Define SAF profiles to control permissions for history collection configurations

Edit online

Create SAF resource profiles to control permissions for history collection and history collection configurations when using TEMS REST services.

Before you begin

TEMS REST services allows you to interact with history collection configurations. By default, all requests are allowed unless SAF resource profiles that restrict access are defined.

Security for TEMS REST services requires a SAF general resource class named $KOBSEC. For more information, review Securing TEMS REST services.

About this task

History collection gathers useful metrics about your managed systems. A history collection configuration defines what historical data is collected for particular attribute groups and provides other collection-related settings.

History collection configurations are stored as internal UADVISOR situations. A UADVISOR situation is a special form of situation that is created for internal product use. The name of a UADVISOR situation is in the format UADVISOR_xxxxx.

Note: For information about securing access to user-defined situations or predefined product-provided situations, see Define SAF profiles to control permissions for situations.

TEMS REST services verifies the authority to interact with history collection and history collection configurations by checking for access to the SAF resources, as follows:

Table 1. TEMS REST services endpoints and SAF resources for history collection configurations
Description of request	Method	Endpoint	Resource pattern	Access required
Retrieve history collection configurations	`GET`	`/data/historycollections`	`O4SRV.HISTORYCOLLECTIONS.uadvisor_name`	`READ`
Edit history collection configurations	`PATCH`	`/data/historycollections`	`O4SRV.HISTORYCOLLECTIONS.uadvisor_name` Note: UPDATE access to `O4SRV.HISTORYCOLLECTIONS.*` allows you to edit history collection configurations. You must also have READ access to the target table on the specific node for the collection, which is controlled by the resource `Kpp.node_name.table_name`.	`UPDATE`
Create history collection configurations	`PUT`	`/data/historycollections`	`O4SRV.HISTORYCOLLECTIONS.` Note: UPDATE access to `O4SRV.HISTORYCOLLECTIONS.` allows you to create history collection configurations. You must also have READ access to the target table on the specific node for the collection, which is controlled by the resource `Kpp.node_name.table_name`.	`UPDATE`
Delete a history collection configuration	`DELETE`	`/data/historycollections`	`O4SRV.HISTORYCOLLECTIONS.uadvisor_name`	`ALTER`
Retrieve history collection status information	`GET`	`/data/historycollections/status`	`O4SRV.HISTORYCOLLECTIONS.uadvisor_name`	`READ`
Start history data collection	`POST`	`/data/historycollections/start`	`O4SRV.HISTORYCOLLECTIONS.STARTSTOP.uadvisor_name`	`READ`
Stop history data collection	`POST`	`/data/historycollections/stop`	`O4SRV.HISTORYCOLLECTIONS.STARTSTOP.uadvisor_name`	`READ`

where:

O4SRV: Is a literal qualifier value. O4SRV is a qualifier for monitoring server tables.
HISTORYCOLLECTIONS: Is a literal qualifier value. Use this qualifier for controlling permissions to history collection configurations.
STARTSTOP: Is a literal qualifier value. Use this qualifier for controlling permissions when starting or stopping a history collection.
uadvisor_name: Is the unique name of the history collection configuration in the format UADVISOR_xxxxx. Commonly, Kpp and tablename appear in the name.

To control permission to edit or create a history collection configuration, TEMS REST services verifies the authority to access the target table on the specific node by checking for access to a SAF resource named in the following pattern:

Kpp.node_name.table_name

where:

Kpp: Is the product code of the agent instance. For example, for OMEGAMON® for z/OS®, the product code is KM5. See Product codes for other products.
Important: For OMEGAMON for CICS, you must use value OMCICS instead of the typical product code KCP.
node_name: Is the name of the node, which is a managed system name. A managed system name typically identifies a unique Tivoli Enterprise Monitoring Server agent instance. Note that the form of managed system names differs from product to product. Check the agent-specific documentation for information about the form used for managed system names.
table_name: Is the name of the table defined within the product agent.

