Customizing the SAF exit

There are two ways to customize the SAF exit: by applying a USERMOD to change the resource class name or to verify commands from consoles along with those from the ISPF interface or the batch utility, or by creating a custom exit.

• The SAF Exit USERMOD

  USERMODs have been provided to allow you to include commands from consoles in the authority check and to modify the resource class name used for SAF authority verification. Both SMP/E (SMPXSAF1) and a non-SMP/E (ZAPXSAF1) versions of the console command USERMOD are available in HLQ.IBM.HGZD341.SGZDSAMP. There are SMP/E (SMPXSAF2) and non-SMP/E (ZAPXSAF2) versions of the resource class name USERMOD in HLQ.IBM.HGZD341.SGZDSAMP as well. These USERMODs must be re-applied if the SAF exit changes as a result of maintenance. If the SMP/E USERMODs are used, the maintenance report will indicate that they are regressed. If the non-SMP/E USERMODs are used, you need to determine if there has been maintenance to GZDXSAF.

• The SAF Exit Sample Program

  A sample SAF exit program has been provided as member GZDXSAF in HLQ.IBM.HGZD341.SGZDSAMP. Although this sample program is not identical to the default program that is shipped with the zDMF product, it is functionally equivalent. The API between the command processor task and the SAF exit is defined by the SAF Authorization Block, which is mapped by GZDSAFB. A copy of the SAF Authorization Block definition is provided as member GZDSAFB in HLQ.IBM.HGZD341.SGZDSAMP.