Creating a temporary DSNRAUTH class by using the RACF dynamic class descriptor table

If you want to use the REST CORS functionality before the availability of the RACF module ICHRRCDX update that delivers the new DSNRAUTH class definition, your z/OS® RACF security administrator can temporarily create the DSNRAUTH class using the RACF dynamic class descriptor table (CDT) support. Unlike the RACF static CDT, use of the RACF dynamic CDT support has the benefit of not requiring a re-IPL of z/OS.

Before you begin

Apply the PTF for APAR PH59837.

Before you use the approach described here, consider the following important facts:

You must use the exact class options specified below in order to ensure that your temporary RACF dynamic CDT DSNRAUTH class definition will be compatible and consistent with the official RACF delivered ICHRRCDX defined DSNRAUTH class. Failure to use these specified class options in your temporary dynamic CDT DSNRAUTH class definition may prevent your ability to migrate to the official RACF delivered ICHRRCDX defined DSNRAUTH class.
It is expected that you will remove any temporary DSNRAUTH CDT definition when the RACF module ICHRRCDX update delivering the formal DSNRAUTH class is available.
The RACF dynamic CDT support is intended to only be used for creating user-defined class definitions, which have documented naming and attribute restrictions to avoid collisions with official IBM class definitions. Using the dynamic CDT support to define a class that does not follow the documented naming and attribute restrictions is allowed, but will result in warning messages if these naming or attribute restrictions are violated. Therefore, the RACF dynamic CDT support can be successfully used to create the DSNRAUTH class definition, but the following expected warning messages will be issued and must be ignored:
- Warning: Class name DSNRAUTH does not contain a national character nor a number.
- Warning: The POSIT value is not within the recommended ranges for installation use. The valid ranges are 19-56 and 128-527.

Procedure

To define the DSNRAUTH class in the RACF dynamic CDT, complete the following steps:

Issue RACF RDEFINE commands with the options shown in the following example

RDEFINE CDT DSNRAUTH UACC(NONE) 
   CDTINFO( 
      CASE(ASIS) DEFAULTRC(8) DEFAULTUACC(NONE) 
      MACPROCESSING(NORMAL) FIRST(ALPHA,NUMERIC,NATIONAL,SPECIAL) 
      GENERIC(ALLOWED) GENLIST(DISALLOWED) KEYQUALIFIERS(0) 
      MAXLENX(246) MAXLENGTH(246) OPERATIONS(NO) 
      OTHER(ALPHA,NUMERIC,NATIONAL,SPECIAL) POSIT(610) 
      PROFILESALLOWED(YES) RACLIST(ALLOWED) MACPROCESSING(NORMAL) 
      SIGNAL(YES) SECLABELSREQUIRED(NO))

Issue the following SETROPTS command.


SETROPTS CLASSACT(CDT) RACLIST(CDT) REFRESH