Define SAF profiles to control access to collection data

Edit online

Create SAF resource profiles to control access to real-time or historical collection data when using TEMS REST services.

Before you begin

TEMS REST services endpoint GET /data allows you to request collection data. For an example, see Requesting collection data.

Security for TEMS REST services requires a SAF general resource class named $KOBSEC. For more information, review Securing TEMS REST services.

By default, all requests to retrieve collection data are allowed unless SAF profiles are defined that restrict access.
Note: If you use $KOBSEC as the SAF general resource class for your OMEGAMON® enhanced 3270 user interface (enhanced 3270UI) security, the same authorizations that have been defined for query access to data sources in the enhanced 3270UI apply when retrieving collection data using TEMS REST services. The enhanced 3270UI uses the same naming structure for its query profiles as TEMS REST services uses for its collection data profiles (which are described in this topic). For information about the enhanced 3270UI query profiles, see Define query profiles to control access to data sources.

About this task

The authority to request collection data using TEMS REST services endpoint GET /data is verified by checking for access to a SAF resource named in the following pattern: 
Kpp.node_name.table_name

where

Kpp
Is the product code of the agent instance. For example, for OMEGAMON AI for z/OS, the product code is KM5. See Product codes for other products.
Important: For OMEGAMON AI for CICS, you must use value OMCICS instead of the typical product code KCP.
node_name
Is the name of the node, which is a managed system name. A managed system name typically identifies a unique Tivoli Enterprise Monitoring Server agent instance. Note that the form of managed system names differs from product to product. Check the agent-specific documentation for information about the form used for managed system names.
table_name
Is the name of the table defined within the product agent.

You must create a SAF profile to match the resource. If a matching SAF profile does not exist to protect a given resource, the request is allowed.

As an example, suppose you want to control the ability to issue a request to an OMEGAMON AI for z/OS agent running on Sysplex IBMTEST on Sysplex member TSTA, for table LPCLUST. You would define a profile named KM5.IBMTEST:TSTA:MVSSYS.LPCLUST by entering the following command, which restricts all access to the resource for all users: 
RDEFINE $KOBSEC KM5.IBMTEST:TSTA:MVSSYS.LPCLUST UACC(NONE)
More generally, you could define the profile using the asterisk (*) wildcard to restrict all collection data requests for a specific product on a specific node: 
RDEFINE $KOBSEC KM5.node_name.* UACC(NONE)

You can then give access to the profiles for individual users or user groups.

Procedure

  1. For each resource to protect, enter the following commands in RACF: 
    RDEFINE $KOBSEC Kpp.node_name.table_name UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH

    These commands restrict access to all users.

  2. To permit access to individual users, enter the following command in RACF: 
    PERMIT Kpp.node_name.table_name ID(userid) ACCESS(READ) CLASS($KOBSEC)