IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Creating a report in table structure

    Posted 3 days ago

    Hello, dear zSecure community,
    I would like to output a report in table structure.
    Here are the CARLA commands:

    n required segment=TSO n=selsegm outlim=0 nopage                        
      s c=user segment=TSO                                                  
      sortlist segment                                                      
    n n=baseu1 segment=BASE required allowrestrict proflist=selsegm nopage, 
     ,                                                                      
     tt="zSecure Admin+Audit for RACF USER overview",                       
     st='Users connected to #TSOL* with segment TSO'                        
     s s=base c=user  CGGRPNM=#TSOL*                                        
     sortlist,                                                              
     ,                                                                      
     key(8,"User") cggrpnm  

    I only want to output users who have a TSO segment and belong to a group that starts with #TSOL.

    The Output:

    MODXXX   #TXXXXP   
             #TXXXXA   
             DBXXXX05  
             DBXXXX08  
             DBXXXX09  
             DBXXXX03  
             DBXXXX05  
             DBXXXX08  
             DBXXXX09  
             DBXXXX03  
             DBXXXX08  
             DBXXXX09  
             DBXXXX03  
             DBXXXX05  
             DBXXXX08  
             DBXXXX09  
             DBXXXX08  
             DBXXXX09  
             DBXXXX05  
             DBXXXX08  
             DBXXXX09  

                                 

    This should result in two columns (unfortunately slightly offset here, as there is no non-proportional font available).
    Now I have two questions:
    1. How can I make sure that the key is displayed in the first column of each row (or other fields, if I add them)?
    2. How can I make sure that only the CGGRPNM that start with the prefix in the select are displayed?


    Best regards
    Stephan                 



    ------------------------------
    Stephan Reichelt
    ------------------------------


  • 2.  RE: Creating a report in table structure

    Posted 3 days ago

    Hi Stephan,

    Re 1:
    You can use the RETAIN modifier to repeat the value of a non-repeated field on lines created by the multiple values in a repeated field.
    https://www.ibm.com/docs/en/szs/3.2.0?topic=SS2RWS_3.2.0/com.ibm.zsecure.doc_3.2.0/carla_lang/carla_cmnd_lang_list_family_cmds_nonrpt_out_mods.htm

    Re 2:
    You cannot apply output filtering to CGGRPNM, but you can to CONNECTS.
    The CONNECTS field display more information by default, but you can use an overriding length of 8 to only see the connected group [in the case of a user profile].

    Filtering CONNECTS uses the SUBSELECT function of the DEFINE command.
    https://www.ibm.com/docs/en/szs/3.2.0?topic=define-subselect-clauses

    You could do something like 

    define myconnects subselect connects(group=#tsol*)

    And then use MYCONNECTS instead of CGGRPNM.

    Regards,



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development Manager IBM zSecure
    Delft
    ------------------------------

    Original Message


  • 3.  RE: Creating a report in table structure

    Posted 3 days ago

    Hi Stephan, you already made a good start by yourself. 

    1. To repeat the selected user IDs on each line of your report, you need to add the RETAIN keyword to the NEWLIST statement. That repeart non repeating fields just as many times as there are repeat group entries for CGGRPNM.
    2. For only reporting the CGGRPNM that match the prefix your program uses, you can define a subselect variable based on the CONNECTS field. For example something along the lines of:

      define #TSOLconns(8) subselect connects(group=#TSOL*)
      And then replace use #TSOLconns in your sortlist instead of CGGRPNM.

    I hope this helps.



    ------------------------------
    Tom Zeehandelaar
    z/OS Security Enablement Specialist - zSecure developer
    IBM
    ------------------------------

    Original Message


  • 4.  RE: Creating a report in table structure

    Posted 3 days ago

    If you're struggling with repeated fields like the connect group names, or access lists, you can look at newlist type=racf_access.  This takes the connect group name (from a user profile), or the access list id (from a DATASET or General resource profile), and creates a separate entry for each.  It allows you to use the SELECT command to select only specific connects groups for users, without the hassle of SUBSELECT.

    newlist type=racf_access
      select class=group profile=dbx*
      sortlist id("Userid") profile("Connect")

    To find connect groups, you select CLASS=GROUP and the user ID pops up in the field ID.  But how can you find out if a user ID has a TSO segment?

    RACF_ACCESS can use the lookup operator to find attributes like the name of the user, the installation data of a group, but also fields from TSO segment.  No, you cannot check if a segment exists, but you must check a field in the segment.  Find a field in the TSO segment that always has a value... TMSIZE, for example.  And remember, the user ID is called ID:

    newlist type=racf_access
      select class=group profile=dbx* exists(id:tmsize)
      sortlist id("Userid") profile("Connect")

    Note: Changing the font to fixed pitch can be done by selecting (a few) lines, then marking them out as code by clicking {;} or by clicking on the ... button and selecting Preformatted instead of Paragraph.



    ------------------------------
    Rob van Hoboken
    ------------------------------

    Original Message


  • 5.  RE: Creating a report in table structure

    Posted 2 days ago

    Good morning,


    Thank you all very much for your quick support.
    I now have several possible solutions, which will also help me to better understand CARLA.


    Have a great weekend.


    Best regards
    Stephan



    ------------------------------
    Stephan Reichelt
    ------------------------------

    Original Message


Related Content