Define user access to Take Action commands using SAF profiles

Configure Take Action command authorization and access using SAF profiles.

Before you begin

The use of SAF profiles for controlling Take Action command authorization and access is optional. Using SAF profiles for this purpose requires a SAF general resource class named $KOBSEC. If resource class $KOBSEC does not exist, it must be defined. For more information, see Define a SAF general resource class for securing access to OMEGAMON resources.

Note: The OMEGAMON® enhanced 3270 user interface (enhanced 3270UI) and TEMS REST services also use the SAF interface for securing access to resources. For the enhanced 3270UI, the SAF general resource class name is customizable and specified in parameter RTE_SECURITY_CLASS. For TEMS REST services, the class name must also be $KOBSEC.

About this task

The purpose of this task is to provide secure access to Take Action commands by controlling authorization and access settings using SAF profiles. Take Action commands can be associated with Tivoli Enterprise Portal user IDs instead of the user ID of the started task by mapping the IDs, and granular access to specific Take Action commands by individual users can be established.

Securing Take Action command authorization and access using SAF profiles requires the creation of the following profiles, where smfid is the name of the LPAR and stc is the name of the started task:

smfid.stc.KGLUMAP.*: This generic profile and related discrete profiles are used to associate Take Action command security with the Tivoli Enterprise Portal user ID instead of the user ID of the started task running the agent. Using the user ID allows you to authorize the use of Take Action commands by individual users while restricting it from others.
smfid.stc.KGLCMAP.*: This generic profile and related discrete profiles are used for Take Action command authorization management. You can authorize the use of specific Take Action commands by individual users while restricting it from others.

Important: To successfully implement this feature, you must define both profiles.

Note: Take Action command authorization and access can also be controlled using settings in the KGLUMAP and KGLCMAP members in the RKANPARU data set, as described in Enable RACF authorization of Take Action commands. When using the settings in the KGLUMAP and KGLCMAP members to manage Take Action command access, any user that has update access to the members can control the command access, whereas with SAF profiles, managed access can be more centralized and limited. When using SAF profiles to define Take Action command authorization and access settings, if duplicate settings exist, the settings defined by SAF profiles are used, and the settings in the KGLUMAP and KGLCMAP members are ignored.

To secure Take Action commands using SAF profiles, complete the following procedure, which consists of these steps:

Map user IDs using SAF profiles.
Define command access using SAF profiles.

Procedure

Important: To successfully implement this feature, you must complete both procedures.

Map user IDs using SAF profiles

Perform the following steps to associate user IDs to Take Action commands instead of the user ID of the started task running the agent:

Create the following profile in the RACF security class $KOBSEC, and ensure the started task owner ID has READ access to the profile:
```
smfid.stc.KGLUMAP.*
```
Where smfid is the name of the LPAR and stc is the name of the started task.
To map Tivoli Enterprise Portal user IDs to RACF user IDs for Take Action validation:
1. Create generic or discrete profiles, as follows:
  - smfid.stc.KGLUMAP.*
  - smfid.stc.KGLUMAP.tep_userid
  - smfid.stc.KGLUMAP.tep_userid_prefix*
  Where smfid is the LPAR name and stc is the started task name.
2. Within the profile, use the APPLDATA field to specify the RACF user ID to which the Tivoli Enterprise Portal user ID is mapped.
Examples:

In the following example, smfid is the LPAR name, stc is the started task name, and the started task user ID does not have access to the profile:
- Generic profile smfid.stc.KGLUMAP.* with UACC(NONE) and empty APPLDATA (no mapping of user IDs) exists, no discrete profiles are defined, and the started task user ID does not have access to this profile. As a result, all Take Action commands are denied.
In the following examples, smfid is the LPAR name, stc is the started task name, and the started task user ID has READ access to the profile:
- Generic profile smfid.stc.KGLUMAP.* with empty APPLDATA (no mapping of user IDs) exists and no discrete profiles are defined. In this example, any Tivoli Enterprise Portal user can create Take Action commands running under the same authority (that is, the Tivoli Enterprise Portal user ID is not mapped).
- Generic profile smfid.stc.KGLUMAP.* with APPLDATA set to RACF_userid exists. In this example, all Tivoli Enterprise Portal user IDs are mapped to a single RACF user ID. Any Tivoli Enterprise Portal user can create Take Action commands running under the specified RACF user ID authority.
- Discrete profile smfid.stc.KGLUMAP.tep_userid with empty APPLDATA (no mapping of user IDs) exists. In this example, a particular Tivoli Enterprise Portal user can create Take Action commands running under the same authority (that is, the Tivoli Enterprise Portal user ID is not mapped to a RACF user ID).
- Discrete profile smfid.stc.KGLUMAP.tep_userid with APPLDATA set to RACF_userid exists. In this example, a particular Tivoli Enterprise Portal user can create Take Action commands running under the specified RACF user ID authority. This is because the Tivoli Enterprise Portal user ID is mapped to a RACF user ID.
- Generic profile smfid.stc.KGLUMAP.tep_userid_prefix* with APPLDATA set to RACF_userid exists. In this example, a group of Tivoli Enterprise Portal users can create Take Action commands running under the specified RACF user ID authority. This is because the Tivoli Enterprise Portal user IDs that match the specified prefix (tep_userid_prefix*) are mapped to the RACF user ID.

Define command access using SAF profiles

Perform the following steps to authorize user IDs for individual Take Action commands:

Create the following profile in the RACF security class $KOBSEC, and ensure the started task owner ID has READ access to the profile:
```
smfid.stc.KGLCMAP.*
```
Where smfid is the name of the LPAR and stc is the name of the started task.
To authorize specific Take Action commands, for each command:
1. Create a discrete profile using the following format:
```
smfid.stc.KGLCMAP.take_action_command
```
  Where smfid is the LPAR name, stc is the started task name, and take_action_command is the name of a specific Take Action command.
2. Assign READ access to this profile for each user that should have access to this command.
Examples:
In the following examples, smfid is the LPAR name and stc is the started task name:
- Generic profile smfid.stc.KGLCMAP.* does not exist. In this example, all Take Action commands are denied.
- Generic profile smfid.stc.KGLCMAP.* with UACC(NONE) exists, and no discrete profiles are defined. In this example, all Take Action commands are denied.
- Generic profile smfid.stc.KGLCMAP.* with UACC(READ) exists, and no discrete profiles are defined. In this example, any Take Action command can be run.
- Generic profile smfid.stc.KGLCMAP.* with UACC(NONE) exists, and no discrete profiles are defined. Any mapped user with READ access can run any Take Action command.
- Generic profile smfid.stc.KGLCMAP.* with UACC(NONE) exists, and discrete profile smfid.stc.KGLCMAP.take_action_command with UACC(READ) is also defined. In this example, any mapped user can run the Take Action command specified in the discrete profile.
- Generic profile smfid.stc.KGLCMAP.* with UACC(NONE) exists, and discrete profile smfid.stc.KGLCMAP.take_action_command is also defined. In this example, any mapped user that has READ access to the discrete profile can run the specified Take Action command.