Enable RACF authorization of Take Action commands

Edit online

As of fix pack 1 for IBM Tivoli Monitoring Version 6.2.3, all z/OS® Take Action commands issued by the OMEGAMON agents, plus any other agents based on the Tivoli Management Services framework that run on z/OS, can now be associated with the Tivoli Enterprise Portal user ID instead of the user ID of the started task running the agent. Using the user ID allows you to authorize the use of Take Action commands by individual portal server users while restricting it from others. You can secure these user IDs (or the RACF® groups they are in) using standard security objects provided by your site's security product. For RACF, these are the OPERCMDS facility class and its profiles.

Note: This enhancement does not alter the existing behavior of the following commands:
  • Prefix-style Take Action commands such as those issued by OMEGAMON AI for CICS and prefixed with CP:. These are still secured by the agent-specific security profiles set up for that purpose.
  • Commands already protected by the OMEGAMON® NetView® Take Action command security facility.
  • Commands issued by the OMEGAMON® classic interfaces and covered by their command security.

Before you begin

Before activating this feature, you also must ensure that every Tivoli Enterprise Portal user ID (and the RACF groups that contain it) that either manually invokes Take Action commands or indirectly invokes them via situations or policies are connected to the appropriate RACF OPERCMDS profiles. Otherwise, RACF may fail some of your z/OS Take Action commands.
If your Tivoli Enterprise Portal user IDs are not currently set up in RACF (for example, if you're using distributed LDAP to authenticate your site's Tivoli Enterprise Portal user IDs), you must either:
  • Add your Tivoli Enterprise Portal user IDs to RACF, and connect them to the appropriate OPERCMDS profiles.
  • Use the user ID mapping capability (as described in Setting up the user ID mapping capability) to map Tivoli Enterprise Portal user IDs to new or existing RACF user IDs that you will connect to the appropriate OPERCMDS profiles.

About this task

As initially installed, z/OS Take Action commands are associated with the user ID of the agent started task (the previous behavior). Use the following procedure to take advantage of the new security behavior for all agents in a particular runtime environment.

All successful and failed command executions create entries in the console log. The agent also creates audit records for all automation command actions. On z/OS, these audit records are written to the SMF audit repository (as described in Auditing).

  1. The user ID that last updated an enterprise situation or a policy is the user ID that gets authenticated for the Take Action command associated with the situation or policy.
  2. The user ID defined in the <LSTUSRPRF> segment for a private situation is the user ID that gets authenticated for the Take Action command associated with the situation. If the segment is not defined, the default user ID is AGENTCFG.

Procedure

  1. Create a new member called KGLUMAP in your RKANPARU data set.
  2. Add at least a one-line comment such as the following to the new member: 
    * z/OS Take Action commands now secured
    This turns on the new security feature so that all z/OS Take Action commands issued by all agents in this runtime environment will be associated with the Tivoli Enterprise Portal user ID instead of the started task user ID.
  3. To revert to the old behavior of using the user ID of the started task as the issuer of the z/OS commands for a particular agent (while retaining the new behavior for other agents), place the following line in the appropriate KxxENV member in RKANPARU, where xx is the two-character agent identifier: 
    KGL_COMMAND_AUTHOR_SECURITY_REQUIRED=N