Define query profiles to control access to data sources

Query profiles control access to data sources in the OMEGAMON® enhanced 3270 user interface.

About this task

The authority to issue query requests from the OMEGAMON enhanced 3270 user interface to a product agent instance is verified by checking for access to a SAF resource named in the following pattern:

Kpp.msn.tablename

where:

Kpp: Is the product code of the agent instance. For example, for OMEGAMON AI for CICS, the product code is KCP. For OMEGAMON AI for z/OS, the product code is KM5. See Product codes for other products.
msn: Is a managed system name. A managed system name typically identifies a unique Tivoli Enterprise Monitoring Server agent instance. Note that the form of managed system names differs from product to product. Check the agent-specific documentation for information about the form used for managed system names.
tablename: Is the name of the data source (attribute group or table) defined within the product agent.

Define the profiles to the general SAF class (RTE_SECURITY_CLASS). If more granular access control is required, define the profiles to the class identified by the KOB_SAF_QUERY_CLASS_NAME parameter.

If there is no matching profile for a given query, the query is allowed.

The following list provides additional information about securing access using query profiles:

Securing near-term history

To secure near-term history configuration actions, add the O4SRV.** profile definition to the global security class definition, or to the query class, if one is used.

Securing Toolkit actions

To secure Toolkit actions, use the following profiles to control access to the respective tables:

For OMEGAMON AI for Storage Storage Toolkit, use profile KS3.msn.TK_REQ.
For OMEGAMON AI for z/OS System Programmer's Toolkit, use profile KM5.msn.SREXXCMD.

Example

To control the ability to issue a query to an OMEGAMON AI for z/OS agent running on Sysplex IBMTEST on sysplex member TSTA, for table KM5xxxxx, in a SAF class named $KOBSEC, define a profile named KM5.IBMTEST:TSTA:MVSSYS.KM5xxxxx by entering the following commands:

RDEFINE $KOBSEC KM5.IBMTEST:TSTA:MVSSYS.KM5xxxxxx UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH

More generally, you can define a profile to control all data queries for a specific product, as follows:

RDEFINE $KOBSEC KM5.** UACC(NONE)
SETROPTS RACLIST($KOBSEC) REFRESH

To secure near-term history configuration actions, add the O4SRV.** profile definition to the class being used by entering the following commands:

RDEFINE classname O4SRV.** UACC(NONE)
SETROPTS RACLIST(classname) REFRESH
PERMIT O4SRV.** ID(userid) ACCESS(READ) CLASS(classname)