SYS1.UADS is the default dataset listing users that are allowed to use TSO/E [1]. Most sites that have RACF or other security products installed use those products to maintain their TSO/E logon information [2]. For a first time installation of RACF, IBM provides a command called RACONVRT to move users from SYS1.UADS to the RACF database [3]. Before you do this, RACF must be set up to protect TSO resources [4].
Once your site is using RACF to manage TSO users (or if your site already is), you can define specific logon procedures for specific users, and allow or disallow users to use certain logon procedures.
Logon Procedures
Say we have a given logon procedure we would like to define — TSLOGP in SYS2.PROCLIB.
At minimum, a logon procedure must have a terminal monitor program (TMP), which is a program that allows a user session to communicate with TSO/E [5]. You may be familiar with the IKJEFT01, IKJEFT1A, and IKJEFT1B TMPs, which can also be used with a JCL job to run commands that you might typically enter in your session in an environment outside of your session — this can keep your screen free so you can keep working if it's a command that will take a long time to execute.
Let's assume the SYS2.PROCLIB(TSLOGP) procedure looks something like this:
//TSLOGP EXEC PGM=IKJEFT01,DYNAMNBR=20
//SYSIN DD TERM=TS
//SYSPRINT DD TERM=TSThis is a minimal logon procedure [6] — it does not define things such as ISPF panels, or other macros or software products. With this logon procedure a user will be limited to working directly from TSO/E.
Like the name of a job in the job card, the first //TSLOGP is the name of our procedure. We are executing IKJEFT01, and the SYSIN and SYSPRINT DDs are both set to the user's terminal session. This allows us to enter TSO commands to IKJEFT01 and for it to return the output to our terminal. The DYNAMNBR param refers to how many datasets you can dynamically allocate at the same time [6] — these are datasets allocated with the TSO ALLOC command, for example.
Defining Logon Procedures to RACF and Permitting Their Use
With your procedure in place, you need to define it to RACF and permit access:
/* Define the procedure to RACF with no universal access */
RDEFINE TSOPROC TSLOGP UACC(NONE)
/* Permit a specific user to use it */
PERMIT TSLOGP CLASS(TSOPROC) ID(<your id>) ACCESS(READ)
/* Refresh the TSOPROC class */
SETROPTS RACLIST(TSOPROC) REFRESHIf you want everyone to be able to use the procedure, use UACC(READ) when defining it and skip the PERMIT step.
After the SETROPTS REFRESH, you should be able to log on with your new procedure. To specify the procedure at logon time, enter it in the Logon Procedure field on the TSO/E logon panel. To set it as a user's default, use the PROC keyword in their RACF TSO segment — see Adding Users to RACF for more on that.