Security requirements

Use one of the following methods:

• For the user ID, grant authorized read access to BPX.SUPERUSER (the Facility class resource).

  Information

  Example

  permit BPX.SUPERUSER CLASS(FACILITY) ACCESS(READ) ID(<userID>)

• For the user ID, grant authorized read access to SUPERUSER.PROCESS.GETPSENT (the UNIXPRIV class resource).

  Information

  Example

  permit SUPERUSER.PROCESS.GETPSENT CLASS(UNIXPRIV) ACCESS(READ) ID(<userID>)

  When you use this method on z/OS 2.5 and PTF UJ95913 is applied, you might receive the following message: 

  ICH408I (<userID>)(<groupID>)(<startedTaskname>) 751
  751 CL(PROCESS )
  751 INSUFFICIENT AUTHORITY TO SETUID
  751 EFFECTIVE UID(<userIDnumber>) EFFECTIVE GID(<groupIDnumber>)

  If you receive this message, this method is no longer available, so use the first method. 

For more information, see OMVS-segment-requirements-and-ESM-definitions

For the user ID, grant authorized read access to BPX.JOBNAME (the Facility class resource).

To activate the new definitions, you might need to refresh the updated class.

For more information, see Managing security for BMC AMI Ops products.

1. For the z/OS Connect EE user ID, grant authorized read access to BPX.SMF (the Facility class resource).

   PERMIT BPX.SMF CLASS(FACILITY) ACCESS(READ) ID(<userID>)

   For userID, specify the z/OS Connect EE user ID.

2. For the BMC AMI Ops Monitor for Java Environments user ID, grant authorized read access to BBGZDFLT.ZOS (the APPL class resource).

   PE <BBGZDFLT> ID(<userID>) CLASS(APPL) ACCESS(READ) 

   For userID, specify the PAS user ID. The PAS must have the appropriate security certificates associated with its user ID.

   For BBGZDFLT, specify the APPL class security prefix for the server.

For the BMC AMI Ops Monitor for Java Environments user ID, grant authorized read access to the Liberty server (the EJBROLE class resource).

For userID, specify the PAS user ID. The PAS must have the appropriate security certificates associated with its user ID.

For serverProfilePrefix, specify profile prefix for the Liberty server.

For the user ID, grant authorized read access to MVS.MCSOPER.** CL(OPERCMDS):

Specifying ** grants general access to MVS.MCSOPER.

Alternatively, you can grant specific access to the BMC AMI OpsMJE console. The default console name is OPSMJExx when the following conditions exist:

• The default console name prefix is OPSMJE. The console name prefix is specified in the EMCSPREF keyword in MJEINIxx.
• The console name suffix given by a PAS (xx) is a value from 01 through 99.