Hello, dear zSecure community,
I would like to output a report in table structure.
Here are the CARLA commands:

n required segment=TSO n=selsegm outlim=0 nopage                        
  s c=user segment=TSO                                                  
  sortlist segment                                                      
n n=baseu1 segment=BASE required allowrestrict proflist=selsegm nopage, 
 ,                                                                      
 tt="zSecure Admin+Audit for RACF USER overview",                       
 st='Users connected to #TSOL* with segment TSO'                        
 s s=base c=user  CGGRPNM=#TSOL*                                        
 sortlist,                                                              
 ,                                                                      
 key(8,"User") cggrpnm  

I only want to output users who have a TSO segment and belong to a group that starts with #TSOL.

The Output:

MODXXX   #TXXXXP   
         #TXXXXA   
         DBXXXX05  
         DBXXXX08  
         DBXXXX09  
         DBXXXX03  
         DBXXXX05  
         DBXXXX08  
         DBXXXX09  
         DBXXXX03  
         DBXXXX08  
         DBXXXX09  
         DBXXXX03  
         DBXXXX05  
         DBXXXX08  
         DBXXXX09  
         DBXXXX08  
         DBXXXX09  
         DBXXXX05  
         DBXXXX08  
         DBXXXX09  

                             

This should result in two columns (unfortunately slightly offset here, as there is no non-proportional font available).
Now I have two questions:
1. How can I make sure that the key is displayed in the first column of each row (or other fields, if I add them)?
2. How can I make sure that only the CGGRPNM that start with the prefix in the select are displayed?

Best regards
Stephan                 

------------------------------
Stephan Reichelt
------------------------------

Hi Stephan,

Re 1:
You can use the RETAIN modifier to repeat the value of a non-repeated field on lines created by the multiple values in a repeated field.
https://www.ibm.com/docs/en/szs/3.2.0?topic=SS2RWS_3.2.0/com.ibm.zsecure.doc_3.2.0/carla_lang/carla_cmnd_lang_list_family_cmds_nonrpt_out_mods.htm

Re 2:
You cannot apply output filtering to CGGRPNM, but you can to CONNECTS.
The CONNECTS field display more information by default, but you can use an overriding length of 8 to only see the connected group [in the case of a user profile].

Filtering CONNECTS uses the SUBSELECT function of the DEFINE command.
https://www.ibm.com/docs/en/szs/3.2.0?topic=define-subselect-clauses

You could do something like 

define myconnects subselect connects(group=#tsol*)

And then use MYCONNECTS instead of CGGRPNM.

Regards,

------------------------------
Jeroen Tiggelman
IBM - Software Development Manager IBM zSecure
Delft
------------------------------

Hi Stephan, you already made a good start by yourself. 

1. To repeat the selected user IDs on each line of your report, you need to add the RETAIN keyword to the NEWLIST statement. That repeart non repeating fields just as many times as there are repeat group entries for CGGRPNM.
2. For only reporting the CGGRPNM that match the prefix your program uses, you can define a subselect variable based on the CONNECTS field. For example something along the lines of:
   
   

   define #TSOLconns(8) subselect connects(group=#TSOL*) 

   And then replace use #TSOLconns in your sortlist instead of CGGRPNM.

I hope this helps.

------------------------------
Tom Zeehandelaar
z/OS Security Enablement Specialist - zSecure developer
IBM
------------------------------

If you're struggling with repeated fields like the connect group names, or access lists, you can look at newlist type=racf_access.  This takes the connect group name (from a user profile), or the access list id (from a DATASET or General resource profile), and creates a separate entry for each.  It allows you to use the SELECT command to select only specific connects groups for users, without the hassle of SUBSELECT.

newlist type=racf_access
  select class=group profile=dbx*
  sortlist id("Userid") profile("Connect")

To find connect groups, you select CLASS=GROUP and the user ID pops up in the field ID.  But how can you find out if a user ID has a TSO segment?

RACF_ACCESS can use the lookup operator to find attributes like the name of the user, the installation data of a group, but also fields from TSO segment.  No, you cannot check if a segment exists, but you must check a field in the segment.  Find a field in the TSO segment that always has a value... TMSIZE, for example.  And remember, the user ID is called ID:

newlist type=racf_access
  select class=group profile=dbx* exists(id:tmsize)
  sortlist id("Userid") profile("Connect")

Note: Changing the font to fixed pitch can be done by selecting (a few) lines, then marking them out as code by clicking {;} or by clicking on the ... button and selecting Preformatted instead of Paragraph.

------------------------------
Rob van Hoboken
------------------------------

Good morning,

Thank you all very much for your quick support.
I now have several possible solutions, which will also help me to better understand CARLA.

Have a great weekend.

Best regards
Stephan

------------------------------
Stephan Reichelt
------------------------------