z/OS Security Server RACF Security Administrator's Guide
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


Defining the SHARED.IDS profile in the UNIXPRIV class

z/OS Security Server RACF Security Administrator's Guide
SA23-2289-00

To control the use of shared IDs, define a profile called SHARED.IDS in the UNIXPRIV class. You must define this profile to enable each method of automatic assignment of unique UNIX identities. (See Automatically assigning unique IDs using RACF commands and Automatically assigning unique IDs through UNIX services.)

Generic characters cannot be used in the profile name. Because the UNIXPRIV class must be RACLISTed, you must refresh the class after defining or altering the SHARED.IDS profile. If the UNIXPRIV class is not already active and RACLISTed, use the following commands to implement the SHARED.IDS profile:

Example:
RDEFINE UNIXPRIV SHARED.IDS UACC(NONE)
SETROPTS CLASSACT(UNIXPRIV) RACLIST(UNIXPRIV)

If the UNIXPRIV class is already active and RACLISTed, issue the following commands to implement the SHARED.IDS profile:

Example:
RDEFINE UNIXPRIV SHARED.IDS UACC(NONE)
SETROPTS RACLIST(UNIXPRIV) REFRESH

Once you define the SHARED.IDS profile, the default behavior of the ADDUSER, ALTUSER, ADDGROUP, and ALTGROUP commands is changed for the UID and GID options of the OMVS operand. Any attempt to assign an ID already in use fails with message IRR52174I being issued. Similarly, if you attempt to assign the same ID to a group of names on a single command, the command fails with message IRR52185I being issued.

Once you define the SHARED.IDS profile, if you want to make an exception to the enforcement of UNIX identity uniqueness, you must use the SHARED operand.

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014