z/OS Security Server RACF Security Administrator's Guide
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


Setting up the BPX.NEXT.USER profile

z/OS Security Server RACF Security Administrator's Guide
SA23-2289-00

BPX.NEXT.USER is a FACILITY class profile that is used by RACF® to derive unused UID and GID values. Note that the FACILITY class does not have to be active for RACF to use BPX.NEXT.USER. When creating the BPX.NEXT.USER profile, generic characters cannot be used in the name.

The APPLDATA field contains the starting UID or GID value or range of values separated by a forward slash (/). The starting value is the value RACF attempts to use in ID assignment, after determining that the ID is not in use. If it is in use, the value is incremented until an appropriate value is found.

For example, to have RACF start automatic assignment with a UID value of 1 and a GID value of 0, issue:

Example:
RDEFINE FACILITY BPX.NEXT.USER APPLDATA('1/0')
When the maximum value of 2147483647 is reached, subsequent automatic ID assignment attempts fail and message IRR52181I is issued.

The starting value used is chosen at your discretion. For example, if UID values 0 - 2000 are already in use, and GID values 0 - 200 are already in use, you should use a UID starting value of 2001 and a GID starting value of 201.

Example:
RALTER FACILITY BPX.NEXT.USER APPLDATA('2001/201')

Specifying NOAUTO as a qualifier in the APPLDATA, or omitting the qualifier, prevents automatic ID assignment. For example, if you use employee serial numbers as the convention for assigning UIDs and do not want to use automatic assignment, but want to use automatic GID assignment starting at 3000, issue:

Example:
RDEFINE FACILITY BPX.NEXT.USER APPLDATA('NOAUTO/3000')

Ranges can be useful in an RRSF environment. Specify a starting and ending value separated by a dash () if you want to include a range of values. Both values must be valid UID or GID values and the second must be greater than the first. Ranges can be specified independently for UIDs or GIDs.

Examples:
RDEFINE FACILITY BPX.NEXT.USER APPLDATA('50000-80000/3000-10000')
RDEFINE FACILITY BPX.NEXT.USER APPLDATA('50000/3000-10000') 
RDEFINE FACILITY BPX.NEXT.USER APPLDATA('50000-80000/3000') 
RDEFINE FACILITY BPX.NEXT.USER APPLDATA('NOAUTO/3000-10000')
Notes®:
  • You cannot specify blanks in the APPLDATA string.
  • Syntax checking of APPLDATA does not occur until AUTOUID and AUTOGID operands are specified on the ADDUSER, ALTUSER, ADDGROUP, and ALTGROUP commands.
  • If you have defined BPX.NEXT.USER with incorrect APPLDATA, issuing AUTOUID or AUTOGID fails with message IRR52187I being issued.
  • You can change the APPLDATA values at any time.
  • After successful automatic ID assignment, RACF updates the APPLDATA starting value with either the next potential value or end of range.

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014