Using SAF general resource class $KOBSEC

You can use the SAF general resource class named $KOBSEC to secure access to resources for multiple product components.

Various Tivoli® Management Services on z/OS® and OMEGAMON components use (or can use) the system authorization facility (SAF) interface to implement security. By using SAF, you can centrally control access to z/OS resources (such as data sets and commands) and access to OMEGAMON resources (such as situations, Take Action commands, and user interface elements).

Security is enabled by specifying the name of a SAF general resource class and defining resource profiles to control access. When using the SAF interface to secure TEMS REST services or control access to Take Action commands for all of the TEMS, the SAF general resource class must be named $KOBSEC. When using the SAF interface for securing the OMEGAMON® enhanced 3270 user interface (enhanced 3270UI), you can optionally use the $KOBSEC class. If you use the class $KOBSEC for the enhanced 3270UI, it is possible for the resource profiles to overlap.

The following sections provide an overview of the resource profiles that are used for securing the resources for these components and considerations when using the $KOBSEC general resource class.

Protected resources

The following table summarizes the resources for which access can be controlled by the SAF interface for these components:

Note: For more information about any of the resources in the table, use the links provided in the Resource description column.

Table 1. Protected resources
Component	Resource description	Resource pattern	Resource class
TEMS REST services	Request collection data with `GET /data` Edit or create history collection configurations with `/data/historycollections` Edit or create situations with `/situations`	`Kpp.node_name.table_name`	`$KOBSEC`
TEMS REST services	Retrieve, edit, create, or delete history collection configurations with `/data/historycollections` Retrieve history collection status information with `GET /data/historycollections/status`	`O4SRV.HISTORYCOLLECTIONS.uadvisor_name` Notes: The required access varies depending on the REST method used. Editing or creating history collection configurations also requires access to the target table on the specific node, which is protected with resource pattern `Kpp.node_name.table_name`.	`$KOBSEC`
TEMS REST services	Start and stop history collections with `POST /data/historycollections/start` and `POST /data/historycollections/stop`	`O4SRV.HISTORYCOLLECTIONS.STARTSTOP.uadvisor_name`	`$KOBSEC`
TEMS REST services	Retrieve, edit, create, or delete situations with `/situations`	`O4SRV.SITUATIONS.situation_name` Notes: The required access varies depending on the REST method used. Editing or creating situations also requires access to the target table on the specific node, which is protected with resource pattern `Kpp.node_name.table_name`.	`$KOBSEC`
TEMS REST services	Request situation status information with `GET /situations/status` and `GET /situations/status/history`	`O4SRV.SITUATIONS.STATUS.situation_name`	`$KOBSEC`
TEMS REST services	Start and stop situations with `POST /situations/start` and `POST /situations/stop`	`O4SRV.SITUATIONS.STARTSTOP.situation_name`	`$KOBSEC`
TEMS REST services	Retrieve or delete Take Action definitions with `/system/actions`	`O4SRV.ACTIONS.Kpp.key` Note: The required access varies depending on the REST method used.	`$KOBSEC`
TEMS REST services	Execute a Take Action with `POST /system/actions/execute`	`O4SRV.ACTIONS.EXECUTE.Kpp.key` Note: If you use resource class `$KOBSEC` to secure the use of Take Action commands in the enhanced 3270UI, then resource profile `Kpp.msn.TAKEACTION` also applies when executing a Take Action in TEMS REST services.	`$KOBSEC`
Enhanced 3270UI	Logon access	`KOB.LOGON.**`	user-defined
Enhanced 3270UI	Near-term history	`KOBUI.ADMIN.DEFINEHISTORY.hub_name` Note: To authorize updates to near-term history, the `O4SRV.**` resource must be defined to the general SAF security class (`RTE_SECURITY_CLASS`), or the query security class (`KOB_SAF_QUERY_CLASS_NAME`), if one is defined.	user-defined
Enhanced 3270UI	Take Action command access	`Kpp.msn.TAKEACTION`	user-defined
Enhanced 3270UI	Query profiles (access to data sources)	`Kpp.msn.tablename`	user-defined
Enhanced 3270UI	Additional interface activities	`KOBUI.ADMIN.interface_activity` `KOBUI.USER.COMMAND.command` `SYSTEM.**`	user-defined
Enhanced 3270UI	Multi-tenancy mode tenant definitions	`KOBUI.MULTI.CUST.customerID` `KOBUI.MULTI.GROUP.group`	user-defined
TEMS Take Action commands	Take Action command access	`smfid.stc.KGLUMAP.tep_userid` `smfid.stc.KGLCMAP.take_action_command`	`$KOBSEC`
TEMS Take Action commands	Take Action environment variables	`smfid.stc.SOAP_IS_SECURE` `smfid.stc.CMS_VALIDATE` `smfid.stc.KDS_VALIDATE` `smfid.stc.RTE_SECURITY_CLASS`	`$KOBSEC`
TEMS Take Action commands	Take Action command security settings	`smfid.stc.KLVINNAM.FOLD` `smfid.stc.KLVINNAM.CNTRLPTxx`	`$KOBSEC`

Considerations when using the $KOBSEC class

Review the following information:

When using the SAF interface to secure TEMS REST services or to control access to Take Action commands across all TEMS applications, the SAF general resource class must be named $KOBSEC.
For the OMEGAMON enhanced 3270 user interface, the SAF general resource class name is customizable and specified in parameter RTE_SECURITY_CLASS.
If you decide to use $KOBSEC as the SAF general resource class for the enhanced 3270UI, then it must be specified in the RTE_SECURITY_CLASS parameter in the runtime environment configuration.

For more information about defining the SAF general resource class for the enhanced 3270UI, see Enable security for the OMEGAMON enhanced 3270 user interface.
If resource class $KOBSEC does not exist, it must be defined. For more information, see Define a SAF general resource class for securing access to OMEGAMON resources.
If you use class $KOBSEC for securing the enhanced 3270UI, it is possible for the resource profiles to overlap with those for TEMS REST services. Review the following cases:
- You might define resource profile O4SRV.** with UACC(NONE) to secure near-term history in the enhanced 3270UI. If this profile exists in your $KOBSEC resource class, it would overrule the profiles that are used with TEMS REST services. If this is the case, define the following profiles (as applicable) to allow access using TEMS REST services to all situations, history collections and configurations, Take Action activities, and related interactions before restricting access to specific resources:
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.* UACC(READ)
```
  Note: To allow users to edit or create situations, you must provide UPDATE access. To allow users to replace or delete situations, you must provide ALTER access.
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.STATUS.* UACC(READ)
```
```
RDEFINE $KOBSEC O4SRV.SITUATIONS.STARTSTOP.* UACC(READ)
```
```
RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.* UACC(READ)
```
  Note: To allow users to edit or create history collection configurations, you must provide UPDATE access. To allow users to delete history collection configurations, you must provide ALTER access.
```
RDEFINE $KOBSEC O4SRV.HISTORYCOLLECTIONS.STARTSTOP.* UACC(READ)
```
```
RDEFINE $KOBSEC O4SRV.ACTIONS.** UACC(ALTER)
```
```
RDEFINE $KOBSEC O4SRV.ACTIONS.EXECUTE.** UACC(READ)
```
- If you use resource profile Kpp.msn.TAKEACTION to secure the use of Take Action commands in the enhanced 3270UI, this profile also applies when executing a Take Action in TEMS REST services.