Top Secret

Does anyone have experience with this Product?  CA translated the RACF commands to Top Secret but when the System Programmer brings up the product the IDs are receiving a violation that they need access to the facility Started Task.  Additionally, our company policy requires a password on the WSGUEST ID with access to an isolated group and OMVS (USS) which is like a secondary auth ID which may also be an issue.  Also, the Resource Class EJBROLE in the RDT table has DEFACC of all is there a way to change it?  We have not defined any digital certificates for this product yet and trying to use SAF security.  The closest product definition that we have seen is ZOSMF.  We are trying to this install and continue to run into issues.   

Mike,

You need to assign a FACILITY to the started task.

See the following knowledge document for creating a FACILITY. The example is for RDZ, but can be used for any application. You just need to change the FACILITY name to what you want and the program name you are using.

To add a password and GROUP, issue a :

TSS ADD(WSGUEST) PASSWORD(xxxxxxxxxx)

TSS ADD(WSGUEST) GROUP(xxxxxxxx)

Why do you want to change the access level for EJBROLE? You either have access to it or you dont.

Here is the TSS LIST(RDT) for the EJBROLE resource class:

tss list(Rdt) resclass(ejbrole)

ACCESSORID = *RDT* NAME = RESOURCE DEFINITIONS

RESOURCE CLASS = EJBROLE
RESOURCE CODE = X'068' POSIT = 568
ATTRIBUTE = MASKABLE,MAXOWN(26),MAXPERMIT(246),ACCESS,PRIVPGM,MIXCASE
ACCESS = NONE(0000),ALL(FFFF)
DEFACC = ALL
TSS0300I LIST FUNCTION SUCCESSFUL
READY

There are 2 access level, ALL or NONE.

Currently if you dont specify an ACCESS Level on a PERMIT, ALL will be used as the default access level.

Setting the DEFACC(NONE) would not make sense.

Regards,

Joseph Porto - CA Level 1 Support

Thank you.  I was re-examining the violations and researching the product documentation.  Not sure how many other businesses are using this but when I have the facility defined; the RACF to TOP Secret documentation for the ZOS Connect should probably be updated to include the facility.  The zOS Connect documentation states once a Liberty Angel  Started task is created if you are using another product such as zOSMF the STC does not have to be redefined just modified.  Thank you.

Joe,

One additional comment for ZOS Connect the EJBROLE information in the RACF command has ACCESS READ for the permit.  That is why I asked.