(Optional) Defining RACF profiles for Db2ZAI

Complete these optional tasks in order to a) control who can access the Db2ZAI user interface, and b) grant permission to access the Db2ZAI external services.

(Optional) Granting permission to access the Db2ZAI user interface:

About this task

RACF user interface control is enabled from the user interface once you have completed the Db2ZAI installation. .

Users with READ access to the DB2ZAI.ADMIN profile will have access to all pages of the Db2ZAI user interface, including the Administration page. Users who only have READ access to the DB2ZAI.USER profile will not be able to access the Administration page. Users with no access to either profile will not be able to access the Db2ZAI user interface.

Note: This task requires RACF administrator authority.

Procedure

To define RACF profiles for Db2ZAI user interface access:

Define the profiles needed to control access for Db2ZAI users and administrators:

RDEFINE DSNR DB2ZAI.ADMIN UACC(NONE) 
RDEFINE DSNR DB2ZAI.USER UACC(NONE) 
SETR RACLIST(DSNR) REFRESH

To grant a user administrator authority to Db2ZAI (administrator authority includes user authority):
```
PERMIT DB2ZAI.ADMIN CLASS(DSNR) ID(<db2zai_admin_id>) ACCESS(READ)
SETR RACLIST(DSNR) REFRESH
```

To grant regular (non-admin) user authority to Db2ZAI:

PERMIT DB2ZAI.USER CLASS(DSNR) ID(<db2zai_user_id>) ACCESS(READ)
SETR RACLIST(DSNR) REFRESH

If the BPX.SERVER profile in the FACILITY class is defined, the user ID assigned to the Db2ZAI started tasks must have READ permission. You can use the following RACF commands to grant READ access to the BPX.SERVER profile of the facility class for the Db2ZAI started tasks owner ID:
```
PERMIT BPX.SERVER CLASS(FACILITY) ID(<started_task_owner>) ACCESS(READ)
SETR RACLIST(FACILITY) REFRESH
```
Open a browser window and navigate to https://<hostname>:<port>/, where <hostname> is your Db2ZAI address and <port> is the port you have assigned to Db2ZAI.
Sign in to Db2® AI for z/OS®.
From the menu in the upper right corner of the Connections page, click Administration (). The System configuration page opens.
In the Db2ZAI UI RACF access section, specify whether the Db2ZAI user interface will use RACF for access control.

Note: When you either activate or deactivate RACF access for the user interface, all current users will need to log out and log back in to pick up the change.

Granting permission to access the Db2ZAI external services

Complete this task in order to grant permission to access the Db2ZAI external services, including the SQL optimization external services and all of the update actions that are available within the SQL optimization user interface.

About this task

Users with UPDATE access to the DB2ZAI.SQLOPT profile will have access to the external services that enable a user to take action with regards to SQL optimization, while READ access will only allow a user to view the current SQL optimization status. Users with no access to the profile will have the same level of access as those users with READ access.

Note: This task requires RACF administrator authority.

Procedure

To grant permission to access the Db2ZAI external services:

Define the profile needed to grant access to Db2ZAI external services:
```
RDEFINE DSNR DB2ZAI.SQLOPT UACC(NONE)
SETR RACLIST(DSNR) REFRESH
```

Grant the user UPDATE or READ access to the DB2ZAI.SQLOPT profile:

PERMIT DB2ZAI.SQLOPT CLASS(DSNR) ID(<db2zai_admin_id>) ACCESS(READ or UPDATE)
SETR RACLIST(DSNR) REFRESH

Run the following RACF commands to grant READ access to the BPX.SERVER profile of the facility class (if that class has been defined) for the Db2ZAI Liberty started task owner ID:
```
PERMIT BPX.SERVER CLASS(FACILITY) ID(<Liberty ID>) ACCESS(READ)
SETR RACLIST(FACILITY) REFRESH
```
Open a browser window and navigate to https://<hostname>:<port>/, where <hostname> is your Db2ZAI address and <port> is the port you have assigned to Db2ZAI.
Sign in to IBM Db2 AI for z/OS.
From the menu in the upper right corner of the Connections page, click Administration (). The System configuration page opens.
In the Db2ZAI UI RACF access section, move the RACF profile for external service access slider to Enabled.
Run the following RACF command to grant READ access to the DB2ZAI.ADMIN RACF profile for the ID that requires access to the Process Queue page for canceling an SQL optimization exploration process. Skip this step if the RACF UI access control option is disabled.
```
PERMIT DB2ZAI.ADMIN CLASS(DSNR) ID(<db2zai_admin_id>) ACCESS(READ)
```