Define SAF profiles to control Take Action permissions

Create SAF resource profiles to control Take Action permissions when using TEMS REST services.

Before you begin

TEMS REST services allows you to interact with Take Action command definitions. By default, all requests to interact with Take Action commands are allowed unless SAF profiles that restrict access are defined.

Security for TEMS REST services requires a SAF general resource class named $KOBSEC. For more information, review Securing TEMS REST services.

About this task

TEMS REST services verifies the authority to interact with Take Action command definitions by checking for access to the SAF resources, as follows:

Table 1. TEMS REST services endpoints and SAF resources for Take Action command definitions
Description of request	Method	Endpoint	Resource pattern	Access required
Retrieve Take Action command definitions	`GET`	`/system/actions`	`O4SRV.ACTIONS.Kpp.name`	`READ`
Edit Take Action command definitions	`PATCH`	`/system/actions`	`O4SRV.ACTIONS.Kpp.name`	`UPDATE`
Create Take Action command definitions	`PUT`	`/system/actions`	`O4SRV.ACTIONS.Kpp.name`	`UPDATE`
Delete Take Action command definitions	`DELETE`	`/system/actions`	`O4SRV.ACTIONS.Kpp.name`	`ALTER`
Execute a Take Action	`POST`	`/system/actions/execute`	`O4SRV.ACTIONS.EXECUTE.Kpp.name`	`READ`

where:

O4SRV: Is a literal. O4SRV is a qualifier for monitoring server tables.
ACTIONS: Is a literal. Use ACTIONS for controlling permissions to interact with Take Action definitions.
EXECUTE: Is a literal qualifier value. Use EXECUTE for controlling permissions when executing a Take Action.
Kpp: Is the product code of the agent instance, or KCN for user-defined Take Action commands. For example, for OMEGAMON® for z/OS®, the product code is KM5. See for other products.
Note: CN is a product code for OMNIMON Base (which includes the OMEGAMON enhanced 3270 user interface and OMEGAMON Subsystem). This code is also used for user-defined Take Action commands and might be present (if applicable) in the NAME field of a GET /system/actions response.
name: Is the NAME field value of a GET /system/actions response. The product code appears as the first two characters. For example: CNP_1211927952798

You must create a SAF profile to match the resource. If a matching SAF profile does not exist to protect a given resource, the request is allowed.

To control permission for a specific Take Action, you must provide unique identifying information for the resource when defining the profile. To locate this information, prior to restricting access, use the GET /system/actions endpoint to retrieve details about the existing definitions. The response exposes the necessary information in the NAME field.

As an example, a GET /system/actions request returns the following response, which includes the NAME field:

[
  {
    "ID": "%IBM.STATIC051",
    "STATICID": "0000000080000000000000000000000004000H468f0",
    "DISPLAYTEXT": "Tivoli Enterprise Monitoring Server",
    "PRODUCTCODE": "KM5",
    "SYMBOL": "CMS",
    "SUBAFFINITIES": [
      {
        "ID": "%IBM.STATIC051",
        "STATICID": "0000000080000000000000000000000004000H468f0",
        "DISPLAYTEXT": "Tivoli Enterprise Monitoring Server",
        "PRODUCTCODE": "KM5",
        "SYMBOL": "CMS"
      }
    ],
    "VERSION": 3,
    "FULLNAME": "test_action",
    "CMD": "NT:AMS_Start_Manage &KCA_Agent_Availability_Management_Status.PAS_Agent_Name",
    "DESC": "test action",
    "NAME": "CNP_1211927952798"
  }
]

In this example, the PRODUCTCODE value is KM5, but the NAME value is CNP_1211927952798, indicating that this Take Action command is user-defined. You define the SAF resource profiles for this Take Action as follows:

To restrict retrieving, editing, and deleting this Take Action command definition:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.KCN.CNP_1211927952798 UACC(NONE)
```
More generally, you could define the profile using the asterisk (*) wildcard to restrict retrieving, editing, creating, and deleting any Take Action command definition:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.** UACC(NONE)
```
To restrict editing and deleting but allow retrieving this Take Action command definition:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.KCN.CNP_1211927952798 UACC(READ)
```
More generally, you could define the profile using the asterisk (*) wildcard to restrict editing, creating, and deleting but allow retrieving any Take Action command definition:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.** UACC(READ)
```
Note: To allow users to edit or create Take Action command definitions, you must provide UPDATE access.
To restrict deleting but allow retrieving and editing this Take Action command definition:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.KCN.CNP_1211927952798 UACC(UPDATE)
```
More generally, you could define the profile using the asterisk (*) wildcard to restrict deleting but allow retrieving, editing, and creating any Take Action command definition:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.** UACC(UPDATE)
```
To restrict executing this Take Action:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.EXECUTE.KCN.CNP_1211927952798 UACC(NONE)
```
More generally, you could define the profile using the asterisk (*) wildcard to refuse permission to execute any Take Action:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.EXECUTE.** UACC(NONE)
```

Important: If you enable security for the OMEGAMON enhanced 3270 user interface using SAF profiles in the $KOBSEC resource class, consider the following cases:

You might define resource profile O4SRV.** with UACC(NONE) to secure near-term history in the enhanced 3270UI. If this profile exists in your $KOBSEC resource class, it would overrule the profiles for accessing your Take Action command definitions using TEMS REST services. If this is the case, define the following profiles to allow the use of TEMS REST services to interact with all Take Action command definitions before restricting access to specific resources:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.** UACC(ALTER)
```
```
RDEFINE $KOBSEC O4SRV.ACTIONS.EXECUTE.** UACC(READ)
```
If you use resource profile Kpp.msn.TAKEACTION to secure the use of Take Action commands in the enhanced 3270UI, this profile also applies when executing a Take Action in TEMS REST services.

Procedure

For each resource to protect, enter the following commands in RACF:
- To restrict retrieving, editing, and deleting a Take Action command definition:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.Kpp.name UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH
```
  Note: To restrict editing and deleting but allow retrieving a Take Action command definition, use access READ.
- To restrict executing a Take Action:
```
RDEFINE $KOBSEC O4SRV.ACTIONS.EXECUTE.Kpp.name UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH
```
These commands refuse access to all users.

To permit access to individual users, enter the following commands in RACF:

To permit retrieving a Take Action command definition:

PERMIT O4SRV.ACTIONS.Kpp.name ID(userid) ACCESS(READ) CLASS($KOBSEC)

To permit editing a Take Action command definition:

PERMIT O4SRV.ACTIONS.Kpp.name ID(userid) ACCESS(UPDATE) CLASS($KOBSEC)

To permit creating a Take Action command definition:

PERMIT O4SRV.ACTIONS.Kpp.name ID(userid) ACCESS(UPDATE) CLASS($KOBSEC)

To permit deleting a Take Action command definition:

PERMIT O4SRV.ACTIONS.Kpp.name ID(userid) ACCESS(ALTER) CLASS($KOBSEC)

To permit executing a Take Action:

PERMIT O4SRV.ACTIONS.EXECUTE.Kpp.name ID(userid) ACCESS(READ) CLASS($KOBSEC)