LISTUSER (List user profile)

Purpose

Use the LISTUSER command to list the details of specific RACF® user profiles. A user profile consists of a BASE segment and, optionally, other segments such as TSO and DFP. The LISTUSER command provides you with the option of listing the information contained in the entire user profile (all segments), or listing the information contained only in specific segments of the user profile.

You cannot use the LISTUSER command to list information about user ID associations; you must use the RACLINK command.

Details about listing the password and password phrase change interval: Users will always have a password interval but may or may not have a password phrase interval value. When a user does not have a password phrase interval value set the password interval value is used as both the password interval and password phrase interval. In this case, LISTUSER will not list the user’s PHRASE INTERVAL value.

Issuing options

The following table identifies the eligible options for issuing the LISTUSER command:

For information on issuing this command as a RACF TSO command, refer to RACF TSO commands.

For information on issuing this command as a RACF operator command, refer to RACF operator commands.

You must be logged on to the console to issue this command as a RACF operator command.

Related commands

• To list a group profile, see LISTGRP (List group profile).
• To list a data set profile, see LISTDSD (List data set profile).
• To list a general resource profile, see RLIST (List general resource profile). (General resources include terminals, and other resources defined in the class descriptor table.)
• To list information about user ID associations, see RACLINK (Administer user ID associations).
• To obtain a list of user profiles, see SEARCH (Search RACF database).

Authorization required

When issuing this command as a RACF operator command, you might require sufficient authority to the proper resource in the OPERCMDS class. For details about OPERCMDS resources, see Controlling the use of operator commands in z/OS Security Server RACF Security Administrator's Guide.

To specify the AT keyword, you must have READ authority to the DIRECT.node resource in the RRSFDATA class and a user ID association must be established between the specified node.userid pair(s).

To specify the ONLYAT keyword you must have the SPECIAL attribute, the userid specified on the ONLYAT keyword must have the SPECIAL attribute, and a user ID association must be established between the specified node.userid pair(s) if the user IDs are not identical.

If you have the AUDITOR or ROAUDIT attribute, or the profile is within the scope of a group in which you the group-AUDITOR attribute, RACF also lists the value of the UAUDIT/NOUAUDIT operand.

Parameters

subsystem-prefix

Specifies that the RACF subsystem is the processing environment of the command. The subsystem prefix can be either the installation-defined prefix for RACF (1 - 8 characters) or, if no prefix has been defined, the RACF subsystem name followed by a blank. If the command prefix was registered with CPF, you can use the MVS™ command D OPDATA to display it or you can contact your RACF security administrator.

Only specify the subsystem prefix when issuing this command as a RACF operator command. The subsystem prefix is required when issuing RACF operator commands.

userid | *

userid

Specifies the user ID of one or more RACF-defined users. If you specify more than one user ID, you must enclose the list of user IDs in parentheses.

*

Specifies that you want to list information contained in all RACF-defined user profiles to which you have the required authority.

Important: On a system with many users defined, the use of * might result in a large amount of output and might not be useful to a user issuing the command. It might be more appropriate for the user to browse the output of IRRDBU00 (database unload) or to write a program to process the IRRDBU00 output and produce a report showing only the subset of information that is of interest to the user. The processing of output of LISTUSER by programs is not supported nor recommended by IBM®. If you want a listing of all the groups for use by a program you should instead have the program process the output from IRRDBU00, RACROUTE REQUEST=EXTRACT, or ICHEINTY.

The userid value or an asterisk (*) must be specified if you specify any other operand in the LISTUSER command, and must be the first operand following LISTUSER.

If you enter LISTUSER and specify one or more user IDs, or an asterisk (*), without specifying an additional operand, RACF lists only the BASE segment information from the specified profiles.

If you enter only LISTUSER, RACF lists only the BASE segment information from your own user profile.

Note: You cannot use the LISTUSER command for user IDs that have mixed-case characters, such as irrcerta, irrsitec, and irrmulti (which are associated with digital certificates).

AT | ONLYAT

The AT and ONLYAT keywords are only valid when the command is issued as a RACF TSO command.

AT([node].userid ...)

Specifies that the command is to be directed to the node specified by node, where it runs under the authority of the user specified by userid in the RACF subsystem address space.

If node is not specified, the command is directed to the local node.

ONLYAT([node].userid ...)

LISTUSER is not eligible for automatic command direction. If you specify the ONLYAT keyword, the effect is the same as if you specified the AT keyword.

CICS

Specifies that you want to list the information contained in the CICS segment of the user's profile.

