General Information

RACF (Resource Access Control Facility) from IBM is a security system that governs all access to computer resources, such as files (referred to as "datasets" in this section), programs, terminals, and CICS transactions on MVS. Each time a user attempts to access a dataset, RACF checks the security profile for that dataset. If the user has not been given authorization to access the dataset or if no security profile has been created for the dataset, RACF fails the user's request. Each user owns all the profiles for each of his/her datasets and, through SECURE, can add, delete, modify, and list those profiles. In addition, account administrators have full control over users and dataset profiles within their group and, thus, may grant themselves access to any datasets created by subaccount users.

Maintaining RACF Profiles With SECURE

If you want to allow another user to access one or more of your datasets, you must use SECURE to add profile(s) for each dataset. You may also add generic profiles that describe more than one dataset by using "wildcard" characters. SECURE is run as a batch job on MVS, which means that you put a copy of the required JCL and RACF commands in your active file and enter the WYLBUR command RUN or RUN FETCH. You can use TECH SECURE, a WYLBUR exec file, to build the required SECURE job in your active file for you, or you can write the SECURE job yourself. Below is an example of a SECURE job, where user ABCDE creates a profile to allow user FGHIJ to access a dataset owned by ABCDE. (Note spacing.)

RACF Commands

The RACF commands used to maintain RACF profiles are ADDSD, ALTDSD, DELDSD, LISTDSD, and PERMIT. RACF commands can begin in any column and are continued to subsequent lines by placing a hyphen (-), preceded by a space, as the last two characters in the line to be continued. The operands of the commands are separated by spaces or commas (see RACF Command Syntax for examples).

Generic Dataset Profile Names

A dataset profile can be a generic dataset name describing several similarly named datasets by using generic or wildcard characters in the dataset name. The generic (wildcard) characters allowed are described below.

Qualifiers

Qualifiers in a dataset name follow standard MVS naming conventions (each qualifier is separated by a period and can be no longer than eight characters, with the total dataset name no longer than 44 characters).

Examples:

WYL.AB.CDE.LIB%%           matches to  WYL.AB.CDE.LIB12
                                   or  WYL.AB.CDE.LIBAB
                    does not match to  WYL.AB.CDE.LIB345
                                   or  WYL.AB.CDE.LIB.TEST
                                   or  WYL.AB.CDE.LIB12.TEST

WYL.AB.CDE.LIB*            matches to  WYL.AB.CDE.LIB
                                   or  WYL.AB.CDE.LIB12
                    does not match to  WYL.AB.CDE.LIB.TEST

WYL.AB.CDE.LIB*.**         matches to  WYL.AB.CDE.LIB
                                   or  WYL.AB.CDE.LIB12
                                   or  WYL.AB.CDE.LIB.TEST
                                   or  WYL.AB.CDE.LIB.TEST.DATA

Note that the single "*" matches zero or more characters in a single qualifier. The double "**" matches zero or more qualifiers until the end of the dataset and, if specified, must be typed at the end of the dataset name (e.g., WYL.AB.CDE.LIB**.TEST would not be recognized by RACF as a generic name).

Dataset profile names must begin with the standard WYLBUR prefix WYL., followed by your group and userid (e.g., WYL.GG.UUU.LIB, where GGUUU is your userid). RACF only recognizes generic characters after the WYL.GG.UUU. prefix so that WYL.GG.U%%.LIB would not be recognized by RACF as a generic name.

RACF Command Syntax

ADDSD and ALTDSD

The ADDSD and ALTDSD commands add or modify (alter) a dataset profile. The dataset itself is created separately using WYLBUR or JCL. The dataset name can be a generic name describing several datasets by using the wildcard characters *, **, or %. Once a profile for a dataset is added, any number of PERMIT commands can be issued to allow access to the dataset by other users. Syntax:

                                   ADDSD profile-name                     -
                                         OWNER(userid)                   -
                                         UACC(universal-access-authority)

The example below adds a profile for any of ABCDE's datasets beginning with WYL.AB.CDE.LIB.:

The syntax for the ALTDSD is exactly the same and may be issued to change the OWNER or UACC for the dataset but not the profile name.

PERMIT

The PERMIT command adds or deletes an entry from the "access list" of a dataset profile. The access list tells RACF what users are allowed to access the dataset or datasets described by the profile and the type of access allowed by those users. Syntax:

                                PERMIT profile-name                 -
                                       ACCESS(access-auth)|DELETE  -
                                       ID(userid|groupname|*)      -
                                       FROM(profile-name2)          -
                                       RESET

Examples:

DELDSD

DELDSD deletes a profile and its access list. Syntax:

Example:

LISTDSD

LISTDSD lists a profile and its access list. Syntax:

                               LISTDSD DATASET(profile-name)|
                                       ID(user|group)|         -
                                       PREFIX(dsn-prefix)       -

The DATASET, ID, and PREFIX operands are mutually exclusive.

Examples:

Site Search Options

Select and Press Go Go to Introduction Getting Started Libraries and System Messages Account Security on WYLBUR Command Summary Glossary Index