Managing connection security

Use connection security to ensure that only authorized user IDs are allowed to start a zRule Execution Server for z/OS or connect to execute rulesets.

About this task

Connection security uses the HBRCONN RACF® class to authorize user IDs to start or connect to the server. However, if the HBRADMIN class includes either of the following resource profiles, connection security for the server is disabled and the HBRCONN class is ignored.

<HBRSSID_NAME>.NO.SUBSYS.SECURITY
<HBRSSID_NAME>.NO.CONNECT.SECURITY

To manage connection security for a single server, set HBRSSID_NAME to a subsystem ID in the ++HBRSSIDLIST++ JCL variable. To manage connection security for multiple servers or for the entire server group, specify a wildcard as the subsystem ID.

Note: In some cases, you might want to disable connection security but maintain the other types of security. For more information, see Disabling types of security.

To implement connection security, authorize the user ID under which the server runs and the user IDs of any applications that execute rulesets.

If you are managing multiple servers, you can use a wildcard as described previously to specify the subsystem ID, HBRSSID_NAME in the following procedure.

Procedure

Authorize the server user ID:
1. Create the resource profile, HBRSSID_NAME, in the HBRCONN RACF class.
  Use the following command:
```
RDEFINE HBRCONN <HBRSSID_NAME> UACC(NONE)
```
2. Give the server user ID UPDATE access to the HBRSSID_NAME resource profile.
  Use the following command:
```
PERMIT <HBRSSID_NAME> CLASS(HBRCONN) ID(<HBRSSID_USER>) ACCESS(UPDATE)
```
  where <HBRSSID_USER> represents the server user ID.
  
  Note: zRule Execution Server for z/OS fails to initialize if <HBRSSID_USER> lacks UPDATE access to this profile.
3. Refresh the HBRSSID_NAME resource profile by using the following command:
```
SETROPTS RACLIST(HBRCONN) REFRESH
```
Authorize the applications:
1. Give READ access to the HBRSSID resource profile to each user ID you want to authorize.
  Use the following command:
```
PERMIT <HBRSSID_NAME> CLASS(HBRCONN) ID(<USER_ID>) ACCESS(READ)
```
  Note: For batch jobs, <USER_ID> is the RACF user ID used by the batch job. For CICS® transactions, <USER_ID> is the user ID assigned to the CICS address space.
2. Refresh the HBRSSID_NAME resource profile by using the following command:
```
SETROPTS RACLIST(HBRCONN) REFRESH
```