Define editor profiles to control access to the editors

Edit online

To control authorization for the Situation Editor, Object Editor, and ISPF Editor in the OMEGAMON® enhanced 3270 user interface, the security administrator must define SAF resource profiles, as described in this topic.

Before you begin

In the respective editor, you can perform the following activities that can be secured using SAF verification:

Situation Editor: In this editor, you can browse defined situations. If you are authorized to make updates in the editor, you can also create, edit, start, and stop situations.
Object Editor: In this editor, you can browse object groups in the hub monitoring server. If you are authorized to make updates in the editor, you can also create or edit the object groups.
ISPF Editor: In this editor, you can browse members in data sets that are allocated to the enhanced 3270 user interface address space. If you are authorized to make updates in the editor, you can also modify the members.

To secure these activities, you can choose between the following implementation options:

Option 1: Authorize the users who can either invoke and make updates in the editors, or cannot access the editors. (With this option, a user cannot be authorized to browse only.)
Option 2: Authorize the users who can invoke and make updates in the editors, can invoke and browse in the editors, or cannot access the editors.

Access to each editor is controlled separately.

Before you begin, decide which configuration option to implement at your site.

Important: The ability to separately control if a user can browse in the editors, update in the editors, or neither, is introduced in APAR OA69124. If you implement this configuration after previously having the editors secured at your site, be aware that the function of previously-defined SAF editor profiles will change and defined access should be reviewed.

Related links: Editor security scenarios and examples; Define profiles for additional interface activities; Security in OMEGAMON enhanced 3270 user interface

About this task

The enhanced 3270 user interface verifies the authority for a user to use the Situation Editor, Object Editor, and ISPF Editor by checking for access to SAF resources named in the following patterns:

KOBUI.ADMIN.editor
KOBUI.ADMIN.editor.UPDATE

where:

KOBUI: Is a literal qualifier value. KOBUI is a qualifier for the enhanced 3270 user interface.
ADMIN: Is a literal qualifier value. ADMIN is a qualifier for enhanced 3270 user interface functions. For information about other features protected by SAF profiles using this qualifier, see Define profiles for additional interface activities.
editor: Identifies the editor. Use SITEDITOR for the Situation Editor, OBJECTEDITOR for the Object Editor, and ISPFEDIT for the ISPF Editor.
UPDATE: Is a literal. This suffix is used only when configuring different profiles for controlling update and browse authorizations separately.

To be authorized for an editor resource, a user or group must be permitted READ (or UPDATE) access to the associated resource profile; for editor profiles, both READ and UPDATE access provide the same capability.

Note: If you have profile KOBUI.ADMIN.** defined at your site, be aware that it might impact expected editor authorizations. See Authorizing access with generic profile definition.

To save updates in the Situation Editor or the Object Editor, the enhanced 3270 user interface also verifies that the user has proper access to underlying tables, which are protected by the following resource:

O4SRV.**

where O4SRV is a qualifier for monitoring server tables.

These profiles are defined to the SAF general resource class identified by the RTE_SECURITY_CLASS parameter. For more information about the defining the class, see Define a SAF general resource class for securing access to OMEGAMON resources.

Use the following procedure to set up your SAF profiles for protecting activities in the Situation Editor, Object Editor, and ISPF Editor. Before you begin, decide which configuration option to implement at your site:

Option 1: Authorize the users who can either invoke and make updates in the editors, or cannot access the editors. (With this option, a user cannot be authorized to browse only.)
Option 2: Authorize the users who can invoke and make updates in the editors, can invoke and browse in the editors, or cannot access the editors.

Procedure

You can implement either of the following options for controlling access to the Situation Editor, Object Editor, and ISPF Editor:

