Example for restricting access to application environment servers

In this example, the installation has the following situation:
  1. Activate STARTED and SERVER classes (if not already done):
      SETR CLASSACT(STARTED) RACLIST(STARTED) GENERIC(STARTED)
      SETR CLASSACT(SERVER)  RACLIST(SERVER)  GENERIC(SERVER)
  2. Establish an arbitrary user ID to use in a subsequent RDEFINE command to tie an MVS procedure name to a server.
      ADDUSER DB2SERV NOPASSWORD
    The NOPASSWORD keyword here is important, it makes DB2SERV a protected user.
  3. Associate the user ID with the started task name.
      RDEFINE STARTED PAY*.* STDATA(USER(DB2SERV) GROUP(SYS1))
      RDEFINE STARTED PER*.* STDATA(USER(DB2SERV) GROUP(SYS1))
  4. Define server profiles in the form:
      subsys_type.subsys_name.applenv[.subsys_node]
    where,
    subsys_type
    is the subsystem type, as specified in the service definition
    subsys_name
    is the instance name of the subsystem associated with this server. Refer to subsystem reference information for how to determine the subsystem name. The subsystem uses this name when establishing itself as the work manager for application environment server requests.
    subsys_node
    is the node name of the server when Work_Manager=Yes is specified. This is an optional parameter.
    applenv
    is the application environment name, as specified in the service definition
      RDEFINE SERVER DB2.DB2A.* UACC(NONE)
      RDEFINE SERVER DB2.DB2B.* UACC(NONE)
    Note: The maximum length of a server profile name passed to a SAF product is restricted to 41 characters. WLM cannot start server address spaces for application environments that do not follow this restriction. If you ensure that the applenv is at maximum 27 characters long, it is guaranteed that the maximum server profile name length does not exceed 41 characters.
  5. Permit the userid to the servers. This completes the association between the MVS procedure names and the servers:
      PERMIT DB2.DB2A.* CLASS(SERVER) ID(DB2SERV) ACCESS(READ)
      PERMIT DB2.DB2B.* CLASS(SERVER) ID(DB2SERV) ACCESS(READ)
  6. Refresh the classes to refresh the RACF® data base and make these changes go into effect:
      SETR RACLIST(STARTED) REFRESH
      SETR RACLIST(SERVER) REFRESH