Tip: The SAF resource patterns for controlling access to tables are also used when requesting collection data and creating or editing situations. For more information, see Define SAF profiles to control access to collection data and Define SAF profiles to control permissions for situations.

You must create a SAF profile to match the resource. If a matching SAF profile does not exist to protect a given resource, the request is allowed.

As an example, to control the ability to interact with a history collection configuration named UADVISOR_KDP_ANOMALY, you can define the following profiles to restrict all access to the resource for all users:

To restrict retrieving, editing, and deleting the specific history collection configuration and retrieving the history collection status information:
```
RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.UADVISOR_KDP_ANOMALY UACC(NONE)
```
To restrict creating a history collection configuration, define a profile that restricts access to the target table on the specific node. In this example, the OMEGAMON for Db2 agent is running on Sysplex IBMTEST on Sysplex member TSTA and the table is ANOMALY:
```
RDEFINE $KOBSEC KDP.IBMTEST:TSTA:MVSSYS.ANOMALY UACC(NONE)
```

To restrict starting and stopping a specific history collection:

RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.STARTSTOP.UADVISOR_KDP_ANOMALY UACC(NONE)

More generally, you can define the profiles using the asterisk (*) wildcard to restrict all interactions with history collection and all history collection configurations:

To restrict retrieving, editing, creating, and deleting all history collection configurations and retrieving the history collection status information:
```
RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.* UACC(NONE)
```

To restrict starting and stopping all history collections:

RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.STARTSTOP.* UACC(NONE)

To restrict all interactions with history collection and all history collection configurations:
```
RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.** UACC(NONE)
```

You can then give access to the profiles for individual users or user groups.

Important: When enabling security for the OMEGAMON enhanced 3270 user interface, you might define resource profile O4SRV.** with UACC(NONE) to secure near-term history. If this profile exists in your $KOBSEC resource class, it would overrule the profiles for your history collection and history collection configurations using TEMS REST services. If this is the case, define the following profile to allow the use of TEMS REST services to interact with all history collection and history collection configurations before restricting access to specific resources:

RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.* UACC(READ)

Note: To allow users to edit or create history collection configurations, you must provide UPDATE access. To allow users to delete history collection configurations, you must provide ALTER access.

RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.STARTSTOP.* UACC(READ)

Procedure

For each history collection configuration to protect, enter the following commands in RACF:
- To restrict retrieving, editing, and deleting a specific history collection configuration and retrieving the history collection status information:
```
RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.uadvisor_name UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH
```
- To restrict creating a historical collection configuration, for the target table on the specific node:
```
RDEFINE $KOBSEC Kpp.node_name.table_name UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH
```
- To restrict starting and stopping a specific history collection:
```
RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.STARTSTOP.uadvisor_name UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH
```
These commands refuse access to all users.

To permit access to individual users, enter the following commands in RACF:

To permit retrieving a history collection configuration and the history collection status information:
```
PERMIT O4SRV.HISTORYCOLLECTIONS.uadvisor_name ID(userid) ACCESS(READ) CLASS($KOBSEC)
```

To permit editing and creating a historical collection configuration:

PERMIT O4SRV.HISTORYCOLLECTIONS.uadvisor_name ID(userid) ACCESS(UPDATE) CLASS($KOBSEC)

For the target table on the specific node:

PERMIT Kpp.node_name.table_name ID(userid) ACCESS(READ) CLASS($KOBSEC)

To permit deleting a history collection configuration:

PERMIT O4SRV.HISTORYCOLLECTIONS.uadvisor_name ID(userid) ACCESS(ALTER) CLASS($KOBSEC)

To permit starting and stopping a history collection:

PERMIT O4SRV.HISTORYCOLLECTIONS.STARTSTOP.uadvisor_name ID(userid) ACCESS(READ) CLASS($KOBSEC)