IBM Security zSecure, Version 2.3.1

Creating zSecure configuration data sets

About this task

You can create zSecure™ configurations for different z/OS® images or different user groups such as RACF® administrators and RACF auditors as described in this procedure.

Note: You can also create special-purpose configurations for zSecure components such as zSecure Alert, zSecure Admin, Access Monitor, and Visual Server. For information about creating configurations for these components, see the setup documentation for each component.

Procedure

Review About zSecure configuration data sets to learn about the zSecure configuration data sets and the zSecure-supplied jobs used to manage them.
(Optional) Set up the global update members CKRZUPDI and C2RIISPF.
The values used to create the zSecure configuration data sets using the CKRZPOST post-installation job are based on the values specified in the global update member CKRZUPDI and C2RIISPF. If you did not run global update during the installation process, do so before running job CKRZPOST. See Customization of the installation parameters.
Select the high-level qualifier for the zSecure configuration data sets. Remember that the naming convention that you establish for the actual software might not be the best choice for the configuration data sets. Instead, consider using a high-level qualifier that indicates the z/OS image and group of users for which the configuration data sets are intended. Because your configuration data sets are supposed to persist across zSecure upgrades, do not embed a qualifier in the data set name that represents a version or release.
Follow the instructions in the CKRZPOST job to customize the job for your installation. Make sure to update the following parameters:
INSTLIB

Specify the high-level qualifier for the zSecure installation library data sets where the zSecure software runs.

YOURPFX

Update the parameter with the high-level qualifier you want to use for the zSecure configuration data sets created using CKRZPOST.
If you do not change the default value for YOURPFX, then the configuration data sets created using the CKRZPOST job use your.prefix as the high-level qualifier. CKRPROF does not supply the prefixes because you can create multiple configurations for a single copy of the installed software.

Comment out the DD-statements for the configuration data sets that do not require customization.
Run CKRZPOST to create the zSecure configuration members.
If you have run job CKRZUPDZ earlier during installation, job CKRZPOST might end with a return code of 4 because some data set updates were already completed during the CKRZUPDZ run. You can ignore this return code.
Create configurations for individual user communities or z/OS images. See Customization of zSecure configuration data sets.
Optional: Only for zSecure Audit users that use option AU.R - Rule-based compliance evaluation. Update job CKAZCUST following the comments in the JCL and submit job to create the CKACUST library. For every new release, run the job CKAZCUST to create all members expected by AU.R that do not exist yet; the job will not touch members that already exist. The members created will contain empty lists.

Feedback