Previous topic |
Next topic |
Contents |
Contact z/OS |
Library |
PDF
Using ICHEACTN with the DATAMAP=NEW and DATAMAP=OLD operands z/OS Security Server RACF Macros and Interfaces SA23-2288-00 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Installations can choose between using the old datamap format and the release 1.8 datamap format. The following topics explain the relationship between the DATAMAP keyword and the RELEASE keyword. In addition, this topic explains how to use the ICHEACTN to retrieve and alter data when the ICHEINTY macro has DATAMAP=NEW specified and how to use ICHEACTN when the ICHEINTY macro has DATAMAP=OLD specified. Using ICHEACTN to retrieve data when ICHEINTY has DATAMAP=NEWThe ICHEACTN macro retrieves data when used with the ICHEINTY macro which has a LOCATE, NEXT or NEXTC operand. With DATAMAP=NEW on the ICHEINTY and RELEASE=1.8 or later on the ICHEACTN, data retrieval and modification are compatible operations. That is, you can do an ICHEINTY LOCATE followed by an ICHEINTY ALTER (with the same ICHEACTN) and the profile ends up with its original data. Or alternatively, by changing the ENTRY name you could copy data from one profile to another. When using ICHEACTN to retrieve data, you must supply a work area on the ICHEINTY macro into which the retrieved data can be placed. The first fullword of the work area must be the length of the work area (including the first fullword itself). The minimum work area is 30 bytes, even if no data is being retrieved. The format
of the user work area is as follows:
Ensure that the storage in the work area from +4 to +1E is initialized to binary zeros. If the area is not initialized, it can be difficult to determine if the information returned by the RACF® manager is present. If the profile located has a generic name, bit 0 (X'80') of the flag byte at offset (X'0A') is set to on. An
ICHEINTY macro can have several ICHEACTN macros associated with
it. For each ICHEACTN macro, the RACF manager
returns into the field value return area:
When multiple ICHEACTNs are used, each returns data immediately following the data (if any) returned by the preceding ICHEACTN. Note that all the fields are byte-aligned. In addition, if the ICHEACTN contains RELEASE=1.8 or later, the manager places the data length in the fullword at offset 12(X'0C') of the ICHEACTN and places a pointer to the data in the fullword at offset 16(X'10') of the ICHEACTN parameter list if no tests are specified. You must increment these offsets by 4 for each test specified by the ICHEACTN TESTS= parameter. For example, with two tests, the length is returned at X'14' and the address is returned at X'18'. The addresses specified in TESTS= are placed before the FLDATA entries within the parameter list. Therefore, for each address noted within TESTS=, the FLDATA entries are displaced by four bytes. The use of the TESTS= operand increments these offsets by four bytes for each test specified regardless of whether DATAMAP=NEW or DATAMAP=OLD is specified. The following examples show the format of the returned data (and the values that would be placed in the ICHEACTN if you specify RELEASE=1.8 or later). Some examples of the different
field types that the RACF manager
can return in the field value return
area are:
Using ICHEACTN to alter data when the ICHEINTY has DATAMAP=NEWThe ICHEACTN macro alters data when used with the ICHEINTY macro
having an ADD, ALTER, ALTERI, or RENAME operand. If the conditions
specified by the TESTS keyword on the ICHEACTN macro are met, the
field specified in the FIELD operand is assigned the value specified
in the FLDATA operand. If the specified field in the RACF profile is in a repeat group, then:
When replacing data, the FLDATA parameter should describe the size of the data and its address in the same format as shown above for retrieving data. When specifying a combination field, the total size must equal the sum of the individual sizes, including the length fields or the request fails. The specification of FLDATA=‘COUNT’ causes the specified fields to be treated as a positive integer and increased by one. If the field specified is variable length or has a fixed length greater than four, RACF ignores the specification and does not modify the field value. If you specify FLDATA=‘DEL’, the specified field has a null value;
that is:
