(If needed) Define security authorization for OMEGAMON started tasks

Edit online

Authorize the OMEGAMON started tasks. If you have an OMEGAMON product installed and running, then the OMEGAMON started tasks have already been authorized; you do not need to perform this task again.

Before you begin

In this task, you authorize the z/OS user ID under which the OMEGAMON started tasks will run. This user ID is required when creating certificates and the key ring, as described in the next topic, Create digital certificates and key ring using RACF.

If you have already authorized your OMEGAMON started tasks, you will need the z/OS user ID under which the OMEGAMON started tasks run, and you can skip this task.

If you are setting up a new installation and need to authorize your OMEGAMON started tasks, you can use the following procedure, which uses RACF for authorization. For other security management products, refer to your product documentation.

For more information about setting up your system for the first time, including authorizing the started tasks, see FTU Task 3: Prepare the system for configuration.

About this task

You must add the OMEGAMON started task user ID to the required RACF groups. The user ID requires superuser authority (a TSO ID with an OMVS segment defined to it). For more information, see z/OS® UNIX® System Services Planning: Superusers in z/OS UNIX.

If you use Configuration Manager to configure your runtime environment, the prefix of the started task names is set to OMEG. Otherwise, the default prefix value is IBM. The example in the following procedure uses the OMEG prefix.

The following procedure provides example RACF commands to perform these steps.
Note: The examples are intended as a guide; you can define your authorizations differently, depending on the requirements of your site.

Procedure

  1. Define the z/OS user ID under which the OMEGAMON started tasks will run.
    In this example, the OMEGAMON started tasks run under the z/OS user ID named ITMUSER with the default group (DFLTGRP) of OMVS and an OMVS segment with a UID of 0:
    ADDUSER ITMUSER NAME('user-name') DFLTGRP(OMVS)
ALTUSER ITMUSER OMVS(UID(0),HOME(/u),PROGRAM(/bin/sh))
RDEFINE STARTED OMEG*.* UACC(NONE) AUDIT(ALL(READ)) OWNER(IBMUSER)
RALTER STARTED xxx*.* DATA('installation-defined-data') +
STDATA(USER(ITMUSER) GROUP(OMVS))
    Note: This example assigns a UID of 0 to give the user ID superuser authority. For more information about this method, see

    Assigning a UID of 0.

  2. Refresh the in-storage generic profiles, as follows:
    SETROPTS REFRESH GENERIC(*)
SETROPTS REFRESH RACLIST(STARTED)