The details RACF lists from the CICS segment of the user's profile are:

• The classes assigned to this operator to which BMS messages are sent.
  Note: The values of the classes are listed in a three digit format, even though a maximum of two digits are used to define the value.
• Whether the operator are forced off when an XRFSOFF takeover occurs.
• The operator identification.
• The priority of the operator.
• The time in hours and minutes that the operator is allowed to be idle before being signed off.
• Resource security level (RSL) keys, if any are assigned to the user. If 99 is displayed, this indicates that all RSL keys are assigned to the user (1 - 24, inclusive). If 0 is displayed, no RSL keys are assigned to the user.
• Transaction security level (TSL) keys, if any are assigned to the user. If 99 is displayed, this indicates that all TSL keys are assigned to the user (1 - 64, inclusive). If 0 is displayed, no TSL keys are assigned to the user.

CSDATA

Specifies that you want to list custom field information for this user. The custom field information in the CSDATA segment for this user was added using the ADDUSER and ALTUSER commands.

Usage for each custom field is defined using the CFDEF operand of the RDEFINE command for resource profiles in the CFIELD class. Contact your security administrator to see how custom fields are used at your installation. For more information about custom fields, see z/OS Security Server RACF Security Administrator's Guide.

DCE

Specifies that you want to list the information contained in the DCE segment of the user's profile.

The details that RACF lists from the DCE segment are:

• The DCE universal unique identifier
• The DCE principal name
• The DCE home cell name
• The DCE home cell universal unique identifier
• The DCE AUTOLOGIN indicator.

If there is no DCENAME or HOMECELL for this segment, the field name is not displayed. However, if UUID or HOMEUUID was not specified when the DCE segment was added to the user profile, the word NONE appears in the listing.

DFP

Specifies that you want to list the information contained in the DFP segment of the user's profile.

The details RACF lists from the DFP segment of the user's profile are:

• The user's default data class
• The user's default management class
• The user's default storage class
• The data management data application for the user.

EIM

Specifies that the Enterprise Identity Mapping (EIM) segment information should be listed.

KERB

Specifies that you want to list the information contained in the KERB segment of the user's profile.

The details that RACF lists from the KERB segment of the user's profile are:

• The encryption value settings (ENCRYPT values or NOENCRYPT)
• The local kerberos-principal-name (KERBNAME)
• The max-ticket-life associated with this local principal (MAXTKTLFE)
• The current z/OS Network Authentication Service key version (KEY VERSION)
• The authenticator used to generate the current user's z/OS Network Authentication Service keys (KEY FROM)
  • When PASSWORD is displayed, the current keys were derived from the user's password.
  • When PHRASE is displayed, the current keys were derived from the user's password phrase.

LANGUAGE

Specifies that you want to list the information contained in the LANGUAGE segment of the user's profile.

The 3-character language code and, if defined, the 24-character language name, is displayed. NOT SPECIFIED indicates that no language has been specified.

If the code is displayed without a name, one of the following is true:

• The MVS message service was not active
• The language was not active.

If the language code equals the language name, one of the following is true:

• There was no language name defined on your system
• The language name was defined to be the same as the language code.

The details RACF lists from the LANGUAGE segment of the user's profile are:

• The user's primary language, if one has been specified
• The user's secondary language, if one has been specified.

LNOTES

Specifies that you want to list the information for the Lotus® Notes® for z/OS short-name, which is contained in the LNOTES segment of the user's profile.

MFA

Specifies that multi-factor authentication information should be listed for the user. The MFA keyword is ignored when NORACF is specified.

NDS

Specifies that you want to list the information for the Novell Directory Services for OS/390® user-name, which is contained in the NDS segment of the user's profile.

NETVIEW

Specifies that you want to list the information contained in the NETVIEW segment of the user's profile.

The details RACF lists from the NETVIEW segment of the user's profile are:

• The command or command line to be processed by NetView® for this operator
• The default MCS console identifier
• Whether security checking should be done for this NetView operator
• Whether this operator can receive unsolicited messages
• The count of operator class values
• The list of NetView scope classes for which this operator has authority
• The number of domains this NetView operator controls
• The list of identifiers of NetView programs in another NetView domain for which this operator has authority
• Whether this operator has administrator authority to the NetView Graphic Monitor Facility (NGMF).

If there is no information in the fields of the NETVIEW segment, the field name is not displayed (with the exception of SIZE, MAXSIZE, and USERDATA).

NORACF

Specifies that you want to suppress the listing of BASE segment information from the user's profile.

