Steps for authorizing users to the random number generate service (CSFRNG)

About this task

Before you begin: You need to be sure that the CSFRNG resource profile has been defined. If it hasn't, then issue the following command where CSFSERV is the class name and CSFRNG is the profile name:

RDEFINE CSFSERV CSFRNG UACC(NONE)

Perform the following steps to authorize users to the random number generate service (CSFRNG):

Procedure

Use one of the following commands to give READ access to the CSFRNG profile, based on your site's security policy:
- To give a user READ access to the CSFRNG profile, where userid is the UID for the specified user, issue:
```
PERMIT CSFRNG CLASS(CSFSERV) ID(userid) ACCESS(READ)
```
  If you choose to give READ access to individual users, you need to repeat this step for each user who requires access.
- To give READ access for a specific group to the CSFRNG profile where groupid is the GID for the specified group, issue:
```
PERMIT CSFRNG CLASS(CSFSERV) ID(groupid) ACCESS(READ)
```
  Verify that the intended user IDs are added to the group.
- To give READ access for all RACF®-defined users and groups to the CSFRNG profile, issue:
```
PERMIT CSFRNG CLASS(CSFSERV) ID(*) ACCESS(READ)
```
  Giving all users and groups READ access to the CSFRNG profile is an unconditional way to authorize users. The security administrator must take the site's security policy into consideration when deciding whether to give all RACF-defined users and groups access to CSFRNG. z/OS Cryptographic Services ICSF Administrator's Guidehas information about the CSFRNG profile.
- Starting with ICSF version HCR77A1, you can disable checking of this resource:
```
RDEFINE XFACILIT CSF.CSFSERV.AUTH.CSFRNG.DISABLE UACC(READ)
SETROPTS REFRESH RACLIST(XFACILIT)
```
_______________________________________________________________
Verify that all user IDs given access to this class have an OMVS segment defined and are not using the default OMVS segment.
_______________________________________________________________
Refresh the CSFSERV class.
```
SETROPTS RACLIST(CSFSERV) REFRESH
```
_______________________________________________________________

Results

When you are done, you have authorized users to the random number generate service (CSFRNG).