IBM GC28-1920-01 Utility, Enhancements to the, Rdceruid Callable Service, SOMobjects for MVS

resources. Profiles must reside in storage before RACROUTE
REQUEST=FASTAUTH can	be used to verify a user's	access to	a resourc
Ÿ The client/server	relationship is not propagated	from the	application

If	the security	administrator	implements access	control bothto	resources th
the	server's RACF	identity and	the client's RACF	identity in	an access

decision, application servers that the security administrator does not treated endas pointson OS/390. These servers notshouldbe allowed to submit batch jobs or use the services of other servers that run exclusively identity of the client. This is because the relationship of the clien identity pair is not propagated to other applications or servers. The administrator must enforce this through administrative procedures by ens applications servers that do not meet notthisauthorizedcriteria areto the profile BPX.SERVER in the RACF FACILITY class. By denying the untrusted servers

authorization to BPX.SERVER, the	security administrator	ensures	that	all
done by the server, including	job submission and the	use of	other	se
using the server's identity.

Controlling	the	R_dceruid Callable Service
The security		administrator must define the IRR.RDCERUID		profile in th
class to control the use of the SAF			R_dceruid callable	service. This
service	maps	the DCE UUID to the	RACF user ID.

Check your installation for programs that use:

Ÿthe SAF R_dceruid callable service

or services that call it, such as:

Ÿ the OS/390 OpenEditionconvert_id_np callable service

Ÿthe C library functionconvert_id_np() function call

Users or	servers	using programs	that use these services must	have REA
or higher	to the	profile that	protects IRR.RDCERUID in the	FACILITY

Enhancements to the	Remove	ID	Utility
The RACF remove ID utility, IRRRID00, has been									enhanced to search		pr
defined to the DCEUUIDS class						when removing a user ID. The utility g
output consisting of commands that remove							DCEUUIDS		class profiles	in	whic
APPLDATA field			contains	the	user	ID being	removed.
The	RACF	security administrator				should contact		the	DCE administrator	when
removing a user ID				which	has	been cross-linked with a DCE principal, to
if	the	DCE	principal	should be		deleted	from	the	cell.

SOMobjects for MVS

The	security administrator must permit the users who	are allowed to	us
SOM	servers and are allowed to use specific methods	within classes	to

within the new RACF CBIND and SOMDOBJS classes. In addition, the securit administrator must define which servers are known to the SOM daemon, by defining profiles within the new RACF SERVER class.

42 OS/390 V1R2.0 Security Server (RACF) Planning: Installation and Migration