z/OS Security Server RACF Security Administrator's Guide
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


Interaction between automatic password direction and automatic direction of application updates

z/OS Security Server RACF Security Administrator's Guide
SA23-2289-00

Automatic password direction propagates user password and password phrase updates. Automatic direction of application updates does not propagate user password and password phrase changes. If updates to fields unrelated to the password (or password phrase) are made with the same ICHEINTY macro execution that updates the password (or password phrase), the propagation of the unrelated fields is controlled by automatic direction of application updates.

A single ICHEINTY macro TYPE='USR' with ACTIONS= that specifies both password and non-password user information will result in the propagation of two requests to the target node: one request (to define the user) is propagated by automatic direction of application updates, and the other (to specify password information for the same user) is propagated by automatic password direction. Requests propagated by automatic direction of application updates execute at the target node using the authority of the user ID associated with the application that issued the ICHEINTY to define the user. Requests propagated by automatic password direction execute at the target node using the authority of the user whose password information is to be changed. Because these two requests execute using the authority of different user IDs, they can execute concurrently with unpredictable results.

Unpredictable results might occur with propagation of password and non-password user information through any combination of ICHEINTY macro executions, such as a program executing a single ICHEINTY, or multiple ICHEINTY executions within the same or different programs. For this reason, the recommended methods for defining RACF® users are:
  1. Execute the ADDUSER command
  2. Invoke the R_admin callable service from an application program
Automatic password direction can be used to propagate a password update for a user only when that user is defined to RACF on both the source and target nodes.

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014