Authorizing commands

When the Command Authorization exit routine (DFSCCMD0) is included in IMS.SDFSRESL, it provides a command authorization check. The Command Authorization exit routine can work in conjunction with RACF®, or it can work independently, without RACF .

The Command Authorization exit routine is called for each IMS command. Default security or RACF is called first to perform the authorization. The return code is passed to the Command Authorization exit routine. DFSCCMD0 performs a final verification and determines the success or failure of the command authorization. DFSCCMD0 can also be used alone to perform the verification. If you want to establish a command authorization level more discrete than that provided by RACF , you can examine DFSCCMD0's input command buffer. DFSCCMD0's input command buffer contains the complete command stream.

If DFSCCMD0 exists in IMS.SDFSRESL, DFSCCMD0 is called for all device types including static, ETO, and LU 6.2.

IMS provides the RVFY= parameter in the IMS procedure for customers who want to force reverification that the operator who signed on to a terminal is the same operator who is now entering a command or transaction. This reverification is done with RACF by including the word 'REVERIFY' in the APPLDATA field of the command or transaction profile. For example:

RDEFINE Cxxx tran-name UACC(NONE) APPLDATA('REVERIFY')

Each time the user enters this transaction code, the RACF password must be entered where an IMS password would be entered if the transaction were password protected.