|
| database. The mvsexpt utility takes a specified input file or | ||||||||||||||||
|
| registry | for | each | principal specified | and | creates | the | RACF DC | |||||||||
|
| and | profiles | in | the |
| RACF | general | resource | class, | DCEUUIDS. | |||||||
For more information on these utilities,OpenEditionseeDCE Administration .Guide |
| |||||||||||||||||
Although | you | can | administer | the DCEUUIDS | profiles | using | the | RACF | RDEFINE | |||||||||
and RALTER | commands, it stronglyis | recommendedthat you use the OS/390 |
| |||||||||||||||
OpenEdition | DCE utilities. |
|
|
|
|
|
|
|
|
|
|
| ||||||
| Attention |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| ||
Changing | the | UUID | or | HOMEUUID | fields | in a | user | profile | DCE | segment | ||||||||
RACF commands | (such as ADDUSER, ALTUSER, or DELUSER) | doesnot |
|
|
| |||||||||||||
update DCEUUIDS class profiles. It is | strongly | recommended | that you | |||||||||||||||
OS/390 OpenEdition DCE utilities to maintain | the | DCE | information | contained | ||||||||||||||
within | RACF. |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |||
The OS/390 OpenEdition DCE utilities maintain a file of users that have processed. If you perform subsequent administration, and do not use utilities, the processed entry file might not be accurate. Inaccurac can cause unpredictable results the next time the OpenEdition DCE utili used.
Activating | the | DCEUUIDS Class |
Before | OS/390 | OpenEdition DCE can use profiles defined to the DCEUUIDS |
the security | administrator must activate the class. To activate the DCE | |
enter: |
|
|
SETROPTS CLASSACT(DCEUUIDS) | ||
Single | Signon to | DCE |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| RACF | support | for | OS/390 OpenEdition DCE providessinglefor signona | to. DCE |
|
|
| ||||||||||
|
| OS/390 OpenEdition DCE single signon signs an MVS user on to DCE |
|
|
| ||||||||||||||
|
| automatically | if | that user has already been authenticated by | RACF. To | ||||||||||||||
|
| signon | to | DCE processing, the | following conditions | must | be | met: |
|
|
| ||||||||
|
| Ÿ | The | security | administrator | has | requested single | signon |
| to DCE | process | ||||||||
|
|
| the | user. |
|
|
|
|
|
|
|
|
|
|
|
| |||
|
| Ÿ | The | security | administrator | has | defined | the | DCE | encryption | key. |
| |||||||
|
| Ÿ | The | user | is | not currently logged into DCE. |
|
|
|
|
|
|
| ||||||
|
| Ÿ | The | user invokes a DCE application. |
|
|
|
|
|
|
|
| |||||||
|
| Ÿ | The | user is defined as a DCE principal to the DCE registry. |
|
| |||||||||||||
|
| Before |
| OpenEdition DCE | single | signon | support | can | be | invoked | for | an | MVS | us | |||||
|
| the | MVS |
| user must be enrolled for | single | signon | to | DCE. To | enroll: |
|
| |||||||
|
| Ÿ | RACF | setup procedures for DCE interoperability must be completed. |
| ||||||||||||||
|
| Ÿ | A | DCE |
| segment | must be created for the MVS | user | in the RACF user pr | ||||||||||
|
|
| The | user profile DCE segment must contain the user's DCE information. | |||||||||||||||
|
| Ÿ | The | AUTOLOGIN | value in the user's DCE segment | must be | set | to | YES | to | |||||||||
|
|
| invoke | single | signon processing. If the value | is | set to | NO, | single | si | |||||||||
|
|
| DCE | processing | does | not occur. |
|
|
|
|
|
|
|
|
| ||||
38 | OS/390 V1R2.0 | Security | Server | (RACF) | Planning: | Installation and | Migration |
|
|
|
|
|
|
|
| ||||