If you specify zero as the "address" value, the result is the same as if you had specified FLDATA=‘DEL’, except that for fields in a repeat group, the field in the occurrence is set to a null value (the same as fields not in a repeat group). If you specify FLDATA=‘DEL’ or FLDATA=‘COUNT’ on an ICHEACTN, the length field of the ICHEACTN is set to -1 or -2. If you also specify RELEASE=1.8 or later, and then uses the ICHEACTN to retrieve data, these new values will be lost. To avoid this, you should not use the same ICHEACTN for both DEL/COUNT and retrieval processing; or you should use the E-Form to re-establish DEL/COUNT after the data retrieval. Using ICHEACTN to retrieve data when the ICHEINTY has DATAMAP=OLDThe ICHEACTN macro retrieves data when used with the ICHEINTY macro having a LOCATE, NEXT or NEXTC operand. When using ICHEACTN to retrieve data, you must supply a work area on the ICHEINTY macro into which the retrieved data can be placed. The first fullword of the work area must be the length of the work area (including the first fullword itself). The minimum work area is 30 bytes, even if no data is being retrieved. The format of the user work area is as follows:
Ensure that the storage in the work area from +4 to +1E is initialized to binary zeros. If the area is not initialized, it can be difficult to determine if the information returned by the RACF manager is present. If the profile located has a generic name, bit 0 (X'80') of the flag byte at offset (X'0A') is on. This flag bit is useful when performing NEXT or NEXTC operations to process many profiles. An ICHEINTY macro can have several ICHEACTN macros associated with
it. For each ICHEACTN macro, the RACF manager
returns into the field value return area:
Note that all the fields are byte-aligned. In addition, if the ICHEACTN contains RELEASE=1.8 or later, the manager will place the data length in the fullword at offset 12(X'0C') of the ICHEACTN, and will place a pointer to the data in the fullword at offset 16(X'10') of the ICHEACTN parameter list if no tests are specified. You must increment these offsets by 4 for each test specified by the ICHEACTN TESTS= parameter. For example, with two tests, the length is returned at X'14' and the address is returned at X'18'. The addresses specified in TESTS= are placed before the FLDATA entries within the parameter list. Therefore, for each address noted within TESTS=, the FLDATA entries are displaced by four bytes. The use of the TESTS= operand increments these offsets by four bytes for each test specified regardless of whether DATAMAP=NEW or DATAMAP=OLD is specified. The following examples show the format of the returned data (and the values that would be placed in the ICHEACTN if you specify RELEASE=1.8 or later). Some examples of the different field types that the RACF manager can return in the
field value return
area are:
Using ICHEACTN to alter data when ICHEINTY has DATAMAP=OLDThe ICHEACTN macro alters data when used with the ICHEINTY macro
having an ADD, ALTER, ALTERI, or RENAME operand. If the conditions
specified by the TESTS keyword on the ICHEACTN macro are met, the
field specified in the FIELD operand is assigned the value specified
in the FLDATA operand. If the specified field in the RACF profile is in a repeat group, then:
RACF uses the length specified as a subfield of the FLDATA keyword only when you specify GROUP=YES. For fixed-length fields, the data length is the field length in the template. For variable-length fields, the data length is the first data byte (it does not include its own length). RACF handles combination fields as a succession of fields, either fixed or variable length. If the combination field contains some but not all of the fields in a repeat group, the fields not included are set to null values. The specification of FLDATA=‘COUNT’ causes the specified field to be treated as a positive integer and increased by one. If the field specified is variable length or has a fixed length greater than four, RACF ignores the specification and does not modify the field value. If you specify FLDATA=‘DEL’, the specified field is given a null
value; that is:
If you specify zero as the "address" value, the result is the same as if you had specified FLDATA=‘DEL’, except that for fields in a repeat group, the field in the occurrence is set to a null value (the same as fields not in a repeat group). |
Copyright IBM Corporation 1990, 2014
|