Role-based access control (RBAC)

Edit online

Creating RACF user profiles and groups with different levels of authorization is a simple way of implementing RBAC for your IZSME® users.

Note: When you enable RBAC, make sure to provide access to the IZSME plug-in for all roles that need access by editing the allowedPlugins.json file. For details on how to do this, see Controlling app access for all users in the Zowe® documentation.

In IZSME, a configuration is a combination of a specific TEPS and HTEMS. After you start IZSME, you can display the current configurations, which are displayed on the Settings panel, by clicking the gear icon:

Settings panel showing IZSME configurations

Under this heading, the panel lists all the configurations currently set up in your environment, with the specific TEPS database host, primary TEMS origin node, and other specifications.

The following example shows how IZSME RACF groups can be set up for different roles:

  • IZSMEADM - group for application administrators
  • IZSMEUSR - group for application users

These groups represent the "roles" in Role Based Access Control. If you have two TSO IDs set up for yourself, add your "administrator" TSO ID to IZSMEADM and your "general user" ID to IZSMEUSR.

These are the general application profiles for all users (user IDs that are in both the IZSMEUSR and IZSMEADM groups):

  • ZLUX.*.*.COM_RS_CTDS_COMMON.**

  • ZLUX.*.*.COM_RS_MVD_CTDS.**

  • ZLUX.*.*.COM_RS_DISCOVERY_BASE.**

  • ZLUX.*.*.COM_RS_TEP_QUERYHANDLER.**

  • ZLUX.*.*.COM_RS_OM_WEBPORTAL.**

These profiles are for application administrators only (IZSMEADM group):

  • ZLUX.*.SVC.COM_RS_OM_WEBPORTAL.CONFIG.PUT.** - API for changing configuration file
  • ZLUX.*.SVC.COM_RS_TEP_QUERYHANDLER.SECURECONFIG.PUT.** - API for changing configuration file
  • ZLUX.*.SVC.COM_RS_OM_WEBPORTAL.QUERYHANDLER.POST.JAVALOGLEVEL - API for changing log level for JavaSidecar
  • ZLUX.*.COR.** - Zowe API for administrators