The sample user message exits HWSSMPL0 and HWSSMPL1 always
perform certain security actions and perform other security actions
only when the IMSLSECX security exit is or is not called.
Security actions when HWSSMPL0 and HWSSMPL1 do not
call IMSLSECX
The following tables define the action that
HWSSMPL0 and HWSSMPL1 take when they do not call the security exit
(IMSLSECX).
Table 1. USERID
results if security exit not called
| |
USERID field present
in IRM |
IRM USERID field blank/null |
RACF® parms results passed in OTMA security header |
| USERID |
Yes |
Yes |
Default RACFID |
| USERID |
Yes |
No |
IRM USERID |
| USERID |
No |
N/A |
Default RACFID |
Table 2. GROUPID
results if security exit not called
| |
GROUPID field present
in IRM |
IRM USERID field blank/null |
RACF parms results passed in OTMA security header |
| GROUPID |
Yes |
Yes |
Blanks/nulls |
| GROUPID |
Yes |
No |
IRM GROUPID |
| GROUPID |
No |
N/A |
Blanks/nulls |
Table 3. Password
results if security exit not called
| |
Password field present
in IRM |
IRM PASSWORD field blank/null |
RACF parms results passed in OTMA security header |
| PASSWORD |
Yes |
Yes |
Blanks/nulls |
| PASSWORD |
Yes |
No |
IRM PASSWORD |
| PASSWORD |
No |
N/A |
Blanks/nulls |
Security actions when HWSSMPL0 and HWSSMPL1 call IMSLSECX
The
following tables define the action that HWSSMPL0 and HWSSMPL1 take
when they call the security exit (IMSLSECX).
Table 4. USERID results if security exit called;
returns blank or non-blank USERID
| |
USERID field present
in IRM |
IRM USERID field blank/null |
Security exit return
USERID |
RACF parms results passed in OTMA security header |
| USERID |
Yes |
Yes |
No |
Default RACF USERID |
| USERID |
Yes |
Yes |
Yes |
Security exit returned
USERID |
| USERID |
Yes |
No |
No |
USERID passed in IRM |
| USERID |
Yes |
No |
Yes |
Security exit returned
USERID |
| USERID |
No |
N/A |
No |
Default RACF USERID |
| USERID |
No |
N/A |
Yes |
Security exit returned
USERID |
Table 5. GROUPID
results if security exit called; returns non-blank USERID
| |
GROUPID field present
in IRM |
IRM GROUPID field blank/null |
Security exit return
GROUPID |
RACF parms results passed in OTMA security header |
| GROUPID |
Yes |
Yes |
No |
Blank GROUPID |
| GROUPID |
Yes |
Yes |
Yes |
Security exit returned
GROUPID |
| GROUPID |
Yes |
No |
No |
Blank GROUPID |
| GROUPID |
Yes |
No |
Yes |
Security exit returned
GROUPID |
| GROUPID |
No |
N/A |
No |
Blank GROUPID |
| GROUPID |
No |
N/A |
Yes |
Security exit returned
GROUPID |
Important: If the security exit returns a blank
USERID, as shown in the following table, then the GROUPID that is
returned by the exit is not used.
Table 6. GROUPID results if security exit called; returns
blank USERID
| |
GROUPID field present
in IRM |
IRM GROUPID field blank/null |
Security exit return
GROUPID |
RACF parms results passed in OTMA security header |
| GROUPID |
Yes |
Yes |
No |
Blank GROUPID |
| GROUPID |
Yes |
Yes |
Yes |
Blank GROUPID |
| GROUPID |
Yes |
No |
No |
IRM GROUPID |
| GROUPID |
Yes |
No |
Yes |
IRM GROUPID |
| GROUPID |
No |
N/A |
No |
Blanks |
| GROUPID |
No |
N/A |
Yes |
Blanks |
Security actions that HWSSMPL0 and HWSSMPL1 always
perform
If an IRM contains IRM extensions that have an
ID of *NETUID* or *NETSID*, HWSSMPL0 and HWSSMPL1 build the security-data section of the OTMA
message prefix to contain the network security credentials that are in the IRM extensions.
The following table defines the actions that
HWSSMPL0 and HWSSMPL1 also take regardless of whether the security exit (IMSLSECX) is called. The
password is based on the IRM, not on the security exit.
Table 7. Password results regardless
of whether security exit called
| |
PASSWORD field present
in IRM |
PASSWORD field blank/null |
Security exit return
PASSWORD |
RACF parms results passed in OTMA security header |
| PASSWORD |
Yes |
Yes |
N/A |
Blanks/nulls |
| PASSWORD |
Yes |
No |
N/A |
IRM PASSWORD |
| PASSWORD |
No |
N/A |
N/A |
Blanks/nulls |