARE OWNED BY SUBGROUPS OWNED BY A GROUP AND SO ON...

70 70 Within the Scope of the Group RESOURCES ARE WITHIN THE SCOPE OF A GROUP WHEN THEY ARE: Where did I lose that SCOPE? OWNED BY USERS OWNED BY A GROUP ANYWHERE IN THE HIERARCHY DATASETS, WHOSE HIGH-LEVEL- QUALIFIER IS A GROUP NAME WITHIN THE SCOPE OF GROUPS

71 71 Group Commands Summary ADDGROUP (AG) ALTGROUP (ALG) LISTGRP (LG) DELGROUP (DG) CONNECT (CO) REMOVE (RE)

72 72 Questions How to Contact Us Vanguard Integrity Professionals 6625 South Eastern Ave., Suite 100 Las Vegas, NV Direct/International: (702) Toll Free: (877)

73 73 Session Evaluation Be sure to rate your experience in the Guidebook app guidebook Using the built-in star rating system, and evaluation forms, you ll be able to share your feedback on sessions and speakers. Your opinions help us to bring you the best possible conference experience. Please let us know your thoughts.