Option 1: Users can either invoke and make updates in the editors, or cannot access the editors
With this option, you use a single set of profiles to control if users can invoke and make updates in the editors, or if they are not allowed to access the editors at all.
To secure the editors, define the profiles for the editors using resource KOBUI.ADMIN.editor, where editor is SITEDITOR, OBJECTEDITOR, or ISPFEDIT. You can use the following commands:
```
RDEFINE classname KOBUI.ADMIN.SITEDITOR UACC(NONE)
RDEFINE classname KOBUI.ADMIN.OBJECTEDITOR UACC(NONE)
RDEFINE classname KOBUI.ADMIN.ISPFEDIT UACC(NONE)
SETROPTS RACLIST(classname) REFRESH
```
Assign READ access to a profile to allow the user to invoke and make updates in the corresponding editor. A user with access authority NONE to a profile is not allowed to use the corresponding editor. For example, you can enter the following commands to allow the user to make updates in the Situation Editor and Object Editor, and to explicitly deny access to the ISPF Editor:
```
PERMIT KOBUI.ADMIN.SITEDITOR ID(userid) ACCESS(READ) CLASS(classname)
PERMIT KOBUI.ADMIN.OBJECTEDITOR ID(userid) ACCESS(READ) CLASS(classname)
PERMIT KOBUI.ADMIN.ISPFEDIT ID(userid) ACCESS(NONE) CLASS(classname)
SETROPTS RACLIST(classname) REFRESH
```
To save updates in the Situation Editor or the Object Editor, the user must also have access to the underlying tables, which are protected by resource O4SRV.**. If needed, assign READ access to this resource by entering the following commands:
```
PERMIT O4SRV.** ID(userid) ACCESS(READ) CLASS(classname)
SETROPTS RACLIST(classname) REFRESH
```
Option 2: Users can make updates in the editors, can only browse in the editors, or cannot access the editors
With this option, you use two sets of profiles to control if users can invoke and make updates in the editors, can invoke and browse in the editors, or cannot access the editors at all.
To control who can make updates in the editors, define the profiles for the editors using resource, where editor is SITEDITOR, OBJECTEDITOR, or ISPFEDIT. You can use the following commands:
```
RDEFINE classname KOBUI.ADMIN.SITEDITOR.UPDATE UACC(NONE)
RDEFINE classname KOBUI.ADMIN.OBJECTEDITOR.UPDATE UACC(NONE)
RDEFINE classname KOBUI.ADMIN.ISPFEDIT.UPDATE UACC(NONE)
SETROPTS RACLIST(classname) REFRESH
```
Assign READ access to a profile to allow the user to make updates in the corresponding editor. For example, you can enter the following commands to allow the user to make updates in the Situation Editor and Object Editor, but not in the ISPF Editor:
```
PERMIT KOBUI.ADMIN.SITEDITOR.UPDATE ID(userid) ACCESS(READ) CLASS(classname)
PERMIT KOBUI.ADMIN.OBJECTEDITOR.UPDATE ID(userid) ACCESS(READ) CLASS(classname)
PERMIT KOBUI.ADMIN.ISPFEDIT.UPDATE ID(userid) ACCESS(NONE) CLASS(classname)
SETROPTS RACLIST(classname) REFRESH
```
To save updates in the Situation Editor or the Object Editor, the user must also have access to the underlying tables, which are protected by resource O4SRV.**. If needed, assign READ access to this resource by entering the following commands:
```
PERMIT O4SRV.** ID(userid) ACCESS(READ) CLASS(classname)
SETROPTS RACLIST(classname) REFRESH
```
Then, to control who can invoke and only browse in the editors, define the profiles using resource KOBUI.ADMIN.editor, if not already defined. You can use the following commands:
```
RDEFINE classname KOBUI.ADMIN.SITEDITOR UACC(NONE)
RDEFINE classname KOBUI.ADMIN.OBJECTEDITOR UACC(NONE)
RDEFINE classname KOBUI.ADMIN.ISPFEDIT UACC(NONE)
SETROPTS RACLIST(classname) REFRESH
```
Assign READ access to a profile to allow the user to invoke and browse in the corresponding editor. A user with access authority NONE to a profile is not allowed to use the corresponding editor. For example, you can enter the following commands to allow the user to invoke and browse in each of the editors:
```
PERMIT KOBUI.ADMIN.SITEDITOR ID(userid) ACCESS(READ) CLASS(classname)
PERMIT KOBUI.ADMIN.OBJECTEDITOR ID(userid) ACCESS(READ) CLASS(classname)
PERMIT KOBUI.ADMIN.ISPFEDIT ID(userid) ACCESS(READ) CLASS(classname)
SETROPTS RACLIST(classname) REFRESH
```
Note: If access to the profile KOBUI.ADMIN.editor is not permitted, then the user cannot invoke the editor, regardless of the permitted access to profile KOBUI.ADMIN.editor.UPDATE.
Important: The ability to control separately if a user can update in the editors, can only browse in the editors, or neither, is introduced in APAR OA69124. If you add editor profiles with suffix UPDATE after previously having profiles in the pattern KOBUI.ADMIN.editor defined at your site, be aware that the function of previously-defined editor profiles changes and any existing, defined access should be reviewed.