Considerations for setting security for the IMSRSC repository in the CSL RM address space

The Common Service Layer (CSL) Resource Manager (RM) address space is an authorized caller of the IMSRSC repository services. You can specify if the RM address space is authorized to access a repository by defining a profile with FRPREP.repository_name.

If RM is authorized to access a repository, then all authorized callers to RM are able to access the repository through RM and also access all members in the repository, whether member level security is defined or not. Member level security is not used for authorized callers to RM.

If RM is authorized to access a repository, then the access to the members in the repository for non-authorized callers is based on the member level security. If member level security is not set up for the repository, then all non-authorized callers to RM will be able to access the repository through RM and also access all members in the repository. If member level security is enabled, then non-authorized callers to RM are able to access the repository through RM only if the caller is authorized to access the member.

You can define the member level security for RM using the following values for product, type, and membername to the Repository Server (RS):
  • product=DFS
  • type = RSC
  • membername=plexnamersctyperscname
    plexname
    The 8-byte CSL IMSplex name where the repository is defined
    rsctype
    The 8-byte resource type. It can be one of the following:
    • DB
    • DBDESC
    • LTERM
    • MSLINK
    • MSNAME
    • MSPLINK
    • PGM
    • PGMDESC
    • TRAN
    • TRANDESC
    • RTC
    • RTCDESC
    rscname
    The 8-byte resource name you want to secure

As an example, to secure a transaction named PART in IMSPLEX1 in repository IMS_REPOS, define a rule for FRPMEM.IMS_REPOS.DFS.RSC.IMSPLEX1.TRAN.PART to RACF®. All authorized callers to RM can access the transaction PART. All non-authorized callers to RM (such as the repository populate utility) can access the transaction PART only if the user ID on the job issued to run the utility is defined to RACF with the member level security defined with the access rule for FRPMEM.IMS_REPOS.DFS.RSC.IMSPLEX1.TRAN.PART.