Authorizing network jobs and SYSOUT (NJE)

This topic contains information about how to use RACF® to ensure that all work entering or leaving your node complies with your installation's security policy. You can control:

Jobs and data received from other nodes in a network, as long as the inbound job or data includes a standard NJE header. This includes jobs or data from an RSCS node.
The extent of security validation performed at your node.
Jobs and data destined for other nodes in a network.

JES does not validate work passing through your node on its way to another node in the network, but it does protect the work from unauthorized access while the work is temporarily stored on spool at your node.

To provide security for network job entry (NJE), activate the NODES class (for inbound work) or the WRITER class (for outbound work), and define the profiles needed to enforce your installation's NJE security policy. Define the appropriate security labels and ensure that compatible SECLABEL system options (using the SETROPTS command) are active on all member nodes in the NJE network.

Consult with your JES system programmer to determine what type of protection is needed for your NJE network and to obtain the information you need to correctly define these profiles. Together, you should decide whether you want to protect inbound work, outbound work, or both. For inbound work, decide whether you want to protect jobs, SYSOUT, or both. You must also determine which users and groups of users can submit work and which security labels are valid for processing on your node.