If you specify NORACF, you must also specify at least one segment name.

The information displayed as a result of using the NORACF operand is dependent on other operands used in the command. For example, if you use NORACF with TSO or DFP also specified, only that information (TSO or DFP) is displayed. User profiles that do not have at least one of the specified segments appear in the command output.

The information displayed as a result of using the NORACF operand is dependent on other operands used in the command. For example, if you use NORACF with TSO or DFP also specified, only that information (TSO or DFP) is displayed.

When you specify an asterisk (*) in place of the user ID, only user profiles with at least one of the specified segments appear in the command output. (See userid for an important note about specifying an asterisk with the LISTUSER command.)

If you do not specify NORACF, RACF displays the information in the BASE segment of a user profile.

OMVS

Specifies that you want to list the information contained in the OMVS segment of the user's profile.

The details RACF lists from the OMVS segment are:

• The user identifier
• The initial directory path name
• The program path name
• The CPU time, in seconds, the user's processes can use
• The address space region size, in bytes, the user's processes can use
• The maximum number of active or open files the user can have
• The maximum number of active processes the user can have
• The maximum number of threads the user can have
• The maximum amount of space, in pages, the user can map in storage.

Note: If CPUTIMEMAX, ASSIZEMAX, FILEPROCMAX, PROCUSERMAX, THREADSMAX, or MMAPAREAMAX is not specified, or is removed with the ALTUSER command, the word NONE appears in the listing. In such situations, z/OS UNIX uses its system level values for limit values.

If there is no HOME or PROGRAM information, the field name is not displayed. However, the word NONE appears in the listing if the UID was not specified, or if the UID was removed using the NOUID operand on the ALTUSER command.

OPERPARM

Specifies that you want to list the information contained in the OPERPARM segment of the user's profile.

The details RACF lists from the OPERPARM segment of the user's profile are:

• The alternate console group (ALTGRP)
• The operator authority (AUTH)
• Whether the console receives messages that can be automated in a sysplex environment.
• The system name for commands from this console (CMDSYS)
• Whether, and what kind of, delete operator messages are received (DOM)
• The searching key (KEY)
• The message level information (LEVEL)
• Whether system command responses are logged (LOGCMDRESP)
• The message format (MFORM)
• Whether this console is assigned a migration ID (MIGID)
• Event information (MONITOR)
• The systems this console can receive undirected messages from (MSCOPE)
• Routing code information (ROUTCODE)
• Storage information (STORAGE)
• Whether this console receives undeliverable messages (UD).

If there is no information in a field in the user's profile for this segment, the field name is not displayed. However, if no value was specified for STORAGE when the OPERPARM segment was added to the user profile, STORAGE=0 appears in the listing.

OVM

Specifies that you want to list the information contained in the OVM segment of the user's profile.

The details that RACF lists from the OVM segment are the z/OS UNIX System Services user's:

• User identifier
• Initial directory path name
• Program path name
• File system root name.

If there is no HOME, PROGRAM, or FSROOT information, the field name is not displayed. However, the word NONE appears in the listing if the UID was not specified, or if the UID was removed using the NOUID operand on the ALTUSER command.

PROXY

Specifies that PROXY segment information should be listed.

The BINDPW password value will not be listed. If a BINDPW password value is defined for a user, LISTUSER will display YES for the PROXY segment BINDPW attribute. If no BINDPW password value has been defined, LISTUSER will display NO for the PROXY segment BINDPW attribute.

TSO

Specifies that you want to list the information contained in the TSO segment of the user's profile.

The details RACF lists from the TSO segment of the user's profile are:

• The user's default account number when logging on from the TSO/E logon panel
• The destination ID for SYSOUT data sets
• The user's default HOLDCLASS
• The user's default JOBCLASS
• The user's default MSGCLASS
• The user's default SYS
• The maximum region size
• The default region size
• The logon procedure name
• The unit name
• The optional user data
• The user's security label
• The default command to be run during the TSO/E logon.

If there is no information in the fields of the TSO segment, the field name is not displayed (with the exception of SIZE, MAXSIZE, and USERDATA).

WORKATTR

Specifies that you want to list the information contained in the WORKATTR segment of the user's profile.

The details RACF lists for the distribution information from the user's WORKATTR segment are:

• The name of the user (WANAME)
• The building (WABLDG)
• The department (WADEPT)
• The room (WAROOM)
• Up to four additional lines of output distribution information (WAADDRn)
• An account number for APPC/MVS processing (WAACCNT).
• An e-mail address for the user (WAEMAIL).