Basic Definition Mode

Use of Recipient Tree Definition

The user’s authority to use a certain dataset specified under the DATREE DD is checked with the following entity:

$$TREE.dsn.member

where

• dsn is the dataset name of a library referenced by DD statement DATREE.
• member is the PDS member referenced by the DD statement.

For each dataset concatenated in DD statement DATREE, the security module is called once and checks each statement with the above entity.

The dataset name is truncated to 23 characters.

To permit USERA to use a DSN set to library‑name(member) in the DATREE DD, use the following commands:

For RACF:

RDEFINE FACILITY $$TREE.dsn.member UACC(NONE)

PERMIT $$TREE.dsn.member ACCESS(READ) ID(USERA) CLASS(FACILITY)

For TopSecret:

TSS ADD(system-dept) IBMFAC($$TREE)

TSS PERMIT(USERA) IBMFAC($$TREE.library.member-name) ACC(READ)

For ACF2/SAF:

SET RESOURCE(CMF)

COMP

$KEY($$TREE.dsn.member-name) TYPE(CMF)

UID(USERA) ALLOW

Access a Report Under Screen U

When the user attempts to specify an action on a certain report (for example, view, ruler change, print), the entity checked is $$CTDACT.qname.userid where userid is the user name related to the report being accessed. There is no distinction between the different actions that can be specified. The user is either allowed to do anything with the report, or completely denied access to the report.

To permit USERA to perform actions to the reports of USERB, use the following command:

For RACF:

RDEFINE FACILITY $$CTDACT.qname.USERB UACC(NONE)

PERMIT $$CTDACT.qname.USERB ACCESS(READ) ID(USERA) CLASS(FACILITY)

For TopSecret:

TSS ADD(system-dept) IBMFAC($$CTDACT)

TSS PERMIT(USERA) IBMFAC($$CTDACT.qname.USERB) ACC(READ)

For ACF2/SAF:

SET RESOURCE(CMF)

COMP

$KEY($CTDACT.qname.USERB) TYPE(CMF)

UID(USERA) ALLOW

Limit Immediate Print of Reports

When the user requests immediate print for a report, and the number of pages for the report is more than DPAGMIN, an additional entity is checked. The entity checked is:

Table 49 Report Limits