Category 2 transactions

• UACC(NONE) and AUDIT(FAILURES) in the transaction profile. AUDIT(FAILURES) is the default and does not have to be specified.
• Access list as appropriate.

SYSADM

This category contains CCRL, CDBC, CEDA, CEMN, CEMT, CESD, CETR, and CIND.

JVMUSER

This category contains CJSA and CJSU.

Note: Depending on your security configuration, transactions CJSA and CJSU might require the CICS default user to have access. For more information, see Security for Java applications, Configuring z/OS Connect for a CICS JSON web service, and Configuring permissions for z/OS Connect Services and APIs.

As a security best practise, you should turn on Liberty security and avoid using the CICS default user to run application tasks. For the z/OS Connect Service, you can install a URIMAP resource that CICS uses to associate the work for the Service with a specific transaction ID in CICS and with an initial user ID.

CJSA is the default transaction ID for any web request that does not have a matching URI. Consider restricting access to CJSA to prevent any arbitrary application being run.

DEVELOPER

This category contains CADP, CEBR, CECI, CECS, CEDB, CEDF, and CEDX.

INQUIRE

This category contains CDBI, CEDC, CKBM, CKDL, CKDP, CKQC, CKRT, and CLDM.

OPERATOR

This category contains CBAM, CEOT, CEST, CIDP, CKAM, CKBM, CKBP, CKBC, CKBR, CKCN, CKDL, CKDP, CKQC, CKRS, CKRT, CKSD, CMSG, CKSQ, CRTE, CKTI, CSFE, CWTO, and DSNC.

DBCTL

This category contains CDBC, CDBI, CDBM, and CDBT.

INTERCOM

This category contains CDFS, CEHP, CEHS, CPMI, CSHR, CSMI, CSM1, CSM2, CSM3, CSM5, CTIN, and CVMI.

If you are using function shipping, the mirror transactions must be available to remote users in a function shipping environment. When a database or file is on another CICS region, CICS function ships the request to access the data. The request runs under one of the CICS-supplied mirror transactions. In this situation, the following conditions apply:

• The terminal user running the application must be authorized to use the mirror transaction. See Transaction security.
• The terminal user must also be authorized to use the data that the mirror transaction accesses. See Resource security. The mirror transactions are supplied with RESSEC(YES) defined; so, even if the user's transaction specifies RESSEC(NO), the mirror transaction fails if the user is not authorized to access the data.

  If you do not use resource security checking, change the mirror transaction definitions to specify RESSEC(NO). Because the mirror transactions are an IBM-protected resource, first copy these definitions into your own groups and then change them.

For a deferred START request, if the user transaction to be started is eligible for dynamic routing, system transaction CDFS will run and start the user transaction at the specified time. Ensure that security for CDFS is correctly configured.

WEBUSER

This category contains CWBA and CW2A.

The CICS default user requires access to the CWBA transaction initially, even if an analyzer program is then used to assign another user ID to the task. Ensure that the CICS default user that is specified in the DFLTUSER system initialization parameter has access to this transaction. If you use the supplied CLIST DFH$CAT2 to create a WEBUSER RACF profile, the default user must have access to this profile.

RPCUSER

This category contains CRPA, CRPC, and CRPM.

CMCIUSER

This category contains CWWU.

PIPEUSER

This category contains CPIH, CPIL, CPIQ, and CPIA.

EVENTUSER

This category contains CEPH, CEPQ, CEPR, CEPS, and CEPT.

CEPH, CEPQ, CEPR, CEPS, and CEPT are the default EP adapter transaction IDs used when security checking is required. They are defined with RESSEC(YES) and CMDSEC(YES) options. When these options are not the ones you want, you must specify your own transaction IDs in the adapter tab Advanced Options section of the Event binding editor. For more information, see Specifying EP adapter and dispatcher information.

ALLUSER

This category contains CMAC, CRTX, and CSGM.

Define the CICS messages and codes transaction CMAC, and the good morning transaction CSGM (or the transaction that is defined in the GMTRAN system initialization parameter) as UACC(READ) in their own group, because all users need access to them. If your installation uses CSGM, users who are not authorized to use CSGM receive message DFHAC2002 when they attempt to use CICS. Also include your good night transaction in this group, if you defined one with the GNTRAN system initialization parameter.

