II13591: OSA/SF IOAC109E ICH408I RACF AUTHORITY

APAR status

• INTRAN

Error description

• When tso user issues get_debug command, supplying his own user
  ID as the high level qualifier, receive following errors:
  IOAC109E File allocation error. Error code FFFF9700 info code 0
  and on syslog:
  ICH408I USER(OSASF   ) GROUP(RACFPROC) NAME(SHAW, D.J. (DAVID)
    MARTIN.QUERY.DEBUG.MESSAGE CL(DATASET ) VOL(*BLANK)
    DEFINE - INSUFFICIENT AUTHORITY
  
  SOLUTION:
  User OSASF must have ALTER access to tso user's datasets (the
  tso user profile user.*).
  .
  General OSA/SF RACF guidelines:
  - The OSA/SF started procedure must have ALTER access to the
    calling user's dataset profile, or ALTER access (or
    equivalent) to the dataset profile of the user/group for any
    HLQ passed by the user for dataset allocation.
  - A user must have at least READ access for any other HLQ passed
    for dataset allocation.
  .
  For Example,
   To create the RACF dataset profile issue the following RACF
   Commands:
     ADDSD 'MARTIN.*' UACC(NONE)
   -Or, If RACF Enhanced generic Naming is Active (EGN),
  ADDSD 'MARTIN.*.**' UACC(NONE)
  .
  Then issue the appropriate Permit:
     PE 'MARTIN.*' ACC(ALTER) ID(OSASF)
  -Or, If EGN is Active
    PE 'MARTIN.*.**' ACC(ALTER) ID(OSASF)
  .
   Refresh the Class:
     SETR GENERIC(DATASET)REFRESH
  .
   You can then verify the existence of the covering profile:
     LISTDSD DA('MARTIN.QUERY.DEBUG.MESSAGE') GENERIC
   Should then return with:
     INFORMATION FOR DATASET MARTIN.* (G)
   -Or, If EGN is Active
     INFORMATION FOR DATASET MARTIN.*.** (G)
   . . .
   Note:
    Either providing the OSASF Started Task with the RACF TRUSTED
    Attribute, or granting RACF OPERATIONS authority to the
    associated useridwould allow OSASF to define the TRACE
    datasets with 'any' user's HLQ, without the above dataset
    definitions. Keep in mind that the TRUSTED and OPERATIONS
    settings should be okay'dwith your security folks.
  

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels