Configure RACF services for the DCAS

This section describes how to configure RACF services for the DCAS, including the following three subtopics:

Define a User ID as superuser to OMVS Services
Provide a User ID with Access to MVS.SERVMGR.DCAS
Provide a RACF Definition for MVS Startup

For information on RACF commands, refer to https://www.ibm.com/docs/en/zos/3.1.0?topic=racf-zos-security-server-command-language-reference.

In the following example RACF commands, italicized items should be replaced with values appropriate for your environment. Refer Setting up RACF for DCAS for more details.

Define a User ID as superuser to OMVS Services

The DCAS server runs as a system daemon and must be started under a controlled user ID that has superuser authority (meaning, not an end-user or system programmer user ID). To define the user ID to use OMVS services, use the following command:

ADDUSER dcasid DFLTGRP(OMVSGRP) OMVS(UID(0) HOME('/'))

where dcasid is the name of the user ID.

Provide a User ID with Access to MVS.SERVMGR.DCAS

Starting the DCAS from an MVS procedure requires that the user ID from which it is started have access to the MVS.SERVMGR.DCAS resource in the OPERCMDS class. To provide this access, use the following commands:

RDEFINE OPERCMDS (MVS.SERVMGR.DCAS) UACC(NONE)
PERMIT MVS.SERVMGR.DCAS CLASS(OPERCMDS) ACCESS(CONTROL) ID(dcasid)

where dcasid is the name of the user ID.

SETROPTS RACLIST(OPERCMDS) REFRESH

Provide a RACF Definition for MVS Start-up

If DCAS is started as an MVS procedure, you will need the following RACF definition:

RDEFINE STARTED DCAS.* STDATA(USER(dcasid))SETROPTS RACLIST(STARTED) REFRESH

where dcasid is the name of the user ID.

If CLIENTAUTH LOCAL2 is coded in the DCAS configuration file, at a minimum, you must use RACF to associate the certificate with a valid user ID. You can do this using the RACDCERT ADD command. The user ID could be the one associated with the DCAS itself or it could be any valid user ID. If you want additional checking, you must activate the SERVAUTH class and define an EZA.DCAS.cvtsysname profile with the user ID associated with the client certificate to access the profile.