All authorization events

Edit online

This event occurs when an authorization request is made. A rule for this event can reject, accept, or modify the request.

Return values

When an ATH event ends, the rule sets a return value. The server evaluates the return value and invokes z/OS® security routines.

Return value Description
ACCEPT Access to the requested resource is allowed, and additional processing by the z/OS security subsystem is not performed.
REJECT Access to the requested resource is denied, and additional processing by the z/OS security subsystem is not performed. The rule can include the ATH.OPAUERMG variable, which for most authorization requests, returns an error message to the requestor.
Other value If another value or no value is returned, the z/OS security subsystem performs validation checking. The security product makes the final determine to allow or deny access to the requested resource.

Variables

Values for these variables are set only when an ATH rule processes an ATH event.

Criterion Variable name Contents Data type
ALL (all variables) ATH.OPAU13WA The WAITS flag is on if the wait state is allowed and is off if wait state is not allowed. If the wait state is not allowed, actions that cause the task to enter a wait state are not allowed. Character, read only
ALL ATH.OPAUACSR The type of access that is being requested. The following are valid values for the access type, except for LOGON requests:

  • ADD

  • CONTROL

  • DISPLAY

  • DEFINE

  • EXECUTE

  • INFO

  • LIST

  • KILL

  • MODIFY

  • READ

  • SHOW

  • SET

  • WRITE

 Character, read only
ALL ATH.OPAUERMG A REXX program can specify the error message to send to the client. Character, read-write
ALL ATH.OPAURQRC The request return code. The following are valid values:

  • 00: Request allowed

  • 04: Request must be modified

  • 08: Request failed

  • 12: Request abended

  • 16: Product address space is unavailable

 Character, read-only
ALL ATH.OPAURQSR The type of request that is being processed. The following are valid values:

  • CICSCONNECTIONS: CICS® connections

  • CONTROLBLOCKS: Product control blocks

  • DATABASES: Product databases

  • DATAMAP: Data map definitions

  • FILE: Shared server QSAM/BPAM data sets

  • GLOBALS: Global variables

  • LINKS: Communication links

  • LOGON: Password and user validation

  • PARMS: Product parameters

  • RPC: Remote procedure call

  • AVZ: AVZ command

  • SEF: Event Facility commands

  • TRACEDATA: Detailed Trace Browse data

  • TRACEBROWSE: Trace browse

  • TSO: Time Share Option

  • USERS: Remote users

ALL ATH.OPAUSRID The search ID, which is created by combining the request type with the access type, for example:

  • PARMS.SHOW displays a product parameter

  • SEF.INFO obtains SEF information.

ALL ATH.OPAUUSID The user ID that is being validated (LOGON), the user ID being logged off (LOGOFF), or the user ID for the task that is requesting access to the controlled resource.
Note: A rule for the LOGON event can change the value of the user ID so that the rule-generated user ID can be used for subsequent validation by the security product. Rules for other authorization events should not attempt to alter the ATH.OPAUUSID variable.
 Character, read-only, except as noted
ALL ATH.USER The user area is passed to all rules that run in response to the same event. Read-only