Mainframe · RACF

Adding Users to RACF

racf tso racf-ids userids

RACF users can be made with the ADDUSER command. Because creating a user is a multiple step process with a lot of different RACF commands involved, creating a user via batch is common. RACF commands can be run in batch with the IKJEFT01 program, which allows you to execute TSO commands in batch.

The minimum command you can enter is:

ADDUSER <userid>

You can also list a user once created to view information about them:

LU <userid>

Or delete a user:

DELUSER <userid>

Adding a user with the above command doesn't automatically mean they can log onto a mainframe. To perform certain tasks they need segments and permissions added to their profile, for example:

  • TSO login → needs a TSO segment
  • USS/OMVS usage → needs an OMVS segment

Protected User IDs

A user created without these segments (without the ability to login) is called a 'protected uid' [1] or sometimes a 'functional uid'. Protected IDs are often used to own and run started tasks, own certificates, and similar non-interactive purposes.

It is good practice to break up tasks and applications into separate protected UIDs and not have them associated with a real user, as that user may become revoked and all the services associated with them will cease to function. Protected UIDs are non-revocable by time expiry — they can only be revoked by explicit command.

Creating an Interactive User

To create a user that can be logged onto you need to add a TSO segment — it is also best practice to give the account details like the user's full name, a default security group, and an owner. If these are not specified, defaults from the system ICHRIN03 module or RACF defaults are used.

ADDUSER <userid> DFLTGRP(<groupid>) OWNER(<ownerid>) NAME('<firstname lastname>') PASSWORD(<temp password>)

Adding a TSO Segment

By creating the TSO segment with additional parameters, we can have fields in the TSO login screen auto-populate for the user.

ACCTNUM — must be already defined to RACF in the ACCTNUM resource class and the UID must have read access to it. This can be added with the command:

PE <account number> CL(ACCTNUM) ID(<userid>)

PROC — for the default logon procedure. More on logon procedures can be found in the TSO Logon Procedures and RACF post.

MAXSIZE — the maximum session size the user is allowed to allocate to themselves on logon in KB. The largest possible session size is 2,096,128 KB (approximately 2 GB).

TSO(ACCTNUM(<account number>) PROC(<default logon proc>) MAXSIZE(<maximum session size>))

Adding an OMVS Segment

The same can be done to add the OMVS segment. Like traditional UNIX, a UID of 0 can be set to grant superuser — or any other number for a regular user.

OMVS(HOME(/u/<lowercase userid>) UID(1000) SHARED PROGRAM(/bin/sh))

A Full Example Job to Make a User ID

//ADDUSER JOB ,'add user',
//  MSGCLASS=X,CLASS=A,NOTIFY=&SYSUID
//ADD     EXEC PGM=IKJEFT01
//SYSTSPRT DD   SYSOUT=*
//SYSTSIN  DD   *,SYMBOLS=(EXECSYS,SYMPRINT)
 ADDUSER <userid>                          -
         DFLTGRP(<groupid>)               -
         OWNER(<ownerid>)                 -
         NAME('<firstname lastname>')     -
         PASSWORD(<temp password>)
 ALTUSER <userid>                          -
         TSO(ACCTNUM(<account number>)    -
             PROC(<default logon proc>)   -
             MAXSIZE(2096128))             -
         OMVS(HOME(/u/<lowercase userid>) -
              UID(1000)                    -
              SHARED                      -
              PROGRAM(/bin/sh))
/*

This will make the user ID. We should also do a couple of other things so they can create mainframe datasets under their userid, have secure datasets, and use their OMVS segment.

Defining a Catalog Alias

Add their userid as a related alias to your system's user catalog if it has one (it is best practice). The user's datasets will then be catalogued on the user catalog.

//DEFALIAS EXEC  PGM=IDCAMS
//SYSPRINT   DD  SYSOUT=*
//SYSIN DD *,SYMBOLS=(EXECSYS,SYMPRINT)
   DEFINE ALIAS                       -
          (NAME(&SYSUID)               -
           RELATE('CATALOG.UCATALOG')) -
/*

Protecting Datasets with RACF

Protect their userid-qualified datasets with RACF. Allow other users none or minimal, controlled access to the user's datasets.

//DEFRACF EXEC PGM=IKJEFT01
//SYSTSPRT DD   SYSOUT=*
//SYSTSIN  DD   *,SYMBOLS=(EXECSYS,SYMPRINT)
 ADDSD '<userid>.*' GENERIC UACC(NONE) OWNER(<ownerid>)
 PERMIT '<userid>.*' GENERIC ID(<userid>) ACCESS(CONTROL)
 SETROPTS GENERIC(DATASET) REFRESH
/*

Creating a ZFS for OMVS

Create a ZFS for their UNIX data and make sure to format it. This should be mounted at the user home directory listed in the profile's OMVS segment, which will need to be created if it has not been already. Some systems may have automation set up to automount user directories to USS.

//DEFZFS    EXEC PGM=IDCAMS
//SYSPRINT  DD SYSOUT=*
//SYSUDUMP  DD SYSOUT=*
//SYSIN DD *,SYMBOLS=(EXECSYS,SYMPRINT)
  DEFINE CLUSTER (NAME(<userid>.USER.ZFS) -
     ZFS                                   -
     CYL(5 5) SHAREOPTIONS(3))
/*
//CREATZFS  EXEC PGM=IOEAGFMT,REGION=0M,
//   PARM='-aggregate <userid>.USER.ZFS -compat'
//SYSPRINT  DD SYSOUT=*

References

[1] IBM — Defining Protected User IDs

More about the available parameters that can be used with ADDUSER and the TSO and OMVS segments can be found in IBM's documentation.

← Back to Mainframe ← All posts