RACF security support must be enabled during the customization of Db2 Admin Tool with Tools Customizer (TCz).
Specifically, the
following fields must be set on the DB2 Parameters (CCQPDB2) panel:
RACF Security for Db2 Enabled must be set to
YES.
RACF Security Scope must be set to M
(multiple-subsystem scope) or S (single-subsystem scope). The default is
M.
If RACF Security Scope is set to M,
Class Name Root must be set to the class name
root (CLASSNMT) that was specified during RACF setup. The default is
DSN.
Class Name Suffix, must be set to the class name
suffix (CHAROPT) that was specified during RACF setup. The default is
blank.
If
RACF Security Scope is set to M, the subsystem ID
(SSID) is used by default as the subsystem qualifier when searching RACF
profiles. You can customize this qualifier by specifying a value for one or
both of the following fields:
RACF SSID Qualifier on the Product Parameters (CCQPPRD) panel
SSID Qualifier on the DB2 Parameters (CCQPDB2) panel
Specify a value on the DB2 Parameters (CCQPDB2) panel only if you want to
override the value on the Product Parameters (CCQPPRD) panel for the
subsystem that you are customizing.
Procedure
To view RACF administrative and system authorities:
On the DB2 Administration Menu (ADB2) panel, specify
option 1, and press Enter.
On the System Catalog (ADB21) panel, specify
option AO, and press Enter.
On the System Catalog - Authorizations (ADB21) panel, specify
option ZA, and press Enter.
On the System Privileges Authorizations (ADB2AZ) panel, issue one of
the following primary commands:
RL
Display your own RACF administrative and system authorities.
RLA
Display all RACF administrative and system authority entries from
the access list.
If only DSNADM profiles are found (no MDSNSM profiles are found), they are
displayed:
Figure 1. RACF System Privileges Authorizations (ADB2AZR1) panel
ADB2AZR1 RCR1 RACF System Privileges Authorizations Row 1 to 1 of 1
Command ===> Scroll ===> PAGE
Commands: DB2AUTH MDSNSM RLIST RLA
Line commands:
I - Interpretation S S S S S A D
PE - Permit Y E Y Y Y C A
S C S S S C T
A A O D C E A
D D P B T S A
M M R A R S C
Sel Grantor Grantee G D L C C
* * * * * * * * * *
--- -------- ---------- - - - - - - - -
RACF TS6462 R R R R
******************************* END OF DB2 DATA *******************************
If MDSNSM profiles are found, they are displayed first:
Figure 2. RACF System Privileges Authorizations (ADB2AZR) panel
ADB2AZR n RCR1 RACF System Privileges Authorizations Row 1 to 2 of 2
Command ===> Scroll ===> PAGE
Commands: DB2AUTH DSNADM RLIST RLA
Line commands:
I - Interpretation B B CREATE : S B M M D E S D R A T S
PE - Permit I S S T I O O E X Q I E R R T
? - Show all line commands N D A T E O N N N B P L S C C A O
D S L M C S D 1 2 U L A P O H C P
A D D I T U P A G A D L V I E A
D B B S A A R A G S I M A E V L
Sel Grantor Grantee Owner G D A C G S B E C T E N Y R E L
* * * * * * * * * * * * * * * * * * * * * * * *
--- -------- -------- -------------- - - - - - - - - - - - - - - - - - - - - -
RACF TS6462 R R R R R R
RACF TS6462 TS3483 R
******************************* END OF DB2 DATA *******************************
You can then issue the DSNADM primary command on this panel to view the
DSNADM profiles,
The last columns on each panel (such as BINDADD, BSDS on ADB2AZR and SYSADM
and SECADM on ADB2AZR1) show the access that the grantee has in the profile.
For more information about these authorizations, see System privileges (Db2 13 for z/OS documentation) .