IBM GC28-1920-01 manual DCEUUIDS Class, Signon to, Activating

database. The mvsexpt utility takes a specified input file or

registry

for

each

principal specified

and

creates

the

RACF DC

and

profiles

in

the

RACF

general

resource

class,

DCEUUIDS.

For more information on these utilities,OpenEditionseeDCE Administration .Guide

Although

you

can

administer

the DCEUUIDS

profiles

using

the

RACF

RDEFINE

and RALTER

commands, it stronglyis

recommendedthat you use the OS/390

OpenEdition

DCE utilities.

Attention

Changing

the

UUID

or

HOMEUUID

fields

in a

user

profile

DCE

segment

RACF commands

(such as ADDUSER, ALTUSER, or DELUSER)

doesnot

update DCEUUIDS class profiles. It is

strongly

recommended

that you

OS/390 OpenEdition DCE utilities to maintain

the

DCE

information

contained

within

RACF.

The OS/390 OpenEdition DCE utilities maintain a file of users that have processed. If you perform subsequent administration, and do not use utilities, the processed entry file might not be accurate. Inaccurac can cause unpredictable results the next time the OpenEdition DCE utili used.

Activating	the	DCEUUIDS Class
Before	OS/390	OpenEdition DCE can use profiles defined to the DCEUUIDS
the security		administrator must activate the class. To activate the DCE
enter:
SETROPTS CLASSACT(DCEUUIDS)

Single

Signon to

DCE

RACF

support

for

OS/390 OpenEdition DCE providessinglefor signona

to. DCE

OS/390 OpenEdition DCE single signon signs an MVS user on to DCE

automatically

if

that user has already been authenticated by

RACF. To

signon

to

DCE processing, the

following conditions

must

be

met:

Ÿ

The

security

administrator

has

requested single

signon

to DCE

process

the

user.

Ÿ

The

security

administrator

has

defined

the

DCE

encryption

key.

Ÿ

The

user

is

not currently logged into DCE.

Ÿ

The

user invokes a DCE application.

Ÿ

The

user is defined as a DCE principal to the DCE registry.

Before

OpenEdition DCE

single

signon

support

can

be

invoked

for

an

MVS

us

the

MVS

user must be enrolled for

single

signon

to

DCE. To

enroll:

Ÿ

RACF

setup procedures for DCE interoperability must be completed.

Ÿ

A

DCE

segment

must be created for the MVS

user

in the RACF user pr

The

user profile DCE segment must contain the user's DCE information.

Ÿ

The

AUTOLOGIN

value in the user's DCE segment

must be

set

to

YES

to

invoke

single

signon processing. If the value

is

set to

NO,

single

si

DCE

processing

does

not occur.

38

OS/390 V1R2.0

Security

Server

(RACF)

Planning:

Installation and

Migration