IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Carla code to compare for redundant RACF Group access

  • 1.  Carla code to compare for redundant RACF Group access

    Posted Fri November 03, 2023 04:29 PM

    Has anyone developed Carla code to compare multiple groups for redundant group access - i.e. any AD* groups that have the same duplicate DATASET/RESOURCE access Permits using MASKing?



    ------------------------------
    David Thomas
    ------------------------------


  • 2.  RE: Carla code to compare for redundant RACF Group access

    Posted Sat November 04, 2023 09:45 AM
    Edited by Rob van Hoboken Sat November 04, 2023 09:57 AM

    Option RA.3.G (Compare IDs) can be used to view a matrix of permits, side by side the access level of the selected groups.  You just enter up to 4 group IDs and select option Compare access through permits.  See manual.  With relatively easy copy/pasting you may extend this to larger numbers of group names, but not supporting masking.  Find the generated CARLa by typing the RESULTS command in the command line after closing the comparison.

    Alternatively, you could use newlist type=racf_access to dump permits into a flat file, like so

    newlist type=racf_access pl=0
      select class<>group id=AD*
      sortlist id access class profile

    Transfer the resulting data set to your workstation, open with Excel or LibreOffice Calc.  Use the pivot tabel wizard to build a matrix of groups by class/profile.  Or go for Python.

    If you're averse to sending RACF data to laptops, look at the Cross Table Generator I wrote.  It was intended as a prototype for a CARLa extension of the SUMMARY command, but never made it to the short list (very short list).

    ------------------------------
    Rob van Hoboken
    ------------------------------