Suggested CARLa program - RACLIST results for IMS transaction TEST1

In this example, an additional column is included that indicates whether the permitted ID is a user ID or a Group. However, most RACF shops might use a naming convention that separates user IDs from group profiles by the profile name.

The output might look like this screen capture:

 

Notes regarding the above CARLa code used for producing the customized “RACLIST result reports”.

• In the SIMULATE statement, you specify for which class and resource you want to run this simulation. The resource names are case-sensitive and must be specified in capitals. The following classes assign a non-standard meaning to the member list and are not supported for resource simulation: CONNECT, DIGTNMAP, DIGTCERT, DIRACC, DIRAUTH, FSSEC, FSOBJ, GLOBAL, GMBR, GROUP, IDIDMAP, NDSLINK, NODES, NODMBR, NOTELINK, PMBR, PROGRAM, RACFVARS, RVARSMBR, SCDMBR, SECDATA, SECLABEL, SECLMBR, UNIXMAP, USER, VMBR, VMEVENT, VMXEVENT, and VXMBR.
   
• The special length output modifier of “0” used in the DEFINE statements strips off all trailing blanks. If a variable is empty when length output modifier “0” is specified, this entire variable is omitted from the output.
   
• The output modifier STR$BLANK prints the specified string when the flag is true, otherwise it prints blanks. So for the first define statement it prints the string “User” if the permitted ID has a default group.
   
• The keyword BOOLEAN indicates that this variable is a YES/NO flag. When the condition is true, the BOOLEAN is set to YES. When false the BOOLEAN contains NO.
   
• The condition EXISTS(ID:DFLTGRP) is a combination of the EXISTS and LOOKUP function. The LOOKUP function uses the value stored in field ID to retrieve the value of field DFLTGRP from the profile that matches the ID. If the matching profile is a user ID, the value of the DFLTGRP is successfully retrieved. This result causes the EXISTS condition to be true.
   
• The condition EXISTS(ID:SUPGROUP) is the same combination of the EXISTS and LOOKUP function. The LOOKUP function uses the value stored in field ID to retrieve the value of field SUPGROUP from the profile that matches the ID. If the matching profile is a group profile, the value of the SUPGROUP is successfully retrieved. This result causes the EXISTS condition to be true.
   
• The pipe sign (“|”) in the SORTLIST statement suppresses the automatically inserted blank between two columns in a report.

 

 

Continue with Monitoring access through OPERATIONS

 

© Copyright IBM Corp. 2012, 2020

IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.