RDEFINE GCICSTRN INQUIRE UACC(NONE)
         ADDMEM(CDBI,CEDC,CKBM,CKDL,CKDP,CKQC,CKRT,CLDM)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
RDEFINE GCICSTRN SYSADM UACC(NONE)
         ADDMEM(CCRL,CDBC,CEDA,CEMN,CEMT,CESD,CETR,CIND)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT   SYSADM  CLASS(GCICSTRN) ID(sysgrp1,..,sysgrpz) ACCESS(READ)

RDEFINE GCICSTRN DEVELOPER UACC(NONE)
         ADDMEM(CADP,CEBR,CECI,CECS,CEDB,CEDF,CEDG,CEDX,CEDY)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT   DEVELOPER  CLASS(GCICSTRN) ID(devgrp1,..,devgrpz)
RDEFINE GCICSTRN INQUIRE UACC(NONE)
         ADDMEM(CDBI,CEDC,CKBM,CKDL,CKDP,CKQC,CKRT)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT   INQUIRE  CLASS(GCICSTRN) ID(inqgrp1,..,inqgrpz)

RDEFINE GCICSTRN OPERATOR UACC(NONE)
         ADDMEM(CBAM,CEOT,CEST,CIDP,CKAM,CKBM,CKBP,CKBC,CKBR,CKCN,CKDL,+
                CKDP,CKQC,CKRS,CKRT,CKSD,CMSG,CKSQ,CRTE,CKTI,CSFE,CWTO,DSNC)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT   OPERATOR  CLASS(GCICSTRN) ID(opsgrp1,..,opsgrpz) ACCESS(READ)
RDEFINE GCICSTRN DBCTL UACC(NONE)
         ADDMEM(CDBC,CDBI,CDBM,CDBT)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT   DBCTL  CLASS(GCICSTRN) ID(dbctgrp1,..,dbctgrpz) ACCESS(READ)

RDEFINE GCICSTRN INTERCOM UACC(NONE)
         ADDMEM(CEHP,CEHS,CPMI,CSHR,CSMI,CSM1,CSM2,CSM3,CSM5,CVMI,CDFS,CTIN)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT   INTERCOM  CLASS(GCICSTRN) ID(intrgrp1,..,intrgrpz) ACCESS(READ)
RDEFINE GCICSTRN ALLUSER UACC(READ)
         ADDMEM(CMAC,CRTX,CSGM)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT ALLUSER CLASS (GCICSTRN) ID(allrgrp1,..,allrgrpz) ACCESS(READ)
RDEFINE GCICSTRN WEBUSER UACC(NON)
         ADDMEM(CWBA,CW2A)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT WEBUSER CLASS (GCICSTRN) ID(webrgrp1,..,webgrpz) ACCESS(READ)

RDEFINE GCICSTRN RESTUSER UACC(NON)
         ADDMEM(CWWU)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT WEBUSER CLASS (GCICSTRN) ID(rstrgrp1,..,rstgrpz) ACCESS(READ)
RDEFINE GCICSTRN RPCUSER UACC(NON)
         ADDMEM(CRPA,CRPC,CRPM)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT RPCUSER CLASS (GCICSTRN) ID(rpcrgrp1,..,rpcrgrpz) ACCESS(READ)
RDEFINE GCICSTRN PIPEUSER UACC(NONE)
         ADDMEM(CPIH,CPIL,CPIQ,CPIA)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT PIPEUSER CLASS(GCICSTRN) ID(pipeline_access_list)

RDEFINE GCICSTRN CMCIUSER UACC(NONE)
         ADDMEM(CWWU)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT CMCIUSER CLASS(GCICSTRN) ID(cmciuser_access_list)
RDEFINE GCICSTRN EVENTUSER UACC(NONE)
         ADDMEM(CEPH,CEPQ,CEPR,CEPS,CEPT)
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT EVENTUSER CLASS(GCICSTRN) ID(eventuser_access_list)
RDEFINE GCICSTRN JVMUSER UACC(NONE) 
         ADDMEM(CJSA) 
         NOTIFY(security_admin_userid)
         OWNER(userid or groupid)
PERMIT JVMUSER CLASS (GCICSTRN) ID(librgrp1,..,libgrpz) ACCESS(READ)