Define SAF profiles to control permissions for situations

Create SAF resource profiles to control permissions for situations when using TEMS REST services.

Before you begin

TEMS REST services allows you to interact with user-defined situations and predefined product-provided situations. By default, all requests related to situations are allowed unless SAF resource profiles that restrict access are defined.

Security for TEMS REST services requires a SAF general resource class named $KOBSEC. For more information, review Securing TEMS REST services.

Note: For information about securing access to history collection configurations (which are stored as UADVISOR situations), see Define SAF profiles to control permissions for history collection configurations.

About this task

TEMS REST services verifies the authority to interact with user-defined situations and predefined situations by checking for access to the SAF resources, as follows:

Table 1. TEMS REST services endpoints and SAF resources for user-defined and predefined situations
Description of request	Method	Endpoint	Resource pattern	Access required
Retrieve defined situations	`GET`	`/situations`	`O4SRV.SITUATIONS.situation_name`	`READ`
Edit a situation	`PATCH`	`/situations`	`O4SRV.SITUATIONS.situation_name` Note: UPDATE access to `O4SRV.SITUATIONS.situation_name` allows you to edit the situation. You must also have READ access to any target tables in the situation on the specific node, which is controlled by the resource `Kpp.node_name.table_name` for each table.	`UPDATE`
Create a situation	PUT	`/situations`	`O4SRV.SITUATIONS.situation_name` Note: UPDATE access to `O4SRV.SITUATIONS.situation_name` allows you to create the situation. You must also have READ access to any target tables in the situation on the specific node, which is controlled by the resource `Kpp.node_name.table_name` for each table.	`UPDATE`
Delete a situation	`DELETE`	`/situations`	`O4SRV.SITUATIONS.situation_name`	`ALTER`
Retrieve current situation status information	`GET`	`/situations/status`	`O4SRV.SITUATIONS.STATUS.situation_name`	`READ`
Retrieve situation status history	`GET`	`/situations/status/history`	`O4SRV.SITUATIONS.STATUS.situation_name`	`READ`
Start a situation	`POST`	`/situations/start`	`O4SRV.SITUATIONS.STARTSTOP.situation_name`	`READ`
Stop a situation	`POST`	`/situations/stop`	`O4SRV.SITUATIONS.STARTSTOP.situation_name`	`READ`

where:

O4SRV: Is a literal qualifier value. O4SRV is a qualifier for monitoring server tables.
SITUATIONS: Is a literal qualifier value. Use this qualifier for controlling permissions to user-defined and product-provided situations.
STATUS | STARTSTOP: Are literal qualifier values. Use STATUS for controlling permissions when retrieving situation status information. Use STARTSTOP for controlling permissions when starting or stopping a situation.
situation_name: Is the unique name of the situation or policy.

For requests to edit or create a situation, TEMS REST services also verifies authority to access any target tables on the specific node by checking for access to SAF resources named in the following pattern:

Kpp.node_name.table_name

where:

Kpp: Is the product code of the agent instance. For example, for OMEGAMON® for z/OS®, the product code is KM5. See Product codes for other products.
Important: For OMEGAMON for CICS, you must use value OMCICS instead of the typical product code KCP.
node_name: Is the name of the node, which is a managed system name. A managed system name typically identifies a unique Tivoli Enterprise Monitoring Server agent instance. Note that the form of managed system names differs from product to product. Check the agent-specific documentation for information about the form used for managed system names.
table_name: Is the name of the table defined within the product agent.

Tip: The SAF resource patterns for controlling access to tables are also used when requesting collection data and creating history collection configurations. For more information, see Define SAF profiles to control access to collection data and Define SAF profiles to control permissions for history collection configurations.

You must create a SAF profile to match the resource. If a matching SAF profile does not exist to protect a given resource, the request is allowed.

As an example, to control the ability to interact with a user-defined situation named MQ_Queue_Depth_High, you can define the following profiles to restrict all access to the resource for all users:

To restrict retrieving, editing, creating, and deleting a specific situation:
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.MQ_Queue_Depth_High UACC(NONE)
```

To restrict retrieving the situation status for a specific situation:

RDEFINE $KOBSEC O4SRV.SITUATIONS.STATUS.MQ_Queue_Depth_High UACC(NONE)

To restrict starting and stopping a specific situation:

RDEFINE $KOBSEC O4SRV.SITUATIONS.STARTSTOP.MQ_Queue_Depth_High UACC(NONE)

More generally, you can define the profiles using the asterisk (*) wildcard to restrict interaction with all situations:

To restrict retrieving, editing, creating, and deleting of all situations:
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.* UACC(NONE)
```
To restrict retrieving the situation status for all situations:
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.STATUS.* UACC(NONE)
```

To restrict starting and stopping all situations:

RDEFINE $KOBSEC O4SRV.SITUATIONS.STARTSTOP.* UACC(NONE)

To restrict all interactions with all situations:
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.** UACC(NONE)
```

You can then give access to the profiles for individual users or user groups.

Important: When enabling security for the OMEGAMON enhanced 3270 user interface, you might define resource profile O4SRV.** with UACC(NONE) to secure near-term history. If this profile exists in your $KOBSEC resource class, it would overrule the profiles for your situations using TEMS REST services. If this is the case, define the following profiles to allow the use of TEMS REST services to interact with all situations and situation statuses before restricting access to specific resources:

RDEFINE $KOBSEC O4SRV.SITUATIONS.* UACC(READ)

Note: To allow users to edit or create situations, you must provide UPDATE access. To allow users to delete situations, you must provide ALTER access.

RDEFINE $KOBSEC O4SRV.SITUATIONS.STATUS.* UACC(READ)

RDEFINE $KOBSEC O4SRV.SITUATIONS.STARTSTOP.* UACC(READ)

Procedure

For each resource to protect, enter the following commands in RACF:
- To restrict retrieving, editing, creating, and deleting a specific situation:
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.situation_name UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH
```
- To restrict retrieving the situation status for a specific situation:
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.STATUS.situation_name UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH
```
- To restrict starting and stopping a specific situation:
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.STARTSTOP.situation_name UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH
```
These commands refuse access to all users.

To permit access to individual users, enter the following commands in RACF:

To permit retrieving a specific situation:

PERMIT O4SRV.SITUATIONS.situation_name ID(userid) ACCESS(READ) CLASS($KOBSEC)

To permit editing and creating a specific situation:

PERMIT O4SRV.SITUATIONS.situation_name ID(userid) ACCESS(UPDATE) CLASS($KOBSEC)

For each target table on the specific node:

PERMIT Kpp.node_name.table_name ID(userid) ACCESS(READ) CLASS($KOBSEC)

To permit deleting a specific situation:

PERMIT O4SRV.SITUATIONS.situation_name ID(userid) ACCESS(ALTER) CLASS($KOBSEC)

To permit retrieving the situation status for a specific situation:

PERMIT O4SRV.SITUATIONS.STATUS.situation_name ID(userid) ACCESS(READ) CLASS($KOBSEC)

To permit starting and stopping a specific situation:

PERMIT O4SRV.SITUATIONS.STARTSTOP.situation_name ID(userid) ACCESS(READ) CLASS($KOBSEC)