z/OS Security Server RACF Security Administrator's Guide
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


RRSF considerations for applications that exploit enveloping

z/OS Security Server RACF Security Administrator's Guide
SA23-2289-00

Applications that exploit LDAP change log entries for registry synchronization should take network topology into account when propagating locally initiated RACF® changes to other z/OS® RACF systems in the network. In particular, if RACF is configured in an RRSF network and user profile, password, or password phrase updates are synchronized across RRSF nodes, then application deployment must include consideration of which propagation mechanism is used for specific types of changes to specific systems. Neglecting the interaction of the various propagation mechanisms could result in an unending cascade of updates for the same RACF change. For example, for an RRSF network that fully mirrors updates to user profiles, passwords, and password phrases, an LDAP based propagation mechanism should only communicate with a single RRSF node, and let that node propagate the change to other RACF nodes. Further, this RACF node should be the only node configured to perform LDAP event notification for user updates.

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014