Introduction to command security

CICS® command security applies to system programming commands; that is, commands that require the special CICS translator option, SP. Security checking is performed for these commands, when they are issued from a CICS application program, and for the equivalent commands that you can issue with the CEMT main terminal transaction.

Table 1 shows the commands that are subject to command security checking:

Table 1. Access required for system programming commands
Command name	Access required
COLLECT CSD DISCONNECT CSD ENDBRGROUP CSD ENDBRLIST CSD ENDBRRSRCE CSD GETNEXTGROUP CSD GETNEXTLIST CSD GETNEXTRSRCE CSD INQUIREGROUP CSD INQUIRELIST CSD INQUIRERSRCE CSD STARTBRGROUP CSD STARTBRLIST CSD STARTBRRSRCE EXTRACT STATISTICS INQUIRE	READ
DISABLE CSD ADD CSD ALTER CSD APPEND CSD COPY CSD DEFINE CSD DELETE CSD LOCK CSD REMOVE CSD RENAME CSD UNLOCK CSD USERDEFINE ENABLE EXTRACT (but not EXTRACT STATISTICS) PERFORM RESYNC SET	UPDATE
CREATE CSD INSTALL DISCARD	ALTER
Note: Because the PERFORM CORBASERVER SCAN might result in the dynamic creation and installation of DJAR resources, the PERFORM CORBASERVER SCAN command requires ALTER access to the DJAR command security resource as well as UPDATE authority to the CORBASERVER resource.

Command security operates in addition to any transaction or resource security that you define for a transaction. For example, if a user is permitted to use a transaction called FILA, which issues an EXEC CICS INQUIRE FILE command that the user is not permitted to use, CICS issues a not authorized (NOTAUTH) condition in response to the command, and the command fails.

Front End Programming Interface security uses the same mechanism for authorization as the system programming commands, using the FEPIRESOURCE resource name.

Note: To determine who is allowed to use the SP option on the CICS translator, you can use RACF® to control who is allowed to load the DFHEITBS table at translation time. For a description of RACF program control, see the z/OS Security Server RACF Security Administrator's Guide. DFHEITBS is the language definition table that defines the system programming commands. It is loaded only on demand.