Space announcement This documentation space provides the same content as before, but the organization of the content has changed. The content is now organized based on logical branches instead of legacy book titles. We hope that the new structure will help you quickly find the content that you need.

Task 8.3: Defining security rules

The roles involved are: Xchange Installer Security Administrator.

The SECPFX parameter is used to define a one- to eight-character prefix for security pseudo-data set names (see SECPFX). The default of CWXG can be changed to suit site requirements.

Whatever prefix is chosen should be unique in that it does not duplicate any existing data set name prefix within the installation's system.

Important

If RACF is the security access method you are using, this prefix must be defined as a group or user ID to RACF.

If the Xchange CMSC PARMLIB member parameter SECADRSP=NO, a pseudo-data set name is built for each Xchange request. The format is

prefix.jobname.stepname.procstep.pgmname

The values for jobname, stepname, procstep, and pgmname are taken from the Xchange request specified for the step and from the system at the time the job makes an SVC11 or other TIME services call.

Important

If a job is being run as a started task and has no procstep, the pseudo-data set name would have the format prefix.jobname.stepname.pgmname.

To prevent a TSO userID from being exchanged, deny update access to the pseudo-data set name prefix.userID.**.

If the Xchange CMSC PARMLIB member parameter SECADRSP=YES, a pseudo-data set name is built for each Xchange request based on whether the request is for a batch job, a started task, or a TSO address space as listed in the following table.

Xchange Pseudo-Data set Names

Pseudo-Data set Name

Purpose

prefix.JOB.jobname.stepname.procstep.pgmname

For batch jobs

prefix.STC.jobname.stepname.pgmname

For started tasks

prefix.TSU.userID

For TSO address spaces

The values for jobname, stepname, procstep, and pgmname are taken from the Xchange request specified for the step and from the system at the time the job makes an SVC11 or other TIME services call.

Important

To prevent a TSO userID from being exchanged, deny update access to the pseudo-data set name prefix.TSU.userID.**.

This section provides information about the following topics:

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*