z/OS Security Server RACF Security Administrator's Guide
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


Steps for authorizing users to define custom fields

z/OS Security Server RACF Security Administrator's Guide
SA23-2289-00

Before you begin:
  • In these steps, you will define FIELD profiles to authorize users to access some or all fields in the CFDEF segment of CFIELD profiles. For a complete listing of the profile name qualifiers you can use to control each field, see details about the CFDEF segment in Table 1.
  • You can define generic profiles in the FIELD class if you enable generics in the FIELD class:
    SETROPTS GENERIC(FIELD)
Optionally, perform the following steps to delegate the authority to view and define custom fields.
  1. Authorize all users to use the RLIST command to view all fields in the CFDEF segment of CFIELD profiles.

    When you authorize UACC(READ) for the appropriate FIELD profiles, users can use the RLIST command to display custom field names and attributes for those fields. This information is useful to users who add CSDATA for those fields.

    Example:
    SETROPTS GENERIC(FIELD)
    RDEFINE FIELD CFIELD.CFDEF.* UACC(READ)
    
    SETROPTS CLASSACT(FIELD) RACLIST(FIELD)
      or, if the FIELD class is already in use:
    SETROPTS RACLIST(FIELD) REFRESH

    ______________________________________________________________________

  2. Authorize selected users and groups to use the RDEFINE and RALTER commands to define and modify all fields in the CFDEF segment of CFIELD profiles.

    When you authorize UPDATE access to the appropriate FIELD profiles, you delegate authority to define custom fields.

    Example:
    ALTUSER USERADM CLAUTH(CFIELD)
    PERMIT CFIELD.CFDEF.* CLASS(FIELD) ID(USERADM) ACCESS(UPDATE)
    SETROPTS RACLIST(FIELD) REFRESH

You have now authorized users and groups to update fields in the CFDEF segment of CFIELD profiles. This allows them to view and define custom fields. It does not allow them to add or view data in the CSDATA of user and group profiles. To authorize users to add or view data in CSDATA segments, perform the steps in Authorizing users to update data in a custom field.

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014